@rightkit/release 0.2.39 → 0.2.40

package/build-invocation-contract.test.mjs

@@ -53,15 +53,28 @@ test("allows release invocation from the primary Git checkout", () => {
   assert.doesNotThrow(() => assertPrimaryReleaseCheckout(primary));
 });
 
-test("reports dirty files that can change the packaged app", () => {
+test("rejects a detached HEAD even in the primary Git checkout", () => {
+  const primary = makeRepo();
+  git(primary, "checkout", "--detach");
+
+  assert.throws(
+    () => assertPrimaryReleaseCheckout(primary),
+    /detached HEAD is forbidden/i,
+  );
+});
+
+test("reports a dirty tracked file declared as a build input", () => {
   const primary = makeRepo();
   writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/app.js"]);
+});
+
+test("reports an untracked file declared as a build input", () => {
+  const primary = makeRepo();
   writeFileSync(path.join(primary, "src", "new-runtime.js"), "export {};\n");
 
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), [
-    "src/app.js",
-    "src/new-runtime.js",
-  ]);
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/new-runtime.js"]);
 });
 
 test("ignores dirty files outside the packaged app input set", () => {
@@ -73,6 +86,21 @@ test("ignores dirty files outside the packaged app input set", () => {
   assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
 });
 
+test("required release metadata cannot be hidden by build-input exclusions", () => {
+  const primary = makeRepo();
+  writeFileSync(path.join(primary, "package.json"), "{\"version\":\"2.0.0\"}\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, {
+    ...buildInputs,
+    exclude: [...buildInputs.exclude, "package.json"],
+    required: ["package.json"],
+  }), ["package.json"]);
+  assert.deepEqual(dirtyBuildInputs(primary, {
+    include: ["package.json"],
+    required: ["package.json"],
+  }), ["package.json"]);
+});
+
 test("checks only build-relevant fields in mixed-purpose JSON manifests", () => {
   const primary = makeRepo();
   writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ scripts: { bakeoff: "node eval.mjs" } })}\n`);

package/build-release.mjs

@@ -42,12 +42,15 @@ for (let i = 0; i < args.length; i += 1) {
 }
 if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
 
-const invocationRoot = path.dirname(path.resolve(configName));
+const configPath = path.resolve(configName);
+const invocationRoot = path.dirname(configPath);
 const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
 assertPrimaryReleaseCheckout(repoRoot);
-const relativeConfig = path.relative(repoRoot, path.resolve(configName)).replaceAll("\\", "/");
+const relativeConfig = path.relative(repoRoot, configPath).replaceAll("\\", "/");
 if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
-const vaultRoot = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) }).vaultRoot;
+const appRoot = path.dirname(configPath);
+const layout = resolveReleaseLayout({ repoRoot, configPath });
+const vaultRoot = layout.vaultRoot;
 mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
 const lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
 let child = null;
@@ -65,31 +68,20 @@ for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
 
