@ckeditor/ckeditor5-dev-release-tools 62.0.0 → 62.2.0

package/lib/tasks/publishpackages.js

@@ -54,6 +54,8 @@ import { workspaces, npm } from '@ckeditor/ckeditor5-dev-utils';
  * @param {Array.<string>} [options.optionalEntryPointPackages=[]] If the entry point validator is enabled (`requireEntryPoint=true`),
  * this array contains a list of packages that will not be checked. In other words, they do not have to define the entry point.
  * @param {string} [options.cwd=process.cwd()] Current working directory from which all paths will be resolved.
+ * @param {string} [options.workerDirectory='build'] A directory, relative to `options.cwd`, where temporary worker modules are stored.
+ * See `executeInParallel()` for details.
  * @param {number} [options.concurrency=4] Number of CPUs that will execute the task.
  * @param {number} [options.attempts=3] Number of attempts. After reaching 0, it won't be publishing packages again.
  * @returns {Promise}
@@ -72,19 +74,12 @@ export default async function publishPackages( options ) {
 		requireEntryPoint = false,
 		optionalEntryPointPackages = [],
 		cwd = process.cwd(),
+		workerDirectory = 'build',
 		concurrency = 2,
 		attempts = 5
 	} = options;
 
-	if ( useOidc ) {
-		// npm exchanges the OIDC token only during supported operations, such as `npm publish`, and `npm whoami`
-		// does not reflect Trusted Publishing authentication. Hence, only the token presence can be verified upfront.
-		if ( !process.env.NPM_ID_TOKEN ) {
-			throw new Error( 'The "NPM_ID_TOKEN" environment variable is required when publishing using npm Trusted Publishing (OIDC).' );
-		}
-	} else {
-		await assertNpmAuthorization( npmOwner );
-	}
+	await assertNpmAuthorization( npmOwner, { useOidc } );
 
 	// Find packages that would be published...
 	const packagePaths = await workspaces.findPathsToPackages( cwd, packagesDirectory );
@@ -127,7 +122,8 @@ export default async function publishPackages( options ) {
 			npmTag
 		},
 		signal,
-		concurrency
+		concurrency,
+		workerDirectory
 	} );
 
 	listrTask.output = 'Let\'s give an npm a moment for taking a breath (~10 sec)...';

package/lib/tasks/reassignnpmtags.js

@@ -19,8 +19,14 @@ const execPromise = promisify( exec );
  * It supports built-in tags (e.g. `latest`, `staging`, `next`) and custom tags (e.g. `latest-v{X}`).
  * Each operation will be retried up to 3 times in case of failure.
  *
+ * When using npm Trusted Publishing (`useOidc`), the `npm whoami` check is replaced by verifying that the `NPM_ID_TOKEN`
+ * environment variable is set, as `npm whoami` does not reflect OIDC authentication. It requires npm 11.21.0 or newer
+ * and a trusted publisher that allows the `npm dist-tag` command.
+ *
  * @param {object} options
- * @param {string} options.npmOwner User that is authorized to release packages.
+ * @param {string} [options.npmOwner] User that is authorized to release packages. Required unless `useOidc` is enabled.
+ * @param {boolean} [options.useOidc=false] Whether to authorize using npm Trusted Publishing (OIDC). When enabled,
+ * the `npm whoami` authorization check is skipped and the `NPM_ID_TOKEN` environment variable must be set instead.
  * @param {string} options.version Specifies the version of packages to reassign the tags for.
  * @param {Array.<string>} options.packages Array of packages' names to reassign tags for.
  * @param {string} [options.npmTag='latest'] Npm dist-tag to assign.
@@ -29,6 +35,7 @@ const execPromise = promisify( exec );
 export default async function reassignNpmTags( options ) {
 	const {
 		npmOwner,
+		useOidc = false,
 		version,
 		packages,
 		npmTag = 'latest'
@@ -38,7 +45,7 @@ export default async function reassignNpmTags( options ) {
 	const packagesSkipped = [];
 	const packagesUpdated = [];
 
