@rightkit/git 0.2.7 → 0.2.9

package/README.md

@@ -23,7 +23,7 @@ Sync records exact prior bytes, refuses unmanaged same-name workflows, & preflig
 
 ## Credential posture (read before enabling package-manager publishing)
 
-- **Signing credentials stay environment-scoped.** Opt-in Windows candidates use GitHub OIDC with Azure Artifact Signing. Opt-in macOS candidates use a temporary runner keychain plus Apple API-key notarization. npm publishing uses short-lived OIDC.
+- **Signing credentials stay environment-scoped.** Opt-in Windows candidates use GitHub OIDC with Azure Artifact Signing. Opt-in macOS candidates use a temporary runner keychain plus Apple API-key notarization. Signing jobs run only for `v*` tag refs; manual dispatch produces unsigned candidates only. npm publishing uses short-lived OIDC.
 - **Exception, disclosed:** the optional, opt-in `publish-package-managers` lane *does* require two owner-provisioned, long-lived tokens in GitHub Actions `secrets.*` (`HOMEBREW_TAP_TOKEN`, `WINGET_CREATE_GITHUB_TOKEN`) to open tap/manifest PRs. These are real bearer tokens, public-repo-scoped by the visibility gate but not zero-exposure. The "no signing credential in CI" invariant is specifically about code-signing material; it does not mean "no credential of any kind."
 
 Manifest input is treated as untrusted: every field flowing into rendered YAML is charset-allowlisted, so a manifest cannot inject `${{ secrets.* }}` or shell/expression syntax.
@@ -38,4 +38,6 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, signWindows?, signMacos? }`; `os` selects supported release hosts from main matrix. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets. Both use product-owned RightRelease finalization & never publish releases.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, targets?, signWindows?, signMacos?, releaseChain? }`. Legacy `os` remains supported & derives one target per runner; explicit `targets` is `{ os, platform, architecture }[]`, independent of main CI matrix. Each target maps to native runner, Rust target triple, exact unsigned artifact, & platform signing matrix. Supported platform values are `windows`, `macos`, `linux`; architectures are `x86_64`, `arm64`. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets.
+
+`releaseChain` lets RightGit own full protected DAG while product scripts own artifact semantics: `{ windowsFinalizeScript, macosFinalizeScript?, installedQualificationScript, publishScript, qualificationRunnerVariable, publishSecrets? }`. Generated ordering is unsigned candidate → platform signing/finalization → installed qualification → publication. It deliberately rejects more than one Windows target or more than one macOS target because its installed-qualification/publish handoff has one canonical signed artifact per platform. Every protected job is tag-gated, publication needs successful installed qualification plus macOS finalization when enabled, & only publish job receives declared publication secrets plus `contents: write`.

package/manifest.mjs

@@ -61,6 +61,24 @@ const TOP_LEVEL_KEYS = new Set([
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
+const GITHUB_VARIABLE_RE = /^[A-Z][A-Z0-9_]*$/;
+const RELEASE_PLATFORMS = new Set(["windows", "macos", "linux"]);
+const RELEASE_ARCHITECTURES = new Set(["x86_64", "arm64"]);
+const NATIVE_RUNNER_TARGETS = new Map([
+  ["windows-2025", ["windows", "x86_64"]],
+  ["windows-11-arm", ["windows", "arm64"]],
+  ["macos-15", ["macos", "arm64"]],
+  ["macos-15-intel", ["macos", "x86_64"]],
+]);
+
+function inferredTarget(os) {
+  const platform = /^windows-/i.test(os) ? "windows" : /^macos-/i.test(os) ? "macos" : "linux";
+  return { os, platform, architecture: platform === "macos" ? "arm64" : "x86_64" };
+}
+
+function candidateTargets(candidate) {
+  return Array.isArray(candidate?.targets) ? candidate.targets : (candidate?.os ?? []).map(inferredTarget);
+}
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -141,7 +159,7 @@ export function validateManifest(manifest) {
       errors.push("candidate must be an object");
     } else {
       for (const key of Object.keys(candidate)) {
