@apollo/rover 0.39.1 → 0.41.0-rc.2

package/README.md

@@ -83,6 +83,8 @@ Commands:
           Commands for fetching offline licenses
   client
           Client workflow commands
+  graph-artifact
+          Graph artifact commands
   help
           Print this message or the help of the given subcommand(s)
 
@@ -97,7 +99,7 @@ Options:
           [possible values: plain, json]
 
   -o, --output <OUTPUT_FILE>
-          Specify a file to write Rover's output to
+          Specify a file to write Rover's console output to instead of stdout
 
       --insecure-accept-invalid-certs
           Accept invalid certificates when performing HTTPS requests.
@@ -114,12 +116,14 @@ Options:
           If hostname verification is not used, any valid certificate for any site will be trusted for use from any other. This introduces a significant vulnerability to man-in-the-middle attacks.
 
       --client-timeout <CLIENT_TIMEOUT>
-          Configure the timeout length (in seconds) when performing HTTP(S) requests
+          Configure the timeout length (in seconds) when performing HTTP(S) requests.
 
-          [default: 30]
+          Defaults to 30s for standard operations and 300s for plugin downloads.
 
       --skip-update-check
-          Skip checking for newer versions of rover
+          Skip checking for newer versions of rover.
+
+          Set the `APOLLO_ROVER_SKIP_UPDATE` environment variable (to `1` or `true`) to disable all of Rover's auto-updating at once — both this self-update check and the `supergraph`/`router` plugin auto-updates (`--skip-update`).
 
   -h, --help
           Print help (see a summary with '-h')
@@ -171,7 +175,7 @@ This repo is organized as a [`cargo` workspace], containing several related proj
 
 ## Installation Methods
 
-As of Rover 0.39.0, all the platforms listed below enforce immutable release tags. This means that you can reference a GitHub release, Docker image, or NPM release version directly by SemVer and be
+As of Rover v0.39.1, all the platforms listed below enforce immutable release tags. This means that you can reference a GitHub release, Docker image, or NPM release version directly by SemVer and be
 guaranteed that the artifact will not change. Note that the `curl | sh` method, while ultimately referencing immutable GitHub release binaries, still first downloads a shell script from a webservice
 that does not provide that same guarantee of immutability. Security conscious installers should verify the downloaded shell script matches 
 [the pinned artifact for its respective Rover version](https://github.com/apollographql-gh-actions/install-rover) or use one of the immutable installation methods described below.
@@ -186,7 +190,7 @@ curl -sSL https://rover.apollo.dev/nix/latest | sh
 
 To install a specific version of Rover (note the `v` prefixing the version number):
 
-> Note: If you're installing Rover in a CI environment, we highly recommend using an [immutable Docker image of Rover](#docker-images)). As an alternative for GitHub Actions users, we vend a [GitHub Action](https://github.com/marketplace/actions/install-apollo-rover-cli) which pins an immutable instance of the download script and installs the native binary.
+> Note: If you're installing Rover in a CI environment, Apollo highly recommends using an [immutable Docker image of Rover](#docker-images)). As an alternative for GitHub Actions users, Apollo vends a [GitHub Action](https://github.com/marketplace/actions/install-apollo-rover-cli) which pins an immutable instance of the download script and installs the native binary.
 
 ```bash
 curl -sSL https://rover.apollo.dev/nix/v0.10.0 | sh
@@ -204,7 +208,7 @@ iwr 'https://rover.apollo.dev/win/latest' | iex
 
 To install a specific version of Rover (note the `v` prefixing the version number):
 
-> Note: If you are installing Rover in a Windows CI environment, you need to put Docker into Linux mode to use the [recommended immutable Docker images](#docker-images)). As an alternative for GitHub Actions users, we vend a [GitHub Action](https://github.com/marketplace/actions/install-apollo-rover-cli) to do so which pins an immutable instance of the download script and installs the native binary.
+> Note: If you are installing Rover in a Windows CI environment, you need to put Docker into Linux mode to use the [recommended immutable Docker images](#docker-images)). As an alternative for GitHub Actions users, Apollo vends a [GitHub Action](https://github.com/marketplace/actions/install-apollo-rover-cli) to do so which pins an immutable instance of the download script and installs the native binary.
 
 
 ```bash
@@ -213,22 +217,22 @@ iwr 'https://rover.apollo.dev/win/v0.10.0' | iex
 
