@bifravst/ci 2.1.1 → 2.1.2

package/LICENSE

@@ -1,6 +1,6 @@
 PBSD 3-Clause License
 
-Copyright (c) 2023-2025, Nordic Semiconductor ASA | nordicsemi.no
+Copyright (c) 2023-2026, Nordic Semiconductor ASA | nordicsemi.no
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

package/dist/{CIApp.d.ts → cdk/CIApp.d.ts}

@@ -1,5 +1,5 @@
 import { App } from 'aws-cdk-lib';
-import { CIStack } from './CIStack.js';
+import { CIStack } from './CIStack.ts';
 export declare class CIApp extends App {
     constructor(name: string, args: ConstructorParameters<typeof CIStack>[2]);
 }

package/dist/{CIApp.js → cdk/CIApp.js}

@@ -1,7 +1,7 @@
 import { App } from 'aws-cdk-lib';
 import { CIStack } from './CIStack.js';
 export class CIApp extends App {
-    constructor(name, args) {
+    constructor(name, args){
         super();
         new CIStack(this, name, args);
     }

package/dist/{CIStack.d.ts → cdk/CIStack.d.ts}

@@ -1,6 +1,6 @@
 import type { App } from 'aws-cdk-lib';
 import { Stack } from 'aws-cdk-lib';
-import type { Repos } from './listRepos.js';
+import type { Repos } from './listRepos.ts';
 export declare class CIStack extends Stack {
     constructor(parent: App, name: string, { repos, gitHubOICDProviderArn, }: {
         gitHubOICDProviderArn: string;

package/dist/{CIStack.js → cdk/CIStack.js}

@@ -1,17 +1,21 @@
 import { CfnOutput, Stack } from 'aws-cdk-lib';
 import { RepoPermission } from './RepoPermission.js';
 export class CIStack extends Stack {
-    constructor(parent, name, { repos, gitHubOICDProviderArn, }) {
+    constructor(parent, name, { repos, gitHubOICDProviderArn }){
         super(parent, name);
-        for (const { id, owner, name: repo } of repos) {
+        for (const { id, owner, name: repo } of repos){
             const perm = new RepoPermission(this, repo, {
-                repository: { id, owner, name: repo },
-                gitHubOICDProviderArn,
+                repository: {
+                    id,
+                    owner,
+                    name: repo
+                },
+                gitHubOICDProviderArn
             });
             new CfnOutput(this, `${id}:ciRoleArn`, {
                 exportName: `${name}:${id}:ciRoleArn`,
                 description: `Role ARN to use for running continuous integration tests using GitHub Actions in the repository ${owner}/${repo} (${id})`,
-                value: perm.role.roleArn,
+                value: perm.role.roleArn
             });
         }
     }

package/dist/{ContinuousDeployment.js → cdk/ContinuousDeployment.js}

@@ -2,7 +2,7 @@ import { Duration, aws_iam as IAM, Stack } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 export class ContinuousDeployment extends Construct {
     role;
-    constructor(parent, { repository: { owner, repo }, gitHubOICDProviderArn, environment, }) {
+    constructor(parent, { repository: { owner, repo }, gitHubOICDProviderArn, environment }){
         super(parent, 'cd');
         const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
         this.role = new IAM.Role(this, 'ghRole', {
@@ -10,14 +10,14 @@ export class ContinuousDeployment extends Construct {
             assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
                 StringEquals: {
                     [`token.actions.githubusercontent.com:sub`]: `repo:${owner}/${repo}:environment:${environment ?? 'production'}`,
-                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
-                },
+                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com'
+                }
             }),
             description: `This role is used by GitHub Actions to deploy ${Stack.of(this).stackName}`,
             maxSessionDuration: Duration.hours(1),
             managedPolicies: [
-                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
-            ],
+                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')
+            ]
         });
     }
 }

package/dist/{RepoPermission.d.ts → cdk/RepoPermission.d.ts}

@@ -1,6 +1,6 @@
 import { aws_iam as IAM } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
-import type { Repository } from './listRepos.js';
+import type { Repository } from './listRepos.ts';
 export declare class RepoPermission extends Construct {
     readonly role: IAM.IRole;
     constructor(parent: Construct, id: string, { repository, gitHubOICDProviderArn, }: {

