@rightkit/release 0.2.69 → 0.2.70

package/publish-update.test.mjs

@@ -1,207 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-
-const publisher = fileURLToPath(new URL("./publish-update.mjs", import.meta.url));
-
-function fixture({ materialize = false } = {}) {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
-        updater: {
-          artifacts: [
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/updates/windows/current/Fixture.exe" },
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-arm64", key: "fixture/updates/windows/current/Fixture.exe" },
-          ],
-        },
-      },
-    },
-  })};\n`);
-  if (materialize) {
-    writeFileSync(path.join(dir, "Fixture-Setup.exe"), "signed installer");
-    writeFileSync(path.join(dir, "Fixture.exe"), "signed updater");
-    writeFileSync(path.join(dir, "Fixture.exe.sig"), "updater signature");
-  }
-  return config;
-}
-
-function versionedFixture() {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/1.2.3/Fixture-Setup.exe" }] },
-        updater: {
-          artifacts: [
-            { file: "Fixture.exe", signature: "Fixture.exe.sig", platform: "windows-x86_64", key: "fixture/1.2.3/windows/Fixture.exe" },
-          ],
-        },
-      },
-    },
-  })};\n`);
-  return config;
-}
-
-function installerOnlyFixture() {
-  const dir = mkdtempSync(path.join(os.tmpdir(), "right-publish-test-"));
-  const config = path.join(dir, "right-release.config.mjs");
-  writeFileSync(config, `export default ${JSON.stringify({
-    schema: 1,
-    app: "fixture",
-    version: "1.2.3",
-    targets: {
-      win: {
-        installer: { artifacts: [{ file: "Fixture-Setup.exe", key: "fixture/installers/windows/current/Fixture-Setup.exe" }] },
-        updater: { artifacts: [] },
-      },
-    },
-  })};\n`);
-  return config;
-}
-
-function run(tier) {
-  const config = fixture();
-  return spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: tier },
-  });
-}
-
-function registrationBody(result) {
-  return result.stdout
-    .split(/\r?\n/)
-    .filter((line) => line.startsWith('{'))
-    .map((line) => JSON.parse(line))
-    .find((body) => body.artifactManifest);
-}
-
-test("patch registers a free updater manifest backed by public installer-path objects", () => {
-  const result = run("patch");
-  assert.equal(result.status, 0, result.stderr);
-  const patchPayloadUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture.exe");
-  const installerUpload = result.stdout.indexOf("UPLOAD public/fixture/installers/windows/current/Fixture-Setup.exe");
-  const registration = result.stdout.indexOf("/v1/admin/apps/patches");
-  assert.ok(patchPayloadUpload >= 0, "patch updater payload must upload to the public installer path");
-  assert.ok(installerUpload >= 0, "patch download installer must upload to the public installer path");
-  assert.ok(patchPayloadUpload < installerUpload, "patch should upload app-update payloads before replacing the public download installer");
-  assert.ok(installerUpload < registration, "patch should register only after uploads complete");
-  assert.doesNotMatch(result.stdout, /UPLOAD public\/fixture\/updates\//);
-  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
-  assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
-  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
-  assert.match(result.stdout, /"tier":"patch"/);
-  assert.match(result.stdout, /"platform":"windows"/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
-  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 2, "patch may upload only one installer and one updater object per OS");
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
-  const body = registrationBody(result);
-  assert.deepEqual(
-    {
-      schema: body.artifactManifest.schema,
-      appKey: body.artifactManifest.appKey,
-      appVersion: body.artifactManifest.appVersion,
-      tier: body.artifactManifest.tier,
-      platform: body.artifactManifest.platform,
-    },
-    { schema: 1, appKey: 'fixture', appVersion: '1.2.3', tier: 'patch', platform: 'windows' },
-  );
-  assert.match(body.artifactManifest.pipelineVersion, /^\d+\.\d+\.\d+$/);
-  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
-    ['installer', 'fixture/installers/windows/current/Fixture-Setup.exe'],
-    ['updater', 'fixture/installers/windows/current/Fixture.exe'],
-  ]);
-  assert.match(body.artifactManifest.artifacts[1].updaterSignature, /^<signature:/);
-});
-
-test("routes feature updates to the Pro-gated release endpoint", () => {
-  const result = run("update");
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/releases/);
-  assert.match(result.stdout, /"tier":"update"/);
-  assert.match(result.stdout, /"platform":"windows"/);
-  assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*\.sig/);
-  assert.equal((result.stdout.match(/UPLOAD /g) ?? []).length, 1, "feature update may upload only one updater object per OS");
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
-  assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
-  const body = registrationBody(result);
-  assert.equal(body.artifactManifest.tier, 'update');
-  assert.deepEqual(body.artifactManifest.artifacts.map((artifact) => [artifact.kind, artifact.r2Key]), [
-    ['updater', 'fixture/updates/windows/current/Fixture.exe'],
-  ]);
-});
-
-test("allows an installer-only patch without registering an updater manifest", () => {
-  const config = installerOnlyFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
-  });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /UPLOAD public\/fixture\/installers\/windows\/current\/Fixture-Setup\.exe/);
-  assert.match(result.stdout, /NO patch updater artifacts/);
-  assert.doesNotMatch(result.stdout, /\/v1\/admin\/apps\/patches/);
-  assert.doesNotMatch(result.stdout, /UPLOAD private\//);
-  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
-});
-
-test("refuses to publish without a valid tier", () => {
-  const result = run("");
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /RIGHT_RELEASE_TIER.*patch\|update/);
-});
-
-test("refuses versioned R2 object keys that would accumulate old releases", () => {
-  const config = versionedFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "patch" },
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /current R2 object/);
-});
-
-test("refuses versioned updater object keys for gated feature updates", () => {
-  const config = versionedFixture();
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win", "--dry-run"], {
-    encoding: "utf8",
-    env: { ...process.env, RIGHT_RELEASE_TIER: "update" },
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /current R2 object/);
-});
-
-test("requires the durable release credential before the first patch upload", () => {
-  const config = fixture({ materialize: true });
-  const env = {
-    ...process.env,
-    APPDATA: path.join(path.dirname(config), "empty-appdata"),
-    RIGHT_RELEASE_TIER: "patch",
-    RIGHTAPPS_RELEASE_TOKEN_FILE: path.join(path.dirname(config), "missing-release-token"),
-    RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session",
-  };
-  delete env.RIGHTAPPS_RELEASE_TOKEN;
-  const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
-    encoding: "utf8",
-    env,
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /RIGHTAPPS_RELEASE_TOKEN/);
-  assert.doesNotMatch(result.stdout, /UPLOAD /, "credential preflight must run before R2 mutation");
-});

