@joshuafolkken/kit 1.1166.0 → 1.1229.0

package/scripts/version/version-commands.ts

@@ -1,8 +1,10 @@
+import { INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import { release_age } from './release-age'
 import { release_hold } from './release-hold'
 import { running_binary } from './running-binary'
 import type { InstalledVersions } from './upgrade-command-guard'
+import type { UpgradeCommand } from './upgrade-shell-command'
 import {
 	version_check_logic,
 	type ReleaseHold,
@@ -24,8 +26,6 @@ import { version_targets } from './version-targets'
 const FAILURE_EXIT_CODE = 1
 const ALREADY_UP_TO_DATE = 'Already up to date'
 const NO_QUARANTINE_MINUTES = 0
-// A global install that goes to the network — the same ten minutes `lane-install.ts` gives one.
-const UPGRADE_TIMEOUT_MS = 600_000
 
 // What the local minimum-release-age policy permits for one package. Resolved per package because
 // the newest installable release is a property of that package's own publish history. Returns a hold
@@ -197,23 +197,35 @@ function run_check(config: VersionCommandConfig): void {
 	)
 }
 
-// Through `sh -c` because an upgrade command is the user's own configured string — `pnpm add -g …`,
-// or a chain with `&&` — so it is inside the trust boundary and needs a shell to mean what it says.
-// The bound keeps a registry that never answers from holding `josh version` open forever; a timed-out
-// run has no exit code, so it falls through to the failure code like any other failed step.
-function run_upgrade_command(command: string): number {
-	const result = execaSync('sh', ['-c', command], {
+// One step as an argument vector — no shell unless the step itself is the consumer's `sh -c`
+// (`shell_upgrade_command`). The bound keeps a registry that never answers from holding `josh
+// version` open forever; a timed-out run has no exit code, so it falls through to the failure code
+// like any other failed step.
+function run_upgrade_step(step: ReadonlyArray<string>): number {
+	const [executable = '', ...rest] = step
+	const result = execaSync(executable, rest, {
 		stdio: 'inherit',
 		reject: false,
-		timeout: UPGRADE_TIMEOUT_MS,
+		timeout: INSTALL_TIMEOUT_MS,
 	})
 
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }
 
+// Run one command's steps in order, stopping at the first failure — what the `&&` in its printed
+// text says.
+function run_upgrade_command(command: UpgradeCommand): number {
+	for (const step of command.steps) {
+		const code = run_upgrade_step(step)
+		if (code !== 0) return code
+	}
+
+	return 0
+}
+
 // Run every upgrade command in order, returning the last non-zero exit code (or 0 when all
 // succeed) so a failure on either target is surfaced without aborting the remaining upgrades.
-function run_all_upgrade_commands(commands: ReadonlyArray<string>): number {
+function run_all_upgrade_commands(commands: ReadonlyArray<UpgradeCommand>): number {
 	let exit_code = 0
 	const failed_commands: Array<string> = []
 
@@ -221,7 +233,7 @@ function run_all_upgrade_commands(commands: ReadonlyArray<string>): number {
 		const code = run_upgrade_command(command)
 		if (code === 0) continue
 		exit_code = code
-		failed_commands.push(command)
+		failed_commands.push(command.text)
 	}
 
 	if (failed_commands.length > 0) {

package/scripts/version/version-remote.ts

@@ -23,19 +23,11 @@ function require_endpoint(versions_endpoint: string | undefined, package_name: s
 	)
 }
 
-// Fetch the latest published version: public npm's `latest` dist-tag first, which needs no
-// credentials (joshuafolkken/kit#2882), then the GitHub Packages versions endpoint for a package
-// public npm does not answer for. The endpoint is supplied per package (e.g.
-// `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the same fetcher serves kit, jgame,
-// and app-kit. Guards an undefined/empty endpoint and wraps `gh api` failures with an actionable
-// message instead of a raw ExecaSyncError stack. The detail is the shared layer's failure text: gh's
-// own stderr (e.g. "gh: Not Found (HTTP 404)") when it wrote one, execa's message otherwise, followed
-// by any JSON error body gh wrote to stdout.
-function fetch_latest_version(versions_endpoint: string | undefined, package_name: string): string {
-	const endpoint = require_endpoint(versions_endpoint, package_name)
-	const public_latest = npm_registry.read_latest(package_name)
-	if (public_latest !== undefined) return public_latest
-
+// The newest version name on the GitHub Packages versions endpoint. Wraps `gh api` failures with an
+// actionable message instead of a raw ExecaSyncError stack. The detail is the shared layer's failure
+// text: gh's own stderr (e.g. "gh: Not Found (HTTP 404)") when it wrote one, execa's message
+// otherwise, followed by any JSON error body gh wrote to stdout.
+function read_github_name(endpoint: string, package_name: string): string {
 	try {
 		return git_gh_exec.exec_gh_api_sync({ path: endpoint, jq_filter: '.[0].name' }).trim()
 	} catch (error) {
@@ -50,6 +42,29 @@ function fetch_latest_version(versions_endpoint: string | undefined, package_nam
 	}
 }
 
