@decohere/ci-tools 0.0.1-dev.108 → 0.0.1-dev.11

package/src/github/oidc-bootstrap-nudge.mjs

@@ -1,368 +0,0 @@
-import { resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { listPublishablePackages } from "./publish-verify.mjs";
-
-const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
-const API = "https://api.clickup.com/api/v2";
-const GITHUB_API = process.env.GITHUB_API_URL ?? "https://api.github.com";
-const DEPLOYMENT_TYPE = 1005;
-const TASK_NAME = "deploy(publish): OIDC bootstrap unpublished packages";
-const LEGACY_TASK_NAMES = ["chore(publish): OIDC bootstrap unpublished packages"];
-const BOOTSTRAP_ENV = "npm-oidc-bootstrap";
-const DEFAULT_REPO = "typesmiths/decohere";
-
-export function taskName() {
-	return TASK_NAME;
-}
-
-export function bootstrapTaskNames() {
-	return [TASK_NAME, ...LEGACY_TASK_NAMES];
-}
-
-/** @param {string | undefined} raw */
-export function parseUnpublished(raw) {
-	return String(raw ?? "")
-		.split(/\s+/)
-		.map((name) => name.trim())
-		.filter(Boolean);
-}
-
-/** @param {string | undefined} raw */
-export function parseAssigneeIds(raw) {
-	return String(raw ?? "")
-		.split(/[,\s]+/)
-		.map((id) => Number(id.trim()))
-		.filter((id) => Number.isInteger(id) && id > 0);
-}
-
-/**
- * @param {string | undefined} version
- */
-export function needsPrereleaseTag(version) {
-	return String(version ?? "").includes("-");
-}
-
-/**
- * @param {{ name: string, dir: string, version?: string }[]} packages
- * @param {string} [channel]
- */
-export function firstPublishCommands(packages, channel = "dev") {
-	if (packages.length === 0) {
-		return [`npm publish ./<package-dir> --tag ${channel}`];
-	}
-	return packages.map((pkg) => {
-		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
-		return `npm publish ./projects/${pkg.dir}${tag}`;
-	});
-}
-
-/**
- * @param {unknown} environment
- * @returns {string[]}
- */
-export function extractGitHubReviewerLogins(environment) {
-	const rules =
-		environment && typeof environment === "object" ? environment.protection_rules : null;
-	if (!Array.isArray(rules)) {
-		return [];
-	}
-	const logins = [];
-	for (const rule of rules) {
-		const reviewers = rule?.reviewers;
-		if (!Array.isArray(reviewers)) {
-			continue;
-		}
-		for (const entry of reviewers) {
-			const login = entry?.reviewer?.login;
-			if (typeof login === "string" && login.length > 0 && entry?.type !== "Team") {
-				logins.push(login);
-			}
-		}
-	}
-	return [...new Set(logins)];
-}
-
-/**
- * @param {string[]} logins
- * @param {{ id?: number, username?: string, email?: string }[]} members
- */
-export function mapLoginsToClickUpIds(logins, members) {
-	const ids = new Set();
-	for (const login of logins) {
-		const key = login.toLowerCase();
-		for (const member of members) {
-			const username = String(member.username ?? "").toLowerCase();
-			const email = String(member.email ?? "").toLowerCase();
-			const local = email.split("@")[0] ?? "";
-			if (username === key || local === key || email === key) {
-				const id = Number(member.id);
-				if (Number.isInteger(id) && id > 0) {
-					ids.add(id);
-				}
-			}
-		}
-	}
-	return [...ids];
-}
-
-/**
- * @param {{
- *   unpublished: string[],
- *   packages: { name: string, dir: string, version?: string }[],
- *   repo?: string,
- *   runUrl?: string,
- *   channel?: string,
- * }} options
- */
-export function buildDescription(options) {
-	const repo = options.repo || DEFAULT_REPO;
-	const names = options.unpublished;
-	const channel = options.channel || "dev";
-	const packages = options.packages.filter((pkg) => names.includes(pkg.name));
-	const [owner, repoName] = repo.split("/");
-	return [
-		"## Summary",
-		"",
