@rightkit/release 0.2.11 → 0.2.12

package/mirror-root-artifact.test.mjs

@@ -4,8 +4,9 @@ import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "nod
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 
-const helper = new URL("./mirror-root-artifact.mjs", import.meta.url);
+const helper = fileURLToPath(new URL("./mirror-root-artifact.mjs", import.meta.url));
 
 test("mirrors a nested package artifact from a linked worktree into both package roots", () => {
   const temp = mkdtempSync(path.join(os.tmpdir(), "right-release-mirror-"));
@@ -26,7 +27,7 @@ test("mirrors a nested package artifact from a linked worktree into both package
     mkdirSync(path.dirname(source), { recursive: true });
     writeFileSync(source, "signed-dmg-fixture");
 
-    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
+    execFileSync(process.execPath, [helper, "--file", source, "--package-root", packageRoot], { encoding: "utf8" });
 
     assert.equal(readFileSync(path.join(packageRoot, "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
     assert.equal(readFileSync(path.join(main, "apps", "desktop", "App_1.0.0.dmg"), "utf8"), "signed-dmg-fixture");
@@ -44,7 +45,7 @@ test("copies a main-worktree artifact into its package root", () => {
     mkdirSync(path.dirname(source), { recursive: true });
     writeFileSync(source, "main-worktree-dmg");
 
-    execFileSync(process.execPath, [helper.pathname, "--file", source, "--package-root", root], { encoding: "utf8" });
+    execFileSync(process.execPath, [helper, "--file", source, "--package-root", root], { encoding: "utf8" });
 
     assert.equal(readFileSync(path.join(root, "App_2.0.0.dmg"), "utf8"), "main-worktree-dmg");
   } finally {

package/notary-auth.test.mjs

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import os from "node:os";
+import path from "node:path";
 import test from "node:test";
 import { notarytoolAuthArgs } from "./notary-auth.mjs";
 
@@ -9,7 +10,7 @@ test("prefers a complete App Store Connect API credential set", () => {
     process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
     process.env.APPLE_API_KEY = "KEY123";
     process.env.APPLE_API_ISSUER = "ISSUER123";
-    assert.deepEqual(notarytoolAuthArgs(), ["--key", `${os.homedir()}/AuthKey.p8`, "--key-id", "KEY123", "--issuer", "ISSUER123"]);
+    assert.deepEqual(notarytoolAuthArgs(), ["--key", path.join(os.homedir(), "AuthKey.p8"), "--key-id", "KEY123", "--issuer", "ISSUER123"]);
   } finally {
     process.env = before;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "cli",
     "*.mjs",
+    "*.json",
     "*.sh",
     "*.py"
   ],

package/release.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { access, readFile } from "node:fs/promises";
+import { access, readFile, readdir } from "node:fs/promises";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -10,13 +10,10 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.11";
+const RIGHTKIT_VERSIONS = JSON.parse(readFileSync(path.resolve(TOOL_ROOT, "rightkit-versions.json"), "utf8"));
+const VERSION = RIGHTKIT_VERSIONS.npm["@rightkit/release"];
 const TIERS = new Set(["patch", "update"]);
-const RIGHTKIT_EXPECTED = new Map([
-  ["@rightkit/license", "^0.1.5"],
-  ["@rightkit/logs", "^0.1.3"],
-  ["@rightkit/release", `^${VERSION}`],
-]);
+const RIGHTKIT_EXPECTED = new Map(Object.entries(RIGHTKIT_VERSIONS.npm));
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
 const args = process.argv.slice(2);
@@ -181,6 +178,16 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
+  const workflowDir = path.join(root, ".github", "workflows");
+  if (existsSync(workflowDir)) {
+    const workflows = await readdir(workflowDir);
+    if (workflows.length) {
+      fail(`${appName ?? pkg.name ?? "app"} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+    }
+  }
+  if (pkg.packageManager !== RIGHTKIT_VERSIONS.packageManager) {
+    fail(`${appName ?? pkg.name ?? "app"} packageManager must be ${RIGHTKIT_VERSIONS.packageManager}, got ${pkg.packageManager ?? "<missing>"}`);
+  }
   if (JSON.stringify(scripts).includes("../tools/right-release") || JSON.stringify(scripts).includes("../tools/rightkit/packages/release")) {
     fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not parent-workspace release source`);
   }

