@decohere/ci-tools 0.0.1-dev.9 → 0.0.1-dev.91

package/src/github/credential-nudge.mjs

@@ -0,0 +1,320 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
+const API = "https://api.clickup.com/api/v2";
+const WARN_DAYS = 14;
+const MS_PER_DAY = 86_400_000;
+const CHORE_TYPE = 1004;
+const DEFAULT_REPO = "typesmiths/decohere";
+
+/**
+ * One profile per credential. Date math, ClickUp upsert, and fail-closed live below.
+ * `ghEnv` unset means repo secret / repo variable (not an Actions environment).
+ *
+ * @typedef {{
+ *   id: string,
+ *   secret: string,
+ *   expiresVar: string,
+ *   ghEnv?: string,
+ *   mint: string,
+ *   failImpact: string,
+ *   rejectedWhy: string,
+ *   revokeUrl: string,
+ * }} CredentialProfile
+ */
+
+/** @type {Record<string, CredentialProfile>} */
+export const CREDENTIALS = {
+	ghcr: {
+		id: "ghcr",
+		secret: "GHCR_PUSH_TOKEN",
+		expiresVar: "GHCR_TOKEN_EXPIRES_AT",
+		ghEnv: "ghcr-publish",
+		mint: "Create a **classic** GitHub PAT (fine-grained tokens cannot push to GHCR): https://github.com/settings/tokens/new?scopes=write:packages",
+		failImpact:
+			"npm may already have published. Docker login/push and the `v*` tag will **fail**. The SHA stays untagged, so the next successful Publish of that tip can finish Docker + tag after you rotate. Images are not pushed with `GITHUB_TOKEN`.",
+		rejectedWhy: "GHCR `docker login` returned 401 (expired, revoked, or wrong secret name).",
+		revokeUrl: "https://github.com/settings/tokens",
+	},
+	npm: {
+		id: "npm",
+		secret: "NODE_AUTH_TOKEN",
+		expiresVar: "NODE_AUTH_TOKEN_EXPIRES_AT",
+		mint: "Create an npm **read** token (granular/classic) at https://www.npmjs.com/settings/~/tokens — Publish PUTs are OIDC; this token is only for private `npm view` and create smoke.",
+		failImpact:
+			"Verify cannot see private packages, so skipIfPublished and create smoke are unsafe. Publish **fails closed** before OIDC/Docker. After you rotate, re-run the failed Publish jobs.",
+		rejectedWhy: "`npm whoami` failed (expired, revoked, or missing `NODE_AUTH_TOKEN`).",
+		revokeUrl: "https://www.npmjs.com/settings/~/tokens",
+	},
+};
+
+export function utcDayMs(date) {
+	return Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate());
+}
+
+/** @param {string | undefined} raw */
+export function parseExpiresAt(raw) {
+	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(raw ?? "").trim());
+	if (!match) {
+		return null;
+	}
+	return Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
+}
+
+/**
+ * @param {{ now?: number, expiresAtMs: number | null, warnDays?: number }} options
+ * @returns {{ kind: "missing" | "ok" | "warn" | "expired", daysLeft: number | null }}
+ */
+export function assessTokenLifetime(options) {
+	const { expiresAtMs, warnDays = WARN_DAYS } = options;
+	if (expiresAtMs == null) {
+		return { kind: "missing", daysLeft: null };
+	}
+	const today = utcDayMs(new Date(options.now ?? Date.now()));
+	const daysLeft = Math.round((expiresAtMs - today) / MS_PER_DAY);
+	if (daysLeft <= 0) {
+		return { kind: "expired", daysLeft };
+	}
+	if (daysLeft <= warnDays) {
+		return { kind: "warn", daysLeft };
+	}
+	return { kind: "ok", daysLeft };
+}
+
+/** @param {CredentialProfile} credential */
+export function resolveRepo() {
+	return process.env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
+}
+
+/** @param {CredentialProfile} credential */
+export function ghScopeFlags(credential) {
+	return credential.ghEnv ? `--env ${credential.ghEnv} ` : "";
+}
+
+/** @param {string} id */
+export function credentialProfile(id) {
+	const credential = CREDENTIALS[id];
+	if (!credential) {
+		throw new Error(