 #### Docker images
 
-Starting with version 0.39.0, Rover vends immutable Linux Docker images that pre-build Rover as an entry point for consumption in CI environments
+Starting with version 0.39.1, Rover vends immutable Linux Docker images that pre-build Rover as an entry point for consumption in CI environments
 or to run Rover on platforms that Rover does not build natively for. Each release verison tag is enforced as immutable at the platform level for
 your convenience so that you can pin to the Rover version you want without needing to deal with the indirection of SHA pinning.
 
 Install directly from Dockerhub:
 
 ```bash
-docker pull apollograph/rover:0.39.0
-docker run apollograph/rover:0.39.0 <<args>>
+docker pull apollograph/rover:0.39.1
+docker run apollograph/rover:0.39.1 <<args>>
 ```
 
 or via ghcr.io:
 
 ```bash
-docker pull ghcr.io/apollographql/rover:0.39.0
-docker run ghcr.io/apollographql/rover:0.39.0 <<args>>
+docker pull ghcr.io/apollographql/rover:0.39.1
+docker run ghcr.io/apollographql/rover:0.39.1 <<args>>
 ```
 
 All CI platforms that support referencing images from those respective image repositories can do so directly as well.
@@ -238,7 +242,7 @@ All CI platforms that support referencing images from those respective image rep
 Rover vends a number of GitHub actions for convenient invocation of common Rover commands in your CI pipeline. They can be found on
 [GitHub's actions marketplace](https://github.com/marketplace?query=apollographql-gh-actions+Rover&type=actions).
 
-As of Rover 0.39.0, each Rover release corresponds to an immutable action tag of `<action>@rover-<version>`. This allows you to specify
+As of Rover v0.39.1, each Rover release corresponds to an immutable action tag of `<action>@rover-<version>`. This allows you to specify
 the exact version of Rover for your CI actions without needing to rely on SHA pinning to guarantee action immutability. These actions
 leverage Rover's Docker image under the hood to sandbox the Rover invocation and only expose it to the `APOLLO_*` environment variable
 surface.
@@ -251,8 +255,8 @@ Their source code is mastered in this repository under the `actions` directory.
 #### npm installer
 
 Rover is distributed on npm for easy integration with your JavaScript projects. Rover's Node dependency will follow LTS versions where possible unless security concerns justify an earlier upgrade.
-While this installation method is provided for convenience in projects that are already in the Node ecosystem, we do not recommend it as an installation method otherwise as it exposes your
-installation to NPM's surface area of potential supply-chain attacks. We have attempted to minimize the dependency surface of Rover's NPM installation script, but it still represents nonzero risk.
+While this installation method is provided for convenience in projects that are already in the Node ecosystem, Apollo does not recommend it as an installation method otherwise as it exposes your
+installation to NPM's surface area of potential supply-chain attacks. Apollo has attempted to minimize the dependency surface of Rover's NPM installation script, but it still represents nonzero risk.
 
 ##### devDependency install
 
@@ -262,7 +266,7 @@ Note that installing rover directly via `npx install` bypasses lockfiles (includ
 
 #### Homebrew
 
-While we recommend using one of the other installation methods above, we do have a homebrew recipe `brew install rover`. The code for this recipe is in the [homebrew-core repo](https://github.com/Homebrew/homebrew-core/blob/master/Formula/r/rover.rb).
+While Apollo recommends using one of the other installation methods above, we do have a homebrew recipe `brew install rover`. The code for this recipe is in the [homebrew-core repo](https://github.com/Homebrew/homebrew-core/blob/master/Formula/r/rover.rb).
 
