@decohere/ci-tools 0.0.1-dev.126 → 0.0.1-dev.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.126",
+  "version": "0.0.1-dev.127",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -43,7 +43,6 @@
     "./github/ensure-metadata": "./src/github/ensure-metadata.mjs",
     "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
     "./github/publish-verify": "./src/github/publish-verify.mjs",
-    "./github/credential-nudge": "./src/github/credential-nudge.mjs",
     "./github/oidc-bootstrap-nudge": "./src/github/oidc-bootstrap-nudge.mjs",
     "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs",
     "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"

package/src/github/smoke-create-launcher.mjs

@@ -9,10 +9,10 @@ import { pathToFileURL } from "node:url";
  * Run `npx @decohere/create@version --help` from an empty temp directory.
  * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
  * `@decohere/create` into the workspace tree and npm's npx misses the bin.
+ * No token: the packages are public, so this installs the launcher the way a user does.
  *
  * @param {{
  *   createVersion: string,
- *   authToken: string,
  *   mkdtempSync?: typeof mkdtempSync,
  *   writeFileSync?: typeof writeFileSync,
  *   spawnSync?: typeof spawnSync,
@@ -22,13 +22,9 @@ import { pathToFileURL } from "node:url";
  */
 export function runCreateLauncherSmoke(options) {
 	const version = options.createVersion?.trim() ?? "";
-	const token = options.authToken?.trim() ?? "";
 	if (!version) {
 		throw new Error("CREATE_VERSION is required");
 	}
-	if (!token) {
-		throw new Error("NODE_AUTH_TOKEN is required");
-	}
 
 	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
 	const writeFile = options.writeFileSync ?? writeFileSync;
@@ -37,18 +33,11 @@ export function runCreateLauncherSmoke(options) {
 
 	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
 	const npmrc = join(workDir, ".npmrc");
-	writeFile(
-		npmrc,
-		`@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`,
-	);
+	writeFile(npmrc, "@decohere:registry=https://registry.npmjs.org/\n");
 
 	const result = spawn("npx", ["--yes", `@decohere/create@${version}`, "--help"], {
 		cwd: workDir,
-		env: {
-			...process.env,
-			NPM_CONFIG_USERCONFIG: npmrc,
-			NODE_AUTH_TOKEN: token,
-		},
+		env: { ...process.env, NPM_CONFIG_USERCONFIG: npmrc },
 		stdio: options.stdio ?? "inherit",
 	});
 
@@ -64,7 +53,6 @@ const isCli =
 if (isCli) {
 	const { status } = runCreateLauncherSmoke({
 		createVersion: process.env.CREATE_VERSION ?? "",
-		authToken: process.env.NODE_AUTH_TOKEN ?? "",
 	});
 	process.exit(status);
 }

package/tests/github/smoke-create-launcher.test.mjs

@@ -15,7 +15,6 @@ describe("runCreateLauncherSmoke", () => {
 
 		const result = runCreateLauncherSmoke({
 			createVersion: "0.0.1-dev.80",
-			authToken: "tok",
 			tmpdir: () => "/tmp",
 			mkdtempSync: (prefix) => `${prefix}abc`,
 			writeFileSync: (path, body) => {
@@ -38,18 +37,17 @@ describe("runCreateLauncherSmoke", () => {
 		expect(written).toEqual([
 			{
 				path: "/tmp/decohere-create-smoke-abc/.npmrc",
-				body: "@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=tok\n",
+				body: "@decohere:registry=https://registry.npmjs.org/\n",
 			},
 		]);
+		// The packages are public: the smoke installs them the way a user does, with no token.
+		expect(calls[0].opts.env.NODE_AUTH_TOKEN).toBeUndefined();
 	});
 
-	it("fails closed without version or token", () => {
-		expect(() => runCreateLauncherSmoke({ createVersion: "", authToken: "tok" })).toThrow(
+	it("fails closed without a version", () => {
+		expect(() => runCreateLauncherSmoke({ createVersion: "" })).toThrow(
 			"CREATE_VERSION is required",
 		);
-		expect(() =>
-			runCreateLauncherSmoke({ createVersion: "0.0.1-dev.80", authToken: "" }),
-		).toThrow("NODE_AUTH_TOKEN is required");
 	});
 });
 
@@ -62,6 +60,19 @@ describe("publish.yml create smoke + tag", () => {
 		expect(yml).not.toContain("npx --yes");
 	});
 