+			`Unknown NUDGE_CREDENTIAL=${id}. Expected one of: ${Object.keys(CREDENTIALS).join(", ")}`,
+		);
+	}
+	return credential;
+}
+
+/** @param {CredentialProfile} credential */
+export function taskName(credential, expiresYmd) {
+	return `chore(security): rotate ${credential.secret} (expires ${expiresYmd})`;
+}
+
+/** @param {CredentialProfile} credential */
+export function rotationCommands(credential, nextExpiresYmd, repo = resolveRepo()) {
+	const next = nextExpiresYmd ?? "YYYY-MM-DD";
+	const flags = ghScopeFlags(credential);
+	return [
+		credential.mint,
+		"",
+		"Then from a trusted machine (do not paste the token into Actions or this task):",
+		"",
+		"```bash",
+		`gh secret set ${credential.secret} ${flags}--repo ${repo}`,
+		`gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body ${next}`,
+		"```",
+		"",
+		`Revoke the old token: ${credential.revokeUrl}`,
+		"Mark this task complete, then retry Publish:",
+		"",
+		"```bash",
+		`gh run list --repo ${repo} --workflow Publish --limit 5`,
+		`gh run rerun --failed <run-id> --repo ${repo}`,
+		"```",
+	].join("\n");
+}
+
+export function suggestedNextExpiry(fromMs, days = 90) {
+	const start = utcDayMs(new Date(fromMs));
+	const next = new Date(start + days * MS_PER_DAY);
+	const y = next.getUTCFullYear();
+	const m = String(next.getUTCMonth() + 1).padStart(2, "0");
+	const d = String(next.getUTCDate()).padStart(2, "0");
+	return `${y}-${m}-${d}`;
+}
+
+/** @param {CredentialProfile} credential */
+export function buildDescription(credential, options) {
+	const { kind, expiresYmd, daysLeft, rejected, runUrl } = options;
+	const next = suggestedNextExpiry(Date.now());
+	const why = rejected
+		? credential.rejectedWhy
+		: kind === "expired"
+			? `${credential.expiresVar} (${expiresYmd}) is today or in the past. Rotate ${credential.secret} and this date before Publish can continue.`
+			: `${credential.secret} expires on ${expiresYmd} (${daysLeft} day(s) left). Rotate before that date so Publish does not fail closed.`;
+	return [
+		"## Summary",
+		"",
+		why,
+		"",
+		"## If this is not done in time",
+		"",
+		credential.failImpact,
+		"",
+		"## Commands",
+		"",
+		rotationCommands(credential, next),
+		"",
+		runUrl ? `- Workflow run: ${runUrl}` : null,
+	]
+		.filter((line) => line != null)
+		.join("\n");
+}
+
+async function clickup(method, path, body) {
+	const key = process.env.CLICKUP_API_KEY;
+	if (key == null || key.length === 0) {
+		throw new Error("Missing CLICKUP_API_KEY");
+	}
+	const response = await fetch(`${API}${path}`, {
+		method,
+		headers: {
+			Authorization: key,
+			"Content-Type": "application/json",
+		},
+		body: body == null ? undefined : JSON.stringify(body),
+	});
+	const text = await response.text();
+	if (!response.ok) {
+		throw new Error(
+			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
+		);
+	}
+	return text.length === 0 ? undefined : JSON.parse(text);
+}
+
+async function findTaskByName(name) {
+	for (let page = 0; page < 10; page += 1) {
+		const qs = new URLSearchParams({
+			include_closed: "true",
+			subtasks: "false",
+			page: String(page),
+		});
+		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
+		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
+		const match = tasks.find((task) => task.name === name);
+		if (match) {
+			return match;
+		}
+		if (tasks.length < 100) {
+			break;
+		}
+	}
+	return null;
+}
+
+async function firstOpenStatus() {
+	const list = await clickup("GET", `/list/${LIST_ID}`);
+	return (list.statuses ?? []).find((status) => status.type === "open")?.status;
+}
+
+function runUrl() {
+	if (
+		process.env.GITHUB_SERVER_URL &&
