@davidvornholt/standards 0.19.0 → 0.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (56) hide show
  1. package/README.md +7 -5
  2. package/package.json +19 -1
  3. package/src/cli.ts +2 -2
  4. package/src/creds-add-cloudflare-commit.ts +2 -5
  5. package/src/creds-add-github.ts +82 -30
  6. package/src/creds-add-policy.ts +106 -26
  7. package/src/creds-add-preflight.ts +68 -0
  8. package/src/creds-add.ts +29 -20
  9. package/src/creds-args.ts +14 -0
  10. package/src/creds-cloudflare-account.ts +2 -2
  11. package/src/creds-cloudflare-id.ts +10 -0
  12. package/src/creds-cloudflare-zone.ts +40 -0
  13. package/src/creds-commands.ts +34 -11
  14. package/src/creds-github-app-api.ts +132 -0
  15. package/src/creds-github-apps.ts +107 -0
  16. package/src/creds-login-github-manifest.ts +38 -15
  17. package/src/creds-login-github.ts +78 -24
  18. package/src/creds-naming.ts +13 -0
  19. package/src/creds-plan-renew.ts +2 -5
  20. package/src/creds-plan-report.ts +87 -0
  21. package/src/creds-plan-run.ts +2 -11
  22. package/src/creds-plan-types.ts +19 -0
  23. package/src/creds-plan-unmanaged.ts +102 -0
  24. package/src/creds-plan.ts +25 -21
  25. package/src/creds-revoke.ts +162 -0
  26. package/src/creds-sops-value.ts +89 -0
  27. package/src/creds-sops.ts +0 -53
  28. package/src/creds-store-github.ts +121 -0
  29. package/src/creds-store-lock-holder.ts +105 -0
  30. package/src/creds-store-lock-inspection.ts +125 -0
  31. package/src/creds-store-lock-lease.ts +32 -0
  32. package/src/creds-store-lock.ts +28 -51
  33. package/src/creds-store.ts +14 -43
  34. package/src/dev-env-compose.ts +120 -0
  35. package/src/dev-env-destination-duplicates.ts +10 -10
  36. package/src/dev-env-destination-gitignore.ts +22 -0
  37. package/src/dev-env-destination.ts +52 -30
  38. package/src/dev-env-document.ts +19 -6
  39. package/src/dev-env-dotenv.ts +12 -3
  40. package/src/dev-env-reconciliation.ts +170 -0
  41. package/src/dev-env-secrets.ts +41 -0
  42. package/src/dev-env-transaction-recovery.ts +74 -11
  43. package/src/dev-env-transaction.ts +61 -15
  44. package/src/dev-env.ts +115 -63
  45. package/src/github-command-shared.ts +8 -1
  46. package/src/github-live-drift.ts +3 -3
  47. package/src/poller-closing-reference.ts +179 -0
  48. package/src/poller-fix-outcome.ts +9 -0
  49. package/src/poller-fix-publication.ts +5 -12
  50. package/src/poller-fix-run.ts +2 -3
  51. package/src/poller-fix-validation.ts +7 -8
  52. package/src/poller-outcome.ts +4 -1
  53. package/src/poller-protected-paths.ts +1 -25
  54. package/src/poller-protocol.ts +0 -42
  55. package/src/poller-review-publication.ts +2 -8
  56. package/src/poller-review-validation.ts +5 -12
@@ -76,8 +76,6 @@ const GATE_WIRING_FILES: ReadonlySet<string> = new Set([
76
76
  const HOST_SECRETS_FILE = /(?:^|\/)secrets\.yaml$/u;
77
77
  const WORKSPACE_GATE_CONFIG =
78
78
  /(?:^|\/)(?:biome\.jsonc|turbo\.json|tsconfig(?:\.[^.]+)?\.json|vitest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s)$/u;
79
- const QUALITY_SCRIPT = /^(?:check|lint|test|typecheck)(?::|$)/u;
80
- const WORKSPACE_MANIFEST = /^(?:apps|packages)\/[^/]+\/package\.json$/u;
81
79
 
82
80
  const isEncryptedSecret = (path: string): boolean =>
83
81
  !path.endsWith('.example.yaml') &&
@@ -101,46 +99,6 @@ export const forbiddenDiffPaths = (
101
99
  );
102
100
  };
103
101
 
