@rightkit/git 0.2.6 → 0.2.8

package/README.md

@@ -23,7 +23,7 @@ Sync records exact prior bytes, refuses unmanaged same-name workflows, & preflig
 
 ## Credential posture (read before enabling package-manager publishing)
 
-- **Signing credentials stay environment-scoped.** Opt-in Windows candidates use GitHub OIDC with Azure Artifact Signing. Opt-in macOS candidates use a temporary runner keychain plus Apple API-key notarization. npm publishing uses short-lived OIDC.
+- **Signing credentials stay environment-scoped.** Opt-in Windows candidates use GitHub OIDC with Azure Artifact Signing. Opt-in macOS candidates use a temporary runner keychain plus Apple API-key notarization. Signing jobs run only for `v*` tag refs; manual dispatch produces unsigned candidates only. npm publishing uses short-lived OIDC.
 - **Exception, disclosed:** the optional, opt-in `publish-package-managers` lane *does* require two owner-provisioned, long-lived tokens in GitHub Actions `secrets.*` (`HOMEBREW_TAP_TOKEN`, `WINGET_CREATE_GITHUB_TOKEN`) to open tap/manifest PRs. These are real bearer tokens, public-repo-scoped by the visibility gate but not zero-exposure. The "no signing credential in CI" invariant is specifically about code-signing material; it does not mean "no credential of any kind."
 
 Manifest input is treated as untrusted: every field flowing into rendered YAML is charset-allowlisted, so a manifest cannot inject `${{ secrets.* }}` or shell/expression syntax.
@@ -38,4 +38,6 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, signWindows?, signMacos? }`; `os` selects supported release hosts from main matrix. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets. Both use product-owned RightRelease finalization & never publish releases.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, signWindows?, signMacos?, releaseChain? }`; `os` selects supported release hosts from main matrix. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets.
+
+`releaseChain` lets RightGit own full protected DAG while product scripts own artifact semantics: `{ windowsFinalizeScript, macosFinalizeScript?, installedQualificationScript, publishScript, qualificationRunnerVariable, publishSecrets? }`. Generated ordering is unsigned candidate → platform signing/finalization → installed qualification → publication. Every protected job is tag-gated, publication needs successful installed qualification plus macOS finalization when enabled, & only publish job receives declared publication secrets plus `contents: write`.

