@rightkit/release 0.2.84 → 0.2.86

package/build-release.mjs

@@ -76,12 +76,14 @@ const args = process.argv.slice(2);
 let configName = "right-release.config.mjs";
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let dryRun = false;
+let skipChecks = false;
 
 for (let i = 0; i < args.length; i += 1) {
   const arg = args[i];
   if (arg === "--config") configName = args[++i];
   else if (arg === "--platform") platform = args[++i];
   else if (arg === "--dry-run") dryRun = true;
+  else if (arg === "--skip-checks") skipChecks = true;
   else if (arg === "--tier" || arg.startsWith("--tier=")) fail("build is tier-neutral; select patch or update only during upload");
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
@@ -337,7 +339,7 @@ try {
         throwIfInterrupted();
         await runProgress(
           process.execPath,
-          [WORKER, "--config", configPath, "--platform", platform, "--no-upload"],
+          [WORKER, "--config", configPath, "--platform", platform, "--no-upload", ...(skipChecks ? ["--skip-checks"] : [])],
           appRoot,
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],

package/cli/right-release.mjs

@@ -127,7 +127,7 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
-  build [--platform mac|win]                         Build, sign/notarize, harden, and seal; never uploads
+  build [--platform mac|win] [--skip-checks]         Build, sign/notarize, harden, and seal; never uploads
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
   release                                             Compatibility alias for build

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.84",
+  "version": "0.2.86",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -17,6 +17,14 @@
     "!standalone-clone-evidence.json"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "test:signer:windows": "node sign-release-manifest.integration.mjs",
+    "prepublishOnly": "pnpm test && pnpm test:signer:windows && pnpm test:registry-parity",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -26,11 +34,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "test:signer:windows": "node sign-release-manifest.integration.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/release-checks.mjs

@@ -0,0 +1,5 @@
+/** Run only app-configured pre-build checks; release safeguards never route here. */
+export async function runConfiguredChecks({ packageManager, checks = [], workdir, skipChecks = false, run }) {
+  if (skipChecks) return;
+  for (const script of checks) await run(packageManager, script, workdir);
+}

package/release-invocation.mjs

@@ -15,7 +15,7 @@ function canonical(file) {
   return path.normalize(realpathSync(file)).toLowerCase();
 }
 
-export function assertPrimaryReleaseCheckout(repoRoot) {
+export function assertPrimaryReleaseCheckout(repoRoot, env = process.env) {
   const worktrees = git(repoRoot, ["worktree", "list", "--porcelain"]);
   const gitDir = git(repoRoot, ["rev-parse", "--git-dir"]).trim();
   const configured = spawnSync("git", ["config", "--path", "--get", "core.worktree"], {
@@ -32,7 +32,35 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
     throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
   }
   const branch = spawnSync("git", ["symbolic-ref", "--quiet", "HEAD"], { cwd: repoRoot, encoding: "utf8", windowsHide: true });
-  if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
+  if (branch.status !== 0 && !isVerifiedGithubActionsTagCheckout(repoRoot, env)) {
+    throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
+  }
+}
+
+function isVerifiedGithubActionsTagCheckout(repoRoot, env) {
+  const ref = env.GITHUB_REF;
+  const sha = env.GITHUB_SHA;
+  if (
+    env.GITHUB_ACTIONS !== "true"
+    || env.GITHUB_EVENT_NAME !== "push"
+    || env.GITHUB_REF_TYPE !== "tag"
+    || !/^refs\/tags\/v.+$/.test(ref ?? "")
+    || !/^[a-f0-9]{40}$/.test(sha ?? "")
+    || !/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(env.GITHUB_REPOSITORY ?? "")
+  ) return false;
+  const head = git(repoRoot, ["rev-parse", "HEAD"]).trim();
+  if (head !== sha) return false;
+  let tagCommit;
+  let origin;
+  try {
+    tagCommit = git(repoRoot, ["rev-parse", `${ref}^{commit}`]).trim();
+    origin = git(repoRoot, ["remote", "get-url", "origin"]).trim();
+  } catch {
+    return false;
+  }
+  if (tagCommit !== head) return false;
+  const repository = origin.match(/(?:github\.com[/:])([^/\s]+\/[^/\s]+?)(?:\.git)?\/?$/i)?.[1];
+  return repository?.toLowerCase() === env.GITHUB_REPOSITORY.toLowerCase();
 }
 
 export function resolvePrimaryWorktree({ repoRoot, worktrees, gitDir, coreWorktree }) {

package/release.mjs

@@ -23,6 +23,7 @@ import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { runConfiguredChecks } from "./release-checks.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -217,9 +218,13 @@ const started = Date.now();
 console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier ?? "neutral"}`);
 
 if (opts.install) await runInstall(config.packageManager, workdir);
-if (!opts.skipChecks) {
-  for (const script of config.checks ?? []) await runPackageScript(config.packageManager, script, workdir);
-}
+await runConfiguredChecks({
+  packageManager: config.packageManager,
+  checks: config.checks,
+  workdir,
+  skipChecks: opts.skipChecks,
+  run: runPackageScript,
+});
 
 let nativeFinalization = null;
 let bundleMarkerReceipts = [];

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.8",
+    "@rightkit/git": "0.2.14",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.84",
+    "@rightkit/release": "0.2.86",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },

package/supply-chain-evidence.mjs

@@ -122,8 +122,9 @@ export function materializeInTotoSlsaProvenance({
   sourceCommit,
   sourceRepository,
   subjects,
-  startedAt,
-  finishedAt = new Date().toISOString(),
+  now = () => new Date().toISOString(),
+  startedAt = now(),
+  finishedAt = now(),
 }) {
   assertIdentity({ product, version, target, sourceCommit });
   if (!outputPath.endsWith(".intoto.jsonl")) throw new Error("in-toto output must end in .intoto.jsonl");