@joshuafolkken/kit 1.1178.0 → 1.1229.0

package/templates/workflows/dependabot-auto-merge.yml

@@ -13,10 +13,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   # Gated on who opened the pull request, not on who triggered this run. `github.actor` names the
   # latter, so a push by anyone other than Dependabot — a maintainer rebasing the branch by hand, or
@@ -24,11 +20,15 @@ jobs:
   # `gh pr merge --auto` is state on the pull request, so a run that never happens cannot withdraw an
   # auto-merge an earlier run armed, and the bump merges itself the moment the checks go green
   # (joshuafolkken/kit#838). The author is the stable fact about a Dependabot pull request; arming is
-  # what stays restricted to Dependabot's own events, on the step below.
+  # what stays restricted to Dependabot's own events, on the step below. The write rights are granted
+  # to this job alone (joshuafolkken/kit#3268).
   auto-merge:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event.pull_request.user.login == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       # Whether the pull request touches a workflow some upstream package overwrites. Decided from
       # the changed files because Dependabot's metadata cannot answer it: for the github-actions

package/templates/workflows/github-release.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # `josh release:github` waits up to 60 minutes (120 polls, 30 seconds apart) for the Publish run
+    # and lower tags' releases; the extra 5 minutes cover the setup before it.
     timeout-minutes: 65
     permissions:
       actions: read

package/scripts/build/build-config-merge.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const CONFIG_MERGE_LIBRARY = 'config-merge'
-const { outfile: CONFIG_MERGE_OUTFILE, dts_file: CONFIG_MERGE_DTS_FILE } =
-	library_paths(CONFIG_MERGE_LIBRARY)
-
-async function build_config_merge_library(): Promise<void> {
-	await build_library(CONFIG_MERGE_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_config_merge_library()
-		console.info(`  ✔ ${CONFIG_MERGE_OUTFILE} built`)
-		console.info(`  ✔ ${CONFIG_MERGE_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_config_merge_library, CONFIG_MERGE_OUTFILE, CONFIG_MERGE_DTS_FILE }

package/scripts/build/build-managed-marker.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const MANAGED_MARKER_LIBRARY = 'managed-marker'
-const { outfile: MANAGED_MARKER_OUTFILE, dts_file: MANAGED_MARKER_DTS_FILE } =
-	library_paths(MANAGED_MARKER_LIBRARY)
-
-async function build_managed_marker_library(): Promise<void> {
-	await build_library(MANAGED_MARKER_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_managed_marker_library()
-		console.info(`  ✔ ${MANAGED_MARKER_OUTFILE} built`)
-		console.info(`  ✔ ${MANAGED_MARKER_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_managed_marker_library, MANAGED_MARKER_OUTFILE, MANAGED_MARKER_DTS_FILE }

package/scripts/build/build-self-sync-guard.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const SELF_SYNC_GUARD_LIBRARY = 'self-sync-guard'
-const { outfile: SELF_SYNC_GUARD_OUTFILE, dts_file: SELF_SYNC_GUARD_DTS_FILE } =
-	library_paths(SELF_SYNC_GUARD_LIBRARY)
-
-async function build_self_sync_guard_library(): Promise<void> {
-	await build_library(SELF_SYNC_GUARD_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_self_sync_guard_library()
-		console.info(`  ✔ ${SELF_SYNC_GUARD_OUTFILE} built`)
-		console.info(`  ✔ ${SELF_SYNC_GUARD_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_self_sync_guard_library, SELF_SYNC_GUARD_OUTFILE, SELF_SYNC_GUARD_DTS_FILE }

package/scripts/build/build-version.ts

@@ -1,26 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const VERSION_LIBRARY = 'version'
-const { outfile: VERSION_OUTFILE, dts_file: VERSION_DTS_FILE } = library_paths(VERSION_LIBRARY)
-
-async function build_version_library(): Promise<void> {
-	await build_library(VERSION_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_version_library()
-		console.info(`  ✔ ${VERSION_OUTFILE} built`)
-		console.info(`  ✔ ${VERSION_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_version_library, VERSION_OUTFILE, VERSION_DTS_FILE }

package/scripts/version/preinstall-version-update.ts

@@ -1,86 +0,0 @@
-import { readFileSync, writeFileSync } from 'node:fs'
-import { ci_installer_pin } from '#scripts/safe-chain/ci-installer-pin'
-import { execaSync } from 'execa'
-
-const SAFE_CHAIN_PKG = '@aikidosec/safe-chain'
-const VERSION_RE = /@aikidosec\/safe-chain@([^\s"']+)/u
-const NPM_TIMEOUT_MS = 30_000
-
-interface PreinstallInfo {
-	content: string
-	current_version: string
-}
-
-function extract_pinned_version(preinstall: string): string | undefined {
-	return VERSION_RE.exec(preinstall)?.[1]
-}
-
-function fetch_latest_version(): string | undefined {
-	const result = execaSync('npm', ['view', SAFE_CHAIN_PKG, 'version'], {
-		reject: false,
-		timeout: NPM_TIMEOUT_MS,
-	})
-	if (result.exitCode !== 0 || !result.stdout) return undefined
-
-	return result.stdout.trim()
-}
-
-function rewrite_version(content: string, current_version: string, next_version: string): string {
-	return content.replace(
-		`${SAFE_CHAIN_PKG}@${current_version}`,
-		() => `${SAFE_CHAIN_PKG}@${next_version}`,
-	)
-}
-
-function read_preinstall_info(package_json_path: string): PreinstallInfo | undefined {
-	const content = readFileSync(package_json_path, 'utf8')
-	const package_json = JSON.parse(content) as { scripts?: { preinstall?: string } }
-	const preinstall = package_json.scripts?.preinstall
-	if (!preinstall) return undefined
-
-	const current_version = extract_pinned_version(preinstall)
-	if (!current_version) return undefined
-
-	return { content, current_version }
-}
-
-function write_if_updated(
-	package_json_path: string,
-	content: string,
-	current: string,
-	latest: string,
-): void {
-	if (current === latest) {
-		console.info(`\n✔ ${SAFE_CHAIN_PKG} preinstall already at ${latest}`)
-
-		return
-	}
-
-	console.info(`\n↑ Updating ${SAFE_CHAIN_PKG} preinstall: ${current} → ${latest}`)
-	writeFileSync(package_json_path, rewrite_version(content, current, latest), 'utf8')
-}
-
-function sync(package_json_path: string): void {
-	const info = read_preinstall_info(package_json_path)
-	if (!info) return
-
-	const latest = fetch_latest_version()
-
-	if (!latest) {
-		console.warn(`\n⚠ Could not fetch latest version of ${SAFE_CHAIN_PKG}; skipping`)
-
-		return
-	}
-
-	write_if_updated(package_json_path, info.content, info.current_version, latest)
-	ci_installer_pin.sync(latest)
-}
-
-const preinstall_version_update = {
-	sync,
-	extract_pinned_version,
-	fetch_latest_version,
-	rewrite_version,
-}
-
-export { preinstall_version_update }