 try {
   throwIfInterrupted();
-  if (!dryRun) git(repoRoot, ["fetch", "origin", "main"]);
-  const commit = git(repoRoot, ["rev-parse", dryRun ? "HEAD" : "origin/main"]);
+  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
   const shortCommit = commit.slice(0, 8);
-  const worktree = path.join(vaultRoot, "worktrees", `${platform}-${shortCommit}`);
-  if (!existsSync(worktree)) {
-    if (dryRun) fail(`dry-run needs an existing worktree: ${worktree}`);
-    mkdirSync(path.dirname(worktree), { recursive: true });
-    runChecked("git", ["worktree", "add", "--detach", worktree, commit], repoRoot);
-  } else if (git(worktree, ["rev-parse", "HEAD"]) !== commit) {
-    fail(`release worktree exists at the wrong commit: ${worktree}`);
-  }
-
-  const worktreeConfigPath = path.join(worktree, relativeConfig);
-  const appRoot = path.dirname(worktreeConfigPath);
-  const layout = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) });
-  const config = (await import(`${pathToFileURL(worktreeConfigPath).href}?commit=${commit}`)).default;
+  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+  if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
+  const config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
     fail("app and version must be safe release-id components");
   }
   const target = config.targets?.[platform];
   if (!target?.package) fail(`${config.app} has no ${platform} package command`);
-  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, invocationRoot, relativeConfig, target.buildInputs ?? config.buildInputs), commit);
+  const requiredInputs = inputPaths(appRoot, configPath, target);
+  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, appRoot, target.buildInputs ?? config.buildInputs, requiredInputs), commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
-  const requiredInputs = inputPaths(appRoot, worktreeConfigPath, target);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
@@ -141,6 +133,8 @@ try {
     commit,
     platform,
     requiredInputs,
+    inputHashes,
+    cacheKey,
     ops: {
       preflight: async () => {
         throwIfInterrupted();
@@ -168,7 +162,7 @@ try {
         mkdirSync(cacheTarget, { recursive: true });
         if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
-          fail(`worktree target exists and is not the release cache link: ${targetLink}`);
+          fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
         await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget);
       },
@@ -176,7 +170,7 @@ try {
         throwIfInterrupted();
         await runProgress(
           process.execPath,
-          [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"],
+          [WORKER, "--config", configPath, "--platform", platform, "--no-upload"],
           appRoot,
           env,
           [env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
@@ -186,7 +180,7 @@ try {
         checkpoint(stateRoot, "hardened");
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: path.dirname(worktreeConfigPath), sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
+        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -220,20 +214,19 @@ function inputPaths(appRoot, configPath, target) {
   return required;
 }
 
-function repoBuildInputs(repoRoot, appRoot, relativeConfig, configured) {
+function repoBuildInputs(repoRoot, appRoot, configured, requiredInputs) {
   if (!Array.isArray(configured?.include) || configured.include.length === 0) {
     fail("release config must declare non-empty buildInputs.include paths");
   }
   const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
-  const qualify = (pattern) => [appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/");
+  const qualify = (pattern) => path.posix.normalize([appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/"));
+  const required = requiredInputs
+    .map((file) => path.relative(repoRoot, file).replaceAll("\\", "/"))
+    .filter((file) => file && file !== ".." && !file.startsWith("../") && !path.isAbsolute(file));
   return {
-    include: [
-      relativeConfig,
-      qualify("package.json"),
-      qualify("pnpm-lock.yaml"),
-      ...configured.include.map(qualify),
-    ],
+    include: configured.include.map(qualify),
     exclude: (configured.exclude ?? []).map(qualify),
+    required,
     json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
   };
 }

package/build-release.test.mjs

@@ -22,3 +22,23 @@ test("macOS builds default to Cache V2 while explicit legacy mode remains availa
   assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
   assert.match(source, /dirtyBuildInputs\(repoRoot/);
 });
+
+test("production builds package from the real primary app checkout", () => {
+  assert.match(source, /const configPath = path\.resolve\(configName\)/);
+  assert.match(source, /const appRoot = path\.dirname\(configPath\)/);
+  assert.match(source, /\[WORKER, "--config", configPath, "--platform", platform, "--no-upload"\]/);
+  assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
+});
+
+test("production builds never create or use an internal Git worktree", () => {
+  assert.doesNotMatch(source, /git", \["worktree", "add"/);
+  assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);
+  assert.doesNotMatch(source, /worktreeConfigPath/);
+});
+
+test("dirty release config is rejected before the config module is imported", () => {
+  const guard = source.indexOf("dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit)");
+  const imported = source.indexOf("await import(");
+  assert.ok(guard >= 0, "config cleanliness guard must exist");
+  assert.ok(guard < imported, "config cleanliness guard must run before module import");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-invocation.mjs

