feat(hololake): add gated signed release pipeline

product-source/hololake-native-desktop/scripts/release-pipeline.test.mjs

@@ -0,0 +1,72 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  validateCredentialEnvironment,
+  validateReleaseInput,
+  validateReleaseTrust,
+} from './release-pipeline.mjs'
+
+const readyTrust = () => ({
+  schema: 'hololake.release-trust/v1',
+  state: 'PROVISIONED',
+  endpoints: ['https://release.guanghu.test/latest.json'],
+  publicKey: 'A'.repeat(64),
+  allowedReleaseHosts: ['release.guanghu.test'],
+  automaticCheckOnStartup: false,
+  automaticDownload: false,
+  humanOptInInstallRequired: true,
+  automaticRestart: false,
+})
+
+const readyInput = () => ({
+  schema: 'hololake.release-pipeline-input/v1',
+  releaseId: 'GH-HOLOLAKE-RELEASE-0.2.0',
+  version: '0.2.0',
+  previousVersion: '0.1.0',
+  minimumVersion: '0.1.0',
+  releaseTag: 'v0.2.0',
+  sourceCommit: 'a'.repeat(40),
+  platformCode: 'darwin-aarch64',
+  packageUrl: 'https://release.guanghu.test/releases/0.2.0/HoloLake.app.tar.gz',
+  appleTeamIdentifier: '825A9L3G7Q',
+  notes: 'Signed release',
+  features: ['Persistent direct connection'],
+  fixes: [],
+  dataMigrationRequired: false,
+  restartMessage: 'Restart manually',
+})
+
+test('release pipeline refuses an unprovisioned or upstream-owned trust document', () => {
+  const unprovisioned = readyTrust()
+  unprovisioned.state = 'UNPROVISIONED_FAIL_CLOSED'
+  assert.throws(() => validateReleaseTrust(unprovisioned), /TRUST_UNPROVISIONED/)
+
+  const upstream = readyTrust()
+  upstream.endpoints = ['https://updates.vendor.test/latest.json']
+  assert.throws(() => validateReleaseTrust(upstream), /ENDPOINT_NOT_HOLOLAKE_HTTPS/)
+})
+
+test('release package must use the exact registered HoloLake HTTPS host and immutable tag', () => {
+  const trust = validateReleaseTrust(readyTrust())
+  const wrongHost = readyInput()
+  wrongHost.packageUrl = 'https://github.com/example/HoloLake.app.tar.gz'
+  assert.throws(() => validateReleaseInput(wrongHost, trust), /PACKAGE_HOST_NOT_TRUSTED/)
+
+  const wrongTag = readyInput()
+  wrongTag.releaseTag = 'latest'
+  assert.throws(() => validateReleaseInput(wrongTag, trust), /IMMUTABLE_TAG_INVALID/)
+  assert.equal(validateReleaseInput(readyInput(), trust).version, '0.2.0')
+})
+
+test('release pipeline requires updater signing, Developer ID and Apple notarization credentials together', () => {
+  assert.throws(() => validateCredentialEnvironment({}), /CREDENTIALS_MISSING/)
+  assert.doesNotThrow(() => validateCredentialEnvironment({
+    APPLE_SIGNING_IDENTITY: 'Developer ID Application: HoloLake (TEAM)',
+    TAURI_SIGNING_PRIVATE_KEY: 'runtime-secret-material',
+    TAURI_SIGNING_PRIVATE_KEY_PASSWORD: 'provided-at-runtime',
+    APPLE_ID: 'release@example.test',
+    APPLE_PASSWORD: 'provided-at-runtime',
+    APPLE_TEAM_ID: 'TEAM',
+  }))
+})