-		"These package names are not on npm yet, so OIDC `npm publish` cannot run until each name exists and has a Trusted Publisher:",
-		"",
-		...names.map((name) => `- \`${name}\``),
-		"",
-		"## What to do",
-		"",
-		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
-		"",
-		"```bash",
-		...firstPublishCommands(packages, channel),
-		"```",
-		"",
-		"2. npm → package settings → Trusted Publisher → GitHub Actions:",
-		"",
-		`- Organization: \`${owner ?? "typesmiths"}\``,
-		`- Repository: \`${repoName ?? "decohere"}\``,
-		"- Workflow filename: `publish.yml`",
-		"- Environment: `npm-publish`",
-		"- Allowed action: `npm publish` (not staged-only)",
-		"",
-		"3. Approve the waiting **npm-oidc-bootstrap** deployment on this Publish run. The job re-checks that the names exist, then npm + Docker + tag continue. If reviewers were not configured and the job already failed:",
-		"",
-		"```bash",
-		`gh run list --repo ${repo} --workflow Publish --limit 5`,
-		`gh run rerun --failed <run-id> --repo ${repo}`,
-		"```",
-		"",
-		options.runUrl ? `- Workflow run: ${options.runUrl}` : null,
-	]
-		.filter((line) => line != null)
-		.join("\n");
-}
-
-async function clickup(method, path, body) {
-	const key = process.env.CLICKUP_API_KEY;
-	if (key == null || key.length === 0) {
-		throw new Error("Missing CLICKUP_API_KEY");
-	}
-	const response = await fetch(`${API}${path}`, {
-		method,
-		headers: {
-			Authorization: key,
-			"Content-Type": "application/json",
-		},
-		body: body == null ? undefined : JSON.stringify(body),
-	});
-	const text = await response.text();
-	if (!response.ok) {
-		throw new Error(
-			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
-		);
-	}
-	return text.length === 0 ? undefined : JSON.parse(text);
-}
-
-async function findTaskByName(names) {
-	const wanted = new Set(Array.isArray(names) ? names : [names]);
-	for (let page = 0; page < 10; page += 1) {
-		const qs = new URLSearchParams({
-			include_closed: "true",
-			subtasks: "false",
-			page: String(page),
-		});
-		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
-		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
-		const match = tasks.find((task) => wanted.has(task.name));
-		if (match) {
-			return match;
-		}
-		if (tasks.length < 100) {
-			break;
-		}
-	}
-	return null;
-}
-
-async function firstOpenStatus() {
-	const list = await clickup("GET", `/list/${LIST_ID}`);
-	return (list.statuses ?? []).find((status) => status.type === "open")?.status;
-}
-
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "";
-}
-
-/**
- * @param {{ fetch?: typeof fetch, token?: string, repo?: string, environment?: string }} options
- */
-export async function githubEnvironmentReviewerLogins(options = {}) {
-	const token = options.token ?? process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
-	const repo = options.repo ?? process.env.GITHUB_REPOSITORY ?? "";
-	const environment = options.environment ?? BOOTSTRAP_ENV;
-	const fetchFn = options.fetch ?? fetch;
-	if (!token || !repo) {
-		return [];
-	}
-	const response = await fetchFn(
-		`${GITHUB_API}/repos/${repo}/environments/${encodeURIComponent(environment)}`,
-		{
-			headers: {
-				Authorization: `Bearer ${token}`,
-				Accept: "application/vnd.github+json",
-				"X-GitHub-Api-Version": "2022-11-28",
-			},
-		},
-	);
-	if (!response.ok) {
-		process.stderr.write(
-			`Could not list ${environment} reviewers (${response.status}); assigning from CLICKUP_ASSIGNEE_ID only\n`,
-		);
-		return [];
-	}
-	return extractGitHubReviewerLogins(await response.json());
-}
-
-export async function clickupWorkspaceMembers() {
-	const data = await clickup("GET", "/team");
-	const teams = Array.isArray(data?.teams) ? data.teams : [];
-	const members = [];
-	for (const team of teams) {
