@decohere/ci-tools 0.0.1-dev.20261105.64 → 0.0.1-dev.20261105.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.20261105.64",
+  "version": "0.0.1-dev.20261105.67",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",

package/src/github/npm-bootstrap.mjs

@@ -165,6 +165,9 @@ export async function runBootstrap(options = {}) {
 		}
 	}
 
+	log(
+		"\nFor each new package, also run `pnpm npm:trust-promote --otp <code>`, so Promote to latest can move its tag.",
+	);
 	log(
 		"\nDone. Approve the waiting npm-oidc-bootstrap deployment on the Publish run, or rerun it: `gh run rerun --failed <run-id>`.",
 	);

package/src/github/npm-trust-promote.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+/**
+ * Gives every public @decohere package the Trusted Publisher `promote-latest.yml` needs, by copying
+ * it from one package an owner set up on npmjs.com. `npm trust` has no flag for the "Allow npm
+ * dist-tag" permission (`manageDistTags` in the registry), so this calls the same registry endpoint
+ * it uses. npm doesn't document that endpoint. It only adds entries, and packages that already have
+ * one are skipped.
+ *
+ * Reads the owner's npm login from NPM_TOKEN, and never prints it.
+ *
+ *   NPM_TOKEN="$(sed -n 's#^//registry.npmjs.org/:_authToken=##p' ~/.npmrc)" \
+ *     pnpm npm:trust-promote --otp <code> [--from @decohere/cli]
+ */
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { listPublishablePackages } from "./publish-verify.mjs";
+
+export const PROMOTE_WORKFLOW = "promote-latest.yml";
+const REGISTRY = "https://registry.npmjs.org";
+
+/**
+ * @typedef {{ type?: string, claims?: { workflow_ref?: { file?: string } }, permissions?: string[] }} TrustEntry
+ */
+
+/**
+ * @param {TrustEntry[]} entries
+ * @returns {TrustEntry | undefined}
+ */
+function findPromoteEntry(entries) {
+	return entries.find((entry) => entry.claims?.workflow_ref?.file === PROMOTE_WORKFLOW);
+}
+
+/**
+ * @param {{
+ *   packages: string[],
+ *   from: string,
+ *   token: string,
+ *   otp: string,
+ *   fetch: typeof globalThis.fetch,
+ *   log?: (message: string) => void,
+ * }} options
+ * @returns {Promise<number>} exit code
+ */
+export async function copyPromoteTrust(options) {
+	const { packages, from, token, otp, fetch } = options;
+	const log = options.log ?? console.log;
+	const headers = {
+		authorization: `Bearer ${token}`,
+		"npm-otp": otp,
+		"content-type": "application/json",
+	};
+	const trustUrl = (name) => `${REGISTRY}/-/package/${name.replace("/", "%2f")}/trust`;
+
+	const list = async (name) => {
+		const response = await fetch(trustUrl(name), { headers });
+		if (!response.ok) {
+			throw new Error(`reading ${name}: ${response.status} ${await response.text()}`);
+		}
+		return /** @type {TrustEntry[]} */ (await response.json());
+	};
+
+	let source;
+	try {
+		source = findPromoteEntry(await list(from));
+	} catch (error) {
+		log(`Nothing changed. ${String(error)}`);
+		return 1;
+	}
+	if (source == null) {
+		log(
+			`${from} has no Trusted Publisher for ${PROMOTE_WORKFLOW}. On npmjs.com, in its settings, add ` +
+				`one: GitHub Actions, organization typesmiths, repository decohere, workflow ${PROMOTE_WORKFLOW}, ` +
+				"no environment, Allow npm publish off, Allow npm dist-tag on. Then run this again. " +
+				"If you set it up on another package, pass that one with --from. Nothing changed.",
+		);
+		return 1;
+	}
+	log(`Copying from ${from}, with permissions: ${(source.permissions ?? []).join(", ")}`);
+
+	const entry = { type: source.type, claims: source.claims, permissions: source.permissions };
+	const others = packages.filter((name) => name !== from);
+	const failures = [];
+	// All at once, so one OTP code covers them before it expires.
+	await Promise.all(
+		others.map(async (name) => {
+			try {
+				if (findPromoteEntry(await list(name)) != null) {
+					log(`already set: ${name}`);
+					return;
+				}
+				const response = await fetch(trustUrl(name), {
+					method: "POST",
+					headers,
+					body: JSON.stringify([entry]),
+				});
+				if (!response.ok) {
+					failures.push(`${name}: ${response.status} ${await response.text()}`);
+					return;
+				}
+				log(`set: ${name}`);
+			} catch (error) {
+				failures.push(`${name}: ${String(error)}`);
+			}
+		}),
+	);
+
+	if (failures.length > 0) {
+		log(`Failed:\n${failures.join("\n")}\nRun it again with a new code to finish.`);
+		return 1;
+	}
+	log(`Done: ${packages.length} packages have a Trusted Publisher for ${PROMOTE_WORKFLOW}.`);
+	return 0;
+}
+
+if (process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href) {
+	const { values } = parseArgs({
+		options: {
+			otp: { type: "string" },
+			from: { type: "string", default: "@decohere/cli" },
+		},
+	});
+	const token = process.env.NPM_TOKEN;
+	if (!token || !values.otp) {
+		console.error(
+			`Usage: NPM_TOKEN="$(sed -n 's#^//registry.npmjs.org/:_authToken=##p' ~/.npmrc)" pnpm npm:trust-promote --otp <code>`,
+		);
+		process.exit(1);
+	}
+	process.exit(
+		await copyPromoteTrust({
+			packages: listPublishablePackages(resolve(".")).map((pkg) => pkg.name),
+			from: values.from,
+			token,
+			otp: values.otp,
+			fetch: globalThis.fetch,
+		}),
+	);
+}

