@decohere/ci-tools 0.0.1-dev.123 → 0.0.1-dev.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.123",
+  "version": "0.0.1-dev.125",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",

package/src/github/credential-nudge.mjs

@@ -7,14 +7,13 @@ const MS_PER_DAY = 86_400_000;
 const DEFAULT_REPO = "typesmiths/decohere";
 
 /**
- * One profile per credential. Date math, GitHub issue upsert, and fail-closed live below.
- * `ghEnv` unset means repo secret / repo variable (not an Actions environment).
+ * One profile per credential (repo secret + repo variable). Date math, GitHub issue
+ * upsert, and fail-closed live below.
  *
  * @typedef {{
  *   id: string,
  *   secret: string,
  *   expiresVar: string,
- *   ghEnv?: string,
  *   mint: string,
  *   failImpact: string,
  *   rejectedWhy: string,
@@ -24,17 +23,6 @@ const DEFAULT_REPO = "typesmiths/decohere";
 
 /** @type {Record<string, CredentialProfile>} */
 export const CREDENTIALS = {
-	ghcr: {
-		id: "ghcr",
-		secret: "GHCR_PUSH_TOKEN",
-		expiresVar: "GHCR_TOKEN_EXPIRES_AT",
-		ghEnv: "ghcr-publish",
-		mint: "Create a **classic** GitHub PAT (fine-grained tokens cannot push to GHCR): https://github.com/settings/tokens/new?scopes=write:packages",
-		failImpact:
-			"npm may already have published. Docker login/push and the `v*` tag will **fail**. The SHA stays untagged, so the next successful Publish of that tip can finish Docker + tag after you rotate. Images are not pushed with `GITHUB_TOKEN`.",
-		rejectedWhy: "GHCR `docker login` returned 401 (expired, revoked, or wrong secret name).",
-		revokeUrl: "https://github.com/settings/tokens",
-	},
 	npm: {
 		id: "npm",
 		secret: "NODE_AUTH_TOKEN",
@@ -85,11 +73,6 @@ export function resolveRepo() {
 	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
 }
 
-/** @param {CredentialProfile} credential */
-export function ghScopeFlags(credential) {
-	return credential.ghEnv ? `--env ${credential.ghEnv} ` : "";
-}
-
 /** @param {string} id */
 export function credentialProfile(id) {
 	const credential = CREDENTIALS[id];
@@ -109,15 +92,14 @@ export function issueTitle(credential, expiresYmd) {
 /** @param {CredentialProfile} credential */
 export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
 	const next = nextExpiresYmd ?? "YYYY-MM-DD";
-	const flags = ghScopeFlags(credential);
 	return [
 		credential.mint,
 		"",
 		"Then from a trusted machine (do not paste the token into Actions or this issue):",
 		"",
 		"```bash",
-		`gh secret set ${credential.secret} ${flags}--repo ${repo}`,
-		`gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body ${next}`,
+		`gh secret set ${credential.secret} --repo ${repo}`,
+		`gh variable set ${credential.expiresVar} --repo ${repo} --body ${next}`,
 		"```",
 		"",
 		`Revoke the old token: ${credential.revokeUrl}`,
@@ -199,13 +181,12 @@ export async function runNudge(env = process.env, upsert = upsertIssue) {
 	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
 	const expiresAtMs = parseExpiresAt(expiresYmd);
 	const assessment = assessTokenLifetime({ expiresAtMs });
-	const flags = ghScopeFlags(credential);
 	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
 
 	if (assessment.kind === "missing" && !rejected) {
 		process.stderr.write(
-			`${credential.ghEnv ? `${credential.ghEnv} environment` : "repository"} variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
-				`  gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body YYYY-MM-DD\n`,
+			`repository variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
+				`  gh variable set ${credential.expiresVar} --repo ${repo} --body YYYY-MM-DD\n`,
 		);
 		return 1;
 	}

package/src/github/npm-bootstrap.mjs

@@ -1,5 +1,5 @@
 /**
- * First-publish a new package name (restricted) and give it its Trusted Publisher,
+ * First-publish a new package name (public) and give it its Trusted Publisher,
  * so `publish.yml` can release it over OIDC from then on.
  *
  *   pnpm npm:bootstrap [--otp <code>] [--dry-run] [--channel dev] [<package-name>...]
@@ -31,15 +31,15 @@ export function needsPrereleaseTag(version) {
 }
 
 /**
- * npm arguments for a name-only first publish. Restricted is the scoped default,
- * so no `--access`. `./` stops npm reading the path as a GitHub `owner/repo`.
+ * npm arguments for a name-only first publish. Scoped names default to restricted,
+ * so `--access public`. `./` stops npm reading the path as a GitHub `owner/repo`.
  *
  * @param {{ dir: string, version?: string }} pkg
  * @param {string} channel
  */
 export function publishArgs(pkg, channel) {
 	const tag = needsPrereleaseTag(pkg.version) ? ["--tag", channel] : [];
-	return ["publish", `./projects/${pkg.dir}`, ...tag];
+	return ["publish", `./projects/${pkg.dir}`, "--access", "public", ...tag];
 }
 
 /** @param {string} name */

package/src/github/oidc-bootstrap-nudge.mjs

@@ -33,7 +33,7 @@ export function firstPublishCommands(packages, channel = "dev") {
 	}
 	return packages.map((pkg) => {
 		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
-		return `npm publish ./projects/${pkg.dir}${tag}`;
+		return `npm publish ./projects/${pkg.dir} --access public${tag}`;
 	});
 }
 