-		for (const entry of team.members ?? []) {
-			const user = entry?.user ?? entry;
-			if (user?.id) {
-				members.push({
-					id: Number(user.id),
-					username: user.username,
-					email: user.email,
-				});
-			}
-		}
-	}
-	return members;
-}
-
-/**
- * @param {{ unpublished: string[], packages: { name: string, dir: string, version?: string }[], assigneeIds: number[], repo?: string, runUrl?: string, channel?: string }} options
- */
-export async function upsertBootstrapTask(options) {
-	const name = taskName();
-	const existing = await findTaskByName(bootstrapTaskNames());
-	const markdown = buildDescription(options);
-	const payload = {
-		name,
-		markdown_description: markdown,
-		custom_item_id: DEPLOYMENT_TYPE,
-		priority: 1,
-	};
-	if (options.assigneeIds.length > 0 && !existing) {
-		payload.assignees = options.assigneeIds;
-	}
-
-	if (existing) {
-		const update = {
-			name,
-			markdown_description: markdown,
-			custom_item_id: DEPLOYMENT_TYPE,
-			priority: 1,
-		};
-		if (existing.closed || existing.status?.type === "closed") {
-			const status = await firstOpenStatus();
-			if (status) {
-				update.status = status;
-			}
-		}
-		if (options.assigneeIds.length > 0) {
-			update.assignees = { add: options.assigneeIds };
-		}
-		await clickup("PUT", `/task/${existing.id}`, update);
-		return { id: existing.id, url: existing.url, created: false };
-	}
-	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
-	return { id: created.id, url: created.url, created: true };
-}
-
-export async function runNudge(env = process.env, io = {}) {
-	const unpublished = parseUnpublished(env.UNPUBLISHED);
-	if (unpublished.length === 0) {
-		process.stdout.write("No unpublished package names; skipping ClickUp bootstrap task\n");
-		return 0;
-	}
-
-	const root = io.root ?? process.cwd();
-	const packages = (io.listPackages ?? listPublishablePackages)(root);
-	const logins = await (io.githubReviewers ?? githubEnvironmentReviewerLogins)({
-		token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
-		repo: env.GITHUB_REPOSITORY,
-	});
-	const members = await (io.clickupMembers ?? clickupWorkspaceMembers)();
-	const assigneeIds = [
-		...new Set([
-			...mapLoginsToClickUpIds(logins, members),
-			...parseAssigneeIds(env.CLICKUP_ASSIGNEE_ID),
-		]),
-	];
-
-	if (logins.length > 0 && mapLoginsToClickUpIds(logins, members).length === 0) {
-		process.stderr.write(
-			`GitHub ${BOOTSTRAP_ENV} reviewers (${logins.join(", ")}) did not match a ClickUp member (login ↔ username or email local-part)\n`,
-		);
-	}
-
-	const result = await (io.upsert ?? upsertBootstrapTask)({
-		unpublished,
-		packages,
-		assigneeIds,
-		repo: env.GITHUB_REPOSITORY || DEFAULT_REPO,
-		runUrl: io.runUrl ?? runUrl(),
-		channel: env.PUBLISH_CHANNEL || env.CHANNEL || "dev",
-	});
-	const url = result.url ?? "";
-	process.stdout.write(
-		`${result.created ? "Created" : "Updated"} ClickUp ${result.id} ${url}\n`,
-	);
-	if (assigneeIds.length > 0) {
-		process.stdout.write(`Assigned ClickUp users ${assigneeIds.join(", ")}\n`);
-	} else {
-		process.stdout.write(
-			"No ClickUp assignees (add required reviewers on npm-oidc-bootstrap, or set vars.CLICKUP_ASSIGNEE_ID)\n",
-		);
-	}
-	if (env.GITHUB_OUTPUT) {
-		const { appendFileSync } = await import("node:fs");
-		appendFileSync(env.GITHUB_OUTPUT, `task_url=${url}\n`);
-	}
-	if (!url) {
-		throw new Error("ClickUp bootstrap task has no URL");
-	}
-	return 0;
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	process.exit(await runNudge());
-}

package/src/github/publish-verify.mjs

@@ -1,209 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-/**
- * Workspace packages that `forge publish` will upload (not `"private": true`).
