@decohere/ci-tools 0.0.1-dev.124 → 0.0.1-dev.126

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.124",
+  "version": "0.0.1-dev.126",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",

package/src/bench/bench.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * bench.mjs — run the benchmark suites and compare against the last saved run (#660).
+ * bench.mjs — run the benchmark suites and compare against the last saved run.
  *
  * Usage:
  *   pnpm bench                          — run every suite and compare, do not save
@@ -41,7 +41,7 @@ import {
 } from "./history.mjs";
 
 const WORKSPACE_ROOT = process.cwd();
-// BENCH_HISTORY_FILE lets the nightly job save each comparison round to its own file (#667).
+// BENCH_HISTORY_FILE lets the nightly job save each comparison round to its own file.
 const HISTORY_FILE =
 	process.env.BENCH_HISTORY_FILE ??
 	join(WORKSPACE_ROOT, "projects/ci-tools/dist/ci/bench/bench-history.json");

package/src/bench/history.mjs

@@ -1,6 +1,6 @@
 /**
  * Benchmark history: the results of each `pnpm bench` run, kept per machine so runs are only
- * compared like for like (#660). Pure functions over plain data; bench.mjs does the I/O.
+ * compared like for like. Pure functions over plain data; bench.mjs does the I/O.
  *
  * Shape (version 2):
  *   { version: 2, contexts: { [contextId]: { context, runs: [{ date, sha, results }] } } }
@@ -118,7 +118,7 @@ export function previousRun(history, id) {
 	return history.contexts[id]?.runs[0];
 }
 
-/** Machine types with no run for this long are dropped: CI runner types come and go (#667). */
+/** Machine types with no run for this long are dropped: CI runner types come and go. */
 export const STALE_AFTER_DAYS = 30;
 
 /** The history without machine types whose newest run is older than `days` before `now`. */
@@ -205,7 +205,7 @@ export function formatComparison(rows) {
 }
 
 /**
- * When a benchmark counts as slower (#667): the nightly job benchmarks tonight's commit (head)
+ * When a benchmark counts as slower: the nightly job benchmarks tonight's commit (head)
  * and the one the previous nightly measured (base) on the same runner, alternating head, base,
  * head, base. A benchmark regressed when head's median beats base's by more than `threshold`
  * in every round, so one noisy round files nothing.

package/src/bench/nightly.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * nightly.mjs — the nightly benchmark run (#667). Benchmarks tonight's commit (head) and the
+ * nightly.mjs — the nightly benchmark run. Benchmarks tonight's commit (head) and the
  * commit the previous nightly measured (base) on this runner, alternating head, base, head,
  * base, so the comparison never mixes CPU models. Then:
  *

package/src/bench/regression-issue.mjs

@@ -1,5 +1,5 @@
 /**
- * The GitHub issue for a benchmark that got slower (#660, #667): one open issue per benchmark,
+ * The GitHub issue for a benchmark that got slower: one open issue per benchmark,
  * found again by its exact title and updated in place while the regression lasts.
  */
 

package/src/github/npm-bootstrap.mjs

@@ -1,5 +1,5 @@
 /**
- * First-publish a new package name (restricted) and give it its Trusted Publisher,
+ * First-publish a new package name (public) and give it its Trusted Publisher,
  * so `publish.yml` can release it over OIDC from then on.
  *
  *   pnpm npm:bootstrap [--otp <code>] [--dry-run] [--channel dev] [<package-name>...]
@@ -31,15 +31,15 @@ export function needsPrereleaseTag(version) {
 }
 
 /**
- * npm arguments for a name-only first publish. Restricted is the scoped default,
- * so no `--access`. `./` stops npm reading the path as a GitHub `owner/repo`.
+ * npm arguments for a name-only first publish. Scoped names default to restricted,
+ * so `--access public`. `./` stops npm reading the path as a GitHub `owner/repo`.
  *
  * @param {{ dir: string, version?: string }} pkg
  * @param {string} channel
  */
 export function publishArgs(pkg, channel) {
 	const tag = needsPrereleaseTag(pkg.version) ? ["--tag", channel] : [];
-	return ["publish", `./projects/${pkg.dir}`, ...tag];
+	return ["publish", `./projects/${pkg.dir}`, "--access", "public", ...tag];
 }
 
 /** @param {string} name */

package/src/github/oidc-bootstrap-nudge.mjs

@@ -33,7 +33,7 @@ export function firstPublishCommands(packages, channel = "dev") {
 	}
 	return packages.map((pkg) => {
 		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
-		return `npm publish ./projects/${pkg.dir}${tag}`;
+		return `npm publish ./projects/${pkg.dir} --access public${tag}`;
 	});
 }
 
