@zaip-ai/cli 2.2.0 → 3.0.0

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs

@@ -12,7 +12,14 @@ try {
   const requestedRepository = resolve(options.repository);
   const repository = git(requestedRepository, ["rev-parse", "--show-toplevel"]).trim();
   const gitDirectory = git(repository, ["rev-parse", "--absolute-git-dir"]).trim();
-  const configuredBranch = configuredDeployBranch(repository);
+  const deployment = configuredDeployment(repository);
+  const framework = isFrameworkRepository(repository);
+  const scope = options.scope ?? (framework ? "framework" : "frontend");
+  if (scope === "framework" && !framework)
+    fail("--scope framework is reserved for the canonical @zaip-ai/aios framework repository");
+  const configuredBranch = deployment[scope];
+  if (scope === "frontend" || scope === "backend")
+    assertApplicationContent(repository, configuredBranch);
   if (options.branch !== null && options.branch !== configuredBranch) {
     fail(
       `caller branch ${options.branch} conflicts with configured deploy.branch ${configuredBranch}`,
@@ -20,7 +27,7 @@ try {
   }
   if (options.resolveBranch) {
     process.stdout.write(
-      `${JSON.stringify({ configured_branch: configuredBranch, push_refspec: `HEAD:refs/heads/${configuredBranch}` })}\n`,
+      `${JSON.stringify({ configured_branch: configuredBranch, production_branch: deployment.productionBranch, push_refspec: `HEAD:refs/heads/${configuredBranch}` })}\n`,
     );
     process.exit(0);
   }
@@ -28,7 +35,7 @@ try {
   if (checkedOutBranch === "") fail("detached HEAD is not deployable");
   if (checkedOutBranch !== configuredBranch)
     fail(
-      `checked out branch ${checkedOutBranch} does not match configured deploy.branch ${configuredBranch}`,
+      `checked out branch ${checkedOutBranch} does not match validation deploy.branch ${configuredBranch}; switch or create the configured validation branch manually before publishing`,
     );
 
   for (const variable of ["GIT_SSH", "GIT_SSH_COMMAND"]) {
@@ -81,6 +88,7 @@ try {
         status: "ready",
         repository,
         configured_branch: configuredBranch,
+        production_branch: deployment.productionBranch,
         checked_out_branch: checkedOutBranch,
         caller_branch: options.branch,
         upstream: upstream || null,
@@ -119,10 +127,12 @@ function parseArguments(arguments_) {
     branch: null,
     timeout: 15_000,
     resolveBranch: false,
+    scope: null,
   };
   for (let index = 0; index < arguments_.length; index += 1) {
     const argument = arguments_[index];
     if (argument === "--resolve-branch") parsed.resolveBranch = true;
+    else if (argument === "--scope") parsed.scope = requiredValue(arguments_, ++index, argument);
     else if (argument === "--repository")
       parsed.repository = requiredValue(arguments_, ++index, argument);
     else if (argument === "--remote") parsed.remote = requiredValue(arguments_, ++index, argument);
@@ -139,12 +149,24 @@ function parseArguments(arguments_) {
   if (!Number.isInteger(parsed.timeout) || parsed.timeout < 1_000 || parsed.timeout > 60_000) {
     fail("--timeout-ms must be an integer from 1000 to 60000");
   }
+  if (
+    parsed.scope !== null &&
+    !["framework", "frontend", "backend", "database"].includes(parsed.scope)
+  )
+    fail("--scope must be framework, frontend, backend or database");
   return parsed;
 }
 
