@rightkit/release 0.2.10 → 0.2.11

package/cli/right-release.mjs

@@ -16,6 +16,7 @@ const commands = new Map([
   ["sign-windows", "sign-windows.mjs"],
   ["sign-updater", "sign-updater.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
+  ["mirror-root-artifact", "mirror-root-artifact.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -105,6 +106,8 @@ Commands:
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
+  mirror-root-artifact --file <path> --package-root <dir>
+                                                      Persist a worktree artifact in the primary repo root
 
 Direct flags are treated as: right-release release <flags>.
 Publishing requires an explicit tier. Unsigned/local smoke builds stay app-local unless declared in right-release.config.mjs.`);

package/mirror-root-artifact.mjs

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { copyFileSync, mkdirSync, realpathSync, renameSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+
+const args = parseArgs(process.argv.slice(2));
+if (!args.file || !args.packageRoot) {
+  console.error("Usage: right-release mirror-root-artifact --file <artifact> --package-root <dir> [--name <filename>]");
+  process.exit(2);
+}
+
+const packageRoot = realpathSync(path.resolve(args.packageRoot));
+const source = path.resolve(packageRoot, args.file);
+const name = args.name || path.basename(source);
+const repoRoot = git(packageRoot, "rev-parse", "--show-toplevel");
+const commonDir = git(packageRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+const canonicalRepoRoot = path.basename(commonDir) === ".git" ? path.dirname(commonDir) : repoRoot;
+const relativePackageRoot = path.relative(repoRoot, packageRoot);
+const destinations = new Set([
+  path.join(packageRoot, name),
+  path.join(canonicalRepoRoot, relativePackageRoot, name),
+]);
+
+for (const destination of destinations) {
+  if (path.resolve(destination) === source) continue;
+  atomicCopy(source, destination);
+}
+
+const canonicalArtifact = path.join(canonicalRepoRoot, relativePackageRoot, name);
+console.log(`right-release: repository-root artifact -> ${canonicalArtifact}`);
+
+function git(cwd, ...commandArgs) {
+  return execFileSync("git", commandArgs, { cwd, encoding: "utf8" }).trim();
+}
+
+function atomicCopy(from, to) {
+  mkdirSync(path.dirname(to), { recursive: true });
+  const temporary = `${to}.tmp-${process.pid}`;
+  rmSync(temporary, { force: true });
+  try {
+    copyFileSync(from, temporary);
+    renameSync(temporary, to);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+
+function parseArgs(values) {
+  const parsed = {};
+  for (let i = 0; i < values.length; i += 1) {
+    const key = values[i];
+    if (!key.startsWith("--")) continue;
+    parsed[key.slice(2).replace(/-([a-z])/g, (_, letter) => letter.toUpperCase())] = values[++i];
+  }
+  return parsed;
+}

package/mirror-root-artifact.test.mjs

@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+const helper = new URL("./mirror-root-artifact.mjs", import.meta.url);
+
+test("mirrors a nested package artifact from a linked worktree into both package roots", () => {
+  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-"));
+  const main = path.join(temp, "suite");
+  const worktree = path.join(temp, "release-worktree");
+  try {
+    mkdirSync(path.join(main, "apps", "desktop"), { recursive: true });
+    git(temp, "init", "suite");
+    git(main, "config", "user.email", "test@example.com");
+    git(main, "config", "user.name", "Right Release Test");
+    writeFileSync(path.join(main, "tracked"), "fixture\n");
+    git(main, "add", "tracked");
+    git(main, "commit", "-m", "fixture");
+    git(main, "worktree", "add", worktree, "-b", "release-test");
+
+    const packageRoot = path.join(worktree, "apps", "desktop");
+    const source = path.join(packageRoot, "target", "App_1.0.0.dmg");
+    mkdirSync(path.dirname(source), { recursive: true });
+    writeFileSync(source, "signed-dmg-fixture");
+
+    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
+
+    assert.equal(readFileSync(path.join(packageRoot, "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
+    assert.equal(readFileSync(path.join(main, "apps", "desktop", "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("copies a main-worktree artifact into its package root", () => {
+  const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-main-"));
+  try {
+    git(temp, "init", "app");
+    const root = path.join(temp, "app");
+    const source = path.join(root, "target", "App_2.0.0.dmg");
+    mkdirSync(path.dirname(source), { recursive: true });
+    writeFileSync(source, "main-worktree-dmg");
+
+    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", root], { encoding: "utf8" });
+
+    assert.equal(readFileSync(path.join(root, "App_2.0.0.dmg"), "utf8"), "main-worktree-dmg");
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+function git(cwd, ...args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release.mjs

@@ -10,7 +10,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.10";
+const VERSION = "0.2.11";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.5"],

package/release.test.mjs

@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.10" },
+        devDependencies: { "@rightkit/release": "^0.2.11" },
       },
       null,
       2,
@@ -57,7 +57,7 @@ function lockFixture() {
         name: "fixture-lock",
         scripts: { "release:patch:mac": "right-release --platform mac --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.10" },
+        devDependencies: { "@rightkit/release": "^0.2.11" },
       },
       null,
       2,

package/right-suite-contract.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import test from "node:test";
@@ -8,7 +8,7 @@ const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.5";
 const logsPackage = "^0.1.3";
-const releasePackage = "^0.2.10";
+const releasePackage = "^0.2.11";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
@@ -44,6 +44,7 @@ for (const app of apps) {
     assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
+    assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /mac|dmg/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} must not expose an unsigned macOS DMG mode`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/right-release"), `${app.key} scripts must not depend on the parent Claude workspace`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/rightkit/packages/release"), `${app.key} scripts must not depend on the parent Claude workspace`);
 
@@ -66,6 +67,9 @@ for (const app of apps) {
       }
     }
     assert.match(config.targets.mac.package.args.join(" "), /mac:dmg:notarized|--notarize/, `${app.key} publish packaging must use the notarized macOS lane`);
+    for (const installer of config.targets.mac.installer.artifacts) {
+      assert.equal(path.dirname(installer.file), ".", `${app.key} macOS installer must be copied to the app package root before upload`);
+    }
     assert.ok(config.targets.win.sign.files.length);
     const winUpdaterFiles = new Set(config.targets.win.updater.artifacts.map((artifact) => artifact.file));
     for (const signed of config.targets.win.sign.files) assert.ok(winUpdaterFiles.has(signed), `${signed} must be both Azure-signed and updater-signed`);
@@ -79,6 +83,10 @@ for (const app of apps) {
     for (const releaseFile of app.releaseFiles) {
       const source = readFileSync(path.join(root, releaseFile), "utf8");
       assert.doesNotMatch(source, /(?:\.\.\/)+tools\/right-release|tools\/right-release\//, `${app.key} ${releaseFile} must consume the installed package`);
+      assert.match(source, /right-release["']?,?\s*["']mirror-root-artifact|right-release mirror-root-artifact/, `${app.key} ${releaseFile} must mirror the final DMG to the canonical package root`);
+    }
+    for (const forbidden of ["scripts/build-mac-unsigned.sh", "package-unsigned.sh"]) {
+      assert.equal(existsSync(path.join(root, forbidden)), false, `${app.key} must not ship ${forbidden}`);
     }
   });
 }