@rightkit/release 0.2.7 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { access, readFile } from "node:fs/promises";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -9,7 +10,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.7";
+const VERSION = "0.2.9";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.5"],
@@ -87,6 +88,7 @@ if (opts.doctor) {
   process.exit(0);
 }
 
+const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = opts.upload ? "publish" : "package";
 const command = target.package;
 if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
@@ -141,6 +143,7 @@ if (opts.upload && !target.publish) {
 }
 
 console.log(`right-release: done (${Date.now() - started}ms)`);
+releaseLock.release();
 
 function usage(code, message) {
   if (message) console.error(`right-release: ${message}\n`);
@@ -249,19 +252,105 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
   });
 }
 
+function acquireReleaseLock(root, app, platform, tier) {
+  const lockDir = path.join(root, ".cache", "right-release");
+  const lockPath = path.join(lockDir, `${platform}.lock.json`);
+  mkdirSync(lockDir, { recursive: true });
+  const existing = readLock(lockPath);
+  if (existing?.pid && isRightReleaseProcess(existing.pid)) {
+    if (opts.dryRun) {
+      console.log(`dry-run: would kill previous ${app} ${platform} release pid=${existing.pid}`);
+    } else {
+      console.error(`right-release: killing previous ${app} ${platform} release pid=${existing.pid}`);
+      killProcessTree(existing.pid);
+    }
+  } else if (existing?.pid) {
+    console.error(`right-release: removing stale ${app} ${platform} release lock pid=${existing.pid}`);
+  }
+  const lock = {
+    pid: process.pid,
+    app,
+    platform,
+    tier,
+    startedAt: new Date().toISOString(),
+    cwd: root,
+    argv: process.argv,
+  };
+  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`);
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    const current = readLock(lockPath);
+    if (current?.pid === process.pid) {
+      try {
+        unlinkSync(lockPath);
+      } catch {
+        // already gone
+      }
+    }
+  };
+  process.once("exit", release);
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.once(signal, () => {
+      release();
+      process.exit(signal === "SIGINT" ? 130 : 143);
+    });
+  }
+  return { release };
+}
+
+function readLock(lockPath) {
+  if (!existsSync(lockPath)) return null;
+  try {
+    return JSON.parse(readFileSync(lockPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function isRightReleaseProcess(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  if (!isProcessAlive(Number(pid))) return false;
+  const commandLine = processCommandLine(Number(pid));
+  return /(?:right-release|release\.mjs)/i.test(commandLine);
+}
+
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function processCommandLine(pid) {
+  if (process.platform === "win32") {
+    const result = spawnSync("powershell", [
+      "-NoProfile",
+      "-Command",
+      `$p = Get-CimInstance Win32_Process -Filter "ProcessId = ${Number(pid)}"; if ($p) { $p.CommandLine }`,
+    ], { encoding: "utf8" });
+    return result.stdout ?? "";
+  }
+  const result = spawnSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8" });
+  return result.stdout ?? "";
+}
+
 function killProcessTree(pid) {
   if (!pid) return;
   if (process.platform === "win32") {
     spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
     return;
   }
+  const children = spawnSync("pgrep", ["-P", String(pid)], { encoding: "utf8" });
+  for (const child of (children.stdout ?? "").split(/\s+/).filter(Boolean)) {
+    killProcessTree(Number(child));
+  }
   try {
-    process.kill(-pid, "SIGKILL");
+    process.kill(pid, "SIGKILL");
   } catch {
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch {
-      // already gone
-    }
+    // already gone
   }
 }

package/release.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.7" },
+        devDependencies: { "@rightkit/release": "^0.2.9" },
       },
       null,
       2,
@@ -47,12 +47,56 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
   return config;
 }
 
+function lockFixture() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-lock-test-"));
+  const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify(
+      {
+        name: "fixture-lock",
+        scripts: { "release:patch:mac": "right-release --platform mac --tier patch" },
+        dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
+        devDependencies: { "@rightkit/release": "^0.2.9" },
+      },
+      null,
+      2,
+    ),
+  );
+  writeFileSync(
+    config,
+    `export default ${JSON.stringify({
+      schema: 1,
+      app: "fixture-lock",
+      packageManager: "pnpm",
+      checks: [],
+      targets: {
+        mac: {
+          signed: true,
+          package: { cmd: "node", args: ["-e", "process.exit(0)"] },
+          artifacts: [],
+          hardening: [],
+          installer: { artifacts: [] },
+          updater: { artifacts: [] },
+        },
+      },
+    })};\n`,
+  );
+  return { dir, config };
+}
+
 function run(config, ...args) {
   return spawnSync(process.execPath, [release, "--config", config, "--platform", "win", "--dry-run", ...args], {
     encoding: "utf8",
   });
 }
 
+function runRaw(config, ...args) {
+  return spawnSync(process.execPath, [release, "--config", config, ...args], {
+    encoding: "utf8",
+  });
+}
+
 test("rejects a release without an explicit entitlement tier", () => {
   const result = run(fixture());
   assert.notEqual(result.status, 0);
@@ -136,3 +180,12 @@ test("Windows update re-signs the updater artifact after Azure code signing", ()
   assert.ok(updaterAt > azureAt, result.stdout);
   assert.ok(publishAt > updaterAt, result.stdout);
 });
+
+test("release lock is single-flight and is cleaned after success", () => {
+  const { dir, config } = lockFixture();
+  const lockPath = path.join(dir, ".cache", "right-release", "mac.lock.json");
+  const result = runRaw(config, "--platform", "mac", "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /right-release: done/);
+  assert.equal(existsSync(lockPath), false);
+});

package/right-suite-contract.test.mjs

@@ -8,7 +8,7 @@ const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replac
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.5";
 const logsPackage = "^0.1.3";
-const releasePackage = "^0.2.7";
+const releasePackage = "^0.2.9";
 const apps = [
   { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
   { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },

package/sign-updater.mjs

@@ -41,7 +41,17 @@ for (const file of files) {
   rmSync(`${file}.sig`, { force: true });
   console.log(`${dryRun ? "[dry-run] " : ""}pnpm exec tauri signer sign ${file}`);
   if (dryRun) continue;
-  const result = spawnSync("pnpm", ["exec", "tauri", "signer", "sign", file], {
+  const result = process.platform === "win32"
+    ? spawnSync(
+        process.env.ComSpec || "cmd.exe",
+        ["/d", "/s", "/c", `pnpm exec tauri signer sign ${file}`],
+        {
+          cwd: process.cwd(),
+          env,
+          stdio: "inherit",
+        },
+      )
+    : spawnSync("pnpm", ["exec", "tauri", "signer", "sign", file], {
     cwd: process.cwd(),
     env,
     stdio: "inherit",