@catladder/cli 5.1.1 → 5.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithubReleaseWorkflow.d.ts +30 -0
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithubReleaseWorkflow.js +89 -0
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithubReleaseWorkflow.js.map +1 -0
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js +2 -0
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js.map +1 -1
- package/dist/apps/cli/src/apps/cli/commands/project/githubMergeGating.d.ts +4 -1
- package/dist/apps/cli/src/apps/cli/commands/project/githubMergeGating.js +4 -1
- package/dist/apps/cli/src/apps/cli/commands/project/githubMergeGating.js.map +1 -1
- package/dist/apps/cli/src/catci.js +13 -0
- package/dist/apps/cli/src/catci.js.map +1 -1
- package/dist/apps/cli/src/release/changesetsReleaseJob.js +20 -42
- package/dist/apps/cli/src/release/changesetsReleaseJob.js.map +1 -1
- package/dist/apps/cli/src/release/githubDeployKey.d.ts +36 -0
- package/dist/apps/cli/src/release/githubDeployKey.js +126 -0
- package/dist/apps/cli/src/release/githubDeployKey.js.map +1 -0
- package/dist/bundles/catci/index.js +5 -5
- package/dist/bundles/catenv/index.js +31 -7
- package/dist/bundles/cli/index.js +133 -8
- package/dist/bundles/runner-images/semantic-release/Dockerfile +3 -1
- package/dist/bundles/runner-images/semantic-release/scripts/semanticRelease +37 -4
- package/dist/bundles/skills/catladder-migrate-ci-backend/SKILL.md +15 -6
- package/dist/bundles/skills/catladder-pipelines/SKILL.md +3 -2
- package/dist/bundles/skills/catladder-releases/SKILL.md +14 -0
- package/dist/packages/pipeline/src/backends/github/GithubBackend.js +12 -3
- package/dist/packages/pipeline/src/backends/github/GithubBackend.js.map +1 -1
- package/dist/packages/pipeline/src/catci/shippedCatci.d.ts +8 -0
- package/dist/packages/pipeline/src/catci/shippedCatci.js +19 -4
- package/dist/packages/pipeline/src/catci/shippedCatci.js.map +1 -1
- package/dist/runner-images/semantic-release/Dockerfile +3 -1
- package/dist/runner-images/semantic-release/scripts/semanticRelease +37 -4
- package/dist/skills/catladder-migrate-ci-backend/SKILL.md +15 -6
- package/dist/skills/catladder-pipelines/SKILL.md +3 -2
- package/dist/skills/catladder-releases/SKILL.md +14 -0
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +1 -1
- package/src/apps/cli/commands/project/__tests__/checkGithubReleaseWorkflow.test.ts +89 -0
- package/src/apps/cli/commands/project/doctor/checkGithubReleaseWorkflow.ts +125 -0
- package/src/apps/cli/commands/project/doctor/index.ts +2 -0
- package/src/apps/cli/commands/project/githubMergeGating.ts +4 -1
- package/src/catci.ts +15 -0
- package/src/release/__tests__/githubDeployKey.test.ts +148 -0
- package/src/release/changesetsReleaseJob.ts +28 -57
- package/src/release/githubDeployKey.ts +141 -0
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
import type { Config } from "../../../../../../../../packages/pipeline/src/index.js";
|
|
2
|
+
import { GithubBackend } from "../../../../../../../../packages/pipeline/src/index.js";
|
|
3
|
+
import type { DoctorReport } from "./DoctorReport";
|
|
4
|
+
type Workflows = Awaited<ReturnType<GithubBackend["createWorkflows"]>>;
|
|
5
|
+
export type ReleaseJobImageDrift = {
|
|
6
|
+
file: string;
|
|
7
|
+
expected: string;
|
|
8
|
+
/** null when the committed workflow has no release job (or no file) */
|
|
9
|
+
committed: string | null;
|
|
10
|
+
};
|
|
11
|
+
/**
|
|
12
|
+
* compares the release job image of every generated workflow carrying
|
|
13
|
+
* one against the committed workflow of the same name. The job images
|
|
14
|
+
* are tagged by a content hash of their definition, so a differing tag
|
|
15
|
+
* means the committed workflow runs an older release image.
|
|
16
|
+
*/
|
|
17
|
+
export declare const findReleaseJobImageDrift: (generated: Workflows, committed: Record<string, string | null>) => ReleaseJobImageDrift[];
|
|
18
|
+
/**
|
|
19
|
+
* the release job image in the committed workflows must be the one this
|
|
20
|
+
* catladder version generates. The image tag encodes the image
|
|
21
|
+
* definition, so an older tag means an older release script — which is
|
|
22
|
+
* more than cosmetics: the semantic-release image before this check
|
|
23
|
+
* pushed with the workflow token and ignored the release deploy key,
|
|
24
|
+
* so every release on a repository with merge gating failed on GH013
|
|
25
|
+
* while `project setup` and the deploy-key checks reported all green.
|
|
26
|
+
*
|
|
27
|
+
* Needs no `gh` login — only the config and the committed files.
|
|
28
|
+
*/
|
|
29
|
+
export declare const checkGithubReleaseWorkflow: (report: DoctorReport, config: Config) => Promise<void>;
|
|
30
|
+
export {};
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.checkGithubReleaseWorkflow = exports.findReleaseJobImageDrift = void 0;
|
|
4
|
+
const promises_1 = require("fs/promises");
|
|
5
|
+
const path_1 = require("path");
|
|
6
|
+
const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
|
|
7
|
+
const yaml_1 = require("yaml");
|
|
8
|
+
const WORKFLOWS_FOLDER = ".github/workflows";
|
|
9
|
+
/** the job name of the release job, see githubReleaseJobs.ts */
|
|
10
|
+
const RELEASE_JOB_NAME = "create release";
|
|
11
|
+
const releaseJobImage = (workflow) => {
|
|
12
|
+
var _a;
|
|
13
|
+
const job = Object.values((_a = workflow.jobs) !== null && _a !== void 0 ? _a : {}).find((job) => (job === null || job === void 0 ? void 0 : job.name) === RELEASE_JOB_NAME);
|
|
14
|
+
const container = job === null || job === void 0 ? void 0 : job.container;
|
|
15
|
+
if (typeof container === "string")
|
|
16
|
+
return container;
|
|
17
|
+
if (container && typeof container === "object" && "image" in container) {
|
|
18
|
+
return `${container.image}`;
|
|
19
|
+
}
|
|
20
|
+
return null;
|
|
21
|
+
};
|
|
22
|
+
/**
|
|
23
|
+
* compares the release job image of every generated workflow carrying
|
|
24
|
+
* one against the committed workflow of the same name. The job images
|
|
25
|
+
* are tagged by a content hash of their definition, so a differing tag
|
|
26
|
+
* means the committed workflow runs an older release image.
