toolfactory 0.1.2 → 0.2.0

package/src/distribution/native.ts

@@ -0,0 +1,460 @@
+/**
+ * Native package registries are deliberately an escape hatch, not bindings.  A project may
+ * carry a real Cargo/.NET/JVM/Ruby/PHP/Go package beside a Toolfactory TypeScript or Python
+ * kernel, but Toolfactory never translates that kernel into another language or invents a
+ * launcher to enter a registry.
+ */
+import { z } from "zod";
+import type { Command, Project, Surface } from "../model.js";
+import type { GateStep, Registry } from "../project/gate.js";
+
+export const NATIVE_PACKAGE_IDS = [
+  "cargo",
+  "nuget",
+  "maven-central",
+  "rubygems",
+  "packagist",
+  "go-module",
+] as const;
+export type NativePackageId = (typeof NATIVE_PACKAGE_IDS)[number];
+
+/**
+ * `name` is intentionally not derived from the Toolfactory identity: package namespaces have
+ * their own ownership rules. A standard per-ecosystem version read is used unless the author
+ * needs a `versionCommand` escape hatch.
+ */
+export const nativePackageConfigSchema = z
+  .object({
+    id: z.enum(NATIVE_PACKAGE_IDS),
+    path: z
+      .string()
+      .min(1)
+      .refine(
+        (path) => !/^(?:[A-Za-z]:|[\\/])/.test(path) && !path.split(/[\\/]/).includes(".."),
+        "path must stay inside the repository.",
+      ),
+    identity: z
+      .string()
+      .min(1)
+      .refine(
+        (path) => !/^(?:[A-Za-z]:|[\\/])/.test(path) && !path.split(/[\\/]/).includes(".."),
+        "identity must be relative to path.",
+      ),
+    name: z
+      .string()
+      .min(1)
+      .describe("Registry package identity, including its required namespace."),
+    versionCommand: z
+      .string()
+      .min(1)
+      .optional()
+      .describe("Command run in path that prints exactly the authored native package version."),
+  })
+  .superRefine((entry, context) => {
+    if (entry.id === "maven-central" && entry.name.split(":").length !== 2)
+      context.addIssue({
+        code: "custom",
+        path: ["name"],
+        message: "Maven Central name must be groupId:artifactId.",
+      });
+    if ((entry.id === "packagist" || entry.id === "go-module") && entry.path !== ".")
+      context.addIssue({
+        code: "custom",
+        path: ["path"],
+        message: `${entry.id} is VCS/tag-discovered and currently requires package path ".".`,
+      });
+  })
+  .strict();
+export type NativePackageConfig = z.infer<typeof nativePackageConfigSchema>;
+
+function configs(project: Project): NativePackageConfig[] {
+  const raw = project.tool.nativePackages ?? [];
+  const parsed = raw.map((entry) => nativePackageConfigSchema.parse(entry));
+  const duplicates = parsed.filter(
+    (entry, index) => parsed.findIndex((other) => other.id === entry.id) !== index,
+  );
+  if (duplicates.length)
+    throw new Error(
+      `Native package configuration repeats: ${[...new Set(duplicates.map((entry) => entry.id))].join(", ")}.`,
+    );
+  return parsed;
+}
+function selected(project: Project, id: NativePackageId): boolean {
+  return project.tool.surfaces.includes(id);
+}
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function defaultVersionCommand(entry: NativePackageConfig): string {
+  const identity = shellQuote(entry.identity);
+  switch (entry.id) {
+    case "cargo":
+      return `cargo metadata --no-deps --format-version 1 --manifest-path ${identity} | node -e ${shellQuote(`let s='';process.stdin.on('data',d=>s+=d).on('end',()=>console.log(JSON.parse(s).packages.find(p=>p.name===${JSON.stringify(entry.name)}).version))`)}`;
+    case "nuget":
+      return `dotnet msbuild ${identity} -nologo -getProperty:Version`;
+    case "maven-central":
+      return `mvn --quiet --file ${identity} -DforceStdout help:evaluate -Dexpression=project.version`;
+    case "rubygems":
