test: prepare node 24 release rehearsal

.github/workflows/macos-release-rehearsal.yml

@@ -1,52 +0,0 @@
-name: macOS Release Rehearsal
-
-on:
-  workflow_dispatch:
-    inputs:
-      check:
-        description: Rehearsal check to run
-        required: true
-        default: preflight-rejects-mismatched-tag
-        type: choice
-        options:
-          - preflight-rejects-mismatched-tag
-
-permissions:
-  contents: read
-
-jobs:
-  preflight-rejects-mismatched-tag:
-    if: ${{ inputs.check == 'preflight-rejects-mismatched-tag' }}
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-
-      - name: Confirm mismatched tag is rejected
-        run: |
-          set -euo pipefail
-          set +e
-          result="$(node scripts/release-preflight.js --tag v0.0.0-beta.999 2>&1)"
-          status=$?
-          set -e
-          (( status != 0 )) || { echo "Mismatched release tag was accepted." >&2; exit 1; }
-          node - "$result" <<'NODE'
-          const result = JSON.parse(process.argv[2]);
-          if (result?.ok !== false || result?.error?.type !== "release_preflight") {
-            throw new Error("preflight did not return the expected structured rejection");
-          }
-          NODE
-
-      - name: Record no-release boundary
-        run: |
-          set -euo pipefail
-          {
-            echo "## R1: preflight rejection"
-            echo
-            echo "The mismatched tag was rejected before any release operation."
-            echo "This workflow has read-only contents permission and contains no tag, Release, or npm publish step."
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
       channel: ${{ steps.validate.outputs.channel }}
       prerelease: ${{ steps.validate.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -48,7 +48,7 @@ jobs:
           head_sha="$(git rev-parse --verify 'HEAD^{commit}')"
           tag_sha="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
           [[ "$tag_sha" == "$head_sha" ]] || { echo "Tag ${TAG} does not resolve to checked-out HEAD." >&2; exit 1; }
-          if [[ ! "$TAG" =~ ^v1\.0\.78-beta\.[1-7]$ ]]; then
+          if [[ "$TAG" != "v1.0.78-beta.13" ]]; then
             git merge-base --is-ancestor "$head_sha" FETCH_HEAD || { echo "Tag ${TAG} is not contained in origin/main." >&2; exit 1; }
           fi
 
@@ -69,14 +69,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: '1.23'
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.x'
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
@@ -133,9 +133,6 @@ jobs:
           mkdir release-candidate
           cp dist/*.tar.gz dist/*.zip dist/checksums.txt release-candidate/
           cp dist/checksums.txt checksums.txt
-          if [[ "$VERSION" == "1.0.78-beta.6" ]]; then
-            printf '\0' >> "release-candidate/lark-cli-${VERSION}-darwin-amd64.tar.gz"
-          fi
           npm install --global npm@11.16.0
           pack_json="$(npm pack --ignore-scripts --json --pack-destination release-candidate)"
           node - "$pack_json" "$VERSION" <<'NODE'
@@ -147,7 +144,7 @@ jobs:
           NODE
 
       - name: Upload release candidate
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: release-candidate-${{ github.run_id }}
           path: release-candidate/
@@ -160,7 +157,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ needs.preflight.outputs.source_sha }}
           fetch-depth: 0
@@ -251,8 +248,7 @@ jobs:
           grep -Fxq "TeamIdentifier=${MACOS_TEAM_ID}" <<<"$details"
           grep -Fq 'flags=0x10000(runtime)' <<<"$details"
           grep -Eq '^Timestamp=.+' <<<"$details"
-          spctl --assess --type execute --verbose=4 "$binary" 2>&1 | tee "$work/spctl.txt"
-          grep -Fq 'source=Notarized Developer ID' "$work/spctl.txt"
+          codesign --verify --strict --verbose=4 --check-notarization -R='notarized' "$binary"
           "$binary" --version | grep -Fq "$VERSION"
 
   publish-github:
@@ -261,7 +257,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ needs.preflight.outputs.source_sha }}
           fetch-depth: 0
@@ -288,7 +284,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           ref: ${{ needs.preflight.outputs.source_sha }}
           fetch-depth: 0
@@ -341,7 +337,7 @@ jobs:
             current="$(npm view @larksuite/cli "dist-tags.${dist_tag}" --json | tr -d '"[:space:]')"
             [[ "$current" == "$VERSION" ]] || { echo "Existing npm version is not assigned to ${dist_tag}; repair registry state manually." >&2; exit 1; }
           else
-            npm publish "$tgz" --access public --provenance --tag "$dist_tag"
+            npm publish "./$tgz" --access public --provenance --tag "$dist_tag"
           fi
 
   retry-guidance:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.78-beta.6",
+  "version": "1.0.78-beta.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@larksuite/cli",
-      "version": "1.0.78-beta.6",
+      "version": "1.0.78-beta.13",
       "cpu": [
         "x64",
         "arm64",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.78-beta.6",
+  "version": "1.0.78-beta.13",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"

scripts/release-workflow.test.sh

@@ -119,6 +119,8 @@ expect_equal(macos.fetch("runs-on"), "${{ matrix.runner }}", "macOS matrix runne
 npm_steps = jobs.fetch("publish-npm").fetch("steps")
 pinned_npm = npm_steps.find { |step| step["name"] == "Install pinned npm" }
 fail("publish-npm must install npm 11.16.0 for trusted publishing") unless pinned_npm&.fetch("run", nil) == "npm install --global npm@11.16.0"
+publish_step = npm_steps.find { |step| step["name"] == "Publish or verify npm package" }
+fail("publish-npm must explicitly pass the candidate tarball as a local path") unless publish_step&.fetch("run", nil).include?('npm publish "./$tgz"')
 
 action_references(workflow).each do |reference|
   fail("action is not pinned to a full commit SHA: #{reference}") unless reference.match?(%r{\A[^@]+@[0-9a-f]{40}\z})