+		process.env.GITHUB_REPOSITORY &&
+		process.env.GITHUB_RUN_ID
+	) {
+		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+	}
+	return "";
+}
+
+/** @param {CredentialProfile} credential */
+export async function upsertRotationTask(credential, options) {
+	const { expiresYmd, kind, daysLeft, rejected } = options;
+	const name = taskName(credential, expiresYmd ?? "unknown");
+	const existing = await findTaskByName(name);
+	const dueMs = parseExpiresAt(expiresYmd);
+	const payload = {
+		name,
+		markdown_description: buildDescription(credential, {
+			kind,
+			expiresYmd,
+			daysLeft,
+			rejected,
+			runUrl: runUrl(),
+		}),
+		custom_item_id: CHORE_TYPE,
+		priority: rejected || kind === "expired" ? 1 : 2,
+		due_date: dueMs == null ? undefined : dueMs,
+		due_date_time: false,
+	};
+	const assignee = process.env.CLICKUP_ASSIGNEE_ID?.trim();
+	if (assignee) {
+		payload.assignees = [Number(assignee)];
+	}
+
+	if (existing) {
+		const update = {
+			markdown_description: payload.markdown_description,
+			priority: payload.priority,
+			due_date: payload.due_date,
+			due_date_time: false,
+		};
+		if (existing.closed || existing.status?.type === "closed") {
+			const status = await firstOpenStatus();
+			if (status) {
+				update.status = status;
+			}
+		}
+		await clickup("PUT", `/task/${existing.id}`, update);
+		return { id: existing.id, url: existing.url, created: false };
+	}
+	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
+	return { id: created.id, url: created.url, created: true };
+}
+
+export async function runNudge(env = process.env) {
+	const credential = credentialProfile(String(env.NUDGE_CREDENTIAL ?? "").trim());
+	const rejected = env.NUDGE_REJECTED === "1";
+	const expiresYmd = String(env[credential.expiresVar] ?? "").trim();
+	const expiresAtMs = parseExpiresAt(expiresYmd);
+	const assessment = assessTokenLifetime({ expiresAtMs });
+	const flags = ghScopeFlags(credential);
+	const repo = env.GITHUB_REPOSITORY?.trim() || DEFAULT_REPO;
+
+	if (assessment.kind === "missing" && !rejected) {
+		process.stderr.write(
+			`${credential.ghEnv ? `${credential.ghEnv} environment` : "repository"} variable ${credential.expiresVar}=YYYY-MM-DD is required\n` +
+				`  gh variable set ${credential.expiresVar} ${flags}--repo ${repo} --body YYYY-MM-DD\n`,
+		);
+		return 1;
+	}
+
+	if (rejected || assessment.kind === "warn" || assessment.kind === "expired") {
+		const result = await upsertRotationTask(credential, {
+			expiresYmd: expiresYmd || "unknown",
+			kind: assessment.kind,
+			daysLeft: assessment.daysLeft,
+			rejected,
+		});
+		process.stdout.write(
+			`${result.created ? "Created" : "Updated"} ClickUp ${result.id} ${result.url ?? ""}\n`,
+		);
+	}
+
+	if (rejected || assessment.kind === "expired" || assessment.kind === "missing") {
+		if (assessment.kind === "expired") {
+			process.stderr.write(
+				`${credential.secret} calendar expiry ${expiresYmd} has been reached — refusing to continue\n`,
+			);
+		}
+		return 1;
+	}
+	return 0;
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	process.exit(await runNudge());
+}

package/src/github/oidc-bootstrap-nudge.mjs

@@ -0,0 +1,368 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { listPublishablePackages } from "./publish-verify.mjs";
+
+const LIST_ID = process.env.CLICKUP_LIST_ID ?? "901220171084";
+const API = "https://api.clickup.com/api/v2";
+const GITHUB_API = process.env.GITHUB_API_URL ?? "https://api.github.com";
+const DEPLOYMENT_TYPE = 1005;
+const TASK_NAME = "deploy(publish): OIDC bootstrap unpublished packages";
+const LEGACY_TASK_NAMES = ["chore(publish): OIDC bootstrap unpublished packages"];
