@bifravst/ci 2.1.2 → 3.0.0

package/README.md

@@ -20,3 +20,19 @@ file.
 ```bash
 npx cdk deploy
 ```
+
+## Node & NPM
+
+This project requires Node.js `>=24.18.1 <25` and npm `>=12.0.2 <13` (enforced
+via `check-node-version` on `npm install` and `npm ci`).
+
+The check is skipped during `npm publish` and `npm pack`, because
+`semantic-release` bundles its own npm (`@semantic-release/npm` depends on
+`npm@^11.6.2`) and runs the publish with that version rather than the one
+installed in CI.
+
+## TypeScript 6 and 7
+
+This repo
+[runs TypeScript 6 and 7 side by side](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/#running-side-by-side-with-typescript-6.0),
+[so that eslint works](https://github.com/typescript-eslint/typescript-eslint/issues/10940#issuecomment-4922812181).

package/dist/{cdk/CIApp.js → CIApp.js}

@@ -1,7 +1,7 @@
 import { App } from 'aws-cdk-lib';
 import { CIStack } from './CIStack.js';
 export class CIApp extends App {
-    constructor(name, args){
+    constructor(name, args) {
         super();
         new CIStack(this, name, args);
     }

package/dist/{cdk/CIStack.js → CIStack.js}

@@ -1,21 +1,17 @@
 import { CfnOutput, Stack } from 'aws-cdk-lib';
 import { RepoPermission } from './RepoPermission.js';
 export class CIStack extends Stack {
-    constructor(parent, name, { repos, gitHubOICDProviderArn }){
+    constructor(parent, name, { repos, gitHubOICDProviderArn, }) {
         super(parent, name);
-        for (const { id, owner, name: repo } of repos){
+        for (const { id, owner, name: repo } of repos) {
             const perm = new RepoPermission(this, repo, {
-                repository: {
-                    id,
-                    owner,
-                    name: repo
-                },
-                gitHubOICDProviderArn
+                repository: { id, owner, name: repo },
+                gitHubOICDProviderArn,
             });
             new CfnOutput(this, `${id}:ciRoleArn`, {
                 exportName: `${name}:${id}:ciRoleArn`,
                 description: `Role ARN to use for running continuous integration tests using GitHub Actions in the repository ${owner}/${repo} (${id})`,
-                value: perm.role.roleArn
+                value: perm.role.roleArn,
             });
         }
     }

package/dist/{cdk/ContinuousDeployment.js → ContinuousDeployment.js}

@@ -2,7 +2,7 @@ import { Duration, aws_iam as IAM, Stack } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 export class ContinuousDeployment extends Construct {
     role;
-    constructor(parent, { repository: { owner, repo }, gitHubOICDProviderArn, environment }){
+    constructor(parent, { repository: { owner, repo }, gitHubOICDProviderArn, environment, }) {
         super(parent, 'cd');
         const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
         this.role = new IAM.Role(this, 'ghRole', {
@@ -10,14 +10,14 @@ export class ContinuousDeployment extends Construct {
             assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
                 StringEquals: {
                     [`token.actions.githubusercontent.com:sub`]: `repo:${owner}/${repo}:environment:${environment ?? 'production'}`,
-                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com'
-                }
+                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
+                },
             }),
             description: `This role is used by GitHub Actions to deploy ${Stack.of(this).stackName}`,
             maxSessionDuration: Duration.hours(1),
             managedPolicies: [
-                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')
-            ]
+                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
+            ],
         });
     }
 }