package/release.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { existsSync, mkdtempSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import test from "node:test";
 
 const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
+const versions = JSON.parse(readFileSync(new URL("./rightkit-versions.json", import.meta.url), "utf8"));
 
 function fixture({ signed = true, publish = false, packageJson } = {}) {
   const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
@@ -17,8 +18,12 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
       packageJson ?? {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
-        dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.11" },
+        packageManager: versions.packageManager,
+        dependencies: {
+          "@rightkit/license": versions.npm["@rightkit/license"],
+          "@rightkit/logs": versions.npm["@rightkit/logs"],
+        },
+        devDependencies: { "@rightkit/release": versions.npm["@rightkit/release"] },
       },
       null,
       2,
@@ -56,8 +61,12 @@ function lockFixture() {
       {
         name: "fixture-lock",
         scripts: { "release:patch:mac": "right-release --platform mac --tier patch" },
-        dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.11" },
+        packageManager: versions.packageManager,
+        dependencies: {
+          "@rightkit/license": versions.npm["@rightkit/license"],
+          "@rightkit/logs": versions.npm["@rightkit/logs"],
+        },
+        devDependencies: { "@rightkit/release": versions.npm["@rightkit/release"] },
       },
       null,
       2,
@@ -134,6 +143,7 @@ test("rejects Git, path, or link RightKit app dependencies before release work s
     fixture({
       packageJson: {
         name: "fixture",
+        packageManager: versions.packageManager,
         scripts: { "release:patch:win": "node ../tools/right-release/release.mjs --tier patch" },
         dependencies: {
           "@rightkit/license": "git+https://github.com/adrdsouza/rightkit.git#main",
@@ -150,6 +160,17 @@ test("rejects Git, path, or link RightKit app dependencies before release work s
   assert.match(result.stderr, /right-release bin|published npm package/i);
 });
 
+test("rejects hosted workflow files before release work starts", () => {
+  const config = fixture();
+  const workflowDir = path.join(path.dirname(config), ".github", "workflows");
+  mkdirSync(workflowDir, { recursive: true });
+  writeFileSync(path.join(workflowDir, "ci.yml"), "name: forbidden\n");
+
+  const result = run(config, "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /hosted workflow.*forbidden/i);
+});
+
 test("publish runs the signed package step before the updater publication step", () => {
   const result = run(fixture({ publish: true }), "--tier=update", "--upload");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -1,22 +1,30 @@
 import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import test from "node:test";
 