|
|
27
|
+
*/
|
|
28
|
+
const findReleaseJobImageDrift = (generated, committed) => Object.entries(generated).flatMap(([file, workflow]) => {
|
|
29
|
+
var _a;
|
|
30
|
+
const expected = releaseJobImage(workflow);
|
|
31
|
+
if (!expected)
|
|
32
|
+
return [];
|
|
33
|
+
const content = committed[file];
|
|
34
|
+
let committedImage = null;
|
|
35
|
+
if (content) {
|
|
36
|
+
try {
|
|
37
|
+
committedImage = releaseJobImage((_a = (0, yaml_1.parse)(content)) !== null && _a !== void 0 ? _a : {});
|
|
38
|
+
}
|
|
39
|
+
catch (_b) {
|
|
40
|
+
committedImage = null;
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
return committedImage === expected
|
|
44
|
+
? []
|
|
45
|
+
: [{ file, expected, committed: committedImage }];
|
|
46
|
+
});
|
|
47
|
+
exports.findReleaseJobImageDrift = findReleaseJobImageDrift;
|
|
48
|
+
/**
|
|
49
|
+
* the release job image in the committed workflows must be the one this
|
|
50
|
+
* catladder version generates. The image tag encodes the image
|
|
51
|
+
* definition, so an older tag means an older release script — which is
|
|
52
|
+
* more than cosmetics: the semantic-release image before this check
|
|
53
|
+
* pushed with the workflow token and ignored the release deploy key,
|
|
54
|
+
* so every release on a repository with merge gating failed on GH013
|
|
55
|
+
* while `project setup` and the deploy-key checks reported all green.
|
|
56
|
+
*
|
|
57
|
+
* Needs no `gh` login — only the config and the committed files.
|
|
58
|
+
*/
|
|
59
|
+
const checkGithubReleaseWorkflow = async (report, config) => {
|
|
60
|
+
if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github"))
|
|
61
|
+
return;
|
|
62
|
+
report.section("github release workflow");
|
|
63
|
+
let generated;
|
|
64
|
+
try {
|
|
65
|
+
const images = new pipeline_1.JobImagesPlan("github", config.images, await (0, pipeline_1.resolveGithubRegistryImage)(config));
|
|
66
|
+
generated = await new pipeline_1.GithubBackend().createWorkflows(config, images);
|
|
67
|
+
}
|
|
68
|
+
catch (e) {
|
|
69
|
+
report.warn(`could not generate the github workflows (${e.message})`);
|
|
70
|
+
return;
|
|
71
|
+
}
|
|
72
|
+
const files = Object.keys(generated).filter((file) => releaseJobImage(generated[file]));
|
|
73
|
+
const committed = {};
|
|
74
|
+
for (const file of files) {
|
|
75
|
+
committed[file] = await (0, promises_1.readFile)((0, path_1.join)(WORKFLOWS_FOLDER, file), "utf8").catch(() => null);
|
|
76
|
+
}
|
|
77
|
+
const drift = (0, exports.findReleaseJobImageDrift)(generated, committed);
|
|
78
|
+
if (drift.length === 0) {
|
|
79
|
+
report.ok(`release job image up to date in ${files.length} generated workflow(s)`);
|
|
80
|
+
return;
|
|
81
|
+
}
|
|
82
|
+
for (const { file, expected, committed } of drift) {
|
|
83
|
+
report.fail(committed
|
|
84
|
+
? `${WORKFLOWS_FOLDER}/${file}: the release job runs ${committed}, this catladder version generates ${expected} — the committed workflow was generated by an older catladder (its release script may push with the workflow token, ignoring the release deploy key)`
|
|
85
|
+
: `${WORKFLOWS_FOLDER}/${file}: missing or without a '${RELEASE_JOB_NAME}' job (expected image ${expected})`, "run: catenv (and commit the regenerated workflows)");
|
|
86
|
+
}
|
|
87
|
+
};
|
|
88
|
+
exports.checkGithubReleaseWorkflow = checkGithubReleaseWorkflow;
|
|
89
|
+
//# sourceMappingURL=checkGithubReleaseWorkflow.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"checkGithubReleaseWorkflow.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkGithubReleaseWorkflow.ts"],"names":[],"mappings":";;;AAAA,0CAAuC;AACvC,+BAA4B;AAE5B,kDAK6B;AAC7B,+BAA6B;AAG7B,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,gEAAgE;AAChE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAW1C,MAAM,eAAe,GAAG,CAAC,QAExB,EAAiB,EAAE;;IAClB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,QAAQ,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,IAAI,MAAK,gBAAgB,CACxC,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,SAAS,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QACvE,OAAO,GAAI,SAAgC,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;GAKG;AACI,MAAM,wBAAwB,GAAG,CACtC,SAAoB,EACpB,SAAwC,EAChB,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;;IACrD,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,cAAc,GAAG,eAAe,CAAC,MAAA,IAAA,YAAK,EAAC,OAAO,CAAC,mCAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,WAAM,CAAC;YACP,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAnBQ,QAAA,wBAAwB,4BAmBhC;AAEL;;;;;;;;;;GAUG;AACI,MAAM,0BAA0B,GAAG,KAAK,EAC7C,MAAoB,EACpB,MAAc,EACd,EAAE;IACF,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAChE,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAE1C,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,wBAAa,CAC9B,QAAQ,EACR,MAAM,CAAC,MAAM,EACb,MAAM,IAAA,qCAA0B,EAAC,MAAM,CAAC,CACzC,CAAC;QACF,SAAS,GAAG,MAAM,IAAI,wBAAa,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;IACF,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,IAAA,mBAAQ,EAC9B,IAAA,WAAI,EAAC,gBAAgB,EAAE,IAAI,CAAC,EAC5B,MAAM,CACP,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,gCAAwB,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,CACP,mCAAmC,KAAK,CAAC,MAAM,wBAAwB,CACxE,CAAC;QACF,OAAO;IACT,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CACT,SAAS;YACP,CAAC,CAAC,GAAG,gBAAgB,IAAI,IAAI,0BAA0B,SAAS,sCAAsC,QAAQ,sJAAsJ;YACpQ,CAAC,CAAC,GAAG,gBAAgB,IAAI,IAAI,2BAA2B,gBAAgB,yBAAyB,QAAQ,GAAG,EAC9G,oDAAoD,CACrD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AA9CW,QAAA,0BAA0B,8BA8CrC"}
|
|