package/manifest.mjs

@@ -61,6 +61,7 @@ const TOP_LEVEL_KEYS = new Set([
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
+const GITHUB_VARIABLE_RE = /^[A-Z][A-Z0-9_]*$/;
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -141,7 +142,7 @@ export function validateManifest(manifest) {
       errors.push("candidate must be an object");
     } else {
       for (const key of Object.keys(candidate)) {
-        if (!["buildScript", "checkScript", "artifactRoot", "os", "signWindows", "signMacos"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+        if (!["buildScript", "checkScript", "artifactRoot", "os", "signWindows", "signMacos", "releaseChain"].includes(key)) errors.push(`unknown candidate field: ${key}`);
       }
       for (const key of ["buildScript", "checkScript"]) {
         if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
@@ -171,6 +172,34 @@ export function validateManifest(manifest) {
       if ((candidate.signWindows === true || candidate.signMacos === true) && manifest.matrix?.node?.length !== 1) {
         errors.push("candidate signing requires exactly one matrix.node version");
       }
+      if (candidate.releaseChain !== undefined) {
+        const chain = candidate.releaseChain;
+        const allowedChainKeys = ["windowsFinalizeScript", "macosFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable", "publishSecrets"];
+        if (chain === null || typeof chain !== "object" || Array.isArray(chain)) {
+          errors.push("candidate.releaseChain must be an object");
+        } else {
+          for (const key of Object.keys(chain)) {
+            if (!allowedChainKeys.includes(key)) errors.push(`unknown candidate.releaseChain field: ${key}`);
+          }
+          for (const key of ["windowsFinalizeScript", "installedQualificationScript", "publishScript"]) {
+            if (typeof chain[key] !== "string" || !PACKAGE_SCRIPT_RE.test(chain[key])) {
+              errors.push(`candidate.releaseChain.${key} must be one safe package script name`);
+            }
+          }
+          if (chain.macosFinalizeScript !== undefined && (typeof chain.macosFinalizeScript !== "string" || !PACKAGE_SCRIPT_RE.test(chain.macosFinalizeScript))) {
+            errors.push("candidate.releaseChain.macosFinalizeScript must be one safe package script name");
+          }
+          if (typeof chain.qualificationRunnerVariable !== "string" || !GITHUB_VARIABLE_RE.test(chain.qualificationRunnerVariable)) {
+            errors.push("candidate.releaseChain.qualificationRunnerVariable must be one uppercase GitHub variable name");
+          }
+          if (chain.publishSecrets !== undefined && (!Array.isArray(chain.publishSecrets) || new Set(chain.publishSecrets).size !== chain.publishSecrets.length || chain.publishSecrets.some((value) => typeof value !== "string" || !GITHUB_VARIABLE_RE.test(value)))) {
+            errors.push("candidate.releaseChain.publishSecrets must be unique uppercase GitHub secret names");
+          }
+          if (candidate.signWindows !== true) errors.push("candidate.releaseChain requires candidate.signWindows=true");
+          if (candidate.signMacos === true && !chain.macosFinalizeScript) errors.push("candidate.releaseChain with candidate.signMacos=true requires macosFinalizeScript");
+          if (chain.macosFinalizeScript && candidate.signMacos !== true) errors.push("candidate.releaseChain.macosFinalizeScript requires candidate.signMacos=true");
+        }
+      }
     }
   }
   if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
@@ -323,9 +352,23 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signWindows !== true) return "";
   const windowsRunner = manifest.candidate.os.find((value) => /^windows-/i.test(value));
   const nodeVersion = String(manifest.matrix.node[0]);
+  const releaseChain = manifest.candidate.releaseChain;
+  const finalizeCommand = releaseChain
+    ? `${pm.runPrefix} ${releaseChain.windowsFinalizeScript}`
+    : "pnpm exec right-release build --platform win --skip-checks";
+  const finalizeEnvironment = releaseChain
+    ? `          RIGHT_GIT_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/finalized-windows
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`
+    : `          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
+          LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`;
+  const uploadPath = releaseChain
+    ? "            ${{ runner.temp }}/finalized-windows/**"
+    : "            dist/releases/windows/**\n            .right-release/receipts/windows-*.json";
   return `
   windows-sign:
     needs: [candidate]
+    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
     environment: release
     runs-on: ${windowsRunner}
     permissions:
@@ -333,6 +376,9 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Resolve checked-out source revision
+        shell: pwsh
+        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${nodeVersion}
@@ -370,10 +416,9 @@ ${pm.setup}
           "AZURE_ARTIFACT_SIGNING_DLIB_PATH=$tools\\client\\bin\\x64\\Azure.CodeSigning.Dlib.dll" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
           "AZURE_SIGNTOOL_PATH=$tools\\sdk\\bin\\10.0.26100.0\\x64\\signtool.exe" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
       - name: Sign & finalize Windows candidate
-        run: pnpm exec right-release build --platform win --skip-checks
+        run: ${finalizeCommand}
         env:
-          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
-          LEGION_SOURCE_REVISION: \${{ github.sha }}
+${finalizeEnvironment}
           AZURE_ARTIFACT_SIGNING_ENDPOINT: \${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
           AZURE_ARTIFACT_SIGNING_ACCOUNT: \${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
           AZURE_ARTIFACT_SIGNING_PROFILE: \${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
@@ -382,8 +427,7 @@ ${pm.setup}
         with:
           name: ${artifactPrefix}-signed-windows-${nodeVersion}
           path: |
-            dist/releases/windows/**
-            .right-release/receipts/windows-*.json
+${uploadPath}
           if-no-files-found: error
 `.trimEnd();
 }
@@ -392,15 +436,32 @@ function macosSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signMacos !== true) return "";
   const macosRunner = manifest.candidate.os.find((value) => /^macos-/i.test(value));
   const nodeVersion = String(manifest.matrix.node[0]);
+  const releaseChain = manifest.candidate.releaseChain;
+  const finalizeCommand = releaseChain
+    ? `${pm.runPrefix} ${releaseChain.macosFinalizeScript}`
+    : "pnpm exec right-release build --platform mac --skip-checks";
+  const finalizeEnvironment = releaseChain
+    ? `          RIGHT_GIT_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
+          RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/finalized-macos
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`
+    : `          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
+          LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`;
+  const uploadPath = releaseChain
+    ? "            ${{ runner.temp }}/finalized-macos/**"
+    : "            dist/releases/mac/**\n            .right-release/receipts/macos-*.json";
   return `
   macos-sign:
     needs: [candidate]
+    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
     environment: release
     runs-on: ${macosRunner}
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Resolve checked-out source revision
+        shell: bash
+        run: printf 'RIGHT_GIT_SOURCE_REVISION=%s\\n' "$(git rev-parse HEAD)" >> "$GITHUB_ENV"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${nodeVersion}
@@ -437,10 +498,9 @@ ${pm.setup}
           security list-keychain -d user -s "$keychain_path"
           printf 'APPLE_API_KEY_PATH=%s\\n' "$key_path" >> "$GITHUB_ENV"
       - name: Sign, notarize & finalize macOS candidate
-        run: pnpm exec right-release build --platform mac --skip-checks
+        run: ${finalizeCommand}
         env:
-          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
-          LEGION_SOURCE_REVISION: \${{ github.sha }}
+${finalizeEnvironment}
           APPLE_DEVELOPER_ID: \${{ vars.APPLE_DEVELOPER_ID }}
           APPLE_API_KEY: \${{ secrets.APPLE_API_KEY }}
           APPLE_API_ISSUER: \${{ secrets.APPLE_API_ISSUER }}
@@ -449,8 +509,7 @@ ${pm.setup}
         with:
           name: ${artifactPrefix}-signed-macos-${nodeVersion}
           path: |
-            dist/releases/mac/**
-            .right-release/receipts/macos-*.json
+${uploadPath}
           if-no-files-found: error
       - name: Remove Apple signing material
         if: \${{ always() }}
@@ -461,6 +520,102 @@ ${pm.setup}
 `.trimEnd();
 }
 
