@decohere/ci-tools 0.0.1-dev.109 → 0.0.1-dev.11

package/src/audit/upsert-clickup.mjs

@@ -1,117 +0,0 @@
-/**
- * Upsert a ClickUp task with the current npm audit report.
- *
- * Env: CLICKUP_API_KEY (required), CLICKUP_LIST_ID (default Decohere list).
- */
-import { existsSync, readFileSync } from "node:fs";
-import { formatMarkdown, parseAudit } from "./format.mjs";
-
-const auditFilePath = process.argv[2] ?? "npm-audit.json";
-const TASK_NAME = "chore(security): npm audit findings";
-const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
-const API = "https://api.clickup.com/api/v2";
-
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "(run URL unavailable)";
-}
-
-async function clickup(method, path, body) {
-	const key = process.env.CLICKUP_API_KEY;
-	if (key == null || key.length === 0) {
-		throw new Error("Missing CLICKUP_API_KEY");
-	}
-	const response = await fetch(`${API}${path}`, {
-		method,
-		headers: {
-			Authorization: key,
-			"Content-Type": "application/json",
-		},
-		body: body == null ? undefined : JSON.stringify(body),
-	});
-	const text = await response.text();
-	if (!response.ok) {
-		throw new Error(
-			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
-		);
-	}
-	return text.length === 0 ? undefined : JSON.parse(text);
-}
-
-async function findTaskByName(name) {
-	for (let page = 0; page < 10; page++) {
-		const qs = new URLSearchParams({
-			include_closed: "true",
-			subtasks: "false",
-			page: String(page),
-		});
-		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
-		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
-		const match = tasks.find((t) => t.name === name);
-		if (match) return match;
-		if (tasks.length < 100) break;
-	}
-	return null;
-}
-
-async function firstOpenStatus() {
-	const list = await clickup("GET", `/list/${LIST_ID}`);
-	return (list.statuses ?? []).find((s) => s.type === "open")?.status;
-}
-
-function buildDescription(parsed) {
-	const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
-	return [
-		formatMarkdown(parsed).trim(),
-		"",
-		`- Commit: \`${sha}\``,
-		`- Workflow run: ${runUrl()}`,
-		"",
-		"Updated by the nightly npm-audit workflow. PR CI still gates high/critical.",
-	].join("\n");
-}
-
-if (!existsSync(auditFilePath)) {
-	console.log(`No audit file at ${auditFilePath}; skipping ClickUp upsert.`);
-	process.exit(0);
-}
-
-const parsed = parseAudit(JSON.parse(readFileSync(auditFilePath, "utf8")));
-const existing = await findTaskByName(TASK_NAME);
-
-if (parsed.total === 0) {
-	if (existing) {
-		await clickup("PUT", `/task/${existing.id}`, {
-			markdown_description: buildDescription(parsed),
-		});
-		console.log(`Cleared findings on ClickUp task ${existing.id}`);
-	} else {
-		console.log("No vulnerabilities and no existing ClickUp task; nothing to upsert.");
-	}
-	process.exit(0);
-}
-
-const payload = {
-	name: TASK_NAME,
-	markdown_description: buildDescription(parsed),
-	custom_item_id: 1004,
-};
-
-if (existing) {
-	const update = { markdown_description: payload.markdown_description };
-	if (existing.closed || existing.status?.type === "closed") {
-		const status = await firstOpenStatus();
-		if (status) update.status = status;
-	}
-	await clickup("PUT", `/task/${existing.id}`, update);
-	console.log(`Updated ClickUp task ${existing.id} (${existing.url ?? ""})`);
-} else {
-	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
-	console.log(`Created ClickUp task ${created.id} ${created.url ?? ""}`);
-}

package/src/github/credential-nudge.mjs

@@ -1,320 +0,0 @@
-import { resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
-const API = "https://api.clickup.com/api/v2";
-const WARN_DAYS = 14;
-const MS_PER_DAY = 86_400_000;
-const CHORE_TYPE = 1004;
-const DEFAULT_REPO = "typesmiths/decohere";
-
-/**
- * One profile per credential. Date math, ClickUp upsert, and fail-closed live below.
- * `ghEnv` unset means repo secret / repo variable (not an Actions environment).
