shipit-engine 0.20.1 → 0.21.0

data/test/fixtures/shipit/pull_requests.yml

@@ -87,3 +87,55 @@ shipit_pending_merged:
   mergeable: null
   additions: 23
   deletions: 43
+
+shipit_mergeable_pending_ci:
+  stack: shipit
+  number: 67
+  title: Super duper nice feature
+  merge_status: pending
+  merge_requested_at: <%= 5.minute.ago.to_s(:db) %>
+  revalidated_at: <%= 5.minute.ago.to_s(:db) %>
+  merge_requested_by: walrus
+  github_id: 424244242424241
+  api_url: https://api.github.com/repos/shopify/shipit-engine/pulls/67
+  state: open
+  branch: feature-67
+  head_id: 4
+  mergeable: true
+  additions: 23
+  deletions: 43
+
+shipit_pending_expired:
+  stack: shipit
+  number: 68
+  title: Noice !
+  merge_status: pending
+  merge_requested_at: <%= 50.minute.ago.to_s(:db) %>
+  revalidated_at: <%= 25.minute.ago.to_s(:db) %>
+  merge_requested_by: walrus
+  github_id: 48484848484848
+  api_url: https://api.github.com/repos/shopify/shipit-engine/pulls/68
+  state: open
+  branch: feature-68
+  head_id: 8
+  mergeable: true
+  additions: 23
+  deletions: 43
+
+cyclimse_pending_merged:
+  id: 99
+  stack: cyclimse
+  number: 66
+  merge_status: merged
+  merge_requested_by: walrus
+  merge_requested_at: <%= 3.minute.ago.to_s(:db) %>
+  merged_at: <%= 2.minute.ago.to_s(:db) %>
+  revalidated_at: <%= 3.minute.ago.to_s(:db) %>
+  github_id: 43243243243232
+  api_url: https://api.github.com/repos/shopify/cyclimse/pulls/66
+  state: closed
+  branch: feature-64
+  head_id: 8
+  mergeable: null
+  additions: 23
+  deletions: 43

data/test/fixtures/shipit/stacks.yml

@@ -123,3 +123,38 @@ undeployed_stack:
       }
     }
   updated_at: <%= 8.days.ago.to_s(:db) %>
+
+soc:
+  repo_owner: "shopify"
+  repo_name: "soc"
+  environment: "production"
+  branch: master
+  tasks_count: 0
+  undeployed_commits_count: 2
+  cached_deploy_spec: >
+    {
+      "machine": {"environment": {}},
+      "review": {
+        "checklist": ["foo", "bar", "baz"],
+        "monitoring": [
+          {"image": "https://example.com/monitor.png", "width": 200, "height": 300}
+        ]
+      },
+      "dependencies": {"override": []},
+      "deploy": {"override": null},
+      "rollback": {"override": ["echo 'Rollback!'"]},
+      "fetch": ["echo '42'"],
+      "tasks": {
+        "restart": {
+          "action": "Restart application",
+          "description": "Restart app and job servers",
+          "steps": [
+            "cap $ENVIRONMENT deploy:restart"
+          ]
+        }
+      },
+      "ci": {
+        "blocking": ["soc/compliance"]
+      }
+    }
+  updated_at: <%= 8.days.ago.to_s(:db) %>

data/test/fixtures/shipit/statuses.yml

@@ -98,3 +98,30 @@ shipit_pending_pr_success_travis:
   created_at: <%= 9.days.ago.to_s(:db) %>
   state: success
   target_url: "http://www.example.com"
+
+soc_first:
+  stack: soc
+  commit_id: 101 # soc_first
+  description: Woops
+  context: soc/compliance
+  created_at: <%= 9.days.ago.to_s(:db) %>
+  state: failure
+  target_url: "http://www.example.com"
+
+soc_second:
+  stack: soc
+  commit_id: 102 # soc_second
+  description: All good
+  context: soc/compliance
+  created_at: <%= 7.days.ago.to_s(:db) %>
+  state: success
+  target_url: "http://www.example.com"
+
+soc_third:
+  stack: soc
+  commit_id: 103 # soc_third
+  description: All good
+  context: soc/compliance
+  created_at: <%= 7.days.ago.to_s(:db) %>
+  state: success
+  target_url: "http://www.example.com"