@@ -95,7 +95,7 @@ export function buildDescription(options) {
 		"",
 		"That does steps 1 and 2 below, skipping what is already done. To do them by hand instead:",
 		"",
-		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
+		"1. First-publish each name **public** (`--access public`: scoped names default to restricted). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
 		"",
 		"```bash",
 		...firstPublishCommands(packages, channel),

package/src/lib/github-issue.mjs

@@ -47,7 +47,7 @@ export function upsertIssue(options, run = gh) {
 			"--limit",
 			"200",
 			"--search",
-			// Quoted: GitHub's search can't match a title like `security(ci): …` unquoted (#681).
+			// Quoted: GitHub's search can't match a title like `security(ci): …` unquoted.
 			// The exact-title match in pickIssue still decides.
 			`"${title.replaceAll('"', "")}" in:title`,
 			"--json",

package/src/pages/bench-page.mjs

@@ -1,5 +1,5 @@
 /**
- * The benchmark page on Pages (#660): a trend chart per benchmark and a table of the latest
+ * The benchmark page on Pages: a trend chart per benchmark and a table of the latest
  * results, from the version 2 history (../bench/history.mjs). Static HTML and inline SVG, so the
  * page needs no script and no third-party chart library.
  */
@@ -51,7 +51,7 @@ function machineName(context) {
 
 /**
  * Contexts with a run within STALE_AFTER_DAYS of the newest run anywhere, most recently run first:
- * CI runner types come and go, and one that stopped appearing would otherwise keep a line (#667).
+ * CI runner types come and go, and one that stopped appearing would otherwise keep a line.
  */
 function activeContexts(history) {
 	const newest = Math.max(

package/tests/github/npm-bootstrap.test.mjs

@@ -58,7 +58,7 @@ afterEach(() => {
 });
 
 describe("npm-bootstrap", () => {
-	it("first-publishes unpublished names restricted, then sets the Trusted Publisher", async () => {
+	it("first-publishes unpublished names public, then sets the Trusted Publisher", async () => {
 		seedWorkspace();
 		const registry = fakeNpm({ published: ["@decohere/scribe"] });
 
@@ -67,7 +67,7 @@ describe("npm-bootstrap", () => {
 		expect(code).toBe(0);
 		expect(registry.calls).toEqual([
 			"whoami",
-			"publish ./projects/scribe/scribe-console --tag dev [otp 123456]",
+			"publish ./projects/scribe/scribe-console --access public --tag dev [otp 123456]",
 			"trust list @decohere/scribe-console --json [otp 123456]",
 			"trust github @decohere/scribe-console --file publish.yml --repo typesmiths/decohere --env npm-publish --allow-publish --yes [otp 123456]",
 		]);
@@ -86,7 +86,7 @@ describe("npm-bootstrap", () => {
 		expect(registry.calls).toEqual(["whoami", "trust list @decohere/scribe-console --json"]);
 	});
 
-	/** #700 — `npm trust` rejects `--otp`: the code goes through the environment. */
+	/** `npm trust` rejects `--otp`: the code goes through the environment. */
 	it("never passes the code as an argument, and lets npm ask when none is given", async () => {
 		seedWorkspace();
 		const withCode = fakeNpm({ published: ["@decohere/scribe"] });
@@ -107,7 +107,7 @@ describe("npm-bootstrap", () => {
 		expect(code).toBe(0);
 		expect(registry.calls).toEqual(["whoami"]);
 		expect(lines).toContain(
-			"[dry run] npm publish ./projects/scribe/scribe-console --tag dev",
+			"[dry run] npm publish ./projects/scribe/scribe-console --access public --tag dev",
 		);
 	});
 

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -47,16 +47,15 @@ describe("oidc-bootstrap-nudge", () => {
 		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
 		expect(needsPrereleaseTag("1.2.3")).toBe(false);
 		expect(firstPublishCommands([pkg], "dev")).toEqual([
-			"npm publish ./projects/scaffold --tag dev",
+			"npm publish ./projects/scaffold --access public --tag dev",
 		]);
 		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
-			"npm publish ./projects/scaffold",
+			"npm publish ./projects/scaffold --access public",
 		]);
-		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
+		expect(body).toContain("npm publish ./projects/scaffold --access public --tag dev");
 		expect(body).toContain("pnpm npm:bootstrap --otp <code> @decohere/scaffold");
 		expect(body).not.toMatch(/# @decohere\/scaffold/);
-		expect(body).toContain("do **not** pass `--access public`");
-		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
+		expect(body).toContain("First-publish each name **public**");
 		expect(body).toContain("Workflow filename: `publish.yml`");
 		expect(body).toContain("Environment: `npm-publish`");
 		expect(body).toContain("gh run rerun --failed");

package/tests/lib/github-issue.test.mjs

@@ -28,7 +28,7 @@ describe("github-issue", () => {
 		expect(pickIssue([], TITLE)).toBeNull();
 	});
 
-	// #681: GitHub's search can't match `security(ci): …` unquoted, so the lookup found nothing
+	// GitHub's search can't match `security(ci): …` unquoted, so the lookup found nothing
 	// and a new issue was opened on every run.
 	it("searches for the title as a quoted phrase", () => {
 		const { run, calls } = fakeGh([]);