@intentius/chant 0.41.14 → 0.41.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.41.14",
+  "version": "0.41.15",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/meta/publish-metadata.test.ts

@@ -0,0 +1,55 @@
+import { describe, test, expect } from "vitest";
+import { readFileSync, readdirSync, existsSync } from "fs";
+import { fileURLToPath } from "url";
+import { join } from "path";
+
+/**
+ * Every publishable package carries the identity block npm provenance
+ * validates at publish time.
+ *
+ * The k3d lexicon's first publish failed with E422: sigstore provenance
+ * checks `repository.url` against the repo the workflow ran from, and the
+ * newborn package.json had no `repository` at all — an error that surfaces
+ * only on the publish runner, after a release is already tagged, which is
+ * the most expensive place to learn a field is missing (chant-v0.41.14
+ * shipped 13 of 14 packages). The peer-deps guard next door exists for the
+ * same reason: a newborn package copies whichever fields its author
+ * remembered, and the registry's requirements are not in anyone's head.
+ *
+ * So: what provenance actually validates (repository.url), plus the fields
+ * whose absence makes a published page anonymous (license, description),
+ * checked per package, in CI, before any tag exists.
+ */
+const repoRoot = fileURLToPath(new URL("../../../../", import.meta.url));
+const REPO_URL = "https://github.com/INTENTIUS/chant.git";
+
+/** Every workspace package that publishes (publishConfig or not private). */
+function publishablePackages(): Array<{ dir: string; pkg: Record<string, any> }> {
+  const out: Array<{ dir: string; pkg: Record<string, any> }> = [];
+  for (const parent of ["packages", "lexicons"]) {
+    const parentDir = join(repoRoot, parent);
+    if (!existsSync(parentDir)) continue;
+    for (const name of readdirSync(parentDir)) {
+      const p = join(parentDir, name, "package.json");
+      if (!existsSync(p)) continue;
+      const pkg = JSON.parse(readFileSync(p, "utf-8"));
+      if (pkg.private) continue;
+      out.push({ dir: join(parent, name), pkg });
+    }
+  }
+  return out;
+}
+
+describe("publishable packages carry the identity provenance validates", () => {
+  test.each(publishablePackages().map((e) => [e.dir, e] as const))(
+    "%s has repository/license/description",
+    (_dir, entry) => {
+      const { dir, pkg } = entry;
+      expect(pkg.repository?.url, `${dir}: repository.url is what sigstore provenance checks`).toBe(REPO_URL);
+      expect(pkg.repository?.directory, `${dir}: repository.directory should name the package's home`).toBe(dir);
+      expect(pkg.license, `${dir}: license`).toBe("Apache-2.0");
+      expect(typeof pkg.description, `${dir}: description`).toBe("string");
+      expect((pkg.description ?? "").length, `${dir}: description is not empty`).toBeGreaterThan(0);
+    },
+  );
+});