@rightkit/release 0.2.68 → 0.2.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.68",
+  "version": "0.2.69",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,6 +15,13 @@
     "*.py"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "prepublishOnly": "pnpm test && pnpm test:registry-parity",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -24,10 +31,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/pipeline-normalization-contract.test.mjs

@@ -0,0 +1,140 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import test from "node:test";
+
+const workspace = path.resolve(
+  process.env.RIGHT_SUITE_CONTRACT_WORKSPACE
+    ?? new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"),
+);
+
+const packageRoots = [
+  "coderight/apps/coderight-tauri",
+  "cutright/apps/studio",
+  "genright",
+  "heardright/tauri-app-next",
+  "mailright",
+  "membrane/apps/membrane-hub",
+  "scraperight",
+  "viewright",
+  "voiceright",
+];
+
+const releaseConfigRoots = [
+  ...packageRoots,
+  "tools/screenright",
+];
+
+const rightGitRepos = ["cutright", "legion", "membrane"];
+const privateRepos = ["rightsites", "sellright", "workright"];
+
+function executableSource(source) {
+  return source
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
+    .join("\n");
+}
+
+function pipelineScripts(root) {
+  const repo = execFileSync("git", ["-C", root, "rev-parse", "--show-toplevel"], { encoding: "utf8", windowsHide: true }).trim();
+  const prefix = path.relative(repo, root).replaceAll(path.sep, "/");
+  const tracked = execFileSync("git", ["-C", repo, "ls-files", "-z"], { encoding: "utf8", windowsHide: true })
+    .split("\0")
+    .filter(Boolean);
+  return tracked
+    .filter((entry) => {
+      const local = prefix ? entry.slice(prefix.length + 1) : entry;
+      if (prefix && !entry.startsWith(`${prefix}/`)) return false;
+      return (
+        local.startsWith("scripts/")
+        || local === "package.ps1"
+        || local === "package.sh"
+      ) && /\.(?:mjs|cjs|js|ts|ps1|sh|py)$/i.test(local)
+        && !/(?:^|[.-])test(?:[.-]|$)/i.test(path.basename(local));
+    })
+    .map((entry) => path.join(repo, entry))
+    .filter((entry) => existsSync(entry));
+}
+
+test("product package pipelines use installed RightKit commands", () => {
+  const violations = [];
+  for (const root of packageRoots) {
+    const manifestPath = path.join(workspace, root, "package.json");
+    if (!existsSync(manifestPath)) continue;
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
+      if (!/^(?:build|package|publish|release|deps|verify:rust|test:rust|lint:rust)/.test(name)) continue;
+      if (/(?:\.\.\/[\w./-]*)?tools\/right-release|tools\\right-release/i.test(command)) violations.push(`${root} ${name}: retired workspace-local right-release source`);
+      if (/(?:^|&&|\|\||;)\s*cargo\s+/i.test(command)) violations.push(`${root} ${name}: bare cargo`);
+      if (/(?:^|&&|\|\||;)\s*npx\s+/i.test(command)) violations.push(`${root} ${name}: npx`);
+      if (/(?:^|&&|\|\||;)\s*npm\s+(?:ci|install)\b/i.test(command)) violations.push(`${root} ${name}: npm install`);
+    }
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("release configs resolve Cargo output through RightKit", () => {
+  const violations = [];
+  for (const root of releaseConfigRoots) {
+    const configPath = path.join(workspace, root, "right-release.config.mjs");