+function releaseChainJobs(manifest, pm, artifactPrefix) {
+  const chain = manifest.candidate?.releaseChain;
+  if (!chain) return "";
+  const windowsRunner = manifest.candidate.os.find((value) => /^windows-/i.test(value));
+  const nodeVersion = String(manifest.matrix.node[0]);
+  const macosDependency = manifest.candidate.signMacos === true ? ", macos-sign" : "";
+  const macosSuccess = manifest.candidate.signMacos === true ? " && needs.macos-sign.result == 'success'" : "";
+  const macosDownload = manifest.candidate.signMacos === true
+    ? `      - name: Download same-run signed & notarized macOS release
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-signed-macos-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/macos`
+    : "";
+  const publishSecretEnvironment = (chain.publishSecrets ?? [])
+    .map((name) => `          ${name}: \${{ secrets.${name} }}`)
+    .join("\n");
+  return `
+  installed-qualification:
+    needs: [candidate, windows-sign]
+    if: \${{ always() && startsWith(github.ref, 'refs/tags/v') && needs.candidate.result == 'success' }}
+    environment: release
+    runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Resolve checked-out source revision
+        shell: pwsh
+        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+      - name: Fail closed when protected finalization is absent
+        if: \${{ needs.windows-sign.result != 'success' }}
+        shell: pwsh
+        run: throw 'installed_qualification_failed { reason: prerequisites_absent, detail: "same-run Windows signing/finalization did not succeed" }'
+      - name: Download same-run finalized Windows release
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-signed-windows-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/windows
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${nodeVersion}
+          package-manager-cache: false
+${pm.setup}
+      - run: ${pm.installCommand}
+      - name: Run installed-artifact qualification
+        run: ${pm.runPrefix} ${chain.installedQualificationScript}
+        env:
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
+          RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+      - name: Upload installed qualification evidence
+        uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
+        with:
+          name: ${artifactPrefix}-installed-qualification-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/qualification/**
+          if-no-files-found: error
+  publish:
+    needs: [installed-qualification${macosDependency}]
+    if: \${{ startsWith(github.ref, 'refs/tags/v') && needs.installed-qualification.result == 'success'${macosSuccess} }}
+    environment: release
+    runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Resolve checked-out source revision
+        shell: pwsh
+        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+      - name: Download same-run finalized Windows release
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-signed-windows-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/windows
+${macosDownload}
+      - name: Download same-run installed qualification evidence
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-installed-qualification-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/qualification
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${nodeVersion}
+          package-manager-cache: false
+${pm.setup}
+      - run: ${pm.installCommand}
+      - name: Publish qualified signed release
+        run: ${pm.runPrefix} ${chain.publishScript}
+        env:
+          GH_TOKEN: \${{ github.token }}
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
+          RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/right-git-release/macos
+          RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+${publishSecretEnvironment}
+`.trimEnd();
+}
+
 /**
  * Derive one project name from the target repo's package.json, falling back
  * to the repo directory's basename. Never throws.
@@ -507,6 +662,7 @@ export function buildRenderContext(manifest, repoPath) {
     CANDIDATE_MATRIX: candidateMatrix(manifest),
     WINDOWS_SIGNING_JOB: windowsSigningJob(manifest, pm, artifactPrefix),
     MACOS_SIGNING_JOB: macosSigningJob(manifest, pm, artifactPrefix),
+    RELEASE_CHAIN_JOBS: releaseChainJobs(manifest, pm, artifactPrefix),
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -96,7 +96,24 @@
         "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" },
         "os": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
         "signWindows": { "type": "boolean" },
-        "signMacos": { "type": "boolean" }
+        "signMacos": { "type": "boolean" },
+        "releaseChain": {
+          "type": "object",
+          "required": ["windowsFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable"],
+          "additionalProperties": false,
+          "properties": {
+            "windowsFinalizeScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "macosFinalizeScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "installedQualificationScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "publishScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "qualificationRunnerVariable": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
+            "publishSecrets": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
+            }
+          }
+        }
       }
     }
   }

