@decohere/ci-tools 0.0.1-dev.80 → 0.0.1-dev.82

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.80",
+  "version": "0.0.1-dev.82",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -36,7 +36,8 @@
     "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
     "./github/publish-verify": "./src/github/publish-verify.mjs",
     "./github/credential-nudge": "./src/github/credential-nudge.mjs",
-    "./github/oidc-bootstrap-nudge": "./src/github/oidc-bootstrap-nudge.mjs"
+    "./github/oidc-bootstrap-nudge": "./src/github/oidc-bootstrap-nudge.mjs",
+    "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"
   },
   "scripts": {
     "test": "vitest run"

package/src/github/oidc-bootstrap-nudge.mjs

@@ -5,8 +5,9 @@ import { listPublishablePackages } from "./publish-verify.mjs";
 const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
 const API = "https://api.clickup.com/api/v2";
 const GITHUB_API = process.env.GITHUB_API_URL ?? "https://api.github.com";
-const CHORE_TYPE = 1004;
-const TASK_NAME = "chore(publish): OIDC bootstrap unpublished packages";
+const DEPLOYMENT_TYPE = 1005;
+const TASK_NAME = "deploy(publish): OIDC bootstrap unpublished packages";
+const LEGACY_TASK_NAMES = ["chore(publish): OIDC bootstrap unpublished packages"];
 const BOOTSTRAP_ENV = "npm-oidc-bootstrap";
 const DEFAULT_REPO = "typesmiths/decohere";
 
@@ -14,6 +15,10 @@ export function taskName() {
 	return TASK_NAME;
 }
 
+export function bootstrapTaskNames() {
+	return [TASK_NAME, ...LEGACY_TASK_NAMES];
+}
+
 /** @param {string | undefined} raw */
 export function parseUnpublished(raw) {
 	return String(raw ?? "")
@@ -31,15 +36,24 @@ export function parseAssigneeIds(raw) {
 }
 
 /**
- * @param {{ name: string, dir: string }[]} packages
+ * @param {string | undefined} version
  */
-export function firstPublishCommands(packages) {
+export function needsPrereleaseTag(version) {
+	return String(version ?? "").includes("-");
+}
+
+/**
+ * @param {{ name: string, dir: string, version?: string }[]} packages
+ * @param {string} [channel]
+ */
+export function firstPublishCommands(packages, channel = "dev") {
 	if (packages.length === 0) {
-		return [
-			"npm publish  # from the unpublished package directory (do not pass --access public)",
-		];
+		return [`npm publish ./<package-dir> --tag ${channel}`];
 	}
-	return packages.map((pkg) => `npm publish projects/${pkg.dir}  # ${pkg.name}`);
+	return packages.map((pkg) => {
+		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
+		return `npm publish ./projects/${pkg.dir}${tag}`;
+	});
 }
 
 /**
@@ -94,14 +108,16 @@ export function mapLoginsToClickUpIds(logins, members) {
 /**
  * @param {{
  *   unpublished: string[],
- *   packages: { name: string, dir: string }[],
+ *   packages: { name: string, dir: string, version?: string }[],
  *   repo?: string,
  *   runUrl?: string,
+ *   channel?: string,
  * }} options
  */
 export function buildDescription(options) {
 	const repo = options.repo || DEFAULT_REPO;
 	const names = options.unpublished;
+	const channel = options.channel || "dev";
 	const packages = options.packages.filter((pkg) => names.includes(pkg.name));
 	const [owner, repoName] = repo.split("/");
 	return [
@@ -113,10 +129,10 @@ export function buildDescription(options) {
 		"",
 		"## What to do",
 		"",
-		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then:",
+		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
 		"",
 		"```bash",
-		...firstPublishCommands(packages),
+		...firstPublishCommands(packages, channel),
 		"```",
 		"",
 		"2. npm → package settings → Trusted Publisher → GitHub Actions:",
@@ -162,7 +178,8 @@ async function clickup(method, path, body) {
 	return text.length === 0 ? undefined : JSON.parse(text);
 }
 
-async function findTaskByName(name) {
+async function findTaskByName(names) {
+	const wanted = new Set(Array.isArray(names) ? names : [names]);
 	for (let page = 0; page < 10; page += 1) {
 		const qs = new URLSearchParams({
 			include_closed: "true",
@@ -171,7 +188,7 @@ async function findTaskByName(name) {
 		});
 		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
 		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
-		const match = tasks.find((task) => task.name === name);
+		const match = tasks.find((task) => wanted.has(task.name));
 		if (match) {
 			return match;
 		}
@@ -248,16 +265,16 @@ export async function clickupWorkspaceMembers() {
 }
 