104
- const qualityScripts = (
105
- manifest: unknown,
106
- ): Readonly<Record<string, string>> => {
107
- if (
108
- typeof manifest !== 'object' ||
109
- manifest === null ||
110
- !('scripts' in manifest) ||
111
- typeof manifest.scripts !== 'object' ||
112
- manifest.scripts === null
113
- ) {
114
- return {};
115
- }
116
- return Object.fromEntries(
117
- Object.entries(manifest.scripts)
118
- .filter(
119
- (entry): entry is [string, string] =>
120
- QUALITY_SCRIPT.test(entry[0]) && typeof entry[1] === 'string',
121
- )
122
- .sort(([left], [right]) => left.localeCompare(right)),
123
- );
124
- };
125
-
126
- export const changesWorkspaceQualityScripts = (
127
- path: string,
128
- before: string,
129
- after: string,
130
- ): boolean => {
131
- if (path === 'package.json' || !WORKSPACE_MANIFEST.test(path)) {
132
- return false;
133
- }
134
- try {
135
- return (
136
- JSON.stringify(qualityScripts(JSON.parse(before) as unknown)) !==
137
- JSON.stringify(qualityScripts(JSON.parse(after) as unknown))
138
- );
139
- } catch {
140
- return true;
141
- }
142
- };
143
-
144
102
  export const branchNameForIssue = (
145
103
  issueNumber: number,
146
104
  approvalId: string,
@@ -1,10 +1,7 @@
1
1
  import type { ClaimBinding } from './poller-claim';
2
2
  import type { PullRequest } from './poller-github-pulls';
3
3
  import { failJob, type JobDeps, type JobLabels } from './poller-job-shared';
4
- import {
5
- changedWorkspaceQualityManifests,
6
- lockedPathsOf,
7
- } from './poller-protected-paths';
4
+ import { lockedPathsOf } from './poller-protected-paths';
8
5
  import { forbiddenDiffPaths, type ReviewOutcome } from './poller-protocol';
9
6
  import { publishReviewArtifacts } from './poller-review-artifacts';
10
7
  import {
@@ -89,10 +86,7 @@ export const finishReviewedJob = async (options: {
89
86
  const { deps, labels, pr, claim, workDir, outcome } = options;
90
87
  const commits = commitCount(workDir, pr.headSha);
91
88
  const paths = commits > 0 ? changedPaths(workDir, pr.headSha) : [];
92
- const forbidden = [
93
- ...forbiddenDiffPaths(paths, await lockedPathsOf(workDir)),
94
- ...changedWorkspaceQualityManifests(workDir, pr.headSha, paths),
95
- ];
89
+ const forbidden = forbiddenDiffPaths(paths, await lockedPathsOf(workDir));
96
90
  if (forbidden.length > 0) {
97
91
  await failJob(
98
92
  deps,
@@ -7,10 +7,7 @@ import {
7
7
  createValidationWorktree,
8
8
  isAncestor,
9
9
  } from './poller-output-integrity';
10
- import {
11
- changedWorkspaceQualityManifests,
12
- lockedPathsOf,
13
- } from './poller-protected-paths';
10
+ import { lockedPathsOf } from './poller-protected-paths';
14
11
  import { forbiddenDiffPaths } from './poller-protocol';
15
12
  import type { ReviewPublicationPlan } from './poller-review-output';
16
13
 
@@ -47,14 +44,10 @@ export const validateSealedReviewOutput = async (options: {
47
44
  ),
48
45
  );
49
46
  try {
50
- const forbidden = [
51
- ...forbiddenDiffPaths(paths, await lockedPathsOf(workspace.dir)),
52
- ...changedWorkspaceQualityManifests(
53
- workspace.dir,
54
- plan.approvedHead,
55
- paths,
56
- ),
57
- ];
47
+ const forbidden = forbiddenDiffPaths(
48
+ paths,
49
+ await lockedPathsOf(workspace.dir),
50
+ );
58
51
  if (forbidden.length > 0) {
59
52
  throw new Error(
60
53
  `publication blocked: sealed review modified protected paths:\n${forbidden.join('\n')}`,