- * @param {string} root
- */
-export function listPublishablePackages(root) {
-	const projectsDir = join(root, "projects");
-	const packages = [];
-	for (const dir of readdirSync(projectsDir)) {
-		const pkgPath = join(projectsDir, dir, "package.json");
-		if (!existsSync(pkgPath)) {
-			continue;
-		}
-		const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-		if (typeof pkg.name !== "string" || pkg.private === true) {
-			continue;
-		}
-		packages.push({
-			name: pkg.name,
-			version: pkg.version,
-			dir,
-		});
-	}
-	return packages.sort((a, b) => a.name.localeCompare(b.name));
-}
-
-export function dockerRepositories(root) {
-	const create = JSON.parse(readFileSync(join(root, "projects/create/package.json"), "utf8"));
-	const devcontainer = JSON.parse(
-		readFileSync(join(root, "projects/devcontainer/package.json"), "utf8"),
-	);
-	return {
-		create: create.decohere?.dockerImageRepository ?? "ghcr.io/typesmiths/decohere/create",
-		devcontainer:
-			devcontainer.decohere?.dockerImageRepository ??
-			"ghcr.io/typesmiths/decohere/devcontainer",
-		createVersion: create.version,
-		workspaceVersion: JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version,
-	};
-}
-
-/**
- * @param {string} spec package or package@version
- * @param {{ spawnSync?: typeof spawnSync }} [io]
- */
-export function npmNameExists(spec, io = {}) {
-	const spawn = io.spawnSync ?? spawnSync;
-	const result = spawn("npm", ["view", spec, "name"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
-	});
-	return result.status === 0;
-}
-
-/**
- * @param {string} spec package@version
- * @param {{ spawnSync?: typeof spawnSync }} [io]
- */
-export function npmVersionExists(spec, io = {}) {
-	const spawn = io.spawnSync ?? spawnSync;
-	const result = spawn("npm", ["view", spec, "version"], {
-		encoding: "utf8",
-		stdio: ["ignore", "pipe", "pipe"],
-	});
-	return result.status === 0;
-}
-
-/**
- * Parse `ghcr.io/org/name/image` into GitHub packages API coordinates.
- * @param {string} repository
- */
-export function parseGhcrRepository(repository) {
-	const withoutHost = repository.replace(/^ghcr\.io\//, "");
-	const slash = withoutHost.indexOf("/");
-	if (slash < 0) {
-		throw new Error(`Not a GHCR repository: ${repository}`);
-	}
-	return {
-		org: withoutHost.slice(0, slash),
-		packageName: withoutHost.slice(slash + 1),
-	};
-}
-
-/**
- * @param {string} repository ghcr.io/org/pkg
- * @param {string} tag
- * @param {{ token: string, fetch?: typeof fetch }} io
- */
-export async function ghcrTagExists(repository, tag, io) {
-	const { org, packageName } = parseGhcrRepository(repository);
-	const encoded = encodeURIComponent(packageName);
-	const headers = {
-		Authorization: `Bearer ${io.token}`,
-		Accept: "application/vnd.github+json",
-		"X-GitHub-Api-Version": "2022-11-28",
-	};
-	const fetchImpl = io.fetch ?? fetch;
-	for (let page = 1; page <= 20; page += 1) {
-		const url = `https://api.github.com/orgs/${org}/packages/container/${encoded}/versions?per_page=100&page=${page}`;
-		const response = await fetchImpl(url, { headers });
-		if (response.status === 404) {
-			return false;
-		}
-		if (!response.ok) {
-			throw new Error(`GHCR versions ${response.status} for ${repository}`);
-		}
-		const versions = await response.json();
-		if (!Array.isArray(versions) || versions.length === 0) {
-			return false;
-		}
-		for (const version of versions) {
-			const tags = version.metadata?.container?.tags ?? [];
-			if (tags.includes(tag)) {
-				return true;
-			}
-		}
-		if (versions.length < 100) {
-			return false;
-		}
-	}
-	return false;
-}
-
-/**
- * @param {{
- *   root: string,
- *   spawnSync?: typeof spawnSync,
- *   fetch?: typeof fetch,
- *   githubToken?: string,
- * }} options
- */
-export async function collectPublishVerify(options) {
-	const packages = listPublishablePackages(options.root);
-	const unpublished = [];
