@decohere/ci-tools 0.0.1-dev.12 → 0.0.1-dev.121

package/src/github/credential-nudge.mjs

@@ -0,0 +1,245 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { upsertIssue } from "../lib/github-issue.mjs";
+
+const WARN_DAYS = 14;
+const MS_PER_DAY = 86_400_000;
+const DEFAULT_REPO = "typesmiths/decohere";
+
+/**
+ * One profile per credential. Date math, GitHub issue upsert, and fail-closed live below.
+ * `ghEnv` unset means repo secret / repo variable (not an Actions environment).
+ *
+ * @typedef {{
+ *   id: string,
+ *   secret: string,
+ *   expiresVar: string,
+ *   ghEnv?: string,
+ *   mint: string,
+ *   failImpact: string,
+ *   rejectedWhy: string,
+ *   revokeUrl: string,
+ * }} CredentialProfile
+ */
+
+/** @type {Record<string, CredentialProfile>} */
+export const CREDENTIALS = {
+	ghcr: {
+		id: "ghcr",
+		secret: "GHCR_PUSH_TOKEN",
+		expiresVar: "GHCR_TOKEN_EXPIRES_AT",
+		ghEnv: "ghcr-publish",
+		mint: "Create a **classic** GitHub PAT (fine-grained tokens cannot push to GHCR): https://github.com/settings/tokens/new?scopes=write:packages",
+		failImpact:
+			"npm may already have published. Docker login/push and the `v*` tag will **fail**. The SHA stays untagged, so the next successful Publish of that tip can finish Docker + tag after you rotate. Images are not pushed with `GITHUB_TOKEN`.",
+		rejectedWhy: "GHCR `docker login` returned 401 (expired, revoked, or wrong secret name).",
+		revokeUrl: "https://github.com/settings/tokens",
+	},
+	npm: {
+		id: "npm",
+		secret: "NODE_AUTH_TOKEN",
+		expiresVar: "NODE_AUTH_TOKEN_EXPIRES_AT",
+		mint: "Create an npm **read** token (granular/classic) at https://www.npmjs.com/settings/~/tokens — Publish PUTs are OIDC; this token is only for private `npm view` and create smoke.",
+		failImpact:
+			"Verify cannot see private packages, so skipIfPublished and create smoke are unsafe. Publish **fails closed** before OIDC/Docker. After you rotate, re-run the failed Publish jobs.",
+		rejectedWhy: "`npm whoami` failed (expired, revoked, or missing `NODE_AUTH_TOKEN`).",
+		revokeUrl: "https://www.npmjs.com/settings/~/tokens",
+	},
+};
+
+export function utcDayMs(date) {
+	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+}
+
+/** @param {string | undefined} raw */
+export function parseExpiresAt(raw) {
+	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(raw ?? "").trim());
+	if (!match) {
+		return null;
+	}
+	return Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
+}
+
+/**
+ * @param {{ now?: number, expiresAtMs: number | null, warnDays?: number }} options
+ * @returns {{ kind: "missing" | "ok" | "warn" | "expired", daysLeft: number | null }}
+ */
+export function assessTokenLifetime(options) {
+	const { expiresAtMs, warnDays = WARN_DAYS } = options;
+	if (expiresAtMs == null) {
+		return { kind: "missing", daysLeft: null };
+	}
+	const today = utcDayMs(new Date(options.now ?? Date.now()));
+	const daysLeft = Math.round((expiresAtMs - today) / MS_PER_DAY);
+	if (daysLeft <= 0) {
+		return { kind: "expired", daysLeft };
+	}
+	if (daysLeft <= warnDays) {
+		return { kind: "warn", daysLeft };
+	}
+	return { kind: "ok", daysLeft };
+}
+
+/** @param {CredentialProfile} credential */
+export function resolveRepo() {
+	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
+}
+
+/** @param {CredentialProfile} credential */
+export function ghScopeFlags(credential) {
+	return credential.ghEnv ? `--env ${credential.ghEnv} ` : "";
+}
+
+/** @param {string} id */
+export function credentialProfile(id) {
+	const credential = CREDENTIALS[id];
+	if (!credential) {
+		throw new Error(
+			`Unknown NUDGE_CREDENTIAL=${id}. Expected one of: ${Object.keys(CREDENTIALS).join(", ")}`,
+		);
+	}
+	return credential;
+}
+
+/** @param {CredentialProfile} credential */
+export function issueTitle(credential, expiresYmd) {
+	return `chore(security): rotate ${credential.secret} (expires ${expiresYmd})`;
+}
+
+/** @param {CredentialProfile} credential */
+export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
+	const next = nextExpiresYmd ?? "YYYY-MM-DD";
+	const flags = ghScopeFlags(credential);
+	return [
+		credential.mint,