+    if (!existsSync(configPath)) continue;
+    const source = executableSource(readFileSync(configPath, "utf8"));
+    const hardcodedTargetRoot = /(?:const|let|var)\s+\w+\s*=\s*["'`]src-tauri[\\/]target/i.test(source);
+    const hardcodedTargetArtifact = /(?:file|signature)\s*:\s*["'`]src-tauri[\\/]target/i.test(source);
+    if (!hardcodedTargetRoot && !hardcodedTargetArtifact) continue;
+    if (!/@rightkit\/release\/cargo-target\.mjs|\.\/scripts\/lib\/target-root\.mjs/.test(source)) violations.push(`${root}: no RightKit target resolver`);
+    if (!/resolve(?:TargetRoot|WindowsReleaseDir)\s*\(/.test(source)) violations.push(`${root}: resolver not invoked`);
+    if (hardcodedTargetRoot) violations.push(`${root}: hardcoded target root`);
+    if (hardcodedTargetArtifact) violations.push(`${root}: hardcoded target artifact`);
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("product pipeline children use managed Rust commands", () => {
+  const violations = [];
+  for (const root of packageRoots) {
+    for (const file of pipelineScripts(path.join(workspace, root))) {
+      const source = executableSource(readFileSync(file, "utf8"));
+      const label = path.relative(workspace, file);
+      if (/(?:spawnSync|spawn|execFileSync|execFile)\s*\(\s*["'`](?:cargo|rustc|rustdoc)["'`]/.test(source)) violations.push(`${label}: unmanaged JS child`);
+      if (/subprocess\.(?:run|Popen)\s*\(\s*\[\s*["'](?:cargo|rustc|rustdoc)["']/.test(source)) violations.push(`${label}: unmanaged Python child`);
+      if (/(?:^|\n)\s*(?:&\s*)?(?:cargo|rustc|rustdoc)\s+(?:build|check|clippy|metadata|test|-vV)\b/m.test(source)) violations.push(`${label}: unmanaged shell command`);
+    }
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("hosted workflows are generated by right-git", () => {
+  const violations = [];
+  for (const root of rightGitRepos) {
+    const workflowRoot = path.join(workspace, root, ".github", "workflows");
+    if (!existsSync(workflowRoot)) continue;
+    for (const entry of readdirSync(workflowRoot, { withFileTypes: true })) {
+      if (!entry.isFile() || !/\.ya?ml$/i.test(entry.name)) continue;
+      const source = readFileSync(path.join(workflowRoot, entry.name), "utf8");
+      if (!/^# Managed by right-git\b/.test(source)) violations.push(`${root}/.github/workflows/${entry.name}: not right-git managed`);
+    }
+  }
+  for (const root of privateRepos) {
+    const workflowRoot = path.join(workspace, root, ".github", "workflows");
+    const workflows = existsSync(workflowRoot)
+      ? readdirSync(workflowRoot).filter((entry) => /\.ya?ml$/i.test(entry))
+      : [];
+    if (workflows.length) violations.push(`${root}: private repo has ${workflows.join(", ")}`);
+  }
+  assert.deepEqual(violations, []);
+});
+
+test("workspace memory pipelines route Rust through RightKit", () => {
+  for (const relative of [
+    "tools/pipelines/memory/dispatch/gate.py",
+    "tools/pipelines/memory/install-cortex.py",
+    "tools/pipelines/memory/verify-source-owner.py",
+  ]) {
+    const source = executableSource(readFileSync(path.join(workspace, relative), "utf8"));
+    assert.doesNotMatch(source, /(?:^|&&|\|\||;)\s*cargo\s+(?:metadata|build|check|clippy|test)\b/m, `${relative} invokes bare Cargo shell command`);
+    assert.doesNotMatch(source, /subprocess\.run\(\s*\[\s*["']cargo["']/m, `${relative} invokes bare Cargo subprocess`);
+  }
+});

