@git.zone/cli 6.8.0 → 6.10.0

package/ts/mod_release/helpers.npmartifact.ts

@@ -9,6 +9,7 @@ const supportedPnpmVersions = [
   "11.25.0",
   "12.1.0",
   "12.2.1",
+  "12.3.0",
   "12.3.4",
 ] as const;
 const pnpmHelpRequirements = {
@@ -49,6 +50,19 @@ const pnpmHelpRequirements = {
       "[possible values: public, restricted]",
     ],
   },
+  "12.3.0": {
+    pack: ["Usage: pnpm pack [OPTIONS]", "--out <OUT>", "--json"],
+    publish: [
+      "Usage: pnpm publish [OPTIONS] [PACKAGE]",
+      "Tarball or directory to publish",
+      "--no-git-checks",
+      "--ignore-scripts",
+      "--json",
+      "--tag <TAG>",
+      "--access <ACCESS>",
+      "[possible values: public, restricted]",
+    ],
+  },
   "12.3.4": {
     pack: ["Usage: pnpm pack [OPTIONS]", "--out <OUT>", "--json"],
     publish: [
@@ -77,9 +91,24 @@ export function assertNpmPackageName(value: unknown): asserts value is string {
 }
 
 export interface IPnpmReleaseCapability {
-  version: (typeof supportedPnpmVersions)[number];
+  readonly version: (typeof supportedPnpmVersions)[number];
 }
 
+export const buildQualifiedPnpmArgs = (
+  capabilityArg: IPnpmReleaseCapability | undefined,
+  argsArg: readonly string[],
+): string[] => {
+  if (
+    !capabilityArg ||
+    !supportedPnpmVersions.includes(capabilityArg.version)
+  ) {
+    throw new Error(
+      "npm release commands require a qualified pnpm invocation.",
+    );
+  }
+  return ["with", capabilityArg.version, ...argsArg];
+};
+
 export type TNpmArtifactProbeStatus =
   "absent" | "exact" | "conflict" | "inconclusive";
 
@@ -169,21 +198,28 @@ export const assertPnpmReleaseCapability = async (
     );
   }
   const requirements = pnpmHelpRequirements[supportedVersion];
+  const capability = Object.freeze({ version: supportedVersion });
 
-  const packHelp = await smartshellArg.execSpawn("pnpm", ["pack", "--help"], {
-    cwd: cwdArg,
-    silent: true,
-    timeout: capabilityCommandTimeoutMs,
-    timeoutKillGraceMs: 5_000,
-  });
+  const packHelp = await smartshellArg.execSpawn(
+    "pnpm",
+    buildQualifiedPnpmArgs(capability, ["pack", "--help"]),
+    {
+      cwd: cwdArg,
+      silent: true,
+      timeout: capabilityCommandTimeoutMs,
+      timeoutKillGraceMs: 5_000,
+    },
+  );
   if (packHelp.exitCode !== 0) {
-    throw new Error("Unable to inspect pnpm pack capabilities.");
+    throw new Error(
+      "Unable to inspect the selected pnpm pack capabilities. Exact release commands require standalone pnpm with support; Corepack launchers are unsupported.",
+    );
   }
   requireHelpFragments(packHelp.combinedOutput, requirements.pack, "pack");
 
   const publishHelp = await smartshellArg.execSpawn(
     "pnpm",
-    ["publish", "--help"],
+    buildQualifiedPnpmArgs(capability, ["publish", "--help"]),
     {
       cwd: cwdArg,
       silent: true,
@@ -199,7 +235,7 @@ export const assertPnpmReleaseCapability = async (
     requirements.publish,
     "publish",
   );
-  return { version: supportedVersion };
+  return capability;
 };
 