-        if (!["buildScript", "checkScript", "artifactRoot", "os", "signWindows", "signMacos"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+        if (!["buildScript", "checkScript", "artifactRoot", "os", "targets", "signWindows", "signMacos", "releaseChain"].includes(key)) errors.push(`unknown candidate field: ${key}`);
       }
       for (const key of ["buildScript", "checkScript"]) {
         if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
@@ -153,24 +171,87 @@ export function validateManifest(manifest) {
       }
       if (!Array.isArray(candidate.os) || candidate.os.length === 0 || candidate.os.some((value) => typeof value !== "string" || !SAFE_MATRIX_VALUE_RE.test(value))) {
         errors.push("candidate.os must be a non-empty array of safe runner labels");
-      } else if (candidate.os.some((value) => !manifest.matrix?.os?.includes(value))) {
+      } else if (candidate.targets === undefined && candidate.os.some((value) => !manifest.matrix?.os?.includes(value))) {
         errors.push("candidate.os entries must also exist in matrix.os");
       }
+      if (candidate.targets !== undefined) {
+        if (!Array.isArray(candidate.targets) || candidate.targets.length === 0) {
+          errors.push("candidate.targets must be a non-empty array");
+        } else {
+          const targetKeys = new Set();
+          for (const target of candidate.targets) {
+            if (target === null || typeof target !== "object" || Array.isArray(target)) {
+              errors.push("candidate.targets entries must be objects");
+              continue;
+            }
+            if (Object.keys(target).some((key) => !["os", "platform", "architecture"].includes(key))) errors.push("candidate.targets entries may only contain os, platform, architecture");
+            if (typeof target.os !== "string" || !SAFE_MATRIX_VALUE_RE.test(target.os)) errors.push("candidate.targets[].os must be a safe runner label");
+            if (!RELEASE_PLATFORMS.has(target.platform)) errors.push("candidate.targets[].platform must be windows, macos, or linux");
+            if (!RELEASE_ARCHITECTURES.has(target.architecture)) errors.push("candidate.targets[].architecture must be x86_64 or arm64");
+            const nativeTarget = NATIVE_RUNNER_TARGETS.get(target.os);
+            if (nativeTarget && (target.platform !== nativeTarget[0] || target.architecture !== nativeTarget[1])) {
+              errors.push(`candidate.targets[] must declare ${target.os} as ${nativeTarget[0]}/${nativeTarget[1]}`);
+            }
+            if ((target.platform === "windows" && !/^windows-/i.test(target.os)) || (target.platform === "macos" && !/^macos-/i.test(target.os))) {
+              errors.push("candidate.targets[].os must match its Windows or macOS platform");
+            }
+            const targetKey = `${target.os}|${target.platform}|${target.architecture}`;
+            if (targetKeys.has(targetKey)) errors.push("candidate.targets entries must be unique");
+            targetKeys.add(targetKey);
+          }
+          const targetOs = new Set(candidate.targets.map((target) => target?.os));
+          if (candidate.os.some((os) => !targetOs.has(os)) || targetOs.size !== new Set(candidate.os).size || candidate.os.length !== new Set(candidate.os).size) {
+            errors.push("candidate.os must contain exactly candidate.targets runner labels");
+          }
+        }
+      }
+      const targets = candidateTargets(candidate);
       if (candidate.signWindows !== undefined && typeof candidate.signWindows !== "boolean") {
         errors.push("candidate.signWindows must be a boolean");
       }
-      if (candidate.signWindows === true && candidate.os.filter((value) => /^windows-/i.test(value)).length !== 1) {
-        errors.push("candidate.signWindows requires exactly one Windows runner in candidate.os");
+      if (candidate.signWindows === true && targets.filter((target) => target?.platform === "windows").length === 0) {
+        errors.push("candidate.signWindows requires at least one Windows target");
       }
       if (candidate.signMacos !== undefined && typeof candidate.signMacos !== "boolean") {
         errors.push("candidate.signMacos must be a boolean");
       }
-      if (candidate.signMacos === true && candidate.os.filter((value) => /^macos-/i.test(value)).length !== 1) {