data/test/fixtures/shipit/tasks.yml

@@ -120,3 +120,17 @@ shipit_rollback:
   created_at: <%= (60 - 8).minutes.ago.to_s(:db) %>
   started_at: <%= (60 - 8).minutes.ago.to_s(:db) %>
   ended_at: <%= (60 - 7).minutes.ago.to_s(:db) %>
+
+soc_deploy:
+  id: 9
+  user: walrus
+  since_commit_id: 101 # soc_first
+  until_commit_id: 101 # soc_first
+  type: Shipit::Deploy
+  stack: soc
+  status: success
+  additions: 1
+  deletions: 1
+  created_at: <%= (60 - 1).minutes.ago.to_s(:db) %>
+  started_at: <%= (60 - 1).minutes.ago.to_s(:db) %>
+  ended_at: <%= (60 - 3).minutes.ago.to_s(:db) %>

data/test/helpers/queries_helper.rb

@@ -50,7 +50,7 @@ module QueriesHelper
 
       # FIXME: this seems bad. we should probably have a better way to indicate
       # the query was cached
-      return if 'CACHE' == values[:name] || ignore.any? { |x| x =~ sql }
+      return if values[:name] == 'CACHE' || ignore.any? { |x| x =~ sql }
       log << sql
     end
   end

data/test/jobs/merge_pull_requests_job_test.rb

@@ -11,6 +11,8 @@ module Shipit
       @not_ready_pr = shipit_pull_requests(:shipit_pending_not_mergeable_yet)
       @closed_pr = shipit_pull_requests(:shipit_pending_closed)
       @merged_pr = shipit_pull_requests(:shipit_pending_merged)
+      @expired_pr = shipit_pull_requests(:shipit_pending_expired)
+      @mergable_pending_ci = shipit_pull_requests(:shipit_mergeable_pending_ci)
     end
 
     test "#perform rejects unmergeable PRs and merge the others" do
@@ -50,6 +52,13 @@ module Shipit
       assert_predicate @pending_pr.reload, :pending?
     end
 
+    test "#perform revalidate PRs but do not attempt to merge any if the stack doesn't allow merges" do
+      PullRequest.any_instance.stubs(:refresh!)
+      @stack.update!(lock_reason: 'Maintenance')
+      @job.perform(@stack)
+      assert_predicate @expired_pr.reload, :revalidating?
+    end
+
     test "#perform schedules a new job if the first PR in the queue is not mergeable yet" do
       PullRequest.any_instance.stubs(:refresh!)
 
@@ -67,11 +76,19 @@ module Shipit
       assert_predicate @closed_pr.reload, :canceled?
     end
 
-    test "#perform completes merge requests for already merged PRs" do
+    test "#perform cancels merge requests for manually merged PRs" do
+      @pending_pr.cancel!
+      PullRequest.any_instance.stubs(:refresh!)
+      @job.perform(@stack)
+      assert_predicate @merged_pr.reload, :canceled?
+    end
+
+    test "#perform does not reject pull requests with pending statuses" do
       @pending_pr.cancel!
       PullRequest.any_instance.stubs(:refresh!)
       @job.perform(@stack)
-      assert_predicate @merged_pr.reload, :merged?
+      refute_predicate @mergable_pending_ci.reload, :rejected?
+      refute_predicate @mergable_pending_ci.reload, :merged?
     end
   end
 end

data/test/jobs/perform_task_job_test.rb

@@ -67,15 +67,39 @@ module Shipit
       @job.perform(@deploy)
     end
 
-    test "mark deploy as error if a command timeout" do
-      Command.any_instance.expects(:stream!).at_least_once.raises(Command::TimedOut)
+    test "mark deploy as error an unexpected exception is raised" do
+      Command.any_instance.expects(:stream!).at_least_once.raises(Command::Denied)
 
