@kungfu-tech/buildchain 0.0.0-bootstrap.0 → 2.0.13-alpha.11

package/scripts/npm-publish-dry-run.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const EXACT_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+
+function readPackageJson(cwd) {
+  const filePath = path.join(cwd, "package.json");
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`package.json not found: ${filePath}`);
+  }
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function readArg(argv, name, fallback = "") {
+  const index = argv.indexOf(`--${name}`);
+  if (index === -1) {
+    return fallback;
+  }
+  return argv[index + 1] || "";
+}
+
+function hasFlag(argv, name) {
+  return argv.includes(`--${name}`);
+}
+
+function runCommand({ cwd, cmd, args }) {
+  const result = spawnSync(cmd, args, {
+    cwd,
+    env: process.env,
+    encoding: "utf8",
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`${cmd} ${args.join(" ")} failed\n${result.stdout || ""}${result.stderr || ""}`.trim());
+  }
+  return {
+    command: [cmd, ...args],
+    stdout: result.stdout,
+    stderr: result.stderr,
+  };
+}
+
+function parsePackResult(stdout) {
+  const parsed = JSON.parse(stdout);
+  const pack = Array.isArray(parsed) ? parsed[0] : parsed;
+  const files = Array.isArray(pack?.files) ? pack.files : [];
+  const bin = files.find((file) => file.path === "bin/buildchain.mjs");
+  return {
+    filename: pack?.filename || "",
+    name: pack?.name || "",
+    version: pack?.version || "",
+    size: pack?.size || 0,
+    unpackedSize: pack?.unpackedSize || 0,
+    entryCount: pack?.entryCount || files.length,
+    bundled: pack?.bundled || [],
+    binMode: bin?.mode,
+  };
+}
+
+function writeGitHubOutputs(outputs) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (!outputPath) {
+    return;
+  }
+  fs.appendFileSync(outputPath, Object.entries(outputs)
+    .map(([key, value]) => `${key}=${String(value).replace(/\r?\n/g, " ")}`)
+    .join("\n") + "\n");
+}
+
+export function npmPublishDryRun({
+  cwd = process.cwd(),
+  expectedTag = "",
+  registry = "https://registry.npmjs.org/",
+  distTag = "",
+  skipNpmPublishDryRun = false,
+} = {}) {
+  const resolvedCwd = path.resolve(cwd);
+  const pkg = readPackageJson(resolvedCwd);
+  if (pkg.private === true) {
+    throw new Error("package.json private must be false before npm publish");
+  }
+  if (!pkg.name || typeof pkg.name !== "string") {
+    throw new Error("package.json name must be a non-empty string");
+  }
+  if (!pkg.version || typeof pkg.version !== "string") {
+    throw new Error("package.json version must be a non-empty string");
+  }
+  const exactTag = `v${pkg.version}`;
+  if (!EXACT_TAG_PATTERN.test(exactTag)) {
+    throw new Error(`unsupported release tag for npm publish: ${exactTag}`);
+  }
+  if (expectedTag && expectedTag !== exactTag) {
+    throw new Error(`npm publish tag must match package.json version: tag=${expectedTag} expected=${exactTag}`);
+  }
+  const resolvedDistTag = distTag || (pkg.version.includes("-") ? "alpha" : "latest");
+  const packCommand = runCommand({
+    cwd: resolvedCwd,
+    cmd: "npm",
+    args: ["pack", "--dry-run", "--json", `--registry=${registry}`],
+  });
+  const pack = parsePackResult(packCommand.stdout);
+  let publishCommand;
+  if (!skipNpmPublishDryRun) {
+    publishCommand = runCommand({
+      cwd: resolvedCwd,
+      cmd: "npm",
+      args: ["publish", "--dry-run", "--access", "public", "--tag", resolvedDistTag, `--registry=${registry}`],
+    });
+  }
+  const result = {
+    schemaVersion: 1,
+    dryRun: true,
+    wouldPublish: !skipNpmPublishDryRun,
+    package: {
+      name: pkg.name,
+      version: pkg.version,
+      private: pkg.private === true,
+    },
+    exactTag,
+    distTag: resolvedDistTag,
+    registry,
+    pack,
+    commands: {
+      pack: packCommand.command,
+      publishDryRun: publishCommand?.command || [],
+    },
+  };
