@catladder/cli 0.0.0-next-78d43d4a → 0.0.0-next-dbb75f51

package/includes/envrc

@@ -1,5 +1,5 @@
 # adjust this file to your needs
-# find a current recommended version here: https://git.panter.ch/panter/catladder2/-/blob/master/includes/envrc
+# find a current recommended version here: https://github.com/panter/catladder/blob/main/apps/cli/includes/envrc
 
 # if catladder is available, invoke that
 if hash catladder 2>/dev/null; then

package/package.json

@@ -2,12 +2,12 @@
   "name": "@catladder/cli",
   "description": "Panter cli tool for cloud CI/CD and DevOps",
   "author": "Marco Wettstein <maw@panter.ch>",
-  "homepage": "https://catladder.git.panter.biz/catladder/docs",
-  "bugs": "https://git.panter.ch/catladder/catladder/issues",
-  "readme": "https://git.panter.ch/catladder/catladder/-/blob/main/cli/README.md",
+  "homepage": "https://panter.github.io/catladder/docs",
+  "bugs": "https://github.com/panter/catladder/issues",
+  "readme": "https://github.com/panter/catladder/blob/main/apps/cli/README.md",
   "repository": {
     "type": "git",
-    "url": "git+https://git.panter.ch/catladder/catladder.git",
+    "url": "git+https://github.com/panter/catladder.git",
     "directory": "apps/cli"
   },
   "keywords": [
@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "0.0.0-next-78d43d4a",
+  "version": "0.0.0-next-dbb75f51",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/catci.ts

@@ -29,8 +29,7 @@ import {
   githubQueuedGuardJob,
 } from "./release/githubQueuedRelease";
 import { npmPublishJob, parseNpmPublishArgs } from "./publish/npmPublishJob";
-
-const GITLAB_HOST = "https://git.panter.ch";
+import { getGitlabHostUrl } from "./utils/gitlabHost";
 
 const USAGE = `catci — catladder CI companion
 
@@ -129,7 +128,7 @@ const securityAuditCiJob = async (
   console.log("could not evaluate security audit document");
   console.log("creating new merge request with security audit template...");
 
-  const api = new Gitlab({ host: GITLAB_HOST, token });
+  const api = new Gitlab({ host: await getGitlabHostUrl(), token });
   const mr = await createSecurityAuditMergeRequest({
     api,
     mainBranch,

package/src/commands/project/commandGitlabCi.ts

@@ -2,6 +2,7 @@ import { exec } from "child-process-promise";
 import { last } from "lodash-es";
 import open from "open";
 import { defineCommand } from "../../core/defineCommand";
+import { getGitlabHostUrl } from "../../utils/gitlabHost";
 import {
   doGitlabRequest,
   getGitlabToken,
@@ -99,7 +100,7 @@ export const commandCiJobLog = defineCommand({
       const trace = await exec(
         `curl -s --header "PRIVATE-TOKEN: ${await getGitlabToken(
           ctx,
-        )}" "https://git.panter.ch/api/v4/projects/${projectId}/jobs/${id}/trace"`,
+        )}" "${await getGitlabHostUrl()}/api/v4/projects/${projectId}/jobs/${id}/trace"`,
       );
 
       const job = await doGitlabRequest(

package/src/commands/security/commandSecurityAuditCiJob.ts

@@ -8,8 +8,7 @@ import {
   createSecurityAuditMergeRequest,
   SECURITY_AUDIT_FILE_NAME,
 } from "../../security/createSecurityAuditMergeRequest";
-
-const GITLAB_HOST = "https://git.panter.ch";
+import { getGitlabHostUrl } from "../../utils/gitlabHost";
 
 export const commandSecurityAuditCiJob = defineCommand({
   name: "security audit ci-job",
@@ -52,7 +51,7 @@ export const commandSecurityAuditCiJob = defineCommand({
       const projectId = await ctx.get("projectId");
       const userId = await ctx.get("userId");
 
-      const api = new Gitlab({ host: GITLAB_HOST, token });
+      const api = new Gitlab({ host: await getGitlabHostUrl(), token });
 
       const mr = await createSecurityAuditMergeRequest({
         api,

package/src/commands/security/commandSecurityAuditCreate.ts

@@ -1,8 +1,7 @@
 import { defineCommand } from "../../core/defineCommand";
 import { Gitlab } from "@gitbeaker/rest";
 import { createSecurityAuditMergeRequest } from "../../security/createSecurityAuditMergeRequest";
-
-const GITLAB_HOST = "https://git.panter.ch";
+import { getGitlabHostUrl } from "../../utils/gitlabHost";
 
 export const commandSecurityAuditCreate = defineCommand({
   name: "security audit create",
@@ -36,7 +35,7 @@ export const commandSecurityAuditCreate = defineCommand({
     const projectId = await ctx.get("projectId");
     const userId = await ctx.get("userId");
 
-    const api = new Gitlab({ host: GITLAB_HOST, token });
+    const api = new Gitlab({ host: await getGitlabHostUrl(), token });
 
     const result = await createSecurityAuditMergeRequest({
       api,

package/src/publish/npmPublishJob.ts

@@ -74,12 +74,29 @@ const writeNpmrc = async (dir: string, registry: string) => {
   return npmrcPath;
 };
 
