@rightkit/release 0.3.0 → 0.4.1

package/ios-host.mjs

@@ -0,0 +1,76 @@
+// Host and storage checks shared by the iOS lane (ios-package-recipe.mjs, ios-upload.mjs, ios-dev.mjs).
+//
+// Everything that needs Xcode, a signing keychain or the login Keychain is macOS only. On Windows or Linux the lane allows
+// config validation and --dry-run and nothing else. The signing session rule follows macos-signing-session.mjs: Xcode's
+// automatic signing needs the unlocked login keychain of the GUI (Aqua) session, so an SSH or other non-Aqua session is
+// refused unless the caller supplies a routing seam (`route`). The signing agent protocol has no xcodebuild request, so the
+// production default is a clear refusal, not a silent fallback.
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { detectMacSigningSession } from "./macos-signing-session.mjs";
+
+export class IosHostError extends Error {
+  constructor(code, message) { super(message); this.name = "IosHostError"; this.code = code; }
+}
+
+export function assertIosHost({ operation, platform = process.platform }) {
+  if (platform !== "darwin") {
+    throw new IosHostError("IOS_HOST_UNSUPPORTED", `${operation} needs macOS with Xcode; on ${platform} only config validation and --dry-run are available`);
+  }
+}
+
+/**
+ * macOS-only stages run in the GUI signing session. `detect` and `route` are injectable.
+ * Returns { routed, reason }. `route` (when given) is used for a non-Aqua session; without it that session is refused.
+ */
+export function assertGuiSigningSession({ operation, env = process.env, run = spawnSync, detect = detectMacSigningSession, route } = {}) {
+  let session;
+  try { session = detect({ env, run }); } catch (error) {
+    throw new IosHostError("IOS_GUI_SESSION_UNKNOWN", `${operation}: cannot prove the GUI signing session (${error.message})`);
+  }
+  if (!session.guiRunner) return { routed: false, reason: session.reason };
+  if (typeof route === "function") return { routed: true, reason: session.reason, route };
+  throw new IosHostError("IOS_GUI_SESSION_REQUIRED", `${operation} needs the unlocked login keychain of the GUI (Aqua) session, but this is a ${session.reason}; run it from the logged-in macOS desktop session (the signing agent cannot run xcodebuild)`);
+}
+
+/**
+ * DerivedData and result-bundle paths. With RIGHTKIT_RUN_ROOT set they come from `rightkit storage xcode-args --run-root <root>`
+ * (a JSON argv list holding -derivedDataPath and -resultBundlePath), the same source CodeRight and HeardRight use. Without a
+ * managed run the fallback is a directory under the right-release state root, never an in-repo DerivedData.
+ */
+export function resolveXcodeStorage({ env = process.env, run = spawnSync, cwd = process.cwd(), fallbackRoot }) {
+  const runRoot = typeof env.RIGHTKIT_RUN_ROOT === "string" ? env.RIGHTKIT_RUN_ROOT.trim() : "";
+  if (!runRoot) {
+    if (!fallbackRoot) throw new IosHostError("IOS_STORAGE_UNAVAILABLE", "no RIGHTKIT_RUN_ROOT and no fallback storage root; run via: rightkit storage run --app <app> -- right-release ...");
+    return { derivedData: path.join(fallbackRoot, "DerivedData"), resultBundle: undefined, source: "fallback" };
+  }
+  const result = run("rightkit", ["storage", "xcode-args", "--run-root", runRoot], { cwd, env, encoding: "utf8", windowsHide: true, shell: false, timeout: 30_000 });
+  if (result.error || result.status !== 0) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args failed (${result.status ?? "unavailable"})`);
+  let args;
+  try { args = JSON.parse(String(result.stdout ?? "")); } catch { args = null; }
+  if (!Array.isArray(args) || !args.length || args.some((arg) => typeof arg !== "string")) throw new IosHostError("IOS_STORAGE_FAILED", "rightkit storage xcode-args returned no argv list");
+  const value = (flag, required) => {
+    const index = args.indexOf(flag);
+    if (index < 0 || index + 1 >= args.length) {
+      if (required) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args is missing ${flag}`);
+      return undefined;
+    }
+    const found = args[index + 1];
+    if (!path.isAbsolute(found)) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args ${flag} is not an absolute path`);
+    return found;
+  };
+  return { derivedData: value("-derivedDataPath", true), resultBundle: value("-resultBundlePath", false), source: "rightkit-storage" };
+}
+
+/** Last lines of command output for an error message: bounded, with obvious key material masked. */
+export function outputTail(result, lines = 40) {
+  const text = `${result?.stdout ?? ""}${result?.stderr ?? ""}`
+    .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[redacted key]")
+    .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+    // a bare JWT (eyJ...), and any long base64 or hex run (a key, a token, a digest) with no path separator in it
+    .replace(/eyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]+){0,2}/g, "[redacted jwt]")
+    .replace(/(?<![A-Za-z0-9+/_-])[A-Za-z0-9+_-]{40,}={0,2}(?![A-Za-z0-9+/_-])/g, "[redacted]")
+    // standard base64 whose alphabet includes "/" (a run that does not start at a path root and has no dot or hyphen)
+    .replace(/(?<![A-Za-z0-9+/_.:~-])(?![/.])[A-Za-z0-9+/]{64,}={0,2}(?![A-Za-z0-9+/_.-])/g, "[redacted]");
+  return text.split(/\r?\n/).filter(Boolean).slice(-lines).join("\n");
+}