-	await assertNpmAuthorization( npmOwner );
+	await assertNpmAuthorization( npmOwner, { useOidc } );
 
 	const counter = tools.createSpinner( 'Reassigning npm tags...', { total: packages.length } );
 	counter.start();

package/lib/utils/assertnpmauthorization.js

@@ -8,10 +8,25 @@ import { tools } from '@ckeditor/ckeditor5-dev-utils';
 /**
  * Checks whether a user is logged to npm as the provided account name.
  *
- * @param {string} npmOwner Expected npm account name that should be logged into npm.
+ * When using npm Trusted Publishing (`useOidc`), the check verifies that the `NPM_ID_TOKEN` environment variable is set
+ * instead. npm exchanges the OIDC token only during supported operations, such as `npm publish` or `npm dist-tag`,
+ * and `npm whoami` does not reflect Trusted Publishing authentication.
+ *
+ * @param {string} [npmOwner] Expected npm account name that should be logged into npm. Required unless `useOidc` is enabled.
+ * @param {object} [options={}]
+ * @param {boolean} [options.useOidc=false] Whether to verify the npm Trusted Publishing (OIDC) setup instead of the npm account.
  * @returns {Promise}
  */
-export default async function assertNpmAuthorization( npmOwner ) {
+export default async function assertNpmAuthorization( npmOwner, { useOidc = false } = {} ) {
+	if ( useOidc ) {
+		// Only the token presence can be verified upfront.
+		if ( !process.env.NPM_ID_TOKEN ) {
+			throw new Error( 'The "NPM_ID_TOKEN" environment variable is required when using npm Trusted Publishing (OIDC).' );
+		}
+
+		return;
+	}
+
 	return tools.shExec( 'npm whoami', { verbosity: 'error', async: true } )
 		.then( npmCurrentUser => {
 			if ( npmOwner !== npmCurrentUser.trim() ) {

package/lib/utils/executeinparallel.js

@@ -31,6 +31,9 @@ const WORKER_SCRIPT = new URL( './parallelworker.js', import.meta.url );
  * @param {ExecuteInParallelPackagesDirectoryFilter|null} [options.packagesDirectoryFilter=null] An optional callback allowing filtering out
  * directories/packages that should not be touched by the task.
  * @param {string} [options.cwd=process.cwd()] Current working directory from which all paths will be resolved.
+ * @param {string} [options.workerDirectory='build'] A directory, relative to `options.cwd`, where temporary worker modules are stored.
+ * It must be inside the project so workers can resolve dependencies from `node_modules`. The default `build` directory is usually ignored
+ * by git, preventing leftover files from polluting the working tree.
  * @param {number} [options.concurrency=require( 'os' ).cpus().length / 2] Number of CPUs that will execute the task.
  * @returns {Promise}
  */
@@ -43,6 +46,7 @@ export default async function executeInParallel( options ) {
 		taskOptions = null,
 		packagesDirectoryFilter = null,
 		cwd = process.cwd(),
+		workerDirectory = 'build',
 		concurrency = os.cpus().length / 2
 	} = options;
 
@@ -53,7 +57,10 @@ export default async function executeInParallel( options ) {
 
 	const packagesInThreads = getPackagesGroupedByThreads( packagesToProcess, concurrencyAsInteger );
 
-	const callbackModule = upath.join( cwd, crypto.randomUUID() + '.mjs' );
+	const callbackModuleDirectory = upath.join( cwd, workerDirectory );
+	const callbackModule = upath.join( callbackModuleDirectory, crypto.randomUUID() + '.mjs' );
+
+	await fs.mkdir( callbackModuleDirectory, { recursive: true } );
 	await fs.writeFile( callbackModule, `export default ${ taskToExecute };`, 'utf-8' );
 
 	const onPackageDone = progressFactory( listrTask, packagesToProcess.length );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-dev-release-tools",
-  "version": "62.0.0",
+  "version": "62.2.0",
   "description": "Tools used for releasing CKEditor 5 and related packages.",
   "keywords": [],
   "author": "CKSource (http://cksource.com/)",
@@ -22,7 +22,7 @@
     "lib"
   ],
   "dependencies": {
-    "@ckeditor/ckeditor5-dev-utils": "^62.0.0",
+    "@ckeditor/ckeditor5-dev-utils": "^62.2.0",
     "@octokit/rest": "^22.0.1",
     "cli-columns": "^4.0.0",
     "glob": "^13.0.6",