@@ -6,6 +6,7 @@ const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
|
|
|
6
6
|
const checkCloudRun_1 = require("./checkCloudRun");
|
|
7
7
|
const checkGithub_1 = require("./checkGithub");
|
|
8
8
|
const checkGithubImageCasing_1 = require("./checkGithubImageCasing");
|
|
9
|
+
const checkGithubReleaseWorkflow_1 = require("./checkGithubReleaseWorkflow");
|
|
9
10
|
const checkGitlab_1 = require("./checkGitlab");
|
|
10
11
|
const checkStore_1 = require("./checkStore");
|
|
11
12
|
const DoctorReport_1 = require("./DoctorReport");
|
|
@@ -42,6 +43,7 @@ const doctorProject = async (instance, onlyComponents) => {
|
|
|
42
43
|
}
|
|
43
44
|
await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
|
|
44
45
|
await (0, checkGithubImageCasing_1.checkGithubImageCasing)(report, config);
|
|
46
|
+
await (0, checkGithubReleaseWorkflow_1.checkGithubReleaseWorkflow)(report, config);
|
|
45
47
|
await (0, checkGithub_1.checkGithub)(report, config);
|
|
46
48
|
report.summarize();
|
|
47
49
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,qEAAkE;AAClE,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAA,+CAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,qEAAkE;AAClE,6EAA0E;AAC1E,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAA,+CAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAA,uDAA0B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAnCW,QAAA,aAAa,iBAmCxB"}
|
|
@@ -26,7 +26,10 @@ export declare const MERGE_GATING_RULESET_NAME = "catladder merge gating";
|
|
|
26
26
|
export declare const RELEASE_DEPLOY_KEY_TITLE = "catladder release";
|
|
27
27
|
/**
|
|
28
28
|
* actions secret holding the deploy key's private half; the generated
|
|
29
|
-
* release jobs pass it
|
|
29
|
+
* release jobs pass it into the job env and both release methods push
|
|
30
|
+
* over ssh with it when it is set — changesets from catci itself,
|
|
31
|
+
* semantic-release via the ssh repository url catci prepares for it
|
|
32
|
+
* (see src/release/githubDeployKey.ts)
|
|
30
33
|
*/
|
|
31
34
|
export declare const RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
|
|
32
35
|
export type GithubRuleset = {
|
|
@@ -30,7 +30,10 @@ exports.MERGE_GATING_RULESET_NAME = "catladder merge gating";
|
|
|
30
30
|
exports.RELEASE_DEPLOY_KEY_TITLE = "catladder release";
|
|
31
31
|
/**
|
|
32
32
|
* actions secret holding the deploy key's private half; the generated
|
|
33
|
-
* release jobs pass it
|
|
33
|
+
* release jobs pass it into the job env and both release methods push
|
|
34
|
+
* over ssh with it when it is set — changesets from catci itself,
|
|
35
|
+
* semantic-release via the ssh repository url catci prepares for it
|
|
36
|
+
* (see src/release/githubDeployKey.ts)
|
|
34
37
|
*/
|
|
35
38
|
exports.RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
|
|
36
39
|
/** the ruleset `project setup` creates (and restores on drift) */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"githubMergeGating.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/githubMergeGating.ts"],"names":[],"mappings":";;;AAAA,kDAA+D;AAE/D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,yEAAyE;AAC5D,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE9B,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAElE,oEAAoE;AACvD,QAAA,wBAAwB,GAAG,mBAAmB,CAAC;AAE5D
|
|
1
|
+
{"version":3,"file":"githubMergeGating.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/githubMergeGating.ts"],"names":[],"mappings":";;;AAAA,kDAA+D;AAE/D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,yEAAyE;AAC5D,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE9B,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAElE,oEAAoE;AACvD,QAAA,wBAAwB,GAAG,mBAAmB,CAAC;AAE5D;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAG,uBAAuB,CAAC;AAmBjE,kEAAkE;AAC3D,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9C,IAAI,EAAE,iCAAyB;IAC/B,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,QAAQ;IACrB,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;IACvE,KAAK,EAAE;QACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE;gBACV,oCAAoC,EAAE,KAAK;gBAC3C,wBAAwB,EAAE,KAAK;gBAC/B,sBAAsB,EAAE;oBACtB;wBACE,OAAO,EAAE,mCAAwB;wBACjC,cAAc,EAAE,6BAAqB;qBACtC;iBACF;aACF;SACF;KACF;IACD,aAAa,EAAE;QACb,kEAAkE;QAClE,oDAAoD;QACpD,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE;KACnE;CACF,CAAC,CAAC;AAzBU,QAAA,yBAAyB,6BAyBnC;AAEH;;;;GAIG;AACI,MAAM,0BAA0B,GAAG,CAAC,OAAsB,EAAW,EAAE;;IAC5E,OAAA,OAAO,CAAC,WAAW,KAAK,QAAQ;QAChC,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,CACxB,CAAC,IAAI,EAAE,EAAE;;YACP,OAAA,IAAI,CAAC,IAAI,KAAK,wBAAwB;gBACtC,CAAC,MAAA,MAAA,IAAI,CAAC,UAAU,0CAAE,sBAAsB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,mCAAwB,CACtD,CAAA;SAAA,CACJ;QACD,CAAC,MAAA,OAAO,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,IAAI,CAChC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CACrE,CAAA;CAAA,CAAC;AAZS,QAAA,0BAA0B,8BAYnC"}
|
|
@@ -17,6 +17,7 @@ const evaluateSecurityAudit_1 = require("./security/evaluateSecurityAudit");
|
|
|
17
17
|
const createSecurityAuditMergeRequest_1 = require("./security/createSecurityAuditMergeRequest");
|
|
18
18
|
const changesetsReleaseJob_1 = require("./release/changesetsReleaseJob");
|
|
19
19
|
const changesetCheckJob_1 = require("./release/changesetCheckJob");
|
|
20
|
+
const githubDeployKey_1 = require("./release/githubDeployKey");
|
|
20
21
|
const githubQueuedRelease_1 = require("./release/githubQueuedRelease");
|
|
21
22
|
const npmPublishJob_1 = require("./publish/npmPublishJob");
|
|
22
23
|
const gitlabHost_1 = require("./utils/gitlabHost");
|
