@catladder/cli 0.0.0-next-78d43d4a → 0.0.0-next-6916db3c

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "0.0.0-next-78d43d4a",
+  "version": "0.0.0-next-6916db3c",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/catci.ts

@@ -29,8 +29,7 @@ import {
   githubQueuedGuardJob,
 } from "./release/githubQueuedRelease";
 import { npmPublishJob, parseNpmPublishArgs } from "./publish/npmPublishJob";
-
-const GITLAB_HOST = "https://git.panter.ch";
+import { getGitlabHostUrl } from "./utils/gitlabHost";
 
 const USAGE = `catci — catladder CI companion
 
@@ -129,7 +128,7 @@ const securityAuditCiJob = async (
   console.log("could not evaluate security audit document");
   console.log("creating new merge request with security audit template...");
 
-  const api = new Gitlab({ host: GITLAB_HOST, token });
+  const api = new Gitlab({ host: await getGitlabHostUrl(), token });
   const mr = await createSecurityAuditMergeRequest({
     api,
     mainBranch,

package/src/commands/project/commandGitlabCi.ts

@@ -2,6 +2,7 @@ import { exec } from "child-process-promise";
 import { last } from "lodash-es";
 import open from "open";
 import { defineCommand } from "../../core/defineCommand";
+import { getGitlabHostUrl } from "../../utils/gitlabHost";
 import {
   doGitlabRequest,
   getGitlabToken,
@@ -99,7 +100,7 @@ export const commandCiJobLog = defineCommand({
       const trace = await exec(
         `curl -s --header "PRIVATE-TOKEN: ${await getGitlabToken(
           ctx,
-        )}" "https://git.panter.ch/api/v4/projects/${projectId}/jobs/${id}/trace"`,
+        )}" "${await getGitlabHostUrl()}/api/v4/projects/${projectId}/jobs/${id}/trace"`,
       );
 
       const job = await doGitlabRequest(

package/src/commands/security/commandSecurityAuditCiJob.ts

@@ -8,8 +8,7 @@ import {
   createSecurityAuditMergeRequest,
   SECURITY_AUDIT_FILE_NAME,
 } from "../../security/createSecurityAuditMergeRequest";
-
-const GITLAB_HOST = "https://git.panter.ch";
+import { getGitlabHostUrl } from "../../utils/gitlabHost";
 
 export const commandSecurityAuditCiJob = defineCommand({
   name: "security audit ci-job",
@@ -52,7 +51,7 @@ export const commandSecurityAuditCiJob = defineCommand({
       const projectId = await ctx.get("projectId");
       const userId = await ctx.get("userId");
 
-      const api = new Gitlab({ host: GITLAB_HOST, token });
+      const api = new Gitlab({ host: await getGitlabHostUrl(), token });
 
       const mr = await createSecurityAuditMergeRequest({
         api,

package/src/commands/security/commandSecurityAuditCreate.ts

@@ -1,8 +1,7 @@
 import { defineCommand } from "../../core/defineCommand";
 import { Gitlab } from "@gitbeaker/rest";
 import { createSecurityAuditMergeRequest } from "../../security/createSecurityAuditMergeRequest";
-
-const GITLAB_HOST = "https://git.panter.ch";
+import { getGitlabHostUrl } from "../../utils/gitlabHost";
 
 export const commandSecurityAuditCreate = defineCommand({
   name: "security audit create",
@@ -36,7 +35,7 @@ export const commandSecurityAuditCreate = defineCommand({
     const projectId = await ctx.get("projectId");
     const userId = await ctx.get("userId");
 
-    const api = new Gitlab({ host: GITLAB_HOST, token });
+    const api = new Gitlab({ host: await getGitlabHostUrl(), token });
 
     const result = await createSecurityAuditMergeRequest({
       api,

package/src/publish/npmPublishJob.ts

@@ -74,12 +74,29 @@ const writeNpmrc = async (dir: string, registry: string) => {
   return npmrcPath;
 };
 
-const npmPublish = (dir: string, npmrcPath: string, args: string[]) =>
+/**
+ * whether the CI job can mint an OIDC token for npm trusted publishing.
+ * github actions exposes these two only when the job declares
+ * `permissions: id-token: write` (catladder sets it via the job's
+ * `idToken` flag).
+ */
+const hasOidcCredentials = () =>
+  !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL &&
+  !!process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+
+const npmPublish = (
+  dir: string,
+  npmrcPath: string | undefined,
+  args: string[],
+) =>
   new Promise<void>((resolvePromise, reject) => {
     const child = spawn("npm", ["publish", ...args], {
       cwd: dir,
       stdio: "inherit",
-      env: { ...process.env, NPM_CONFIG_USERCONFIG: npmrcPath },
+      env: {
+        ...process.env,
+        ...(npmrcPath ? { NPM_CONFIG_USERCONFIG: npmrcPath } : {}),
+      },
     });
     child.on("error", reject);
     child.on("exit", (code) =>
@@ -90,9 +107,10 @@ const npmPublish = (dir: string, npmrcPath: string, args: string[]) =>
   });
 
 export const npmPublishJob = async (options: NpmPublishJobOptions) => {
-  if (!process.env.NPM_TOKEN) {
+  const oidc = hasOidcCredentials();
+  if (!oidc && !process.env.NPM_TOKEN) {
     throw new Error(
-      "NPM_TOKEN is not set — configure it as a catladder secret for this component",
+      "NPM_TOKEN is not set — configure it as a catladder secret for this component, or publish from a workflow registered as a trusted publisher on npm",
     );
   }
   const registry = options.registry ?? DEFAULT_NPM_REGISTRY;
@@ -103,10 +121,18 @@ export const npmPublishJob = async (options: NpmPublishJobOptions) => {
   });
 
   const name = await setPackageVersion(options.dir, plan.version);
-  const npmrcPath = await writeNpmrc(options.dir, registry);
+  // with OIDC available npm mints its own short-lived credentials, and
+  // an .npmrc referencing an unset ${NPM_TOKEN} would only get in the
+  // way. A token, when present, still wins as the fallback.
+  const npmrcPath =
+    oidc && !process.env.NPM_TOKEN
+      ? undefined
+      : await writeNpmrc(options.dir, registry);
 
   console.log(
-    `publishing ${name}@${plan.version} (dist-tag ${plan.distTag}) to ${registry}`,
+    `publishing ${name}@${plan.version} (dist-tag ${plan.distTag}) to ${registry}${
+      npmrcPath ? "" : " via trusted publishing (OIDC)"
+    }`,
   );
   await npmPublish(options.dir, npmrcPath, [
     "--tag",

package/src/utils/gitlabHost.ts

@@ -0,0 +1,23 @@
+import { getGitRemoteHostAndPath } from "../git/gitProjectInformation";
+
+/**
+ * the base url of the gitlab instance this project lives on.
+ *
+ * Never hardcode an instance: catladder is used outside panter, and the
+ * host was baked in as https://git.panter.ch in several places, which
+ * silently broke every consumer on another gitlab.
+ *
+ * - in a gitlab CI job, `CI_SERVER_URL` is the authoritative value
+ *   (predefined, already includes the scheme)
+ * - locally, derive it from the git remote
+ *
+ * @param remoteName the remote to derive from outside CI (default origin)
+ */
+export const getGitlabHostUrl = async (remoteName = "origin") => {
+  const fromCi = process.env.CI_SERVER_URL;
+  if (fromCi) {
+    return fromCi.replace(/\/+$/, "");
+  }
+  const { gitRemoteHost } = await getGitRemoteHostAndPath(remoteName);
+  return `https://${gitRemoteHost}`;
+};