+// Refused at the source, as public npm's answer is: the value goes into an install command, so
+// anything but a semver version is never passed on (joshuafolkken/kit#3266).
+function read_github_latest(endpoint: string, package_name: string): string {
+	const name = read_github_name(endpoint, package_name)
+	const version = npm_registry.valid_version(name)
+	if (version !== undefined) return version
+
+	throw new Error(
+		`Refused latest version for ${package_name} via ${endpoint}: ${JSON.stringify(name)} is not a semver version`,
+	)
+}
+
+// Fetch the latest published version: public npm's `latest` dist-tag first, which needs no
+// credentials (joshuafolkken/kit#2882), then the GitHub Packages versions endpoint for a package
+// public npm does not answer for. The endpoint is supplied per package (e.g.
+// `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the same fetcher serves kit, jgame,
+// and app-kit. Guards an undefined/empty endpoint before either source is asked.
+function fetch_latest_version(versions_endpoint: string | undefined, package_name: string): string {
+	const endpoint = require_endpoint(versions_endpoint, package_name)
+
+	return npm_registry.read_latest(package_name) ?? read_github_latest(endpoint, package_name)
+}
+
 // Rewrite the endpoint's page size. The endpoint is consumer-overridable, so `per_page` is set
 // through a query parser rather than by substituting the literal the default happens to carry.
 function with_page_size(endpoint: string, page_size: number): string {

package/templates/pnpm-workspace.basic.yaml

@@ -4,3 +4,7 @@
 allowBuilds:
   esbuild: true
   unrs-resolver: true
+
+# pnpm 12 reads these settings from this file only; the same lines in .npmrc are ignored (kit #3267).
+minimumReleaseAge: 1440
+engineStrict: true

package/templates/workflows/dependabot-auto-merge.yml

@@ -13,10 +13,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   # Gated on who opened the pull request, not on who triggered this run. `github.actor` names the
   # latter, so a push by anyone other than Dependabot — a maintainer rebasing the branch by hand, or
@@ -24,11 +20,15 @@ jobs:
   # `gh pr merge --auto` is state on the pull request, so a run that never happens cannot withdraw an
   # auto-merge an earlier run armed, and the bump merges itself the moment the checks go green
   # (joshuafolkken/kit#838). The author is the stable fact about a Dependabot pull request; arming is
-  # what stays restricted to Dependabot's own events, on the step below.
+  # what stays restricted to Dependabot's own events, on the step below. The write rights are granted
+  # to this job alone (joshuafolkken/kit#3268).
   auto-merge:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event.pull_request.user.login == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       # Whether the pull request touches a workflow some upstream package overwrites. Decided from
       # the changed files because Dependabot's metadata cannot answer it: for the github-actions

package/templates/workflows/github-release.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # `josh release:github` waits up to 60 minutes (120 polls, 30 seconds apart) for the Publish run
+    # and lower tags' releases; the extra 5 minutes cover the setup before it.
     timeout-minutes: 65
     permissions:
       actions: read

package/scripts/build/build-config-merge.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const CONFIG_MERGE_LIBRARY = 'config-merge'
-const { outfile: CONFIG_MERGE_OUTFILE, dts_file: CONFIG_MERGE_DTS_FILE } =
-	library_paths(CONFIG_MERGE_LIBRARY)
-
-async function build_config_merge_library(): Promise<void> {
-	await build_library(CONFIG_MERGE_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_config_merge_library()
-		console.info(`  ✔ ${CONFIG_MERGE_OUTFILE} built`)
-		console.info(`  ✔ ${CONFIG_MERGE_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_config_merge_library, CONFIG_MERGE_OUTFILE, CONFIG_MERGE_DTS_FILE }

package/scripts/build/build-managed-marker.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const MANAGED_MARKER_LIBRARY = 'managed-marker'
-const { outfile: MANAGED_MARKER_OUTFILE, dts_file: MANAGED_MARKER_DTS_FILE } =
-	library_paths(MANAGED_MARKER_LIBRARY)
-
-async function build_managed_marker_library(): Promise<void> {
-	await build_library(MANAGED_MARKER_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_managed_marker_library()
-		console.info(`  ✔ ${MANAGED_MARKER_OUTFILE} built`)
-		console.info(`  ✔ ${MANAGED_MARKER_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_managed_marker_library, MANAGED_MARKER_OUTFILE, MANAGED_MARKER_DTS_FILE }

