@akira-tl/forgerelay 0.4.5 → 0.4.7

package/scripts/release-proof.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+const PROOF_VERSION = 1;
+const PROOF_RELATIVE_PATH = join("forgerelay", "release-proof.json");
+
+function fail(message) {
+  console.error(`Release proof failed: ${message}`);
+  process.exitCode = 1;
+}
+
+function git(args, options = {}) {
+  return execFileSync("git", args, {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    ...options,
+  }).trim();
+}
+
+function packageVersion() {
+  const pkg = JSON.parse(readFileSync(join(process.cwd(), "package.json"), "utf8"));
+  if (typeof pkg.version !== "string" || !pkg.version) {
+    throw new Error("package.json must contain a version string");
+  }
+  return pkg.version;
+}
+
+function gitDir() {
+  const path = git(["rev-parse", "--git-dir"]);
+  return path.startsWith("/") ? path : join(process.cwd(), path);
+}
+
+function proofPath() {
+  return process.env.FORGERELAY_RELEASE_PROOF_PATH ?? join(gitDir(), PROOF_RELATIVE_PATH);
+}
+
+function currentHead() {
+  return git(["rev-parse", "HEAD"]);
+}
+
+function assertReleaseTreeClean() {
+  const status = git(["status", "--porcelain", "--untracked-files=all"]);
+  if (status) {
+    throw new Error("working tree differs from HEAD or contains untracked files; commit or remove every release input before running release:verify");
+  }
+}
+
+function writeProof() {
+  assertReleaseTreeClean();
+  const proof = {
+    proofVersion: PROOF_VERSION,
+    head: currentHead(),
+    packageVersion: packageVersion(),
+    verifiedAt: new Date().toISOString(),
+  };
+  const path = proofPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 });
+  console.log(`Release verification proof recorded for ${proof.head.slice(0, 12)} (${proof.packageVersion}).`);
+}
+
+function readProof() {
+  const path = proofPath();
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`no valid local release proof at ${path}: ${detail}. Run npm run release:verify on the committed release HEAD first`);
+  }
+  if (
+    parsed?.proofVersion !== PROOF_VERSION ||
+    typeof parsed?.head !== "string" ||
+    typeof parsed?.packageVersion !== "string" ||
+    typeof parsed?.verifiedAt !== "string"
+  ) {
+    throw new Error(`invalid release proof format at ${path}; run npm run release:verify again`);
+  }
+  return parsed;
+}
+
+function hookTag() {
+  let payload;
+  try {
+    payload = JSON.parse(process.env.FORGERELAY_HOOK_PAYLOAD ?? "{}");
+  } catch {
+    throw new Error("FORGERELAY_HOOK_PAYLOAD is not valid JSON");
+  }
+  const command = typeof payload.command === "string" ? payload.command : "";
+  const match = /git\s+push\s+origin\s+(v\d+\.\d+\.\d+)/.exec(command);
+  if (!match?.[1]) {
+    throw new Error("release Hook payload does not contain a stable tag push");
+  }
+  return match[1];
+}
+
+function checkHookProof() {
+  assertReleaseTreeClean();
+  const proof = readProof();
+  const head = currentHead();
+  const version = packageVersion();
+  const tag = hookTag();
+  const expectedTag = `v${version}`;
+
+  if (proof.head !== head) {
+    throw new Error(`release proof is for ${proof.head.slice(0, 12)}, but current HEAD is ${head.slice(0, 12)}; rerun npm run release:verify`);
+  }
+  if (proof.packageVersion !== version) {
+    throw new Error(`release proof is for package ${proof.packageVersion}, but package.json is ${version}; rerun npm run release:verify`);
+  }
+  if (tag !== expectedTag) {
+    throw new Error(`tag ${tag} does not match package version ${version}; expected ${expectedTag}`);
+  }
+
+  let tagHead;
+  try {
+    tagHead = git(["rev-parse", `${tag}^{commit}`]);
+  } catch {
+    throw new Error(`local tag ${tag} does not exist or does not resolve to a commit`);
+  }
+  if (tagHead !== head) {
+    throw new Error(`tag ${tag} points to ${tagHead.slice(0, 12)}, but verified HEAD is ${head.slice(0, 12)}`);
+  }
+
+  console.log(`Release proof OK: ${tag} -> ${head.slice(0, 12)} (${proof.verifiedAt}).`);
+}
+
+const action = process.argv[2];
+try {
+  if (action === "write") writeProof();
+  else if (action === "check-hook") checkHookProof();
+  else throw new Error("usage: node scripts/release-proof.mjs <write|check-hook>");
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error));
+}

