@decohere/ci-tools 0.0.1-dev.123 → 0.0.1-dev.124

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.123",
+  "version": "0.0.1-dev.124",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",

package/src/github/credential-nudge.mjs

@@ -7,14 +7,13 @@ const MS_PER_DAY = 86_400_000;
 const DEFAULT_REPO = "typesmiths/decohere";
 
 /**
- * One profile per credential. Date math, GitHub issue upsert, and fail-closed live below.
- * `ghEnv` unset means repo secret / repo variable (not an Actions environment).
+ * One profile per credential (repo secret + repo variable). Date math, GitHub issue
+ * upsert, and fail-closed live below.
  *
  * @typedef {{
  *   id: string,
  *   secret: string,
  *   expiresVar: string,
- *   ghEnv?: string,
  *   mint: string,
  *   failImpact: string,
  *   rejectedWhy: string,
@@ -24,17 +23,6 @@ const DEFAULT_REPO = "typesmiths/decohere";
 
 /** @type {Record<string, CredentialProfile>} */
 export const CREDENTIALS = {
-	ghcr: {
-		id: "ghcr",
-		secret: "GHCR_PUSH_TOKEN",
-		expiresVar: "GHCR_TOKEN_EXPIRES_AT",
-		ghEnv: "ghcr-publish",
-		mint: "Create a **classic** GitHub PAT (fine-grained tokens cannot push to GHCR): https://github.com/settings/tokens/new?scopes=write:packages",
-		failImpact:
-			"npm may already have published. Docker login/push and the `v*` tag will **fail**. The SHA stays untagged, so the next successful Publish of that tip can finish Docker + tag after you rotate. Images are not pushed with `GITHUB_TOKEN`.",
-		rejectedWhy: "GHCR `docker login` returned 401 (expired, revoked, or wrong secret name).",
-		revokeUrl: "https://github.com/settings/tokens",
-	},
 	npm: {
 		id: "npm",
 		secret: "NODE_AUTH_TOKEN",
@@ -85,11 +73,6 @@ export function resolveRepo() {
 	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
 }
 
-/** @param {CredentialProfile} credential */
-export function ghScopeFlags(credential) {
-	return credential.ghEnv ? `--env ${credential.ghEnv} ` : "";
-}
-
 /** @param {string} id */
 export function credentialProfile(id) {
 	const credential = CREDENTIALS[id];
@@ -109,15 +92,14 @@ export function issueTitle(credential, expiresYmd) {
 /** @param {CredentialProfile} credential */
 export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
 	const next = nextExpiresYmd ?? "YYYY-MM-DD";
-	const flags = ghScopeFlags(credential);
 	return [
 		credential.mint,
 		"",
 		"Then from a trusted machine (do not paste the token into Actions or this issue):",
 		"",
 		"```bash",
-		`gh secret set ${credential.secret} ${flags}--repo ${repo}`,
-		`gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body ${next}`,
+		`gh secret set ${credential.secret} --repo ${repo}`,
+		`gh variable set ${credential.expiresVar} --repo ${repo} --body ${next}`,
 		"```",
 		"",
 		`Revoke the old token: ${credential.revokeUrl}`,
@@ -199,13 +181,12 @@ export async function runNudge(env = process.env, upsert = upsertIssue) {
 	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
 	const expiresAtMs = parseExpiresAt(expiresYmd);
 	const assessment = assessTokenLifetime({ expiresAtMs });
-	const flags = ghScopeFlags(credential);
 	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
 
 	if (assessment.kind === "missing" && !rejected) {
 		process.stderr.write(
-			`${credential.ghEnv ? `${credential.ghEnv} environment` : "repository"} variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
-				`  gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body YYYY-MM-DD\n`,
+			`repository variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
+				`  gh variable set ${credential.expiresVar} --repo ${repo} --body YYYY-MM-DD\n`,
 		);
 		return 1;
 	}

package/tests/github/credential-nudge.test.mjs

@@ -4,7 +4,6 @@ import {
 	buildDescription,
 	CREDENTIALS,
 	credentialProfile,
-	ghScopeFlags,
 	issueTitle,
 	parseExpiresAt,
 	rotationCommands,
@@ -54,14 +53,8 @@ describe("credential-nudge", () => {
 		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
 	});
 
-	it("parameterizes GHCR vs npm rotate commands without duplicating date logic", () => {
-		const ghcr = credentialProfile("ghcr");
+	it("builds the rotation issue for a credential profile", () => {
 		const npm = credentialProfile("npm");
-		expect(ghScopeFlags(ghcr)).toBe("--env ghcr-publish ");
-		expect(ghScopeFlags(npm)).toBe("");
-		expect(rotationCommands(ghcr, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set GHCR_PUSH_TOKEN --env ghcr-publish --repo typesmiths/decohere",
-		);
 		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
 			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
 		);
@@ -71,16 +64,15 @@ describe("credential-nudge", () => {
 		expect(issueTitle(npm, "2026-11-19")).toBe(
 			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
 		);
-		const body = buildDescription(ghcr, {
+		const body = buildDescription(npm, {
 			kind: "warn",
 			expiresYmd: "2026-11-19",
 			daysLeft: 14,
 			rejected: false,
 		});
-		expect(body).toContain("Docker login/push and the `v*` tag will **fail**");
-		expect(CREDENTIALS.npm.secret).toBe("NODE_AUTH_TOKEN");
+		expect(body).toContain(CREDENTIALS.npm.failImpact);
 		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
-		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
+		expect(() => credentialProfile("ghcr")).toThrow(/Unknown NUDGE_CREDENTIAL/);
 	});
 
 	it("files nothing and passes while the token has more than 14 days left", async () => {
@@ -104,13 +96,17 @@ describe("credential-nudge", () => {
 
 	it("files a rotation issue and stops Publish once the token has expired or was rejected", async () => {
 		const expired = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "ghcr", GHCR_TOKEN_EXPIRES_AT: inDays(0) };
+		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(0) };
 		expect(await runNudge(env, expired.upsert)).toBe(1);
 		expect(expired.upserts).toHaveLength(1);
 
 		const rejected = recordUpserts();
-		const rejectedEnv = { ...env, GHCR_TOKEN_EXPIRES_AT: inDays(60), NUDGE_REJECTED: "1" };
+		const rejectedEnv = {
+			...env,
+			NODE_AUTH_TOKEN_EXPIRES_AT: inDays(60),
+			NUDGE_REJECTED: "1",
+		};
 		expect(await runNudge(rejectedEnv, rejected.upsert)).toBe(1);
-		expect(rejected.upserts[0].body).toContain(CREDENTIALS.ghcr.rejectedWhy);
+		expect(rejected.upserts[0].body).toContain(CREDENTIALS.npm.rejectedWhy);
 	});
 });