+	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
+		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
+		const files = fs
+			.readdirSync(workflows, { recursive: true })
+			.filter((file) => /\.ya?ml$/.test(file));
+		expect(files.length).toBeGreaterThan(0);
+		for (const file of files) {
+			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
+				/NODE_AUTH_TOKEN|_authToken/,
+			);
+		}
+	});
+
 	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
 		const tag = yml.slice(yml.indexOf("\n  tag:"));
 		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));

package/tests/lib/github-issue.test.mjs

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { pickIssue, upsertIssue } from "../../src/lib/github-issue.mjs";
 
-const TITLE = "chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)";
+const TITLE = "security(ci): high or critical npm audit findings";
 
 /** A fake `gh` that answers `issue list` with `issues` and records every call. */
 function fakeGh(issues) {

package/src/github/credential-nudge.mjs

@@ -1,226 +0,0 @@
-import { resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { upsertIssue } from "../lib/github-issue.mjs";
-
-const WARN_DAYS = 14;
-const MS_PER_DAY = 86_400_000;
-const DEFAULT_REPO = "typesmiths/decohere";
-
-/**
- * One profile per credential (repo secret + repo variable). Date math, GitHub issue
- * upsert, and fail-closed live below.
- *
- * @typedef {{
- *   id: string,
- *   secret: string,
- *   expiresVar: string,
- *   mint: string,
- *   failImpact: string,
- *   rejectedWhy: string,
- *   revokeUrl: string,
- * }} CredentialProfile
- */
-
-/** @type {Record<string, CredentialProfile>} */
-export const CREDENTIALS = {
-	npm: {
-		id: "npm",
-		secret: "NODE_AUTH_TOKEN",
-		expiresVar: "NODE_AUTH_TOKEN_EXPIRES_AT",
-		mint: "Create an npm **read** token (granular/classic) at https://www.npmjs.com/settings/~/tokens — Publish PUTs are OIDC; this token is only for private `npm view` and create smoke.",
-		failImpact:
-			"Verify cannot see private packages, so skipIfPublished and create smoke are unsafe. Publish **fails closed** before OIDC/Docker. After you rotate, re-run the failed Publish jobs.",
-		rejectedWhy: "`npm whoami` failed (expired, revoked, or missing `NODE_AUTH_TOKEN`).",
-		revokeUrl: "https://www.npmjs.com/settings/~/tokens",
-	},
-};
-
-export function utcDayMs(date) {
-	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
-}
-
-/** @param {string | undefined} raw */
-export function parseExpiresAt(raw) {
-	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(raw ?? "").trim());
-	if (!match) {
-		return null;
-	}
-	return Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
-}
-
-/**
- * @param {{ now?: number, expiresAtMs: number | null, warnDays?: number }} options
- * @returns {{ kind: "missing" | "ok" | "warn" | "expired", daysLeft: number | null }}
- */
-export function assessTokenLifetime(options) {
-	const { expiresAtMs, warnDays = WARN_DAYS } = options;
-	if (expiresAtMs == null) {
-		return { kind: "missing", daysLeft: null };
-	}
-	const today = utcDayMs(new Date(options.now ?? Date.now()));
-	const daysLeft = Math.round((expiresAtMs - today) / MS_PER_DAY);
-	if (daysLeft <= 0) {
-		return { kind: "expired", daysLeft };
-	}
-	if (daysLeft <= warnDays) {
-		return { kind: "warn", daysLeft };
-	}
-	return { kind: "ok", daysLeft };
-}
-
-/** @param {CredentialProfile} credential */
-export function resolveRepo() {
-	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
-}
-
-/** @param {string} id */
-export function credentialProfile(id) {
-	const credential = CREDENTIALS[id];
-	if (!credential) {
-		throw new Error(
-			`Unknown NUDGE_CREDENTIAL=${id}. Expected one of: ${Object.keys(CREDENTIALS).join(", ")}`,
-		);
-	}
-	return credential;
-}
-
-/** @param {CredentialProfile} credential */
-export function issueTitle(credential, expiresYmd) {
