@ankhorage/devtools 1.10.0 → 1.10.1

package/dist/owner/synchronizeRenovateOwnerAsync.js

@@ -3,6 +3,7 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { applyBunRuntimePolicy } from '../policy/applyBunRuntimePolicy.js';
 import { nodeRuntimePolicy } from '../policy/bunRuntimePolicy.js';
+import { renderRenovateWorkflowAsync } from '../tools/workflows/renderRenovateWorkflowAsync.js';
 import { renderWorkflowAsync } from '../tools/workflows/renderWorkflowAsync.js';
 export async function synchronizeRenovateOwnerAsync(operation, targetDirectory, options = {}) {
     const target = resolve(targetDirectory);
@@ -52,7 +53,7 @@ async function createManagedDefinitionsAsync(targetDirectory, policy) {
         },
         {
             relativePath: '.github/workflows/renovate.yml',
-            contents: await renderWorkflowAsync(new URL('../tools/workflows/files/renovate.yml', import.meta.url), workflowPolicy),
+            contents: await renderRenovateWorkflowAsync(new URL('../tools/workflows/files/renovate.yml', import.meta.url), targetDirectory, workflowPolicy),
         },
         {
             relativePath: 'README.md',

package/dist/tools/workflows/index.js

@@ -1,9 +1,10 @@
 import { bunRuntimePolicy, nodeRuntimePolicy } from '../../policy/bunRuntimePolicy.js';
+import { renderRenovateWorkflowAsync } from './renderRenovateWorkflowAsync.js';
 import { renderWorkflowAsync } from './renderWorkflowAsync.js';
 export const workflowManagedFiles = [
     createWorkflowDefinition('.github/workflows/ci.yml', './files/ci.yml'),
     createWorkflowDefinition('.github/workflows/release.yml', './files/release.yml'),
-    createWorkflowDefinition('.github/workflows/renovate.yml', './files/renovate.yml'),
+    createRenovateWorkflowDefinition(),
 ];
 function createWorkflowDefinition(relativePath, sourcePath) {
     const sourceUrl = new URL(sourcePath, import.meta.url);
@@ -15,3 +16,14 @@ function createWorkflowDefinition(relativePath, sourcePath) {
         }),
     };
 }
+/*** Creates the managed workflow whose immutable digest remains Renovate-owned. */
+function createRenovateWorkflowDefinition() {
+    const sourceUrl = new URL('./files/renovate.yml', import.meta.url);
+    return {
+        relativePath: '.github/workflows/renovate.yml',
+        render: async (targetDirectory) => await renderRenovateWorkflowAsync(sourceUrl, targetDirectory, {
+            bunVersion: bunRuntimePolicy.version,
+            nodeVersion: nodeRuntimePolicy.setupVersion,
+        }),
+    };
+}

package/dist/tools/workflows/renderRenovateWorkflowAsync.d.ts

@@ -0,0 +1,3 @@
+import { type WorkflowPolicy } from './renderWorkflowAsync.js';
+/*** Renders the canonical workflow while retaining Renovate's exact trusted digest. */
+export declare function renderRenovateWorkflowAsync(sourceUrl: URL, targetDirectory: string, policy: WorkflowPolicy): Promise<string>;

package/dist/tools/workflows/renderRenovateWorkflowAsync.js

@@ -0,0 +1,39 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { renderWorkflowAsync } from './renderWorkflowAsync.js';
+/*** Renders the canonical workflow while retaining Renovate's exact trusted digest. */
+export async function renderRenovateWorkflowAsync(sourceUrl, targetDirectory, policy) {
+    const template = await renderWorkflowAsync(sourceUrl, policy);
+    readSingleRenovateWorkflowDigest(template, 'Devtools workflow template');
+    const target = await readOptionalWorkflowAsync(resolve(targetDirectory, RENOVATE_WORKFLOW_RELATIVE_PATH));
+    if (target === null)
+        return template;
+    const digest = readSingleRenovateWorkflowDigest(target, 'target workflow');
+    return template.replace(RENOVATE_WORKFLOW_REFERENCE_PATTERN, (_reference, prefix, _templateDigest, suffix) => `${prefix}${digest}${suffix}`);
+}
+/*** Reads one exact immutable digest from the canonical Renovate workflow reference. */
+function readSingleRenovateWorkflowDigest(contents, source) {
+    const matches = [...contents.matchAll(RENOVATE_WORKFLOW_REFERENCE_PATTERN)];
+    const digest = matches.length === 1 ? matches[0]?.[2] : undefined;
+    if (digest === undefined) {
+        throw new Error(`Expected exactly one immutable Renovate digest in the ${source}.`);
+    }
+    return digest;
+}
+/*** Reads an existing managed workflow without treating first-time creation as an error. */
+async function readOptionalWorkflowAsync(path) {
+    try {
+        return await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+/*** Narrows filesystem failures to Node errors with stable codes. */
+function isNodeError(error) {
+    return error instanceof Error && 'code' in error;
+}
+const RENOVATE_WORKFLOW_REFERENCE_PATTERN = /^([ \t]*uses:[ \t]+ankhorage\/renovate\/\.github\/workflows\/changeset\.yml@)([0-9a-f]{40})([ \t]*)$/gmu;
+const RENOVATE_WORKFLOW_RELATIVE_PATH = '.github/workflows/renovate.yml';

package/dist/tools/workflows/renderWorkflowAsync.d.ts

@@ -1,4 +1,6 @@
-export declare function renderWorkflowAsync(sourceUrl: URL, policy: {
+export interface WorkflowPolicy {
     readonly bunVersion: string;
     readonly nodeVersion: string;
-}): Promise<string>;
+}
+/*** Renders one workflow template with the canonical runtime and Changesets policy. */
+export declare function renderWorkflowAsync(sourceUrl: URL, policy: WorkflowPolicy): Promise<string>;

package/dist/tools/workflows/renderWorkflowAsync.js

@@ -1,5 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { changesetsPolicy } from '../../policy/changesetsPolicy.js';
+/*** Renders one workflow template with the canonical runtime and Changesets policy. */
 export async function renderWorkflowAsync(sourceUrl, policy) {
     const template = await readFile(sourceUrl, 'utf8');
     return template

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Shared development tools and repository standards for Ankhorage",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",