       @job.perform(@deploy)
 
       assert_equal 'failed', @deploy.reload.status
+      assert_includes @deploy.chunk_output, 'Denied'
+    end
+
+    test "mark deploy as timedout if a command timeout" do
+      Command.any_instance.expects(:stream!).at_least_once.raises(Command::TimedOut)
+
+      @job.perform(@deploy)
+
+      assert_equal 'timedout', @deploy.reload.status
       assert_includes @deploy.chunk_output, 'TimedOut'
     end
 
+    test "mark deploy as timedout if a command exit in one of the codes in Shipit.timeout_exit_codes" do
+      previous_exit_codes = Shipit.timeout_exit_codes
+      begin
+        Shipit.timeout_exit_codes = [70].freeze
+
+        Command.any_instance.expects(:stream!).at_least_once.raises(Command::Failed.new('Blah', 70))
+
+        @job.perform(@deploy)
+
+        assert_equal 'timedout', @deploy.reload.status
+      ensure
+        Shipit.timeout_exit_codes = previous_exit_codes
+      end
+    end
+
     test "records stack support for rollbacks and fetching deployed revision" do
       @job.stubs(:capture!)
       @commands = stub(:commands)

data/test/models/commits_test.rb

@@ -148,8 +148,8 @@ module Shipit
         author: walrus,
         committer: walrus,
         sha: "ab12",
-        authored_at: DateTime.now,
-        committed_at: DateTime.now,
+        authored_at: Time.now,
+        committed_at: Time.now,
         message: "more fish!",
       )
     end
@@ -176,8 +176,8 @@ module Shipit
         author: walrus,
         committer: walrus,
         sha: "ab12",
-        authored_at: DateTime.now,
-        committed_at: DateTime.now,
+        authored_at: Time.now,
+        committed_at: Time.now,
         message: "more fish!",
       )
       @stack.reload
@@ -217,8 +217,8 @@ module Shipit
         author: walrus,
         committer: walrus,
         sha: "ab12",
-        authored_at: DateTime.now,
-        committed_at: DateTime.now,
+        authored_at: Time.now,
+        committed_at: Time.now,
         message: "more fish!",
       )
       stack.reload
@@ -306,6 +306,37 @@ module Shipit
       refute_predicate commit, :deployable?
     end
 
+    test "#deployable? is false if a blocking status is missing on a previous undeployed commit" do
+      blocking_commit = shipit_commits(:soc_second)
+      blocking_commit.statuses.delete_all
+
+      assert_predicate blocking_commit, :pending?
+      assert_predicate blocking_commit, :blocking?
+
+      commit = shipit_commits(:soc_third)
+      refute_predicate commit, :deployable?
+    end
+
+    test "#deployable? is false if a blocking status is failing on a previous undeployed commit" do
+      blocking_commit = shipit_commits(:soc_second)
+      blocking_commit.statuses.update_all(state: 'failure')
+
+      assert_predicate blocking_commit, :failure?
+      assert_predicate blocking_commit, :blocking?
+
+      commit = shipit_commits(:soc_third)
+      refute_predicate commit, :deployable?
+    end
+
+    test "#deployable? is true if no blocking status is failing or missing on a previous undeployed commit" do
+      blocking_commit = shipit_commits(:soc_second)
+      assert_predicate blocking_commit, :success?
+      refute_predicate blocking_commit, :blocking?
+
+      commit = shipit_commits(:soc_third)
+      assert_predicate commit, :deployable?
+    end
+
     expected_webhook_transitions = { # we expect deployable_status to fire on these transitions, and not on any others
       'unknown' => %w(pending success failure error),
       'pending' => %w(success failure error),
@@ -551,6 +582,24 @@ module Shipit
       assert revert.revert_of?(commit)
     end
 