-function configuredDeployBranch(repository) {
+function configuredDeployment(repository) {
   const configPath = resolve(repository, ".agents/config/project.yaml");
-  if (!existsSync(configPath)) return "main";
+  if (!existsSync(configPath))
+    return {
+      framework: "beta",
+      frontend: "beta",
+      backend: "beta",
+      database: "beta",
+      productionBranch: "main",
+    };
   let document;
   try {
     document = parseDocument(readFileSync(configPath, "utf8"), { strict: true, uniqueKeys: true });
@@ -161,25 +183,100 @@ function configuredDeployBranch(repository) {
     fail("project.yaml must contain a mapping");
   }
   const deploy = config.deploy;
-  if (deploy === undefined) return "main";
+  if (deploy === undefined)
+    return {
+      framework: "beta",
+      frontend: "beta",
+      backend: "beta",
+      database: "beta",
+      productionBranch: "main",
+    };
   if (deploy === null || typeof deploy !== "object" || Array.isArray(deploy)) {
     fail("project.yaml deploy must be a mapping");
   }
-  if (!("branch" in deploy)) return "main";
-  if (typeof deploy.branch !== "string" || deploy.branch.trim() === "") {
+  if (
+    !Object.keys(deploy).every((key) =>
+      [
+        "branch",
+        "production_branch",
+        "allow_production",
+        "frontend",
+        "backend",
+        "database",
+      ].includes(key),
+    )
+  ) {
+    fail("project.yaml deploy has unsupported keys");
+  }
+  const branch = "branch" in deploy ? deploy.branch : "beta";
+  for (const key of ["frontend", "backend", "database"])
+    if (
+      deploy[key] !== undefined &&
+      (deploy[key] === null ||
+        typeof deploy[key] !== "object" ||
+        Array.isArray(deploy[key]) ||
+        !Object.keys(deploy[key]).every((nested) => nested === "branch"))
+    )
+      fail(`project.yaml deploy.${key} must be a branch mapping`);
+  const frontend = deploy.frontend?.branch ?? branch;
+  const backend = deploy.backend?.branch ?? branch;
+  const database = deploy.database?.branch ?? "beta";
+  const productionBranch = "production_branch" in deploy ? deploy.production_branch : "main";
+  if (typeof branch !== "string" || branch.trim() === "") {
     fail("project.yaml deploy.branch must be a non-empty Git branch name");
   }
-  const branch = deploy.branch.trim();
-  if (!isValidBranch(repository, branch)) fail(`project.yaml deploy.branch is invalid: ${branch}`);
-  return branch;
+  if (typeof productionBranch !== "string" || productionBranch.trim() === "") {
+    fail("project.yaml deploy.production_branch must be a non-empty Git branch name");
+  }
+  if (branch.trim() !== branch || productionBranch.trim() !== productionBranch) {
+    fail("project.yaml deploy branch names must not contain leading or trailing whitespace");
+  }
+  if (typeof frontend !== "string" || typeof backend !== "string" || database !== "beta")
+    fail(
+      "project.yaml deploy.database.branch must be literal beta and application branches must be strings",
+    );
+  for (const candidate of [frontend, backend, database])
+    if (!isValidBranch(repository, candidate))
+      fail(`project.yaml deploy branch is invalid: ${candidate}`);
+  const validationBranch = branch;
+  const protectedProductionBranch = productionBranch;
+  if (!isValidBranch(repository, validationBranch))
+    fail(`project.yaml deploy.branch is invalid: ${validationBranch}`);
+  if (!isValidBranch(repository, protectedProductionBranch))
+    fail(`project.yaml deploy.production_branch is invalid: ${protectedProductionBranch}`);
+  if (validationBranch === "main" || validationBranch === protectedProductionBranch)
+    fail("project.yaml deploy.branch is framework-only and must not equal the production branch");
+  return {
+    framework: validationBranch,
+    frontend,
+    backend,
+    database,
+    productionBranch: protectedProductionBranch,
+  };
+}
+
+function isFrameworkRepository(repository) {
+  const manifest = resolve(repository, "package.json");
+  if (!existsSync(manifest) || !existsSync(resolve(repository, "packages/core/src/config.ts")))
+    return false;
+  try {
+    return JSON.parse(readFileSync(manifest, "utf8")).name === "@zaip-ai/aios";
+  } catch {
+    return false;
+  }
 }
 
 function isValidBranch(repository, branch) {
   if (
+    branch.length > 255 ||
+    !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(branch) ||
     branch.startsWith("-") ||
     branch.includes("..") ||
     branch.includes("//") ||
-    branch.includes("@{")
+    branch.includes("@{") ||
+    branch.endsWith(".") ||
+    branch.endsWith("/") ||
+    branch.split("/").some((segment) => segment.startsWith(".") || segment.endsWith(".lock"))
   )
     return false;
   return (
@@ -188,6 +285,46 @@ function isValidBranch(repository, branch) {
   );
 }
 
