@ckeditor/ckeditor5-dev-release-tools 61.2.0 → 61.3.0

package/README.md

@@ -2,7 +2,7 @@ CKEditor 5 release tools
 ========================
 
 [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-release-tools.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-release-tools)
-[![CircleCI](https://circleci.com/gh/ckeditor/ckeditor5-dev.svg?style=shield)](https://app.circleci.com/pipelines/github/ckeditor/ckeditor5-dev?branch=master)
+[![CircleCI](https://circleci.com/gh/ckeditor/ckeditor5-dev.svg?style=shield)](https://app.circleci.com/pipelines/github/ckeditor/ckeditor5-dev?branch=master-v61)
 
 Contains tools used during a release of [CKEditor 5](https://ckeditor.com) and related packages.
 

package/lib/index.js

@@ -33,3 +33,4 @@ export { default as validateRepositoryToRelease } from './utils/validatereposito
 export { default as getNpmTagFromVersion } from './utils/getnpmtagfromversion.js';
 export { default as provideToken } from './utils/providetoken.js';
 export { default as validateGithubToken } from './utils/validategithubtoken.js';
+export { default as getNpmIdToken } from './utils/getnpmidtoken.js';

package/lib/tasks/publishpackages.js

@@ -76,15 +76,7 @@ export default async function publishPackages( options ) {
 		attempts = 5
 	} = options;
 
-	if ( useOidc ) {
-		// npm exchanges the OIDC token only during supported operations, such as `npm publish`, and `npm whoami`
-		// does not reflect Trusted Publishing authentication. Hence, only the token presence can be verified upfront.
-		if ( !process.env.NPM_ID_TOKEN ) {
-			throw new Error( 'The "NPM_ID_TOKEN" environment variable is required when publishing using npm Trusted Publishing (OIDC).' );
-		}
-	} else {
-		await assertNpmAuthorization( npmOwner );
-	}
+	await assertNpmAuthorization( npmOwner, { useOidc } );
 
 	// Find packages that would be published...
 	const packagePaths = await workspaces.findPathsToPackages( cwd, packagesDirectory );
@@ -124,7 +116,8 @@ export default async function publishPackages( options ) {
 		listrTask,
 		taskToExecute: publishPackageOnNpmCallback,
 		taskOptions: {
-			npmTag
+			npmTag,
+			useOidc
 		},
 		signal,
 		concurrency

package/lib/tasks/reassignnpmtags.js

@@ -10,6 +10,7 @@ import { styleText, promisify } from 'node:util';
 import columns from 'cli-columns';
 import shellEscape from 'shell-escape';
 import assertNpmAuthorization from '../utils/assertnpmauthorization.js';
+import getNpmIdToken from '../utils/getnpmidtoken.js';
 import { exec } from 'node:child_process';
 
 const execPromise = promisify( exec );
@@ -19,8 +20,14 @@ const execPromise = promisify( exec );
  * It supports built-in tags (e.g. `latest`, `staging`, `next`) and custom tags (e.g. `latest-v{X}`).
  * Each operation will be retried up to 3 times in case of failure.
  *
+ * When using npm Trusted Publishing (`useOidc`), the `npm whoami` check is replaced by verifying that the `NPM_ID_TOKEN`
+ * environment variable is set, as `npm whoami` does not reflect OIDC authentication. It requires npm 11.21.0 or newer
+ * and a trusted publisher that allows the `npm dist-tag` command.
+ *
  * @param {object} options
- * @param {string} options.npmOwner User that is authorized to release packages.
+ * @param {string} [options.npmOwner] User that is authorized to release packages. Required unless `useOidc` is enabled.
+ * @param {boolean} [options.useOidc=false] Whether to authorize using npm Trusted Publishing (OIDC). When enabled,
+ * the `npm whoami` authorization check is skipped and the `NPM_ID_TOKEN` environment variable must be set instead.
  * @param {string} options.version Specifies the version of packages to reassign the tags for.
  * @param {Array.<string>} options.packages Array of packages' names to reassign tags for.
  * @param {string} [options.npmTag='latest'] Npm dist-tag to assign.
@@ -29,6 +36,7 @@ const execPromise = promisify( exec );
 export default async function reassignNpmTags( options ) {
 	const {
 		npmOwner,
+		useOidc = false,
 		version,
 		packages,
 		npmTag = 'latest'
@@ -38,14 +46,21 @@ export default async function reassignNpmTags( options ) {
 	const packagesSkipped = [];
 	const packagesUpdated = [];
 
