@rightkit/release 0.4.1 → 0.5.1

package/cli/right-release.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { spawn } from "../background-process.mjs";
 import { fileURLToPath } from "node:url";
 import { assertReleaseExecutionAllowed } from "../execution-policy.mjs";
+import { hostUploadRefusalMessage } from "../host-upload-refusal.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const commands = new Map([
@@ -19,6 +20,7 @@ const commands = new Map([
   ["sign-windows", "sign-windows.mjs"],
   ["sign-updater", "sign-updater.mjs"],
   ["sign-dev-artifact", "sign-dev-artifact.mjs"],
+  ["sign-qa-bundle", "sign-qa-bundle.mjs"],
   ["sign-candidate", "sign-candidate.mjs"],
   ["engine-locate", "engine-locator.mjs"],
   ["stage-sidecar", "stage-sidecar-command.mjs"],
@@ -65,6 +67,7 @@ try {
     || first?.startsWith("-")
     || (first === "addon" && args[1] === "build")
     || (first === "dmg" && args[1] === "build")
+    || first === "qualify"
     || (first === "publish" && ["cargo", "swift"].includes(args[1]))) {
     assertReleaseExecutionAllowed({ command: `right-release ${args.join(" ")}`.trim() });
   }
@@ -103,8 +106,25 @@ if (first === "--version" || first === "-v") {
   run("dmg-build.mjs", args.slice(1));
 } else if (first === "apple") {
   run("apple-profile-renew.mjs", args.slice(1));
+} else if (first === "qualify") {
+  // Local qualification (default): both native hosts qualify the crates through the RustRight broker and a candidate is cut.
+  // It uploads nothing; the approval commit and publish-reviewed.yml publish the pinned bytes (docs/CI.md "Local qualification").
+  run("local-qualify.mjs", args.slice(1));
 } else if (first === "publish") {
   const rest = args.slice(1);
+  // RightKit crates and @rightkit packages reach a registry from CI only: publish.yml qualification, the approval
+  // commit in ci/approved-artifacts.json, then publish-reviewed.yml uploads exactly the approved bytes (docs/CI.md).
+  // Every host-side upload path is refused on every host; preflight, --dry-run and --qualify-only still run.
+  if (rest[0] === "cargo" || rest[0] === "npm") {
+    const uploads = rest[0] === "npm"
+      ? rest.includes("--publish") || rest.includes("--local")
+      : !rest.includes("--dry-run") && !rest.includes("--qualify-only");
+    // Unconditional: a caller-set GITHUB_ACTIONS=true never lifts it (CI uploads use scripts/ci/publish.mjs and reviewed-candidate.mjs).
+    if (uploads) {
+      console.error(hostUploadRefusalMessage(`right-release publish ${rest[0]}`));
+      process.exit(2);
+    }
+  }
   if ((rest[0] === "cargo" || rest[0] === "npm") && rest.includes("--local")) {
     run("local-publish.mjs", rest);
   } else if (rest[0] === "cargo") {
@@ -237,6 +257,8 @@ Commands:
                                                       Fail when a built web dist/ carries a forbidden marker string or mock/fixture chunk name (dev, mock or fixture code in release)
   sign-dev-artifact --artifact <dir> --manifest <sign.json> [--metadata <payload.json>] [--evidence <path>] [--dry-run]
                                                       Developer ID sign an existing CI dev artifact per file with fixed identifiers; never builds, notarizes or publishes (macOS)
+  sign-qa-bundle --app <abs .app> --qa-root <abs dir> [--entitlements <abs plist>] [--out <evidence.json>]
+                                                      QA ONLY: ad hoc sign a bundle inside a QA scratch root, nested code first, outer last, never --deep, never the signing agent (macOS); not a release artifact
   sign-candidate --platform win|mac --artifact <dir> --candidate-receipt <receipt.json> --out <binding.json> [--manifest <sign.json>] [--publisher <subject>] [--dry-run]
                                                       Sign the exact unsigned candidate bytes (sha256 checked against the candidate receipt) instead of rebuilding; writes a candidate-sha -> signed-sha binding receipt
   engine-locate --engine cutright|genright [--sha256 <hex>] [--json]
@@ -268,6 +290,13 @@ Commands:
                                                       Verify on source host; export crate bytes & gate evidence without uploading
   publish cargo --crate <name> --from-evidence <gate.json>
                                                       Reuse exact HEAD/artifact proof on upload host; recheck archive hash & registry bytes
+  qualify cargo --crates <a,b> [--hosts win,mac] [--id <id>] [--allow-ignored-units <a,b>] [--jobs <1-64>] [--concurrency <1-8>] [--out <dir>] [--no-release] [--with-ci]
+                                                      Qualify the crates on BOTH native hosts through the RustRight broker (Dell: Windows, Mac: macOS over ssh), seal one packed
+                                                      asset and one receipt per host, attach them to the prerelease candidate-<id> and print the candidate and approval entry.
+                                                      Needs a clean checkout with HEAD on origin/main (the other host at the same HEAD). Never uploads to a registry.
+                                                      --with-ci also dispatches publish.yml for the same commit when the hosts start and pins that run in the candidate as clean-room proof
+                                                      (Linux-required units and runtime owners no local workload covers are planned only with --with-ci, and then need that run to succeed).
+                                                      Any repository: owner/name from its origin remote; hosts, approvals file and promotion workflow from .rightkit-gate.json
   publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]
                                                       Check main, a clean tree, and the publication evidence, then tag RightKitSwift at its VERSION on origin
   inventory check [--json] [--warn-only] [--md <file>] [--no-cache]