+    test "deploy_requested_at defaults to commit created_at" do
+      assert_equal @commit.deploy_requested_at, @commit.created_at
+    end
+
+    test "when merged via the queue, deploy_requested_at is merge_requested_at" do
+      commit = shipit_commits(:cyclimse_merged)
+      assert_predicate commit, :pull_request?
+      assert_equal commit.pull_request, shipit_pull_requests(:cyclimse_pending_merged)
+      assert_equal commit.deploy_requested_at, commit.pull_request.merge_requested_at
+    end
+
+    test "when merged manually after being queued, deploy_requested_at is created_at" do
+      pr = shipit_pull_requests(:cyclimse_pending_merged)
+      pr.cancel!
+      commit = shipit_commits(:cyclimse_merged)
+      assert_equal commit.deploy_requested_at, commit.created_at
+    end
+
     private
 
     def expect_event(stack)

data/test/models/deploy_spec_test.rb

@@ -284,11 +284,16 @@ module Shipit
           'require' => [],
           'ignore' => [],
           'revalidate_after' => nil,
+          'max_divergence' => {
+            'commits' => nil,
+            'age' => nil,
+          },
         },
         'ci' => {
           'hide' => [],
           'allow_failures' => [],
           'require' => [],
+          'blocking' => [],
         },
         'machine' => {'environment' => {}, 'directory' => nil, 'cleanup' => true},
         'review' => {'checklist' => [], 'monitoring' => [], 'checks' => []},
@@ -318,59 +323,19 @@ module Shipit
       assert_equal 'SAFETY_DISABLED', variable_definition.name
     end
 
-    test "task definitions prepend bundle exec by default" do
-      @spec.expects(:load_config).returns('tasks' => {'restart' => {'steps' => %w(foo)}})
-      @spec.expects(:bundler?).returns(true).at_least_once
-      assert_deprecated(/Automatically prepending `bundle exec`/) do
-        definition = @spec.find_task_definition('restart')
-        assert_equal ['bundle exec foo'], definition.steps
-      end
-    end
-
-    test "task definitions prepend bundle exec if enabled" do
-      Shipit.expects(:automatically_prepend_bundle_exec).returns(true).at_least_once
+    test "task definitions don't prepend bundle exec by default" do
       @spec.expects(:load_config).returns('tasks' => {'restart' => {'steps' => %w(foo)}})
-      @spec.expects(:bundler?).returns(true).at_least_once
       definition = @spec.find_task_definition('restart')
-
-      assert_equal ['bundle exec foo'], definition.steps
-    end
-
-    test "task definitions do not prepend bundle exec if disabled" do
-      Shipit.expects(:automatically_prepend_bundle_exec).returns(false).at_least_once
-      @spec.expects(:load_config).returns('tasks' => {'restart' => {'steps' => %w(foo)}})
-      definition = @spec.find_task_definition('restart')
-
       assert_equal ['foo'], definition.steps
     end
 
-    test "task definitions do not prepend bundle exec if the task already does" do
-      Shipit.expects(:automatically_prepend_bundle_exec).returns(true).at_least_once
-      @spec.expects(:load_config).returns('tasks' => {'restart' => {'steps' => ['bundle exec foo']}})
-      @spec.stubs(:bundler?).returns(true)
-      definition = @spec.find_task_definition('restart')
-
-      assert_equal ['bundle exec foo'], definition.steps
-    end
-
-    test "task definitions do not prepend bundle exec if depedency step is overridden" do
-      @spec.expects(:load_config).returns(
-        'dependencies' => {'override' => []},
-        'tasks' => {'restart' => {'steps' => %w(foo)}},
-      )
-      @spec.expects(:bundler?).returns(true).at_least_once
-      definition = @spec.find_task_definition('restart')
-
-      assert_equal ['foo'], definition.steps
-    end
-
-    test "task definitions prepend bundle exec before serialization" do
+    test "task definitions don't bundle exec before serialization" do
       @spec.expects(:discover_task_definitions).returns('restart' => {'steps' => %w(foo)})
       @spec.expects(:bundler?).returns(true).at_least_once
 
       cached_spec = DeploySpec.load(DeploySpec.dump(@spec))
       definition = cached_spec.find_task_definition('restart')
-      assert_equal ['bundle exec foo'], definition.steps
+      assert_equal ['foo'], definition.steps
     end
 
     test "#task_definitions returns kubernetes commands as well as comands from the config" do
@@ -455,6 +420,16 @@ module Shipit
       assert_equal %w(ci/circleci ci/jenkins), @spec.hidden_statuses
     end
 