package/dist/{RepoPermission.js → cdk/RepoPermission.js}

@@ -3,24 +3,24 @@ import { Construct } from 'constructs';
 import { sanitize } from './sanitize.js';
 export class RepoPermission extends Construct {
     role;
-    constructor(parent, id, { repository, gitHubOICDProviderArn, }) {
+    constructor(parent, id, { repository, gitHubOICDProviderArn }){
         super(parent, id);
         const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
         this.role = new IAM.Role(this, 'ghRole', {
             roleName: `${Stack.of(this).stackName}-${sanitize(repository.name)}`,
             assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
                 StringEquals: {
-                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
+                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com'
                 },
                 StringLike: {
-                    [`token.actions.githubusercontent.com:sub`]: `repo:${repository.owner}/${repository.name}:*`,
-                },
+                    [`token.actions.githubusercontent.com:sub`]: `repo:${repository.owner}/${repository.name}:*`
+                }
             }),
             description: `This role is used by GitHub Actions to run Continuous Integration Tests ${Stack.of(this).stackName} in the repository ${repository.owner}/${repository.name} (${repository.id}).`,
             maxSessionDuration: Duration.hours(1),
             managedPolicies: [
-                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
-            ],
+                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')
+            ]
         });
     }
 }

package/dist/{ci.js → cdk/ci.js}

@@ -5,16 +5,16 @@ import { ensureGitHubOIDCProvider } from './ensureGitHubOIDCProvider.js';
 import { listRepos } from './listRepos.js';
 import { loadRepoList } from './loadRepoList.js';
 const { token } = fromEnv({
-    token: 'GITHUB_TOKEN',
+    token: 'GITHUB_TOKEN'
 })(process.env);
 const repos = await listRepos(token, await loadRepoList(process.env.REPOS_LIST ?? './repos.txt'));
-for (const repo of repos) {
+for (const repo of repos){
     console.debug(`Setting up permissions for ${repo.name} (${repo.id})...`);
 }
 const iam = new IAMClient({});
 new CIApp(process.env.STACK_NAME ?? 'bifravst-ci', {
     gitHubOICDProviderArn: await ensureGitHubOIDCProvider({
-        iam,
+        iam
     }),
-    repos,
+    repos
 });

package/dist/cdk/ensureGitHubOIDCProvider.js

@@ -0,0 +1,39 @@
+import { CreateOpenIDConnectProviderCommand, GetOpenIDConnectProviderCommand, ListOpenIDConnectProvidersCommand } from '@aws-sdk/client-iam';
+import chalk from 'chalk';
+/**
+ * Returns the ARN of the OpenID Connect provider for GitHub of the account.
+ */ export const ensureGitHubOIDCProvider = async ({ iam })=>{
+    const { OpenIDConnectProviderList } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+    const maybeGithubProvider = (await Promise.all(OpenIDConnectProviderList?.map(async ({ Arn })=>iam.send(new GetOpenIDConnectProviderCommand({
+            OpenIDConnectProviderArn: Arn
+        })).then((provider)=>({
+                Arn,
+                provider
+            }))) ?? [])).find(({ provider: { Url } })=>Url === 'token.actions.githubusercontent.com');
+    if (maybeGithubProvider?.Arn !== undefined) {
+        console.debug(chalk.green(`OIDC provider for GitHub exists: ${maybeGithubProvider.Arn}`));
+        return maybeGithubProvider.Arn;
+    }
+    console.log(chalk.yellow(`OIDC provider for GitHub does not exist. Creating ...`));
+    const provider = await iam.send(new CreateOpenIDConnectProviderCommand({
+        Url: `https://token.actions.githubusercontent.com`,
+        ClientIDList: [
+            'sts.amazonaws.com'
+        ],
+        /**
+			 * Starting July 6, 2023, AWS began securing communication with
+			 * GitHub’s OIDC identity provider (IdP) using our library of
+			 * trusted root Certificate Authorities instead of using a
+			 * certificate thumbprint to verify the IdP’s server certificate.
+			 * This approach ensures that your GitHub OIDC configuration behaves
+			 * correctly without disruption during future certificate rotations
+			 * and changes. With this new validation approach in place, your
+			 * legacy thumbprint(s) will remain in your configuration but will
+			 * no longer be needed for validation purposes.
+			 */ ThumbprintList: [
+            '6938fd4d98bab03faadb97b34396831e3780aea1'
+        ]
+    }));
+    if (provider.OpenIDConnectProviderArn === undefined) throw new Error(`Failed to create OpenID Connect Provider for GitHub!`);
+    return provider.OpenIDConnectProviderArn;
+};

package/dist/cdk/index.d.ts

@@ -0,0 +1,3 @@
+export * from './ContinuousDeployment.ts';
+export * from './ensureGitHubOIDCProvider.ts';
+export * from './RepoPermission.ts';

package/dist/{listRepos.d.ts → cdk/listRepos.d.ts}

@@ -4,4 +4,4 @@ export type Repository = {
     id: number;
 };
 export type Repos = Array<Repository>;
-export declare const listRepos: (token: string, repos: Array<Omit<Repository, "id">>) => Promise<Array<Repository>>;
+export declare const listRepos: (token: string, repos: Array<Omit<Repository, 'id'>>) => Promise<Array<Repository>>;