+      return `ruby -e 'puts Gem::Specification.load(ARGV[0]).version' ${identity}`;
+    case "packagist":
+    case "go-module":
+      throw new Error(
+        `${entry.id} is discovered from the release tag and has no pre-release version command.`,
+      );
+  }
+}
+function versionAssert(entry: NativePackageConfig, version: string | undefined): string {
+  if (!version)
+    throw new Error(
+      `Native package "${entry.name}" requires the shared identity to declare version.`,
+    );
+  return `test "$(${entry.versionCommand ?? defaultVersionCommand(entry)})" = ${shellQuote(version)}`;
+}
+function configFor(project: Project, id: NativePackageId): NativePackageConfig {
+  const matches = configs(project).filter((entry) => entry.id === id);
+  if (matches.length !== 1)
+    throw new Error(
+      `Surface "${id}" requires exactly one tool.nativePackages entry with id "${id}".`,
+    );
+  const entry = matches[0] as NativePackageConfig;
+  if ((id === "packagist" || id === "go-module") && !project.identity.repository)
+    throw new Error(
+      `Surface "${id}" requires identity.repository because it is discovered from the final Git tag.`,
+    );
+  return entry;
+}
+function activeConfigs(project: Project): NativePackageConfig[] {
+  return NATIVE_PACKAGE_IDS.filter((id) => selected(project, id)).map((id) =>
+    configFor(project, id),
+  );
+}
+function entryVersion(project: Project, entry: NativePackageConfig): string {
+  if (!project.identity.version)
+    throw new Error(
+      `Native package "${entry.name}" requires the shared identity to declare version.`,
+    );
+  return project.identity.version;
+}
+
+const commands: Record<NativePackageId, (entry: NativePackageConfig) => Command[]> = {
+  cargo: (entry) => [
+    {
+      label: "Cargo package",
+      command: "cargo",
+      args: ["package", "--manifest-path", entry.identity],
+      cwd: entry.path,
+    },
+  ],
+  nuget: (entry) => [
+    {
+      label: "NuGet pack",
+      command: "dotnet",
+      args: ["pack", entry.identity, "--configuration", "Release"],
+      cwd: entry.path,
+    },
+  ],
+  "maven-central": (entry) => [
+    {
+      label: "Maven verify",
+      command: "mvn",
+      args: ["--batch-mode", "--file", entry.identity, "verify"],
+      cwd: entry.path,
+    },
+  ],
+  rubygems: (entry) => [
+    {
+      label: "RubyGems build",
+      command: "gem",
+      args: ["build", "--strict", entry.identity],
+      cwd: entry.path,
+    },
+  ],
+  packagist: (entry) => [
+    {
+      label: "Composer validate",
+      command: "composer",
+      args: ["validate", "--strict", entry.identity],
+      cwd: entry.path,
+    },
+  ],
+  "go-module": (entry) => [
+    { label: "Go module tidy", command: "go", args: ["mod", "tidy", "-diff"], cwd: entry.path },
+    { label: "Go module tests", command: "go", args: ["test", "./..."], cwd: entry.path },
+  ],
+};
+
+/** External registries do not generate files: their package metadata remains author-owned. */
+export const nativePackageSurfaces: Surface[] = NATIVE_PACKAGE_IDS.map((id) => ({
+  id,
+  plan(project) {
+    configFor(project, id);
+    return [];
+  },
+  validate(project) {
+    const entry = configFor(project, id);
+    return commands[id](entry).map((command) => ({ ...command, cwd: entry.path }));
+  },
+}));
+
+/**
+ * Release packaging happens after the main package build. VCS registries deliberately have no
+ * artifact: their published object is the signed Git tag and repository contents.
+ */
+export function nativePackageSteps(project: Project): GateStep[] {
+  return activeConfigs(project).flatMap((entry) => {
+    // Packagist and Go proxy discovery happens from the tag created by the final release job.
+    // Before then, `git describe` can only see the prior version, so asserting it here is wrong.