-        errors.push("candidate.signMacos requires exactly one macOS runner in candidate.os");
+      if (candidate.signMacos === true && targets.filter((target) => target?.platform === "macos").length === 0) {
+        errors.push("candidate.signMacos requires at least one macOS target");
       }
       if ((candidate.signWindows === true || candidate.signMacos === true) && manifest.matrix?.node?.length !== 1) {
         errors.push("candidate signing requires exactly one matrix.node version");
       }
+      if (candidate.releaseChain !== undefined) {
+        const chain = candidate.releaseChain;
+        const allowedChainKeys = ["windowsFinalizeScript", "macosFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable", "publishSecrets"];
+        if (chain === null || typeof chain !== "object" || Array.isArray(chain)) {
+          errors.push("candidate.releaseChain must be an object");
+        } else {
+          for (const key of Object.keys(chain)) {
+            if (!allowedChainKeys.includes(key)) errors.push(`unknown candidate.releaseChain field: ${key}`);
+          }
+          for (const key of ["windowsFinalizeScript", "installedQualificationScript", "publishScript"]) {
+            if (typeof chain[key] !== "string" || !PACKAGE_SCRIPT_RE.test(chain[key])) {
+              errors.push(`candidate.releaseChain.${key} must be one safe package script name`);
+            }
+          }
+          if (chain.macosFinalizeScript !== undefined && (typeof chain.macosFinalizeScript !== "string" || !PACKAGE_SCRIPT_RE.test(chain.macosFinalizeScript))) {
+            errors.push("candidate.releaseChain.macosFinalizeScript must be one safe package script name");
+          }
+          if (typeof chain.qualificationRunnerVariable !== "string" || !GITHUB_VARIABLE_RE.test(chain.qualificationRunnerVariable)) {
+            errors.push("candidate.releaseChain.qualificationRunnerVariable must be one uppercase GitHub variable name");
+          }
+          if (chain.publishSecrets !== undefined && (!Array.isArray(chain.publishSecrets) || new Set(chain.publishSecrets).size !== chain.publishSecrets.length || chain.publishSecrets.some((value) => typeof value !== "string" || !GITHUB_VARIABLE_RE.test(value)))) {
+            errors.push("candidate.releaseChain.publishSecrets must be unique uppercase GitHub secret names");
+          }
+          if (candidate.signWindows !== true) errors.push("candidate.releaseChain requires candidate.signWindows=true");
+          if (targets.filter((target) => target?.platform === "windows").length !== 1 || targets.filter((target) => target?.platform === "macos").length > 1) {
+            errors.push("candidate.releaseChain requires at most one target per signing platform; multi-target aggregation is not supported");
+          }
+          if (candidate.signMacos === true && !chain.macosFinalizeScript) errors.push("candidate.releaseChain with candidate.signMacos=true requires macosFinalizeScript");
+          if (chain.macosFinalizeScript && candidate.signMacos !== true) errors.push("candidate.releaseChain.macosFinalizeScript requires candidate.signMacos=true");
+        }
+      }
     }
   }
   if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
@@ -295,10 +376,8 @@ function yamlFlowStringList(values) {
 
 function candidateMatrix(manifest) {
   const entries = [];
-  for (const os of manifest.candidate?.os ?? manifest.matrix.os) {
-    const platform = /^windows-/i.test(os) ? "windows" : /^macos-/i.test(os) ? "macos" : "linux";
-    const architecture = platform === "macos" ? "arm64" : "x86_64";
-    for (const node of manifest.matrix.node) entries.push({ os, node, platform, architecture });
+  for (const target of candidateTargets(manifest.candidate ?? { os: manifest.matrix.os })) {
+    for (const node of manifest.matrix.node) entries.push({ ...target, node, targetTriple: targetTriple(target) });
   }
   return [
     "        include:",
@@ -307,6 +386,31 @@ function candidateMatrix(manifest) {
       `            node: ${JSON.stringify(entry.node)}`,
       `            platform: ${JSON.stringify(entry.platform)}`,
       `            architecture: ${JSON.stringify(entry.architecture)}`,
+      `            targetTriple: ${JSON.stringify(entry.targetTriple)}`,
