@designcrowd/fe-shared-lib 1.8.4-edge-fallback-1 → 1.8.4-edge-fallback-2

package/CLAUDE.md

@@ -123,7 +123,15 @@ npm link @designcrowd/fe-shared-lib                # in consumer project
 
 ## Publishing (UAT)
 
-To test experimental versions without publishing to production:
-1. Update `package.json` version to `[current]-[description]`
-2. Run `docker build . --build-arg NPM_TOKEN=$NPM_TOKEN`
-3. Update consumer package reference to the new version
+Use `scripts/publish-uat.sh <suffix>` to publish a UAT build for testing in a consumer (e.g. BrandCrowd.Net). The script handles the version bump, bundle-translation, secret scanning of the tarball, and the commit. Examples:
+
+```bash
+./scripts/publish-uat.sh edge-fallback-0
+./scripts/publish-uat.sh edge-fallback-1   # next iteration
+```
+
+It refuses to run on `master`/`main`, refuses if the version is already published, aborts on dangerous filenames or token-shaped strings inside the tarball, and only commits the bump after the registry confirms upload.
+
+The npm publish token is read from `~/.config/designcrowd/npm-publish-token` (mode 600). Override with `NPM_PUBLISH_TOKEN_FILE` if it lives elsewhere. The token file is **not** stored anywhere in the repo.
+
+The legacy `docker build . --build-arg NPM_TOKEN=...` flow still works but is brittle — prefer the script.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@designcrowd/fe-shared-lib",
-  "version": "1.8.4-edge-fallback-1",
+  "version": "1.8.4-edge-fallback-2",
   "scripts": {
     "start": "run-p storybook watch:translation",
     "build": "npm run build:css --production",