package/qa-contract.test.mjs

@@ -1,47 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { validateQaBackdoorContract } from "./qa-contract.mjs";
-
-function fixture({ optional = true, releaseScript = "right-release release --tier patch" } = {}) {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-qa-"));
-  mkdirSync(path.join(root, "src-tauri", "src"), { recursive: true });
-  writeFileSync(path.join(root, "right-qa.config.mjs"), "export default {};\n");
-  writeFileSync(path.join(root, "src-tauri", "Cargo.toml"), `
-[features]
-qa-native = ["dep:tauri-plugin-wdio-webdriver"]
-[dependencies]
-tauri-plugin-wdio-webdriver = { version = "1.2.0", optional = ${optional} }
-`);
-  writeFileSync(path.join(root, "src-tauri", "src", "lib.rs"), `
-#[cfg(all(not(debug_assertions), feature = "qa-native"))]
-compile_error!("qa-native must never be enabled in release builds");
-#[cfg(all(debug_assertions, feature = "qa-native"))]
-fn qa_enabled() -> bool { std::env::var("RIGHTKIT_QA_NATIVE").as_deref() == Ok("1") }
-#[cfg(all(debug_assertions, feature = "qa-native"))]
-fn add_plugin() { tauri_plugin_wdio_webdriver::init(); }
-`);
-  return { root, scripts: { "qa:native": "tauri dev --features qa-native", "release:patch:win": releaseScript } };
-}
-
-test("accepts a debug-only, runtime-gated native QA surface", () => {
-  const value = fixture();
-  assert.deepEqual(validateQaBackdoorContract(value.root, value.scripts), []);
-});
-
-test("rejects a non-optional WebDriver plugin", () => {
-  const value = fixture({ optional: false });
-  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /must be optional/);
-});
-
-test("rejects release scripts that enable native QA", () => {
-  const value = fixture({ releaseScript: "tauri build --features qa-native" });
-  assert.match(validateQaBackdoorContract(value.root, value.scripts).join("\n"), /release:patch:win/);
-});
-
-test("does not impose native QA on an app before its config lands", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-no-qa-"));
-  assert.deepEqual(validateQaBackdoorContract(root, {}), []);
-});