-	let publishedVersions = 0;
-	for (const pkg of packages) {
-		if (!npmNameExists(pkg.name, options)) {
-			unpublished.push(pkg.name);
-			continue;
-		}
-		if (npmVersionExists(`${pkg.name}@${pkg.version}`, options)) {
-			publishedVersions += 1;
-		}
-	}
-
-	const images = dockerRepositories(options.root);
-	const token = options.githubToken ?? "";
-	let skipDocker = false;
-	if (token) {
-		const createExists = await ghcrTagExists(images.create, images.workspaceVersion, {
-			token,
-			fetch: options.fetch,
-		});
-		const devExists = await ghcrTagExists(images.devcontainer, images.workspaceVersion, {
-			token,
-			fetch: options.fetch,
-		});
-		skipDocker = createExists && devExists;
-	}
-
-	return {
-		unpublished,
-		skipNpm: packages.length > 0 && publishedVersions === packages.length,
-		skipDocker,
-		imageTag: images.workspaceVersion,
-		createVersion: images.createVersion,
-		repository: images.create,
-		devcontainerRepository: images.devcontainer,
-		packageCount: packages.length,
-		publishedVersions,
-	};
-}
-
-export function formatGithubOutput(result) {
-	return [
-		`unpublished=${result.unpublished.join(" ")}`,
-		`skip_npm=${result.skipNpm ? "true" : "false"}`,
-		`skip_docker=${result.skipDocker ? "true" : "false"}`,
-		`image_tag=${result.imageTag}`,
-		`create_version=${result.createVersion}`,
-		`repository=${result.repository}`,
-		`devcontainer_repository=${result.devcontainerRepository}`,
-	].join("\n");
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	const result = await collectPublishVerify({
-		root: process.cwd(),
-		githubToken: process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN,
-	});
-	const body = formatGithubOutput(result);
-	process.stdout.write(`${body}\n`);
-	if (process.env.GITHUB_OUTPUT) {
-		const { appendFileSync } = await import("node:fs");
-		appendFileSync(process.env.GITHUB_OUTPUT, `${body}\n`);
-	}
-	if (result.unpublished.length) {
-		process.stderr.write(
-			`Never-published packages (bootstrap OIDC before PUT): ${result.unpublished.join(", ")}\n`,
-		);
-	}
-}

package/src/github/smoke-create-launcher.mjs

@@ -1,70 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-/**
- * Run `npx @decohere/create@version --help` from an empty temp directory.
- * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
- * `@decohere/create` into the workspace tree and npm's npx misses the bin.
- *
- * @param {{
- *   createVersion: string,
- *   authToken: string,
- *   mkdtempSync?: typeof mkdtempSync,
- *   writeFileSync?: typeof writeFileSync,
- *   spawnSync?: typeof spawnSync,
- *   tmpdir?: () => string,
- *   stdio?: import("node:child_process").StdioOptions,
- * }} options
- */
-export function runCreateLauncherSmoke(options) {
-	const version = options.createVersion?.trim() ?? "";
-	const token = options.authToken?.trim() ?? "";
-	if (!version) {
-		throw new Error("CREATE_VERSION is required");
-	}
-	if (!token) {
-		throw new Error("NODE_AUTH_TOKEN is required");
-	}
-
-	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
-	const writeFile = options.writeFileSync ?? writeFileSync;
-	const spawn = options.spawnSync ?? spawnSync;
-	const tmp = options.tmpdir ?? tmpdir;
-
-	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
-	const npmrc = join(workDir, ".npmrc");
-	writeFile(
-		npmrc,
-		`@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`,
-	);
-
-	const result = spawn("npx", ["--yes", `@decohere/create@${version}`, "--help"], {
-		cwd: workDir,
-		env: {
-			...process.env,
-			NPM_CONFIG_USERCONFIG: npmrc,
-			NODE_AUTH_TOKEN: token,
-		},
-		stdio: options.stdio ?? "inherit",
-	});
-
-	return {
-		workDir,
-		status: result.status ?? 1,
-	};
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	const { status } = runCreateLauncherSmoke({
-		createVersion: process.env.CREATE_VERSION ?? "",
-		authToken: process.env.NODE_AUTH_TOKEN ?? "",
-	});
-	process.exit(status);
-}