+    if (entry.id === "packagist" || entry.id === "go-module") return [];
+    const directory = shellQuote(entry.path);
+    const out = `dist/release/native/${entry.id}`;
+    const check = versionAssert(entry, project.identity.version);
+    const steps: GateStep[] = [
+      { name: `${entry.id} version matches release`, run: `cd ${directory} && ${check}` },
+    ];
+    switch (entry.id) {
+      case "cargo":
+        steps.push({
+          name: "Cargo crate",
+          run: `mkdir -p ${shellQuote(out)} && cargo package --manifest-path ${shellQuote(`${entry.path}/${entry.identity}`)} --target-dir ${shellQuote(`dist/native-build/${entry.id}`)} && cp ${shellQuote(`dist/native-build/${entry.id}/package`)}/*.crate ${shellQuote(out)}/`,
+        });
+        break;
+      case "nuget":
+        steps.push({
+          name: "NuGet package",
+          run: `mkdir -p ${shellQuote(out)} && dotnet pack ${shellQuote(`${entry.path}/${entry.identity}`)} --configuration Release --output ${shellQuote(out)}`,
+        });
+        break;
+      case "maven-central":
+        steps.push({
+          name: "Maven package",
+          run: `mkdir -p ${shellQuote(out)} && mvn --batch-mode --file ${shellQuote(`${entry.path}/${entry.identity}`)} package && cp ${shellQuote(`${entry.path}/${entry.identity}`)} ${shellQuote(`${out}/${entry.name.split(":")[1]}-${project.identity.version}.pom`)} && find ${shellQuote(`${entry.path}/target`)} -maxdepth 1 -type f \\( -name '*.jar' -o -name '*.war' -o -name '*.pom' \\) -exec cp {} ${shellQuote(out)} \\;`,
+        });
+        break;
+      case "rubygems":
+        steps.push({
+          name: "Ruby gem",
+          run: `mkdir -p ${shellQuote(out)} && (cd ${directory} && gem build --strict ${shellQuote(entry.identity)}) && mv ${shellQuote(`${entry.path}/${entry.name}-${project.identity.version}.gem`)} ${shellQuote(out)}/`,
+        });
+        break;
+    }
+    return steps;
+  });
+}
+
+/**
+ * Kept with the release contract so local `gate` and the package job fail before a package
+ * command with a clear missing-tool message. GitHub's hosted Linux image supplies these upstream
+ * clients; callers that use another runner can install its normal distro packages first.
+ */
+export function nativeToolchainSteps(project: Project): GateStep[] {
+  const tools: Record<NativePackageId, string> = {
+    cargo: "cargo",
+    nuget: "dotnet",
+    "maven-central": "mvn",
+    rubygems: "gem",
+    packagist: "composer",
+    "go-module": "go",
+  };
+  return activeConfigs(project).map((entry) => ({
+    name: `${entry.id} upstream toolchain`,
+    run: `command -v ${tools[entry.id]} >/dev/null || { echo "${entry.id}: install its upstream ${tools[entry.id]} CLI before packaging" >&2; exit 1; }`,
+  }));
+}
+
+function row(project: Project, entry: NativePackageConfig): Registry {
+  const version = entryVersion(project, entry);
+  const [groupId = "", artifactId = ""] = entry.name.split(":");
+  const mavenSearch = `https://search.maven.org/solrsearch/select?q=${encodeURIComponent(`g:"${groupId}" AND a:"${artifactId}" AND v:"${version}"`)}&rows=1&wt=json`;
+  const shared: Pick<Registry, "id" | "surfaces" | "url"> = {
+    id: entry.id,
+    surfaces: [entry.id],
+    url: {
+      cargo: "https://crates.io/settings/tokens",
+      nuget: "https://www.nuget.org/account/apikeys",
+      "maven-central": "https://central.sonatype.com/account",
+      rubygems: "https://rubygems.org/profile/edit",
+      packagist: "https://packagist.org/about",
+      "go-module": "https://go.dev/doc/modules/publishing",
+    }[entry.id],
+  };
+  switch (entry.id) {
+    case "cargo":
+      return {
+        ...shared,
+        secrets: ["CARGO_REGISTRY_TOKEN"],
+        exists: `curl -fsS -o /dev/null ${shellQuote(`https://crates.io/api/v1/crates/${encodeURIComponent(entry.name)}/${encodeURIComponent(version)}`)}`,
+        gate: '[ -n "$CARGO_REGISTRY_TOKEN" ]',
+        retract: `cargo yank ${shellQuote(entry.name)} --vers ${shellQuote(version)} --token "$CARGO_REGISTRY_TOKEN"`,
+      };
+    case "nuget":
+      return {
+        ...shared,
+        secrets: ["NUGET_API_KEY"],