|
@@ -47,6 +48,13 @@ usage:
|
|
|
47
48
|
github only: dispatches the generated taggedRelease workflow for
|
|
48
49
|
the tag (tags pushed with the job token don't trigger it)
|
|
49
50
|
|
|
51
|
+
catci release github-deploy-key-remote
|
|
52
|
+
github only, semantic-release path: configures the checkout to
|
|
53
|
+
push over ssh with the release deploy key (CATLADDER_RELEASE_KEY,
|
|
54
|
+
the only actor that bypasses the merge-gating ruleset), verifies
|
|
55
|
+
the key reaches the repository and prints the ssh url for
|
|
56
|
+
semantic-release's --repository-url
|
|
57
|
+
|
|
50
58
|
catci release github-queue-check
|
|
51
59
|
github only, first step of the manual create-release task:
|
|
52
60
|
releases right away when the main workflow run for HEAD is green
|
|
@@ -139,6 +147,11 @@ const main = async () => {
|
|
|
139
147
|
args.length === 1) {
|
|
140
148
|
return (0, changesetsReleaseJob_1.dispatchTaggedReleaseWorkflow)(args[0]);
|
|
141
149
|
}
|
|
150
|
+
if (group === "release" &&
|
|
151
|
+
command === "github-deploy-key-remote" &&
|
|
152
|
+
args.length === 0) {
|
|
153
|
+
return (0, githubDeployKey_1.githubDeployKeyRemoteJob)();
|
|
154
|
+
}
|
|
142
155
|
if (group === "release" &&
|
|
143
156
|
command === "github-queue-check" &&
|
|
144
157
|
args.length === 0) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"catci.js","sourceRoot":"","sources":["../../../../src/catci.ts"],"names":[],"mappings":";;AAAA;;;;;;;;;;;GAWG;AACH,0CAAyC;AACzC,4EAG0C;AAC1C,gGAGoD;AACpD,yEAGwC;AACxC,mEAAgE;AAChE,uEAGuC;AACvC,2DAA6E;AAC7E,mDAAsD;AAEtD,MAAM,KAAK,GAAG;;;;kBAII,0DAAwB;;;;kBAIxB,0DAAwB
|
|
1
|
+
{"version":3,"file":"catci.js","sourceRoot":"","sources":["../../../../src/catci.ts"],"names":[],"mappings":";;AAAA;;;;;;;;;;;GAWG;AACH,0CAAyC;AACzC,4EAG0C;AAC1C,gGAGoD;AACpD,yEAGwC;AACxC,mEAAgE;AAChE,+DAAqE;AACrE,uEAGuC;AACvC,2DAA6E;AAC7E,mDAAsD;AAEtD,MAAM,KAAK,GAAG;;;;kBAII,0DAAwB;;;;kBAIxB,0DAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CzC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;IAC1C,MAAM,UAAU,GAAG,MAAM,IAAA,6CAAqB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CACF,yCAAyC;YACvC,oCAAoC,0DAAwB,4DAA4D,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAA,iDAAyB,EAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;IAChD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CACF,sBAAsB,0DAAwB,IAAI;YAChD,gBAAgB,0DAAwB,6CAA6C;YACrF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,EAAE;IACF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAE1E,MAAM,GAAG,GAAG,IAAI,aAAM,CAAC,EAAE,IAAI,EAAE,MAAM,IAAA,6BAAgB,GAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,MAAM,IAAA,iEAA+B,EAAC;QAC/C,GAAG;QACH,UAAU;QACV,SAAS;QACT,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACf,IAAI,CACF,gEAAgE,EAAE,CAAC,KAAK,EAAE,CAC3E,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CACT,oCAAoC,0DAAwB,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CACpF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,gBAAgB,IAAI,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;QAC1D,OAAO,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,KAAK,gBAAgB,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,IAAA,2CAAoB,GAAE,CAAC;IAChC,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,iBAAiB;QAC7B,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,IAAA,qCAAiB,GAAE,CAAC;IAC7B,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,0BAA0B;QACtC,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,IAAA,oDAA6B,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,0BAA0B;QACtC,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,IAAA,0CAAwB,GAAE,CAAC;IACpC,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,oBAAoB;QAChC,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,IAAA,yCAAmB,GAAE,CAAC;IAC/B,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,qBAAqB;QACjC,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,IAAA,0CAAoB,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAA,6BAAa,EAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC;AACd,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,IAAI,CAAC,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC"}
|
|
@@ -10,9 +10,9 @@ exports.changesetsReleaseJob = exports.dispatchTaggedReleaseWorkflow = exports.r
|
|
|
10
10
|
*/
|
|
11
11
|
const fs_1 = require("fs");
|
|
12
12
|
const promises_1 = require("fs/promises");
|
|
13
|
-
const os_1 = require("os");
|
|
14
13
|
const path_1 = require("path");
|
|
15
14
|
const changesets_1 = require("./changesets");
|
|
15
|
+
const githubDeployKey_1 = require("./githubDeployKey");
|
|
16
16
|
const releaseGit_1 = require("./releaseGit");
|
|
17
17
|
const releaseEntry_1 = require("./releaseEntry");
|
|
18
18
|
const stepSummary_1 = require("./stepSummary");
|
|
@@ -52,12 +52,11 @@ const requireEnv = (name) => {
|
|
|
52
52
|
* - gitlab: CI checkouts have a read-only origin, so push via an
|
|
53
53
|
* authenticated url with GL_TOKEN (the same project access token
|
|
54
54
|
* semantic-release uses)
|
|
55
|
-
* - github: over ssh with the release deploy key
|
|
56
|
-
*
|
|
57
|
-
*
|
|
58
|
-
*
|
|
59
|
-
*
|
|
60
|
-
* push falls back to origin, which works on repos without gating.
|
|
55
|
+
* - github: over ssh with the release deploy key (see
|
|
56
|
+
* ./githubDeployKey) — merge gating requires the `catladder ✅` check
|
|
57
|
+
* on the default branch, and only a deploy key can bypass that.
|
|
58
|
+
* Without the secret the push falls back to origin (the workflow
|
|
59
|
+
* token), which works on repos without gating.
