@rightkit/release 0.6.5 → 0.6.7

package/advisory-exceptions.mjs

@@ -108,6 +108,9 @@ export function parseToml(text) {
     if (raw === 'true') return true;
     if (raw === 'false') return false;
     if (/^[+-]?\d[\d_]*(\.\d+)?$/.test(raw)) return Number(raw.replace(/_/g, ''));
+    if (/^0x[0-9a-fA-F_]+$/.test(raw)) return parseInt(raw.slice(2).replace(/_/g, ''), 16);
+    if (/^0o[0-7_]+$/.test(raw)) return parseInt(raw.slice(2).replace(/_/g, ''), 8);
+    if (/^0b[01_]+$/.test(raw)) return parseInt(raw.slice(2).replace(/_/g, ''), 2);
     return fail(`unsupported value ${raw}`);
   };
   for (;;) {
@@ -224,14 +227,14 @@ function dateProblem(entryLabel, value, now) {
   return null;
 }
 
-export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date(), readFile, allowPending = false } = {}) {
+export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date(), readFile, allowPending = false, exceptionsFile = EXCEPTIONS_FILE } = {}) {
   const read = readFile ?? (p => fs.readFileSync(path.join(root, p), 'utf8'));
   const problems = [];
   const load = (file, parse) => {
     try { return parse(read(file)); } catch (err) { problems.push(`${file}: cannot read or parse (${err.message})`); return null; }
   };
 
-  const doc = load(EXCEPTIONS_FILE, JSON.parse);
+  const doc = load(exceptionsFile, JSON.parse);
   const deny = load(DENY_FILE, parseToml);
   const audit = load(AUDIT_FILE, parseToml);
   const lockPair = load(LOCK_FILE, t => ({ versions: lockedVersions(t), ...lockedGraph(t) }));
@@ -240,9 +243,9 @@ export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date()
   const { graph } = lockPair;
   for (const u of lockPair.unresolved) problems.push(`${LOCK_FILE}: dependency ${u} does not resolve to exactly one locked package`);
 
-  if (doc.schema !== 1) problems.push(`${EXCEPTIONS_FILE}: schema must be 1`);
+  if (doc.schema !== 1) problems.push(`${exceptionsFile}: schema must be 1`);
   if (!Array.isArray(doc.exceptions)) {
-    problems.push(`${EXCEPTIONS_FILE}: exceptions must be an array`);
+    problems.push(`${exceptionsFile}: exceptions must be an array`);
     return problems;
   }
 
@@ -250,7 +253,7 @@ export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date()
   const byId = new Map();
   const valid = [];
   doc.exceptions.forEach((e, idx) => {
-    const label = `${EXCEPTIONS_FILE} entry ${e?.id ?? `#${idx}`}`;
+    const label = `${exceptionsFile} entry ${e?.id ?? `#${idx}`}`;
     if (!e || typeof e !== 'object' || Array.isArray(e)) { problems.push(`${label}: not an object`); return; }
     let ok = true;
     for (const f of REQUIRED) {
@@ -329,10 +332,10 @@ export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date()
       if (seen.has(id)) problems.push(`${DENY_FILE}: duplicate ignore ${id}`);
       seen.add(id);
       const entry = byId.get(id);
-      if (!entry) { problems.push(`${DENY_FILE}: ignore ${id} has no entry in ${EXCEPTIONS_FILE}`); continue; }
-      if (reason !== entry.rationale) problems.push(`${DENY_FILE}: ignore ${id} reason differs from the rationale in ${EXCEPTIONS_FILE}`);
+      if (!entry) { problems.push(`${DENY_FILE}: ignore ${id} has no entry in ${exceptionsFile}`); continue; }
+      if (reason !== entry.rationale) problems.push(`${DENY_FILE}: ignore ${id} reason differs from the rationale in ${exceptionsFile}`);
     }
-    for (const id of byId.keys()) if (!seen.has(id)) problems.push(`${EXCEPTIONS_FILE}: entry ${id} has no ignore in ${DENY_FILE}`);
+    for (const id of byId.keys()) if (!seen.has(id)) problems.push(`${exceptionsFile}: entry ${id} has no ignore in ${DENY_FILE}`);
   }
   if (adv) {
     if (adv.yanked !== 'deny') problems.push(`${DENY_FILE}: [advisories] yanked must be "deny"`);
@@ -348,9 +351,9 @@ export function checkAdvisoryExceptions({ root = process.cwd(), now = new Date()
     for (const id of auditIgnore) {
       if (set.has(id)) problems.push(`${AUDIT_FILE}: duplicate ignore ${id}`);
       set.add(id);
-      if (!byId.has(id)) problems.push(`${AUDIT_FILE}: ignore ${id} has no entry in ${EXCEPTIONS_FILE}`);
+      if (!byId.has(id)) problems.push(`${AUDIT_FILE}: ignore ${id} has no entry in ${exceptionsFile}`);
     }
-    for (const id of byId.keys()) if (!set.has(id)) problems.push(`${AUDIT_FILE}: entry ${id} from ${EXCEPTIONS_FILE} is not ignored here (sets differ)`);
+    for (const id of byId.keys()) if (!set.has(id)) problems.push(`${AUDIT_FILE}: entry ${id} from ${exceptionsFile} is not ignored here (sets differ)`);
   }
 
   return problems;

package/android-play-upload.mjs

@@ -23,8 +23,8 @@
 import { createSign } from "node:crypto";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { describeAabProblems, scanAabBuffer } from "./android-aab-scan.mjs";
 import { sealedManifestAllowsContentDevtools } from "./devtools-policy.mjs";
 import { targetDistribution } from "./target-distribution.mjs";
@@ -190,7 +190,7 @@ const git = (cwd, args) => {
 };
 
 // Local checks only; no network, no secret. The sealed release is the only input: build-free by construction.
-export async function authorizePlayUpload({ releaseId, configName = "right-release.config.mjs", cwd = process.cwd() }) {
+export async function authorizePlayUpload({ releaseId, cwd = process.cwd(), configName = defaultReleaseConfigFile(cwd) }) {
   if (!RELEASE_ID.test(releaseId ?? "")) refuse("PLAY_RELEASE_REQUIRED", "--release <sealed-id> is required");
   const repoRoot = git(cwd, ["rev-parse", "--show-toplevel"]);
   assertPrimaryReleaseCheckout(repoRoot);
@@ -198,8 +198,8 @@ export async function authorizePlayUpload({ releaseId, configName = "right-relea
   assertCleanSource({ status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]), commandId: "right-release upload" });
   const configPath = path.resolve(cwd, configName);
   if (!existsSync(configPath)) refuse("PLAY_CONFIG_INVALID", `release config is required: ${configName}`);
-  // The config is a module that runs on import: loaded only after the tree is proven clean.
-  const config = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
+  // A legacy config is a module that runs on import (a JSON config is data): loaded only after the tree is proven clean.
+  const config = await importReleaseConfig(configPath, { query: `upload=${Date.now()}` });
   const distribution = validatePlayDistribution(targetDistribution(config, "android"));
   const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, "android");
   const sealed = verifyPublicationRelease({ sealedDir, repoRoot, appRoot: path.dirname(configPath), commit, app: config.app, version: config.version, platform: "android", configPath, releaseId });