@decohere/ci-tools 0.0.1-dev.122 → 0.0.1-dev.124

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.122",
+  "version": "0.0.1-dev.124",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -10,6 +10,15 @@
     "github-actions",
     "decohere"
   ],
+  "homepage": "https://github.com/typesmiths/decohere/tree/main/projects/ci-tools#readme",
+  "bugs": {
+    "url": "https://github.com/typesmiths/decohere/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/typesmiths/decohere.git",
+    "directory": "projects/ci-tools"
+  },
   "license": "ISC",
   "author": "Typesmiths",
   "type": "module",

package/src/github/credential-nudge.mjs

@@ -7,14 +7,13 @@ const MS_PER_DAY = 86_400_000;
 const DEFAULT_REPO = "typesmiths/decohere";
 
 /**
- * One profile per credential. Date math, GitHub issue upsert, and fail-closed live below.
- * `ghEnv` unset means repo secret / repo variable (not an Actions environment).
+ * One profile per credential (repo secret + repo variable). Date math, GitHub issue
+ * upsert, and fail-closed live below.
  *
  * @typedef {{
  *   id: string,
  *   secret: string,
  *   expiresVar: string,
- *   ghEnv?: string,
  *   mint: string,
  *   failImpact: string,
  *   rejectedWhy: string,
@@ -24,17 +23,6 @@ const DEFAULT_REPO = "typesmiths/decohere";
 
 /** @type {Record<string, CredentialProfile>} */
 export const CREDENTIALS = {
-	ghcr: {
-		id: "ghcr",
-		secret: "GHCR_PUSH_TOKEN",
-		expiresVar: "GHCR_TOKEN_EXPIRES_AT",
-		ghEnv: "ghcr-publish",
-		mint: "Create a **classic** GitHub PAT (fine-grained tokens cannot push to GHCR): https://github.com/settings/tokens/new?scopes=write:packages",
-		failImpact:
-			"npm may already have published. Docker login/push and the `v*` tag will **fail**. The SHA stays untagged, so the next successful Publish of that tip can finish Docker + tag after you rotate. Images are not pushed with `GITHUB_TOKEN`.",
-		rejectedWhy: "GHCR `docker login` returned 401 (expired, revoked, or wrong secret name).",
-		revokeUrl: "https://github.com/settings/tokens",
-	},
 	npm: {
 		id: "npm",
 		secret: "NODE_AUTH_TOKEN",
@@ -85,11 +73,6 @@ export function resolveRepo() {
 	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
 }
 
-/** @param {CredentialProfile} credential */
-export function ghScopeFlags(credential) {
-	return credential.ghEnv ? `--env ${credential.ghEnv} ` : "";
-}
-
 /** @param {string} id */
 export function credentialProfile(id) {
 	const credential = CREDENTIALS[id];
@@ -109,15 +92,14 @@ export function issueTitle(credential, expiresYmd) {
 /** @param {CredentialProfile} credential */
 export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
 	const next = nextExpiresYmd ?? "YYYY-MM-DD";
-	const flags = ghScopeFlags(credential);
 	return [
 		credential.mint,
 		"",
 		"Then from a trusted machine (do not paste the token into Actions or this issue):",
 		"",
 		"```bash",
-		`gh secret set ${credential.secret} ${flags}--repo ${repo}`,
-		`gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body ${next}`,
+		`gh secret set ${credential.secret} --repo ${repo}`,
+		`gh variable set ${credential.expiresVar} --repo ${repo} --body ${next}`,
 		"```",
 		"",
 		`Revoke the old token: ${credential.revokeUrl}`,
@@ -199,13 +181,12 @@ export async function runNudge(env = process.env, upsert = upsertIssue) {
 	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
 	const expiresAtMs = parseExpiresAt(expiresYmd);
 	const assessment = assessTokenLifetime({ expiresAtMs });
-	const flags = ghScopeFlags(credential);
 	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
 
 	if (assessment.kind === "missing" && !rejected) {
 		process.stderr.write(
-			`${credential.ghEnv ? `${credential.ghEnv} environment` : "repository"} variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
-				`  gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body YYYY-MM-DD\n`,
+			`repository variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
+				`  gh variable set ${credential.expiresVar} --repo ${repo} --body YYYY-MM-DD\n`,
 		);
 		return 1;
 	}

package/tests/github/credential-nudge.test.mjs

@@ -4,7 +4,6 @@ import {
 	buildDescription,
 	CREDENTIALS,
 	credentialProfile,
-	ghScopeFlags,
 	issueTitle,
 	parseExpiresAt,
 	rotationCommands,
@@ -54,14 +53,8 @@ describe("credential-nudge", () => {
 		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
 	});
 