package/scripts/release-proof.test.mjs

@@ -0,0 +1,104 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const script = fileURLToPath(new URL("./release-proof.mjs", import.meta.url));
+
+async function git(cwd, args) {
+  await execFileAsync("git", args, { cwd });
+}
+
+async function runProof(cwd, action, env = {}) {
+  return execFileAsync(process.execPath, [script, action], {
+    cwd,
+    env: { ...process.env, ...env },
+  });
+}
+
+test("release proof binds a successful local verification to the exact tag HEAD", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await writeFile(join(root, "package.json"), JSON.stringify({ version: "1.2.3" }) + "\n");
+  await writeFile(join(root, "tracked.txt"), "verified\n");
+  await git(root, ["init"]);
+  await git(root, ["config", "user.email", "proof@example.com"]);
+  await git(root, ["config", "user.name", "Release Proof Test"]);
+  await git(root, ["add", "."]);
+  await git(root, ["commit", "-m", "release 1.2.3"]);
+
+  const written = await runProof(root, "write");
+  assert.match(written.stdout, /Release verification proof recorded/);
+  await git(root, ["tag", "v1.2.3"]);
+
+  const checked = await runProof(root, "check-hook", {
+    FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
+  });
+  assert.match(checked.stdout, /Release proof OK: v1\.2\.3/);
+
+  await writeFile(join(root, "tracked.txt"), "changed after verification\n");
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /working tree differs from HEAD/);
+      return true;
+    },
+  );
+
+  await writeFile(join(root, "tracked.txt"), "verified\n");
+  await writeFile(join(root, "untracked.txt"), "not in the release commit\n");
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /contains untracked files/);
+      return true;
+    },
+  );
+  await rm(join(root, "untracked.txt"));
+  await git(root, ["add", "tracked.txt"]);
+  await git(root, ["commit", "--allow-empty", "-m", "new head"]);
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v1.2.3" }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /release proof is for .* current HEAD is/);
+      return true;
+    },
+  );
+});
+
+test("release proof rejects a mismatched tag without invoking a remote", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "forgerelay-release-proof-"));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  await writeFile(join(root, "package.json"), JSON.stringify({ version: "2.0.0" }) + "\n");
+  await git(root, ["init"]);
+  await git(root, ["config", "user.email", "proof@example.com"]);
+  await git(root, ["config", "user.name", "Release Proof Test"]);
+  await git(root, ["add", "."]);
+  await git(root, ["commit", "-m", "release 2.0.0"]);
+  await runProof(root, "write");
+  await git(root, ["tag", "v2.0.0"]);
+
+  await assert.rejects(
+    () => runProof(root, "check-hook", {
+      FORGERELAY_HOOK_PAYLOAD: JSON.stringify({ command: "git push origin v2.0.1" }),
+    }),
+    (error) => {
+      assert.match(String(error.stderr ?? error), /tag v2\.0\.1 does not match package version 2\.0\.0/);
+      return true;
+    },
+  );
+
+  const proof = JSON.parse(await readFile(join(root, ".git", "forgerelay", "release-proof.json"), "utf8"));
+  assert.equal(proof.packageVersion, "2.0.0");
+});

package/scripts/release-version.mjs

@@ -162,7 +162,7 @@ async function prepareRelease(state, nextVersion, dryRun) {
 
   console.log(`${state.pkg.version} -> ${nextVersion}`);
   console.log("updated package.json, package-lock.json, and CHANGELOG.md");
-  console.log("next: review the diff, run npm run release:verify, commit, then push the matching vX.Y.Z tag");
+  console.log("next: review the diff, commit the release-ready tree, run npm run release:verify on that clean HEAD, then push the matching vX.Y.Z tag");
 }
 
 function promoteUnreleased(changelog, nextVersion) {