-const npmPublish = (dir: string, npmrcPath: string, args: string[]) =>
+/**
+ * whether the CI job can mint an OIDC token for npm trusted publishing.
+ * github actions exposes these two only when the job declares
+ * `permissions: id-token: write` (catladder sets it via the job's
+ * `idToken` flag).
+ */
+const hasOidcCredentials = () =>
+  !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL &&
+  !!process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+
+const npmPublish = (
+  dir: string,
+  npmrcPath: string | undefined,
+  args: string[],
+) =>
   new Promise<void>((resolvePromise, reject) => {
     const child = spawn("npm", ["publish", ...args], {
       cwd: dir,
       stdio: "inherit",
-      env: { ...process.env, NPM_CONFIG_USERCONFIG: npmrcPath },
+      env: {
+        ...process.env,
+        ...(npmrcPath ? { NPM_CONFIG_USERCONFIG: npmrcPath } : {}),
+      },
     });
     child.on("error", reject);
     child.on("exit", (code) =>
@@ -90,9 +107,10 @@ const npmPublish = (dir: string, npmrcPath: string, args: string[]) =>
   });
 
 export const npmPublishJob = async (options: NpmPublishJobOptions) => {
-  if (!process.env.NPM_TOKEN) {
+  const oidc = hasOidcCredentials();
+  if (!oidc && !process.env.NPM_TOKEN) {
     throw new Error(
-      "NPM_TOKEN is not set — configure it as a catladder secret for this component",
+      "NPM_TOKEN is not set — configure it as a catladder secret for this component, or publish from a workflow registered as a trusted publisher on npm",
     );
   }
   const registry = options.registry ?? DEFAULT_NPM_REGISTRY;
@@ -103,10 +121,18 @@ export const npmPublishJob = async (options: NpmPublishJobOptions) => {
   });
 
   const name = await setPackageVersion(options.dir, plan.version);
-  const npmrcPath = await writeNpmrc(options.dir, registry);
+  // with OIDC available npm mints its own short-lived credentials, and
+  // an .npmrc referencing an unset ${NPM_TOKEN} would only get in the
+  // way. A token, when present, still wins as the fallback.
+  const npmrcPath =
+    oidc && !process.env.NPM_TOKEN
+      ? undefined
+      : await writeNpmrc(options.dir, registry);
 
   console.log(
-    `publishing ${name}@${plan.version} (dist-tag ${plan.distTag}) to ${registry}`,
+    `publishing ${name}@${plan.version} (dist-tag ${plan.distTag}) to ${registry}${
+      npmrcPath ? "" : " via trusted publishing (OIDC)"
+    }`,
   );
   await npmPublish(options.dir, npmrcPath, [
     "--tag",

package/src/security/topics.json

@@ -17,67 +17,67 @@
   {
     "description": "No sensitive information (passwords, keys, user data, ...) is logged or traced",
     "responsibles": 1,
-    "more": "[Logging guide](https://www.notion.so/panterch/Long-story-logging-022722bb878f4724ae5b49e17667b630?pvs=4#9e5a36b7158a4953b73ec6a345bd8989), [Tracing guide](https://www.notion.so/panterch/Long-story-tracing-d8a9ec1ac2ff4fa78cefa8991233224e?pvs=4#535121b5bf9741fbaf8654b4b64d879d)"
+    "more": ""
   },
   {
     "description": "Passwords are stored hashed with salt and salt is not stored in the repository",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/hash.md)"
+    "more": ""
   },
   {
     "description": "Input that ends up in DOM is properly sanitized",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/xss.md)"
+    "more": ""
   },
   {
     "description": "All user inputs have reasonable validations",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/validation.md)"
+    "more": ""
   },
   {
     "description": "The app is not using cookies",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
+    "more": ""
   },
   {
     "description": "The app is using cookies and cookies are properly configured",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
+    "more": ""
   },
   {
     "description": "The app uses JWT with a secret and the secret is not stored in the repository",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
+    "more": ""
   },
   {
     "description": "Authorization and user roles (RBAC) were reviewed thoroughly",
     "responsibles": 2,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/authorization.md)"
+    "more": ""
   },
   {
     "description": "CORS headers do not use `*`",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cors.md)"
+    "more": ""
   },
   {
     "description": "CSP headers are properly configured (no `unsafe-inline` or `unsafe-eval`)",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/csp.md)"
+    "more": ""
   },
   {
     "description": "DoS defense mechanism is implemented",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/dos.md)"
+    "more": ""
   },
   {
     "description": "YAML/XML parsing is not used or used YAML/XML parsers have disabled DTD",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/dos.md)"
+    "more": ""
   },
   {
     "description": "The app implements CSRF prevention",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/csrf.md)"
+    "more": ""
   },
   {
     "description": "The app has a rate limitter",
@@ -87,12 +87,12 @@
   {
     "description": "The app has disabled GraphQL introspection and schema registry",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/graphql.md)"
+    "more": ""
   },
   {
     "description": "The app has set GraphQL complexity query limits",
     "responsibles": 1,
-    "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/graphql.md)"
+    "more": ""
   },
   {
     "description": "`sitemap.xml` does not leak any routes with sensitive data",

package/src/utils/gitlabHost.ts

@@ -0,0 +1,23 @@
+import { getGitRemoteHostAndPath } from "../git/gitProjectInformation";
+
+/**
+ * the base url of the gitlab instance this project lives on.
+ *
+ * Never hardcode an instance: catladder is used outside panter, and the
+ * host was baked in as https://git.panter.ch in several places, which
+ * silently broke every consumer on another gitlab.
+ *
+ * - in a gitlab CI job, `CI_SERVER_URL` is the authoritative value
+ *   (predefined, already includes the scheme)
+ * - locally, derive it from the git remote
+ *
+ * @param remoteName the remote to derive from outside CI (default origin)
+ */
+export const getGitlabHostUrl = async (remoteName = "origin") => {
+  const fromCi = process.env.CI_SERVER_URL;
+  if (fromCi) {
+    return fromCi.replace(/\/+$/, "");
+  }
+  const { gitRemoteHost } = await getGitRemoteHostAndPath(remoteName);
+  return `https://${gitRemoteHost}`;
+};