package/registry-parity.test.mjs

@@ -21,7 +21,7 @@ test('registry parity distinguishes an unpublished version from registry failure
   assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
     status: 'UNPUBLISHED',
     name: '@rightkit/release',
-    version: '0.2.68',
+    version: '0.2.69',
   });
   await assert.rejects(
     verifyRegistryParity({ fetchImpl: notFound }),

package/release.mjs

@@ -29,7 +29,8 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
 );
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
-const WINDOWS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const WINDOWS_NSIS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const WINDOWS_PORTABLE_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-portable-v1";
 const DEFAULT_NOTARIZATION_TIMEOUT_MS = 30 * 60 * 1000;
 
 const args = process.argv.slice(2);
@@ -91,7 +92,7 @@ if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<m
 
 const root = path.dirname(configPath);
 const workdir = path.resolve(root, config.workdir ?? ".");
-await validateRightKitPackageContract(root, config.app);
+await validateRightKitPackageContract(root, config.app, config.hostedWorkflows);
 validateRightKitCargoContract(root, RIGHTKIT_CARGO_ALLOWED, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
@@ -101,14 +102,16 @@ const legalContract = config.legal
 if (target.signed !== true) {
   fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
 }
-if (opts.platform === "win" && !target.sign?.files?.length) {
-  fail(`${config.app ?? "app"} win must declare sign.files for the signed release pipeline`);
-}
 if (opts.platform === "win") {
-  if (target.signingContract !== WINDOWS_SIGNING_CONTRACT) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_SIGNING_CONTRACT}`);
+  const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
+  const isPortable = target.signingContract === WINDOWS_PORTABLE_SIGNING_CONTRACT;
+  if (!isNsis && !isPortable) fail(`${config.app ?? "app"} win must declare signingContract: ${WINDOWS_NSIS_SIGNING_CONTRACT} or ${WINDOWS_PORTABLE_SIGNING_CONTRACT}`);
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} win must declare prePackage for the raw EXE build`);
-  if (target.sign?.prePackageFiles?.length !== 1) fail(`${config.app ?? "app"} win must declare exactly one sign.prePackageFiles raw EXE`);
-  if (target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+  if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} win must declare at least one sign.prePackageFiles raw EXE`);
+  if (isNsis && target.sign.prePackageFiles.length !== 1) fail(`${config.app ?? "app"} win NSIS must declare exactly one sign.prePackageFiles raw EXE`);
+  if (isNsis && !target.sign?.files?.length) fail(`${config.app ?? "app"} win NSIS must declare sign.files for installer signing`);
+  if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
+  if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
@@ -206,7 +209,8 @@ if (opts.platform === "win") {
   // bundling, and doing that to signed bytes invalidates Authenticode — the exact
   // defect that shipped invalid binaries. Idempotent, so an app that still patches
   // in its own prePackage script simply reports alreadyPatched here.
-  bundleMarkerReceipts = opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
+  const isNsis = target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT;
+  bundleMarkerReceipts = !isNsis || opts.dryRun ? [] : rawFiles.map((file) => patchTauriBundleType(file, { bundle: target.bundleMarker ?? "nsis" }));
   for (const receipt of bundleMarkerReceipts) {
     console.log(`right-release: bundle marker ${receipt.bundle} ${receipt.alreadyPatched ? "already applied" : "applied"} at offset ${receipt.offset} in ${path.basename(receipt.file)}`);
   }
@@ -219,7 +223,7 @@ for (const rel of target.artifacts ?? []) {
   await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
 }
 
-if (opts.platform === "win" && target.sign?.files?.length) {
+if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT) {
   const files = target.sign.files.map((p) => path.resolve(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
   // Before the installer earns its own signature, prove it carries the bytes we
@@ -360,16 +364,16 @@ function commandTimeoutMs(command) {
     : undefined;
 }
 
-async function validateRightKitPackageContract(root, appName) {
+async function validateRightKitPackageContract(root, appName, hostedWorkflows) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
   assertQaBackdoorContract(root, scripts);
   const workflowDir = path.join(root, ".github", "workflows");
   if (existsSync(workflowDir)) {
-    const workflows = await readdir(workflowDir);
+    const workflows = (await readdir(workflowDir)).sort();
     if (workflows.length) {
-      fail(`${appName ?? pkg.name ?? "app"} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+      await validateHostedWorkflows(root, appName ?? pkg.name ?? "app", workflows, hostedWorkflows);
     }
   }
   if (pkg.packageManager !== RIGHTKIT_VERSIONS.packageManager) {
@@ -394,6 +398,33 @@ async function validateRightKitPackageContract(root, appName) {
   }
 }
 