@@ -95,7 +95,7 @@ export function buildDescription(options) {
 		"",
 		"That does steps 1 and 2 below, skipping what is already done. To do them by hand instead:",
 		"",
-		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
+		"1. First-publish each name **public** (`--access public`: scoped names default to restricted). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
 		"",
 		"```bash",
 		...firstPublishCommands(packages, channel),

package/tests/github/credential-nudge.test.mjs

@@ -4,7 +4,6 @@ import {
 	buildDescription,
 	CREDENTIALS,
 	credentialProfile,
-	ghScopeFlags,
 	issueTitle,
 	parseExpiresAt,
 	rotationCommands,
@@ -54,14 +53,8 @@ describe("credential-nudge", () => {
 		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
 	});
 
-	it("parameterizes GHCR vs npm rotate commands without duplicating date logic", () => {
-		const ghcr = credentialProfile("ghcr");
+	it("builds the rotation issue for a credential profile", () => {
 		const npm = credentialProfile("npm");
-		expect(ghScopeFlags(ghcr)).toBe("--env ghcr-publish ");
-		expect(ghScopeFlags(npm)).toBe("");
-		expect(rotationCommands(ghcr, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set GHCR_PUSH_TOKEN --env ghcr-publish --repo typesmiths/decohere",
-		);
 		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
 			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
 		);
@@ -71,16 +64,15 @@ describe("credential-nudge", () => {
 		expect(issueTitle(npm, "2026-11-19")).toBe(
 			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
 		);
-		const body = buildDescription(ghcr, {
+		const body = buildDescription(npm, {
 			kind: "warn",
 			expiresYmd: "2026-11-19",
 			daysLeft: 14,
 			rejected: false,
 		});
-		expect(body).toContain("Docker login/push and the `v*` tag will **fail**");
-		expect(CREDENTIALS.npm.secret).toBe("NODE_AUTH_TOKEN");
+		expect(body).toContain(CREDENTIALS.npm.failImpact);
 		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
-		expect(() => credentialProfile("nope")).toThrow(/Unknown NUDGE_CREDENTIAL/);
+		expect(() => credentialProfile("ghcr")).toThrow(/Unknown NUDGE_CREDENTIAL/);
 	});
 
 	it("files nothing and passes while the token has more than 14 days left", async () => {
@@ -104,13 +96,17 @@ describe("credential-nudge", () => {
 
 	it("files a rotation issue and stops Publish once the token has expired or was rejected", async () => {
 		const expired = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "ghcr", GHCR_TOKEN_EXPIRES_AT: inDays(0) };
+		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(0) };
 		expect(await runNudge(env, expired.upsert)).toBe(1);
 		expect(expired.upserts).toHaveLength(1);
 
 		const rejected = recordUpserts();
-		const rejectedEnv = { ...env, GHCR_TOKEN_EXPIRES_AT: inDays(60), NUDGE_REJECTED: "1" };
+		const rejectedEnv = {
+			...env,
+			NODE_AUTH_TOKEN_EXPIRES_AT: inDays(60),
+			NUDGE_REJECTED: "1",
+		};
 		expect(await runNudge(rejectedEnv, rejected.upsert)).toBe(1);
-		expect(rejected.upserts[0].body).toContain(CREDENTIALS.ghcr.rejectedWhy);
+		expect(rejected.upserts[0].body).toContain(CREDENTIALS.npm.rejectedWhy);
 	});
 });

package/tests/github/npm-bootstrap.test.mjs

@@ -58,7 +58,7 @@ afterEach(() => {
 });
 
 describe("npm-bootstrap", () => {
-	it("first-publishes unpublished names restricted, then sets the Trusted Publisher", async () => {
+	it("first-publishes unpublished names public, then sets the Trusted Publisher", async () => {
 		seedWorkspace();
 		const registry = fakeNpm({ published: ["@decohere/scribe"] });
 
@@ -67,7 +67,7 @@ describe("npm-bootstrap", () => {
 		expect(code).toBe(0);
 		expect(registry.calls).toEqual([
 			"whoami",
-			"publish ./projects/scribe/scribe-console --tag dev [otp 123456]",
+			"publish ./projects/scribe/scribe-console --access public --tag dev [otp 123456]",
 			"trust list @decohere/scribe-console --json [otp 123456]",
 			"trust github @decohere/scribe-console --file publish.yml --repo typesmiths/decohere --env npm-publish --allow-publish --yes [otp 123456]",
 		]);
@@ -107,7 +107,7 @@ describe("npm-bootstrap", () => {
 		expect(code).toBe(0);
 		expect(registry.calls).toEqual(["whoami"]);
 		expect(lines).toContain(
-			"[dry run] npm publish ./projects/scribe/scribe-console --tag dev",
+			"[dry run] npm publish ./projects/scribe/scribe-console --access public --tag dev",
 		);
 	});
 

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -47,16 +47,15 @@ describe("oidc-bootstrap-nudge", () => {
 		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
 		expect(needsPrereleaseTag("1.2.3")).toBe(false);
 		expect(firstPublishCommands([pkg], "dev")).toEqual([
-			"npm publish ./projects/scaffold --tag dev",
+			"npm publish ./projects/scaffold --access public --tag dev",
 		]);
 		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
-			"npm publish ./projects/scaffold",
+			"npm publish ./projects/scaffold --access public",
 		]);
-		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
+		expect(body).toContain("npm publish ./projects/scaffold --access public --tag dev");
 		expect(body).toContain("pnpm npm:bootstrap --otp <code> @decohere/scaffold");
 		expect(body).not.toMatch(/# @decohere\/scaffold/);
-		expect(body).toContain("do **not** pass `--access public`");
-		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
+		expect(body).toContain("First-publish each name **public**");
 		expect(body).toContain("Workflow filename: `publish.yml`");
 		expect(body).toContain("Environment: `npm-publish`");
 		expect(body).toContain("gh run rerun --failed");