package/dist/cdk/listRepos.js

@@ -0,0 +1,14 @@
+import { Octokit } from '@octokit/rest';
+export const listRepos = async (token, repos)=>{
+    const client = new Octokit({
+        auth: token
+    });
+    return (await Promise.all(repos.map(async (repo)=>client.repos.get({
+            repo: repo.name,
+            owner: repo.owner
+        })))).map((res)=>res.data).filter((repo)=>repo.archived !== true).map((repo)=>({
+            id: repo.id,
+            name: repo.name,
+            owner: repo.full_name.split('/')[0]
+        }));
+};

package/dist/cdk/loadRepoList.d.ts

@@ -0,0 +1,2 @@
+import type { Repository } from './listRepos.ts';
+export declare const loadRepoList: (location: string) => Promise<Array<Omit<Repository, 'id'>>>;

package/dist/cdk/loadRepoList.js

@@ -0,0 +1,8 @@
+import { readFile } from 'node:fs/promises';
+export const loadRepoList = async (location)=>(await readFile(location, 'utf-8')).trim().split('\n').filter((s)=>!s.startsWith('#')).map((s)=>{
+        const [owner, name] = s.split('/');
+        return {
+            owner,
+            name
+        };
+    });

package/dist/cdk/sanitize.js

@@ -0,0 +1 @@
+export const sanitize = (s)=>s.replace(/[^a-z0-9-]/g, '');

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@bifravst/ci",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "Sets up the permissions in our CI account for all repositories in this account to be able to use it for CI runs.",
   "exports": {
     ".": {
       "import": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
+        "types": "./dist/cdk/index.d.ts",
+        "default": "./dist/cdk/index.js"
       }
     }
   },
   "type": "module",
   "scripts": {
-    "prepare": "husky && check-node-version --package",
-    "test": "npx globstar -- npx tsx --test --test-reporter spec \"!(node_modules)/**/*.spec.ts\"",
-    "prepublishOnly": "npx tsc --noEmit false --outDir ./dist -d"
+    "prepare": "husky && case \"$npm_command\" in install|ci) check-node-version --package ;; esac",
+    "test": "node --no-warnings --experimental-transform-types --test \"!(node_modules)/**/*.spec.ts\"",
+    "prepublishOnly": "node --experimental-strip-types ./.npm/compile.ts && npx tsc -P ./.npm/tsconfig.npm.json --outDir ./dist"
   },
   "repository": {
     "type": "git",
@@ -34,21 +34,24 @@
   "author": "Nordic Semiconductor ASA | nordicsemi.no",
   "license": "BSD-3-Clause",
   "devDependencies": {
-    "@bifravst/eslint-config-typescript": "6.1.21",
+    "@bifravst/eslint-config-typescript": "7.0.32",
     "@bifravst/from-env": "3.0.2",
-    "@bifravst/prettier-config": "1.1.8",
-    "@commitlint/config-conventional": "19.8.0",
-    "@octokit/rest": "21.1.1",
-    "aws-cdk": "2.1004.0",
-    "aws-cdk-lib": "2.184.1",
-    "cdk": "2.1004.0",
+    "@bifravst/prettier-config": "1.1.17",
+    "@commitlint/config-conventional": "21.2.0",
+    "@octokit/rest": "22.0.1",
+    "@swc/core": "1.15.47",
+    "@types/node": "26.1.2",
+    "@typescript/native": "npm:typescript@7.0.2",
+    "aws-cdk": "2.1135.0",
+    "aws-cdk-lib": "2.263.0",
+    "cdk": "2.1135.0",
     "check-node-version": "4.2.1",
-    "commitlint": "19.8.0",
-    "constructs": "10.4.2",
+    "commitlint": "21.2.1",
+    "constructs": "10.8.1",
     "globstar": "1.0.0",
     "husky": "9.1.7",
-    "lint-staged": "15.5.0",
-    "tsx": "4.19.3"
+    "lint-staged": "17.3.0",
+    "typescript": "npm:@typescript/typescript6@6.0.2"
   },
   "lint-staged": {
     "*.{md,json,yaml,yml}": [
@@ -60,8 +63,8 @@
     ]
   },
   "engines": {
-    "node": ">=22",
-    "npm": ">=9"
+    "node": ">=24.18.1 <25",
+    "npm": ">=12.0.2 <13"
   },
   "release": {
     "branches": [
@@ -96,7 +99,7 @@
   ],
   "prettier": "@bifravst/prettier-config",
   "peerDependencies": {
-    "@aws-sdk/client-iam": "^3.758.0",
-    "chalk": "^5.4.1"
+    "@aws-sdk/client-iam": "^3.1031.0",
+    "chalk": "^5.6.2"
   }
 }