package/src/release/promote-latest.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+/**
+ * Points npm's `latest` tag at a version on every public @decohere package. Run by
+ * `promote-latest.yml`, which authenticates over OIDC.
+ *
+ * Refuses a version that isn't on every package, has no `v*` tag (a version only gets one once it
+ * passed CI and fully shipped), or is under a day old, unless `allowYoung` is set: current pnpm
+ * skips versions that new and would install an older one. Safe to re-run: packages already there
+ * are skipped.
+ */
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { listPublishablePackages } from "../github/publish-verify.mjs";
+
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+const LAUNCH_PACKAGE = "@decohere/cli";
+
+/** @typedef {{ status: number | null, stdout: string }} RunResult */
+
+/**
+ * @param {{
+ *   version?: string,
+ *   allowYoung?: boolean,
+ *   packages: string[],
+ *   run: (command: string, args: string[]) => RunResult,
+ *   now?: () => number,
+ *   log?: (message: string) => void,
+ * }} options
+ * @returns {number} exit code
+ */
+export function promoteLatest(options) {
+	const { packages, run, allowYoung = false } = options;
+	const now = options.now ?? Date.now;
+	const log = options.log ?? console.log;
+	const npm = (...args) => run("npm", args);
+
+	const version =
+		options.version?.trim() || npm("view", LAUNCH_PACKAGE, "dist-tags.dev").stdout.trim();
+	if (!version) {
+		log(`Could not read the dev tag of ${LAUNCH_PACKAGE}. Nothing moved.`);
+		return 1;
+	}
+	log(`Promoting ${version} to latest on ${packages.length} packages`);
+
+	const tag = run("git", ["tag", "--list", `v${version}`]).stdout.trim();
+	if (tag !== `v${version}`) {
+		log(`${version} has no v${version} tag, so it didn't fully ship. Nothing moved.`);
+		return 1;
+	}
+
+	const missing = packages.filter(
+		(name) => npm("view", `${name}@${version}`, "version").stdout.trim() !== version,
+	);
+	if (missing.length > 0) {
+		log(`Not on npm at ${version}: ${missing.join(", ")}. Nothing moved.`);
+		return 1;
+	}
+
+	if (!allowYoung) {
+		const published = Date.parse(
+			npm("view", `${LAUNCH_PACKAGE}@${version}`, "time", "--json").stdout.match(
+				new RegExp(`"${version.replaceAll(".", "\\.")}":\\s*"([^"]+)"`),
+			)?.[1] ?? "",
+		);
+		if (Number.isNaN(published)) {
+			log(`Could not read when ${version} was published. Nothing moved.`);
+			return 1;
+		}
+		const hours = (now() - published) / (60 * 60 * 1000);
+		if (now() - published < ONE_DAY_MS) {
+			log(
+				`${version} is ${hours.toFixed(1)} hours old. Current pnpm skips versions under a day old ` +
+					"and would install an older one. Wait, or run with allow_young. Nothing moved.",
+			);
+			return 1;
+		}
+	}
+
+	/** `npm dist-tag ls` reads fresh; `npm view` can lag for a minute or so after a move. */
+	const onLatest = (name) => {
+		const line = npm("dist-tag", "ls", name)
+			.stdout.split("\n")
+			.find((entry) => entry.startsWith("latest:"));
+		return line?.slice("latest:".length).trim() === version;
+	};
+
+	const failed = [];
+	for (const name of packages) {
+		if (onLatest(name)) {
+			log(`already there: ${name}`);
+			continue;
+		}
+		if (npm("dist-tag", "add", `${name}@${version}`, "latest").status !== 0) failed.push(name);
+	}
+
+	const wrong = packages.filter((name) => !failed.includes(name) && !onLatest(name));
+	if (failed.length > 0 || wrong.length > 0) {
+		log(`Failed to move: ${[...failed, ...wrong].join(", ")}. Run it again to finish.`);
+		return 1;
+	}
+	log(`latest is now ${version} on all ${packages.length} packages`);
+	return 0;
+}
+
+if (process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href) {
+	const packages = listPublishablePackages(resolve(".")).map((pkg) => pkg.name);
+	process.exit(
+		promoteLatest({
+			version: process.env.PROMOTE_VERSION,
+			allowYoung: process.env.PROMOTE_ALLOW_YOUNG === "true",
+			packages,
+			run: (command, args) => {
+				const result = spawnSync(command, args, {
+					encoding: "utf8",
+					stdio: ["ignore", "pipe", "inherit"],
+				});
+				return { status: result.status, stdout: result.stdout ?? "" };
+			},
+		}),
+	);
+}