 const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const versionsPath = path.join(path.dirname(new URL(import.meta.url).pathname.replace(/^\/(\w:)/, "$1")), "rightkit-versions.json");
+const versions = JSON.parse(readFileSync(versionsPath, "utf8"));
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
-const licensePackage = "^0.1.5";
-const logsPackage = "^0.1.3";
-const releasePackage = "^0.2.11";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
   { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac.sh"] },
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
+test("RightKit exposes one current version manifest", () => {
+  assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
+  assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
+  assert.equal(versions.npm["@rightkit/release"], "0.2.12");
+  assert.equal(versions.npm["@rightkit/license"], "0.1.5");
+  assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
+  assert.equal(versions.npm["@rightkit/updates"], "0.1.1");
+});
+
 for (const app of apps) {
   test(`${app.key} follows the signed tiered Right Release contract`, async () => {
     const root = path.join(workspace, app.root);
@@ -24,16 +32,16 @@ for (const app of apps) {
     const rightKitDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
       assert.doesNotMatch(specifier, /^(?:git|file|link|workspace):|github/i, `${app.key} ${name} must come from the published npm package`);
+      if (versions.npm[name]) assert.equal(specifier, versions.npm[name], `${app.key} ${name} must match rightkit-versions.json exactly`);
     }
-    if (rightKitDeps["@rightkit/license"]) assert.equal(rightKitDeps["@rightkit/license"], licensePackage);
-    if (rightKitDeps["@rightkit/logs"]) assert.equal(rightKitDeps["@rightkit/logs"], logsPackage);
-    assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
+    assert.equal(pkg.packageManager, versions.packageManager);
+    assert.equal(pkg.devDependencies?.["@rightkit/release"], versions.npm["@rightkit/release"]);
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/rightkit/packages/release"));
     assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
-    assert.equal(pkg.scripts["release:mac"], "right-release --platform mac");
-    assert.equal(pkg.scripts["release:win"], "right-release --platform win");
+    assert.equal(pkg.scripts["release:mac"], undefined, "tierless release entry points are forbidden");
+    assert.equal(pkg.scripts["release:win"], undefined, "tierless release entry points are forbidden");
     assert.equal(pkg.scripts["release:patch:mac"], "right-release --platform mac --tier patch");
     assert.equal(pkg.scripts["release:patch:win"], "right-release --platform win --tier patch");
     assert.equal(pkg.scripts["release:update:mac"], "right-release --platform mac --tier update");
@@ -44,7 +52,7 @@ for (const app of apps) {
     assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
-    assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /mac|dmg/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} must not expose an unsigned macOS DMG mode`);
+    assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /^(?:release|publish):/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} release/publish commands must not expose an unsigned macOS DMG mode`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/right-release"), `${app.key} scripts must not depend on the parent Claude workspace`);
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/rightkit/packages/release"), `${app.key} scripts must not depend on the parent Claude workspace`);
 
@@ -66,7 +74,8 @@ for (const app of apps) {
         assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
       }
     }
-    assert.match(config.targets.mac.package.args.join(" "), /mac:dmg:notarized|--notarize/, `${app.key} publish packaging must use the notarized macOS lane`);
+    assert.equal(config.targets.mac.package.cmd, "pnpm", `${app.key} must use the shared pnpm package entry point`);
+    assert.deepEqual(config.targets.mac.package.args, ["run", "mac:dmg:notarized"], `${app.key} R2 release must use the signed and notarized macOS package entry point`);
     for (const installer of config.targets.mac.installer.artifacts) {
       assert.equal(path.dirname(installer.file), ".", `${app.key} macOS installer must be copied to the app package root before upload`);
     }
@@ -85,12 +94,17 @@ for (const app of apps) {
       assert.doesNotMatch(source, /(?:\.\.\/)+tools\/right-release|tools\/right-release\//, `${app.key} ${releaseFile} must consume the installed package`);
       assert.match(source, /right-release["']?,?\s*["']mirror-root-artifact|right-release mirror-root-artifact/, `${app.key} ${releaseFile} must mirror the final DMG to the canonical package root`);
     }
-    for (const forbidden of ["scripts/build-mac-unsigned.sh", "package-unsigned.sh"]) {
-      assert.equal(existsSync(path.join(root, forbidden)), false, `${app.key} must not ship ${forbidden}`);
-    }
   });
 }
 
+test("Right Suite has no hosted workflow files", () => {
+  for (const root of ["viewright", "scraperight", "heardright", "mailright", "coderight", "genright", "voiceright", "tools/rightkit"]) {
+    const workflowDir = path.join(workspace, root, ".github", "workflows");
+    const workflows = existsSync(workflowDir) ? readdirSync(workflowDir) : [];
+    assert.deepEqual(workflows, [], `${root} must not contain hosted workflow files`);
+  }
+});
+
 test("RightApps brand hosts expose app-keyed update manifest proxies", () => {
   for (const app of apps) {
     const siteRoot = path.join(workspace, "rightapps", app.key);

package/rightkit-versions.json

@@ -0,0 +1,10 @@
+{
+  "schema": 1,
+  "packageManager": "pnpm@11.12.0",
+  "npm": {
+    "@rightkit/license": "0.1.5",
+    "@rightkit/logs": "0.1.3",
+    "@rightkit/release": "0.2.12",
+    "@rightkit/updates": "0.1.1"
+  }
+}