@rightkit/release 0.2.99 → 0.2.100

package/direct-bootstrap.mjs

@@ -356,7 +356,7 @@ export function renderPowerShellBootstrap({
     "New-Item -ItemType Junction -Path $NextLink -Target $VersionRoot | Out-Null",
     "$Switched = $false; $PriorDetached = $false",
     "try {",
-    "  if (Test-Path $Current) { Move-Item $Current $PreviousLink; $PriorDetached = $true }; Move-Item $NextLink $Current; $Switched = $true",
+    "  if (Test-Path $Current) { [IO.Directory]::Move($Current, $PreviousLink); $PriorDetached = $true }; [IO.Directory]::Move($NextLink, $Current); $Switched = $true",
     "  $StableExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")),
     "  $ActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate $VersionRoot $Version); $StatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate $VersionRoot $Version)",
     "  & $StableExe @ActivationArgs; if ($LASTEXITCODE -ne 0) { throw 'Activation failed' }",
@@ -367,7 +367,7 @@ export function renderPowerShellBootstrap({
     // cleanup fails, catch still has a rollback anchor to restore.
     "  Remove-Item -Force $Journal; if (Test-Path $PreviousLink) { Remove-Item -Force $PreviousLink }; Write-Output (" + psQuote(product + " ") + " + $Version + ' installed')",
     "} catch {",
-    "  if (($Switched -or $PriorDetached) -and (Test-Path $Current)) { Remove-Item -Force $Current }; if ($PriorDetached -and (Test-Path $PreviousLink)) { Move-Item $PreviousLink $Current }",
+    "  if (($Switched -or $PriorDetached) -and (Test-Path $Current)) { Remove-Item -Force $Current }; if ($PriorDetached -and (Test-Path $PreviousLink)) { [IO.Directory]::Move($PreviousLink, $Current) }",
     "  if ($PriorTarget -and (Test-Path $Current)) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate ([string]$PriorTarget) $PriorVersion); $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); & $PriorExe @PriorActivationArgs; if ($LASTEXITCODE -ne 0) { throw 'Rollback activation failed' }; $PriorHealthText = (& $PriorExe @PriorStatusArgs | Out-String).Trim(); if ($LASTEXITCODE -ne 0) { throw 'Rollback health failed' }; $PriorHealth = $PriorHealthText | ConvertFrom-Json; try { Assert-Health $PriorHealth $PriorVersion } catch { throw 'Prior health was not restored' } }",
     "  if (Test-Path $VersionRoot) { Remove-Item -Recurse -Force $VersionRoot }; throw",
     "} finally { if (Test-Path $Work) { Remove-Item -Recurse -Force $Work } }",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.99",
+  "version": "0.2.100",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release-invocation.mjs

@@ -32,7 +32,11 @@ export function assertPrimaryReleaseCheckout(repoRoot, env = process.env) {
     throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
   }
   const branch = spawnSync("git", ["symbolic-ref", "--quiet", "HEAD"], { cwd: repoRoot, encoding: "utf8", windowsHide: true });
-  if (branch.status !== 0 && !isVerifiedGithubActionsTagCheckout(repoRoot, env)) {
+  if (
+    branch.status !== 0
+    && !isVerifiedGithubActionsTagCheckout(repoRoot, env)
+    && !isVerifiedGithubActionsAdmittedDispatch(repoRoot, env)
+  ) {
     throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
   }
 }
@@ -63,6 +67,48 @@ function isVerifiedGithubActionsTagCheckout(repoRoot, env) {
   return repository?.toLowerCase() === env.GITHUB_REPOSITORY.toLowerCase();
 }
 
+// A tag-last release chain never has a tag to check out: the whole point is that
+// publication mints the tag only after qualification passes. Every stage instead
+// checks out one exact commit SHA admitted from the default branch, which leaves
+// HEAD detached. Refusing that would force the retired tag-first shape back.
+//
+// This exemption is deliberately STRICTER than the tag one above. A tag proves
+// only that some ref points at this commit; here the commit must additionally be
+// the exact revision this run was admitted against AND be genuinely reachable
+// from the remote branch the dispatch came from, so a detached HEAD parked on an
+// arbitrary, orphaned, or force-pushed commit is still refused.
+function isVerifiedGithubActionsAdmittedDispatch(repoRoot, env) {
+  const sha = env.GITHUB_SHA;
+  const admitted = env.RIGHT_GIT_SOURCE_REVISION;
+  if (
+    env.GITHUB_ACTIONS !== "true"
+    || env.GITHUB_EVENT_NAME !== "workflow_dispatch"
+    || env.GITHUB_REF_TYPE !== "branch"
+    || !/^refs\/heads\/.+$/.test(env.GITHUB_REF ?? "")
+    || !/^[a-f0-9]{40}$/.test(sha ?? "")
+    || !/^[a-f0-9]{40}$/.test(admitted ?? "")
+    || !/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(env.GITHUB_REPOSITORY ?? "")
+  ) return false;
+  // The checkout must be the exact revision the admission stage bound this run
+  // to — not merely some commit the dispatch happened to land on.
+  const head = git(repoRoot, ["rev-parse", "HEAD"]).trim();
+  if (head !== admitted) return false;
+  let origin;
+  try {
+    origin = git(repoRoot, ["remote", "get-url", "origin"]).trim();
+  } catch {
+    return false;
+  }
+  const repository = origin.match(/(?:github\.com[/:])([^/\s]+\/[^/\s]+?)(?:\.git)?\/?$/i)?.[1];
+  if (repository?.toLowerCase() !== env.GITHUB_REPOSITORY.toLowerCase()) return false;
+  // Reachability from the remote branch that was dispatched. A shallow or
+  // ref-less checkout cannot prove this, and so does not get the exemption.
+  const dispatchBranch = (env.GITHUB_REF ?? "").replace(/^refs\/heads\//, "");
+  const remoteRef = `refs/remotes/origin/${dispatchBranch}`;
+  if (spawnSync("git", ["rev-parse", "--verify", "--quiet", remoteRef], { cwd: repoRoot, windowsHide: true }).status !== 0) return false;
+  return spawnSync("git", ["merge-base", "--is-ancestor", head, remoteRef], { cwd: repoRoot, windowsHide: true }).status === 0;
+}
+
 export function resolvePrimaryWorktree({ repoRoot, worktrees, gitDir, coreWorktree }) {
   const listed = worktrees.match(/^worktree (.+)$/m)?.[1];
   if (!listed) return undefined;

