@rightkit/release 0.2.146 → 0.2.148

package/build-release.mjs

@@ -31,7 +31,7 @@ import { createTargetBridge } from "./target-bridge.mjs";
 import { signingReceiptPath } from "./signing-receipts.mjs";
 import { validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
-import { resolveReleaseCacheMode } from "./release-cache-mode.mjs";
+import { ensureLegacyTargetLink, resolveReleaseCacheMode } from "./release-cache-mode.mjs";
 import { resolveTargetRoot } from "./cargo-target.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { collectSwiftToolVersions, planSwiftBuild } from "./swift-build-context.mjs";
@@ -363,9 +363,10 @@ try {
         // flag already knows to leave a real directory untouched instead.
         if (swiftPlan) { /* SwiftPM: no Rust target link */ }
         else if (cacheMode === "shared" || managedCargoTarget) targetBridge.ensure();
-        else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
-        else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
-          fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
+        else {
+          const linked = ensureLegacyTargetLink({ targetLink, cacheTarget, fs: { existsSync, realpathSync, renameSync, symlinkSync } });
+          if (linked.action === "refused") fail(linked.reason);
+          if (linked.action === "moved-aside") console.error(`[right-release] hosted CI: moved existing ${targetLink} aside to ${linked.aside}`);
         }
         if (resolveProjectType({ appRoot, config, target }) !== "swiftpm" || config.packageManager) await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.146",
+  "version": "0.2.148",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release-cache-mode.mjs

@@ -1,3 +1,5 @@
+import { isManagedHost } from "./managed-host-secrets.mjs";
+
 export function resolveReleaseCacheMode({ requested, platform, env = process.env } = {}) {
   const fallback = env.GITHUB_ACTIONS === "true"
     ? "legacy"
@@ -6,3 +8,22 @@ export function resolveReleaseCacheMode({ requested, platform, env = process.env
   if (mode !== "legacy" && mode !== "shared") throw new Error("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
   return mode;
 }
+
+/**
+ * Legacy (non-shared, non-broker) mode links the checkout's target directory to the release cache.
+ * A target that already exists and points elsewhere fails closed on developer hosts, where it may hold
+ * work. Hosted CI runners are ephemeral: an earlier workflow step (a build or a cache restore) may have
+ * created a real target directory, so it is renamed aside and the link created instead of failing.
+ */
+export function ensureLegacyTargetLink({ targetLink, cacheTarget, platform = process.platform, env = process.env, fs, now = () => Date.now() }) {
+  const linkType = platform === "win32" ? "junction" : "dir";
+  if (!fs.existsSync(targetLink)) { fs.symlinkSync(cacheTarget, targetLink, linkType); return { action: "linked" }; }
+  if (fs.realpathSync(targetLink) === fs.realpathSync(cacheTarget)) return { action: "current" };
+  if (env.GITHUB_ACTIONS !== "true" || isManagedHost(env)) {
+    return { action: "refused", reason: `primary checkout target exists and is not the release cache link: ${targetLink}` };
+  }
+  const aside = `${targetLink}.pre-right-release-${now()}`;
+  fs.renameSync(targetLink, aside);
+  fs.symlinkSync(cacheTarget, targetLink, linkType);
+  return { action: "moved-aside", aside };
+}

package/release.mjs

@@ -742,7 +742,8 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
   }
   const lanes = manifest?.lanes;
-  const safeLanes = new Set(["ci", "release-candidate"]);
+  // Mirrors the `lanes` enum in @rightkit/git manifest.schema.json.
+  const safeLanes = new Set(["ci", "qualification", "package-smoke", "release-candidate", "publish-npm", "publish-package-managers"]);
   if (manifest?.schemaVersion !== 1
     || manifest?.compile !== "github-actions-only"
     || !Array.isArray(lanes)
@@ -750,7 +751,7 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     || !lanes.includes("ci")
     || new Set(lanes).size !== lanes.length
     || lanes.some((lane) => !safeLanes.has(lane))) {
-    fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
+    fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from [${[...safeLanes].map((lane) => `"${lane}"`).join(", ")}] and including "ci"`);
   }
   const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
   if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
@@ -798,6 +799,15 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const protectedMacosSigning = workflow === "release-candidate.yml"
       && manifest?.candidate?.signMacos === true
       && (legacySigningGate("macos-sign").test(macosSource) || admittedSigningGate("macos-sign").test(macosSource));
+    // @rightkit/git `devArtifact.mac: "sign"` renders a `dev-mac-sign` job into
+    // the managed ci.yml: push to the default branch only, release environment,
+    // Developer ID certificate secrets only (no notarization keys).
+    const devMacSpan = workflow === "ci.yml" ? jobSpan("dev-mac-sign") : null;
+    const devMacSource = devMacSpan ? source.slice(devMacSpan.start, devMacSpan.end) : "";
+    const allowedDevMacSecrets = new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD"]);
+    const protectedDevMacSigning = workflow === "ci.yml"
+      && manifest?.devArtifact?.mac === "sign"
+      && /dev-mac-sign:\n(?:    #[^\n]*\n)*    needs: \[ci\]\n    if: \$\{\{ github\.event_name == 'push' && github\.ref_name == github\.event\.repository\.default_branch \}\}\n    environment: /.test(devMacSource);
     const releaseChain = workflow === "release-candidate.yml" ? manifest?.candidate?.releaseChain : undefined;
     const allowedReleaseSecrets = new Set(releaseChain?.publishSecrets ?? []);
     const writePermissions = [...source.matchAll(/^\s*(actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/gmi)].map((match) => ({ name: match[1].toLowerCase(), index: match.index }));
@@ -821,6 +831,7 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
       || /pull_request_target\s*:/i.test(source)
       || /\bsecrets\s*\[/i.test(source)
       || requestedSecrets.some(({ name, index }) => !(protectedMacosSigning && inside(index, macosSpan) && allowedMacosSecrets.has(name))
+        && !(protectedDevMacSigning && inside(index, devMacSpan) && allowedDevMacSecrets.has(name))
         && !(protectedReleasePublish && inside(index, publishSpan) && allowedReleaseSecrets.has(name)))) {
       fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
     }

package/rightkit-versions.json

@@ -16,7 +16,7 @@
     "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
     "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.33",
+    "@rightkit/git": "0.2.34",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.146",
+    "@rightkit/release": "0.2.148",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -74,7 +74,8 @@
       "0.2.29",
       "0.2.30",
       "0.2.31",
-      "0.2.32"
+      "0.2.32",
+      "0.2.33"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -178,7 +179,9 @@
       "0.2.142",
       "0.2.143",
       "0.2.144",
-      "0.2.145"
+      "0.2.145",
+      "0.2.146",
+      "0.2.147"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -377,7 +380,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.33",
+      "@rightkit/git": "0.2.34",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -390,7 +393,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.146",
+      "@rightkit/release": "0.2.147",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",