rake_npm 0.3.0.pre.2.pr69.1.1 → 0.3.0.pre.2.pr69.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67461edba070915df6d111f6adac8a5106d1bbad6d9131edcef6c0eb8d4933d6
-  data.tar.gz: ec9633114176a48480fd4157d799ffcd7ed94e3834a8b9829a5bad9735886fa3
+  metadata.gz: 6b0b31ed83b24103dd072ddb101dcd02f1ddfab5675920b91a8aebb7f8c5e5e7
+  data.tar.gz: a543d821297c7f144a3c51ab720d5429023fb55f25fc524ff8bae55b0a051b8b
 SHA512:
-  metadata.gz: cdffbeb8c2b77888c5d2f7319a8d58d49d6bf583abcee202c077d452b99fc00fd6236237423ad2b2a533eb8024854fee3790c56ea8ba26b7cb068f06c78daaac
-  data.tar.gz: 28919bf6b1c4022607b744b521116ab9f6a273eb2a474d2714b11c8ffb250bbd220af269dbb9233820c62a544f140a8fcb1a097ba830677e85369b5879f30cfb
+  metadata.gz: a498d3a7afb5967735f56c792830361068e84811603fc1e3f83911bef69731503ee4ca15d0209bb0a5aec6a9912a86700a2251080d182674b4a33f60fbdd592b
+  data.tar.gz: 1e633190e3dc74cef8f0f37690606366d542d43e656f0b9c64adbda25fb134f43a529d333e70ba5ee63920fcf7cc92461eadd9fdf4a121f22b81da63c11f7c28

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rake_npm (0.3.0.pre.2.pr69.1.1)
+    rake_npm (0.3.0.pre.2.pr69.2.1)
       colored2 (~> 3.1)
       rake_dependencies (~> 3.9)
       rake_factory (~> 0.33)

data/Rakefile

@@ -120,43 +120,9 @@ RakeGithub.define_repository_tasks(
   namespace: :github,
   repository: 'infrablocks/rake_npm'
 ) do |t|
-  # Operator's ambient auth. Resolve once and fail fast: a missing,
-  # unauthenticated, or absent gh yields an empty string, which would
-  # otherwise surface later as an opaque Octokit 401. An empty or
-  # whitespace-only GITHUB_TOKEN is treated as absent so an authenticated
-  # operator falls through to `gh auth token` rather than hitting the raise.
-  github_token = ENV['GITHUB_TOKEN'].to_s.strip
-  if github_token.empty?
-    github_token = begin
-      `gh auth token`
-    rescue Errno::ENOENT
-      ''
-    end.strip
-  end
-  if github_token.empty?
-    raise 'No GitHub token available: set GITHUB_TOKEN or run `gh auth login`'
-  end
-
-  t.access_token = github_token
-
-  # Actions store only: dependabot runs never reach the passphrase — the
-  # only pr.yaml job that unlocks git-crypt (prerelease) is guarded to
-  # same-repo human PRs. Guard against a locked clone: without
-  # it, File.read returns git-crypt ciphertext and github:secrets:ensure
-  # silently uploads garbage that only surfaces much later as an opaque
-  # GPG unlock failure in the release job.
-  passphrase_path = 'config/secrets/ci/encryption.passphrase'
-  unless File.exist?(passphrase_path)
-    raise "Passphrase file not found: #{passphrase_path} — expected a " \
-          'git-crypt-unlocked clone with the CI secrets present'
-  end
-  passphrase = File.binread(passphrase_path)
-  if passphrase.start_with?("\x00GITCRYPT")
-    raise 'encryption.passphrase is git-crypt ciphertext — unlock the ' \
-          'clone before provisioning'
-  end
+  t.access_token = ambient_github_token
   t.secrets = [
-    { name: 'ENCRYPTION_PASSPHRASE', value: passphrase.chomp }
+    { name: 'ENCRYPTION_PASSPHRASE', value: ci_encryption_passphrase }
   ]
   t.environments = [
     { name: 'release',
@@ -207,6 +173,11 @@ namespace :version do
   end
 end
 
+desc 'Release gem'
+task :release do
+  sh 'gem release --tag --push'
+end
+
 namespace :prerelease do
   desc 'Build and push a namespaced pre-release to RubyGems ' \
        '(PR CI only; no bump, no tag, no commit, no push)'
@@ -239,9 +210,45 @@ namespace :prerelease do
   end
 end
 
-desc 'Release gem'
-task :release do
-  sh 'gem release --tag --push'
+# Operator's ambient auth. Resolve once and fail fast: a missing,
+# unauthenticated, or absent gh yields an empty string, which would
+# otherwise surface later as an opaque Octokit 401. An empty or
+# whitespace-only GITHUB_TOKEN is treated as absent so an authenticated
+# operator falls through to `gh auth token` rather than hitting the raise.
+def ambient_github_token
+  token = ENV['GITHUB_TOKEN'].to_s.strip
+  token = gh_auth_token if token.empty?
+  if token.empty?
+    raise 'No GitHub token available: set GITHUB_TOKEN or run `gh auth login`'
+  end
+
+  token
+end
+
+def gh_auth_token
+  `gh auth token`.strip
+rescue Errno::ENOENT
+  ''
+end
+
+# Actions store only: dependabot runs never reach the passphrase — the only
+# pr.yaml job that unlocks git-crypt (prerelease) is guarded to same-repo
+# human PRs. Guard against a locked clone: without it, File.read returns
+# git-crypt ciphertext and github:secrets:ensure silently uploads garbage
+# that only surfaces much later as an opaque GPG unlock failure in the
+# release job.
+def ci_encryption_passphrase
+  path = 'config/secrets/ci/encryption.passphrase'
+  unless File.exist?(path)
+    raise "Passphrase file not found: #{path} — unlock the clone first"
+  end
+
+  passphrase = File.binread(path)
+  if passphrase.start_with?("\x00GITCRYPT")
+    raise 'encryption.passphrase is git-crypt ciphertext — unlock first'
+  end
+
+  passphrase.chomp
 end
 
 def bump_version_for(version_type)

data/lib/rake_npm/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeNPM
-  VERSION = '0.3.0.pre.2.pr69.1.1'
+  VERSION = '0.3.0.pre.2.pr69.2.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rake_npm
 version: !ruby/object:Gem::Version
-  version: 0.3.0.pre.2.pr69.1.1
+  version: 0.3.0.pre.2.pr69.2.1
 platform: ruby
 authors:
 - InfraBlocks Maintainers