 #### Manual binary download
 

package/bin/rover.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+'use strict'
+
+function isMusl() {
+  try {
+    return require('fs').readFileSync('/usr/bin/ldd', 'utf-8').includes('musl')
+  } catch {}
+  try {
+    const orig = process.report.excludeNetwork
+    process.report.excludeNetwork = true
+    const report = process.report.getReport()
+    process.report.excludeNetwork = orig
+    if (report.header?.glibcVersionRuntime) return false
+    return report.sharedObjects.some((f) => f.includes('libc.musl-') || f.includes('ld-musl-'))
+  } catch {}
+}
+
+const PLATFORMS = {
+  darwin: {
+    arm64: '@apollo/rover-darwin-arm64/rover',
+    x64: '@apollo/rover-darwin-x64/rover',
+  },
+  linux: {
+    arm64: '@apollo/rover-linux-arm64/rover',
+    x64: '@apollo/rover-linux-x64/rover',
+  },
+  'linux-musl': {
+    x64: '@apollo/rover-linux-x64-musl/rover',
+  },
+  win32: {
+    x64: '@apollo/rover-win32-x64/rover.exe',
+  },
+}
+
+const key = process.platform === 'linux' && isMusl() ? 'linux-musl' : process.platform
+const binPath = PLATFORMS[key]?.[process.arch]
+
+if (!binPath) {
+  console.error(`Unsupported platform: ${process.platform} ${process.arch}`)
+  process.exit(1)
+}
+
+const bin = require.resolve(binPath)
+process.env.APOLLO_NODE_MODULES_BIN_DIR = require('path').dirname(bin)
+const result = require('child_process').spawnSync(bin, process.argv.slice(2), { stdio: 'inherit' })
+if (result.error) {
+  throw result.error
+}
+process.exitCode = result.status ?? 1

package/package.json

@@ -1,22 +1,7 @@
 {
   "name": "@apollo/rover",
-  "version": "0.39.1",
-  "description": "The new Apollo CLI",
-  "main": "index.js",
-  "bin": {
-    "rover": "run.js"
-  },
-  "scripts": {
-    "prepack": "cp ../../README.md . && cp ../../LICENSE .",
-    "postinstall": "node ./install.js",
-    "fmt": "prettier --write **/*.js",
-    "fmt:check": "prettier --check **/*.js",
-    "test": "jest"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/apollographql/rover.git"
-  },
+  "version": "0.41.0-rc.2",
+  "description": "Rover is a tool for working with the Apollo GraphQL Registry.",
   "keywords": [
     "rover",
     "graphql",
@@ -26,23 +11,28 @@
     "tooling",
     "tools"
   ],
-  "author": "Apollo Developers <opensource@apollographql.com>",
+  "homepage": "https://github.com/apollographql/rover#readme",
   "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/apollographql/rover/issues"
+  "author": "Apollo Developers <opensource@apollographql.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/apollographql/rover.git"
+  },
+  "bin": {
+    "rover": "bin/rover.js"
   },
   "engines": {
     "node": ">=22.14.0"
   },
-  "homepage": "https://github.com/apollographql/rover#readme",
-  "dependencies": {
-    "detect-libc": "2.1.2",
-    "tar": "^7.0.0",
-    "undici": "^7.0.0"
+  "optionalDependencies": {
+    "@apollo/rover-darwin-arm64": "0.41.0-rc.2",
+    "@apollo/rover-darwin-x64": "0.41.0-rc.2",
+    "@apollo/rover-linux-arm64": "0.41.0-rc.2",
+    "@apollo/rover-linux-x64": "0.41.0-rc.2",
+    "@apollo/rover-linux-x64-musl": "0.41.0-rc.2",
+    "@apollo/rover-win32-x64": "0.41.0-rc.2"
   },
-  "devDependencies": {
-    "jest": "30.4.2",
-    "jest-junit": "17.0.0",
-    "prettier": "3.8.3"
+  "bugs": {
+    "url": "https://github.com/apollographql/rover/issues"
   }
-}
+}