 /**
@@ -358,6 +394,7 @@ export const packNpmArtifact = async (
   cwdArg: string,
   destinationDirectoryArg: string,
   expectedVersionArg: string,
+  capabilityArg: IPnpmReleaseCapability | undefined,
   fileArg: string = releaseArtifactFileName,
 ): Promise<IReleaseArtifact> => {
   if (
@@ -375,7 +412,12 @@ export const packNpmArtifact = async (
   const artifactPath = plugins.path.join(destinationDirectoryArg, fileArg);
   const result = await smartshellArg.execSpawn(
     "pnpm",
-    ["pack", "--out", artifactPath, "--json"],
+    buildQualifiedPnpmArgs(capabilityArg, [
+      "pack",
+      "--out",
+      artifactPath,
+      "--json",
+    ]),
     {
       cwd: cwdArg,
       timeout: packCommandTimeoutMs,
@@ -470,10 +512,14 @@ export const publishNpmArtifact = async (
   cwdArg: string,
   artifactPathArg: string,
   registryArg: string,
+  capabilityArg: IPnpmReleaseCapability | undefined,
 ): Promise<{ exitCode: number; output: string }> => {
   const result = await smartshellArg.execSpawn(
     "pnpm",
-    buildPnpmPublishArgs(artifactPathArg, registryArg),
+    buildQualifiedPnpmArgs(
+      capabilityArg,
+      buildPnpmPublishArgs(artifactPathArg, registryArg),
+    ),
     {
       cwd: cwdArg,
       timeout: publishCommandTimeoutMs,

package/ts/mod_release/helpers.releasepublication.ts

@@ -7,17 +7,27 @@ import {
   getReleaseDockerPromotionContext,
   getReleaseArtifacts,
   getReleaseNpmArtifact,
+  hasReleasePackages,
   type TReleaseJournal,
   type IReleaseJournalV2,
+  type IReleaseJournalV4,
   type IReleaseTargetStatus,
   type TReleaseErrorCode,
   type TReleaseTargetState,
 } from "./classes.releasejournal.js";
+import {
+  GiteaAssetsClient,
+  GiteaAssetConflictError,
+  validateGiteaAssets,
+} from "./helpers.giteaassets.js";
+import { assertGiteaAssetsGitDestination } from "../helpers.workflow.js";
 import {
   probeAnonymousNpmArtifact,
   publishNpmArtifact,
   verifyStoredNpmArtifact,
   waitForAnonymousNpmArtifact,
+  buildQualifiedPnpmArgs,
+  type IPnpmReleaseCapability,
   type INpmArtifactProbeOptions,
   type INpmArtifactProbeResult,
 } from "./helpers.npmartifact.js";
@@ -73,6 +83,8 @@ export function buildReleaseGitPushArgs(
 
 type TReleaseTargetSelector =
   | { kind: "git" }
+  | { kind: "gitea-release" }
+  | { kind: "gitea-asset"; name: string }
   | { kind: "npm"; registry: string; packageName?: string }
   | { kind: "docker-qualification" }
   | { kind: "docker-promotion"; promotionId: string }
@@ -85,6 +97,7 @@ interface IGitProbeResult {
 }
 
 export interface IReleasePublicationOptions {
+  pnpmCapability?: IPnpmReleaseCapability;
   smartshell: plugins.smartshell.Smartshell;
   cwd: string;
   store: ReleaseJournalStore;
@@ -93,6 +106,15 @@ export interface IReleasePublicationOptions {
   recoveryAttemptId?: string;
   npmProbeOptions?: INpmArtifactProbeOptions;
   tsdocker?: ITsdockerReleaseClient;
+  giteaAssets?: Pick<
+    GiteaAssetsClient,
+    | "preflight"
+    | "inspectRelease"
+    | "createRelease"
+    | "inspectAssets"
+    | "uploadAsset"
+    | "verifyComplete"
+  >;
   ensurePublicationState: (expectedRemoteMainOidArg?: string) => Promise<void>;
 }
 