-	await assertNpmAuthorization( npmOwner );
+	await assertNpmAuthorization( npmOwner, { useOidc } );
 
 	const counter = tools.createSpinner( 'Reassigning npm tags...', { total: packages.length } );
 	counter.start();
 
 	const updateTagPromises = packages.map( async packageName => {
 		const command = `npm dist-tag add ${ shellEscape( [ packageName ] ) }@${ shellEscape( [ version ] ) } ${ npmTag }`;
-		const updateLatestTagRetryable = retry( () => execPromise( command ) );
+		const updateLatestTagRetryable = retry( async () => {
+			if ( !useOidc ) {
+				return execPromise( command );
+			}
+
+			// The calls run in parallel, so the fresh token is passed only to this npm process.
+			return execPromise( command, { env: { ...process.env, NPM_ID_TOKEN: await getNpmIdToken() } } );
+		} );
 		await updateLatestTagRetryable()
 			.then( response => {
 				if ( response.stdout ) {

package/lib/utils/assertnpmauthorization.js

@@ -4,14 +4,29 @@
  */
 
 import { tools } from '@ckeditor/ckeditor5-dev-utils';
+import getNpmIdToken from './getnpmidtoken.js';
 
 /**
  * Checks whether a user is logged to npm as the provided account name.
  *
- * @param {string} npmOwner Expected npm account name that should be logged into npm.
+ * When using npm Trusted Publishing (`useOidc`), the check verifies that an OIDC token can be obtained instead
+ * (see `getNpmIdToken()`). npm exchanges the OIDC token only during supported operations, such as `npm publish` or `npm dist-tag`,
+ * and `npm whoami` does not reflect Trusted Publishing authentication.
+ *
+ * @param {string} [npmOwner] Expected npm account name that should be logged into npm. Required unless `useOidc` is enabled.
+ * @param {object} [options={}]
+ * @param {boolean} [options.useOidc=false] Whether to verify the npm Trusted Publishing (OIDC) setup instead of the npm account.
  * @returns {Promise}
  */
-export default async function assertNpmAuthorization( npmOwner ) {
+export default async function assertNpmAuthorization( npmOwner, { useOidc = false } = {} ) {
+	if ( useOidc ) {
+		// A token is requested again before each npm command. Requesting one here stops the release before any package
+		// is processed when no token can be obtained (neither from the CircleCI CLI nor from `NPM_ID_TOKEN`).
+		await getNpmIdToken();
+
+		return;
+	}
+
 	return tools.shExec( 'npm whoami', { verbosity: 'error', async: true } )
 		.then( npmCurrentUser => {
 			if ( npmOwner !== npmCurrentUser.trim() ) {