- *
- * @typedef {{
- *   id: string,
- *   secret: string,
- *   expiresVar: string,
- *   ghEnv?: string,
- *   mint: string,
- *   failImpact: string,
- *   rejectedWhy: string,
- *   revokeUrl: string,
- * }} CredentialProfile
- */
-
-/** @type {Record<string, CredentialProfile>} */
-export const CREDENTIALS = {
-	ghcr: {
-		id: "ghcr",
-		secret: "GHCR_PUSH_TOKEN",
-		expiresVar: "GHCR_TOKEN_EXPIRES_AT",
-		ghEnv: "ghcr-publish",
-		mint: "Create a **classic** GitHub PAT (fine-grained tokens cannot push to GHCR): https://github.com/settings/tokens/new?scopes=write:packages",
-		failImpact:
-			"npm may already have published. Docker login/push and the `v*` tag will **fail**. The SHA stays untagged, so the next successful Publish of that tip can finish Docker + tag after you rotate. Images are not pushed with `GITHUB_TOKEN`.",
-		rejectedWhy: "GHCR `docker login` returned 401 (expired, revoked, or wrong secret name).",
-		revokeUrl: "https://github.com/settings/tokens",
-	},
-	npm: {
-		id: "npm",
-		secret: "NODE_AUTH_TOKEN",
-		expiresVar: "NODE_AUTH_TOKEN_EXPIRES_AT",
-		mint: "Create an npm **read** token (granular/classic) at https://www.npmjs.com/settings/~/tokens — Publish PUTs are OIDC; this token is only for private `npm view` and create smoke.",
-		failImpact:
-			"Verify cannot see private packages, so skipIfPublished and create smoke are unsafe. Publish **fails closed** before OIDC/Docker. After you rotate, re-run the failed Publish jobs.",
-		rejectedWhy: "`npm whoami` failed (expired, revoked, or missing `NODE_AUTH_TOKEN`).",
-		revokeUrl: "https://www.npmjs.com/settings/~/tokens",
-	},
-};
-
-export function utcDayMs(date) {
-	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
-}
-
-/** @param {string | undefined} raw */
-export function parseExpiresAt(raw) {
-	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(raw ?? "").trim());
-	if (!match) {
-		return null;
-	}
-	return Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
-}
-
-/**
- * @param {{ now?: number, expiresAtMs: number | null, warnDays?: number }} options
- * @returns {{ kind: "missing" | "ok" | "warn" | "expired", daysLeft: number | null }}
- */
-export function assessTokenLifetime(options) {
-	const { expiresAtMs, warnDays = WARN_DAYS } = options;
-	if (expiresAtMs == null) {
-		return { kind: "missing", daysLeft: null };
-	}
-	const today = utcDayMs(new Date(options.now ?? Date.now()));
-	const daysLeft = Math.round((expiresAtMs - today) / MS_PER_DAY);
-	if (daysLeft <= 0) {
-		return { kind: "expired", daysLeft };
-	}
-	if (daysLeft <= warnDays) {
-		return { kind: "warn", daysLeft };
-	}
-	return { kind: "ok", daysLeft };
-}
-
-/** @param {CredentialProfile} credential */
-export function resolveRepo() {
-	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
-}
-
-/** @param {CredentialProfile} credential */
-export function ghScopeFlags(credential) {
-	return credential.ghEnv ? `--env ${credential.ghEnv} ` : "";
-}
-
-/** @param {string} id */
-export function credentialProfile(id) {
-	const credential = CREDENTIALS[id];
-	if (!credential) {
-		throw new Error(
-			`Unknown NUDGE_CREDENTIAL=${id}. Expected one of: ${Object.keys(CREDENTIALS).join(", ")}`,
-		);
-	}
-	return credential;
-}
-
-/** @param {CredentialProfile} credential */
-export function taskName(credential, expiresYmd) {
-	return `chore(security): rotate ${credential.secret} (expires ${expiresYmd})`;
-}
-
-/** @param {CredentialProfile} credential */
-export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
-	const next = nextExpiresYmd ?? "YYYY-MM-DD";
-	const flags = ghScopeFlags(credential);
-	return [
-		credential.mint,
-		"",
-		"Then from a trusted machine (do not paste the token into Actions or this task):",
-		"",
-		"```bash",
-		`gh secret set ${credential.secret} ${flags}--repo ${repo}`,
-		`gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body ${next}`,
-		"```",
-		"",
-		`Revoke the old token: ${credential.revokeUrl}`,
-		"Mark this task complete, then retry Publish:",
-		"",
-		"```bash",
-		`gh run list --repo ${repo} --workflow Publish --limit 5`,
-		`gh run rerun --failed <run-id> --repo ${repo}`,
-		"```",
-	].join("\n");
-}
-
-export function suggestedNextExpiry(fromMs, days = 90) {
-	const start = utcDayMs(new Date(fromMs));
-	const next = new Date(start + days * MS_PER_DAY);
-	const y = next.getUTCFullYear();
-	const m = String(next.getUTCMonth() + 1).padStart(2, "0");
-	const d = String(next.getUTCDate()).padStart(2, "0");
-	return `${y}-${m}-${d}`;
-}
-
-/** @param {CredentialProfile} credential */
-export function buildDescription(credential, options) {
-	const { kind, expiresYmd, daysLeft, rejected, runUrl } = options;
-	const next = suggestedNextExpiry(Date.now());
-	const why = rejected
-		? credential.rejectedWhy
-		: kind === "expired"