package/dist/ensureGitHubOIDCProvider.js

@@ -1,37 +0,0 @@
-import { CreateOpenIDConnectProviderCommand, GetOpenIDConnectProviderCommand, ListOpenIDConnectProvidersCommand, } from '@aws-sdk/client-iam';
-import chalk from 'chalk';
-/**
- * Returns the ARN of the OpenID Connect provider for GitHub of the account.
- */
-export const ensureGitHubOIDCProvider = async ({ iam, }) => {
-    const { OpenIDConnectProviderList } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
-    const maybeGithubProvider = (await Promise.all(OpenIDConnectProviderList?.map(async ({ Arn }) => iam
-        .send(new GetOpenIDConnectProviderCommand({
-        OpenIDConnectProviderArn: Arn,
-    }))
-        .then((provider) => ({ Arn, provider }))) ?? [])).find(({ provider: { Url } }) => Url === 'token.actions.githubusercontent.com');
-    if (maybeGithubProvider?.Arn !== undefined) {
-        console.debug(chalk.green(`OIDC provider for GitHub exists: ${maybeGithubProvider.Arn}`));
-        return maybeGithubProvider.Arn;
-    }
-    console.log(chalk.yellow(`OIDC provider for GitHub does not exist. Creating ...`));
-    const provider = await iam.send(new CreateOpenIDConnectProviderCommand({
-        Url: `https://token.actions.githubusercontent.com`,
-        ClientIDList: ['sts.amazonaws.com'],
-        /**
-         * Starting July 6, 2023, AWS began securing communication with
-         * GitHub’s OIDC identity provider (IdP) using our library of
-         * trusted root Certificate Authorities instead of using a
-         * certificate thumbprint to verify the IdP’s server certificate.
-         * This approach ensures that your GitHub OIDC configuration behaves
-         * correctly without disruption during future certificate rotations
-         * and changes. With this new validation approach in place, your
-         * legacy thumbprint(s) will remain in your configuration but will
-         * no longer be needed for validation purposes.
-         */
-        ThumbprintList: ['6938fd4d98bab03faadb97b34396831e3780aea1'],
-    }));
-    if (provider.OpenIDConnectProviderArn === undefined)
-        throw new Error(`Failed to create OpenID Connect Provider for GitHub!`);
-    return provider.OpenIDConnectProviderArn;
-};

package/dist/index.d.ts

@@ -1,3 +0,0 @@
-export * from './ContinuousDeployment.js';
-export * from './ensureGitHubOIDCProvider.js';
-export * from './RepoPermission.js';

package/dist/listRepos.js

@@ -1,17 +0,0 @@
-import { Octokit } from '@octokit/rest';
-export const listRepos = async (token, repos) => {
-    const client = new Octokit({
-        auth: token,
-    });
-    return (await Promise.all(repos.map(async (repo) => client.repos.get({
-        repo: repo.name,
-        owner: repo.owner,
-    }))))
-        .map((res) => res.data)
-        .filter((repo) => repo.archived !== true)
-        .map((repo) => ({
-        id: repo.id,
-        name: repo.name,
-        owner: repo.full_name.split('/')[0],
-    }));
-};

package/dist/loadRepoList.d.ts

@@ -1,2 +0,0 @@
-import type { Repository } from './listRepos.js';
-export declare const loadRepoList: (location: string) => Promise<Array<Omit<Repository, "id">>>;

package/dist/loadRepoList.js

@@ -1,9 +0,0 @@
-import { readFile } from 'node:fs/promises';
-export const loadRepoList = async (location) => (await readFile(location, 'utf-8'))
-    .trim()
-    .split('\n')
-    .filter((s) => !s.startsWith('#'))
-    .map((s) => {
-    const [owner, name] = s.split('/');
-    return { owner, name };
-});

package/dist/loadRepoList.spec.js

@@ -1,18 +0,0 @@
-import assert from 'node:assert/strict';
-import path from 'node:path';
-import { describe, it } from 'node:test';
-import { loadRepoList } from './loadRepoList.js';
-void describe('loadRepoList()', () => {
-    void it('should load the list of repos', async () => {
-        assert.deepEqual(await loadRepoList(path.join(process.cwd(), 'cdk', 'test', 'repos.txt')), [
-            {
-                name: 'ci',
-                owner: 'bifravst',
-            },
-            {
-                name: 'aws-cdk-ecr-helpers',
-                owner: 'bifravst',
-            },
-        ]);
-    });
-});

package/dist/sanitize.js

@@ -1 +0,0 @@
-export const sanitize = (s) => s.replace(/[^a-z0-9-]/g, '');