@@ -21,6 +21,8 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
   if (canonical(repoRoot) !== canonical(primary)) {
     throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
   }
+  const branch = spawnSync("git", ["symbolic-ref", "--quiet", "HEAD"], { cwd: repoRoot, encoding: "utf8", windowsHide: true });
+  if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
 }
 
 function pathspec(pattern, exclude = false) {
@@ -55,9 +57,25 @@ export function dirtyBuildInputs(repoRoot, inputs, baseline = "HEAD") {
   if (!Array.isArray(inputs?.include) || inputs.include.length === 0) {
     throw new Error("release config must declare non-empty buildInputs.include paths");
   }
+  const required = new Set(inputs.required ?? []);
+  const files = [
+    ...statusFiles(repoRoot, inputs.include, inputs.exclude),
+    ...statusFiles(repoRoot, [...required], []),
+  ];
+  return [...new Set(files)]
+    .filter((file) => required.has(file)
+      ? fileChangedFromBaseline(repoRoot, file, baseline)
+      : inputs.json?.[file]
+      ? jsonProjectionChanged(repoRoot, file, inputs.json[file], baseline)
+      : fileChangedFromBaseline(repoRoot, file, baseline))
+    .sort();
+}
+
+function statusFiles(repoRoot, include, exclude = []) {
+  if (!include.length) return [];
   const specs = [
-    ...inputs.include.map((pattern) => pathspec(pattern)),
-    ...(inputs.exclude ?? []).map((pattern) => pathspec(pattern, true)),
+    ...include.map((pattern) => pathspec(pattern)),
+    ...exclude.map((pattern) => pathspec(pattern, true)),
   ];
   const output = git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...specs]);
   const records = output.split("\0");
@@ -69,9 +87,5 @@ export function dirtyBuildInputs(repoRoot, inputs, baseline = "HEAD") {
     files.push(record.slice(3).replaceAll("\\", "/"));
     if (/[RC]/.test(status)) index += 1;
   }
-  return [...new Set(files)]
-    .filter((file) => inputs.json?.[file]
-      ? jsonProjectionChanged(repoRoot, file, inputs.json[file], baseline)
-      : fileChangedFromBaseline(repoRoot, file, baseline))
-    .sort();
+  return files;
 }

package/release-state.mjs

@@ -111,6 +111,8 @@ export async function runBuildStateMachine({
   commit,
   platform,
   requiredInputs = [],
+  inputHashes,
+  cacheKey,
   ops,
 }) {
   const releaseId = `${app}-${version}-${commit.slice(0, 8)}`;
@@ -121,6 +123,11 @@ export async function runBuildStateMachine({
     if (sealed.manifest.app !== app || sealed.manifest.version !== version || sealed.manifest.commit !== commit) {
       throw new Error(`sealed release identity mismatch: ${releaseId}`);
     }
+    if (sealed.manifest.platform !== platform) throw new Error(`sealed release platform identity mismatch: ${releaseId}`);
+    if (inputHashes && JSON.stringify(sealed.manifest.inputs) !== JSON.stringify(inputHashes)) {
+      throw new Error(`sealed release input identity mismatch: ${releaseId}`);
+    }
+    if (cacheKey && sealed.manifest.cacheKey !== cacheKey) throw new Error(`sealed release cache identity mismatch: ${releaseId}`);
     return { status: "sealed", resumed: true, releaseId, sealedDir };
   }
   await ops.preflight?.({ root, app, version, commit, platform, requiredInputs, releaseId });

package/release-state.test.mjs

@@ -198,6 +198,40 @@ test("a valid sealed release resumes without rebuilding", async () => {
   assert.equal(builds, 0);
 });
 
