@rightkit/release 0.2.76 → 0.2.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.76",
+  "version": "0.2.77",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -619,9 +619,6 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
   }
-  if (workflows.length !== 1 || workflows[0] !== "ci.yml") {
-    fail(`${appName} right-git-ci-only policy permits only ci.yml, got: ${workflows.join(", ")}`);
-  }
   const manifestPath = path.join(root, ".rightgit.json");
   let manifest;
   try {
@@ -629,16 +626,30 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   } catch {
     fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
   }
-  if (manifest?.schemaVersion !== 1 || JSON.stringify(manifest?.lanes) !== JSON.stringify(["ci"])) {
-    fail(`${appName} right-git-ci-only policy requires .rightgit.json lanes=["ci"]`);
-  }
-  const source = await readFile(path.join(root, ".github", "workflows", "ci.yml"), "utf8");
-  if (!source.startsWith("# Managed by right-git")) {
-    fail(`${appName} ci.yml is not marked as right-git managed`);
-  }
-  if (/^\s*(?:actions|attestations|contents|id-token|packages|security-events):\s*write\s*$/mi.test(source)
-    || /\bsecrets\s*\./i.test(source)) {
-    fail(`${appName} right-git managed ci.yml requests release-capable permissions or secrets`);
+  const lanes = manifest?.lanes;
+  const safeLanes = new Set(["ci", "release-candidate"]);
+  if (manifest?.schemaVersion !== 1
+    || !Array.isArray(lanes)
+    || lanes.length === 0
+    || !lanes.includes("ci")
+    || new Set(lanes).size !== lanes.length
+    || lanes.some((lane) => !safeLanes.has(lane))) {
+    fail(`${appName} right-git-ci-only policy requires unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
+  }
+  const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
+  if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
+    fail(`${appName} right-git-ci-only policy requires workflows declared by .rightgit.json; expected ${expectedWorkflows.join(", ")}, got: ${workflows.join(", ")}`);
+  }
+  for (const workflow of expectedWorkflows) {
+    const source = await readFile(path.join(root, ".github", "workflows", workflow), "utf8");
+    if (!source.startsWith("# Managed by right-git")) {
+      fail(`${appName} ${workflow} is not marked as right-git managed`);
+    }
+    if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
+      || /^\s*(?:actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/mi.test(source)
+      || /\bsecrets\s*(?:\.|\[)/i.test(source)) {
+      fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
+    }
   }
 }
 

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.1",
+    "@rightkit/git": "0.2.5",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.76",
+    "@rightkit/release": "0.2.77",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -30,6 +30,12 @@
     "@rightkit/ax": [
       "0.2.0"
     ],
+    "@rightkit/git": [
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4"
+    ],
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
@@ -74,7 +80,8 @@
       "0.2.72",
       "0.2.73",
       "0.2.74",
-      "0.2.75"
+      "0.2.75",
+      "0.2.76"
     ],
     "@rightkit/qa": [
       "0.1.0",