+    test "#required_statuses automatically includes #blocking_statuses" do
+      @spec.expects(:load_config).returns(
+        'ci' => {
+          'require' => %w(ci/circleci),
+          'blocking' => %w(soc/compliance),
+        },
+      )
+      assert_equal %w(ci/circleci soc/compliance), @spec.required_statuses
+    end
+
     test "pull_request_ignored_statuses defaults to the union of ci.hide and ci.allow_failures" do
       @spec.expects(:load_config).returns(
         'ci' => {
@@ -573,26 +548,43 @@ module Shipit
       assert_equal ['fake gem task'], @spec.deploy_steps
     end
 
+    test 'lerna monorepos take priority over solo npm deploys' do
+      @spec.expects(:discover_npm_package).never
+      @spec.stubs(:discover_lerna_packages).returns(['fake monorepo task']).once
+
+      assert_equal ['fake monorepo task'], @spec.deploy_steps
+    end
+
+    test '#lerna? is false if there is no lerna.json' do
+      @spec.expects(:lerna_json).returns(Shipit::Engine.root.join("tmp-#{SecureRandom.hex}"))
+      refute @spec.lerna?
+    end
+
     test '#npm? is false if there is no package.json' do
       @spec.expects(:package_json).returns(Shipit::Engine.root.join("tmp-#{SecureRandom.hex}"))
       refute @spec.npm?
     end
 
-    test '#npm? is false if npm package is private' do
+    test '#npm? is true if npm package is public' do
       file = Pathname.new('/tmp/fake_package.json')
-      file.write('{"private": true}')
+      file.write('{"private": false}')
 
       @spec.expects(:package_json).returns(file)
-      refute @spec.npm?
+
+      assert @spec.npm?
     end
 
-    test '#npm? is true if npm package is public' do
+    test '#npm? is false if npm package is private' do
       file = Pathname.new('/tmp/fake_package.json')
-      file.write('{"private": false}')
+      file.write('{"private": true}')
 
       @spec.expects(:package_json).returns(file)
+      refute @spec.npm?
+    end
 
-      assert @spec.npm?
+    test 'lerna monorepos have a checklist' do
+      @spec.stubs(:lerna?).returns(true).at_least_once
+      assert_match(/lerna publish --skip-npm/, @spec.review_checklist[0])
     end
 
     test 'npm packages have a checklist' do
@@ -600,14 +592,223 @@ module Shipit
       assert_match(/npm version/, @spec.review_checklist[0])
     end
 
+    test '#lerna_version returns the monorepo root version number' do
+      file = Pathname.new('/tmp/fake_lerna.json')
+      file.write('{"version": "1.0.0-beta.1"}')
+
+      @spec.expects(:lerna_json).returns(file)
+      assert_equal '1.0.0-beta.1', @spec.lerna_version
+    end
+
+    test '#package_version returns the version number' do
+      file = Pathname.new('/tmp/fake_package.json')
+      file.write('{"version": "1.0.0-beta.1"}')
+
+      @spec.expects(:package_json).returns(file)
+      assert_equal '1.0.0-beta.1', @spec.package_version
+    end
+
+    test '#dist_tag returns "latest" if the version does not contains a standard pre-release tag' do
+      assert_equal 'latest', @spec.dist_tag('1.0.0')
+      assert_equal 'latest', @spec.dist_tag('1.0.0-shopifyv4')
+    end
+
+    test '#dist_tag returns "next" if the version contains a pre-release tag' do
+      assert_equal 'next', @spec.dist_tag('1.0.0-alpha.1')
+      assert_equal 'next', @spec.dist_tag('1.0.0-beta')
+      assert_equal 'next', @spec.dist_tag('1.0.0-rc.3')
+      assert_equal 'next', @spec.dist_tag('1.0.0-next')
+    end
+
+    test '#dependencies_steps returns lerna setup if a `lerna.json` is present' do
+      @spec.expects(:lerna?).returns(true).at_least_once
+      assert_equal ['npm install --no-progress', 'node_modules/.bin/lerna bootstrap'], @spec.dependencies_steps
+    end
+
     test '#dependencies_steps returns `npm install` if a `package.json` is present' do
       @spec.expects(:npm?).returns(true).at_least_once
       assert_equal ['npm install --no-progress'], @spec.dependencies_steps
     end
 