-	return `chore(security): rotate ${credential.secret} (expires ${expiresYmd})`;
-}
-
-/** @param {CredentialProfile} credential */
-export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
-	const next = nextExpiresYmd ?? "YYYY-MM-DD";
-	return [
-		credential.mint,
-		"",
-		"Then from a trusted machine (do not paste the token into Actions or this issue):",
-		"",
-		"```bash",
-		`gh secret set ${credential.secret} --repo ${repo}`,
-		`gh variable set ${credential.expiresVar} --repo ${repo} --body ${next}`,
-		"```",
-		"",
-		`Revoke the old token: ${credential.revokeUrl}`,
-		"Close this issue, then retry Publish:",
-		"",
-		"```bash",
-		`gh run list --repo ${repo} --workflow Publish --limit 5`,
-		`gh run rerun --failed <run-id> --repo ${repo}`,
-		"```",
-	].join("\n");
-}
-
-export function suggestedNextExpiry(fromMs, days = 90) {
-	const start = utcDayMs(new Date(fromMs));
-	const next = new Date(start + days * MS_PER_DAY);
-	const y = next.getUTCFullYear();
-	const m = String(next.getUTCMonth() + 1).padStart(2, "0");
-	const d = String(next.getUTCDate()).padStart(2, "0");
-	return `${y}-${m}-${d}`;
-}
-
-/** @param {CredentialProfile} credential */
-export function buildDescription(credential, options) {
-	const { kind, expiresYmd, daysLeft, rejected, runUrl } = options;
-	const next = suggestedNextExpiry(Date.now());
-	const why = rejected
-		? credential.rejectedWhy
-		: kind === "expired"
-			? `${credential.expiresVar} (${expiresYmd}) is today or in the past. Rotate ${credential.secret} and this date before Publish can continue.`
-			: `${credential.secret} expires on ${expiresYmd} (${daysLeft} day(s) left). Rotate before that date so Publish does not fail closed.`;
-	return [
-		"## Summary",
-		"",
-		why,
-		"",
-		"## If this is not done in time",
-		"",
-		credential.failImpact,
-		"",
-		"## Commands",
-		"",
-		rotationCommands(credential, next),
-		"",
-		runUrl ? `- Workflow run: ${runUrl}` : null,
-	]
-		.filter((line) => line != null)
-		.join("\n");
-}
-
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "";
-}
-
-/** @param {CredentialProfile} credential */
-export function upsertRotationIssue(credential, options, upsert = upsertIssue) {
-	const { expiresYmd, kind, daysLeft, rejected } = options;
-	return upsert({
-		title: issueTitle(credential, expiresYmd ?? "unknown"),
-		body: buildDescription(credential, {
-			kind,
-			expiresYmd,
-			daysLeft,
-			rejected,
-			runUrl: runUrl(),
-		}),
-	});
-}
-
-export async function runNudge(env = process.env, upsert = upsertIssue) {
-	const credential = credentialProfile(String(env.NUDGE_CREDENTIAL ?? "").trim());
-	const rejected = env.NUDGE_REJECTED === "1";
-	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
-	const expiresAtMs = parseExpiresAt(expiresYmd);
-	const assessment = assessTokenLifetime({ expiresAtMs });
-	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
-
-	if (assessment.kind === "missing" && !rejected) {
-		process.stderr.write(
-			`repository variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
-				`  gh variable set ${credential.expiresVar} --repo ${repo} --body YYYY-MM-DD\n`,
-		);
-		return 1;
-	}
-
-	if (rejected || assessment.kind === "warn" || assessment.kind === "expired") {
-		const result = upsertRotationIssue(
-			credential,
-			{
-				expiresYmd: expiresYmd || "unknown",
-				kind: assessment.kind,
-				daysLeft: assessment.daysLeft,
-				rejected,
-			},
-			upsert,
-		);
-		process.stdout.write(
-			`${result.created ? "Opened" : "Updated"} issue #${result.number} ${result.url}\n`,
-		);
-	}
-
-	if (rejected || assessment.kind === "expired" || assessment.kind === "missing") {
-		if (assessment.kind === "expired") {
-			process.stderr.write(
-				`${credential.secret} calendar expiry ${expiresYmd} has been reached — refusing to continue\n`,
-			);
-		}
-		return 1;
-	}
-	return 0;
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	process.exit(await runNudge());
-}