|
|
61
60
|
*/
|
|
62
61
|
const pushCommitAndTag = async (tag) => {
|
|
63
62
|
var _a;
|
|
@@ -67,24 +66,25 @@ const pushCommitAndTag = async (tag) => {
|
|
|
67
66
|
if (process.env.GITHUB_ACTIONS === "true") {
|
|
68
67
|
const branch = requireEnv("GITHUB_REF_NAME");
|
|
69
68
|
const refs = [`HEAD:refs/heads/${branch}`, tag];
|
|
70
|
-
const deployKey =
|
|
69
|
+
const deployKey = (0, githubDeployKey_1.getReleaseDeployKey)();
|
|
71
70
|
if (deployKey) {
|
|
72
|
-
await pushWithDeployKey(deployKey, refs);
|
|
71
|
+
await (0, githubDeployKey_1.pushWithDeployKey)(deployKey, refs);
|
|
73
72
|
return;
|
|
74
73
|
}
|
|
75
74
|
try {
|
|
76
75
|
await (0, releaseGit_1.git)("push", "--atomic", "origin", ...refs);
|
|
77
76
|
}
|
|
78
77
|
catch (e) {
|
|
79
|
-
// GH006
|
|
80
|
-
// commit (it cannot have a
|
|
81
|
-
// the release deploy key,
|
|
82
|
-
|
|
78
|
+
// GH006 (classic protection) / GH013 (ruleset): a required status
|
|
79
|
+
// check rejects the fresh release commit (it cannot have a
|
|
80
|
+
// passing check yet) — the push needs the release deploy key,
|
|
81
|
+
// which `project setup` provisions
|
|
82
|
+
if (/GH006|GH013|protected branch|rule violations/i.test(`${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`)) {
|
|
83
83
|
throw new Error(`pushing the release to '${branch}' was rejected by its branch protection:\n` +
|
|
84
84
|
`${e.message}\n` +
|
|
85
85
|
`The workflow token cannot bypass a required status check on '${branch}'. ` +
|
|
86
86
|
`Run \`catladder project setup\` to provision the release deploy key ` +
|
|
87
|
-
`(${
|
|
87
|
+
`(${githubDeployKey_1.RELEASE_DEPLOY_KEY_ENV} secret + ruleset bypass), then rerun this job.`);
|
|
88
88
|
}
|
|
89
89
|
throw e;
|
|
90
90
|
}
|
|
@@ -97,31 +97,6 @@ const pushCommitAndTag = async (tag) => {
|
|
|
97
97
|
const remote = `https://oauth2:${token}@${host}/${projectPath}.git`;
|
|
98
98
|
await (0, releaseGit_1.git)("push", "--atomic", remote, `HEAD:refs/heads/${branch}`, tag);
|
|
99
99
|
};
|
|
100
|
-
const RELEASE_KEY_ENV = "CATLADDER_RELEASE_KEY";
|
|
101
|
-
/**
|
|
102
|
-
* pushes over ssh with the release deploy key — the only actor that
|
|
103
|
-
* can bypass the merge-gating ruleset on the default branch
|
|
104
|
-
*/
|
|
105
|
-
const pushWithDeployKey = async (privateKey, refs) => {
|
|
106
|
-
var _a;
|
|
107
|
-
const serverUrl = (_a = process.env.GITHUB_SERVER_URL) !== null && _a !== void 0 ? _a : "https://github.com";
|
|
108
|
-
const host = new URL(serverUrl).host;
|
|
109
|
-
const repository = requireEnv("GITHUB_REPOSITORY");
|
|
110
|
-
const dir = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "release-key-"));
|
|
111
|
-
try {
|
|
112
|
-
const keyFile = (0, path_1.join)(dir, "id_ed25519");
|
|
113
|
-
// a key file without a trailing newline is rejected by openssh
|
|
114
|
-
await (0, promises_1.writeFile)(keyFile, privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`, {
|
|
115
|
-
mode: 0o600,
|
|
116
|
-
});
|
|
117
|
-
await (0, releaseGit_1.gitWithEnv)({
|
|
118
|
-
GIT_SSH_COMMAND: `ssh -i ${keyFile} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`,
|
|
119
|
-
}, "push", "--atomic", `git@${host}:${repository}.git`, ...refs);
|
|
120
|
-
}
|
|
121
|
-
finally {
|
|
122
|
-
await (0, promises_1.rm)(dir, { recursive: true, force: true });
|
|
123
|
-
}
|
|
124
|
-
};
|
|
125
100
|
/**
|
|
126
101
|
* tags pushed with the default GITHUB_TOKEN do not trigger `on: push:
|
|
127
102
|
* tags` workflows (github's recursion guard), so the taggedRelease
|
|
@@ -199,9 +174,12 @@ const changesetsReleaseJob = async () => {
|
|
|
199
174
|
// [skip ci] on github only: deploy-key pushes trigger workflows
|
|
200
175
|
// (unlike GITHUB_TOKEN pushes), and neither the release commit nor
|
|
201
176
|
// the tag needs a push-triggered run — the taggedRelease workflow is
|
|
202
|
-
// dispatched explicitly below, [skip ci] keeps it the only run
|
|
203
|
-
//
|
|
204
|
-
//
|
|
177
|
+
// dispatched explicitly below, [skip ci] keeps it the only run
|
|
178
|
+
// (verified on catladder's own releases: one run per tag, all
|
|
179
|
+
// workflow_dispatch). The semantic-release runner script does the
|
|
180
|
+
// same. On gitlab the tag pipeline MUST fire natively, so no marker
|
|
181
|
+
// there (release-commit branch pipelines are already filtered by
|
|
182
|
+
// rules).