+    ]),
+  ].join("\n");
+}
+
+function targetTriple(target) {
+  const rustArchitecture = target.architecture === "arm64" ? "aarch64" : target.architecture;
+  if (target.platform === "windows") return `${rustArchitecture}-pc-windows-msvc`;
+  if (target.platform === "macos") return `${rustArchitecture}-apple-darwin`;
+  return `${rustArchitecture}-unknown-linux-gnu`;
+}
+
+function signingMatrix(manifest, platform) {
+  const node = String(manifest.matrix.node[0]);
+  const entries = candidateTargets(manifest.candidate)
+    .filter((target) => target.platform === platform)
+    .map((target) => ({ ...target, node, targetTriple: targetTriple(target) }));
+  return [
+    "        include:",
+    ...entries.flatMap((entry) => [
+      `          - os: ${JSON.stringify(entry.os)}`,
+      `            platform: ${JSON.stringify(entry.platform)}`,
+      `            architecture: ${JSON.stringify(entry.architecture)}`,
+      `            targetTriple: ${JSON.stringify(entry.targetTriple)}`,
+      `            node: ${JSON.stringify(entry.node)}`,
     ]),
   ].join("\n");
 }
@@ -321,13 +425,30 @@ const WINDOWS_SDK_BUILD_TOOLS_SHA256 = "180DEB372659029864C10A0C04787833234D64AA
 
 function windowsSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signWindows !== true) return "";
-  const windowsRunner = manifest.candidate.os.find((value) => /^windows-/i.test(value));
   const nodeVersion = String(manifest.matrix.node[0]);
+  const releaseChain = manifest.candidate.releaseChain;
+  const finalizeCommand = releaseChain
+    ? `${pm.runPrefix} ${releaseChain.windowsFinalizeScript}`
+    : "pnpm exec right-release build --platform win --skip-checks";
+  const finalizeEnvironment = releaseChain
+    ? `          RIGHT_GIT_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/finalized-windows
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`
+    : `          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
+          LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`;
+  const uploadPath = releaseChain
+    ? "            ${{ runner.temp }}/finalized-windows/**"
+    : "            dist/releases/windows/**\n            .right-release/receipts/windows-*.json";
   return `
   windows-sign:
     needs: [candidate]
+    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
     environment: release
-    runs-on: ${windowsRunner}
+    strategy:
+      fail-fast: false
+      matrix:
+${signingMatrix(manifest, "windows")}
+    runs-on: \${{ matrix.os }}
     permissions:
       contents: read
       id-token: write
@@ -344,11 +465,12 @@ ${pm.setup}
       - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
         with:
           toolchain: 1.98.0
+          targets: \${{ matrix.targetTriple }}
       - run: ${pm.installCommand}
       - name: Download exact unsigned Windows candidate
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-unsigned-${windowsRunner}-${nodeVersion}
+          name: ${artifactPrefix}-unsigned-\${{ matrix.platform }}-\${{ matrix.architecture }}-${nodeVersion}
           path: \${{ runner.temp }}/unsigned-windows-candidate
       - name: Authenticate to Azure with GitHub OIDC
         uses: azure/login@${AZURE_LOGIN_SHA} # v3
@@ -373,33 +495,50 @@ ${pm.setup}
           "AZURE_ARTIFACT_SIGNING_DLIB_PATH=$tools\\client\\bin\\x64\\Azure.CodeSigning.Dlib.dll" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
           "AZURE_SIGNTOOL_PATH=$tools\\sdk\\bin\\10.0.26100.0\\x64\\signtool.exe" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
       - name: Sign & finalize Windows candidate
-        run: pnpm exec right-release build --platform win --skip-checks
+        run: ${finalizeCommand}
         env:
-          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-windows-candidate
-          LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+${finalizeEnvironment}
+          RIGHT_GIT_RELEASE_PLATFORM: \${{ matrix.platform }}
+          RIGHT_GIT_RELEASE_ARCHITECTURE: \${{ matrix.architecture }}
           AZURE_ARTIFACT_SIGNING_ENDPOINT: \${{ vars.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
           AZURE_ARTIFACT_SIGNING_ACCOUNT: \${{ vars.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