+		"",
+		"Then from a trusted machine (do not paste the token into Actions or this issue):",
+		"",
+		"```bash",
+		`gh secret set ${credential.secret} ${flags}--repo ${repo}`,
+		`gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body ${next}`,
+		"```",
+		"",
+		`Revoke the old token: ${credential.revokeUrl}`,
+		"Close this issue, then retry Publish:",
+		"",
+		"```bash",
+		`gh run list --repo ${repo} --workflow Publish --limit 5`,
+		`gh run rerun --failed <run-id> --repo ${repo}`,
+		"```",
+	].join("\n");
+}
+
+export function suggestedNextExpiry(fromMs, days = 90) {
+	const start = utcDayMs(new Date(fromMs));
+	const next = new Date(start + days * MS_PER_DAY);
+	const y = next.getUTCFullYear();
+	const m = String(next.getUTCMonth() + 1).padStart(2, "0");
+	const d = String(next.getUTCDate()).padStart(2, "0");
+	return `${y}-${m}-${d}`;
+}
+
+/** @param {CredentialProfile} credential */
+export function buildDescription(credential, options) {
+	const { kind, expiresYmd, daysLeft, rejected, runUrl } = options;
+	const next = suggestedNextExpiry(Date.now());
+	const why = rejected
+		? credential.rejectedWhy
+		: kind === "expired"
+			? `${credential.expiresVar} (${expiresYmd}) is today or in the past. Rotate ${credential.secret} and this date before Publish can continue.`
+			: `${credential.secret} expires on ${expiresYmd} (${daysLeft} day(s) left). Rotate before that date so Publish does not fail closed.`;
+	return [
+		"## Summary",
+		"",
+		why,
+		"",
+		"## If this is not done in time",
+		"",
+		credential.failImpact,
+		"",
+		"## Commands",
+		"",
+		rotationCommands(credential, next),
+		"",
+		runUrl ? `- Workflow run: ${runUrl}` : null,
+	]
+		.filter((line) => line != null)
+		.join("\n");
+}
+
+function runUrl() {
+	if (
+		process.env.GITHUB_SERVER_URL &&
+		process.env.GITHUB_REPOSITORY &&
+		process.env.GITHUB_RUN_ID
+	) {
+		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+	}
+	return "";
+}
+
+/** @param {CredentialProfile} credential */
+export function upsertRotationIssue(credential, options, upsert = upsertIssue) {
+	const { expiresYmd, kind, daysLeft, rejected } = options;
+	return upsert({
+		title: issueTitle(credential, expiresYmd ?? "unknown"),
+		body: buildDescription(credential, {
+			kind,
+			expiresYmd,
+			daysLeft,
+			rejected,
+			runUrl: runUrl(),
+		}),
+	});
+}
+
+export async function runNudge(env = process.env, upsert = upsertIssue) {
+	const credential = credentialProfile(String(env.NUDGE_CREDENTIAL ?? "").trim());
+	const rejected = env.NUDGE_REJECTED === "1";
+	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
+	const expiresAtMs = parseExpiresAt(expiresYmd);
+	const assessment = assessTokenLifetime({ expiresAtMs });
+	const flags = ghScopeFlags(credential);
+	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
+
+	if (assessment.kind === "missing" && !rejected) {
+		process.stderr.write(
+			`${credential.ghEnv ? `${credential.ghEnv} environment` : "repository"} variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
+				`  gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body YYYY-MM-DD\n`,
+		);
+		return 1;
+	}
+
+	if (rejected || assessment.kind === "warn" || assessment.kind === "expired") {
+		const result = upsertRotationIssue(
+			credential,
+			{
+				expiresYmd: expiresYmd || "unknown",
+				kind: assessment.kind,
+				daysLeft: assessment.daysLeft,
+				rejected,
+			},
+			upsert,
+		);
+		process.stdout.write(
+			`${result.created ? "Opened" : "Updated"} issue #${result.number} ${result.url}\n`,
+		);
+	}
+
+	if (rejected || assessment.kind === "expired" || assessment.kind === "missing") {
+		if (assessment.kind === "expired") {
+			process.stderr.write(
+				`${credential.secret} calendar expiry ${expiresYmd} has been reached — refusing to continue\n`,
+			);
+		}
+		return 1;
+	}
+	return 0;
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	process.exit(await runNudge());
+}

package/src/github/oidc-bootstrap-nudge.mjs

@@ -0,0 +1,210 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { upsertIssue } from "../lib/github-issue.mjs";