|
|
205
183
|
const onGithub = process.env.GITHUB_ACTIONS === "true";
|
|
206
184
|
const subject = `chore(release): ${version}${onGithub ? " [skip ci]" : ""}`;
|
|
207
185
|
await (0, releaseGit_1.git)("commit", "-m", `${subject}\n\n${entries}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"changesetsReleaseJob.js","sourceRoot":"","sources":["../../../../../src/release/changesetsReleaseJob.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,2BAAgC;AAChC,
|
|
1
|
+
{"version":3,"file":"changesetsReleaseJob.js","sourceRoot":"","sources":["../../../../../src/release/changesetsReleaseJob.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,2BAAgC;AAChC,0CAA+D;AAC/D,+BAA4B;AAE5B,6CAMsB;AACtB,uDAI2B;AAC3B,6CAA4E;AAC5E,iDAAoD;AACpD,+CAAkD;AAElD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAExD,MAAM,qBAAqB,GAAG,KAAK,IAAI,EAAE;IAC9C,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,CACrE,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvB,IAAA,+BAAkB,EAChB,IAAI,EACJ,MAAM,IAAA,mBAAQ,EAAC,IAAA,WAAI,EAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CACnD,CACF,CACF,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,qBAAqB,yBAahC;AAEF,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;IACnC,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAG,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;IACvD,MAAM,IAAA,gBAAG,EACP,QAAQ,EACR,WAAW,EACX,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAC/C,CAAC;IACF,MAAM,IAAA,gBAAG,EACP,QAAQ,EACR,YAAY,EACZ,QAAQ;QACN,CAAC,CAAC,uDAAuD;QACzD,CAAC,CAAC,6BAA6B,CAClC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;;IAC7C,iEAAiE;IACjE,+DAA+D;IAC/D,iCAAiC;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,mBAAmB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAA,qCAAmB,GAAE,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAA,mCAAiB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAA,gBAAG,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kEAAkE;YAClE,2DAA2D;YAC3D,8DAA8D;YAC9D,mCAAmC;YACnC,IACE,+CAA+C,CAAC,IAAI,CAClD,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,CAAC,EAAE,CACrB,EACD,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,4CAA4C;oBAC3E,GAAG,CAAC,CAAC,OAAO,IAAI;oBAChB,gEAAgE,MAAM,KAAK;oBAC3E,sEAAsE;oBACtE,IAAI,wCAAsB,iDAAiD,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,kBAAkB,KAAK,IAAI,IAAI,IAAI,WAAW,MAAM,CAAC;IACpE,MAAM,IAAA,gBAAG,EAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF;;;;;;GAMG;AACI,MAAM,6BAA6B,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;;IACjE,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,cAAc,mCAAI,wBAAwB,CAAC;IACtE,MAAM,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,MAAM,UAAU,UAAU,sBAAsB,8BAA8B,aAAa,EAC9F;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,6BAA6B;SACtC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;KACnC,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,eAAe,8BAA8B,QAAQ,GAAG,YAAY,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,cAAc,8BAA8B,QAAQ,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC;AArBW,QAAA,6BAA6B,iCAqBxC;AAEF;;;;;GAKG;AACH,MAAM,wBAAwB,GAAc;IAC1C,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,4CAA4C;CACtD,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAqB,GAAE,CAAC;IAC9C,MAAM,WAAW,GACf,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,MAAM,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,0BAA0B,aAAa,wBAAwB,CAChE,CAAC;QACF,OAAO,CAAC,GAAG,CACT,kBAAkB,IAAA,eAAU,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,8EAA8E,CAC/I,CAAC;QACF,OAAO,CAAC,GAAG,CACT,mEAAmE,CACpE,CAAC;QACF,IAAA,+BAAiB,EACf,wDAAwD,aAAa,OAAO;YAC1E,6EAA6E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAA,iCAAoB,GAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAiB,GAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAA,2BAAc,EAC5B,OAAO,EACP,IAAA,oBAAO,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,OAAO,CAAC,GAAG,CACT,aAAa,GAAG,KAAK,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,eAAe,MAAM,UAAU,CAAC,MAAM,gBAAgB,CACvF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAA,mCAAsB,EAAC,UAAU,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,MAAM,IAAA,mBAAQ,EAAC,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAA,oBAAS,EACb,cAAc,EACd,IAAA,+BAAkB,EAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,CAAC,GAAG;IACf,kEAAkE;IAClE,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,aAAE,EAAC,IAAA,WAAI,EAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CACxE,CAAC;IAEF,MAAM,iBAAiB,EAAE,CAAC;IAC1B,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAA,gBAAG,EAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,IAAA,gBAAG,EAAC,KAAK,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAClD,CAAC;IACD,gEAAgE;IAChE,mEAAmE;IACnE,qEAAqE;IACrE,+DAA+D;IAC/D,8DAA8D;IAC9D,kEAAkE;IAClE,oEAAoE;IACpE,iEAAiE;IACjE,UAAU;IACV,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;IACvD,MAAM,OAAO,GAAG,mBAAmB,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5E,MAAM,IAAA,gBAAG,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,IAAA,gBAAG,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IAC/B,IAAA,+BAAiB,EAAC,iBAAiB,GAAG,SAAS,OAAO,EAAE,CAAC,CAAC;IAC1D,sEAAsE;IACtE,MAAM,IAAA,iCAAkB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAA,qCAA6B,EAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC,CAAC;AAjFW,QAAA,oBAAoB,wBAiF/B"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
export declare const RELEASE_DEPLOY_KEY_ENV = "CATLADDER_RELEASE_KEY";
|
|
2
|
+
/** the private key from the job env, or null when not provisioned */
|
|
3
|
+
export declare const getReleaseDeployKey: () => string | null;
|
|
4
|
+
/** the ssh url of the repository, from the github-provided env */
|
|
5
|
+
export declare const deployKeyRemoteUrl: () => string;
|
|
6
|
+
/** the ssh command using exactly the deploy key (GIT_SSH_COMMAND / core.sshCommand) */
|
|
7
|
+
export declare const deployKeySshCommand: (keyFile: string) => string;
|
|
8
|
+
/**
|
|
9
|
+
* writes the private key into a fresh temp dir and returns the file
|
|
10
|
+
* path. A key file without a trailing newline is rejected by openssh,
|
|
11
|
+
* and the secret may come without one.
|
|
12
|
+
*/
|
|
13
|
+
export declare const writeDeployKeyFile: (privateKey: string) => Promise<{
|
|
14
|
+
dir: string;
|
|
15
|
+
keyFile: string;
|
|
16
|
+
}>;
|
|
17
|
+
/**
|
|
18
|
+
* pushes the refs over ssh with the release deploy key — the changesets
|
|
19
|
+
* release path (catci pushes itself)
|
|
20
|
+
*/
|
|
21
|
+
export declare const pushWithDeployKey: (privateKey: string, refs: string[]) => Promise<void>;
|
|
22
|
+
/**
|
|
23
|
+
* the semantic-release release path: prepares the checkout so that git
|
|
24
|
+
* pushes to the ssh url of the repository authenticate with the release
|
|
25
|
+
* deploy key, verifies the key actually reaches the repository, and
|
|
26
|
+
* returns the ssh url (the runner script passes it to semantic-release
|
|
27
|
+
* as `--repository-url`). Nothing is cleaned up on purpose — the key
|
|
28
|
+
* file has to outlive this process, semantic-release runs afterwards
|
|
29
|
+
* in the same (ephemeral) job container.
