@afokapu/atdd-bun 0.10.60 → 0.10.61

package/README.md

@@ -25,6 +25,13 @@ without `--replace`, and adding the dependency changes nothing until you run `in
 
 Then require the workflow's job in the GitHub branch ruleset, so it gates merges.
 
+For a declared GitHub Packages scope in `.npmrc` (for example,
+`@forgeonehundred:registry=https://npm.pkg.github.com`), run
+`bun run atdd-bun ci init --replace`. The generator preserves that scope and adds
+only `//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}`; the generated workflow
+supplies the ephemeral Actions token to its frozen install step. It refuses an
+existing stored token rather than reading, copying, or replacing it.
+
 ## Commands
 
 | Command | What it does |

package/integrity.json

@@ -1,9 +1,9 @@
 {
-  "version": "0.10.60",
+  "version": "0.10.61",
   "files": {
     "HOOK_AUDIT.md": "5329d840db37671b1918f688ead26865473b87db73dbc75f7c8b2a8bbe8d6d43",
     "PLANNER_PORT.md": "fb5935bac8b7ac18994de21e43ace3a5ef8cd55f85b0e3349fca261280054f11",
-    "README.md": "ab10b690a87a3a654e7b16ad2528acdfc682e0b2eca31dddf1fae9dd69ef44c5",
+    "README.md": "97715ea62760048752774c5c6f9a34046e5a019595590fc71d5b007551385c7e",
     "bunfig.toml": "b9fc65eca9014c5179380259d70e76385a6a80788fa9a2df5fb3eaa5554fd2fe",
     "conventions/_profiles/architecture.yaml": "f1808768b720a4e476047e4a0912002ca673946562cea9aeef5d0c214828d93a",
     "conventions/_profiles/coder.yaml": "3fb191556a64c9ebcf249516afa189afca24da9b22fd40b2fc66908196cdfb78",
@@ -1257,7 +1257,7 @@
     "planner-schemas/wmbt.schema.json": "7a3a5693bfcf01340667c2be4a3c48e74f34b1af7e8dc13372c0de06b7f4fe12",
     "relationships.yaml": "5860a308ebc3ee7fa8172fc2c6633984000ab3003f0ae4b6fa28db48879eda22",
     "src/agent.ts": "6d6c6e75908af8fbab13432f0001b0374bb25cf3dee46ba218dfd67e0090cb56",
-    "src/ci.ts": "67e54d2cbfc44a9e42837d5e750af526d6255c539d3c452a4d5fca3226c0d9ac",
+    "src/ci.ts": "646e72ff576d3921d85ecdd1d8c7821693832735be8949f5da254f3c345be032",
     "src/cli.ts": "90e59edbb8a7ea116ad9e7b4ba56b5c612ac18ada05824e8e941048be4dc72c8",
     "src/docs-capability.ts": "bdeeb414649049b1cd4fa8008cada3a576318be51c43bec91bfa46a8e250c270",
     "src/enforce.ts": "7e6b3a1fc7c90f8e1836ab3e4655778fb569a63be5e7c199de44024fc003e6be",
@@ -1279,6 +1279,6 @@
     "templates/agents/atdd-bun.integrity.test.ts": "dec6f6e5f65a08d9512fc703b367c163f8c9da1f6aa7fd466835c1ec30348a41",
     "templates/docs/site.css": "482b3427e3a3cb02a85dc85cfbeac80592dfd53abf42fc92d6ea7071f22afc95",
     "templates/github/atdd-bun-release.yml": "d9547e9e6ef3ae010d53d55314f6a54567f88bd900f7e50d994cd308601d2684",
-    "templates/github/atdd-bun.yml": "404dc06b6ff4faf5eab909f9f77bac0ae58163d810c3928c4353b1f4b3529048"
+    "templates/github/atdd-bun.yml": "c267f47505eb7df2b73b279185f46912aac0f17dcd2c5a1c6c8e1a5834bdcb30"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afokapu/atdd-bun",
-  "version": "0.10.60",
+  "version": "0.10.61",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/afokapu/atdd-bun.git"