package/lib/utils/getnpmidtoken.js

@@ -0,0 +1,72 @@
+/**
+ * @license Copyright (c) 2003-2026, CKSource Holding sp. z o.o. All rights reserved.
+ * For licensing, see LICENSE.md.
+ */
+
+import { execFile } from 'node:child_process';
+
+/**
+ * The audience that npm expects in an OIDC token used in the npm Trusted Publishing token exchange.
+ */
+export const NPM_OIDC_AUDIENCE = 'npm:registry.npmjs.org';
+
+/**
+ * Returns an OIDC token that the npm CLI exchanges for a short-lived npm token (npm Trusted Publishing).
+ *
+ * npm accepts a CircleCI OIDC token in the exchange only for a few minutes after it was issued, even though the token
+ * itself is valid longer. A release that publishes many packages takes longer than that. Hence, on CircleCI, a fresh
+ * token is requested each time, right before an npm command that needs it.
+ *
+ * When the CircleCI CLI is not available, or the command does not run on CircleCI, the `NPM_ID_TOKEN` environment
+ * variable is used, if it is set.
+ *
+ * @returns {Promise<string>}
+ */
+export default async function getNpmIdToken() {
+	if ( process.env.CIRCLECI ) {
+		const token = await requestCircleciToken();
+
+		if ( token ) {
+			return token;
+		}
+	}
+
+	if ( process.env.NPM_ID_TOKEN ) {
+		return process.env.NPM_ID_TOKEN;
+	}
+
+	throw new Error(
+		'Cannot get an OIDC token for npm Trusted Publishing (OIDC). ' +
+		'Run the command on CircleCI or set the "NPM_ID_TOKEN" environment variable.'
+	);
+}
+
+/**
+ * Requests a fresh OIDC token using the CircleCI CLI. Resolves `null` when the CLI is not installed.
+ *
+ * @returns {Promise<string|null>}
+ */
+async function requestCircleciToken() {
+	const args = [ 'run', 'oidc', 'get', '--claims', JSON.stringify( { aud: NPM_OIDC_AUDIENCE } ) ];
+	let stdout;
+
+	try {
+		stdout = await new Promise( ( resolve, reject ) => {
+			execFile( 'circleci', args, ( error, output ) => error ? reject( error ) : resolve( output ) );
+		} );
+	} catch ( error ) {
+		if ( error.code === 'ENOENT' ) {
+			return null;
+		}
+
+		throw error;
+	}
+
+	const token = String( stdout ).trim();
+
+	if ( !token ) {
+		throw new Error( 'The `circleci run oidc get` command returned an empty OIDC token.' );
+	}
+
+	return token;
+}

package/lib/utils/publishpackageonnpmcallback.js

@@ -9,17 +9,26 @@
  * @param {string} packagePath
  * @param {object} taskOptions
  * @param {string} taskOptions.npmTag
+ * @param {boolean} [taskOptions.useOidc=false] Whether to request a fresh OIDC token for npm Trusted Publishing before publishing.
  * @returns {Promise}
  */
 export default async function publishPackageOnNpmCallback( packagePath, taskOptions ) {
-	const { tools } = await import( '@ckeditor/ckeditor5-dev-utils' );
+	// The callback runs in a worker thread, so dependencies are imported dynamically and resolve from the project root.
+	const { exec } = await import( 'node:child_process' );
 	const { rm } = await import( 'node:fs/promises' );
+	const { getNpmIdToken } = await import( '@ckeditor/ckeditor5-dev-release-tools' );
 
 	try {
-		await tools.shExec( `npm publish --access=public --tag ${ taskOptions.npmTag }`, {
-			cwd: packagePath,
-			async: true,
-			verbosity: 'silent'
+		const env = taskOptions.useOidc ? { ...process.env, NPM_ID_TOKEN: await getNpmIdToken() } : process.env;
+
+		if ( !/^[a-z0-9][a-z0-9._-]*$/i.test( taskOptions.npmTag ) ) {
+			throw new Error( `Invalid npm tag: "${ taskOptions.npmTag }".` );
+		}
+
+		const command = `npm publish --access=public --tag ${ taskOptions.npmTag }`;
+
+		await new Promise( ( resolve, reject ) => {
+			exec( command, { cwd: packagePath, env }, error => error ? reject( error ) : resolve() );
 		} );
 
 		await rm( packagePath, { recursive: true, force: true } );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-dev-release-tools",
-  "version": "61.2.0",
+  "version": "61.3.0",
   "description": "Tools used for releasing CKEditor 5 and related packages.",
   "keywords": [],
   "author": "CKSource (http://cksource.com/)",
@@ -22,7 +22,7 @@
     "lib"
   ],
   "dependencies": {
-    "@ckeditor/ckeditor5-dev-utils": "^61.2.0",
+    "@ckeditor/ckeditor5-dev-utils": "^61.3.0",
     "@octokit/rest": "^22.0.1",
     "cli-columns": "^4.0.0",
     "glob": "^13.0.6",