@rightkit/release 0.2.143 → 0.2.144
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build-release.mjs +13 -2
- package/cli/right-release.mjs +3 -0
- package/github-release.mjs +9 -0
- package/ownership-approval.mjs +14 -1
- package/ownership-command.mjs +48 -2
- package/ownership-declaration.json +175 -4
- package/ownership-dependency-allowlist-seed.mjs +86 -0
- package/ownership-dependency-allowlist.json +1087 -0
- package/ownership-dependency-allowlist.mjs +124 -0
- package/ownership-evidence.mjs +13 -2
- package/ownership-key-command.mjs +55 -13
- package/ownership-key-elevation.mjs +114 -8
- package/ownership-key-trust.mjs +25 -4
- package/ownership-policy-bundle.mjs +155 -0
- package/ownership-report-command.mjs +1 -1
- package/ownership-trust-summary.mjs +119 -0
- package/ownership-windows-presence.mjs +171 -0
- package/ownership.mjs +42 -6
- package/package.json +1 -1
- package/protected-credentials.mjs +6 -1
- package/publish-update.mjs +8 -1
- package/release-qa-command.mjs +145 -0
- package/release-qa-floor.json +9 -0
- package/release-qa-receipt.mjs +276 -0
- package/release.mjs +1 -1
- package/rightkit-drift.mjs +1 -1
- package/rightkit-ownership.json +2276 -429
- package/rightkit-sync.mjs +3 -0
- package/rightkit-versions.json +4 -3
- package/upload-release.mjs +8 -1
package/rightkit-sync.mjs
CHANGED
|
@@ -185,8 +185,11 @@ export function syncConsumerCopies(root = rightkitRoot) {
|
|
|
185
185
|
["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-catalog.json")],
|
|
186
186
|
["rightkit-ownership.json", path.join(root, "packages", "build-control-policy", "src", "ownership-fingerprints.json")],
|
|
187
187
|
["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
|
|
188
|
+
["ownership-repositories.json", path.join(root, "packages", "build-control-policy", "src", "ownership-repositories.json")],
|
|
188
189
|
["rightkit-drift.mjs", path.join(root, "packages", "build-control-policy", "src", "rightkit-drift.mjs")],
|
|
189
190
|
["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
|
|
191
|
+
["ownership-dependency-allowlist.json", path.join(root, "packages", "build-control-policy", "src", "ownership-dependency-allowlist.json")],
|
|
192
|
+
["ownership-dependency-allowlist.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-dependency-allowlist.mjs")],
|
|
190
193
|
["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
|
|
191
194
|
["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
|
|
192
195
|
];
|
package/rightkit-versions.json
CHANGED
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
"@rightkit/platform-ui": "0.2.0",
|
|
30
30
|
"@rightkit/qa": "0.4.0",
|
|
31
31
|
"@rightkit/qa-chrome": "0.1.3",
|
|
32
|
-
"@rightkit/release": "0.2.
|
|
32
|
+
"@rightkit/release": "0.2.144",
|
|
33
33
|
"@rightkit/settings-ui": "0.3.0",
|
|
34
34
|
"@rightkit/shell": "0.1.0",
|
|
35
35
|
"@rightkit/tauri": "0.2.0",
|
|
@@ -175,7 +175,8 @@
|
|
|
175
175
|
"0.2.139",
|
|
176
176
|
"0.2.140",
|
|
177
177
|
"0.2.141",
|
|
178
|
-
"0.2.142"
|
|
178
|
+
"0.2.142",
|
|
179
|
+
"0.2.143"
|
|
179
180
|
],
|
|
180
181
|
"@rightkit/qa": [
|
|
181
182
|
"0.1.0",
|
|
@@ -387,7 +388,7 @@
|
|
|
387
388
|
"@rightkit/platform-ui": "0.2.0",
|
|
388
389
|
"@rightkit/qa": "0.4.0",
|
|
389
390
|
"@rightkit/qa-chrome": "0.1.3",
|
|
390
|
-
"@rightkit/release": "0.2.
|
|
391
|
+
"@rightkit/release": "0.2.144",
|
|
391
392
|
"@rightkit/settings-ui": "0.3.0",
|
|
392
393
|
"@rightkit/shell": "0.1.0",
|
|
393
394
|
"@rightkit/tauri": "0.2.0",
|
package/upload-release.mjs
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
import {
|
|
2
|
+
import { createHash } from "node:crypto";
|
|
3
|
+
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
|
3
4
|
import path from "node:path";
|
|
4
5
|
import { spawnSync } from "./background-process.mjs";
|
|
5
6
|
import { pathToFileURL } from "node:url";
|
|
@@ -9,6 +10,7 @@ import { verifySealedRelease } from "./release-state.mjs";
|
|
|
9
10
|
import { assertCleanSource } from "./source-gate.mjs";
|
|
10
11
|
import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
|
|
11
12
|
import { recordPublishedVersion } from "./artifact-storage.mjs";
|
|
13
|
+
import { assertInstalledQaAdmission } from "./release-qa-receipt.mjs";
|
|
12
14
|
|
|
13
15
|
const args = process.argv.slice(2);
|
|
14
16
|
let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
|
|
@@ -58,6 +60,11 @@ if (!configuredRepo) fail("release config distribution.repository is required fo
|
|
|
58
60
|
if (repo && repo !== configuredRepo) fail(`--repo must match configured distribution.repository (${configuredRepo})`);
|
|
59
61
|
repo = configuredRepo;
|
|
60
62
|
|
|
63
|
+
// Hardening step 4: installed QA on these exact artifact hashes and commit must have passed before any upload.
|
|
64
|
+
if (!dryRun) {
|
|
65
|
+
try { assertInstalledQaAdmission({ repoRoot, manifest: sealed.manifest, platform, configName: path.relative(process.cwd(), configPath) || configName, releaseConfigSha256: createHash("sha256").update(readFileSync(configPath)).digest("hex") }); }
|
|
66
|
+
catch (error) { if (error?.code !== "QA_ADMISSION_REFUSED") throw error; fail(error.message); }
|
|
67
|
+
}
|
|
61
68
|
const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
|
|
62
69
|
const verifiedMarker = path.join(stateRoot, `verified-${tier}-github-releases.json`);
|
|
63
70
|
if (existsSync(verifiedMarker)) {
|