package/scripts/build/build-self-sync-guard.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const SELF_SYNC_GUARD_LIBRARY = 'self-sync-guard'
-const { outfile: SELF_SYNC_GUARD_OUTFILE, dts_file: SELF_SYNC_GUARD_DTS_FILE } =
-	library_paths(SELF_SYNC_GUARD_LIBRARY)
-
-async function build_self_sync_guard_library(): Promise<void> {
-	await build_library(SELF_SYNC_GUARD_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_self_sync_guard_library()
-		console.info(`  ✔ ${SELF_SYNC_GUARD_OUTFILE} built`)
-		console.info(`  ✔ ${SELF_SYNC_GUARD_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_self_sync_guard_library, SELF_SYNC_GUARD_OUTFILE, SELF_SYNC_GUARD_DTS_FILE }

package/scripts/build/build-version.ts

@@ -1,26 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const VERSION_LIBRARY = 'version'
-const { outfile: VERSION_OUTFILE, dts_file: VERSION_DTS_FILE } = library_paths(VERSION_LIBRARY)
-
-async function build_version_library(): Promise<void> {
-	await build_library(VERSION_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_version_library()
-		console.info(`  ✔ ${VERSION_OUTFILE} built`)
-		console.info(`  ✔ ${VERSION_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_version_library, VERSION_OUTFILE, VERSION_DTS_FILE }

package/scripts/version/preinstall-version-update.ts

@@ -1,86 +0,0 @@
-import { readFileSync, writeFileSync } from 'node:fs'
-import { ci_installer_pin } from '#scripts/safe-chain/ci-installer-pin'
-import { execaSync } from 'execa'
-
-const SAFE_CHAIN_PKG = '@aikidosec/safe-chain'
-const VERSION_RE = /@aikidosec\/safe-chain@([^\s"']+)/u
-const NPM_TIMEOUT_MS = 30_000
-
-interface PreinstallInfo {
-	content: string
-	current_version: string
-}
-
-function extract_pinned_version(preinstall: string): string | undefined {
-	return VERSION_RE.exec(preinstall)?.[1]
-}
-
-function fetch_latest_version(): string | undefined {
-	const result = execaSync('npm', ['view', SAFE_CHAIN_PKG, 'version'], {
-		reject: false,
-		timeout: NPM_TIMEOUT_MS,
-	})
-	if (result.exitCode !== 0 || !result.stdout) return undefined
-
-	return result.stdout.trim()
-}
-
-function rewrite_version(content: string, current_version: string, next_version: string): string {
-	return content.replace(
-		`${SAFE_CHAIN_PKG}@${current_version}`,
-		() => `${SAFE_CHAIN_PKG}@${next_version}`,
-	)
-}
-
-function read_preinstall_info(package_json_path: string): PreinstallInfo | undefined {
-	const content = readFileSync(package_json_path, 'utf8')
-	const package_json = JSON.parse(content) as { scripts?: { preinstall?: string } }
-	const preinstall = package_json.scripts?.preinstall
-	if (!preinstall) return undefined
-
-	const current_version = extract_pinned_version(preinstall)
-	if (!current_version) return undefined
-
-	return { content, current_version }
-}
-
-function write_if_updated(
-	package_json_path: string,
-	content: string,
-	current: string,
-	latest: string,
-): void {
-	if (current === latest) {
-		console.info(`\n✔ ${SAFE_CHAIN_PKG} preinstall already at ${latest}`)
-
-		return
-	}
-
-	console.info(`\n↑ Updating ${SAFE_CHAIN_PKG} preinstall: ${current} → ${latest}`)
-	writeFileSync(package_json_path, rewrite_version(content, current, latest), 'utf8')
-}
-
-function sync(package_json_path: string): void {
-	const info = read_preinstall_info(package_json_path)
-	if (!info) return
-
-	const latest = fetch_latest_version()
-
-	if (!latest) {
-		console.warn(`\n⚠ Could not fetch latest version of ${SAFE_CHAIN_PKG}; skipping`)
-
-		return
-	}
-
-	write_if_updated(package_json_path, info.content, info.current_version, latest)
-	ci_installer_pin.sync(latest)
-}
-
-const preinstall_version_update = {
-	sync,
-	extract_pinned_version,
-	fetch_latest_version,
-	rewrite_version,
-}
-
-export { preinstall_version_update }