package/scripts/publish-uat.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+#
+# publish-uat.sh — publish a UAT-suffixed version of @designcrowd/fe-shared-lib
+#
+# Usage:   ./scripts/publish-uat.sh <suffix>
+# Example: ./scripts/publish-uat.sh edge-fallback-2
+#
+# Reads the npm publish token from $NPM_PUBLISH_TOKEN_FILE
+# (default ~/.config/designcrowd/npm-publish-token, mode 600).
+# The token is never written into the repo.
+#
+# Workflow:
+#   1. Validate branch (refuse master) and suffix.
+#   2. Compute new version = <base>-<suffix>, refuse if already published.
+#   3. Bump package.json, run bundle-translation.
+#   4. npm pack — produces a tarball.
+#   5. Secret scan: dangerous filenames + token-shaped strings + the
+#      literal token bytes from the token file (if it leaked into the
+#      tree somehow, this catches it).
+#   6. npm publish <tarball> via a temp .npmrc in /tmp (mode 600,
+#      removed on exit).
+#   7. git add + commit the version bump.
+#
+# Anything in steps 4-6 that fails leaves the working tree dirty so you
+# can investigate. The commit only lands after the registry confirms
+# the upload.
+
+set -euo pipefail
+
+PKG="@designcrowd/fe-shared-lib"
+TOKEN_FILE="${NPM_PUBLISH_TOKEN_FILE:-$HOME/.config/designcrowd/npm-publish-token}"
+
+abort() { echo "ABORT: $*" >&2; exit 1; }
+
+# --- args ---
+SUFFIX="${1:-}"
+[[ -z "$SUFFIX" ]] && abort "usage: $0 <suffix>  e.g. $0 edge-fallback-2"
+[[ "$SUFFIX" =~ ^[A-Za-z0-9._-]+$ ]] || abort "suffix must be [A-Za-z0-9._-]+"
+
+# --- repo state ---
+cd "$(git rev-parse --show-toplevel)"
+BRANCH=$(git symbolic-ref --short HEAD)
+[[ "$BRANCH" == "master" || "$BRANCH" == "main" ]] && abort "refusing to publish from $BRANCH"
+
+# --- token ---
+[[ -f "$TOKEN_FILE" ]] || abort "no token at $TOKEN_FILE (set NPM_PUBLISH_TOKEN_FILE to override)"
+TOKEN=$(tr -d '[:space:]' < "$TOKEN_FILE")
+[[ -n "$TOKEN" ]] || abort "token file is empty: $TOKEN_FILE"
+
+# --- compute version ---
+BASE=$(node -p "require('./package.json').version.replace(/-.*/, '')")
+NEW="$BASE-$SUFFIX"
+
+if npm view "$PKG@$NEW" version >/dev/null 2>&1; then
+  abort "$PKG@$NEW already published — pick a new suffix"
+fi
+
+echo "==> publishing $PKG@$NEW from branch $BRANCH"
+
+# --- bump + bundle ---
+node -e "const fs=require('fs');const p=require('./package.json');p.version='$NEW';fs.writeFileSync('./package.json', JSON.stringify(p, null, 2)+'\n');"
+echo "==> running bundle-translation"
+npm run --silent bundle-translation >/dev/null
+
+# --- pack ---
+echo "==> packing"
+TARBALL=$(npm pack --silent)
+[[ -f "$TARBALL" ]] || abort "npm pack did not produce a tarball"
+
+# Always clean up temp artifacts on exit
+SCAN_DIR=$(mktemp -d)
+TMP_NPMRC=$(mktemp /tmp/fe-shared-lib-publish.XXXXXX.npmrc)
+chmod 600 "$TMP_NPMRC"
+cleanup() { rm -rf "$SCAN_DIR"; rm -f "$TMP_NPMRC" "$TARBALL"; }
+trap cleanup EXIT
+
+# --- secret scan: filenames ---
+echo "==> scanning $TARBALL"
+DANGEROUS_PATHS='(^|/)(\.env(\..+)?|\.npmrc|\.npm-publish-token|id_rsa.*|id_ed25519.*|.*\.pem|.*\.key|.*token.*|.*secret.*|.*credential.*)$|(^|/)\.(aws|ssh|gnupg)/'
+if BAD=$(tar tzf "$TARBALL" | grep -E -i "$DANGEROUS_PATHS" || true); [[ -n "$BAD" ]]; then
+  echo "$BAD" >&2
+  abort "dangerous filenames in tarball"
+fi
+
+# --- secret scan: contents ---
+tar xzf "$TARBALL" -C "$SCAN_DIR"
+
+# Token-shaped patterns. Tightened so the literal '${NPM_TOKEN}' template
+# in the tracked npmrc file doesn't trip the check.
+SECRET_PATTERNS='(npm_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk_live_[A-Za-z0-9]{20,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)'
+if HITS=$(grep -REn -I -E "$SECRET_PATTERNS" "$SCAN_DIR" 2>/dev/null || true); [[ -n "$HITS" ]]; then
+  echo "$HITS" >&2
+  abort "secret-shaped string in tarball"
+fi
+
+# Belt-and-braces: the token's own bytes. If our publish token ever
+# lands in a tracked file by accident, this catches it regardless of
+# pattern-matching.
+if grep -RFq "$TOKEN" "$SCAN_DIR" 2>/dev/null; then
+  abort "publish token bytes appear in tarball — DO NOT publish"
+fi
+
+FILES=$(tar tzf "$TARBALL" | wc -l | tr -d ' ')
+SIZE=$(du -h "$TARBALL" | cut -f1)
+echo "==> scan clean. $FILES files, $SIZE"
+
+# --- publish ---
+printf '//registry.npmjs.org/:_authToken=%s\n' "$TOKEN" > "$TMP_NPMRC"
+echo "==> publishing"
+npm publish "$TARBALL" --userconfig "$TMP_NPMRC"
+
+# --- commit bump ---
+git add -- package.json
+git add -- src/bundles 2>/dev/null || true
+git commit -m "bump version to $NEW" >/dev/null
+echo
+echo "Published $PKG@$NEW (commit $(git rev-parse --short HEAD))"
+echo
+echo "Install in BrandCrowd.Net:"
+echo "  npm i $PKG@$NEW"