-	it("parameterizes GHCR vs npm rotate commands without duplicating date logic", () => {
-		const ghcr = credentialProfile("ghcr");
+	it("builds the rotation issue for a credential profile", () => {
 		const npm = credentialProfile("npm");
-		expect(ghScopeFlags(ghcr)).toBe("--env ghcr-publish ");
-		expect(ghScopeFlags(npm)).toBe("");
-		expect(rotationCommands(ghcr, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set GHCR_PUSH_TOKEN --env ghcr-publish --repo typesmiths/decohere",
-		);
 		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
 			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
 		);
@@ -71,16 +64,15 @@ describe("credential-nudge", () => {
 		expect(issueTitle(npm, "2026-11-19")).toBe(
 			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
 		);
-		const body = buildDescription(ghcr, {
+		const body = buildDescription(npm, {
 			kind: "warn",
 			expiresYmd: "2026-11-19",
 			daysLeft: 14,
 			rejected: false,
 		});
-		expect(body).toContain("Docker login/push and the `v*` tag will **fail**");
-		expect(CREDENTIALS.npm.secret).toBe("NODE_AUTH_TOKEN");
+		expect(body).toContain(CREDENTIALS.npm.failImpact);
 		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
-		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
+		expect(() => credentialProfile("ghcr")).toThrow(/Unknown NUDGE_CREDENTIAL/);
 	});
 
 	it("files nothing and passes while the token has more than 14 days left", async () => {
@@ -104,13 +96,17 @@ describe("credential-nudge", () => {
 
 	it("files a rotation issue and stops Publish once the token has expired or was rejected", async () => {
 		const expired = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "ghcr", GHCR_TOKEN_EXPIRES_AT: inDays(0) };
+		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(0) };
 		expect(await runNudge(env, expired.upsert)).toBe(1);
 		expect(expired.upserts).toHaveLength(1);
 
 		const rejected = recordUpserts();
-		const rejectedEnv = { ...env, GHCR_TOKEN_EXPIRES_AT: inDays(60), NUDGE_REJECTED: "1" };
+		const rejectedEnv = {
+			...env,
+			NODE_AUTH_TOKEN_EXPIRES_AT: inDays(60),
+			NUDGE_REJECTED: "1",
+		};
 		expect(await runNudge(rejectedEnv, rejected.upsert)).toBe(1);
-		expect(rejected.upserts[0].body).toContain(CREDENTIALS.ghcr.rejectedWhy);
+		expect(rejected.upserts[0].body).toContain(CREDENTIALS.npm.rejectedWhy);
 	});
 });

package/tests/github/package-metadata.test.mjs

@@ -0,0 +1,69 @@
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { vol } from "memfs";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { listPublishablePackages } from "../../src/github/publish-verify.mjs";
+
+const fs = await vi.importActual("node:fs");
+const REPO_ROOT = fileURLToPath(new URL("../../../../", import.meta.url));
+const REPO = "https://github.com/typesmiths/decohere";
+
+/** The repo's real package.json files, loaded into the in-memory fs the tests run on. */
+function loadRealManifests() {
+	/** @type {Record<string, string>} */
+	const files = {};
+	const walk = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+			const path = join(dir, entry.name);
+			if (entry.isDirectory() && !["node_modules", "dist"].includes(entry.name)) {
+				walk(path);
+			} else if (entry.name === "package.json") {
+				files[join("/repo", relative(REPO_ROOT, path))] = fs.readFileSync(path, "utf8");
+			}
+		}
+	};
+	walk(join(REPO_ROOT, "projects"));
+	return files;
+}
+
+afterEach(() => {
+	vol.reset();
+});
+
+// npm shows these on each package's page, and Trusted Publishing's provenance is
+// checked against `repository.url`, so a package without it fails to publish.
+describe("published package metadata", () => {
+	vol.fromJSON(loadRealManifests());
+	const packages = listPublishablePackages("/repo").map((pkg) => ({
+		...pkg,
+		json: JSON.parse(String(vol.readFileSync(`/repo/projects/${pkg.dir}/package.json`))),
+	}));
+	vol.reset();
+
+	it("finds the publishable packages", () => {
+		expect(packages.length).toBeGreaterThan(0);
+	});
+
+	it.each(packages.map((pkg) => [pkg.name, pkg]))(
+		"%s links back to the repo",
+		(_name, pkg) => {
+			expect(pkg.json.repository).toEqual({
+				type: "git",
+				url: `git+${REPO}.git`,
+				directory: `projects/${pkg.dir}`,
+			});
+			expect(pkg.json.homepage).toBe(`${REPO}/tree/main/projects/${pkg.dir}#readme`);
+			expect(pkg.json.bugs).toEqual({ url: `${REPO}/issues` });
+		},
+	);
+
+	it.each(packages.map((pkg) => [pkg.name, pkg]))(
+		"%s has a description, keywords, license and author",
+		(_name, pkg) => {
+			expect(pkg.json.description).toBeTruthy();
+			expect(pkg.json.keywords?.length).toBeGreaterThan(0);
+			expect(pkg.json.license).toBe("ISC");
+			expect(pkg.json.author).toBeTruthy();
+		},
+	);
+});