+function assertApplicationContent(repository, targetBranch) {
+  const remote = git(repository, ["rev-parse", "--verify", `refs/remotes/origin/${targetBranch}`], {
+    allowFailure: true,
+  }).trim();
+  const committed = remote
+    ? git(repository, ["diff", "--name-only", `${remote}..HEAD`], { allowFailure: true })
+    : git(repository, ["ls-tree", "-r", "--name-only", "HEAD"], { allowFailure: true });
+  const changed = git(repository, ["diff", "--name-only", "HEAD"], { allowFailure: true });
+  const untracked = git(repository, ["ls-files", "--others", "--exclude-standard"], {
+    allowFailure: true,
+  });
+  const names = [
+    ...new Set(
+      [committed, changed, untracked].flatMap((value) => value.split(/\r?\n/).filter(Boolean)),
+    ),
+  ];
+  if (names.some((name) => /(^|\/)supabase\/migrations\/|migration.*\.sql$/i.test(name)))
+    fail("application deploy cannot include database migrations");
+  for (const name of names) {
+    if (/^(?:\.agents\/|docs\/|README(?:-[A-Z]+)?\.md$)/i.test(name)) continue;
+    if (/^packages\/cli\/src\/database-migration-policy(?:\.test)?\.[cm]?[jt]sx?$/i.test(name))
+      continue;
+    if (!/\.(?:[cm]?[jt]sx?|py|rb|go|ya?ml)$/i.test(name)) continue;
+    const path = resolve(repository, name);
+    const contents = [
+      git(repository, ["show", `HEAD:${name}`], { allowFailure: true }),
+      git(repository, ["show", `:${name}`], { allowFailure: true }),
+      existsSync(path) ? readFileSync(path, "utf8") : "",
+    ];
+    if (
+      contents.some((content) =>
+        /(?:service_role\s*=\s*[^\s'"`]+|SUPABASE_SERVICE_ROLE_KEY\s*=|apply_migration\s*\(|\b(?:supabase\s+)?db\s+push\b|startup\s+migration\s*[:=])/i.test(
+          content,
+        ),
+      )
+    )
+      fail("application deploy cannot include database admin credentials or migration bypasses");
+  }
+}
+
 function requiredValue(arguments_, index, option) {
   const value = arguments_[index];
   if (!value || value.startsWith("--")) fail(`${option} requires a value`);