package/binary.js

@@ -1,383 +0,0 @@
-"use strict";
-
-const libc = require("detect-libc");
-const os = require("os");
-const tar = require("tar");
-const { Console } = require("node:console");
-const { existsSync, mkdirSync, rmSync } = require("fs");
-const { join } = require("path");
-const { spawnSync } = require("child_process");
-const { Readable } = require("stream");
-const { ProxyAgent, fetch } = require("undici");
-
-const error = (msg) => {
-  console.error(msg);
-  process.exit(1);
-};
-
-const { version } = require("./package.json");
-const fs = require("fs");
-const name = `rover`;
-
-const supportedPlatforms = [
-  {
-    TYPE: "Windows_NT",
-    ARCHITECTURE: "x64",
-    RUST_TARGET: "x86_64-pc-windows-msvc",
-    BINARY_NAME: `${name}-${version}.exe`,
-    RAW_NAME: `${name}.exe`,
-  },
-  {
-    TYPE: "Linux",
-    ARCHITECTURE: "x64",
-    RUST_TARGET: "x86_64-unknown-linux-gnu",
-    BINARY_NAME: `${name}-${version}`,
-    RAW_NAME: `${name}`,
-  },
-  {
-    TYPE: "Linux",
-    ARCHITECTURE: "arm64",
-    RUST_TARGET: "aarch64-unknown-linux-gnu",
-    BINARY_NAME: `${name}-${version}`,
-    RAW_NAME: `${name}`,
-  },
-  {
-    TYPE: "Darwin",
-    ARCHITECTURE: "x64",
-    RUST_TARGET: "x86_64-apple-darwin",
-    BINARY_NAME: `${name}-${version}`,
-    RAW_NAME: `${name}`,
-  },
-  {
-    TYPE: "Darwin",
-    ARCHITECTURE: "arm64",
-    RUST_TARGET: "aarch64-apple-darwin",
-    BINARY_NAME: `${name}-${version}`,
-    RAW_NAME: `${name}`,
-  },
-];
-
-const getPlatform = (type = os.type(), architecture = os.arch()) => {
-  for (let supportedPlatform of supportedPlatforms) {
-    if (
-      type === supportedPlatform.TYPE &&
-      architecture === supportedPlatform.ARCHITECTURE
-    ) {
-      if (supportedPlatform.TYPE === "Linux") {
-        let musl_warning =
-          "Downloading musl binary that does not include `rover supergraph compose`.";
-        if (libc.isNonGlibcLinuxSync()) {
-          console.warn(
-            "This operating system does not support dynamic linking to glibc.",
-          );
-          console.warn(musl_warning);
-          supportedPlatform.RUST_TARGET = "x86_64-unknown-linux-musl";
-        } else {
-          let libc_version = libc.versionSync();
-          let split_libc_version = libc_version.split(".");
-          let libc_major_version = split_libc_version[0];
-          let libc_minor_version = split_libc_version[1];
-          let min_major_version = 2;
-          let min_minor_version = 17;
-          if (
-            libc_major_version < min_major_version ||
-            libc_minor_version < min_minor_version
-          ) {
-            console.warn(
-              `This operating system needs glibc >= ${min_major_version}.${min_minor_version}, but only has ${libc_version} installed.`,
-            );
-            console.warn(musl_warning);
-            supportedPlatform.RUST_TARGET = "x86_64-unknown-linux-musl";
-          }
-        }
-      }
-      return supportedPlatform;
-    }
-  }
-
-  const stderr = new Console(process.stderr);
-  stderr.log(
-    `Platform with type "${type}" and architecture "${architecture}" is not supported by ${name}.`,
-  );
-  stderr.table(supportedPlatforms);
-  process.exit(1);
-};
-
-const DEFAULT_PORTS = { "http:": 80, "https:": 443 };
-
-/*! Copyright (c) 2014-present Matt Zabriskie & Collaborators - MIT License */
-const parseNoProxyEntry = (entry) => {
-  let entryHost = entry;
-  let entryPort = 0;
-
-  if (entryHost.charAt(0) === "[") {
-    const bracketIndex = entryHost.indexOf("]");
-    if (bracketIndex !== -1) {
-      const host = entryHost.slice(1, bracketIndex);
-      const rest = entryHost.slice(bracketIndex + 1);
-      if (rest.charAt(0) === ":" && /^\d+$/.test(rest.slice(1))) {
-        entryPort = Number.parseInt(rest.slice(1), 10);
