Publish curated ForgeFlow source from 63022ccf9a37242d573297c8ce7f15db61acc34e

tests/update-service.test.mjs

@@ -118,6 +118,33 @@ test("update repository parts reject path injection", async () => {
   await rm(temp, { recursive: true, force: true });
 });
 
+test("packaged updates pin the published release commit despite later source-only changes", async (t) => {
+  const temp = await mkdtemp(path.join(os.tmpdir(), "forgeflow-release-check-"));
+  t.after(() => rm(temp, { recursive: true, force: true }));
+  const releaseCommit = "b".repeat(40);
+  const service = new UpdateService({
+    store: { data: { updates: {} }, save: async () => {} },
+    gitea: {
+      async getLatestRelease(owner, repo) {
+        assert.equal(repo, "ForgeFlow-Public");
+        return { tag_name: "v0.10.16", target_commitish: releaseCommit, draft: false, prerelease: false };
+      },
+      async getBranch() { throw new Error("Packaged updates must not follow mutable main."); },
+      async getRepositoryFile(input) {
+        assert.equal(input.ref, releaseCommit);
+        return { decoded: JSON.stringify({ name: "forgeflow", version: "0.10.16" }) };
+      },
+    },
+    appInfo: { version: "0.10.14", packaged: true },
+    sourcePath: temp,
+    userDataPath: temp,
+  });
+  const result = await service.check();
+  assert.equal(result.available, true);
+  assert.equal(result.remoteSha, releaseCommit);
+  assert.equal(result.releaseTag, "v0.10.16");
+});
+
 test("source updater refuses an unsigned archive before launching a helper", async () => {
   const temp = await mkdtemp(
     path.join(os.tmpdir(), "forgeflow-update-handshake-"),
@@ -734,11 +761,13 @@ test("Windows release pipeline emits signed provenance, manifest and SBOM eviden
   assert.doesNotMatch(releaseWorkflow, /checkout@v\d|setup-node@v\d/);
   assert.match(releaseWorkflow, /checkout@[a-f0-9]{40}/);
   assert.match(releaseWorkflow, /setup-node@[a-f0-9]{40}/);
-  assert.ok(
-    releaseWorkflow.indexOf("Validate version bump and build release artifacts") <
-      releaseWorkflow.indexOf("FORGEFLOW_RELEASE_SIGNING_KEY_PEM"),
-    "signing secrets must not be present during dependency installation and quality checks",
-  );
+  const buildStart = releaseWorkflow.indexOf("- name: Build and validate release artifacts");
+  const signingStart = releaseWorkflow.indexOf("- name: Sign and publish validated artifacts");
+  assert.ok(buildStart >= 0 && signingStart > buildStart);
+  assert.doesNotMatch(releaseWorkflow.slice(buildStart, signingStart), /FORGEFLOW_RELEASE_SIGNING_KEY_PEM/);
+  assert.match(releaseWorkflow, /push:\s*\n\s*branches: \[main\]/);
+  assert.match(releaseWorkflow, /should_release=false/);
+  assert.match(releaseWorkflow, /should_release=true/);
   assert.match(releaseWorkflow, /finally \{/);
   assert.match(releaseWorkflow, /Remove-Item -LiteralPath \$privateKeyPath -Force/);
   const publisher = await readFile(new URL("../scripts/publish-binary-release.cjs", import.meta.url), "utf8");