package/src/ci.ts

@@ -12,5 +12,36 @@ const version = (await Bun.file(join(root, "package.json")).json() as { version:
 export async function renderWorkflow(repo = process.cwd()) {
   return (await readFile(template, "utf8")).replace("{{VERSION}}", version).replace("{{PROTECTED_BRANCHES}}", (await policy(repo)).protected_branches.map(branch => JSON.stringify(branch)).join(", "));
 }
-export async function ciInit(repo = process.cwd(), replace = false) { const output = join(repo, ".github/workflows/atdd-bun.yml"); if (existsSync(output) && !replace) return { ok: false, message: `${output} exists; use --replace` }; let rendered: string; try { rendered = await renderWorkflow(repo); } catch (error) { return { ok: false, message: `atdd-bun.yaml could not be parsed, so the workflow's push branches are unknown; fix the file first: ${String(error)}` }; } await mkdir(join(repo, ".github/workflows"), { recursive: true }); await writeFile(output, rendered); return { ok: true, message: output }; }
+const githubPackagesRegistry = /^\s*@[\w.-]+:registry\s*=\s*https:\/\/npm\.pkg\.github\.com\/?\s*$/im;
+const githubPackagesAuth = /^\s*\/\/npm\.pkg\.github\.com\/:_authToken\s*=\s*(.*?)\s*$/gim;
+const githubPackagesTokenInterpolation = "${NODE_AUTH_TOKEN}";
+
+/** Add only the npm-compatible environment interpolation required by an already-declared GitHub Packages scope.
+ * Registry ownership remains with the consumer: absent or other registry scopes are never invented or changed. */
+async function githubPackagesNpmrc(repo: string) {
+  const path = join(repo, ".npmrc");
+  if (!existsSync(path)) return { ok: true, path, content: undefined as string | undefined };
+  const content = await readFile(path, "utf8");
+  // Authentication is sensitive even when no scope currently routes to GitHub Packages: validate every present
+  // assignment before deciding whether the generator should add a missing interpolation for a declared scope.
+  const assignments = [...content.matchAll(githubPackagesAuth)].map(match => match[1]);
+  if (assignments.length > 1) return { ok: false, path, message: ".npmrc must declare exactly one npm.pkg.github.com _authToken assignment to avoid ambiguous authentication" };
+  const current = assignments[0];
+  if (current !== undefined && current !== githubPackagesTokenInterpolation) return { ok: false, path, message: ".npmrc already configures npm.pkg.github.com authentication; replace it with the standard ${NODE_AUTH_TOKEN} interpolation instead of storing a credential" };
+  if (!githubPackagesRegistry.test(content) || current !== undefined) return { ok: true, path, content: undefined as string | undefined };
+  return { ok: true, path, content: `${content}${content.endsWith("\n") ? "" : "\n"}//npm.pkg.github.com/:_authToken=${githubPackagesTokenInterpolation}\n` };
+}
+
+export async function ciInit(repo = process.cwd(), replace = false) {
+  const output = join(repo, ".github/workflows/atdd-bun.yml");
+  if (existsSync(output) && !replace) return { ok: false, message: `${output} exists; use --replace` };
+  let rendered: string;
+  try { rendered = await renderWorkflow(repo); } catch (error) { return { ok: false, message: `atdd-bun.yaml could not be parsed, so the workflow's push branches are unknown; fix the file first: ${String(error)}` }; }
+  const npmrc = await githubPackagesNpmrc(repo);
+  if (!npmrc.ok) return { ok: false, message: `${npmrc.path}: ${npmrc.message}` };
+  await mkdir(join(repo, ".github/workflows"), { recursive: true });
+  if (npmrc.content !== undefined) await writeFile(npmrc.path, npmrc.content);
+  await writeFile(output, rendered);
+  return { ok: true, message: npmrc.content === undefined ? output : `${output}\n${npmrc.path}` };
+}
 export async function ciStatus(repo = process.cwd()) { const output = join(repo, ".github/workflows/atdd-bun.yml"); return { ok: existsSync(output), message: output }; }

package/templates/github/atdd-bun.yml

@@ -1,5 +1,10 @@
 # Generated by @afokapu/atdd-bun {{VERSION}}. Do not edit; run `atdd-bun ci init --replace`.
 name: ATdd-Bun
+# The generated gate only needs checkout and package-download access. All other
+# token capabilities are explicitly disabled.
+permissions:
+  contents: read
+  packages: read
 on:
   pull_request:
   merge_group:
@@ -16,9 +21,15 @@ jobs:
       ATDD_BASE_REF: ${{ github.event_name == 'push' && github.event.before || github.event_name == 'merge_group' && github.event.merge_group.base_sha || '' }}
     steps:
       - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
+        with:
+          fetch-depth: 0
+          persist-credentials: false
       - uses: oven-sh/setup-bun@v2
+      # A consumer-owned .npmrc keeps registry scope. The Actions token exists
+      # only for this install step; it is neither written nor echoed.
       - run: bun install --frozen-lockfile
+        env:
+          NODE_AUTH_TOKEN: ${{ github.token }}
       - run: bun run atdd-bun integrity
       - run: bun run atdd-bun all
       - run: bun test