@rightkit/release 0.2.97 → 0.2.99

package/cli/right-release.mjs

@@ -2,6 +2,7 @@
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { assertReleaseExecutionAllowed } from "../execution-policy.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const commands = new Map([
@@ -25,6 +26,19 @@ const commands = new Map([
 
 const args = process.argv.slice(2);
 const first = args[0];
+const githubBuildCommands = new Set(["release", "build", "package", "sign-windows", "sign-updater", "create-mac-updater", "cargo-target"]);
+
+try {
+  if (githubBuildCommands.has(first)
+    || first?.startsWith("-")
+    || (first === "addon" && args[1] === "build")
+    || (first === "publish" && ["cargo", "swift"].includes(args[1]))) {
+    assertReleaseExecutionAllowed({ command: `right-release ${args.join(" ")}`.trim() });
+  }
+} catch (error) {
+  console.error(`right-release: ${error.message}`);
+  process.exit(125);
+}
 
 if (!first || first === "-h" || first === "--help") {
   printHelp();

package/execution-policy.mjs

@@ -0,0 +1,46 @@
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+export const GITHUB_ACTIONS_ONLY = "github-actions-only";
+export const GITHUB_ACTIONS_ONLY_ERROR = "RK_GITHUB_ACTIONS_ONLY";
+
+function directoryFrom(value) {
+  const selected = path.resolve(value ?? process.cwd());
+  try { return statSync(selected).isDirectory() ? realpathSync(selected) : path.dirname(realpathSync(selected)); }
+  catch { return selected; }
+}
+
+function orthicRemote(root) {
+  const config = path.join(root, ".git", "config");
+  if (!existsSync(config)) return false;
+  try { return /github\.com(?::|\/)Orthic-Labs\//i.test(readFileSync(config, "utf8")); }
+  catch { return false; }
+}
+
+export function releaseExecutionPolicy(cwd = process.cwd()) {
+  let cursor = directoryFrom(cwd);
+  const filesystemRoot = path.parse(cursor).root;
+  for (;;) {
+    const manifestPath = path.join(cursor, ".rightgit.json");
+    if (existsSync(manifestPath)) {
+      let manifest;
+      try { manifest = JSON.parse(readFileSync(manifestPath, "utf8")); }
+      catch (error) { throw Object.assign(new Error(`invalid public repository execution policy: ${manifestPath}: ${error.message}`), { code: "RK_EXECUTION_POLICY_INVALID" }); }
+      if (orthicRemote(cursor) && manifest.compile !== GITHUB_ACTIONS_ONLY) {
+        throw Object.assign(new Error(`Orthic Labs public repository requires compile=${GITHUB_ACTIONS_ONLY}: ${manifestPath}`), { code: "RK_EXECUTION_POLICY_MISSING" });
+      }
+      return Object.freeze({ root: cursor, compile: manifest.compile ?? null });
+    }
+    if (orthicRemote(cursor)) throw Object.assign(new Error(`Orthic Labs public repository requires .rightgit.json with compile=${GITHUB_ACTIONS_ONLY}: ${cursor}`), { code: "RK_EXECUTION_POLICY_MISSING" });
+    if (cursor === filesystemRoot) return Object.freeze({ root: null, compile: null });
+    cursor = path.dirname(cursor);
+  }
+}
+
+export function assertReleaseExecutionAllowed({ cwd = process.cwd(), environment = process.env, command = "build" } = {}) {
+  const policy = releaseExecutionPolicy(cwd);
+  if (policy.compile === GITHUB_ACTIONS_ONLY && environment.GITHUB_ACTIONS !== "true") {
+    throw Object.assign(new Error(`${command} is GitHub Actions only for ${policy.root}; push changes & use managed CI`), { code: GITHUB_ACTIONS_ONLY_ERROR });
+  }
+  return policy;
+}

package/nsis-payload.mjs

@@ -94,10 +94,23 @@ export function extractNsisEntry(installer, entryName, { sevenZip = resolveSeven
   const destination = path.join(tempRoot, `right-nsis-${process.pid}-${Math.random().toString(16).slice(2)}`);
   mkdirSync(destination, { recursive: true });
   try {
-    // `e` flattens the entry to the destination root, so the extracted path is
-    // known regardless of how deep the entry sits inside the payload.
-    const result = run(sevenZip, ["e", "-tnsis", "-y", `-o${destination}`, "--", resolvedInstaller, base]);
-    const extracted = path.join(destination, base);
+    // NSIS entries may live below `$PLUGINSDIR/release`. A basename-only 7-Zip
+    // filter then reports `No files to process`, so resolve the actual archive
+    // member first & extract that exact path.
+    const requested = String(entryName).replace(/\\/g, "/");
+    const members = listNsisPayload(resolvedInstaller, { sevenZip, run });
+    const exact = members.filter((member) => member.name.toLowerCase() === requested.toLowerCase());
+    const matches = exact.length > 0
+      ? exact
+      : members.filter((member) => path.posix.basename(member.name).toLowerCase() === base.toLowerCase());
+    if (matches.length === 0) {
+      throw new Error(`could not extract ${base} from ${resolvedInstaller}: no such payload entry`);
+    }
+    if (matches.length !== 1) {
+      throw new Error(`could not uniquely identify ${base} in ${resolvedInstaller}: found ${matches.length} payload entries`);
+    }
+    const result = run(sevenZip, ["e", "-tnsis", "-y", `-o${destination}`, "--", resolvedInstaller, matches[0].name]);
+    const extracted = path.join(destination, path.posix.basename(matches[0].name));
     if (result.status !== 0 || !existsSync(extracted)) {
       throw new Error(
         `could not extract ${base} from ${resolvedInstaller}: ${(result.stderr || result.stdout || "no such entry").trim()}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.97",
+  "version": "0.2.99",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -660,12 +660,13 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
   const lanes = manifest?.lanes;
   const safeLanes = new Set(["ci", "release-candidate"]);
   if (manifest?.schemaVersion !== 1
+    || manifest?.compile !== "github-actions-only"
     || !Array.isArray(lanes)
     || lanes.length === 0
     || !lanes.includes("ci")
     || new Set(lanes).size !== lanes.length
     || lanes.some((lane) => !safeLanes.has(lane))) {
-    fail(`${appName} right-git-ci-only policy requires unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
+    fail(`${appName} right-git-ci-only policy requires compile=github-actions-only plus unique .rightgit.json lanes drawn from ["ci", "release-candidate"] and including "ci"`);
   }
   const expectedWorkflows = lanes.map((lane) => `${lane}.yml`).sort();
   if (JSON.stringify(workflows) !== JSON.stringify(expectedWorkflows)) {

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.21",
+    "@rightkit/git": "0.2.23",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.97",
+    "@rightkit/release": "0.2.99",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -49,7 +49,9 @@
       "0.2.16",
       "0.2.18",
       "0.2.19",
-      "0.2.20"
+      "0.2.20",
+      "0.2.21",
+      "0.2.22"
     ],
     "@rightkit/legal-ui": [
       "0.1.0"
@@ -103,7 +105,9 @@
       "0.2.92",
       "0.2.94",
       "0.2.95",
-      "0.2.96"
+      "0.2.96",
+      "0.2.97",
+      "0.2.98"
     ],
     "@rightkit/qa": [
       "0.1.0",