package/tests/github/credential-nudge.test.mjs

@@ -1,112 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-	assessTokenLifetime,
-	buildDescription,
-	CREDENTIALS,
-	credentialProfile,
-	issueTitle,
-	parseExpiresAt,
-	rotationCommands,
-	runNudge,
-	suggestedNextExpiry,
-} from "../../src/github/credential-nudge.mjs";
-
-/** Records each upsert and answers like a newly opened issue. */
-function recordUpserts() {
-	/** @type {{ title: string, body: string }[]} */
-	const upserts = [];
-	const upsert = (options) => {
-		upserts.push(options);
-		return {
-			number: 9,
-			url: "https://github.com/typesmiths/decohere/issues/9",
-			created: true,
-		};
-	};
-	return { upserts, upsert };
-}
-
-function inDays(days) {
-	return suggestedNextExpiry(Date.now(), days);
-}
-
-describe("credential-nudge", () => {
-	it("parses YYYY-MM-DD as a UTC day", () => {
-		expect(parseExpiresAt("2026-11-19")).toBe(Date.UTC(2026, 10, 19));
-		expect(parseExpiresAt("")).toBeNull();
-	});
-
-	it("is ok more than 14 days out, warns inside the window, expires on the day", () => {
-		const expiresAtMs = Date.UTC(2026, 10, 19);
-		const now = (day) => Date.UTC(2026, 10, day, 15);
-		expect(assessTokenLifetime({ now: now(1), expiresAtMs }).kind).toBe("ok");
-		expect(assessTokenLifetime({ now: now(5), expiresAtMs })).toEqual({
-			kind: "warn",
-			daysLeft: 14,
-		});
-		expect(assessTokenLifetime({ now: now(18), expiresAtMs }).kind).toBe("warn");
-		expect(assessTokenLifetime({ now: now(19), expiresAtMs })).toEqual({
-			kind: "expired",
-			daysLeft: 0,
-		});
-		expect(assessTokenLifetime({ now: now(20), expiresAtMs }).kind).toBe("expired");
-		expect(assessTokenLifetime({ expiresAtMs: null }).kind).toBe("missing");
-	});
-
-	it("builds the rotation issue for a credential profile", () => {
-		const npm = credentialProfile("npm");
-		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh secret set NODE_AUTH_TOKEN --repo typesmiths/decohere",
-		);
-		expect(rotationCommands(npm, "2027-02-17", "typesmiths/decohere")).toContain(
-			"gh variable set NODE_AUTH_TOKEN_EXPIRES_AT --repo typesmiths/decohere --body 2027-02-17",
-		);
-		expect(issueTitle(npm, "2026-11-19")).toBe(
-			"chore(security): rotate NODE_AUTH_TOKEN (expires 2026-11-19)",
-		);
-		const body = buildDescription(npm, {
-			kind: "warn",
-			expiresYmd: "2026-11-19",
-			daysLeft: 14,
-			rejected: false,
-		});
-		expect(body).toContain(CREDENTIALS.npm.failImpact);
-		expect(suggestedNextExpiry(Date.UTC(2026, 7, 21), 90)).toBe("2026-11-19");
-		expect(() => credentialProfile("ghcr")).toThrow(/Unknown NUDGE_CREDENTIAL/);
-	});
-
-	it("files nothing and passes while the token has more than 14 days left", async () => {
-		const { upserts, upsert } = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(30) };
-		expect(await runNudge(env, upsert)).toBe(0);
-		expect(upserts).toEqual([]);
-	});
-
-	it("files a rotation issue but lets Publish continue inside the warning window", async () => {
-		const { upserts, upsert } = recordUpserts();
-		const expires = inDays(10);
-		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: expires };
-		expect(await runNudge(env, upsert)).toBe(0);
-		expect(upserts).toHaveLength(1);
-		expect(upserts[0].title).toBe(
-			`chore(security): rotate NODE_AUTH_TOKEN (expires ${expires})`,
-		);
-		expect(upserts[0].body).toContain("Close this issue, then retry Publish");
-	});
-
-	it("files a rotation issue and stops Publish once the token has expired or was rejected", async () => {
-		const expired = recordUpserts();
-		const env = { NUDGE_CREDENTIAL: "npm", NODE_AUTH_TOKEN_EXPIRES_AT: inDays(0) };
-		expect(await runNudge(env, expired.upsert)).toBe(1);
-		expect(expired.upserts).toHaveLength(1);
-
-		const rejected = recordUpserts();
-		const rejectedEnv = {
-			...env,
-			NODE_AUTH_TOKEN_EXPIRES_AT: inDays(60),
-			NUDGE_REJECTED: "1",
-		};
-		expect(await runNudge(rejectedEnv, rejected.upsert)).toBe(1);
-		expect(rejected.upserts[0].body).toContain(CREDENTIALS.npm.rejectedWhy);
-	});
-});