package/release.mjs

@@ -694,17 +694,41 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     const windowsSource = windowsSpan ? source.slice(windowsSpan.start, windowsSpan.end) : "";
     const macosSource = macosSpan ? source.slice(macosSpan.start, macosSpan.end) : "";
     const publishSource = publishSpan ? source.slice(publishSpan.start, publishSpan.end) : "";
+    // Two release-chain shapes are accepted: the retired tag-first lane (a pushed
+    // `refs/tags/v*` — or, for signing only, an explicit manual `signed_qualification`
+    // dispatch — gates signing/publish) and the current tag-last lane (one admitted
+    // dispatch binds every stage to an exact main commit; an `admission` job validates
+    // the dispatch envelope and publication itself mints the tag last). Both must prove
+    // the same thing — signing is unreachable without qualification actually being
+    // requested for this run, and publish is unreachable unless that qualification
+    // verified success in this same run — only the mechanism differs.
+    const legacySigningGate = (job) => new RegExp(
+      `${job}:\\n    needs: \\[candidate\\]\\n    if: \\$\\{\\{ startsWith\\(github\\.ref, 'refs\\/tags\\/v'\\)(?: \\|\\| \\(github\\.event_name == 'workflow_dispatch' && inputs\\.signed_qualification == true\\))? \\}\\}`,
+    );
+    const admittedSigningGate = (job) => new RegExp(
+      `${job}:\\n    needs: \\[admission, candidate\\]\\n    if: \\$\\{\\{ needs\\.admission\\.outputs\\.signed_qualification == 'true' \\}\\}`,
+    );
     const protectedWindowsSigning = workflow === "release-candidate.yml"
       && manifest?.candidate?.signWindows === true
-      && /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\)(?: \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\))? \}\}/.test(windowsSource);
+      && (legacySigningGate("windows-sign").test(windowsSource) || admittedSigningGate("windows-sign").test(windowsSource));
     const protectedMacosSigning = workflow === "release-candidate.yml"
       && manifest?.candidate?.signMacos === true
-      && /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\)(?: \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\))? \}\}/.test(macosSource);
+      && (legacySigningGate("macos-sign").test(macosSource) || admittedSigningGate("macos-sign").test(macosSource));
     const releaseChain = workflow === "release-candidate.yml" ? manifest?.candidate?.releaseChain : undefined;
     const allowedReleaseSecrets = new Set(releaseChain?.publishSecrets ?? []);
     const writePermissions = [...source.matchAll(/^\s*(actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/gmi)].map((match) => ({ name: match[1].toLowerCase(), index: match.index }));
+    // Legacy: publish requires a pushed tag AND same-run installed-qualification
+    // success — the tag is the sole gate because tag-first signing already proved
+    // qualification before the tag existed. Tag-last: there is no tag to check;
+    // instead publish requires the admission job's `publish` output (which itself
+    // implies `signed_qualification` was requested — see the admission job's own
+    // envelope validation) AND same-run success of BOTH installed-qualification
+    // (Windows) and macos-sign (macOS), so publish is unreachable unless every
+    // signing/qualification stage actually verified in this exact run.
+    const legacyReleasePublishGate = /publish:\n    needs: \[[^\n]*installed-qualification[^\n]*\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) && needs\.installed-qualification\.result == 'success'/.test(publishSource);
+    const admittedReleasePublishGate = /publish:\n    needs: \[(?=[^\n]*\badmission\b)(?=[^\n]*\binstalled-qualification\b)(?=[^\n]*\bmacos-sign\b)[^\n]*\]\n    if: \$\{\{ needs\.admission\.outputs\.publish == 'true' && needs\.installed-qualification\.result == 'success' && needs\.macos-sign\.result == 'success' \}\}/.test(publishSource);
     const protectedReleasePublish = releaseChain
-      && /publish:\n    needs: \[[^\n]*installed-qualification[^\n]*\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) && needs\.installed-qualification\.result == 'success'/.test(publishSource)
+      && (legacyReleasePublishGate || admittedReleasePublishGate)
       && /\n    permissions:\n      contents: write\n/.test(publishSource);
     if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
       || writePermissions.some(({ name, index }) => name === "id-token"

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.23",
+    "@rightkit/git": "0.2.25",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.99",
+    "@rightkit/release": "0.2.100",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -51,7 +51,9 @@
       "0.2.19",
       "0.2.20",
       "0.2.21",
-      "0.2.22"
+      "0.2.22",
+      "0.2.23",
+      "0.2.24"
     ],
     "@rightkit/legal-ui": [
       "0.1.0"
@@ -107,7 +109,8 @@
       "0.2.95",
       "0.2.96",
       "0.2.97",
-      "0.2.98"
+      "0.2.98",
+      "0.2.99"
     ],
     "@rightkit/qa": [
       "0.1.0",