+import { listPublishablePackages } from "./publish-verify.mjs";
+
+const GITHUB_API = process.env.GITHUB_API_URL ?? "https://api.github.com";
+const ISSUE_TITLE = "deploy(publish): OIDC bootstrap unpublished packages";
+const BOOTSTRAP_ENV = "npm-oidc-bootstrap";
+const DEFAULT_REPO = "typesmiths/decohere";
+
+export function issueTitle() {
+	return ISSUE_TITLE;
+}
+
+/** @param {string | undefined} raw */
+export function parseUnpublished(raw) {
+	return String(raw ?? "")
+		.split(/\s+/)
+		.map((name) => name.trim())
+		.filter(Boolean);
+}
+
+/**
+ * @param {string | undefined} version
+ */
+export function needsPrereleaseTag(version) {
+	return String(version ?? "").includes("-");
+}
+
+/**
+ * @param {{ name: string, dir: string, version?: string }[]} packages
+ * @param {string} [channel]
+ */
+export function firstPublishCommands(packages, channel = "dev") {
+	if (packages.length === 0) {
+		return [`npm publish ./<package-dir> --tag ${channel}`];
+	}
+	return packages.map((pkg) => {
+		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
+		return `npm publish ./projects/${pkg.dir}${tag}`;
+	});
+}
+
+/**
+ * @param {unknown} environment
+ * @returns {string[]}
+ */
+export function extractGitHubReviewerLogins(environment) {
+	const rules =
+		environment && typeof environment === "object" ? environment.protection_rules : null;
+	if (!Array.isArray(rules)) {
+		return [];
+	}
+	const logins = [];
+	for (const rule of rules) {
+		const reviewers = rule?.reviewers;
+		if (!Array.isArray(reviewers)) {
+			continue;
+		}
+		for (const entry of reviewers) {
+			const login = entry?.reviewer?.login;
+			if (typeof login === "string" && login.length > 0 && entry?.type !== "Team") {
+				logins.push(login);
+			}
+		}
+	}
+	return [...new Set(logins)];
+}
+
+/**
+ * @param {{
+ *   unpublished: string[],
+ *   packages: { name: string, dir: string, version?: string }[],
+ *   repo?: string,
+ *   runUrl?: string,
+ *   channel?: string,
+ * }} options
+ */
+export function buildDescription(options) {
+	const repo = options.repo || DEFAULT_REPO;
+	const names = options.unpublished;
+	const channel = options.channel || "dev";
+	const packages = options.packages.filter((pkg) => names.includes(pkg.name));
+	const [owner, repoName] = repo.split("/");
+	return [
+		"## Summary",
+		"",
+		"These package names are not on npm yet, so OIDC `npm publish` cannot run until each name exists and has a Trusted Publisher:",
+		"",
+		...names.map((name) => `- \`${name}\``),
+		"",
+		"## What to do",
+		"",
+		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
+		"",
+		"```bash",
+		...firstPublishCommands(packages, channel),
+		"```",
+		"",
+		"2. npm → package settings → Trusted Publisher → GitHub Actions:",
+		"",
+		`- Organization: \`${owner ?? "typesmiths"}\``,
+		`- Repository: \`${repoName ?? "decohere"}\``,
+		"- Workflow filename: `publish.yml`",
+		"- Environment: `npm-publish`",
+		"- Allowed action: `npm publish` (not staged-only)",
+		"",
+		"3. Approve the waiting **npm-oidc-bootstrap** deployment on this Publish run. The job re-checks that the names exist, then npm + Docker + tag continue. If reviewers were not configured and the job already failed:",
+		"",
+		"```bash",
+		`gh run list --repo ${repo} --workflow Publish --limit 5`,
+		`gh run rerun --failed <run-id> --repo ${repo}`,
+		"```",
+		"",
+		options.runUrl ? `- Workflow run: ${options.runUrl}` : null,
+	]
+		.filter((line) => line != null)
+		.join("\n");
+}
+
+function runUrl() {
+	if (
+		process.env.GITHUB_SERVER_URL &&
+		process.env.GITHUB_REPOSITORY &&
+		process.env.GITHUB_RUN_ID
+	) {
+		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+	}
+	return "";
+}
+
+/**
+ * @param {{ fetch?: typeof fetch, token?: string, repo?: string, environment?: string }} options
+ */
+export async function githubEnvironmentReviewerLogins(options = {}) {
+	const token = options.token ?? process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+	const repo = options.repo ?? process.env.GITHUB_REPOSITORY ?? "";
+	const environment = options.environment ?? BOOTSTRAP_ENV;
+	const fetchFn = options.fetch ?? fetch;
+	if (!token || !repo) {
