@rightkit/release 0.2.76 → 0.2.78

package/direct-bootstrap.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure } from "./sign-release-manifest.mjs";
 import { validateCycloneDxSbom, validateInTotoSlsaProvenance } from "./supply-chain-evidence.mjs";
@@ -73,8 +73,13 @@ function assertGitHubAssetUrl(url) {
 
 export function createPortableArchive({ sourceDir, outputPath, commandRunner = spawnSync }) {
   const source = realpathSync(sourceDir);
-  mkdirSync(dirname(outputPath), { recursive: true });
-  const result = commandRunner("tar", ["-a", "-c", "-f", resolve(outputPath), "-C", source, "."], {
+  const outputDir = resolve(dirname(outputPath));
+  mkdirSync(outputDir, { recursive: true });
+  // GNU tar reads a colon in -f as a remote host spec, so an absolute
+  // Windows path (C:\...) fails with "Cannot connect to C:". Run from the
+  // output directory and pass a bare filename instead.
+  const result = commandRunner("tar", ["-a", "-c", "-f", basename(outputPath), "-C", source, "."], {
+    cwd: outputDir,
     encoding: "utf8",
     windowsHide: true,
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.76",
+  "version": "0.2.78",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -619,9 +619,6 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   if (policy !== "right-git-ci-only") {
     fail(`${appName} hosted workflow files are forbidden: ${workflows.join(", ")}`);
   }
-  if (workflows.length !== 1 || workflows[0] !== "ci.yml") {
-    fail(`${appName} right-git-ci-only policy permits only ci.yml, got: ${workflows.join(", ")}`);
-  }
   const manifestPath = path.join(root, ".rightgit.json");
   let manifest;
   try {
@@ -629,16 +626,30 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   } catch {
     fail(`${appName} right-git-ci-only policy requires a valid .rightgit.json`);
   }
-  if (manifest?.schemaVersion !== 1 || JSON.stringify(manifest?.lanes) !== JSON.stringify(["ci"])) {
-    fail(`${appName} right-git-ci-only policy requires .rightgit.json lanes=["ci"]`);
-  }
-  const source = await readFile(path.join(root, ".github", "workflows", "ci.yml"), "utf8");
-  if (!source.startsWith("# Managed by right-git")) {
-    fail(`${appName} ci.yml is not marked as right-git managed`);
-  }
-  if (/^\s*(?:actions|attestations|contents|id-token|packages|security-events):\s*write\s*$/mi.test(source)
-    || /\bsecrets\s*\./i.test(source)) {
-    fail(`${appName} right-git managed ci.yml requests release-capable permissions or secrets`);
+  const lanes = manifest?.lanes;
+  const safeLanes = new Set(["ci", "release-candidate"]);
+  if (manifest?.schemaVersion !== 1
+    || !Array.isArray(lanes)
+    || lanes.length === 0
+    || !lanes.includes("ci")
+    || new Set(lanes).size !== lanes.length
+    || lanes.some((lane) => !safeLanes.has(lane))) {
+    fail(`${appName} right-git-ci-only policy requires unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
+  }
+  const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
+  if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {
+    fail(`${appName} right-git-ci-only policy requires workflows declared by .rightgit.json; expected ${expectedWorkflows.join(", ")}, got: ${workflows.join(", ")}`);
+  }
+  for (const workflow of expectedWorkflows) {
+    const source = await readFile(path.join(root, ".github", "workflows", workflow), "utf8");
+    if (!source.startsWith("# Managed by right-git")) {
+      fail(`${appName} ${workflow} is not marked as right-git managed`);
+    }
+    if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
+      || /^\s*(?:actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/mi.test(source)
+      || /\bsecrets\s*(?:\.|\[)/i.test(source)) {
+      fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
+    }
   }
 }
 

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.1",
+    "@rightkit/git": "0.2.5",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.76",
+    "@rightkit/release": "0.2.78",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -30,6 +30,12 @@
     "@rightkit/ax": [
       "0.2.0"
     ],
+    "@rightkit/git": [
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4"
+    ],
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
@@ -74,7 +80,8 @@
       "0.2.72",
       "0.2.73",
       "0.2.74",
-      "0.2.75"
+      "0.2.75",
+      "0.2.76"
     ],
     "@rightkit/qa": [
       "0.1.0",