@rightkit/release 0.2.97 → 0.2.98

package/cli/right-release.mjs

@@ -2,6 +2,7 @@
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { assertReleaseExecutionAllowed } from "../execution-policy.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const commands = new Map([
@@ -25,6 +26,19 @@ const commands = new Map([
 
 const args = process.argv.slice(2);
 const first = args[0];
+const githubBuildCommands = new Set(["release", "build", "package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
+
+try {
+  if (githubBuildCommands.has(first)
+    || first?.startsWith("-")
+    || (first === "addon" && args[1] === "build")
+    || (first === "publish" && ["cargo", "swift"].includes(args[1]))) {
+    assertReleaseExecutionAllowed({ command: `right-release ${args.join(" ")}`.trim() });
+  }
+} catch (error) {
+  console.error(`right-release: ${error.message}`);
+  process.exit(125);
+}
 
 if (!first || first === "-h" || first === "--help") {
   printHelp();

package/execution-policy.mjs

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+export const GITHUB_ACTIONS_ONLY = "github-actions-only";
+export const GITHUB_ACTIONS_ONLY_ERROR = "RK_GITHUB_ACTIONS_ONLY";
+
+function directoryFrom(value) {
+  const selected = path.resolve(value ?? process.cwd());
+  try { return statSync(selected).isDirectory() ? realpathSync(selected) : path.dirname(realpathSync(selected)); }
+  catch { return selected; }
+}
+
+function orthicRemote(root) {
+  const config = path.join(root, ".git", "config");
+  if (!existsSync(config)) return false;
+  try { return /github\.com(?::|\/)Orthic-Labs\//i.test(readFileSync(config, "utf8")); }
+  catch { return false; }
+}
+
+export function releaseExecutionPolicy(cwd = process.cwd()) {
+  let cursor = directoryFrom(cwd);
+  const filesystemRoot = path.parse(cursor).root;
+  for (;;) {
+    const manifestPath = path.join(cursor, ".rightgit.json");
+    if (existsSync(manifestPath)) {
+      let manifest;
+      try { manifest = JSON.parse(readFileSync(manifestPath, "utf8")); }
+      catch (error) { throw Object.assign(new Error(`invalid public repository execution policy: ${manifestPath}: ${error.message}`), { code: "RK_EXECUTION_POLICY_INVALID" }); }
+      if (orthicRemote(cursor) && manifest.compile !== GITHUB_ACTIONS_ONLY) {
+        throw Object.assign(new Error(`Orthic Labs public repository requires compile=${GITHUB_ACTIONS_ONLY}: ${manifestPath}`), { code: "RK_EXECUTION_POLICY_MISSING" });
+      }
+      return Object.freeze({ root: cursor, compile: manifest.compile ?? null });
+    }
+    if (orthicRemote(cursor)) throw Object.assign(new Error(`Orthic Labs public repository requires .rightgit.json with compile=${GITHUB_ACTIONS_ONLY}: ${cursor}`), { code: "RK_EXECUTION_POLICY_MISSING" });
+    if (cursor === filesystemRoot) return Object.freeze({ root: null, compile: null });
+    cursor = path.dirname(cursor);
+  }
+}
+
+export function assertReleaseExecutionAllowed({ cwd = process.cwd(), environment = process.env, command = "build" } = {}) {
+  const policy = releaseExecutionPolicy(cwd);
+  if (policy.compile === GITHUB_ACTIONS_ONLY && environment.GITHUB_ACTIONS !== "true") {
+    throw Object.assign(new Error(`${command} is GitHub Actions only for ${policy.root}; push changes & use managed CI`), { code: GITHUB_ACTIONS_ONLY_ERROR });
+  }
+  return policy;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.97",
+  "version": "0.2.98",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -660,12 +660,13 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   const lanes = manifest?.lanes;
   const safeLanes = new Set(["ci", "release-candidate"]);
   if (manifest?.schemaVersion !== 1
+    || manifest?.compile !== "github-actions-only"
     || !Array.isArray(lanes)
     || lanes.length === 0
     || !lanes.includes("ci")
     || new Set(lanes).size !== lanes.length
     || lanes.some((lane) => !safeLanes.has(lane))) {
-    fail(`${appName} right-git-ci-only policy requires unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
+    fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
   }
   const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
   if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.21",
+    "@rightkit/git": "0.2.22",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.97",
+    "@rightkit/release": "0.2.98",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -49,7 +49,8 @@
       "0.2.16",
       "0.2.18",
       "0.2.19",
-      "0.2.20"
+      "0.2.20",
+      "0.2.21"
     ],
     "@rightkit/legal-ui": [
       "0.1.0"
@@ -103,7 +104,8 @@
       "0.2.92",
       "0.2.94",
       "0.2.95",
-      "0.2.96"
+      "0.2.96",
+      "0.2.97"
     ],
     "@rightkit/qa": [
       "0.1.0",