+		return [];
+	}
+	const response = await fetchFn(
+		`${GITHUB_API}/repos/${repo}/environments/${encodeURIComponent(environment)}`,
+		{
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/vnd.github+json",
+				"X-GitHub-Api-Version": "2022-11-28",
+			},
+		},
+	);
+	if (!response.ok) {
+		process.stderr.write(
+			`Could not list ${environment} reviewers (${response.status}); the issue will have no assignees\n`,
+		);
+		return [];
+	}
+	return extractGitHubReviewerLogins(await response.json());
+}
+
+export async function runNudge(env = process.env, io = {}) {
+	const unpublished = parseUnpublished(env.UNPUBLISHED);
+	if (unpublished.length === 0) {
+		process.stdout.write("No unpublished package names; skipping OIDC bootstrap issue\n");
+		return 0;
+	}
+
+	const root = io.root ?? process.cwd();
+	const packages = (io.listPackages ?? listPublishablePackages)(root);
+	const assignees = await (io.githubReviewers ?? githubEnvironmentReviewerLogins)({
+		token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
+		repo: env.GITHUB_REPOSITORY,
+	});
+	const repo = env.GITHUB_REPOSITORY || DEFAULT_REPO;
+
+	const result = (io.upsert ?? upsertIssue)({
+		title: issueTitle(),
+		body: buildDescription({
+			unpublished,
+			packages,
+			repo,
+			runUrl: io.runUrl ?? runUrl(),
+			channel: env.PUBLISH_CHANNEL || env.CHANNEL || "dev",
+		}),
+		assignees,
+	});
+	process.stdout.write(
+		`${result.created ? "Opened" : "Updated"} issue #${result.number} ${result.url}\n`,
+	);
+	if (assignees.length > 0) {
+		process.stdout.write(`Assigned ${assignees.join(", ")}\n`);
+	} else {
+		process.stdout.write(
+			`No assignees (add required reviewers on the ${BOOTSTRAP_ENV} environment)\n`,
+		);
+	}
+	if (env.GITHUB_OUTPUT) {
+		const { appendFileSync } = await import("node:fs");
+		appendFileSync(env.GITHUB_OUTPUT, `issue_url=${result.url}\n`);
+	}
+	return 0;
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	process.exit(await runNudge());
+}

package/src/github/publish-verify.mjs

@@ -0,0 +1,206 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { listProjectDirs } from "../lib/workspace-packages.mjs";
+
+/**
+ * Workspace packages that `forge publish` will upload (not `"private": true`), including
+ * grouped ones such as `projects/data/data-typeorm`.
+ * @param {string} root
+ */
+export function listPublishablePackages(root) {
+	const packages = [];
+	for (const projectDir of listProjectDirs(root)) {
+		const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
+		if (typeof pkg.name !== "string" || pkg.private === true) {
+			continue;
+		}
+		packages.push({
+			name: pkg.name,
+			version: pkg.version,
+			dir: relative(join(root, "projects"), projectDir),
+		});
+	}
+	return packages.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function dockerRepositories(root) {
+	const create = JSON.parse(readFileSync(join(root, "projects/create/package.json"), "utf8"));
+	const devcontainer = JSON.parse(
+		readFileSync(join(root, "projects/devcontainer/package.json"), "utf8"),
+	);
+	return {
+		create: create.decohere?.dockerImageRepository ?? "ghcr.io/typesmiths/decohere/create",
+		devcontainer:
+			devcontainer.decohere?.dockerImageRepository ??
+			"ghcr.io/typesmiths/decohere/devcontainer",
+		createVersion: create.version,
+		workspaceVersion: JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version,
+	};
+}
+
+/**
+ * @param {string} spec package or package@version
+ * @param {{ spawnSync?: typeof spawnSync }} [io]
+ */
+export function npmNameExists(spec, io = {}) {
+	const spawn = io.spawnSync ?? spawnSync;
+	const result = spawn("npm", ["view", spec, "name"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return result.status === 0;
+}
+
+/**
+ * @param {string} spec package@version
+ * @param {{ spawnSync?: typeof spawnSync }} [io]
+ */
+export function npmVersionExists(spec, io = {}) {
+	const spawn = io.spawnSync ?? spawnSync;
+	const result = spawn("npm", ["view", spec, "version"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return result.status === 0;
+}
+
+/**
+ * Parse `ghcr.io/org/name/image` into GitHub packages API coordinates.