-      }
-      return [host, entryPort];
-    }
-  }
-
-  const firstColon = entryHost.indexOf(":");
-  const lastColon = entryHost.lastIndexOf(":");
-  if (
-    firstColon !== -1 &&
-    firstColon === lastColon &&
-    /^\d+$/.test(entryHost.slice(lastColon + 1))
-  ) {
-    entryPort = Number.parseInt(entryHost.slice(lastColon + 1), 10);
-    entryHost = entryHost.slice(0, lastColon);
-  }
-
-  return [entryHost, entryPort];
-};
-
-/*! Copyright (c) 2014-present Matt Zabriskie & Collaborators - MIT License */
-const normalizeNoProxyHost = (hostname) => {
-  if (!hostname) return hostname;
-  if (
-    hostname.charAt(0) === "[" &&
-    hostname.charAt(hostname.length - 1) === "]"
-  ) {
-    hostname = hostname.slice(1, -1);
-  }
-  return hostname.replace(/\.+$/, "");
-};
-
-/*! Copyright (c) 2014-present Matt Zabriskie & Collaborators - MIT License */
-const shouldBypassProxy = (requestURL) => {
-  const noProxy = (
-    process.env.no_proxy ||
-    process.env.NO_PROXY ||
-    ""
-  ).toLowerCase();
-
-  if (!noProxy) return false;
-  if (noProxy === "*") return true;
-
-  const port =
-    Number.parseInt(requestURL.port, 10) ||
-    DEFAULT_PORTS[requestURL.protocol] ||
-    0;
-  const hostname = normalizeNoProxyHost(requestURL.hostname.toLowerCase());
-
-  return noProxy.split(/[\s,]+/).some((entry) => {
-    if (!entry) return false;
-
-    let [entryHost, entryPort] = parseNoProxyEntry(entry);
-    entryHost = normalizeNoProxyHost(entryHost);
-    if (!entryHost) return false;
-
-    if (entryPort && entryPort !== port) return false;
-
-    if (entryHost.charAt(0) === "*") {
-      entryHost = entryHost.slice(1);
-    }
-
-    if (entryHost.charAt(0) === ".") {
-      return hostname.endsWith(entryHost);
-    }
-
-    return hostname === entryHost;
-  });
-};
-
-const getProxyEnv = (requestURL) => {
-  if (shouldBypassProxy(requestURL)) return null;
-
-  if (requestURL.protocol === "http:") {
-    return process.env.HTTP_PROXY || process.env.http_proxy || null;
-  }
-
-  if (requestURL.protocol === "https:") {
-    return process.env.HTTPS_PROXY || process.env.https_proxy || null;
-  }
-
-  return null;
-};
-
-/*! Copyright (c) 2019 Avery Harnish - MIT License */
-class Binary {
-  constructor(name, raw_name, url, installDirectory) {
-    let errors = [];
-    if (typeof url !== "string") {
-      errors.push("url must be a string");
-    } else {
-      try {
-        new URL(url);
-      } catch (e) {
-        errors.push(e);
-      }
-    }
-    if (name && typeof name !== "string") {
-      errors.push("name must be a string");
-    }
-
-    if (!name) {
-      errors.push("You must specify the name of your binary");
-    }
-    if (errors.length > 0) {
-      let errorMsg =
-        "One or more of the parameters you passed to the Binary constructor are invalid:\n";
-      errors.forEach((error) => {
-        errorMsg += error;
-      });
-      errorMsg +=
-        '\n\nCorrect usage: new Binary("my-binary", "https://example.com/binary/download.tar.gz")';
-      error(errorMsg);
-    }
-    this.url = url;
-    this.name = name;
-    this.raw_name = raw_name;
-    this.installDirectory = installDirectory;
-
-    if (!existsSync(this.installDirectory)) {
-      mkdirSync(this.installDirectory, { recursive: true });
-    }
-
-    this.binaryPath = join(this.installDirectory, this.name);
-  }
-
-  exists() {
-    return existsSync(this.binaryPath);
-  }
-
-  install(suppressLogs = false) {
-    if (this.exists()) {
-      if (!suppressLogs) {
-        console.error(
-          `${this.name} is already installed, skipping installation.`,
-        );
-      }
-      return Promise.resolve();
-    }
-
-    if (existsSync(this.installDirectory)) {
-      rmSync(this.installDirectory, { recursive: true });
-    }
-
-    mkdirSync(this.installDirectory, { recursive: true });