+test("sealed build resume rejects changed input or cache identity", async () => {
+  const fx = fixture();
+  fx.manifest.inputs = { "src-tauri/Cargo.lock": "old-hash" };
+  fx.manifest.cacheKey = "old-cache";
+  writeFileSync(path.join(fx.sealedDir, "release-manifest.json"), `${JSON.stringify(fx.manifest, null, 2)}\n`);
+
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: fx.manifest.app,
+      version: fx.manifest.version,
+      commit: fx.manifest.commit,
+      platform: fx.manifest.platform,
+      inputHashes: { "src-tauri/Cargo.lock": "new-hash" },
+      cacheKey: fx.manifest.cacheKey,
+      ops: {},
+    }),
+    /sealed release input identity mismatch/i,
+  );
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: fx.manifest.app,
+      version: fx.manifest.version,
+      commit: fx.manifest.commit,
+      platform: fx.manifest.platform,
+      inputHashes: fx.manifest.inputs,
+      cacheKey: "new-cache",
+      ops: {},
+    }),
+    /sealed release cache identity mismatch/i,
+  );
+});
+
 test("manifest or file tampering blocks upload before any mutation", async () => {
   const fx = fixture();
   writeFileSync(fx.installer, "changed");

package/right-suite-contract.test.mjs

@@ -32,6 +32,33 @@ const apps = [
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
+function assertReleasePackageScripts(scripts, label) {
+  for (const platform of ["mac", "win"]) {
+    assert.equal(scripts[`release:build:${platform}`], `right-release build --platform ${platform}`, `${label} must use the tier-neutral ${platform} build entry point`);
+    for (const tier of ["patch", "update"]) {
+      assert.equal(scripts[`release:upload:${tier}:${platform}`], `right-release upload --platform ${platform} --tier ${tier}`, `${label} must select ${tier} only during ${platform} upload`);
+    }
+  }
+
+  const genericTauri = scripts.tauri;
+  if (typeof genericTauri === "string") {
+    assert.doesNotMatch(
+      genericTauri.trim(),
+      /^(?:(?:pnpm|npm)\s+(?:(?:exec|dlx)\s+)?|npx\s+)?(?:(?:\.\/)?node_modules\/\.bin\/)?(?:@tauri-apps\/cli\s+)?tauri(?:\s|$)/,
+      `${label} generic \"tauri\" package script bypasses the RightKit release entry points; use an explicitly named dev, debug, unsigned, or local command instead`,
+    );
+  }
+}
+
+function assertMacPackageEntry(packageCommand, scripts, label) {
+  assert.equal(packageCommand.cmd, "pnpm", `${label} must use the shared pnpm package entry point`);
+  assert.deepEqual(packageCommand.args, ["run", "rightkit:package:mac"], `${label} R2 release must use the dedicated signed and notarized macOS package entry point`);
+  const implementation = scripts["rightkit:package:mac"];
+  assert.equal(typeof implementation, "string", `${label} must define rightkit:package:mac`);
+  assert.doesNotMatch(implementation, /\bright-release\b/, `${label} rightkit:package:mac must package directly instead of recursing into the release build`);
+  assert.doesNotMatch(implementation, /\bpnpm(?:\s+run)?\s+rightkit:package:mac\b/, `${label} rightkit:package:mac must not recurse into itself`);
+}
+
 function resolveCargoVersionContract(versionManifest, canonicalVersions) {
   const consumer = new Map(Object.entries(versionManifest.cargo ?? {}));
   const staged = new Map(Object.entries(versionManifest.stagedCargo ?? {}));
@@ -314,10 +341,58 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
   );
 });
 