@@ -103,6 +125,20 @@ const getTargetStatus = (
   if (selectorArg.kind === "git") {
     return journalArg.git;
   }
+  if (
+    selectorArg.kind === "gitea-release" ||
+    selectorArg.kind === "gitea-asset"
+  ) {
+    if (journalArg.schemaVersion !== 4)
+      throw new Error("Release journal has no Gitea assets.");
+    if (selectorArg.kind === "gitea-release")
+      return journalArg.giteaAssets.release;
+    const entry = journalArg.giteaAssets.assets.find(
+      (entry) => entry.asset.name === selectorArg.name,
+    );
+    if (!entry) throw new Error("Release journal has no matching Gitea asset.");
+    return entry;
+  }
   if (selectorArg.kind === "docker-qualification") {
     if (journalArg.schemaVersion !== 2) {
       throw new Error("Release journal does not contain Docker qualification.");
@@ -613,7 +649,7 @@ const executeNpmRegistry = async (
   // the accepted artifact on resume. Older root/Docker journal behavior stays
   // unchanged.
   if (
-    journal.schemaVersion === 3 &&
+    hasReleasePackages(journal) &&
     status.state === "failed" &&
     status.attempts > 0 &&
     status.error === "verification-inconclusive" &&
@@ -689,7 +725,7 @@ const executeNpmRegistry = async (
   }
   if (probe.status !== "absent") {
     if (
-      journal.schemaVersion === 3 &&
+      hasReleasePackages(journal) &&
       status.state === "failed" &&
       probe.status === "inconclusive"
     ) {
@@ -713,12 +749,15 @@ const executeNpmRegistry = async (
     artifact.file,
   );
   await verifyStoredNpmArtifact(artifactPath, artifact);
+  // Reject a missing invocation before claiming a potentially publishing target.
+  buildQualifiedPnpmArgs(optionsArg.pnpmCapability, []);
   journal = await claimTarget(optionsArg.store, journal, selector);
   const publishResult = await publishNpmArtifact(
     optionsArg.smartshell,
     optionsArg.cwd,
     artifactPath,
     registryArg,
+    optionsArg.pnpmCapability,
   );
   probe = await probeNpm(
     journal,
@@ -1426,6 +1465,165 @@ const executeDockerPromotion = async (
   );
 };
 