package/dist/{cdk/RepoPermission.js → RepoPermission.js}

@@ -3,24 +3,24 @@ import { Construct } from 'constructs';
 import { sanitize } from './sanitize.js';
 export class RepoPermission extends Construct {
     role;
-    constructor(parent, id, { repository, gitHubOICDProviderArn }){
+    constructor(parent, id, { repository, gitHubOICDProviderArn, }) {
         super(parent, id);
         const gitHubOIDC = IAM.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, 'gitHubOICDProvider', gitHubOICDProviderArn);
         this.role = new IAM.Role(this, 'ghRole', {
             roleName: `${Stack.of(this).stackName}-${sanitize(repository.name)}`,
             assumedBy: new IAM.WebIdentityPrincipal(gitHubOIDC.openIdConnectProviderArn, {
                 StringEquals: {
-                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com'
+                    [`token.actions.githubusercontent.com:aud`]: 'sts.amazonaws.com',
                 },
                 StringLike: {
-                    [`token.actions.githubusercontent.com:sub`]: `repo:${repository.owner}/${repository.name}:*`
-                }
+                    [`token.actions.githubusercontent.com:sub`]: `repo:${repository.owner}/${repository.name}:*`,
+                },
             }),
             description: `This role is used by GitHub Actions to run Continuous Integration Tests ${Stack.of(this).stackName} in the repository ${repository.owner}/${repository.name} (${repository.id}).`,
             maxSessionDuration: Duration.hours(1),
             managedPolicies: [
-                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')
-            ]
+                IAM.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess'),
+            ],
         });
     }
 }

package/dist/{cdk/ci.js → ci.js}

@@ -5,16 +5,16 @@ import { ensureGitHubOIDCProvider } from './ensureGitHubOIDCProvider.js';
 import { listRepos } from './listRepos.js';
 import { loadRepoList } from './loadRepoList.js';
 const { token } = fromEnv({
-    token: 'GITHUB_TOKEN'
+    token: 'GITHUB_TOKEN',
 })(process.env);
 const repos = await listRepos(token, await loadRepoList(process.env.REPOS_LIST ?? './repos.txt'));
-for (const repo of repos){
+for (const repo of repos) {
     console.debug(`Setting up permissions for ${repo.name} (${repo.id})...`);
 }
 const iam = new IAMClient({});
 new CIApp(process.env.STACK_NAME ?? 'bifravst-ci', {
     gitHubOICDProviderArn: await ensureGitHubOIDCProvider({
-        iam
+        iam,
     }),
-    repos
+    repos,
 });

package/dist/ensureGitHubOIDCProvider.js

@@ -0,0 +1,37 @@
+import { CreateOpenIDConnectProviderCommand, GetOpenIDConnectProviderCommand, ListOpenIDConnectProvidersCommand, } from '@aws-sdk/client-iam';
+import chalk from 'chalk';
+/**
+ * Returns the ARN of the OpenID Connect provider for GitHub of the account.
+ */
+export const ensureGitHubOIDCProvider = async ({ iam, }) => {
+    const { OpenIDConnectProviderList } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
+    const maybeGithubProvider = (await Promise.all(OpenIDConnectProviderList?.map(async ({ Arn }) => iam
+        .send(new GetOpenIDConnectProviderCommand({
+        OpenIDConnectProviderArn: Arn,
+    }))
+        .then((provider) => ({ Arn, provider }))) ?? [])).find(({ provider: { Url } }) => Url === 'token.actions.githubusercontent.com');
+    if (maybeGithubProvider?.Arn !== undefined) {
+        console.debug(chalk.green(`OIDC provider for GitHub exists: ${maybeGithubProvider.Arn}`));
+        return maybeGithubProvider.Arn;
+    }
+    console.log(chalk.yellow(`OIDC provider for GitHub does not exist. Creating ...`));
+    const provider = await iam.send(new CreateOpenIDConnectProviderCommand({
+        Url: `https://token.actions.githubusercontent.com`,
+        ClientIDList: ['sts.amazonaws.com'],
+        /**
+         * Starting July 6, 2023, AWS began securing communication with
+         * GitHub’s OIDC identity provider (IdP) using our library of
+         * trusted root Certificate Authorities instead of using a
+         * certificate thumbprint to verify the IdP’s server certificate.
+         * This approach ensures that your GitHub OIDC configuration behaves
+         * correctly without disruption during future certificate rotations
+         * and changes. With this new validation approach in place, your
+         * legacy thumbprint(s) will remain in your configuration but will
+         * no longer be needed for validation purposes.
+         */
+        ThumbprintList: ['6938fd4d98bab03faadb97b34396831e3780aea1'],
+    }));
+    if (provider.OpenIDConnectProviderArn === undefined)
+        throw new Error(`Failed to create OpenID Connect Provider for GitHub!`);
+    return provider.OpenIDConnectProviderArn;
+};