-
-    if (!suppressLogs) {
-      console.error(`Downloading release from ${this.url}`);
-    }
-
-    const proxyUrl = getProxyEnv(new URL(this.url));
-
-    const agent = proxyUrl ? new ProxyAgent(proxyUrl) : null;
-    const fetchPromise = fetch(this.url, agent ? { dispatcher: agent } : {});
-
-    return fetchPromise
-      .then((res) => {
-        if (!res.ok) {
-          throw new Error(
-            `Failed to download binary: HTTP ${res.status} ${res.statusText}`,
-          );
-        }
-        return new Promise((resolve, reject) => {
-          const sink = Readable.fromWeb(res.body).pipe(
-            tar.x({ strip: 1, C: this.installDirectory }),
-          );
-          sink.on("finish", () => resolve());
-          sink.on("error", (err) => reject(err));
-        });
-      })
-      .then(() => {
-        fs.renameSync(
-          join(this.installDirectory, this.raw_name),
-          this.binaryPath,
-        );
-        if (!suppressLogs) {
-          console.error(`${this.name} has been installed!`);
-        }
-      })
-      .finally(() => agent && agent.close())
-      .catch((e) => {
-        error(`Error fetching release: ${e.message}`);
-      });
-  }
-
-  run() {
-    const promise = !this.exists() ? this.install(true) : Promise.resolve();
-
-    promise
-      .then(() => {
-        const [, , ...args] = process.argv;
-
-        const options = { cwd: process.cwd(), stdio: "inherit" };
-
-        const result = spawnSync(this.binaryPath, args, options);
-
-        if (result.error) {
-          error(result.error);
-        }
-
-        process.exit(result.status);
-      })
-      .catch((e) => {
-        error(e.message);
-        process.exit(1);
-      });
-  }
-}
-
-const getBinary = (overrideInstallDirectory, platform = getPlatform()) => {
-  const download_host =
-    process.env.npm_config_apollo_rover_download_host ||
-    process.env.APOLLO_ROVER_DOWNLOAD_HOST ||
-    "https://rover.apollo.dev";
-  // the url for this binary is constructed from values in `package.json`
-  // https://rover.apollo.dev/tar/rover/x86_64-unknown-linux-gnu/vx.x.x
-  const url = `${download_host}/tar/${name}/${platform.RUST_TARGET}/v${version}`;
-  const { dirname } = require("path");
-  const appDir = dirname(require.main.filename);
-  let installDirectory = join(appDir, "binary");
-  if (overrideInstallDirectory != null && overrideInstallDirectory !== "") {
-    installDirectory = overrideInstallDirectory;
-  }
-  let binary = new Binary(
-    platform.BINARY_NAME,
-    platform.RAW_NAME,
-    url,
-    installDirectory,
-  );
-
-  // setting this allows us to extract supergraph plugins to the proper directory
-  // the variable itself is read in Rust code
-  process.env.APOLLO_NODE_MODULES_BIN_DIR = binary.installDirectory;
-  return binary;
-};
-
-const install = (suppressLogs = false) => {
-  const binary = getBinary();
-  // these messages are duplicated in `src/command/install/mod.rs`
-  // for the curl installer.
-  if (!suppressLogs) {
-    console.error(
-      "If you would like to disable Rover's anonymized usage collection, you can set APOLLO_TELEMETRY_DISABLED=true",
-    );
-    console.error(
-      "You can check out our documentation at https://go.apollo.dev/r/docs.",
-    );
-  }
-
-  return binary.install(suppressLogs);
-};
-
-const run = () => {
-  const binary = getBinary();
-  binary.run();
-};
-
-module.exports = {
-  install,
-  run,
-  getBinary,
-  getPlatform,
-  getProxyEnv,
-  shouldBypassProxy,
-};

package/install.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-
-const { install } = require("./binary");
-install();

package/run.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-
-const { run, install: maybeInstall } = require("./binary");
-maybeInstall(true).then(run);