+  writeGitHubOutputs({
+    version: pkg.version,
+    "exact-tag": exactTag,
+    "dist-tag": resolvedDistTag,
+    registry,
+    "pack-entry-count": pack.entryCount,
+    "publish-dry-run": String(!skipNpmPublishDryRun),
+  });
+  return result;
+}
+
+function usage() {
+  return `Usage:
+  node scripts/npm-publish-dry-run.mjs [--cwd <dir>] [--expected-tag <tag>]
+                                      [--registry <url>] [--dist-tag <tag>]
+                                      [--skip-npm-publish-dry-run] [--json]
+`;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const argv = process.argv.slice(2);
+    if (hasFlag(argv, "help") || hasFlag(argv, "h")) {
+      process.stdout.write(usage());
+      process.exit(0);
+    }
+    const result = npmPublishDryRun({
+      cwd: readArg(argv, "cwd", process.cwd()),
+      expectedTag: readArg(argv, "expected-tag", ""),
+      registry: readArg(argv, "registry", "https://registry.npmjs.org/"),
+      distTag: readArg(argv, "dist-tag", ""),
+      skipNpmPublishDryRun: hasFlag(argv, "skip-npm-publish-dry-run"),
+    });
+    if (hasFlag(argv, "json")) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    } else {
+      process.stdout.write(`npm publish dry-run ok: ${result.package.name}@${result.package.version} -> ${result.distTag}\n`);
+      process.stdout.write(`pack entries: ${result.pack.entryCount}\n`);
+    }
+  } catch (error) {
+    console.error(`npm-publish-dry-run: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/npm-publish-transaction.mjs

@@ -0,0 +1,268 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const EXACT_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+
+function readArg(argv, name, fallback = "") {
+  const index = argv.indexOf(`--${name}`);
+  if (index === -1) {
+    return fallback;
+  }
+  return argv[index + 1] || "";
+}
+
+function hasFlag(argv, name) {
+  return argv.includes(`--${name}`);
+}
+
+function readEnv(name, fallback = "") {
+  return process.env[name] || fallback;
+}
+
+function runNpm({ cwd, args, allowFailure = false }) {
+  const result = spawnSync("npm", args, {
+    cwd,
+    env: process.env,
+    encoding: "utf8",
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (!allowFailure && result.status !== 0) {
+    throw new Error(`npm ${args.join(" ")} failed\n${result.stdout || ""}${result.stderr || ""}`.trim());
+  }
+  return result;
+}
+
+function readPackageJson(cwd) {
+  const filePath = path.join(cwd, "package.json");
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`package.json not found: ${filePath}`);
+  }
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function parsePackResult(stdout) {
+  const parsed = JSON.parse(stdout);
+  const pack = Array.isArray(parsed) ? parsed[0] : parsed;
+  if (!pack?.name || !pack?.version) {
+    throw new Error("npm pack did not return package name and version");
+  }
+  return {
+    name: pack.name,
+    version: pack.version,
+    filename: pack.filename || "",
+    integrity: pack.integrity || "",
+    shasum: pack.shasum || "",
+    entryCount: pack.entryCount || pack.files?.length || 0,
+  };
+}
+
+function artifactDigest(pack) {
+  if (pack.integrity) {
+    return pack.integrity;
+  }
+  if (pack.shasum) {
+    return `sha1:${pack.shasum}`;
+  }
+  throw new Error("npm pack did not return integrity or shasum");
+}
+
+function parseNpmView(stdout) {
+  const raw = String(stdout || "").trim();
+  if (!raw) {
+    return undefined;
+  }
+  const parsed = JSON.parse(raw);
+  const dist = parsed?.dist || parsed;
+  return {
+    integrity: dist?.integrity || "",
+    shasum: dist?.shasum || "",
+  };
+}
+
+function publishedDigest({ cwd, name, version, registry }) {
+  const result = runNpm({
+    cwd,
+    args: ["view", `${name}@${version}`, "dist.integrity", "dist.shasum", "--json", `--registry=${registry}`],
+    allowFailure: true,
+  });
+  if (result.status !== 0) {