package/dist/listRepos.js

@@ -0,0 +1,17 @@
+import { Octokit } from '@octokit/rest';
+export const listRepos = async (token, repos) => {
+    const client = new Octokit({
+        auth: token,
+    });
+    return (await Promise.all(repos.map(async (repo) => client.repos.get({
+        repo: repo.name,
+        owner: repo.owner,
+    }))))
+        .map((res) => res.data)
+        .filter((repo) => repo.archived !== true)
+        .map((repo) => ({
+        id: repo.id,
+        name: repo.name,
+        owner: repo.full_name.split('/')[0],
+    }));
+};

package/dist/loadRepoList.js

@@ -0,0 +1,9 @@
+import { readFile } from 'node:fs/promises';
+export const loadRepoList = async (location) => (await readFile(location, 'utf-8'))
+    .trim()
+    .split('\n')
+    .filter((s) => !s.startsWith('#'))
+    .map((s) => {
+    const [owner, name] = s.split('/');
+    return { owner, name };
+});

package/dist/loadRepoList.spec.js

@@ -0,0 +1,18 @@
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { loadRepoList } from './loadRepoList.js';
+void describe('loadRepoList()', () => {
+    void it('should load the list of repos', async () => {
+        assert.deepEqual(await loadRepoList(path.join(process.cwd(), 'cdk', 'test', 'repos.txt')), [
+            {
+                name: 'ci',
+                owner: 'bifravst',
+            },
+            {
+                name: 'aws-cdk-ecr-helpers',
+                owner: 'bifravst',
+            },
+        ]);
+    });
+});

package/dist/sanitize.js

@@ -0,0 +1 @@
+export const sanitize = (s) => s.replace(/[^a-z0-9-]/g, '');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bifravst/ci",
-  "version": "2.1.2",
+  "version": "3.0.0",
   "description": "Sets up the permissions in our CI account for all repositories in this account to be able to use it for CI runs.",
   "exports": {
     ".": {
@@ -14,7 +14,7 @@
   "scripts": {
     "prepare": "husky && case \"$npm_command\" in install|ci) check-node-version --package ;; esac",
     "test": "node --no-warnings --experimental-transform-types --test \"!(node_modules)/**/*.spec.ts\"",
-    "prepublishOnly": "node --experimental-strip-types ./.npm/compile.ts && npx tsc -P ./.npm/tsconfig.npm.json --outDir ./dist"
+    "prepublishOnly": "npx tsc --noEmit false -d"
   },
   "repository": {
     "type": "git",
@@ -34,19 +34,18 @@
   "author": "Nordic Semiconductor ASA | nordicsemi.no",
   "license": "BSD-3-Clause",
   "devDependencies": {
-    "@bifravst/eslint-config-typescript": "7.0.32",
-    "@bifravst/from-env": "3.0.2",
-    "@bifravst/prettier-config": "1.1.17",
-    "@commitlint/config-conventional": "21.2.0",
+    "@bifravst/eslint-config-typescript": "8.0.0",
+    "@bifravst/from-env": "4.0.0",
+    "@bifravst/prettier-config": "2.0.0",
+    "@commitlint/config-conventional": "21.2.2",
     "@octokit/rest": "22.0.1",
-    "@swc/core": "1.15.47",
-    "@types/node": "26.1.2",
+    "@types/node": "26.2.0",
     "@typescript/native": "npm:typescript@7.0.2",
-    "aws-cdk": "2.1135.0",
-    "aws-cdk-lib": "2.263.0",
-    "cdk": "2.1135.0",
+    "aws-cdk": "2.1136.0",
+    "aws-cdk-lib": "2.265.0",
+    "cdk": "2.1136.0",
     "check-node-version": "4.2.1",
-    "commitlint": "21.2.1",
+    "commitlint": "21.2.2",
     "constructs": "10.8.1",
     "globstar": "1.0.0",
     "husky": "9.1.7",
@@ -99,7 +98,7 @@
   ],
   "prettier": "@bifravst/prettier-config",
   "peerDependencies": {
-    "@aws-sdk/client-iam": "^3.1031.0",
-    "chalk": "^5.6.2"
+    "@aws-sdk/client-iam": ">=3.1111.0 <4",
+    "chalk": "6.x"
   }
 }