package/ios-lock.mjs

@@ -0,0 +1,75 @@
+// A single-holder lock file for the iOS upload, the same mechanism as the build lane's run lock (build-release.mjs acquireLock):
+// the file is created exclusively with the holder's pid, and a lock whose holder is no longer alive is replaced. Two
+// `upload --apply` runs of one release can therefore never interleave. The file lives in `.right-release/locks/`, which the source gate
+// already exempts from the clean-tree check.
+//
+// Replacing a stale lock is race-free: the stale file is first RENAMED to a unique tombstone (rename is atomic, so exactly one process
+// wins; the others see ENOENT and just retry the exclusive create), and only the winner unlinks the tombstone. A lock that was created
+// but not yet written (empty or unparsable) is held until it is older than a short grace period; it is never taken for stale at once.
+// If the file renamed away turns out not to be the stale one that was judged (another process replaced it in between), it is put back.
+import * as nodeFs from "node:fs";
+import path from "node:path";
+
+export const LOCK_GRACE_MS = 5_000;
+
+export class IosLockError extends Error {
+  constructor(code, message) { super(message); this.name = "IosLockError"; this.code = code; }
+}
+
+const processAlive = (pid) => {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  try { process.kill(Number(pid), 0); return true; } catch (error) { return error.code === "EPERM"; }
+};
+
+export function acquireFileLock(file, label, { fs = nodeFs, isAlive = processAlive, pid = process.pid, now = () => Date.now(), graceMs = LOCK_GRACE_MS } = {}) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const locked = (detail) => new IosLockError("IOS_UPLOAD_LOCKED", `${label} is already running (${detail}, lock ${file})`);
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    try {
+      const fd = fs.openSync(file, "wx");
+      try { fs.writeFileSync(fd, `${JSON.stringify({ pid, label, startedAt: new Date().toISOString() })}\n`); } finally { fs.closeSync(fd); }
+      let released = false;
+      const release = () => {
+        if (released) return;
+        released = true;
+        process.removeListener("exit", release);
+        try { fs.unlinkSync(file); } catch { /* already released */ }
+      };
+      process.on("exit", release);
+      return { release };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+    let raw;
+    try { raw = fs.readFileSync(file, "utf8"); } catch (error) {
+      if (error.code === "ENOENT") continue; // released meanwhile: create it
+      throw error;
+    }
+    let holder;
+    try { holder = JSON.parse(raw); } catch { holder = undefined; }
+    if (holder && typeof holder === "object") {
+      if (isAlive(holder.pid) && holder.pid !== pid) throw locked(`pid ${holder.pid}`);
+    } else {
+      // created but not written yet (or damaged): held until it is older than the grace period
+      let age;
+      try { age = now() - fs.statSync(file).mtimeMs; } catch (error) { if (error.code === "ENOENT") continue; throw error; }
+      if (age < graceMs) throw locked("its lock file is still being written");
+    }
+    // stale: take it away atomically; only one process can win this rename
+    const tombstone = `${file}.stale-${pid}-${now()}-${Math.random().toString(16).slice(2)}`;
+    try { fs.renameSync(file, tombstone); } catch (error) {
+      if (error.code === "ENOENT") continue; // somebody else won; retry the exclusive create
+      throw error;
+    }
+    let taken;
+    try { taken = fs.readFileSync(tombstone, "utf8"); } catch { taken = raw; }
+    if (taken !== raw) {
+      // not the stale file we judged: a live lock was replaced under us. Put it back if the name is still free.
+      try { fs.linkSync(tombstone, file); } catch { /* the name is taken again; the holder will see its lock gone only if it checks */ }
+      try { fs.unlinkSync(tombstone); } catch { /* ignore */ }
+      throw locked("another process took the lock while it was being replaced");
+    }
+    try { fs.unlinkSync(tombstone); } catch { /* ignore */ }
+  }
+  throw new IosLockError("IOS_UPLOAD_LOCKED", `${label}: cannot take the lock ${file}`);
+}