+const BOOTSTRAP_ENV = "npm-oidc-bootstrap";
+const DEFAULT_REPO = "typesmiths/decohere";
+
+export function taskName() {
+	return TASK_NAME;
+}
+
+export function bootstrapTaskNames() {
+	return [TASK_NAME, ...LEGACY_TASK_NAMES];
+}
+
+/** @param {string | undefined} raw */
+export function parseUnpublished(raw) {
+	return String(raw ?? "")
+		.split(/\s+/)
+		.map((name) => name.trim())
+		.filter(Boolean);
+}
+
+/** @param {string | undefined} raw */
+export function parseAssigneeIds(raw) {
+	return String(raw ?? "")
+		.split(/[,\s]+/)
+		.map((id) => Number(id.trim()))
+		.filter((id) => Number.isInteger(id) && id > 0);
+}
+
+/**
+ * @param {string | undefined} version
+ */
+export function needsPrereleaseTag(version) {
+	return String(version ?? "").includes("-");
+}
+
+/**
+ * @param {{ name: string, dir: string, version?: string }[]} packages
+ * @param {string} [channel]
+ */
+export function firstPublishCommands(packages, channel = "dev") {
+	if (packages.length === 0) {
+		return [`npm publish ./<package-dir> --tag ${channel}`];
+	}
+	return packages.map((pkg) => {
+		const tag = needsPrereleaseTag(pkg.version) ? ` --tag ${channel}` : "";
+		return `npm publish ./projects/${pkg.dir}${tag}`;
+	});
+}
+
+/**
+ * @param {unknown} environment
+ * @returns {string[]}
+ */
+export function extractGitHubReviewerLogins(environment) {
+	const rules =
+		environment && typeof environment === "object" ? environment.protection_rules : null;
+	if (!Array.isArray(rules)) {
+		return [];
+	}
+	const logins = [];
+	for (const rule of rules) {
+		const reviewers = rule?.reviewers;
+		if (!Array.isArray(reviewers)) {
+			continue;
+		}
+		for (const entry of reviewers) {
+			const login = entry?.reviewer?.login;
+			if (typeof login === "string" && login.length > 0 && entry?.type !== "Team") {
+				logins.push(login);
+			}
+		}
+	}
+	return [...new Set(logins)];
+}
+
+/**
+ * @param {string[]} logins
+ * @param {{ id?: number, username?: string, email?: string }[]} members
+ */
+export function mapLoginsToClickUpIds(logins, members) {
+	const ids = new Set();
+	for (const login of logins) {
+		const key = login.toLowerCase();
+		for (const member of members) {
+			const username = String(member.username ?? "").toLowerCase();
+			const email = String(member.email ?? "").toLowerCase();
+			const local = email.split("@")[0] ?? "";
+			if (username === key || local === key || email === key) {
+				const id = Number(member.id);
+				if (Number.isInteger(id) && id > 0) {
+					ids.add(id);
+				}
+			}
+		}
+	}
+	return [...ids];
+}
+
+/**
+ * @param {{
+ *   unpublished: string[],
+ *   packages: { name: string, dir: string, version?: string }[],
+ *   repo?: string,
+ *   runUrl?: string,
+ *   channel?: string,
+ * }} options
+ */
+export function buildDescription(options) {
+	const repo = options.repo || DEFAULT_REPO;
+	const names = options.unpublished;
+	const channel = options.channel || "dev";
+	const packages = options.packages.filter((pkg) => names.includes(pkg.name));
+	const [owner, repoName] = repo.split("/");
+	return [
+		"## Summary",
+		"",
+		"These package names are not on npm yet, so OIDC `npm publish` cannot run until each name exists and has a Trusted Publisher:",
+		"",
+		...names.map((name) => `- \`${name}\``),
+		"",
+		"## What to do",
+		"",
+		"1. First-publish each name **restricted** (scoped default — do **not** pass `--access public`). From a trusted machine, `npm login` to the org, then from the **repo root**. Use `./` so npm does not treat the path as a GitHub `owner/repo`. `--tag` is required for prerelease versions (`x.y.z-dev.N`). Missing `bin`/`es6` warnings are OK for this name-only bootstrap; CI `forge publish` ships the built tarball later:",