package/registry-parity.test.mjs

@@ -1,30 +0,0 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-import { comparePackedTrees, verifyRegistryParity } from './registry-parity.mjs';
-
-test('registry parity rejects same-version packed-byte drift', () => {
-  assert.deepEqual(comparePackedTrees([['build-release.mjs', 'new']], [['build-release.mjs', 'old']]), {
-    equal: false,
-    differences: ['build-release.mjs'],
-  });
-});
-
-test('registry parity accepts identical packed trees', () => {
-  assert.deepEqual(comparePackedTrees([['a.mjs', 'one'], ['package.json', 'two']], [['a.mjs', 'one'], ['package.json', 'two']]), {
-    equal: true,
-    differences: [],
-  });
-});
-
-test('registry parity distinguishes an unpublished version from registry failure', async () => {
-  const notFound = async () => ({ status: 404, ok: false });
-  assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
-    status: 'UNPUBLISHED',
-    name: '@rightkit/release',
-    version: '0.2.69',
-  });
-  await assert.rejects(
-    verifyRegistryParity({ fetchImpl: notFound }),
-    /registry metadata failed: HTTP 404/,
-  );
-});

package/release-cli-contract.test.mjs

@@ -1,119 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import vm from "node:vm";
-import test from "node:test";
-
-const root = path.dirname(fileURLToPath(import.meta.url));
-const cli = path.join(root, "cli", "right-release.mjs");
-const build = path.join(root, "build-release.mjs");
-const upload = path.join(root, "upload-release.mjs");
-const signWindows = path.join(root, "sign-windows.mjs");
-
-test("CLI routes build and release only to the build state machine", () => {
-  const source = readFileSync(cli, "utf8");
-  assert.match(source, /\["build",\s*"build-release\.mjs"\]/);
-  assert.match(source, /\["release",\s*"build-release\.mjs"\]/);
-});
-
-test("CLI routes upload and legacy publish only to the upload state machine", () => {
-  const source = readFileSync(cli, "utf8");
-  assert.match(source, /\["upload",\s*"upload-release\.mjs"\]/);
-  assert.match(source, /\["publish",\s*"upload-release\.mjs"\]/);
-  assert.doesNotMatch(source, /first === "publish"[\s\S]{0,500}run\("release\.mjs"/);
-});
-
-test("upload dry-run cannot write a verified marker", () => {
-  const source = readFileSync(upload, "utf8");
-  assert.match(source, /if \(!dryRun\)\s+writeJson\(verifiedMarker,/);
-});
-
-test("build is tier-neutral and rejects a tier before touching a repository", () => {
-  const result = spawnSync(process.execPath, [build, "--platform", "win", "--tier", "patch"], {
-    cwd: mkdtempSync(path.join(os.tmpdir(), "right-build-cli-")),
-    encoding: "utf8",
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /build is tier-neutral/i);
-});
-
-test("build enforces primary-checkout and build-input cleanliness guards", () => {
-  const source = readFileSync(build, "utf8");
-  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
-  assert.match(source, /dirtyBuildInputs\(repoRoot,/);
-  assert.match(source, /dirty files can change the packaged app/i);
-});
-
-test("upload enforces the same primary-checkout vault", () => {
-  const source = readFileSync(upload, "utf8");
-  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
-});
-
-test("upload requires an explicit patch or update tier before reading a release", () => {
-  const result = spawnSync(process.execPath, [upload, "--platform", "win", "--release", "fixture-1.0.0-deadbeef"], {
-    cwd: mkdtempSync(path.join(os.tmpdir(), "right-upload-cli-")),
-    encoding: "utf8",