 /**
- * @param {{ unpublished: string[], packages: { name: string, dir: string }[], assigneeIds: number[], repo?: string, runUrl?: string }} options
+ * @param {{ unpublished: string[], packages: { name: string, dir: string, version?: string }[], assigneeIds: number[], repo?: string, runUrl?: string, channel?: string }} options
  */
 export async function upsertBootstrapTask(options) {
 	const name = taskName();
-	const existing = await findTaskByName(name);
+	const existing = await findTaskByName(bootstrapTaskNames());
 	const markdown = buildDescription(options);
 	const payload = {
 		name,
 		markdown_description: markdown,
-		custom_item_id: CHORE_TYPE,
+		custom_item_id: DEPLOYMENT_TYPE,
 		priority: 1,
 	};
 	if (options.assigneeIds.length > 0 && !existing) {
@@ -266,7 +283,9 @@ export async function upsertBootstrapTask(options) {
 
 	if (existing) {
 		const update = {
+			name,
 			markdown_description: markdown,
+			custom_item_id: DEPLOYMENT_TYPE,
 			priority: 1,
 		};
 		if (existing.closed || existing.status?.type === "closed") {
@@ -318,6 +337,7 @@ export async function runNudge(env = process.env, io = {}) {
 		assigneeIds,
 		repo: env.GITHUB_REPOSITORY || DEFAULT_REPO,
 		runUrl: io.runUrl ?? runUrl(),
+		channel: env.PUBLISH_CHANNEL || env.CHANNEL || "dev",
 	});
 	const url = result.url ?? "";
 	process.stdout.write(

package/src/github/smoke-create-launcher.mjs

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * Run `npx @decohere/create@version --help` from an empty temp directory.
+ * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
+ * `@decohere/create` into the workspace tree and npm's npx misses the bin.
+ *
+ * @param {{
+ *   createVersion: string,
+ *   authToken: string,
+ *   mkdtempSync?: typeof mkdtempSync,
+ *   writeFileSync?: typeof writeFileSync,
+ *   spawnSync?: typeof spawnSync,
+ *   tmpdir?: () => string,
+ *   stdio?: import("node:child_process").StdioOptions,
+ * }} options
+ */
+export function runCreateLauncherSmoke(options) {
+	const version = options.createVersion?.trim() ?? "";
+	const token = options.authToken?.trim() ?? "";
+	if (!version) {
+		throw new Error("CREATE_VERSION is required");
+	}
+	if (!token) {
+		throw new Error("NODE_AUTH_TOKEN is required");
+	}
+
+	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
+	const writeFile = options.writeFileSync ?? writeFileSync;
+	const spawn = options.spawnSync ?? spawnSync;
+	const tmp = options.tmpdir ?? tmpdir;
+
+	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
+	const npmrc = join(workDir, ".npmrc");
+	writeFile(
+		npmrc,
+		`@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`,
+	);
+
+	const result = spawn("npx", ["--yes", `@decohere/create@${version}`, "--help"], {
+		cwd: workDir,
+		env: {
+			...process.env,
+			NPM_CONFIG_USERCONFIG: npmrc,
+			NODE_AUTH_TOKEN: token,
+		},
+		stdio: options.stdio ?? "inherit",
+	});
+
+	return {
+		workDir,
+		status: result.status ?? 1,
+	};
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	const { status } = runCreateLauncherSmoke({
+		createVersion: process.env.CREATE_VERSION ?? "",
+		authToken: process.env.NODE_AUTH_TOKEN ?? "",
+	});
+	process.exit(status);
+}

package/src/release/sync-dependencies.mjs

@@ -7,10 +7,9 @@
 import { execSync } from "node:child_process";
 
 const DRY_RUN = process.env.DRY_RUN === "true";
-const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/cli/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `node "${TERMINAL_CLI}" --log-level info --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
+const baseCmd = `pnpm exec flux run projects/cli/src/forge.ts -- --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/tests/github/oidc-bootstrap-nudge.test.mjs

@@ -1,9 +1,11 @@
 import { describe, expect, it } from "vitest";
 import {
+	bootstrapTaskNames,
 	buildDescription,
 	extractGitHubReviewerLogins,
 	firstPublishCommands,
 	mapLoginsToClickUpIds,
+	needsPrereleaseTag,
 	parseAssigneeIds,
 	parseUnpublished,
 	runNudge,
@@ -18,7 +20,10 @@ describe("oidc-bootstrap-nudge", () => {
 		]);
 		expect(parseAssigneeIds("308432336, 99")).toEqual([308432336, 99]);
 		expect(parseAssigneeIds("")).toEqual([]);
-		expect(taskName()).toBe("chore(publish): OIDC bootstrap unpublished packages");
+		expect(taskName()).toBe("deploy(publish): OIDC bootstrap unpublished packages");
+		expect(bootstrapTaskNames()).toContain(
+			"chore(publish): OIDC bootstrap unpublished packages",
+		);
 	});
 