-			? `${credential.expiresVar} (${expiresYmd}) is today or in the past. Rotate ${credential.secret} and this date before Publish can continue.`
-			: `${credential.secret} expires on ${expiresYmd} (${daysLeft} day(s) left). Rotate before that date so Publish does not fail closed.`;
-	return [
-		"## Summary",
-		"",
-		why,
-		"",
-		"## If this is not done in time",
-		"",
-		credential.failImpact,
-		"",
-		"## Commands",
-		"",
-		rotationCommands(credential, next),
-		"",
-		runUrl ? `- Workflow run: ${runUrl}` : null,
-	]
-		.filter((line) => line != null)
-		.join("\n");
-}
-
-async function clickup(method, path, body) {
-	const key = process.env.CLICKUP_API_KEY;
-	if (key == null || key.length === 0) {
-		throw new Error("Missing CLICKUP_API_KEY");
-	}
-	const response = await fetch(`${API}${path}`, {
-		method,
-		headers: {
-			Authorization: key,
-			"Content-Type": "application/json",
-		},
-		body: body == null ? undefined : JSON.stringify(body),
-	});
-	const text = await response.text();
-	if (!response.ok) {
-		throw new Error(
-			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
-		);
-	}
-	return text.length === 0 ? undefined : JSON.parse(text);
-}
-
-async function findTaskByName(name) {
-	for (let page = 0; page < 10; page += 1) {
-		const qs = new URLSearchParams({
-			include_closed: "true",
-			subtasks: "false",
-			page: String(page),
-		});
-		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
-		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
-		const match = tasks.find((task) => task.name === name);
-		if (match) {
-			return match;
-		}
-		if (tasks.length < 100) {
-			break;
-		}
-	}
-	return null;
-}
-
-async function firstOpenStatus() {
-	const list = await clickup("GET", `/list/${LIST_ID}`);
-	return (list.statuses ?? []).find((status) => status.type === "open")?.status;
-}
-
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "";
-}
-
-/** @param {CredentialProfile} credential */
-export async function upsertRotationTask(credential, options) {
-	const { expiresYmd, kind, daysLeft, rejected } = options;
-	const name = taskName(credential, expiresYmd ?? "unknown");
-	const existing = await findTaskByName(name);
-	const dueMs = parseExpiresAt(expiresYmd);
-	const payload = {
-		name,
-		markdown_description: buildDescription(credential, {
-			kind,
-			expiresYmd,
-			daysLeft,
-			rejected,
-			runUrl: runUrl(),
-		}),
-		custom_item_id: CHORE_TYPE,
-		priority: rejected || kind === "expired" ? 1 : 2,
-		due_date: dueMs == null ? undefined : dueMs,
-		due_date_time: false,
-	};
-	const assignee = process.env.CLICKUP_ASSIGNEE_ID?.trim();
-	if (assignee) {
-		payload.assignees = [Number(assignee)];
-	}
-
-	if (existing) {
-		const update = {
-			markdown_description: payload.markdown_description,
-			priority: payload.priority,
-			due_date: payload.due_date,
-			due_date_time: false,
-		};
-		if (existing.closed || existing.status?.type === "closed") {
-			const status = await firstOpenStatus();
-			if (status) {
-				update.status = status;
-			}
-		}
-		await clickup("PUT", `/task/${existing.id}`, update);
-		return { id: existing.id, url: existing.url, created: false };
-	}
-	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
-	return { id: created.id, url: created.url, created: true };
-}
-
-export async function runNudge(env = process.env) {
-	const credential = credentialProfile(String(env.NUDGE_CREDENTIAL ?? "").trim());
-	const rejected = env.NUDGE_REJECTED === "1";
-	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
-	const expiresAtMs = parseExpiresAt(expiresYmd);
-	const assessment = assessTokenLifetime({ expiresAtMs });
-	const flags = ghScopeFlags(credential);
-	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
-
-	if (assessment.kind === "missing" && !rejected) {
-		process.stderr.write(
-			`${credential.ghEnv ? `${credential.ghEnv} environment` : "repository"} variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
-				`  gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body YYYY-MM-DD\n`,
-		);
-		return 1;
-	}
-
-	if (rejected || assessment.kind === "warn" || assessment.kind === "expired") {
-		const result = await upsertRotationTask(credential, {
-			expiresYmd: expiresYmd || "unknown",
-			kind: assessment.kind,
-			daysLeft: assessment.daysLeft,
-			rejected,
-		});
-		process.stdout.write(
-			`${result.created ? "Created" : "Updated"} ClickUp ${result.id} ${result.url ?? ""}\n`,
-		);
-	}
-
-	if (rejected || assessment.kind === "expired" || assessment.kind === "missing") {
-		if (assessment.kind === "expired") {
-			process.stderr.write(
-				`${credential.secret} calendar expiry ${expiresYmd} has been reached — refusing to continue\n`,
-			);
-		}
-		return 1;
-	}
-	return 0;
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	process.exit(await runNudge());
-}