+const executeGiteaTarget = async (
+  options: IReleasePublicationOptions,
+  journalArg: TReleaseJournal,
+  selector: TReleaseTargetSelector,
+  inspect: () => Promise<boolean>,
+  publish: () => Promise<void>,
+  onVerified?: (target: IReleaseTargetStatus) => void,
+): Promise<TReleaseJournal> => {
+  let journal = journalArg;
+  let status = getTargetStatus(journal, selector);
+  if (status.state === "conflict")
+    throw new Error("Gitea publication has a recorded destination conflict.");
+  const mark = async (
+    state: "verified" | "failed" | "conflict",
+    error: TReleaseErrorCode | null,
+  ) => {
+    status = getTargetStatus(journal, selector);
+    journal = await updateTarget(
+      options.store,
+      journal,
+      selector,
+      status.state,
+      status.attempt?.id || null,
+      (target) => {
+        target.state = state;
+        target.error = error;
+        target.attempt = null;
+        if (state === "verified") onVerified?.(target);
+      },
+    );
+  };
+  let present: boolean;
+  try {
+    present = await inspect();
+  } catch (error) {
+    if (error instanceof GiteaAssetConflictError)
+      await mark("conflict", "destination-conflict");
+    throw error;
+  }
+  if (present) {
+    if (status.state !== "verified") await mark("verified", null);
+    return journal;
+  }
+  if (status.state === "verified") {
+    await mark("conflict", "destination-conflict");
+    throw new Error(
+      "A previously verified Gitea release or attachment is missing.",
+    );
+  }
+  if (status.state === "publishing") {
+    journal = await recoverPublishingTarget(
+      options.store,
+      journal,
+      selector,
+      options.recoveryAttemptId,
+    );
+  }
+  await options.ensurePublicationState(journal.release.mainOid);
+  journal = await claimTarget(options.store, journal, selector);
+  // One mutation per claimed attempt. Reconcile an accepted request even when
+  // its response was lost; never overwrite an attachment or recreate a tag.
+  let publicationError: unknown;
+  try {
+    await publish();
+  } catch (error) {
+    publicationError = error;
+  }
+  try {
+    present = await inspect();
+  } catch (error) {
+    await mark(
+      error instanceof GiteaAssetConflictError ? "conflict" : "failed",
+      error instanceof GiteaAssetConflictError
+        ? "destination-conflict"
+        : "verification-inconclusive",
+    );
+    throw error;
+  }
+  if (present) {
+    await mark("verified", null);
+    return journal;
+  }
+  await mark(
+    publicationError instanceof GiteaAssetConflictError ? "conflict" : "failed",
+    publicationError instanceof GiteaAssetConflictError
+      ? "destination-conflict"
+      : publicationError
+        ? "command-failed"
+        : "verification-inconclusive",
+  );
+  throw new Error(
+    "Gitea publication could not be verified; npm publication remains blocked. Inspect the retained journal before resuming.",
+  );
+};
+
+const executeGiteaAssets = async (
+  options: IReleasePublicationOptions,
+  journalArg: IReleaseJournalV4,
+  client: NonNullable<IReleasePublicationOptions["giteaAssets"]>,
+): Promise<IReleaseJournalV4> => {
+  let releaseId = journalArg.giteaAssets.release.id;
+  let journal = (await executeGiteaTarget(
+    options,
+    journalArg,
+    { kind: "gitea-release" },
+    async () => {
+      const release = await client.inspectRelease();
+      if (!release) return false;
+      if (releaseId !== null && release.id !== releaseId)
+        throw new GiteaAssetConflictError("Gitea release identity changed.");
+      releaseId = release.id;
+      return true;
+    },
+    async () => {
+      await client.createRelease();
+    },
+    (target) => {
+      (target as IReleaseJournalV4["giteaAssets"]["release"]).id = releaseId;
+    },
+  )) as IReleaseJournalV4;
+  if (releaseId === null)
+    throw new Error("Gitea release has no verified identity.");
+  const expected = journal.giteaAssets.assets.map((entry) => entry.asset);
+  const directory = options.store.getReleaseDirectory(journal.release.version);
+  for (const { asset } of journal.giteaAssets.assets) {
+    journal = (await executeGiteaTarget(
+      options,
+      journal,
+      { kind: "gitea-asset", name: asset.name },
+      async () => {
+        const inspection = await client.inspectAssets(releaseId!, expected);
+        return inspection.present.some((entry) => entry.name === asset.name);
+      },
+      async () => {
+        await validateGiteaAssets(directory, expected);
+        await client.uploadAsset(releaseId!, asset, directory);
+      },
+    )) as IReleaseJournalV4;
+  }
+  // One full anonymous verification immediately before entering the npm phase.
+  // Resume always repeats it, including an otherwise completed journal.
+  try {
+    await client.verifyComplete(releaseId, expected);
+  } catch (error) {
+    if (error instanceof GiteaAssetConflictError) {
+      await markUnclaimedTarget(
+        options.store,
+        journal,
+        { kind: "gitea-release" },
+        ["verified"],
+        "conflict",
+        "destination-conflict",
+      );
+    }
+    throw error;
+  }
+  return journal;
+};
+
 export const executeReleasePublication = async (
   optionsArg: IReleasePublicationOptions,
 ): Promise<TReleaseJournal> => {
@@ -1437,6 +1635,32 @@ export const executeReleasePublication = async (
       artifact,
     );
   }
+  let giteaClient = optionsArg.giteaAssets;
+  if (journal.schemaVersion === 4) {
+    const { destination, tokenEnv, manifestPath, assets } = journal.giteaAssets;
+    assertGiteaAssetsGitDestination(
+      { ...destination, tokenEnv, manifestPath },
+      optionsArg.pushUrl || "",
+    );
+    await validateGiteaAssets(
+      optionsArg.store.getReleaseDirectory(journal.release.version),
+      assets.map((entry) => entry.asset),
+    );
+    if (!giteaClient) {
+      const token = process.env[tokenEnv];
+      if (!token)
+        throw new Error(
+          `Gitea assets require the configured credential in ${tokenEnv}.`,
+        );
+      giteaClient = new GiteaAssetsClient({
+        destination,
+        token,
+        tag: journal.release.tag,
+        commit: journal.release.mainOid,
+      });
+    }
+    await giteaClient.preflight();
+  }
   if (journal.schemaVersion === 2) {
     journal = await executeDockerQualification(optionsArg, journal);
     if (
@@ -1447,6 +1671,8 @@ export const executeReleasePublication = async (
     }
   }
   journal = await executeGitTarget(optionsArg, journal);
+  if (journal.schemaVersion === 4)
+    journal = await executeGiteaAssets(optionsArg, journal, giteaClient!);
   const expectedRemoteMainOid =
     journal.git.state === "verified"
       ? journal.release.mainOid
@@ -1458,12 +1684,12 @@ export const executeReleasePublication = async (
       journal,
       registry.registry,
       registry.packageName,
-      journal.schemaVersion === 3,
+      hasReleasePackages(journal),
     );
   }
   // Submit in dependency order before waiting for npm's publish-time scans.
   // Success still requires every package/registry cell to verify exactly.
-  if (journal.schemaVersion === 3) {
+  if (hasReleasePackages(journal)) {
     for (const registry of journal.npm.registries) {
       if (
         registry.state !== "failed" ||