+		"",
+		"```bash",
+		...firstPublishCommands(packages, channel),
+		"```",
+		"",
+		"2. npm → package settings → Trusted Publisher → GitHub Actions:",
+		"",
+		`- Organization: \`${owner ?? "typesmiths"}\``,
+		`- Repository: \`${repoName ?? "decohere"}\``,
+		"- Workflow filename: `publish.yml`",
+		"- Environment: `npm-publish`",
+		"- Allowed action: `npm publish` (not staged-only)",
+		"",
+		"3. Approve the waiting **npm-oidc-bootstrap** deployment on this Publish run. The job re-checks that the names exist, then npm + Docker + tag continue. If reviewers were not configured and the job already failed:",
+		"",
+		"```bash",
+		`gh run list --repo ${repo} --workflow Publish --limit 5`,
+		`gh run rerun --failed <run-id> --repo ${repo}`,
+		"```",
+		"",
+		options.runUrl ? `- Workflow run: ${options.runUrl}` : null,
+	]
+		.filter((line) => line != null)
+		.join("\n");
+}
+
+async function clickup(method, path, body) {
+	const key = process.env.CLICKUP_API_KEY;
+	if (key == null || key.length === 0) {
+		throw new Error("Missing CLICKUP_API_KEY");
+	}
+	const response = await fetch(`${API}${path}`, {
+		method,
+		headers: {
+			Authorization: key,
+			"Content-Type": "application/json",
+		},
+		body: body == null ? undefined : JSON.stringify(body),
+	});
+	const text = await response.text();
+	if (!response.ok) {
+		throw new Error(
+			`ClickUp ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`,
+		);
+	}
+	return text.length === 0 ? undefined : JSON.parse(text);
+}
+
+async function findTaskByName(names) {
+	const wanted = new Set(Array.isArray(names) ? names : [names]);
+	for (let page = 0; page < 10; page += 1) {
+		const qs = new URLSearchParams({
+			include_closed: "true",
+			subtasks: "false",
+			page: String(page),
+		});
+		const data = await clickup("GET", `/list/${LIST_ID}/task?${qs}`);
+		const tasks = Array.isArray(data) ? data : (data?.tasks ?? []);
+		const match = tasks.find((task) => wanted.has(task.name));
+		if (match) {
+			return match;
+		}
+		if (tasks.length < 100) {
+			break;
+		}
+	}
+	return null;
+}
+
+async function firstOpenStatus() {
+	const list = await clickup("GET", `/list/${LIST_ID}`);
+	return (list.statuses ?? []).find((status) => status.type === "open")?.status;
+}
+
+function runUrl() {
+	if (
+		process.env.GITHUB_SERVER_URL &&
+		process.env.GITHUB_REPOSITORY &&
+		process.env.GITHUB_RUN_ID
+	) {
+		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+	}
+	return "";
+}
+
+/**
+ * @param {{ fetch?: typeof fetch, token?: string, repo?: string, environment?: string }} options
+ */
+export async function githubEnvironmentReviewerLogins(options = {}) {
+	const token = options.token ?? process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+	const repo = options.repo ?? process.env.GITHUB_REPOSITORY ?? "";
+	const environment = options.environment ?? BOOTSTRAP_ENV;
+	const fetchFn = options.fetch ?? fetch;
+	if (!token || !repo) {
+		return [];
+	}
+	const response = await fetchFn(
+		`${GITHUB_API}/repos/${repo}/environments/${encodeURIComponent(environment)}`,
+		{
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/vnd.github+json",
+				"X-GitHub-Api-Version": "2022-11-28",
+			},
+		},
+	);
+	if (!response.ok) {
+		process.stderr.write(
+			`Could not list ${environment} reviewers (${response.status}); assigning from CLICKUP_ASSIGNEE_ID only\n`,
+		);
+		return [];
+	}
+	return extractGitHubReviewerLogins(await response.json());
+}
+
+export async function clickupWorkspaceMembers() {
+	const data = await clickup("GET", "/team");