+    test '#publish_lerna_packages checks if independent version tags exist, and then invokes lerna deploy script' do
+      @spec.stubs(:lerna?).returns(true)
+      @spec.stubs(:lerna_version).returns('independent')
+      assert_equal 'assert-lerna-independent-version-tags', @spec.deploy_steps[0]
+      assert_equal 'publish-lerna-independent-packages', @spec.deploy_steps[1]
+    end
+
+    test '#publish_lerna_packages checks if fixed version tag exists, and then invokes lerna deploy script' do
+      @spec.stubs(:lerna?).returns(true)
+      @spec.stubs(:lerna_version).returns('1.0.0')
+      assert_equal 'assert-lerna-fixed-version-tag', @spec.deploy_steps[0]
+      assert_equal 'node_modules/.bin/lerna publish --yes --skip-git --repo-version 1.0.0 --force-publish=* --npm-tag latest', @spec.deploy_steps[1]
+    end
+
+    test '#enforce_publish_config? is false when Shipit.enforce_publish_config is nil' do
+      Shipit.stubs(:enforce_publish_config).returns(nil)
+      refute @spec.enforce_publish_config?
+    end
+
+    test '#enforce_publish_config? is false when Shipit.enforce_publish_config is 0' do
+      Shipit.stubs(:enforce_publish_config).returns('0')
+      refute @spec.enforce_publish_config?
+    end
+
+    test '#enforce_publish_config? is true when Shipit.enforce_publish_config is 1' do
+      Shipit.stubs(:enforce_publish_config).returns('1')
+      assert @spec.enforce_publish_config?
+    end
+
+    test '#valid_publish_config? is false when enforce_publish_config? is true and publishConfig is missing from package.json' do
+      Shipit.stubs(:private_npm_registry).returns('some_private_registry')
+      @spec.stubs(:enforce_publish_config?).returns(true)
+      @spec.stubs(:publish_config_access).returns('restricted')
+
+      package_json = Pathname.new('/tmp/fake_package.json')
+      package_json.write('{"name": "foo"}')
+
+      @spec.expects(:package_json).returns(package_json)
+      refute @spec.valid_publish_config?
+    end
+
+    test '#valid_publish_config? is true when enforce_publish_config? is true and publishConfig.access is public' do
+      Shipit.stubs(:private_npm_registry).returns('some_private_registry')
+      @spec.stubs(:enforce_publish_config?).returns(true)
+      @spec.stubs(:publish_config_access).returns('public')
+      @spec.stubs(:publish_config).returns('something')
+
+      assert @spec.valid_publish_config?
+    end
+
+    test '#valid_publish_config? is true when shipit does not enforce a publishConfig' do
+      @spec.stubs(:lerna_version).returns('1.0.0')
+      assert @spec.valid_publish_config?
+    end
+
+    test '#publish_config returns publishConfig from package.json' do
+      package_json = Pathname.new('/tmp/fake_package.json')
+      package_json.write('{"publishConfig": "foo"}')
+
+      @spec.expects(:package_json).returns(package_json)
+      assert_equal "foo", @spec.publish_config
+    end
+
+    test '#valid_publish_config_access? is false when publishConfig.access is invalid' do
+      @spec.stubs(:publish_config_access).returns('foo')
+      refute @spec.valid_publish_config_access?
+    end
+
+    test '#valid_publish_config_access? is true when publishConfig.access is public or restricted' do
+      @spec.stubs(:publish_config_access).returns('public')
+      assert @spec.valid_publish_config_access?
+
+      @spec.stubs(:publish_config_access).returns('restricted')
+      assert @spec.valid_publish_config_access?
+    end
+
+    test '#publish_config_access is restricted when enforce_publish_config? is true and publishConfig is missing' do
+      package_json = Pathname.new('/tmp/fake_package.json')
+      package_json.write('{"name": "@shopify/foo"}')
+
+      @spec.stubs(:enforce_publish_config?).returns(true)
+      @spec.expects(:package_json).returns(package_json)
+      assert_equal 'restricted', @spec.publish_config_access
+    end
+
+    test '#publish_config_access is public when enforce_publish_config? is false and publishConfig is missing' do
+      package_json = Pathname.new('/tmp/fake_package.json')
+      package_json.write('{"name": "@shopify/foo"}')
+
+      @spec.stubs(:enforce_publish_config?).returns(false)
+      @spec.expects(:package_json).returns(package_json)
+      assert_equal 'public', @spec.publish_config_access