+test("release package scripts use tier-neutral builds and tiered uploads", () => {
+  const scripts = {
+    "release:build:mac": "right-release build --platform mac",
+    "release:build:win": "right-release build --platform win",
+    "release:upload:patch:mac": "right-release upload --platform mac --tier patch",
+    "release:upload:patch:win": "right-release upload --platform win --tier patch",
+    "release:upload:update:mac": "right-release upload --platform mac --tier update",
+    "release:upload:update:win": "right-release upload --platform win --tier update",
+  };
+  assert.doesNotThrow(() => assertReleasePackageScripts(scripts, "fixture"));
+});
+
+test("release package scripts reject a generic direct Tauri alias but allow named local commands", () => {
+  const scripts = {
+    "release:build:mac": "right-release build --platform mac",
+    "release:build:win": "right-release build --platform win",
+    "release:upload:patch:mac": "right-release upload --platform mac --tier patch",
+    "release:upload:patch:win": "right-release upload --platform win --tier patch",
+    "release:upload:update:mac": "right-release upload --platform mac --tier update",
+    "release:upload:update:win": "right-release upload --platform win --tier update",
+    "tauri:dev": "tauri dev",
+    "mac:build:debug": "tauri build --debug",
+    "build:win:unsigned": "tauri build --bundles nsis --no-sign",
+    "cargo:check": "cargo check --locked",
+  };
+  assert.doesNotThrow(() => assertReleasePackageScripts(scripts, "fixture"));
+  for (const genericTauri of ["tauri", "pnpm exec tauri", "pnpm dlx tauri", "./node_modules/.bin/tauri"]) {
+    assert.throws(
+      () => assertReleasePackageScripts({ ...scripts, tauri: genericTauri }, "fixture"),
+      /generic \"tauri\" package script bypasses/i,
+      genericTauri,
+    );
+  }
+});
+
+test("mac release config uses a dedicated non-recursive package entry point", () => {
+  const command = { cmd: "pnpm", args: ["run", "rightkit:package:mac"] };
+  assert.doesNotThrow(() => assertMacPackageEntry(command, { "rightkit:package:mac": "node scripts/mac-dmg.mjs --notarize" }, "fixture"));
+  assert.throws(
+    () => assertMacPackageEntry(command, { "rightkit:package:mac": "right-release build --platform mac" }, "fixture"),
+    /instead of recursing into the release build/i,
+  );
+  assert.throws(
+    () => assertMacPackageEntry(command, { "rightkit:package:mac": "pnpm run rightkit:package:mac" }, "fixture"),
+    /must not recurse into itself/i,
+  );
+});
+
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.39");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.40");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -399,14 +474,7 @@ for (const app of apps) {
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
     assert.equal(pkg.scripts["release:mac"], undefined, "tierless release entry points are forbidden");
     assert.equal(pkg.scripts["release:win"], undefined, "tierless release entry points are forbidden");
-    assert.equal(pkg.scripts["release:patch:mac"], "right-release --platform mac --tier patch");
-    assert.equal(pkg.scripts["release:patch:win"], "right-release --platform win --tier patch");
-    assert.equal(pkg.scripts["release:update:mac"], "right-release --platform mac --tier update");
-    assert.equal(pkg.scripts["release:update:win"], "right-release --platform win --tier update");
-    assert.equal(pkg.scripts["publish:patch:mac"], "right-release publish --platform mac --tier patch");
-    assert.equal(pkg.scripts["publish:patch:win"], "right-release publish --platform win --tier patch");
-    assert.equal(pkg.scripts["publish:update:mac"], "right-release publish --platform mac --tier update");
-    assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
+    assertReleasePackageScripts(pkg.scripts, app.key);
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
     assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /^(?:release|publish):/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} release/publish commands must not expose an unsigned macOS DMG mode`);
@@ -431,8 +499,7 @@ for (const app of apps) {
         assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
       }
     }
-    assert.equal(config.targets.mac.package.cmd, "pnpm", `${app.key} must use the shared pnpm package entry point`);
-    assert.deepEqual(config.targets.mac.package.args, ["run", "mac:dmg:notarized"], `${app.key} R2 release must use the signed and notarized macOS package entry point`);
+    assertMacPackageEntry(config.targets.mac.package, pkg.scripts, app.key);
     for (const installer of config.targets.mac.installer.artifacts) {
       assert.equal(path.dirname(installer.file), ".", `${app.key} macOS installer must be copied to the app package root before upload`);
     }

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.39",
+    "@rightkit/release": "0.2.40",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },