@decohere/ci-tools 0.0.1-dev.20261105.103 → 0.0.1-dev.20261105.110

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.20261105.103",
+  "version": "0.0.1-dev.20261105.110",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -44,8 +44,7 @@
     "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
     "./github/publish-verify": "./src/github/publish-verify.mjs",
     "./github/first-publish-check": "./src/github/first-publish-check.mjs",
-    "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs",
-    "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"
+    "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs"
   },
   "scripts": {
     "test": "vitest run"

package/tests/github/publish-workflow.test.mjs

@@ -0,0 +1,47 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+
+const fs = await vi.importActual("node:fs");
+const PUBLISH_YML = fileURLToPath(
+	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
+);
+
+describe("publish.yml", () => {
+	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
+
+	it("only tags a version once npm and the images have shipped", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const needs = /needs: \[(.+)\]/.exec(tag)?.[1].split(", ");
+
+		expect(needs).toContain("npm");
+		expect(needs).toContain("check-images");
+	});
+
+	it("checks the images with no login, as a stranger would", () => {
+		const job = yml.slice(yml.indexOf("\n  check-images:"), yml.indexOf("\n  tag:"));
+
+		expect(job).toContain("permissions: {}");
+		expect(job).toContain("docker manifest inspect");
+		expect(job).not.toContain("docker login");
+	});
+
+	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
+		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
+		const files = fs
+			.readdirSync(workflows, { recursive: true })
+			.filter((file) => /\.ya?ml$/.test(file));
+		expect(files.length).toBeGreaterThan(0);
+		for (const file of files) {
+			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
+				/NODE_AUTH_TOKEN|_authToken/,
+			);
+		}
+	});
+
+	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
+		expect(perms).toMatch(/contents:\s*write/);
+		expect(perms).toMatch(/actions:\s*read/);
+	});
+});

package/src/github/smoke-create-launcher.mjs

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-/**
- * Run `npx @decohere/create@version --help` from an empty temp directory.
- * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
- * `@decohere/create` into the workspace tree and npm's npx misses the bin.
- * No token: the packages are public, so this installs the launcher the way a user does.
- * Anonymous reads go through npm's cache, which can lag minutes behind a publish, so it
- * first waits until npm serves the version (`attempts` tries, `intervalMs` apart).
- *
- * @param {{
- *   createVersion: string,
- *   attempts?: number,
- *   intervalMs?: number,
- *   sleep?: (ms: number) => void,
- *   mkdtempSync?: typeof mkdtempSync,
- *   writeFileSync?: typeof writeFileSync,
- *   spawnSync?: typeof spawnSync,
- *   tmpdir?: () => string,
- *   stdio?: import("node:child_process").StdioOptions,
- * }} options
- */
-export function runCreateLauncherSmoke(options) {
-	const version = options.createVersion?.trim() ?? "";
-	if (!version) {
-		throw new Error("CREATE_VERSION is required");
-	}
-
-	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
-	const writeFile = options.writeFileSync ?? writeFileSync;
-	const spawn = options.spawnSync ?? spawnSync;
-	const tmp = options.tmpdir ?? tmpdir;
-	const sleep = options.sleep ?? sleepSync;
-	const attempts = options.attempts ?? 20;
-	const intervalMs = options.intervalMs ?? 15_000;
-
-	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
-	const npmrc = join(workDir, ".npmrc");
-	writeFile(npmrc, "@decohere:registry=https://registry.npmjs.org/\n");
-
-	const env = { ...process.env, NPM_CONFIG_USERCONFIG: npmrc };
-	const spec = `@decohere/create@${version}`;
-
-	for (let attempt = 1; ; attempt++) {
-		const view = spawn("npm", ["view", spec, "version"], { cwd: workDir, env, stdio: "pipe" });
-		if (view.status === 0) break;
-		if (attempt >= attempts) {
-			console.error(`${spec} is still not served by npm after ${attempts} tries`);
-			return { workDir, status: 1 };
-		}
-		console.log(`${spec} not served by npm yet (try ${attempt} of ${attempts}); waiting`);
-		sleep(intervalMs);
-	}
-
-	const result = spawn("npx", ["--yes", spec, "--help"], {
-		cwd: workDir,
-		env,
-		stdio: options.stdio ?? "inherit",
-	});
-
-	return {
-		workDir,
-		status: result.status ?? 1,
-	};
-}
-
-/** @param {number} ms */
-function sleepSync(ms) {
-	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	const { status } = runCreateLauncherSmoke({
-		createVersion: process.env.CREATE_VERSION ?? "",
-	});
-	process.exit(status);
-}

