@hearthlog/tooling 0.1.0 → 0.1.2

package/bin/hearthlog.mjs

@@ -41,6 +41,15 @@ if (deployTools[command]) {
     process.exit(built === 0 ? (spawnSync(process.execPath, [tsx, source(deployTools[command]), ...rest], { stdio: 'inherit', env }).status ?? 1) : built);
 }
 
+// The plan reads the site's generated files too: build them first (a no-op when they are current). `apply` does not,
+// because `apply --skip-build` deploys the release already in place and must not rewrite it.
+if (command === 'plan') {
+    const site = rest[rest.indexOf('--site') + 1];
+    const env = { ...process.env, ...(rest.includes('--site') && site ? { VITE_STOR_TENANT: site } : {}) };
+    const built = spawnSync(process.execPath, [tsx, source('generate/build-generated.ts'), '--quiet'], { stdio: 'inherit', env }).status ?? 1;
+    if (built !== 0) process.exit(built);
+}
+
 const entry = {
     build: 'generate/build-generated.ts',
     init: 'init/init.ts',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hearthlog/tooling",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "tsx": "^4.23.15",
-    "@hearthlog/contracts": "0.1.0"
+    "@hearthlog/contracts": "0.1.2"
   },
   "bin": {
     "hearthlog": "./bin/hearthlog.mjs"

package/src/compose/module-scaffold.ts

@@ -155,6 +155,7 @@ export function exportModule(modulesDirectory: string, name: string, out: string
     writeFileSync(packagePath, `${JSON.stringify(publishable, null, 2)}\n`);
     mkdirSync(join(out, ".github", "workflows"), { recursive: true });
     copyFileSync(join(TEMPLATE, "gitignore.tmpl"), join(out, ".gitignore"));
+    copyFileSync(join(TEMPLATE, "gitleaks.toml.tmpl"), join(out, ".gitleaks.toml"));
     // vitest's esbuild needs its install script; pnpm 10 asks for it by name.
     writeFileSync(join(out, "pnpm-workspace.yaml"), "onlyBuiltDependencies:\n  - esbuild\n");
     copyFileSync(join(TEMPLATE, "ci.yml.tmpl"), join(out, ".github", "workflows", "ci.yml"));

package/src/init/init.ts

@@ -80,7 +80,8 @@ export function renderSite(options: InitOptions): Array<[string, string]> {
     const manifest = JSON.parse(readFileSync(join(TEMPLATE, "package.json.tmpl"), "utf8")) as Record<string, unknown>;
     const dependencies: Record<string, string> = Object.fromEntries([
         ...CORE_PACKAGES.map((name) => [`@hearthlog/${name}`, own]),
-        ...modules.map(({ manifest: { package: name } }) => [name, own]),
+        // A module is released on its own version, not on the platform's.
+        ...modules.map(({ manifest: { package: name }, directory }) => [name, workspace ? own : `^${(JSON.parse(readFileSync(join(directory, "package.json"), "utf8")) as { version: string }).version}`]),
         ["@hearthlog/generated", "link:.generated"],
     ].sort(([a], [b]) => a!.localeCompare(b!)));
     const devDependencies = Object.fromEntries(Object.entries(tooling.peerDependencies ?? {}).filter(([name]) => !name.startsWith("@hearthlog/")).sort(([a], [b]) => a.localeCompare(b)));

package/src/security/audit-push.ts

@@ -34,6 +34,11 @@ const SAFE_NOREPLY = /^(?:noreply@github\.com|[0-9]*\+?[a-z0-9-]+@users\.noreply
 
 /** Every file under the directory except `.git`, as relative paths. */
 export function listFiles(directory: string): string[] {
+    // In a repository, what could be pushed is what git tracks or would add: an ignored `node_modules` is not part of it.
+    if (existsSync(join(directory, ".git"))) {
+        const listed = execFileSync("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: directory, maxBuffer: 256 * 1024 * 1024 });
+        return [...new Set(listed.toString("utf8").split("\0").filter(Boolean))].filter((file) => existsSync(join(directory, file)));
+    }
     const files: string[] = [];
     const walk = (current: string) => {
         for (const entry of readdirSync(current, { withFileTypes: true })) {

package/templates/module/gitleaks.toml.tmpl

@@ -0,0 +1,11 @@
+title = "hearthlog"
+
+[extend]
+useDefault = true
+
+# Entity definitions name the fields of an event payload (`payloadKey: "caloriesPer100g"`); a field name that ends in
+# digits and a letter looks like a key to the generic rule, but it is not a credential.
+[[allowlists]]
+description = "payloadKey names a payload field"
+regexTarget = "line"
+regexes = ['''payloadKey:\s*["'][A-Za-z0-9_]+["']''']

package/templates/module/release.yml.tmpl

@@ -1,7 +1,7 @@
 name: Release
 
 # Set "version" in package.json, commit, then push the tag `v<version>`. The publish job waits for approval in the
-# protected `npm` environment; the registry credential is the organization secret NPM_TOKEN.
+# protected `npm` environment; the package is published through npm's trusted publishing, so no registry token is stored.
 on:
   push:
     tags: ["v*"]
@@ -37,10 +37,16 @@ jobs:
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
+      # npm's trusted publishing (OIDC) needs npm 11.5.1 or later; no token is stored anywhere.
+      - run: npm install --global npm@11
       - run: pnpm install
-      - run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Publish the version in package.json unless the registry has it
+        run: |
+          name=$(node -p "require('./package.json').name")
+          version=$(node -p "require('./package.json').version")
+          if [ "$(npm view "$name@$version" version 2>/dev/null)" = "$version" ]; then echo "$name@$version is already published"; exit 0; fi
+          pnpm pack --pack-destination "$RUNNER_TEMP/pack"
+          npm publish "$RUNNER_TEMP/pack/"*.tgz --access public --provenance
 
   release:
     needs: publish

package/templates/tenant/github-workflows/deploy.yml.tmpl

@@ -38,8 +38,6 @@ jobs:
           cache: pnpm
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-      - name: Plan (read-only)
-        run: pnpm exec hearthlog plan --site {{id}}
       - name: Build and seal
         env:
           VITE_STOR_TENANT: {{id}}
@@ -48,6 +46,9 @@ jobs:
           pnpm exec hearthlog gallery-public:build --site {{id}}
           pnpm exec vite build
           pnpm exec hearthlog artifact manifest --site {{id}}
+      # After the build: the plan reads the generated files the build writes.
+      - name: Plan (read-only)
+        run: pnpm exec hearthlog plan --site {{id}}
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release