@rightkit/release 0.2.149 → 0.2.150

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.149",
+  "version": "0.2.150",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/publish-swift.mjs

@@ -16,7 +16,10 @@ import { scanCrateForSecrets } from "./publish-cargo.mjs";
 import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
 
 export const DEFAULT_SWIFT_GIT_URL = "https://github.com/bogusyogi/rightkit-swift.git";
-const MIRROR_EXCLUDES = new Set([".build", ".swiftpm", ".git", "Package.resolved", ".DS_Store"]);
+// The mirror must reproduce the verified git subtree exactly (its tree id is
+// compared), so only untracked build state is excluded. Tracked Xcode scheme
+// metadata under .swiftpm ships with the package; SwiftPM consumers ignore it.
+const MIRROR_EXCLUDES = new Set([".build", ".git", "Package.resolved", ".DS_Store"]);
 
 export function parseSwiftPublishArgs(argv, env = process.env) {
   const allowed = new Set(["--repo", "--dry-run", "--allow-dirty", "--evidence", "--workspace"]);
@@ -138,7 +141,10 @@ export function runSwiftPublish(options, execute = spawnSync) {
   const prefix = git(["rev-parse", "--show-prefix"], packageDir, execute).replace(/\/$/, "");
   const sourceCommit = gate.evidence?.commit ?? "HEAD";
   const tree = git(["rev-parse", prefix ? `${sourceCommit}:${prefix}` : `${sourceCommit}^{tree}`], packageDir, execute);
-  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: packageDir, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
+  // `git archive` filters by the current subdirectory, so archiving the package
+  // subtree from inside the package yields an empty tar; run it at the toplevel.
+  const toplevel = git(["rev-parse", "--show-toplevel"], packageDir, execute) || packageDir;
+  const archive = execute("git", ["archive", "--format=tar", "--mtime=1970-01-01T00:00:00Z", tree], { cwd: toplevel, windowsHide: true, maxBuffer: 128 * 1024 * 1024 });
   if (archive.error || archive.status !== 0 || !archive.stdout?.length) throw new Error("Swift source archive creation failed");
   const bytes = Buffer.from(archive.stdout);
   if (gate.ok || !options.dryRun) verifySwiftSourceArchive(bytes, gate.evidence);

package/release.mjs

@@ -820,9 +820,13 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const allowedRegeneratePermissions = new Set(["contents", "pull-requests"]);
     const devMacSpan = workflow === "ci.yml" ? jobSpan("dev-mac-sign") : null;
     const devMacSource = devMacSpan ? source.slice(devMacSpan.start, devMacSpan.end) : "";
-    const allowedDevMacSecrets = new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD"]);
+    // `mac: "notarize"` additionally allows the notary API key secrets; the
+    // job gate (push to the default branch, release environment) is the same.
+    const allowedDevMacSecrets = manifest?.devArtifact?.mac === "notarize"
+      ? allowedMacosSecrets
+      : new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD"]);
     const protectedDevMacSigning = workflow === "ci.yml"
-      && manifest?.devArtifact?.mac === "sign"
+      && (manifest?.devArtifact?.mac === "sign" || manifest?.devArtifact?.mac === "notarize")
       && /dev-mac-sign:\n(?:    #[^\n]*\n)*    needs: \[ci\]\n    if: \$\{\{ github\.event_name == 'push' && github\.ref_name == github\.event\.repository\.default_branch \}\}\n    environment: /.test(devMacSource);
     const releaseChain = workflow === "release-candidate.yml" ? manifest?.candidate?.releaseChain : undefined;
     const allowedReleaseSecrets = new Set(releaseChain?.publishSecrets ?? []);

package/rightkit-versions.json

@@ -13,27 +13,27 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/app-shell": "0.3.0",
+    "@rightkit/app-shell": "0.4.0",
     "@rightkit/ax": "0.2.4",
-    "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.36",
+    "@rightkit/doc-render": "0.1.5",
+    "@rightkit/git": "0.2.37",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.2.0",
     "@rightkit/license": "0.1.8",
     "@rightkit/logs": "0.1.4",
-    "@rightkit/media-ui": "0.3.0",
-    "@rightkit/onboarding": "0.3.0",
-    "@rightkit/pdf-ui": "0.1.2",
+    "@rightkit/media-ui": "0.3.1",
+    "@rightkit/onboarding": "0.3.1",
+    "@rightkit/pdf-ui": "0.1.3",
     "@rightkit/platform-ui": "0.2.0",
-    "@rightkit/qa": "0.4.0",
+    "@rightkit/qa": "0.4.1",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.149",
-    "@rightkit/settings-ui": "0.3.0",
+    "@rightkit/release": "0.2.150",
+    "@rightkit/settings-ui": "0.3.1",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
-    "@rightkit/theme": "0.2.1",
+    "@rightkit/theme": "0.2.2",
     "@rightkit/updates": "0.2.5"
   },
   "legacyNpm": {
@@ -77,7 +77,8 @@
       "0.2.32",
       "0.2.33",
       "0.2.34",
-      "0.2.35"
+      "0.2.35",
+      "0.2.36"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -184,7 +185,8 @@
       "0.2.145",
       "0.2.146",
       "0.2.147",
-      "0.2.148"
+      "0.2.148",
+      "0.2.149"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -195,12 +197,14 @@
       "0.2.4",
       "0.3.0",
       "0.3.1",
-      "0.3.2"
+      "0.3.2",
+      "0.4.0"
     ],
     "@rightkit/app-shell": [
       "0.1.0",
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.3.0"
     ],
     "@rightkit/media-ui": [
       "0.1.0",
@@ -210,11 +214,13 @@
       "0.2.3",
       "0.2.4",
       "0.2.5",
-      "0.2.6"
+      "0.2.6",
+      "0.3.0"
     ],
     "@rightkit/theme": [
       "0.1.0",
-      "0.2.0"
+      "0.2.0",
+      "0.2.1"
     ],
     "@rightkit/settings-ui": [
       "0.1.0",
@@ -224,20 +230,23 @@
       "0.2.4",
       "0.2.5",
       "0.2.6",
-      "0.2.7"
+      "0.2.7",
+      "0.3.0"
     ],
     "@rightkit/onboarding": [
       "0.1.0",
       "0.2.0",
       "0.2.1",
       "0.2.2",
-      "0.2.3"
+      "0.2.3",
+      "0.3.0"
     ],
     "@rightkit/doc-render": [
       "0.1.0",
       "0.1.1",
       "0.1.2",
-      "0.1.3"
+      "0.1.3",
+      "0.1.4"
     ],
     "@rightkit/platform-ui": [
       "0.1.1",
@@ -245,7 +254,8 @@
     ],
     "@rightkit/pdf-ui": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "@rightkit/qa-chrome": [
       "0.1.0",
@@ -326,13 +336,13 @@
   "swift": {
     "rightkit-swift": {
       "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.1.1"
+      "version": "0.4.0"
     }
   },
   "stagedSwift": {
     "rightkit-swift": {
       "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.3.1"
+      "version": "0.4.0"
     }
   },
   "registry": {
@@ -383,7 +393,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.36",
+      "@rightkit/git": "0.2.37",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -396,7 +406,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.148",
+      "@rightkit/release": "0.2.149",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",