+    end
+
+    test '#publish_config_access returns publishConfig.access from package.json when enforce_publish_config? is true' do
+      package_json = Pathname.new('/tmp/fake_package.json')
+      package_json.write('{
+        "name": "@shopify/foo",
+        "publishConfig": {
+          "access": "foo"
+        }
+      }')
+
+      @spec.stubs(:enforce_publish_config?).returns(false)
+      @spec.expects(:package_json).returns(package_json)
+      assert_equal 'foo', @spec.publish_config_access
+    end
+
+    test "#scoped_package? is false when Shipit.npm_org_scope is not set and the package is private" do
+      Shipit.stubs(:npm_org_scope).returns(nil)
+      @spec.stubs(:publish_config_access).returns('restricted')
+      refute @spec.scoped_package?
+    end
+
+    test "#scoped_package? is true when Shipit.npm_org_scope is set and package_name starts with scope and the package is private" do
+      Shipit.stubs(:npm_org_scope).returns('@shopify')
+      @spec.stubs(:publish_config_access).returns('restricted')
+      @spec.stubs(:package_name).returns('@shopify/polaris')
+      assert @spec.scoped_package?
+    end
+
+    test "#private_scoped_package? is false when private packages are not scoped" do
+      @spec.stubs(:scoped_package?).returns(false)
+      @spec.stubs(:publish_config_access).returns("restricted")
+      refute @spec.private_scoped_package?
+    end
+
+    test "#private_scoped_package? is true when private packages are scoped" do
+      @spec.stubs(:scoped_package?).returns(true)
+      @spec.stubs(:publish_config_access).returns("restricted")
+      assert @spec.private_scoped_package?
+    end
+
     test '#publish_npm_package checks if version tag exists, and then invokes npm deploy script' do
       @spec.stubs(:npm?).returns(true)
-      assert_equal ['assert-npm-version-tag', 'npm publish'], @spec.deploy_steps
+      @spec.stubs(:package_version).returns('1.0.0')
+      @spec.stubs(:valid_publish_config?).returns(true)
+      @spec.stubs(:publish_config_access).returns('restricted')
+      @spec.stubs(:registry).returns("@private:registry=some_private_registry")
+      assert_equal ['assert-npm-version-tag', 'npm publish --tag latest --access restricted'], @spec.deploy_steps
+    end
+
+    test '#npmrc_contents returns a scoped private package configuration when the package is scoped and private' do
+      registry = "@shopify:registry=some_private_registry"
+      Shipit.stubs(:npm_org_scope).returns('@shopify')
+      Shipit.stubs(:private_npm_registry).returns('some_private_registry')
+      @spec.stubs(:scoped_package?).returns(true)
+      @spec.stubs(:publish_config_access).returns('restricted')
+      assert_equal registry, @spec.registry
+    end
+
+    test '#npmrc_contents returns a public scoped package configuration when the package is scoped and public' do
+      registry = "@shopify:registry=https://registry.npmjs.org/"
+      Shipit.stubs(:npm_org_scope).returns('@shopify')
+      @spec.stubs(:scoped_package?).returns(true)
+      @spec.stubs(:publish_config_access).returns('public')
+      assert_equal registry, @spec.registry
+    end
+
+    test '#npmrc_contents returns a public non-scoped package configuration when the package is not scoped and public' do
+      registry = "registry=https://registry.npmjs.org/"
+      @spec.stubs(:scoped_package?).returns(false)
+      @spec.stubs(:publish_config_access).returns('public')
+      assert_equal registry, @spec.registry
+    end
+
+    test '#publish_lerna_packages guesses npm tag' do
+      @spec.stubs(:lerna?).returns(true)
+      @spec.stubs(:lerna_version).returns('1.0.0-alpha.1')
+      assert_match(/--npm-tag next/, @spec.deploy_steps.last)
+    end
+
+    test '#publish_npm_package checks if version tag and a pre-release flag exist, and then invokes npm deploy script' do
+      @spec.stubs(:npm?).returns(true)
+      @spec.stubs(:package_version).returns('1.0.0-alpha.1')
+      @spec.stubs(:valid_publish_config?).returns(true)
+      @spec.stubs(:publish_config_access).returns('restricted')
+      @spec.stubs(:registry).returns("@private:registry=some_private_registry")
+      assert_equal ['assert-npm-version-tag', 'npm publish --tag next --access restricted'], @spec.deploy_steps
     end
 