package/tests/github/smoke-create-launcher.test.mjs

@@ -1,132 +0,0 @@
-import { fileURLToPath } from "node:url";
-import { describe, expect, it, vi } from "vitest";
-import { runCreateLauncherSmoke } from "../../src/github/smoke-create-launcher.mjs";
-
-const fs = await vi.importActual("node:fs");
-const PUBLISH_YML = fileURLToPath(
-	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
-);
-
-describe("runCreateLauncherSmoke", () => {
-	it("execs npx from a temp directory, not the repo root", () => {
-		/** @type {{ cmd: string, args: string[], opts: { cwd?: string } }[]} */
-		const calls = [];
-		const written = [];
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.80",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: (path, body) => {
-				written.push({ path, body });
-			},
-			spawnSync: (cmd, args, opts) => {
-				calls.push({ cmd, args, opts });
-				return { status: 0 };
-			},
-			stdio: "pipe",
-		});
-
-		expect(result.workDir).toBe("/tmp/decohere-create-smoke-abc");
-		expect(result.workDir).not.toBe(process.cwd());
-		const npx = calls.at(-1);
-		expect(npx.cmd).toBe("npx");
-		expect(npx.args).toEqual(["--yes", "@decohere/create@0.0.1-dev.80", "--help"]);
-		expect(npx.opts.cwd).toBe("/tmp/decohere-create-smoke-abc");
-		expect(npx.opts.cwd).not.toBe(process.cwd());
-		expect(written).toEqual([
-			{
-				path: "/tmp/decohere-create-smoke-abc/.npmrc",
-				body: "@decohere:registry=https://registry.npmjs.org/\n",
-			},
-		]);
-		// The packages are public: the smoke installs them the way a user does, with no token.
-		expect(npx.opts.env.NODE_AUTH_TOKEN).toBeUndefined();
-	});
-
-	// npm's public cache can lag minutes behind a publish: the first token-free Publish ran npx
-	// 90 seconds after publishing and got ETARGET for a version the registry already had.
-	it("waits until npm serves the new version before running npx", () => {
-		/** @type {{ cmd: string, args: string[] }[]} */
-		const calls = [];
-		const sleeps = [];
-		let views = 0;
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.127",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: () => {},
-			spawnSync: (cmd, args) => {
-				calls.push({ cmd, args });
-				if (cmd === "npm") return { status: ++views < 3 ? 1 : 0 };
-				return { status: 0 };
-			},
-			sleep: (ms) => sleeps.push(ms),
-			stdio: "pipe",
-		});
-
-		expect(result.status).toBe(0);
-		expect(calls.map((call) => call.cmd)).toEqual(["npm", "npm", "npm", "npx"]);
-		expect(calls[0].args).toEqual(["view", "@decohere/create@0.0.1-dev.127", "version"]);
-		expect(sleeps).toHaveLength(2);
-	});
-
-	it("fails without running npx when npm never serves the version", () => {
-		/** @type {string[]} */
-		const commands = [];
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.127",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: () => {},
-			spawnSync: (cmd) => {
-				commands.push(cmd);
-				return { status: 1 };
-			},
-			sleep: () => {},
-			attempts: 3,
-			stdio: "pipe",
-		});
-
-		expect(result.status).toBe(1);
-		expect(commands).toEqual(["npm", "npm", "npm"]);
-	});
-
-	it("fails closed without a version", () => {
-		expect(() => runCreateLauncherSmoke({ createVersion: "" })).toThrow(
-			"CREATE_VERSION is required",
-		);
-	});
-});
-
-describe("publish.yml create smoke + tag", () => {
-	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
-
-	it("wires create smoke through the isolated launcher", () => {
-		expect(yml).toContain("node projects/ci-tools/src/github/smoke-create-launcher.mjs");
-		expect(yml).toContain("CREATE_VERSION:");
-		expect(yml).not.toContain("npx --yes");
-	});
-
-	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
-		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
-		const files = fs
-			.readdirSync(workflows, { recursive: true })
-			.filter((file) => /\.ya?ml$/.test(file));
-		expect(files.length).toBeGreaterThan(0);
-		for (const file of files) {
-			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
-				/NODE_AUTH_TOKEN|_authToken/,
-			);
-		}
-	});
-
-	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
-		const tag = yml.slice(yml.indexOf("\n  tag:"));
-		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
-		expect(perms).toMatch(/contents:\s*write/);
-		expect(perms).toMatch(/actions:\s*read/);
-	});
-});