+async function validateHostedWorkflows(root, appName, workflows, policy) {
+  if (policy !== "right-git-ci-only") {
+    fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
+  }
+  if (workflows.length !== 1 || workflows[0] !== "ci.yml") {
+    fail(`${appName} right-git-ci-only policy permits only ci.yml, got: ${workflows.join(", ")}`);
+  }
+  const manifestPath = path.join(root, ".rightgit.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  } catch {
+    fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
+  }
+  if (manifest?.schemaVersion !== 1 || JSON.stringify(manifest?.lanes) !== JSON.stringify(["ci"])) {
+    fail(`${appName} right-git-ci-only policy requires .rightgit.json lanes=["ci"]`);
+  }
+  const source = await readFile(path.join(root, ".github", "workflows", "ci.yml"), "utf8");
+  if (!source.startsWith("# Managed by right-git")) {
+    fail(`${appName} ci.yml is not marked as right-git managed`);
+  }
+  if (/^\s*(?:actions|attestations|contents|id-token|packages|security-events):\s*write\s*$/mi.test(source)
+    || /\bsecrets\s*\./i.test(source)) {
+    fail(`${appName} right-git managed ci.yml requests release-capable permissions or secrets`);
+  }
+}
+
 function buildAllowedVersions(published = {}, staged = {}, legacy = {}) {
   const allowed = new Map();
   for (const [name, value] of [
@@ -423,7 +454,7 @@ function expandEnv(value) {
 
 async function signWindows(files, phase, root) {
   const args = [SIGN_WINDOWS];
-  const receipt = path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
+  const receipt = windowsReceiptPath(root, phase);
   if (opts.dryRun) args.push("--dry-run");
   else {
     if (existsSync(receipt)) unlinkSync(receipt);
@@ -435,6 +466,8 @@ async function signWindows(files, phase, root) {
 }
 
 function windowsReceiptPath(root, phase) {
+  const configured = phase === "raw-exe" ? target.sign?.receipt : target.sign?.installerReceipt;
+  if (configured) return path.resolve(root, configured);
   return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
 }
 

package/release.test.mjs

@@ -16,7 +16,7 @@ function git(cwd, ...args) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 
-function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], packageJson, packageCommand, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
+function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], signFiles = ["fixture.exe"], packageJson, packageCommand, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win", hostedWorkflows } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -45,6 +45,7 @@ function fixture({ signed = true, publish = false, signingContract = "windows-ra
       app: "fixture",
       packageManager: "pnpm",
       checks: [],
+      ...(hostedWorkflows ? { hostedWorkflows } : {}),
       targets: {
         [platform]: {
           ...(buildInputs ? { buildInputs } : {}),
@@ -52,7 +53,7 @@ function fixture({ signed = true, publish = false, signingContract = "windows-ra
           package: packageCommand ?? { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
           artifacts: [],
-          ...(platform === "win" ? { signingContract, prePackage: { cmd: "node", args: ["-e", "process.exit(0)"] }, sign: { prePackageFiles, files: ["fixture.exe"] } } : {}),
+          ...(platform === "win" ? { signingContract, prePackage: { cmd: "node", args: ["-e", "process.exit(0)"] }, sign: { prePackageFiles, files: signFiles } } : {}),
           updater: { artifacts: [{ file: "fixture.exe", signature: "fixture.exe.sig", platform: "windows-x86_64", key: "fixture/fixture.exe" }] },
           hardening: [],
         },
@@ -240,6 +241,32 @@ test("rejects Windows targets with missing or ambiguous signing configuration",
   }
 });
 