     test 'bundler installs take priority over yarn installs' do
@@ -663,14 +864,49 @@ module Shipit
       assert_equal ['yarn install --no-progress'], @spec.dependencies_steps
     end
 
-    test '#publish_yarn_package checks if version tag exists, and then invokes npm publish script' do
+    test '#publish_npm_package checks if version tag exists, and then invokes npm publish script' do
       @spec.stubs(:yarn?).returns(true).at_least_once
-      assert_equal ['assert-npm-version-tag', 'npm publish'], @spec.deploy_steps
+      @spec.stubs(:package_version).returns('1.0.0')
+      @spec.stubs(:valid_publish_config?).returns(true)
+      @spec.stubs(:publish_config_access).returns('restricted')
+      @spec.stubs(:registry).returns("@private:registry=some_private_registry")
+      assert_equal ['assert-npm-version-tag', 'npm publish --tag latest --access restricted'], @spec.deploy_steps
+    end
+
+    test '#publish_npm_package checks if version tag exists, generates npmrc, and then invokes npm publish script when enforce_publish_config? is true' do
+      @spec.stubs(:yarn?).returns(true).at_least_once
+      @spec.stubs(:package_version).returns('1.0.0')
+      @spec.stubs(:valid_publish_config?).returns(true)
+
+      @spec.stubs(:publish_config_access).returns('restricted')
+      @spec.stubs(:enforce_publish_config?).returns(true)
+      @spec.stubs(:registry).returns('fake')
+
+      generate_npmrc = 'generate-local-npmrc "fake"'
+      npm_publish = 'npm publish --tag latest --access restricted'
+      deploy_steps = ['assert-npm-version-tag', generate_npmrc, npm_publish]
+      assert_equal deploy_steps, @spec.deploy_steps
     end
 
     test 'yarn checklist takes precedence over npm checklist' do
       @spec.stubs(:yarn?).returns(true).at_least_once
       assert_match(/yarn version/, @spec.review_checklist[0])
     end
+
+    test "max_divergence_commits defaults to `nil" do
+      @spec.expects(:load_config).returns({})
+      assert_nil @spec.max_divergence_commits
+    end
+
+    test "max_divergence_age defaults to `nil` if `merge.max_divergence.age` cannot be parsed" do
+      @spec.expects(:load_config).returns(
+        'merge' => {
+          'max_divergence' => {
+            'age' => 'badbadbad',
+          },
+        },
+      )
+      assert_nil @spec.max_divergence_age
+    end
   end
 end