+        exists: `curl -fsS -o /dev/null ${shellQuote(`https://api.nuget.org/v3-flatcontainer/${entry.name.toLowerCase()}/${version.toLowerCase()}/${entry.name.toLowerCase()}.${version.toLowerCase()}.nupkg`)}`,
+        gate: '[ -n "$NUGET_API_KEY" ]',
+        retract: `dotnet nuget delete ${shellQuote(entry.name)} ${shellQuote(version)} --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --non-interactive`,
+      };
+    case "maven-central":
+      return {
+        ...shared,
+        secrets: [
+          "MAVEN_CENTRAL_USERNAME",
+          "MAVEN_CENTRAL_PASSWORD",
+          "MAVEN_GPG_PRIVATE_KEY",
+          "MAVEN_GPG_PASSPHRASE",
+        ],
+        exists: `curl -fsS ${shellQuote(mavenSearch)} | node -e ${shellQuote("let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.exit(JSON.parse(s).response.numFound>0?0:1))")}`,
+        gate: '[ -n "$MAVEN_CENTRAL_USERNAME" ] && [ -n "$MAVEN_CENTRAL_PASSWORD" ] && [ -n "$MAVEN_GPG_PRIVATE_KEY" ] && [ -n "$MAVEN_GPG_PASSPHRASE" ]',
+        retractUrl: "https://central.sonatype.com/publishing/deployments",
+      };
+    case "rubygems":
+      return {
+        ...shared,
+        secrets: ["RUBYGEMS_API_KEY"],
+        exists: `curl -fsS ${shellQuote(`https://rubygems.org/api/v1/versions/${encodeURIComponent(entry.name)}.json`)} | node -e ${shellQuote(`let s='';process.stdin.on('data',d=>s+=d).on('end',()=>process.exit(JSON.parse(s).some(v=>v.number===${JSON.stringify(version)})?0:1))`)}`,
+        gate: '[ -n "$RUBYGEMS_API_KEY" ]',
+        retract: `GEM_HOST_API_KEY="$RUBYGEMS_API_KEY" gem yank ${shellQuote(entry.name)} -v ${shellQuote(version)}`,
+      };
+    case "packagist":
+      return {
+        ...shared,
+        secrets: [],
+        gate: "true",
+        retractUrl: "https://packagist.org/packages",
+      };
+    case "go-module":
+      return {
+        ...shared,
+        secrets: [],
+        gate: "true",
+        retractUrl: "https://go.dev/ref/mod#go-mod-file-retract-directive",
+      };
+  }
+}
+
+export function nativeRegistryRows(project: Project): Registry[] {
+  return activeConfigs(project).map((entry) => row(project, entry));
+}
+
+type Job = Record<string, unknown>;
+const checkout = (releaseSha: string) => ({
+  uses: "actions/checkout@v7",
+  with: { ref: releaseSha },
+});
+const download = (artifactDir: string) => ({
+  uses: "actions/download-artifact@v8",
+  with: { name: "release-assets", path: artifactDir },
+});
+
+/** GitHub Actions jobs use the upstream language tool and package client directly. */
+export function nativePublishJobs(
+  project: Project,
+  artifactDir: string,
+  releaseSha: string,
+): Record<string, Job> {
+  return Object.fromEntries(
+    activeConfigs(project).flatMap((entry) => {
+      if (entry.id === "packagist" || entry.id === "go-module") return [];
+      const path = entry.path;
+      const base = {
+        needs: ["gate", "package"],
+        if: `needs.gate.outputs.${entry.id.replace(/-/g, "_")} == 'true'`,
+        "runs-on": "ubuntu-latest",
+        permissions: { contents: "read", "id-token": "write" },
+      };
+      let job: Job;
+      switch (entry.id) {
+        case "cargo":
+          job = {
+            ...base,
+            env: { CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}" },
+            steps: [
+              checkout(releaseSha),
+              { run: "cargo --version" },
+              {
+                run: `cd ${shellQuote(path)} && ${versionAssert(entry, project.identity.version)} && cargo publish --manifest-path ${shellQuote(entry.identity)} --token "$CARGO_REGISTRY_TOKEN"`,
+              },
+            ],
+          };
+          break;
+        case "nuget":
+          job = {
+            ...base,
+            env: { NUGET_API_KEY: "${{ secrets.NUGET_API_KEY }}" },
+            steps: [
+              { uses: "actions/setup-dotnet@v5", with: { "dotnet-version": "8.0.x" } },
+              { run: "dotnet --info" },
+              download(artifactDir),
+              {
+                run: `find ${shellQuote(`${artifactDir}/native/nuget`)} -maxdepth 1 -name '*.nupkg' -print0 | xargs -0 -r -n1 sh -c 'dotnet nuget push "$0" --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate'`,
