@rightkit/release 0.2.83 → 0.2.85

package/build-release.mjs

@@ -76,12 +76,14 @@ const args = process.argv.slice(2);
 let configName = "right-release.config.mjs";
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let dryRun = false;
+let skipChecks = false;
 
 for (let i = 0; i < args.length; i += 1) {
   const arg = args[i];
   if (arg === "--config") configName = args[++i];
   else if (arg === "--platform") platform = args[++i];
   else if (arg === "--dry-run") dryRun = true;
+  else if (arg === "--skip-checks") skipChecks = true;
   else if (arg === "--tier" || arg.startsWith("--tier=")) fail("build is tier-neutral; select patch or update only during upload");
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
@@ -337,7 +339,7 @@ try {
         throwIfInterrupted();
         await runProgress(
           process.execPath,
-          [WORKER, "--config", configPath, "--platform", platform, "--no-upload"],
+          [WORKER, "--config", configPath, "--platform", platform, "--no-upload", ...(skipChecks ? ["--skip-checks"] : [])],
           appRoot,
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],

package/cli/right-release.mjs

@@ -127,7 +127,7 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
-  build [--platform mac|win]                         Build, sign/notarize, harden, and seal; never uploads
+  build [--platform mac|win] [--skip-checks]         Build, sign/notarize, harden, and seal; never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
   release                                             Compatibility alias for build

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.83",
+  "version": "0.2.85",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -17,6 +17,14 @@
     "!standalone-clone-evidence.json"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "test:signer:windows": "node sign-release-manifest.integration.mjs",
+    "prepublishOnly": "pnpm test && pnpm test:signer:windows && pnpm test:registry-parity",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -26,11 +34,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "test:signer:windows": "node sign-release-manifest.integration.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/release-checks.mjs

@@ -0,0 +1,5 @@
+/** Run only app-configured pre-build checks; release safeguards never route here. */
+export async function runConfiguredChecks({ packageManager, checks = [], workdir, skipChecks = false, run }) {
+  if (skipChecks) return;
+  for (const script of checks) await run(packageManager, script, workdir);
+}

package/release.mjs

@@ -23,6 +23,7 @@ import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { runConfiguredChecks } from "./release-checks.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -217,9 +218,13 @@ const started = Date.now();
 console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier ?? "neutral"}`);
 
 if (opts.install) await runInstall(config.packageManager, workdir);
-if (!opts.skipChecks) {
-  for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
-}
+await runConfiguredChecks({
+  packageManager: config.packageManager,
+  checks: config.checks,
+  workdir,
+  skipChecks: opts.skipChecks,
+  run: runPackageScript,
+});
 
 let nativeFinalization = null;
 let bundleMarkerReceipts = [];
@@ -671,14 +676,43 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     if (!source.startsWith("# Managed by right-git")) {
       fail(`${appName} ${workflow} is not marked as right-git managed`);
     }
-    const requestedSecrets = [...source.matchAll(/\bsecrets\.([A-Z0-9_]+)/gi)].map((match) => match[1]);
+    const jobSpan = (jobName) => {
+      const marker = `\n  ${jobName}:\n`;
+      const start = source.indexOf(marker);
+      if (start < 0) return null;
+      const remainder = source.slice(start + marker.length);
+      const next = /\n  [A-Za-z0-9_-]+:\n/.exec(remainder);
+      return { start, end: next ? start + marker.length + next.index : source.length };
+    };
+    const inside = (index, span) => span && index >= span.start && index < span.end;
+    const requestedSecrets = [...source.matchAll(/\bsecrets\.([A-Z0-9_]+)/gi)].map((match) => ({ name: match[1], index: match.index }));
     const allowedMacosSecrets = new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD", "APPLE_API_KEY_BASE64", "APPLE_API_KEY", "APPLE_API_ISSUER"]);
-    const macosSigningAllowed = workflow === "release-candidate.yml" && manifest?.candidate?.signMacos === true;
+    const windowsSpan = jobSpan("windows-sign");
+    const macosSpan = jobSpan("macos-sign");
+    const publishSpan = jobSpan("publish");
+    const windowsSource = windowsSpan ? source.slice(windowsSpan.start, windowsSpan.end) : "";
+    const macosSource = macosSpan ? source.slice(macosSpan.start, macosSpan.end) : "";
+    const publishSource = publishSpan ? source.slice(publishSpan.start, publishSpan.end) : "";
+    const protectedWindowsSigning = workflow === "release-candidate.yml"
+      && manifest?.candidate?.signWindows === true
+      && /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/.test(windowsSource);
+    const protectedMacosSigning = workflow === "release-candidate.yml"
+      && manifest?.candidate?.signMacos === true
+      && /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/.test(macosSource);
+    const releaseChain = workflow === "release-candidate.yml" ? manifest?.candidate?.releaseChain : undefined;
+    const allowedReleaseSecrets = new Set(releaseChain?.publishSecrets ?? []);
+    const writePermissions = [...source.matchAll(/^\s*(actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/gmi)].map((match) => ({ name: match[1].toLowerCase(), index: match.index }));
+    const protectedReleasePublish = releaseChain
+      && /publish:\n    needs: \[[^\n]*installed-qualification[^\n]*\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) && needs\.installed-qualification\.result == 'success'/.test(publishSource)
+      && /\n    permissions:\n      contents: write\n/.test(publishSource);
     if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
-      || /^\s*(?:actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/mi.test(source)
+      || writePermissions.some(({ name, index }) => name === "id-token"
+        ? !(protectedWindowsSigning && inside(index, windowsSpan))
+        : name !== "contents" || !protectedReleasePublish || !inside(index, publishSpan))
       || /pull_request_target\s*:/i.test(source)
       || /\bsecrets\s*\[/i.test(source)
-      || requestedSecrets.some((name) => !macosSigningAllowed || !allowedMacosSecrets.has(name))) {
+      || requestedSecrets.some(({ name, index }) => !(protectedMacosSigning && inside(index, macosSpan) && allowedMacosSecrets.has(name))
+        && !(protectedReleasePublish && inside(index, publishSpan) && allowedReleaseSecrets.has(name)))) {
       fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
     }
   }

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.7",
+    "@rightkit/git": "0.2.14",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.83",
+    "@rightkit/release": "0.2.85",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -36,7 +36,8 @@
       "0.2.3",
       "0.2.4",
       "0.2.5",
-      "0.2.6"
+      "0.2.6",
+      "0.2.7"
     ],
     "@rightkit/legal-ui": [
       "0.1.0"
@@ -84,7 +85,8 @@
       "0.2.74",
       "0.2.75",
       "0.2.76",
-      "0.2.82"
+      "0.2.82",
+      "0.2.83"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/supply-chain-evidence.mjs

@@ -122,8 +122,9 @@ export function materializeInTotoSlsaProvenance({
   sourceCommit,
   sourceRepository,
   subjects,
-  startedAt,
-  finishedAt = new Date().toISOString(),
+  now = () => new Date().toISOString(),
+  startedAt = now(),
+  finishedAt = now(),
 }) {
   assertIdentity({ product, version, target, sourceCommit });
   if (!outputPath.endsWith(".intoto.jsonl")) throw new Error("in-toto output must end in .intoto.jsonl");