@rightkit/release 0.2.91 → 0.2.92

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.91",
-  "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
+  "version": "0.2.92",
+  "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {

package/publish-update.mjs

@@ -14,7 +14,7 @@ const API_BASE = process.env.RIGHTAPPS_API_URL || "https://api.spoares.com";
 const DOWNLOAD_BASE = process.env.RIGHTAPPS_UPDATE_DOWNLOAD_BASE || "https://rightapps-license-gate.adrdsouza.workers.dev";
 const PUBLIC_BASE = process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev";
 const PIPELINE_VERSION = JSON.parse(await readFile(path.join(TOOL_ROOT, "package.json"), "utf8")).version;
-const tier = process.env.RIGHT_RELEASE_TIER || "";
+let tier = process.env.RIGHT_RELEASE_TIER || "";
 const args = process.argv.slice(2);
 let configName = "right-release.config.mjs";
 let platform = process.platform === "win32" ? "win" : "mac";
@@ -24,17 +24,20 @@ for (let i = 0; i < args.length; i++) {
   const arg = args[i];
   if (arg === "--config") configName = args[++i];
   else if (arg === "--platform") platform = args[++i];
+  else if (arg === "--tier") tier = args[++i];
+  else if (arg.startsWith("--tier=")) tier = arg.slice("--tier=".length);
   else if (arg === "--dry-run") dryRun = true;
   else fail(`unknown argument: ${arg}`);
 }
 
-if (tier !== "patch" && tier !== "update") {
-  fail("RIGHT_RELEASE_TIER is required (patch|update)");
-}
+if (tier !== "patch" && tier !== "update") fail("tier is required (--tier patch|update or RIGHT_RELEASE_TIER)");
 
 const configPath = path.resolve(configName);
 const root = path.dirname(configPath);
 const config = (await import(pathToFileURL(configPath))).default;
+if (config?.distribution?.provider !== "r2-rightapps") {
+  fail("release config distribution.provider must be r2-rightapps");
+}
 const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
 const installers = target?.installer?.artifacts ?? [];

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.91",
+    "@rightkit/release": "0.2.92",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -93,7 +93,8 @@
       "0.2.75",
       "0.2.76",
       "0.2.82",
-      "0.2.83"
+      "0.2.83",
+      "0.2.91"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/upload-release.mjs

@@ -3,7 +3,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
-import { prepareGitHubRelease, publishGitHubRelease, repositoryFromRemote } from "./github-release.mjs";
+import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { verifySealedRelease } from "./release-state.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
@@ -43,22 +43,23 @@ const platformDir = platform === "win" ? "windows" : "mac";
 const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir));
 if (sealed.manifest.commit !== candidateCommit) fail("sealed release was built from a different commit than the current checkout");
 
+const configPath = path.resolve(configName);
+if (!existsSync(configPath)) fail(`release config is required: ${configName}`);
+const releaseConfig = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
+if (releaseConfig?.distribution?.provider !== "github-releases") {
+  fail("release config distribution.provider must be github-releases");
+}
+const configuredRepo = releaseConfig?.distribution?.repository ?? "";
+if (!configuredRepo) fail("release config distribution.repository is required for github-releases");
+if (repo && repo !== configuredRepo) fail(`--repo must match configured distribution.repository (${configuredRepo})`);
+repo = configuredRepo;
+
 const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
-const verifiedMarker = path.join(stateRoot, `verified-${tier}.json`);
+const verifiedMarker = path.join(stateRoot, `verified-${tier}-github-releases.json`);
 if (existsSync(verifiedMarker)) {
-  console.log(`right-release upload: already verified ${releaseId} tier=${tier}`);
+  console.log(`right-release upload: already verified ${releaseId} tier=${tier} provider=github-releases`);
   process.exit(0);
 }
-
-const configPath = path.resolve(configName);
-if (existsSync(configPath)) {
-  const releaseConfig = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
-  if (releaseConfig?.distribution?.provider && releaseConfig.distribution.provider !== "github-releases") {
-    fail("release config distribution.provider must be github-releases");
-  }
-  repo ||= releaseConfig?.distribution?.repository ?? "";
-}
-repo ||= repositoryFromRemote(repoRoot);
 const plan = prepareGitHubRelease({ repoRoot, releaseId, platform, repo });
 const result = publishGitHubRelease(plan, { repo, dryRun });
 if (!dryRun) writeJson(verifiedMarker, {