           AZURE_ARTIFACT_SIGNING_PROFILE: \${{ vars.AZURE_ARTIFACT_SIGNING_PROFILE }}
       - name: Upload signed Windows candidate
         uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
         with:
-          name: ${artifactPrefix}-signed-windows-${nodeVersion}
+          name: ${artifactPrefix}-signed-windows-\${{ matrix.architecture }}-${nodeVersion}
           path: |
-            dist/releases/windows/**
-            .right-release/receipts/windows-*.json
+${uploadPath}
           if-no-files-found: error
 `.trimEnd();
 }
 
 function macosSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signMacos !== true) return "";
-  const macosRunner = manifest.candidate.os.find((value) => /^macos-/i.test(value));
   const nodeVersion = String(manifest.matrix.node[0]);
+  const releaseChain = manifest.candidate.releaseChain;
+  const finalizeCommand = releaseChain
+    ? `${pm.runPrefix} ${releaseChain.macosFinalizeScript}`
+    : "pnpm exec right-release build --platform mac --skip-checks";
+  const finalizeEnvironment = releaseChain
+    ? `          RIGHT_GIT_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
+          RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/finalized-macos
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`
+    : `          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
+          LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}`;
+  const uploadPath = releaseChain
+    ? "            ${{ runner.temp }}/finalized-macos/**"
+    : "            dist/releases/mac/**\n            .right-release/receipts/macos-*.json";
   return `
   macos-sign:
     needs: [candidate]
+    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
     environment: release
-    runs-on: ${macosRunner}
+    strategy:
+      fail-fast: false
+      matrix:
+${signingMatrix(manifest, "macos")}
+    runs-on: \${{ matrix.os }}
     permissions:
       contents: read
     steps:
@@ -415,11 +554,12 @@ ${pm.setup}
       - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
         with:
           toolchain: 1.98.0
+          targets: \${{ matrix.targetTriple }}
       - run: ${pm.installCommand}
       - name: Download exact unsigned macOS candidate
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:
-          name: ${artifactPrefix}-unsigned-${macosRunner}-${nodeVersion}
+          name: ${artifactPrefix}-unsigned-\${{ matrix.platform }}-\${{ matrix.architecture }}-${nodeVersion}
           path: \${{ runner.temp }}/unsigned-macos-candidate
       - name: Install Apple signing identity in temporary keychain
         shell: bash
@@ -443,20 +583,20 @@ ${pm.setup}
           security list-keychain -d user -s "$keychain_path"
           printf 'APPLE_API_KEY_PATH=%s\\n' "$key_path" >> "$GITHUB_ENV"
       - name: Sign, notarize & finalize macOS candidate
-        run: pnpm exec right-release build --platform mac --skip-checks
+        run: ${finalizeCommand}
         env:
-          LEGION_UNSIGNED_CANDIDATE_ROOT: \${{ runner.temp }}/unsigned-macos-candidate
-          LEGION_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+${finalizeEnvironment}
+          RIGHT_GIT_RELEASE_PLATFORM: \${{ matrix.platform }}
+          RIGHT_GIT_RELEASE_ARCHITECTURE: \${{ matrix.architecture }}
           APPLE_DEVELOPER_ID: \${{ vars.APPLE_DEVELOPER_ID }}
           APPLE_API_KEY: \${{ secrets.APPLE_API_KEY }}
           APPLE_API_ISSUER: \${{ secrets.APPLE_API_ISSUER }}
       - name: Upload signed & notarized macOS candidate
         uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
         with:
-          name: ${artifactPrefix}-signed-macos-${nodeVersion}
+          name: ${artifactPrefix}-signed-macos-\${{ matrix.architecture }}-${nodeVersion}
           path: |
-            dist/releases/mac/**
-            .right-release/receipts/macos-*.json
+${uploadPath}
           if-no-files-found: error
       - name: Remove Apple signing material
         if: \${{ always() }}
@@ -467,6 +607,105 @@ ${pm.setup}
 `.trimEnd();
 }
 
+function releaseChainJobs(manifest, pm, artifactPrefix) {
+  const chain = manifest.candidate?.releaseChain;
+  if (!chain) return "";
+  const windowsTarget = candidateTargets(manifest.candidate).find((target) => target.platform === "windows");