+              },
+            ],
+          };
+          break;
+        case "maven-central":
+          job = {
+            ...base,
+            env: {
+              MAVEN_CENTRAL_USERNAME: "${{ secrets.MAVEN_CENTRAL_USERNAME }}",
+              MAVEN_CENTRAL_PASSWORD: "${{ secrets.MAVEN_CENTRAL_PASSWORD }}",
+              MAVEN_GPG_PRIVATE_KEY: "${{ secrets.MAVEN_GPG_PRIVATE_KEY }}",
+              MAVEN_GPG_PASSPHRASE: "${{ secrets.MAVEN_GPG_PASSPHRASE }}",
+            },
+            steps: [
+              checkout(releaseSha),
+              {
+                uses: "actions/setup-java@v5",
+                with: {
+                  distribution: "temurin",
+                  "java-version": "21",
+                  cache: "maven",
+                  "server-id": "central",
+                  "server-username": "MAVEN_CENTRAL_USERNAME",
+                  "server-password": "MAVEN_CENTRAL_PASSWORD",
+                },
+              },
+              { run: 'echo "$MAVEN_GPG_PRIVATE_KEY" | base64 --decode | gpg --batch --import' },
+              {
+                run: `cd ${shellQuote(path)} && ${versionAssert(entry, project.identity.version)} && mvn --batch-mode --file ${shellQuote(entry.identity)} -DskipTests -Dgpg.passphrase="$MAVEN_GPG_PASSPHRASE" deploy`,
+              },
+            ],
+          };
+          break;
+        case "rubygems":
+          job = {
+            ...base,
+            env: { GEM_HOST_API_KEY: "${{ secrets.RUBYGEMS_API_KEY }}" },
+            steps: [
+              { run: "gem --version" },
+              download(artifactDir),
+              {
+                run: `gem push ${shellQuote(`${artifactDir}/native/rubygems/${entry.name}-${project.identity.version}.gem`)}`,
+              },
+            ],
+          };
+          break;
+      }
+      const steps = job.steps as Array<Record<string, unknown>>;
+      steps.unshift({ uses: "actions/setup-node@v7", with: { "node-version": "24" } });
+      const publish = steps.at(-1);
+      const exists = row(project, entry).exists;
+      if (publish && exists)
+        publish.run = `if ${exists}; then echo "${entry.id}: version already published"; else ${publish.run}; fi`;
+      return [[`publish-${entry.id}`, job]];
+    }),
+  );
+}
+
+export function nativeInstallLines(project: Project): string[] {
+  return activeConfigs(project).map(
+    (entry) =>
+      ({
+        cargo: `\`cargo install ${entry.name}\``,
+        nuget: `\`dotnet add package ${entry.name}\``,
+        "maven-central": `add \`${entry.name}\` as a Maven dependency`,
+        rubygems: `\`gem install ${entry.name}\``,
+        packagist: `\`composer require ${entry.name}\``,
+        "go-module": `\`go get ${entry.name}@${project.identity.version ? `v${project.identity.version}` : "latest"}\``,
+      })[entry.id],
+  );
+}

package/src/distribution/system.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, it } from "vitest";
+import type { Project } from "../model.js";
+import {
+  systemPackageConfigSchema,
+  systemPackageJobs,
+  systemPackageSteps,
+  systemPublishJobs,
+  systemRegistryRows,
+} from "./system.js";
+
+function project(
+  entries: unknown[],
+  surfaces = entries.map((entry) => (entry as { id: string }).id),
+): Project {
+  return {
+    root: "/local/never-in-output",
+    tool: {
+      schemaVersion: 1,
+      identity: "package.json",
+      binding: "typescript",
+      surfaces: surfaces as unknown as Project["tool"]["surfaces"],
+      bundle: { runtime: "package" },
+      tests: { examples: {} },
+      systemPackages: entries,
+    } as unknown as Project["tool"],
+    identity: { name: "tool", version: "1.2.3" },
+    identityExtra: {},
+    operations: [],
+    toolfactoryVersion: "0.1.0",
+  };
+}
+const choco = {
+  id: "chocolatey",
+  path: "packaging/choco",
+  identity: "tool.nuspec",
+  name: "tool",
+  versionCommand: "node -p \"require('./tool.nuspec.version.json').version\"",
+};
+
+describe("system packages", () => {
+  it("requires real catalog/repository configuration", () => {