+ * @param {string} repository
+ */
+export function parseGhcrRepository(repository) {
+	const withoutHost = repository.replace(/^ghcr\.io\//, "");
+	const slash = withoutHost.indexOf("/");
+	if (slash < 0) {
+		throw new Error(`Not a GHCR repository: ${repository}`);
+	}
+	return {
+		org: withoutHost.slice(0, slash),
+		packageName: withoutHost.slice(slash + 1),
+	};
+}
+
+/**
+ * @param {string} repository ghcr.io/org/pkg
+ * @param {string} tag
+ * @param {{ token: string, fetch?: typeof fetch }} io
+ */
+export async function ghcrTagExists(repository, tag, io) {
+	const { org, packageName } = parseGhcrRepository(repository);
+	const encoded = encodeURIComponent(packageName);
+	const headers = {
+		Authorization: `Bearer ${io.token}`,
+		Accept: "application/vnd.github+json",
+		"X-GitHub-Api-Version": "2022-11-28",
+	};
+	const fetchImpl = io.fetch ?? fetch;
+	for (let page = 1; page <= 20; page += 1) {
+		const url = `https://api.github.com/orgs/${org}/packages/container/${encoded}/versions?per_page=100&page=${page}`;
+		const response = await fetchImpl(url, { headers });
+		if (response.status === 404) {
+			return false;
+		}
+		if (!response.ok) {
+			throw new Error(`GHCR versions ${response.status} for ${repository}`);
+		}
+		const versions = await response.json();
+		if (!Array.isArray(versions) || versions.length === 0) {
+			return false;
+		}
+		for (const version of versions) {
+			const tags = version.metadata?.container?.tags ?? [];
+			if (tags.includes(tag)) {
+				return true;
+			}
+		}
+		if (versions.length < 100) {
+			return false;
+		}
+	}
+	return false;
+}
+
+/**
+ * @param {{
+ *   root: string,
+ *   spawnSync?: typeof spawnSync,
+ *   fetch?: typeof fetch,
+ *   githubToken?: string,
+ * }} options
+ */
+export async function collectPublishVerify(options) {
+	const packages = listPublishablePackages(options.root);
+	const unpublished = [];
+	let publishedVersions = 0;
+	for (const pkg of packages) {
+		if (!npmNameExists(pkg.name, options)) {
+			unpublished.push(pkg.name);
+			continue;
+		}
+		if (npmVersionExists(`${pkg.name}@${pkg.version}`, options)) {
+			publishedVersions += 1;
+		}
+	}
+
+	const images = dockerRepositories(options.root);
+	const token = options.githubToken ?? "";
+	let skipDocker = false;
+	if (token) {
+		const createExists = await ghcrTagExists(images.create, images.workspaceVersion, {
+			token,
+			fetch: options.fetch,
+		});
+		const devExists = await ghcrTagExists(images.devcontainer, images.workspaceVersion, {
+			token,
+			fetch: options.fetch,
+		});
+		skipDocker = createExists && devExists;
+	}
+
+	return {
+		unpublished,
+		skipNpm: packages.length > 0 && publishedVersions === packages.length,
+		skipDocker,
+		imageTag: images.workspaceVersion,
+		createVersion: images.createVersion,
+		repository: images.create,
+		devcontainerRepository: images.devcontainer,
+		packageCount: packages.length,
+		publishedVersions,
+	};
+}
+
+export function formatGithubOutput(result) {
+	return [
+		`unpublished=${result.unpublished.join(" ")}`,
+		`skip_npm=${result.skipNpm ? "true" : "false"}`,
+		`skip_docker=${result.skipDocker ? "true" : "false"}`,
+		`image_tag=${result.imageTag}`,
+		`create_version=${result.createVersion}`,
+		`repository=${result.repository}`,
+		`devcontainer_repository=${result.devcontainerRepository}`,
+	].join("\n");
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	const result = await collectPublishVerify({
+		root: process.cwd(),
+		githubToken: process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN,
+	});
+	const body = formatGithubOutput(result);
+	process.stdout.write(`${body}\n`);
+	if (process.env.GITHUB_OUTPUT) {
+		const { appendFileSync } = await import("node:fs");
+		appendFileSync(process.env.GITHUB_OUTPUT, `${body}\n`);
+	}
+	if (result.unpublished.length) {
+		process.stderr.write(
+			`Never-published packages (bootstrap OIDC before PUT): ${result.unpublished.join(", ")}\n`,
+		);
+	}
+}