+  const windowsRunner = windowsTarget.os;
+  const windowsArchitecture = windowsTarget.architecture;
+  const macosTarget = candidateTargets(manifest.candidate).find((target) => target.platform === "macos");
+  const nodeVersion = String(manifest.matrix.node[0]);
+  const macosDependency = manifest.candidate.signMacos === true ? ", macos-sign" : "";
+  const macosSuccess = manifest.candidate.signMacos === true ? " && needs.macos-sign.result == 'success'" : "";
+  const macosDownload = manifest.candidate.signMacos === true
+    ? `      - name: Download same-run signed & notarized macOS release
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-signed-macos-${macosTarget.architecture}-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/macos`
+    : "";
+  const publishSecretEnvironment = (chain.publishSecrets ?? [])
+    .map((name) => `          ${name}: \${{ secrets.${name} }}`)
+    .join("\n");
+  return `
+  installed-qualification:
+    needs: [candidate, windows-sign]
+    if: \${{ always() && startsWith(github.ref, 'refs/tags/v') && needs.candidate.result == 'success' }}
+    environment: release
+    runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Resolve checked-out source revision
+        shell: pwsh
+        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+      - name: Fail closed when protected finalization is absent
+        if: \${{ needs.windows-sign.result != 'success' }}
+        shell: pwsh
+        run: throw 'installed_qualification_failed { reason: prerequisites_absent, detail: "same-run Windows signing/finalization did not succeed" }'
+      - name: Download same-run finalized Windows release
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-signed-windows-${windowsArchitecture}-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/windows
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${nodeVersion}
+          package-manager-cache: false
+${pm.setup}
+      - run: ${pm.installCommand}
+      - name: Run installed-artifact qualification
+        run: ${pm.runPrefix} ${chain.installedQualificationScript}
+        env:
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
+          RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+      - name: Upload installed qualification evidence
+        uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4
+        with:
+          name: ${artifactPrefix}-installed-qualification-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/qualification/**
+          if-no-files-found: error
+  publish:
+    needs: [installed-qualification${macosDependency}]
+    if: \${{ startsWith(github.ref, 'refs/tags/v') && needs.installed-qualification.result == 'success'${macosSuccess} }}
+    environment: release
+    runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Resolve checked-out source revision
+        shell: pwsh
+        run: '"RIGHT_GIT_SOURCE_REVISION=$(git rev-parse HEAD)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append'
+      - name: Download same-run finalized Windows release
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-signed-windows-${windowsArchitecture}-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/windows
+${macosDownload}
+      - name: Download same-run installed qualification evidence
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: ${artifactPrefix}-installed-qualification-${nodeVersion}
+          path: \${{ runner.temp }}/right-git-release/qualification
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${nodeVersion}
+          package-manager-cache: false
+${pm.setup}
+      - run: ${pm.installCommand}
+      - name: Publish qualified signed release
+        run: ${pm.runPrefix} ${chain.publishScript}
+        env:
+          GH_TOKEN: \${{ github.token }}
+          RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
+          RIGHT_GIT_FINALIZED_MACOS_ROOT: \${{ runner.temp }}/right-git-release/macos
+          RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
+          RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
+${publishSecretEnvironment}
+`.trimEnd();
+}
+
 /**
  * Derive one project name from the target repo's package.json, falling back
  * to the repo directory's basename. Never throws.