+test("accepts portable Windows releases with multiple pre-package executables and no installer", () => {
+  const result = run(fixture({
+    signingContract: "windows-raw-exe-authenticode-before-portable-v1",
+    prePackageFiles: ["legion.exe", "legion-hook.exe", "legion-mcp.exe"],
+    signFiles: [],
+  }), "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /raw-exe/);
+  assert.doesNotMatch(result.stdout, /bundle marker/);
+});
+
+test("uses a configured signing receipt path for portable architecture isolation", () => {
+  const source = readFileSync(release, "utf8");
+  assert.match(source, /phase === "raw-exe" \? target\.sign\?\.receipt : target\.sign\?\.installerReceipt/);
+  assert.match(source, /if \(configured\) return path\.resolve\(root, configured\)/);
+});
+
+test("rejects portable Windows releases that declare a second installer signing phase", () => {
+  const result = run(fixture({
+    signingContract: "windows-raw-exe-authenticode-before-portable-v1",
+    prePackageFiles: ["legion.exe"],
+  }), "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /portable.*omit sign\.files/i);
+});
+
 test("rejects Git, path, or link RightKit app dependencies before release work starts", () => {
   const result = run(
     fixture({
@@ -273,6 +300,35 @@ test("rejects hosted workflow files before release work starts", () => {
   assert.match(result.stderr, /hosted workflow.*forbidden/i);
 });
 
+test("accepts one right-git managed CI workflow without granting hosted release authority", () => {
+  const config = fixture({ hostedWorkflows: "right-git-ci-only" });
+  const root = path.dirname(config);
+  const workflowDir = path.join(root, ".github", "workflows");
+  mkdirSync(workflowDir, { recursive: true });
+  writeFileSync(path.join(root, ".rightgit.json"), JSON.stringify({ schemaVersion: 1, lanes: ["ci"] }));
+  writeFileSync(path.join(workflowDir, "ci.yml"), "# Managed by right-git — do not hand-edit.\npermissions:\n  contents: read\njobs: {}\n");
+  git(root, "add", ".");
+  git(root, "commit", "-m", "add managed ci");
+
+  const result = run(config, "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test("rejects a self-labeled right-git workflow with release-capable authority", () => {
+  const config = fixture({ hostedWorkflows: "right-git-ci-only" });
+  const root = path.dirname(config);
+  const workflowDir = path.join(root, ".github", "workflows");
+  mkdirSync(workflowDir, { recursive: true });
+  writeFileSync(path.join(root, ".rightgit.json"), JSON.stringify({ schemaVersion: 1, lanes: ["ci"] }));
+  writeFileSync(path.join(workflowDir, "ci.yml"), "# Managed by right-git\npermissions:\n  id-token: write\njobs: {}\n");
+  git(root, "add", ".");
+  git(root, "commit", "-m", "add unsafe ci");
+
+  const result = run(config, "--tier=patch");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /release-capable permissions or secrets/i);
+});
+
 test("doctor accepts an exact crates.io RightKit pin with benign Cargo config", () => {
   const config = fixture({
     platform: hostPlatform,

package/right-suite-contract.test.mjs

@@ -489,7 +489,7 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.68",
+    "@rightkit/release": "0.2.69",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4",
   });
@@ -498,7 +498,7 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/hooks": ["0.1.0"],
     "@rightkit/legal": ["0.3.0"],
     "@rightkit/license": ["0.1.6"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66", "0.2.67"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66", "0.2.67", "0.2.68"],
     "@rightkit/qa": ["0.1.0", "0.2.0"],
   });
   assert.ok(
@@ -717,8 +717,12 @@ for (const app of apps) {
 }
 
 for (const app of macOnlyApps) {
-  test(`${app.key} follows the macOS-only AppKit Right Release contract`, async () => {
+  test(`${app.key} follows the macOS-only AppKit Right Release contract`, async (context) => {
     const root = path.join(workspace, app.root);
+    if (!existsSync(path.join(root, "package.json"))) {
+      context.skip(`${app.key} is not present in this checkout`);
+      return;
+    }
     const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
     assert.equal(pkg.scripts["release:build:mac"], "right-release build --platform mac");

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.68",
+    "@rightkit/release": "0.2.69",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -63,7 +63,8 @@
       "0.2.64",
       "0.2.65",
       "0.2.66",
-      "0.2.67"
+      "0.2.67",
+      "0.2.68"
     ],
     "@rightkit/qa": [
       "0.1.0",