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/preflight.test.mjs

@@ -29,23 +29,82 @@ test("standalone consumer resolves fresh project targets without node_modules",
       return JSON.parse(result.stdout);
     };
     const config = (text) => writeFileSync(join(root, ".agents/config/project.yaml"), text);
-    assert.equal(target().configured_branch, "main");
+    assert.equal(target().configured_branch, "beta");
+    assert.equal(target().production_branch, "main");
     config("project: { name: example }\n");
-    assert.equal(target().configured_branch, "main");
+    assert.equal(target().configured_branch, "beta");
     config("deploy: {}\n");
-    assert.equal(target().configured_branch, "main");
+    assert.equal(target().configured_branch, "beta");
     config("deploy:\n  branch: 'release/production'\n");
     assert.deepEqual(target(), {
       configured_branch: "release/production",
+      production_branch: "main",
       push_refspec: "HEAD:refs/heads/release/production",
     });
     config("deploy: { branch: staging }\n");
     assert.equal(target().configured_branch, "staging");
+    config("deploy: { branch: beta, production_branch: production }\n");
+    assert.deepEqual(target(), {
+      configured_branch: "beta",
+      production_branch: "production",
+      push_refspec: "HEAD:refs/heads/beta",
+    });
     assert.match(run("--resolve-branch", "--branch", "main").stderr, /conflicts with configured/);
+    config(
+      "deploy: { branch: beta, allow_production: true, frontend: { branch: main }, backend: { branch: main }, database: { branch: beta } }\n",
+    );
+    assert.equal(target().configured_branch, "main");
+    assert.match(
+      run("--resolve-branch", "--scope", "framework").stderr,
+      /reserved for the canonical/,
+    );
+    mkdirSync(join(root, "packages/core/src"), { recursive: true });
+    writeFileSync(join(root, "packages/core/src/config.ts"), "export {};\n");
+    writeFileSync(join(root, "package.json"), '{"name":"@zaip-ai/aios"}\n');
+    assert.equal(
+      JSON.parse(run("--resolve-branch", "--scope", "framework").stdout).configured_branch,
+      "beta",
+    );
+    assert.equal(
+      JSON.parse(run("--resolve-branch", "--scope", "frontend").stdout).configured_branch,
+      "main",
+    );
+    assert.equal(
+      JSON.parse(run("--resolve-branch", "--scope", "backend").stdout).configured_branch,
+      "main",
+    );
+    assert.match(
+      run("--resolve-branch", "--scope", "database", "--branch", "main").stderr,
+      /conflicts/,
+    );
+    config("deploy: { database: { branch: main } }\n");
+    assert.match(run("--resolve-branch", "--scope", "database").stderr, /literal beta/);
+    config("deploy: { branch: main, allow_production: true }\n");
+    assert.match(run("--resolve-branch", "--scope", "framework").stderr, /framework-only/);
+    for (const source of [
+      "deploy: { branch: null, production_branch: production }\n",
+      "deploy: { branch: beta, validation_branch: staging }\n",
+      "deploy: { branch: beta, branch: staging }\n",
+    ]) {
+      config(source);
+      assert.match(run("--resolve-branch").stderr, /non-empty|unsupported keys|malformed/);
+    }
+    config("deploy: { branch: staging, production_branch: production }\n");
     assert.match(run().stderr, /checked out branch codex\/working does not match/);
-    for (const branch of ["bad..branch", "bad.lock/child", ".hidden/child", "-option"]) {
+    for (const branch of [
+      "bad..branch",
+      "bad.lock/child",
+      ".hidden/child",
+      "foo/.hidden",
+      "-option",
+      " beta ",
+      "a".repeat(256),
+    ]) {
       config(`deploy: { branch: '${branch}' }\n`);
-      assert.match(run("--resolve-branch").stderr, /deploy.branch is invalid/);
+      assert.match(
+        run("--resolve-branch").stderr,
+        /deploy.branch is invalid|must not contain leading/,
+      );
     }
     config("deploy: { branch: release_ }\n");
     assert.equal(target().configured_branch, "release_");

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/release-notes-coverage.test.mjs