@@ -513,6 +752,7 @@ export function buildRenderContext(manifest, repoPath) {
     CANDIDATE_MATRIX: candidateMatrix(manifest),
     WINDOWS_SIGNING_JOB: windowsSigningJob(manifest, pm, artifactPrefix),
     MACOS_SIGNING_JOB: macosSigningJob(manifest, pm, artifactPrefix),
+    RELEASE_CHAIN_JOBS: releaseChainJobs(manifest, pm, artifactPrefix),
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -95,8 +95,39 @@
         "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
         "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" },
         "os": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
+        "targets": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["os", "platform", "architecture"],
+            "additionalProperties": false,
+            "properties": {
+              "os": { "type": "string", "minLength": 1 },
+              "platform": { "enum": ["windows", "macos", "linux"] },
+              "architecture": { "enum": ["x86_64", "arm64"] }
+            }
+          }
+        },
         "signWindows": { "type": "boolean" },
-        "signMacos": { "type": "boolean" }
+        "signMacos": { "type": "boolean" },
+        "releaseChain": {
+          "type": "object",
+          "required": ["windowsFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable"],
+          "additionalProperties": false,
+          "properties": {
+            "windowsFinalizeScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "macosFinalizeScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "installedQualificationScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "publishScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+            "qualificationRunnerVariable": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
+            "publishSecrets": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
+            }
+          }
+        }
       }
     }
   }

package/manifest.test.mjs

@@ -41,6 +41,54 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, os: ["windows-latest"] } }).valid, false);
+
+  const releaseChain = {
+    ...windowsCandidate,
+    candidate: {
+      ...windowsCandidate.candidate,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:win",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+  };
+  assert.equal(validateManifest(releaseChain).valid, true);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, signWindows: false } }).valid, false);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, publishScript: "echo unsafe" } } }).valid, false);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, qualificationRunnerVariable: "${{ secrets.X }}" } } }).valid, false);
+  assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, publishSecrets: ["TOKEN", "TOKEN"] } } }).valid, false);
+});
+
+test("candidate targets permit native multi-architecture matrices independent of normal CI runners", () => {
+  const multiArchitecture = {
+    ...VALID_MINIMAL,
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    lanes: ["ci", "release-candidate"],
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "windows-11-arm", "macos-15", "macos-15-intel"],
+      targets: [
+        { os: "windows-2025", platform: "windows", architecture: "x86_64" },
+        { os: "windows-11-arm", platform: "windows", architecture: "arm64" },
+        { os: "macos-15", platform: "macos", architecture: "arm64" },
+        { os: "macos-15-intel", platform: "macos", architecture: "x86_64" },
+      ],
+      signWindows: true,
+      signMacos: true,
+    },
+  };
+  assert.equal(validateManifest(multiArchitecture).valid, true, JSON.stringify(validateManifest(multiArchitecture).errors));
+  assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "windows-2025", platform: "windows", architecture: "riscv64" }] } }).valid, false);
+  assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "windows-11-arm", platform: "windows", architecture: "x86_64" }] } }).valid, false);
+  assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "ubuntu-24.04", platform: "windows", architecture: "x86_64" }] } }).valid, false);
+  assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "${{ secrets.X }}", platform: "windows", architecture: "x86_64" }] } }).valid, false);
+  assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, releaseChain: { windowsFinalizeScript: "release:finalize:win", macosFinalizeScript: "release:finalize:mac", installedQualificationScript: "release:qualify", publishScript: "release:publish", qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL" } } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -90,6 +90,7 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /environment: release/);