+    expect(() => systemPackageConfigSchema.parse({ ...choco, id: "apt" })).toThrow(/PPA/);
+    expect(() =>
+      systemPackageConfigSchema.parse({
+        id: "scoop",
+        path: "packaging/scoop",
+        identity: "tool.json",
+        name: "tool",
+        versionCommand: "Get-Content VERSION",
+        buildCommand: "./build.ps1",
+        asset: "../tool.zip",
+        bucket: "acme/scoop-bucket",
+        bucketName: "acme",
+        catalogPath: "bucket/tool.json",
+      }),
+    ).toThrow(/path must stay/);
+    expect(() => systemPackageSteps(project([], ["chocolatey"]))).toThrow(/exactly one/);
+  });
+  it("packages with checkout-relative paths", () => {
+    const steps = systemPackageSteps(project([choco]), { local: false });
+    expect(steps.at(-1)?.run).toContain("choco pack 'packaging/choco/tool.nuspec'");
+    expect(steps.at(-1)?.run).not.toContain("/local/never-in-output");
+  });
+  it("stages a non-root WinGet manifest directory and Debian source changes portably", () => {
+    const winget = {
+      id: "winget",
+      path: "packaging/winget",
+      identity: "manifests/a/acme/tool/1.2.3",
+      name: "Acme.Tool",
+      versionCommand: "cat VERSION",
+      buildCommand: "./build-installer.ps1",
+      asset: "dist/tool.msi",
+    };
+    const apt = {
+      id: "apt",
+      path: "packaging/debian/source",
+      identity: "debian/control",
+      name: "tool",
+      versionCommand: "dpkg-parsechangelog -S Version | cut -d- -f1",
+      ppa: "acme/tool",
+      buildDependencies: ["debhelper"],
+    };
+    const steps = systemPackageSteps(project([winget, apt]), { local: false });
+    expect(steps.find((step) => step.name === "WinGet catalog submission")?.run).toContain(
+      "test -d 'packaging/winget/manifests/a/acme/tool/1.2.3'",
+    );
+    const debian = steps.find((step) => step.name === "Debian source package")?.run;
+    expect(debian).toContain("find 'packaging/debian/source/..'");
+    expect(debian).toContain("'dist/release/system/apt'");
+    expect(debian).not.toContain("../dist/release");
+  });
+  it("gates direct jobs and commits author-controlled Homebrew metadata after release", () => {
+    const brew = {
+      id: "homebrew",
+      path: "packaging/brew",
+      identity: "tool.rb",
+      name: "tool",
+      versionCommand: "grep VERSION tool.rb",
+      buildCommand: "make release-archive",
+      asset: "dist/tool.tar.gz",
+      tap: "acme/homebrew-tap",
+      catalogPath: "Formula/tool.rb",
+    };
+    const jobs = systemPublishJobs(
+      project([choco, brew]),
+      "release-assets",
+      "${{ needs.gate.outputs.sha }}",
+    );
+    expect(jobs["publish-chocolatey"]?.if).toBe("needs.gate.outputs.chocolatey == 'true'");
+    expect(jobs["publish-homebrew"]?.needs).toEqual(["gate", "release"]);
+    expect(JSON.stringify(jobs["publish-homebrew"])).toContain("git -C .system-catalog push");
+    expect(JSON.stringify(jobs["publish-homebrew"])).toContain("system-homebrew");
+    expect(JSON.stringify(jobs["publish-homebrew"])).toContain("toolfactory-postrelease/tap");
+    expect(JSON.stringify(jobs["publish-chocolatey"])).toContain("system-chocolatey");
+    expect(JSON.stringify(jobs)).not.toContain("/local/never-in-output");
+    expect(systemRegistryRows(project([choco])).at(0)?.secrets).toEqual(["CHOCOLATEY_API_KEY"]);
+  });
+  it("uses dedicated native runners and upload names instead of the Ubuntu package job", () => {
+    const brew = {
+      id: "homebrew",
+      path: "packaging/brew",
+      identity: "tool.rb",
+      name: "tool",
+      versionCommand: "grep VERSION tool.rb",
+      buildCommand: "make release-archive",
+      asset: "dist/tool.tar.gz",
+      tap: "acme/homebrew-tap",
+      catalogPath: "Formula/tool.rb",
+    };
+    const jobs = systemPackageJobs(project([choco, brew]), "${{ github.sha }}");
+    expect(jobs["system-homebrew"]?.["runs-on"]).toBe("macos-latest");
+    expect(jobs["system-chocolatey"]?.["runs-on"]).toBe("windows-latest");
+    expect(JSON.stringify(jobs["system-chocolatey"])).toContain("system-chocolatey");
+    expect(JSON.stringify(jobs)).not.toContain("/local/never-in-output");
+  });
+});