@@ -0,0 +1,126 @@
+import assert from "node:assert/strict";
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { resolve, sep } from "node:path";
+import test from "node:test";
+
+const script = resolve(import.meta.dirname, "validate-release-notes.mjs");
+const bullet = "- **Exportação:** corrige datas e inclui documentação revisada.";
+
+test("release notes validate real Git coverage and categorized content", async (t) => {
+  const root = mkdtempSync(resolve(tmpdir(), "zaip-release-notes-"));
+  t.after(() => {
+    assert.ok(root.startsWith(resolve(tmpdir()) + sep + "zaip-release-notes-"));
+    rmSync(root, { recursive: true, force: true });
+  });
+  const git = (...args) => execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
+  git("init", "--quiet");
+  git("config", "user.email", "test@example.com");
+  git("config", "user.name", "Test");
+  writeFileSync(resolve(root, "feature.md"), "before\n");
+  writeFileSync(resolve(root, "obsolete.md"), "remove me\n");
+  git("add", "--", "feature.md", "obsolete.md");
+  git("commit", "--quiet", "-m", "initial");
+  git("tag", "v1.0");
+  const base = git("rev-parse", "HEAD");
+  writeFileSync(resolve(root, "feature.md"), "after\n");
+  writeFileSync(resolve(root, "revisão.md"), "UTF-8\n");
+  unlinkSync(resolve(root, "obsolete.md"));
+  git("add", "--", "feature.md", "obsolete.md", "revisão.md");
+  git("commit", "--quiet", "-m", "direct changes");
+  const sha = git("rev-parse", "HEAD");
+  const files = ["feature.md", "obsolete.md", "revisão.md"];
+  const inventory = () => ({
+    from: "v1.0",
+    to: sha,
+    files,
+    topics: [{ category: "fix", bullet, files }],
+  });
+  const notes =
+    "## Resumo\n\nEsta versão corrige a exportação e atualiza a documentação.\n\n## Correções\n\n" +
+    bullet +
+    "\n";
+  function check({
+    body = notes,
+    data = inventory(),
+    args = ["--from", "v1.0", "--to", sha],
+    error,
+  } = {}) {
+    writeFileSync(resolve(root, "notes.md"), body);
+    writeFileSync(resolve(root, "inventory.json"), JSON.stringify(data));
+    const result = spawnSync(
+      process.execPath,
+      [
+        script,
+        "--repository",
+        root,
+        ...args,
+        "--notes-file",
+        "notes.md",
+        "--inventory-file",
+        "inventory.json",
+      ],
+      { encoding: "utf8" },
+    );
+    assert.equal(result.status, error ? 1 : 0, result.stderr);
+    if (error) assert.match(result.stderr, error);
+    else assert.equal(JSON.parse(result.stdout).semantic_review, "required");
+  }
+  await t.test("accepts direct edits, deleted files and Unicode paths", () => check());
+  await t.test("rejects compare-only notes", () =>
+    check({ body: "Full Changelog: v1.0...v1.1\n", error: /compare-only/ }),
+  );
+  await t.test("rejects omitted deletion independently of body quality", () => {
+    const data = inventory();
+    data.files = files.filter((file) => file !== "obsolete.md");
+    check({ data, error: /exactly cover the changed Git range/ });
+  });
+  await t.test("rejects unmapped files", () => {
+    const data = inventory();
+    data.topics[0].files = ["feature.md"];
+    check({ data, error: /exactly cover every inventoried file/ });
+  });
+  await t.test("rejects a topic present only in a fenced example", () =>
+    check({
+      body: notes.replace(bullet, "```md\n" + bullet + "\n```"),
+      error: /outside fenced examples/,
+    }),
+  );
+  await t.test("rejects unsupported extra bullets", () =>
+    check({
+      body: notes + "- **API:** adiciona uma capacidade sem origem no inventário.\n",
+      error: /exactly match inventory topics/,
+    }),
+  );
+  await t.test("rejects a topic under the wrong category", () =>
+    check({
+      body: notes.replace("## Correções", "## Novidades"),
+      error: /mapped category heading/,
+    }),
+  );
+  await t.test("rejects a missing summary", () =>
+    check({ body: "## Correções\n\n" + bullet, error: /Resumo/ }),
+  );
+  await t.test("rejects an empty category", () =>
+    check({ body: notes + "\n## Documentação\n", error: /category section must contain a bullet/ }),
+  );
+  await t.test("rejects moving candidate refs", () =>
+    check({ args: ["--from", "v1.0", "--to", "HEAD"], error: /immutable/ }),
+  );
+  await t.test("rejects a previous ref newer than the candidate", () =>
+    check({ args: ["--from", sha, "--to", base], error: /is-ancestor/ }),
+  );
+  await t.test("accepts a first release against its entire tree", () => {
+    const initialFiles = ["feature.md", "revisão.md"];
+    check({
+      args: ["--initial", "--to", sha],
+      data: {
+        from: null,
+        to: sha,
+        files: initialFiles,
+        topics: [{ category: "fix", bullet, files: initialFiles }],
+      },
+    });
+  });
+});

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/resolve-release-identity.mjs