package/dist/cdk/ensureGitHubOIDCProvider.js

@@ -1,39 +0,0 @@
-import { CreateOpenIDConnectProviderCommand, GetOpenIDConnectProviderCommand, ListOpenIDConnectProvidersCommand } from '@aws-sdk/client-iam';
-import chalk from 'chalk';
-/**
- * Returns the ARN of the OpenID Connect provider for GitHub of the account.
- */ export const ensureGitHubOIDCProvider = async ({ iam })=>{
-    const { OpenIDConnectProviderList } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
-    const maybeGithubProvider = (await Promise.all(OpenIDConnectProviderList?.map(async ({ Arn })=>iam.send(new GetOpenIDConnectProviderCommand({
-            OpenIDConnectProviderArn: Arn
-        })).then((provider)=>({
-                Arn,
-                provider
-            }))) ?? [])).find(({ provider: { Url } })=>Url === 'token.actions.githubusercontent.com');
-    if (maybeGithubProvider?.Arn !== undefined) {
-        console.debug(chalk.green(`OIDC provider for GitHub exists: ${maybeGithubProvider.Arn}`));
-        return maybeGithubProvider.Arn;
-    }
-    console.log(chalk.yellow(`OIDC provider for GitHub does not exist. Creating ...`));
-    const provider = await iam.send(new CreateOpenIDConnectProviderCommand({
-        Url: `https://token.actions.githubusercontent.com`,
-        ClientIDList: [
-            'sts.amazonaws.com'
-        ],
-        /**
-			 * Starting July 6, 2023, AWS began securing communication with
-			 * GitHub’s OIDC identity provider (IdP) using our library of
-			 * trusted root Certificate Authorities instead of using a
-			 * certificate thumbprint to verify the IdP’s server certificate.
-			 * This approach ensures that your GitHub OIDC configuration behaves
-			 * correctly without disruption during future certificate rotations
-			 * and changes. With this new validation approach in place, your
-			 * legacy thumbprint(s) will remain in your configuration but will
-			 * no longer be needed for validation purposes.
-			 */ ThumbprintList: [
-            '6938fd4d98bab03faadb97b34396831e3780aea1'
-        ]
-    }));
-    if (provider.OpenIDConnectProviderArn === undefined) throw new Error(`Failed to create OpenID Connect Provider for GitHub!`);
-    return provider.OpenIDConnectProviderArn;
-};

package/dist/cdk/listRepos.js

@@ -1,14 +0,0 @@
-import { Octokit } from '@octokit/rest';
-export const listRepos = async (token, repos)=>{
-    const client = new Octokit({
-        auth: token
-    });
-    return (await Promise.all(repos.map(async (repo)=>client.repos.get({
-            repo: repo.name,
-            owner: repo.owner
-        })))).map((res)=>res.data).filter((repo)=>repo.archived !== true).map((repo)=>({
-            id: repo.id,
-            name: repo.name,
-            owner: repo.full_name.split('/')[0]
-        }));
-};

package/dist/cdk/loadRepoList.js

@@ -1,8 +0,0 @@
-import { readFile } from 'node:fs/promises';
-export const loadRepoList = async (location)=>(await readFile(location, 'utf-8')).trim().split('\n').filter((s)=>!s.startsWith('#')).map((s)=>{
-        const [owner, name] = s.split('/');
-        return {
-            owner,
-            name
-        };
-    });

package/dist/cdk/sanitize.js

@@ -1 +0,0 @@
-export const sanitize = (s)=>s.replace(/[^a-z0-9-]/g, '');