|
|
30
|
+
*/
|
|
31
|
+
export declare const configureDeployKeyRemote: (privateKey: string) => Promise<string>;
|
|
32
|
+
/**
|
|
33
|
+
* `catci release github-deploy-key-remote`: only the ssh url goes to
|
|
34
|
+
* stdout (the caller captures it), everything else to stderr
|
|
35
|
+
*/
|
|
36
|
+
export declare const githubDeployKeyRemoteJob: () => Promise<void>;
|
|
@@ -0,0 +1,126 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.githubDeployKeyRemoteJob = exports.configureDeployKeyRemote = exports.pushWithDeployKey = exports.writeDeployKeyFile = exports.deployKeySshCommand = exports.deployKeyRemoteUrl = exports.getReleaseDeployKey = exports.RELEASE_DEPLOY_KEY_ENV = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* the github release deploy key — how a release push gets past the
|
|
6
|
+
* merge-gating ruleset.
|
|
7
|
+
*
|
|
8
|
+
* The ruleset `project setup` creates requires the `catladder ✅` check
|
|
9
|
+
* on the default branch, which a fresh release commit can never carry.
|
|
10
|
+
* Only a deploy key can bypass the ruleset (github deliberately never
|
|
11
|
+
* lets the workflow token bypass one), so setup provisions a write
|
|
12
|
+
* deploy key and stores its private half as the CATLADDER_RELEASE_KEY
|
|
13
|
+
* actions secret, which the generated release jobs pass into the job
|
|
14
|
+
* env. Both release methods push with it:
|
|
15
|
+
*
|
|
16
|
+
* - changesets: catci makes the push itself (pushWithDeployKey)
|
|
17
|
+
* - semantic-release: `@semantic-release/git` and semantic-release
|
|
18
|
+
* itself push, to the repository url they are given. catci prepares
|
|
19
|
+
* the ssh setup (configureDeployKeyRemote) and the runner script
|
|
20
|
+
* passes the ssh url as `--repository-url`. That flag is needed —
|
|
21
|
+
* semantic-release derives the url from package.json's `repository`
|
|
22
|
+
* field before it looks at `origin`, and actions/checkout leaves an
|
|
23
|
+
* https origin authenticated with the workflow token behind, which
|
|
24
|
+
* the ruleset rejects (GH013).
|
|
25
|
+
*
|
|
26
|
+
* Without the secret both methods push with the workflow token, which
|
|
27
|
+
* works on repositories without merge gating.
|
|
28
|
+
*/
|
|
29
|
+
const promises_1 = require("fs/promises");
|
|
30
|
+
const os_1 = require("os");
|
|
31
|
+
const path_1 = require("path");
|
|
32
|
+
const releaseGit_1 = require("./releaseGit");
|
|
33
|
+
exports.RELEASE_DEPLOY_KEY_ENV = "CATLADDER_RELEASE_KEY";
|
|
34
|
+
/** title of the deploy key `project setup` registers (see githubMergeGating) */
|
|
35
|
+
const RELEASE_DEPLOY_KEY_TITLE = "catladder release";
|
|
36
|
+
const requireEnv = (name) => {
|
|
37
|
+
const value = process.env[name];
|
|
38
|
+
if (!value) {
|
|
39
|
+
throw new Error(`${name} is not set — cannot push the release`);
|
|
40
|
+
}
|
|
41
|
+
return value;
|
|
42
|
+
};
|
|
43
|
+
/** the private key from the job env, or null when not provisioned */
|
|
44
|
+
const getReleaseDeployKey = () => process.env[exports.RELEASE_DEPLOY_KEY_ENV] || null;
|
|
45
|
+
exports.getReleaseDeployKey = getReleaseDeployKey;
|
|
46
|
+
/** the ssh url of the repository, from the github-provided env */
|
|
47
|
+
const deployKeyRemoteUrl = () => {
|
|
48
|
+
var _a;
|
|
49
|
+
const serverUrl = (_a = process.env.GITHUB_SERVER_URL) !== null && _a !== void 0 ? _a : "https://github.com";
|
|
50
|
+
const host = new URL(serverUrl).host;
|
|
51
|
+
const repository = requireEnv("GITHUB_REPOSITORY");
|
|
52
|
+
return `git@${host}:${repository}.git`;
|
|
53
|
+
};
|
|
54
|
+
exports.deployKeyRemoteUrl = deployKeyRemoteUrl;
|
|
55
|
+
/** the ssh command using exactly the deploy key (GIT_SSH_COMMAND / core.sshCommand) */
|
|
56
|
+
const deployKeySshCommand = (keyFile) => `ssh -i ${keyFile} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`;
|
|
57
|
+
exports.deployKeySshCommand = deployKeySshCommand;
|
|
58
|
+
/**
|
|
59
|
+
* writes the private key into a fresh temp dir and returns the file
|
|
60
|
+
* path. A key file without a trailing newline is rejected by openssh,
|
|
61
|
+
* and the secret may come without one.
|
|
62
|
+
*/
|
|
63
|
+
const writeDeployKeyFile = async (privateKey) => {
|
|
64
|
+
const dir = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "release-key-"));
|
|
65
|
+
const keyFile = (0, path_1.join)(dir, "id_ed25519");
|
|
66
|
+
await (0, promises_1.writeFile)(keyFile, privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`, { mode: 0o600 });
|
|
67
|
+
return { dir, keyFile };
|
|
68
|
+
};
|
|
69
|
+
exports.writeDeployKeyFile = writeDeployKeyFile;
|
|
70
|
+
/**
|
|
71
|
+
* pushes the refs over ssh with the release deploy key — the changesets
|
|
72
|
+
* release path (catci pushes itself)
|
|
73
|
+
*/
|
|
74
|
+
const pushWithDeployKey = async (privateKey, refs) => {
|
|
75
|
+
const { dir, keyFile } = await (0, exports.writeDeployKeyFile)(privateKey);
|
|
76
|
+
try {
|
|
77
|
+
await (0, releaseGit_1.gitWithEnv)({ GIT_SSH_COMMAND: (0, exports.deployKeySshCommand)(keyFile) }, "push", "--atomic", (0, exports.deployKeyRemoteUrl)(), ...refs);
|
|
78
|
+
}
|
|
79
|
+
finally {
|
|
80
|
+
await (0, promises_1.rm)(dir, { recursive: true, force: true });
|
|
81
|
+
}
|
|
82
|
+
};
|
|
83
|
+
exports.pushWithDeployKey = pushWithDeployKey;
|
|
84
|
+
/**
|
|
85
|
+
* the semantic-release release path: prepares the checkout so that git
|
|
86
|
+
* pushes to the ssh url of the repository authenticate with the release
|
|
87
|
+
* deploy key, verifies the key actually reaches the repository, and
|
|
88
|
+
* returns the ssh url (the runner script passes it to semantic-release
|
|
89
|
+
* as `--repository-url`). Nothing is cleaned up on purpose — the key
|
|
90
|
+
* file has to outlive this process, semantic-release runs afterwards
|
|
91
|
+
* in the same (ephemeral) job container.