package/manifest.test.mjs

@@ -41,6 +41,25 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, os: ["windows-latest"] } }).valid, false);
+
+  const releaseChain = {
+    ...windowsCandidate,
+    candidate: {
+      ...windowsCandidate.candidate,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:win",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+  };
+  assert.equal(validateManifest(releaseChain).valid, true);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, signWindows: false } }).valid, false);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, publishScript: "echo unsafe" } } }).valid, false);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, qualificationRunnerVariable: "${{ secrets.X }}" } } }).valid, false);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, publishSecrets: ["TOKEN", "TOKEN"] } } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -90,11 +90,15 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /environment: release/);
+  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
   assert.match(content, /id-token: write/);
   assert.match(content, /azure\/login@[a-f0-9]{40}/);
   assert.match(content, /vars\.AZURE_CLIENT_ID/);
   assert.match(content, /right-release build --platform win --skip-checks/);
   assert.match(content, /Artifact Signing client hash mismatch/);
+  assert.match(content, /RIGHT_GIT_SOURCE_REVISION=\$\(git rev-parse HEAD\)/);
+  assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
+  assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.doesNotMatch(content, /secrets\.|client-secret|private.key/i);
 });
 
@@ -113,15 +117,63 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /macos-sign:/);
+  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
   assert.match(content, /environment: release/);
   assert.match(content, /secrets\.APPLE_CERTIFICATE_BASE64/);
   assert.match(content, /temporary keychain/i);
   assert.match(content, /right-release build --platform mac --skip-checks/);
   assert.match(content, /secrets\.APPLE_API_KEY_BASE64/);
+  assert.match(content, /RIGHT_GIT_SOURCE_REVISION=%s\\n.*git rev-parse HEAD/);
+  assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
+  assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.match(content, /security delete-keychain/);
   assert.doesNotMatch(content, /pull_request_target/);
 });
 
+test("rust-hybrid release chain preserves signed candidate, installed qualification, then publish", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:win",
+        macosFinalizeScript: "release:finalize:mac",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.4.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /windows-sign:[\s\S]*pnpm run release:finalize:win/);
+  assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
+  assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
+  assert.match(content, /installed_qualification_failed/);
+  assert.match(content, /pnpm run release:qualify:installed/);
+  assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
+  assert.match(content, /needs\.macos-sign\.result == 'success'/);
+  assert.match(content, /contents: write/);
+  assert.match(content, /pnpm run release:publish:qualified/);
+  assert.match(content, /CLOUDFLARE_API_TOKEN: \$\{\{ secrets\.CLOUDFLARE_API_TOKEN \}\}/);
+  assert.equal((content.match(/RIGHT_GIT_SOURCE_REVISION=\$\(git rev-parse HEAD\)/g) ?? []).length, 3);
+  assert.doesNotMatch(content, /RIGHT_GIT_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
+  assert.doesNotMatch(content.slice(0, content.indexOf("  windows-sign:")), /secrets\.|id-token: write|contents: write/);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -58,3 +58,4 @@ ${PACKAGE_MANAGER_SETUP}
           if-no-files-found: error
 ${WINDOWS_SIGNING_JOB}
 ${MACOS_SIGNING_JOB}
+${RELEASE_CHAIN_JOBS}