@rightkit/release 0.2.85 → 0.2.86
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/release-invocation.mjs +30 -2
- package/rightkit-versions.json +1 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@rightkit/release",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.86",
|
|
4
4
|
"description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
|
|
5
5
|
"license": "MIT OR Apache-2.0",
|
|
6
6
|
"type": "module",
|
package/release-invocation.mjs
CHANGED
|
@@ -15,7 +15,7 @@ function canonical(file) {
|
|
|
15
15
|
return path.normalize(realpathSync(file)).toLowerCase();
|
|
16
16
|
}
|
|
17
17
|
|
|
18
|
-
export function assertPrimaryReleaseCheckout(repoRoot) {
|
|
18
|
+
export function assertPrimaryReleaseCheckout(repoRoot, env = process.env) {
|
|
19
19
|
const worktrees = git(repoRoot, ["worktree", "list", "--porcelain"]);
|
|
20
20
|
const gitDir = git(repoRoot, ["rev-parse", "--git-dir"]).trim();
|
|
21
21
|
const configured = spawnSync("git", ["config", "--path", "--get", "core.worktree"], {
|
|
@@ -32,7 +32,35 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
|
|
|
32
32
|
throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
|
|
33
33
|
}
|
|
34
34
|
const branch = spawnSync("git", ["symbolic-ref", "--quiet", "HEAD"], { cwd: repoRoot, encoding: "utf8", windowsHide: true });
|
|
35
|
-
if (branch.status !== 0
|
|
35
|
+
if (branch.status !== 0 && !isVerifiedGithubActionsTagCheckout(repoRoot, env)) {
|
|
36
|
+
throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
|
|
37
|
+
}
|
|
38
|
+
}
|
|
39
|
+
|
|
40
|
+
function isVerifiedGithubActionsTagCheckout(repoRoot, env) {
|
|
41
|
+
const ref = env.GITHUB_REF;
|
|
42
|
+
const sha = env.GITHUB_SHA;
|
|
43
|
+
if (
|
|
44
|
+
env.GITHUB_ACTIONS !== "true"
|
|
45
|
+
|| env.GITHUB_EVENT_NAME !== "push"
|
|
46
|
+
|| env.GITHUB_REF_TYPE !== "tag"
|
|
47
|
+
|| !/^refs\/tags\/v.+$/.test(ref ?? "")
|
|
48
|
+
|| !/^[a-f0-9]{40}$/.test(sha ?? "")
|
|
49
|
+
|| !/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(env.GITHUB_REPOSITORY ?? "")
|
|
50
|
+
) return false;
|
|
51
|
+
const head = git(repoRoot, ["rev-parse", "HEAD"]).trim();
|
|
52
|
+
if (head !== sha) return false;
|
|
53
|
+
let tagCommit;
|
|
54
|
+
let origin;
|
|
55
|
+
try {
|
|
56
|
+
tagCommit = git(repoRoot, ["rev-parse", `${ref}^{commit}`]).trim();
|
|
57
|
+
origin = git(repoRoot, ["remote", "get-url", "origin"]).trim();
|
|
58
|
+
} catch {
|
|
59
|
+
return false;
|
|
60
|
+
}
|
|
61
|
+
if (tagCommit !== head) return false;
|
|
62
|
+
const repository = origin.match(/(?:github\.com[/:])([^/\s]+\/[^/\s]+?)(?:\.git)?\/?$/i)?.[1];
|
|
63
|
+
return repository?.toLowerCase() === env.GITHUB_REPOSITORY.toLowerCase();
|
|
36
64
|
}
|
|
37
65
|
|
|
38
66
|
export function resolvePrimaryWorktree({ repoRoot, worktrees, gitDir, coreWorktree }) {
|
package/rightkit-versions.json
CHANGED