|
|
92
|
+
*/
|
|
93
|
+
const configureDeployKeyRemote = async (privateKey) => {
|
|
94
|
+
var _a;
|
|
95
|
+
const remote = (0, exports.deployKeyRemoteUrl)();
|
|
96
|
+
const { keyFile } = await (0, exports.writeDeployKeyFile)(privateKey);
|
|
97
|
+
// the repo config, not the env: every git process semantic-release
|
|
98
|
+
// and its plugins spawn picks it up
|
|
99
|
+
await (0, releaseGit_1.git)("config", "core.sshCommand", (0, exports.deployKeySshCommand)(keyFile));
|
|
100
|
+
try {
|
|
101
|
+
await (0, releaseGit_1.git)("ls-remote", "--exit-code", remote, "HEAD");
|
|
102
|
+
}
|
|
103
|
+
catch (e) {
|
|
104
|
+
throw new Error(`the release deploy key cannot reach ${remote}: ${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}\n` +
|
|
105
|
+
`The ${exports.RELEASE_DEPLOY_KEY_ENV} secret does not match the '${RELEASE_DEPLOY_KEY_TITLE}' deploy key of the repository ` +
|
|
106
|
+
`(or the key was removed). Run \`catladder project setup\` to provision both again, then rerun this job.`);
|
|
107
|
+
}
|
|
108
|
+
return remote;
|
|
109
|
+
};
|
|
110
|
+
exports.configureDeployKeyRemote = configureDeployKeyRemote;
|
|
111
|
+
/**
|
|
112
|
+
* `catci release github-deploy-key-remote`: only the ssh url goes to
|
|
113
|
+
* stdout (the caller captures it), everything else to stderr
|
|
114
|
+
*/
|
|
115
|
+
const githubDeployKeyRemoteJob = async () => {
|
|
116
|
+
const privateKey = (0, exports.getReleaseDeployKey)();
|
|
117
|
+
if (!privateKey) {
|
|
118
|
+
throw new Error(`${exports.RELEASE_DEPLOY_KEY_ENV} is not set — the release push cannot use the deploy key ` +
|
|
119
|
+
`(without merge gating the workflow token push works: run semantic-release without --repository-url)`);
|
|
120
|
+
}
|
|
121
|
+
const remote = await (0, exports.configureDeployKeyRemote)(privateKey);
|
|
122
|
+
console.error(`release push: ${remote} over ssh with the release deploy key (bypasses the merge-gating ruleset)`);
|
|
123
|
+
process.stdout.write(`${remote}\n`);
|
|
124
|
+
};
|
|
125
|
+
exports.githubDeployKeyRemoteJob = githubDeployKeyRemoteJob;
|
|
126
|
+
//# sourceMappingURL=githubDeployKey.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"githubDeployKey.js","sourceRoot":"","sources":["../../../../../src/release/githubDeployKey.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,0CAAqD;AACrD,2BAA4B;AAC5B,+BAA4B;AAC5B,6CAA+C;AAElC,QAAA,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,gFAAgF;AAChF,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAErD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,qEAAqE;AAC9D,MAAM,mBAAmB,GAAG,GAAkB,EAAE,CACrD,OAAO,CAAC,GAAG,CAAC,8BAAsB,CAAC,IAAI,IAAI,CAAC;AADjC,QAAA,mBAAmB,uBACc;AAE9C,kEAAkE;AAC3D,MAAM,kBAAkB,GAAG,GAAW,EAAE;;IAC7C,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,iBAAiB,mCAAI,oBAAoB,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IACrC,MAAM,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACnD,OAAO,OAAO,IAAI,IAAI,UAAU,MAAM,CAAC;AACzC,CAAC,CAAC;AALW,QAAA,kBAAkB,sBAK7B;AAEF,uFAAuF;AAChF,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAU,EAAE,CAC7D,UAAU,OAAO,4DAA4D,CAAC;AADnE,QAAA,mBAAmB,uBACgD;AAEhF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EAAE,UAAkB,EAAE,EAAE;IAC7D,MAAM,GAAG,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,MAAM,IAAA,oBAAS,EACb,OAAO,EACP,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,EAC1D,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC,CAAC;AATW,QAAA,kBAAkB,sBAS7B;AAEF;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,IAAc,EAAE,EAAE;IAC5E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,0BAAkB,EAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAA,uBAAU,EACd,EAAE,eAAe,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC,EAAE,EACjD,MAAM,EACN,UAAU,EACV,IAAA,0BAAkB,GAAE,EACpB,GAAG,IAAI,CACR,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC;AAbW,QAAA,iBAAiB,qBAa5B;AAEF;;;;;;;;GAQG;AACI,MAAM,wBAAwB,GAAG,KAAK,EAC3C,UAAkB,EACD,EAAE;;IACnB,MAAM,MAAM,GAAG,IAAA,0BAAkB,GAAE,CAAC;IACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,0BAAkB,EAAC,UAAU,CAAC,CAAC;IACzD,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,IAAA,gBAAG,EAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAA,gBAAG,EAAC,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,KAAK,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,CAAC,IAAI;YACnE,OAAO,8BAAsB,+BAA+B,wBAAwB,iCAAiC;YACrH,yGAAyG,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAlBW,QAAA,wBAAwB,4BAkBnC;AAEF;;;GAGG;AACI,MAAM,wBAAwB,GAAG,KAAK,IAAI,EAAE;IACjD,MAAM,UAAU,GAAG,IAAA,2BAAmB,GAAE,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,GAAG,8BAAsB,2DAA2D;YAClF,qGAAqG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAwB,EAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,CACX,iBAAiB,MAAM,2EAA2E,CACnG,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;AACtC,CAAC,CAAC;AAbW,QAAA,wBAAwB,4BAanC"}
|