@rightkit/git 0.2.9 → 0.2.11

package/manifest.mjs

@@ -641,7 +641,8 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
       - name: Fail closed when protected finalization is absent
         if: \${{ needs.windows-sign.result != 'success' }}
         shell: pwsh
-        run: throw 'installed_qualification_failed { reason: prerequisites_absent, detail: "same-run Windows signing/finalization did not succeed" }'
+        run: |
+          throw 'installed_qualification_failed { reason: prerequisites_absent, detail: "same-run Windows signing/finalization did not succeed" }'
       - name: Download same-run finalized Windows release
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,6 +15,9 @@
     "*.json"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -24,7 +27,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/render.mjs

@@ -31,5 +31,8 @@ export function renderTemplate(templateText, context) {
   if (leftover) {
     throw new Error(`render: unresolved placeholder ${leftover[0]} remained after substitution`);
   }
-  return rendered;
+  // Optional final job fragments may expand to an empty string. Normalize
+  // template EOF after substitution so managed workflows remain byte-stable
+  // with exactly one terminating newline.
+  return `${rendered.replace(/(?:\r\n|\r|\n)+$/, "")}\n`;
 }

package/render.test.mjs

@@ -203,6 +203,8 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
   assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
   assert.match(content, /installed_qualification_failed/);
+  assert.match(content, /shell: pwsh\n        run: \|\n          throw 'installed_qualification_failed \{ reason: prerequisites_absent, detail: "same-run Windows signing\/finalization did not succeed" \}'/);
+  assert.doesNotMatch(content, /^        run: throw 'installed_qualification_failed .*detail: /m);
   assert.match(content, /pnpm run release:qualify:installed/);
   assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
   assert.match(content, /needs\.macos-sign\.result == 'success'/);
@@ -320,3 +322,9 @@ test("renderTemplate never substitutes inside GitHub Actions double-brace expres
   const out = renderTemplate("run: echo ${{ github.repository }}\nname: ${TEMPLATE_VERSION}\n", { TEMPLATE_VERSION: "1.0.0" });
   assert.equal(out, "run: echo ${{ github.repository }}\nname: 1.0.0\n");
 });
+
+test("renderTemplate normalizes an empty final release-chain fragment to one newline", () => {
+  const out = renderTemplate("jobs:\n${RELEASE_CHAIN_JOBS}\n", { RELEASE_CHAIN_JOBS: "" });
+  assert.equal(out, "jobs:\n");
+  assert.equal((out.match(/\n/g) ?? []).length, 1);
+});