-  });
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /tier is required.*patch\|update/i);
-});
-
-test("GitHub upload delegates platform trust verification to the shared release lane", () => {
-  const uploadSource = readFileSync(upload, "utf8");
-  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
-  const signingSource = readFileSync(signWindows, "utf8");
-  assert.match(uploadSource, /publishGitHubRelease/);
-  assert.match(githubSource, /sign-windows\.mjs/);
-  assert.match(githubSource, /--verify-only/);
-  assert.doesNotMatch(uploadSource, /CLOUDFLARE_API_TOKEN|wrangler|R2/i);
-  assert.match(signingSource, /verifyOnly/);
-  assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
-});
-
-test("Windows signer verification accepts CRLF subjects and retains identity checks", () => {
-  const source = readFileSync(signWindows, "utf8");
-  const functionSource = source.slice(source.indexOf("function assertVerification"), source.indexOf("\nfunction fileEvidence"));
-  const assertVerification = vm.runInNewContext(`(${functionSource})`, {
-    fail(message) { throw new Error(message); },
-  });
-  const valid = "Successfully verified\r\n\tIssued to: Damned Ventures LLC  \r\nTimestamp: present\r\n";
-  assert.equal(JSON.stringify(assertVerification("fixture.exe", valid)), JSON.stringify({
-    authenticode: "Valid",
-    subject: "CN=Damned Ventures LLC",
-    timestampPresent: true,
-  }));
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Damned Ventures LLC", "Other Company")),
-    /subject must be Damned Ventures LLC/,
-  );
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Damned Ventures LLC", "damned ventures llc")),
-    /subject must be Damned Ventures LLC/,
-  );
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Timestamp: present", "")),
-    /timestamp is missing/,
-  );
-  assert.throws(
-    () => assertVerification("fixture.exe", valid.replace("Successfully verified", "Verification failed")),
-    /did not report Valid/,
-  );
-});
-
-test("upload uses GitHub CLI and never invokes the R2 runner", () => {
-  const source = readFileSync(upload, "utf8");
-  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
-  assert.match(githubSource, /run\("gh", \["release", "upload"/);
-  assert.doesNotMatch(source, /wrangler|CLOUDFLARE_API_TOKEN|RIGHTAPPS_API_URL/i);
-  assert.doesNotMatch(source, /\bnpx\b/);
-});
-
-test("upload accepts only GitHub Releases as configured product distribution", () => {
-  const source = readFileSync(upload, "utf8");
-  assert.match(source, /distribution\.provider/);
-  assert.match(source, /github-releases/);
-  assert.match(source, /releaseConfig\?\.distribution\?\.repository/);
-});

package/release-invocation.test.mjs

@@ -1,22 +0,0 @@
-import assert from "node:assert/strict";
-import path from "node:path";
-import test from "node:test";
-import { resolvePrimaryWorktree } from "./release-invocation.mjs";
-
-test("resolves a submodule primary worktree from core.worktree", () => {
-  assert.equal(resolvePrimaryWorktree({
-    repoRoot: path.resolve("/suite/membrane"),
-    worktrees: "worktree /suite/.git/modules/membrane\nHEAD abc\n",
-    gitDir: "/suite/.git/modules/membrane",
-    coreWorktree: "../../../membrane",
-  }), path.resolve("/suite/membrane"));
-});
-
-test("preserves an ordinary primary worktree", () => {
-  assert.equal(resolvePrimaryWorktree({
-    repoRoot: "/suite/app",
-    worktrees: "worktree /suite/app\nHEAD abc\n",
-    gitDir: "/suite/app/.git",
-    coreWorktree: "",
-  }), "/suite/app");
-});