@@ -0,0 +1,78 @@
+import { parseArgs } from "node:util";
+
+const { values } = parseArgs({
+  options: {
+    sha: { type: "string" },
+    channel: { type: "string" },
+    "latest-tag": { type: "string" },
+    "tags-json": { type: "string" },
+    version: { type: "string" },
+    major: { type: "boolean", default: false },
+    "existing-tag-sha": { type: "string" },
+  },
+  strict: true,
+});
+if (!/^[a-f0-9]{40}$/i.test(values.sha ?? ""))
+  throw new Error("--sha must be an exact 40 character Git SHA");
+if (values.channel !== "validation" && values.channel !== "production")
+  throw new Error("--channel must be validation or production");
+if (values.version !== undefined && values.major)
+  throw new Error("--version and --major cannot be used together");
+if (values["latest-tag"] !== undefined && values["tags-json"] !== undefined)
+  throw new Error("use either --latest-tag or --tags-json");
+const latest =
+  values["tags-json"] === undefined ? values["latest-tag"] : numericMaximum(values["tags-json"]);
+const version = values.version ?? nextVersion(latest, values.major);
+parseVersion(version, "release version");
+const tag = `v${version}`;
+if (
+  values["existing-tag-sha"] !== undefined &&
+  values["existing-tag-sha"].toLowerCase() !== values.sha.toLowerCase()
+)
+  throw new Error(`tag ${tag} belongs to a different SHA and cannot be reused`);
+process.stdout.write(
+  `${JSON.stringify({
+    version,
+    tag,
+    npm_version: `${version}.0`,
+    sha: values.sha,
+    channel: values.channel,
+    prerelease: values.channel === "validation",
+    tag_reused: values["existing-tag-sha"] !== undefined,
+  })}\n`,
+);
+
+function nextVersion(latest, major) {
+  if (latest === undefined) return "1.0";
+  const match = /^v((?:0|[1-9]\d*))\.((?:0|[1-9]\d*))$/.exec(latest);
+  if (!match) throw new Error("--latest-tag must use canonical vN.N");
+  const [majorPart, minorPart] = [BigInt(match[1]), BigInt(match[2])];
+  return major ? `${majorPart + 1n}.0` : `${majorPart}.${minorPart + 1n}`;
+}
+function parseVersion(version, label) {
+  if (!/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(version))
+    throw new Error(`${label} must use canonical N.N integers`);
+}
+function numericMaximum(source) {
+  let tags;
+  try {
+    tags = JSON.parse(source);
+  } catch {
+    throw new Error("--tags-json must be a JSON array");
+  }
+  if (!Array.isArray(tags) || !tags.every((tag) => typeof tag === "string"))
+    throw new Error("--tags-json must be a JSON array of tag names");
+  const parsed = tags
+    .map((tag) => /^v((?:0|[1-9]\d*))\.((?:0|[1-9]\d*))(?:-[0-9A-Za-z.-]+)?$/.exec(tag))
+    .filter(Boolean);
+  if (parsed.length === 0) return undefined;
+  return `v${parsed
+    .map((match) => [BigInt(match[1]), BigInt(match[2])])
+    .sort((left, right) =>
+      left[0] === right[0]
+        ? Number(left[1] > right[1]) - Number(left[1] < right[1])
+        : Number(left[0] > right[0]) - Number(left[0] < right[0]),
+    )
+    .at(-1)
+    .join(".")}`;
+}

package/templates/.agents/skills/zaip-skill-github-deploy/scripts/resolve-release-identity.test.mjs

@@ -0,0 +1,51 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import test from "node:test";
+
+const script = resolve(import.meta.dirname, "resolve-release-identity.mjs");
+const sha = "a".repeat(40);
+function identity(...args) {
+  return JSON.parse(
+    execFileSync(process.execPath, [script, "--sha", sha, "--channel", "validation", ...args], {
+      encoding: "utf8",
+    }),
+  );
+}
+test("starts at v1.0 and maps npm to zero patch", () =>
+  assert.deepEqual(identity(), {
+    version: "1.0",
+    tag: "v1.0",
+    npm_version: "1.0.0",
+    sha,
+    channel: "validation",
+    prerelease: true,
+    tag_reused: false,
+  }));
+test("increments numeric maximum from verified tags, including prereleases", () => {
+  assert.equal(identity("--tags-json", '["v1.9", "v1.10-rc.1", "v1.2"]').tag, "v1.11");
+  assert.equal(identity("--latest-tag", "v1.9", "--major").tag, "v2.0");
+});
+test("allows retry only for the candidate SHA and rejects noncanonical versions", () => {
+  assert.deepEqual(identity("--version", "1.1", "--existing-tag-sha", sha), {
+    version: "1.1",
+    tag: "v1.1",
+    npm_version: "1.1.0",
+    sha,
+    channel: "validation",
+    prerelease: true,
+    tag_reused: true,
+  });
+  assert.throws(() => identity("--version", "01.1"), /canonical/);
+  assert.throws(
+    () => identity("--version", "1.1", "--existing-tag-sha", "b".repeat(40)),
+    /different SHA/,
+  );
+  assert.throws(
+    () =>
+      execFileSync(process.execPath, [script, "--sha", "a".repeat(64), "--channel", "validation"], {
+        encoding: "utf8",
+      }),
+    /exact 40/,
+  );
+});