 	it("extracts GitHub user reviewers and maps login to ClickUp email local-part", () => {
@@ -48,20 +53,26 @@ describe("oidc-bootstrap-nudge", () => {
 	});
 
 	it("puts first-publish commands and Trusted Publisher fields in the task body", () => {
+		const pkg = { name: "@decohere/scaffold", dir: "scaffold", version: "0.0.1-dev.18" };
 		const body = buildDescription({
 			unpublished: ["@decohere/scaffold"],
-			packages: [{ name: "@decohere/scaffold", dir: "scaffold" }],
+			packages: [pkg],
 			repo: "typesmiths/decohere",
 			runUrl: "https://github.com/typesmiths/decohere/actions/runs/9",
+			channel: "dev",
 		});
-		expect(firstPublishCommands([{ name: "@decohere/scaffold", dir: "scaffold" }])).toEqual([
-			"npm publish projects/scaffold  # @decohere/scaffold",
+		expect(needsPrereleaseTag("0.0.1-dev.18")).toBe(true);
+		expect(needsPrereleaseTag("1.2.3")).toBe(false);
+		expect(firstPublishCommands([pkg], "dev")).toEqual([
+			"npm publish ./projects/scaffold --tag dev",
+		]);
+		expect(firstPublishCommands([{ ...pkg, version: "1.0.0" }], "dev")).toEqual([
+			"npm publish ./projects/scaffold",
 		]);
-		expect(body).toContain("npm publish projects/scaffold");
+		expect(body).toContain("npm publish ./projects/scaffold --tag dev");
+		expect(body).not.toMatch(/# @decohere\/scaffold/);
 		expect(body).toContain("do **not** pass `--access public`");
-		expect(
-			firstPublishCommands([{ name: "@decohere/scaffold", dir: "scaffold" }]).join("\n"),
-		).not.toContain("--access public");
+		expect(firstPublishCommands([pkg], "dev").join("\n")).not.toContain("--access public");
 		expect(body).toContain("Workflow filename: `publish.yml`");
 		expect(body).toContain("Environment: `npm-publish`");
 		expect(body).toContain("gh run rerun --failed");

package/tests/github/smoke-create-launcher.test.mjs

@@ -0,0 +1,71 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+import { runCreateLauncherSmoke } from "../../src/github/smoke-create-launcher.mjs";
+
+const fs = await vi.importActual("node:fs");
+const PUBLISH_YML = fileURLToPath(
+	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
+);
+
+describe("runCreateLauncherSmoke", () => {
+	it("execs npx from a temp directory, not the repo root", () => {
+		/** @type {{ cmd: string, args: string[], opts: { cwd?: string } }[]} */
+		const calls = [];
+		const written = [];
+
+		const result = runCreateLauncherSmoke({
+			createVersion: "0.0.1-dev.80",
+			authToken: "tok",
+			tmpdir: () => "/tmp",
+			mkdtempSync: (prefix) => `${prefix}abc`,
+			writeFileSync: (path, body) => {
+				written.push({ path, body });
+			},
+			spawnSync: (cmd, args, opts) => {
+				calls.push({ cmd, args, opts });
+				return { status: 0 };
+			},
+			stdio: "pipe",
+		});
+
+		expect(result.workDir).toBe("/tmp/decohere-create-smoke-abc");
+		expect(result.workDir).not.toBe(process.cwd());
+		expect(calls).toHaveLength(1);
+		expect(calls[0].cmd).toBe("npx");
+		expect(calls[0].args).toEqual(["--yes", "@decohere/create@0.0.1-dev.80", "--help"]);
+		expect(calls[0].opts.cwd).toBe("/tmp/decohere-create-smoke-abc");
+		expect(calls[0].opts.cwd).not.toBe(process.cwd());
+		expect(written).toEqual([
+			{
+				path: "/tmp/decohere-create-smoke-abc/.npmrc",
+				body: "@decohere:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=tok\n",
+			},
+		]);
+	});
+
+	it("fails closed without version or token", () => {
+		expect(() => runCreateLauncherSmoke({ createVersion: "", authToken: "tok" })).toThrow(
+			"CREATE_VERSION is required",
+		);
+		expect(() =>
+			runCreateLauncherSmoke({ createVersion: "0.0.1-dev.80", authToken: "" }),
+		).toThrow("NODE_AUTH_TOKEN is required");
+	});
+});
+
+describe("publish.yml create smoke + tag", () => {
+	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
+
+	it("wires create smoke through the isolated launcher", () => {
+		expect(yml).toContain("node projects/ci-tools/src/github/smoke-create-launcher.mjs");
+		expect(yml).toContain("CREATE_VERSION:");
+		expect(yml).not.toContain("npx --yes");
+	});
+
+	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
+		expect(perms).toMatch(/contents:\s*write/);
+		expect(perms).toMatch(/actions:\s*read/);
+	});
+});