+	const teams = Array.isArray(data?.teams) ? data.teams : [];
+	const members = [];
+	for (const team of teams) {
+		for (const entry of team.members ?? []) {
+			const user = entry?.user ?? entry;
+			if (user?.id) {
+				members.push({
+					id: Number(user.id),
+					username: user.username,
+					email: user.email,
+				});
+			}
+		}
+	}
+	return members;
+}
+
+/**
+ * @param {{ unpublished: string[], packages: { name: string, dir: string, version?: string }[], assigneeIds: number[], repo?: string, runUrl?: string, channel?: string }} options
+ */
+export async function upsertBootstrapTask(options) {
+	const name = taskName();
+	const existing = await findTaskByName(bootstrapTaskNames());
+	const markdown = buildDescription(options);
+	const payload = {
+		name,
+		markdown_description: markdown,
+		custom_item_id: DEPLOYMENT_TYPE,
+		priority: 1,
+	};
+	if (options.assigneeIds.length > 0 && !existing) {
+		payload.assignees = options.assigneeIds;
+	}
+
+	if (existing) {
+		const update = {
+			name,
+			markdown_description: markdown,
+			custom_item_id: DEPLOYMENT_TYPE,
+			priority: 1,
+		};
+		if (existing.closed || existing.status?.type === "closed") {
+			const status = await firstOpenStatus();
+			if (status) {
+				update.status = status;
+			}
+		}
+		if (options.assigneeIds.length > 0) {
+			update.assignees = { add: options.assigneeIds };
+		}
+		await clickup("PUT", `/task/${existing.id}`, update);
+		return { id: existing.id, url: existing.url, created: false };
+	}
+	const created = await clickup("POST", `/list/${LIST_ID}/task`, payload);
+	return { id: created.id, url: created.url, created: true };
+}
+
+export async function runNudge(env = process.env, io = {}) {
+	const unpublished = parseUnpublished(env.UNPUBLISHED);
+	if (unpublished.length === 0) {
+		process.stdout.write("No unpublished package names; skipping ClickUp bootstrap task\n");
+		return 0;
+	}
+
+	const root = io.root ?? process.cwd();
+	const packages = (io.listPackages ?? listPublishablePackages)(root);
+	const logins = await (io.githubReviewers ?? githubEnvironmentReviewerLogins)({
+		token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
+		repo: env.GITHUB_REPOSITORY,
+	});
+	const members = await (io.clickupMembers ?? clickupWorkspaceMembers)();
+	const assigneeIds = [
+		...new Set([
+			...mapLoginsToClickUpIds(logins, members),
+			...parseAssigneeIds(env.CLICKUP_ASSIGNEE_ID),
+		]),
+	];
+
+	if (logins.length > 0 && mapLoginsToClickUpIds(logins, members).length === 0) {
+		process.stderr.write(
+			`GitHub ${BOOTSTRAP_ENV} reviewers (${logins.join(", ")}) did not match a ClickUp member (login ↔ username or email local-part)\n`,
+		);
+	}
+
+	const result = await (io.upsert ?? upsertBootstrapTask)({
+		unpublished,
+		packages,
+		assigneeIds,
+		repo: env.GITHUB_REPOSITORY || DEFAULT_REPO,
+		runUrl: io.runUrl ?? runUrl(),
+		channel: env.PUBLISH_CHANNEL || env.CHANNEL || "dev",
+	});
+	const url = result.url ?? "";
+	process.stdout.write(
+		`${result.created ? "Created" : "Updated"} ClickUp ${result.id} ${url}\n`,
+	);
+	if (assigneeIds.length > 0) {
+		process.stdout.write(`Assigned ClickUp users ${assigneeIds.join(", ")}\n`);
+	} else {
+		process.stdout.write(
+			"No ClickUp assignees (add required reviewers on npm-oidc-bootstrap, or set vars.CLICKUP_ASSIGNEE_ID)\n",
+		);
+	}
+	if (env.GITHUB_OUTPUT) {
+		const { appendFileSync } = await import("node:fs");
+		appendFileSync(env.GITHUB_OUTPUT, `task_url=${url}\n`);
+	}
+	if (!url) {
+		throw new Error("ClickUp bootstrap task has no URL");
+	}
+	return 0;
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	process.exit(await runNudge());
+}