+  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
   assert.match(content, /id-token: write/);
   assert.match(content, /azure\/login@[a-f0-9]{40}/);
   assert.match(content, /vars\.AZURE_CLIENT_ID/);
@@ -116,6 +117,7 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /macos-sign:/);
+  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
   assert.match(content, /environment: release/);
   assert.match(content, /secrets\.APPLE_CERTIFICATE_BASE64/);
   assert.match(content, /temporary keychain/i);
@@ -128,6 +130,90 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
   assert.doesNotMatch(content, /pull_request_target/);
 });
 
+test("rust-hybrid multi-architecture candidates bind every native target to exact artifacts and signing", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    matrix: { os: ["ubuntu-24.04"], node: ["22.23.2"] },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "windows-11-arm", "macos-15", "macos-15-intel"],
+      targets: [
+        { os: "windows-2025", platform: "windows", architecture: "x86_64" },
+        { os: "windows-11-arm", platform: "windows", architecture: "arm64" },
+        { os: "macos-15", platform: "macos", architecture: "arm64" },
+        { os: "macos-15-intel", platform: "macos", architecture: "x86_64" },
+      ],
+      signWindows: true,
+      signMacos: true,
+    },
+    templateVersion: "1.5.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  for (const [runner, triple] of [["windows-2025", "x86_64-pc-windows-msvc"], ["windows-11-arm", "aarch64-pc-windows-msvc"], ["macos-15", "aarch64-apple-darwin"], ["macos-15-intel", "x86_64-apple-darwin"]]) {
+    assert.match(content, new RegExp(`os: ${JSON.stringify(runner).replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")}`));
+    assert.match(content, new RegExp(`targetTriple: ${JSON.stringify(triple).replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")}`));
+  }
+  assert.match(content, /targets: \$\{\{ matrix\.targetTriple \}\}/);
+  assert.match(content, /windows-sign:[\s\S]*matrix:[\s\S]*windows-11-arm/);
+  assert.match(content, /macos-sign:[\s\S]*matrix:[\s\S]*macos-15-intel/);
+  assert.match(content, /name: widgets-unsigned-\$\{\{ matrix\.platform \}\}-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
+  assert.match(content, /name: widgets-signed-windows-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
+  assert.match(content, /name: widgets-signed-macos-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
+  assert.equal((content.match(/RIGHT_GIT_RELEASE_ARCHITECTURE: \$\{\{ matrix\.architecture \}\}/g) ?? []).length, 4);
+});
+
+test("rust-hybrid release chain preserves signed candidate, installed qualification, then publish", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:win",
+        macosFinalizeScript: "release:finalize:mac",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.4.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /windows-sign:[\s\S]*pnpm run release:finalize:win/);
+  assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
+  assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
+  assert.match(content, /installed_qualification_failed/);
+  assert.match(content, /pnpm run release:qualify:installed/);
+  assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
+  assert.match(content, /needs\.macos-sign\.result == 'success'/);
+  assert.match(content, /contents: write/);
+  assert.match(content, /pnpm run release:publish:qualified/);
+  assert.match(content, /CLOUDFLARE_API_TOKEN: \$\{\{ secrets\.CLOUDFLARE_API_TOKEN \}\}/);
+  assert.equal((content.match(/RIGHT_GIT_SOURCE_REVISION=\$\(git rev-parse HEAD\)/g) ?? []).length, 3);
+  assert.doesNotMatch(content, /RIGHT_GIT_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
+  assert.doesNotMatch(content.slice(0, content.indexOf("  windows-sign:")), /secrets\.|id-token: write|contents: write/);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -34,6 +34,7 @@ ${PACKAGE_MANAGER_SETUP}
         with:
           toolchain: 1.98.0
           components: rustfmt, clippy
+          targets: ${{ matrix.targetTriple }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: engine
@@ -53,8 +54,9 @@ ${PACKAGE_MANAGER_SETUP}
       - name: Upload unsigned candidate handoff
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.os }}-${{ matrix.node }}
+          name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.platform }}-${{ matrix.architecture }}-${{ matrix.node }}
           path: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}/**
           if-no-files-found: error
 ${WINDOWS_SIGNING_JOB}
 ${MACOS_SIGNING_JOB}
+${RELEASE_CHAIN_JOBS}