@rightkit/release 0.2.142 → 0.2.144

package/rightkit-sync.mjs

@@ -185,8 +185,11 @@ export function syncConsumerCopies(root = rightkitRoot) {
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-catalog.json")],
     ["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-fingerprints.json")],
     ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
+    ["ownership-repositories.json", path.join(root, "packages", "build-control-policy", "src", "ownership-repositories.json")],
     ["rightkit-drift.mjs", path.join(root, "packages", "build-control-policy", "src", "rightkit-drift.mjs")],
     ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
+    ["ownership-dependency-allowlist.json", path.join(root, "packages", "build-control-policy", "src", "ownership-dependency-allowlist.json")],
+    ["ownership-dependency-allowlist.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-dependency-allowlist.mjs")],
     ["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
     ["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
   ];

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.142",
+    "@rightkit/release": "0.2.144",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -174,7 +174,9 @@
       "0.2.138",
       "0.2.139",
       "0.2.140",
-      "0.2.141"
+      "0.2.141",
+      "0.2.142",
+      "0.2.143"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -279,7 +281,7 @@
     "rightkit-db": "0.3.2",
     "rightkit-embed": "0.3.1",
     "rightkit-framed-sidecar": "0.1.0",
-    "rightkit-fs": "0.3.2",
+    "rightkit-fs": "0.3.3",
     "rightkit-fsindex": "0.1.0",
     "rightkit-http": "0.2.4",
     "rightkit-jobs": "0.2.6",
@@ -336,7 +338,7 @@
       "rightkit-db": "0.3.2",
       "rightkit-embed": "0.3.1",
       "rightkit-framed-sidecar": "0.1.0",
-      "rightkit-fs": "0.3.2",
+      "rightkit-fs": "0.3.3",
       "rightkit-fsindex": "0.1.0",
       "rightkit-http": "0.2.4",
       "rightkit-jobs": "0.2.6",
@@ -386,7 +388,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.142",
+      "@rightkit/release": "0.2.144",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -519,7 +521,8 @@
       "0.1.0",
       "0.2.0",
       "0.3.0",
-      "0.3.1"
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-service": [
       "0.1.0",

package/upload-release.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { pathToFileURL } from "node:url";
@@ -9,6 +10,7 @@ import { verifySealedRelease } from "./release-state.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
 import { recordPublishedVersion } from "./artifact-storage.mjs";
+import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
 
 const args = process.argv.slice(2);
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
@@ -58,6 +60,11 @@ if (!configuredRepo) fail("release config distribution.repository is required fo
 if (repo && repo !== configuredRepo) fail(`--repo must match configured distribution.repository (${configuredRepo})`);
 repo = configuredRepo;
 
+// Hardening step 4: installed QA on these exact artifact hashes and commit must have passed before any upload.
+if (!dryRun) {
+  try { assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: createHash("sha256").update(readFileSync(configPath)).digest("hex") }); }
+  catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; fail(error.message); }
+}
 const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
 const verifiedMarker = path.join(stateRoot, `verified-${tier}-github-releases.json`);
 if (existsSync(verifiedMarker)) {