@designcrowd/fe-shared-lib 1.8.4-edge-fallback-2 → 1.8.4

package/scripts/publish-uat.sh

@@ -1,120 +0,0 @@
-#!/usr/bin/env bash
-#
-# publish-uat.sh — publish a UAT-suffixed version of @designcrowd/fe-shared-lib
-#
-# Usage:   ./scripts/publish-uat.sh <suffix>
-# Example: ./scripts/publish-uat.sh edge-fallback-2
-#
-# Reads the npm publish token from $NPM_PUBLISH_TOKEN_FILE
-# (default ~/.config/designcrowd/npm-publish-token, mode 600).
-# The token is never written into the repo.
-#
-# Workflow:
-#   1. Validate branch (refuse master) and suffix.
-#   2. Compute new version = <base>-<suffix>, refuse if already published.
-#   3. Bump package.json, run bundle-translation.
-#   4. npm pack — produces a tarball.
-#   5. Secret scan: dangerous filenames + token-shaped strings + the
-#      literal token bytes from the token file (if it leaked into the
-#      tree somehow, this catches it).
-#   6. npm publish <tarball> via a temp .npmrc in /tmp (mode 600,
-#      removed on exit).
-#   7. git add + commit the version bump.
-#
-# Anything in steps 4-6 that fails leaves the working tree dirty so you
-# can investigate. The commit only lands after the registry confirms
-# the upload.
-
-set -euo pipefail
-
-PKG="@designcrowd/fe-shared-lib"
-TOKEN_FILE="${NPM_PUBLISH_TOKEN_FILE:-$HOME/.config/designcrowd/npm-publish-token}"
-
-abort() { echo "ABORT: $*" >&2; exit 1; }
-
-# --- args ---
-SUFFIX="${1:-}"
-[[ -z "$SUFFIX" ]] && abort "usage: $0 <suffix>  e.g. $0 edge-fallback-2"
-[[ "$SUFFIX" =~ ^[A-Za-z0-9._-]+$ ]] || abort "suffix must be [A-Za-z0-9._-]+"
-
-# --- repo state ---
-cd "$(git rev-parse --show-toplevel)"
-BRANCH=$(git symbolic-ref --short HEAD)
-[[ "$BRANCH" == "master" || "$BRANCH" == "main" ]] && abort "refusing to publish from $BRANCH"
-
-# --- token ---
-[[ -f "$TOKEN_FILE" ]] || abort "no token at $TOKEN_FILE (set NPM_PUBLISH_TOKEN_FILE to override)"
-TOKEN=$(tr -d '[:space:]' < "$TOKEN_FILE")
-[[ -n "$TOKEN" ]] || abort "token file is empty: $TOKEN_FILE"
-
-# --- compute version ---
-BASE=$(node -p "require('./package.json').version.replace(/-.*/, '')")
-NEW="$BASE-$SUFFIX"
-
-if npm view "$PKG@$NEW" version >/dev/null 2>&1; then
-  abort "$PKG@$NEW already published — pick a new suffix"
-fi
-
-echo "==> publishing $PKG@$NEW from branch $BRANCH"
-
-# --- bump + bundle ---
-node -e "const fs=require('fs');const p=require('./package.json');p.version='$NEW';fs.writeFileSync('./package.json', JSON.stringify(p, null, 2)+'\n');"
-echo "==> running bundle-translation"
-npm run --silent bundle-translation >/dev/null
-
-# --- pack ---
-echo "==> packing"
-TARBALL=$(npm pack --silent)
-[[ -f "$TARBALL" ]] || abort "npm pack did not produce a tarball"
-
-# Always clean up temp artifacts on exit
-SCAN_DIR=$(mktemp -d)
-TMP_NPMRC=$(mktemp /tmp/fe-shared-lib-publish.XXXXXX.npmrc)
-chmod 600 "$TMP_NPMRC"
-cleanup() { rm -rf "$SCAN_DIR"; rm -f "$TMP_NPMRC" "$TARBALL"; }
-trap cleanup EXIT
-
-# --- secret scan: filenames ---
-echo "==> scanning $TARBALL"
-DANGEROUS_PATHS='(^|/)(\.env(\..+)?|\.npmrc|\.npm-publish-token|id_rsa.*|id_ed25519.*|.*\.pem|.*\.key|.*token.*|.*secret.*|.*credential.*)$|(^|/)\.(aws|ssh|gnupg)/'
-if BAD=$(tar tzf "$TARBALL" | grep -E -i "$DANGEROUS_PATHS" || true); [[ -n "$BAD" ]]; then
-  echo "$BAD" >&2
-  abort "dangerous filenames in tarball"
-fi
-
-# --- secret scan: contents ---
-tar xzf "$TARBALL" -C "$SCAN_DIR"
-
-# Token-shaped patterns. Tightened so the literal '${NPM_TOKEN}' template
-# in the tracked npmrc file doesn't trip the check.
-SECRET_PATTERNS='(npm_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|sk_live_[A-Za-z0-9]{20,}|-----BEGIN [A-Z ]*PRIVATE KEY-----)'
-if HITS=$(grep -REn -I -E "$SECRET_PATTERNS" "$SCAN_DIR" 2>/dev/null || true); [[ -n "$HITS" ]]; then
-  echo "$HITS" >&2
-  abort "secret-shaped string in tarball"
-fi
-
-# Belt-and-braces: the token's own bytes. If our publish token ever
-# lands in a tracked file by accident, this catches it regardless of
-# pattern-matching.
-if grep -RFq "$TOKEN" "$SCAN_DIR" 2>/dev/null; then
-  abort "publish token bytes appear in tarball — DO NOT publish"
-fi
-
-FILES=$(tar tzf "$TARBALL" | wc -l | tr -d ' ')
-SIZE=$(du -h "$TARBALL" | cut -f1)
-echo "==> scan clean. $FILES files, $SIZE"
-
-# --- publish ---
-printf '//registry.npmjs.org/:_authToken=%s\n' "$TOKEN" > "$TMP_NPMRC"
-echo "==> publishing"
-npm publish "$TARBALL" --userconfig "$TMP_NPMRC"
-
-# --- commit bump ---
-git add -- package.json
-git add -- src/bundles 2>/dev/null || true
-git commit -m "bump version to $NEW" >/dev/null
-echo
-echo "Published $PKG@$NEW (commit $(git rev-parse --short HEAD))"
-echo
-echo "Install in BrandCrowd.Net:"
-echo "  npm i $PKG@$NEW"