+    const output = `${result.stdout || ""}\n${result.stderr || ""}`;
+    if (/\bE404\b|404 Not Found|is not in this registry/i.test(output)) {
+      return undefined;
+    }
+    throw new Error(`npm view ${name}@${version} failed\n${output}`.trim());
+  }
+  const view = parseNpmView(result.stdout);
+  if (!view) {
+    return undefined;
+  }
+  return view.integrity || (view.shasum ? `sha1:${view.shasum}` : "");
+}
+
+function assertPackageVersion({ pkg, expectedVersion }) {
+  if (pkg.private === true) {
+    throw new Error("package.json private must be false before npm publish");
+  }
+  if (!pkg.name || typeof pkg.name !== "string") {
+    throw new Error("package.json name must be a non-empty string");
+  }
+  if (!pkg.version || typeof pkg.version !== "string") {
+    throw new Error("package.json version must be a non-empty string");
+  }
+  if (expectedVersion && pkg.version !== expectedVersion) {
+    throw new Error(`package.json version must match Buildchain version: package=${pkg.version} buildchain=${expectedVersion}`);
+  }
+  const exactTag = `v${pkg.version}`;
+  if (!EXACT_TAG_PATTERN.test(exactTag)) {
+    throw new Error(`unsupported release tag for npm publish: ${exactTag}`);
+  }
+  return exactTag;
+}
+
+function writeEvidence({ cwd, evidencePath, evidence }) {
+  const resolved = path.resolve(cwd, evidencePath);
+  fs.mkdirSync(path.dirname(resolved), { recursive: true });
+  fs.writeFileSync(resolved, `${JSON.stringify(evidence, null, 2)}\n`);
+  return resolved;
+}
+
+function writeGitHubOutputs(outputs) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (!outputPath) {
+    return;
+  }
+  fs.appendFileSync(outputPath, Object.entries(outputs)
+    .map(([key, value]) => `${key}=${String(value).replace(/\r?\n/g, " ")}`)
+    .join("\n") + "\n");
+}
+
+export function npmPublishTransaction({
+  cwd = process.cwd(),
+  registry = "https://registry.npmjs.org/",
+  dryRunPublish = false,
+  access = "public",
+  skipRegistryLookup = false,
+} = {}) {
+  const resolvedCwd = path.resolve(cwd);
+  const pkg = readPackageJson(resolvedCwd);
+  const expectedVersion = readEnv("BUILDCHAIN_VERSION");
+  const exactTag = assertPackageVersion({ pkg, expectedVersion });
+  const distTag = pkg.version.includes("-") ? "alpha" : "latest";
+
+  const pack = parsePackResult(runNpm({
+    cwd: resolvedCwd,
+    args: ["pack", "--dry-run", "--json", `--registry=${registry}`],
+  }).stdout);
+  const digest = artifactDigest(pack);
+
+  const existingDigest = skipRegistryLookup
+    ? undefined
+    : publishedDigest({
+        cwd: resolvedCwd,
+        name: pkg.name,
+        version: pkg.version,
+        registry,
+      });
+  let publishAction = "already-published";
+  if (existingDigest) {
+    if (existingDigest !== digest) {
+      throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+    }
+  } else if (dryRunPublish) {
+    publishAction = "dry-run";
+  } else {
+    runNpm({
+      cwd: resolvedCwd,
+      args: ["publish", "--access", access, "--tag", distTag, `--registry=${registry}`],
+    });
+    publishAction = "published";
+    const registryDigest = skipRegistryLookup
+      ? undefined
+      : publishedDigest({
+          cwd: resolvedCwd,
+          name: pkg.name,
+          version: pkg.version,
+          registry,
+        });
+    if (registryDigest && registryDigest !== digest) {
+      throw new Error(`artifact digest mismatch: npm:${pkg.name}@${pkg.version}`);
+    }
+  }
+
+  const evidencePath = readEnv("BUILDCHAIN_PUBLISH_EVIDENCE");
+  if (!evidencePath) {
+    throw new Error("BUILDCHAIN_PUBLISH_EVIDENCE is required");
+  }
+  const evidence = {
+    schema: 1,
+    version: expectedVersion || pkg.version,
+    channel: readEnv("BUILDCHAIN_CHANNEL"),
+    source_sha: readEnv("BUILDCHAIN_SOURCE_SHA"),
+    release_sha: readEnv("BUILDCHAIN_RELEASE_SHA"),
+    target_ref: readEnv("BUILDCHAIN_TARGET_REF"),
+    release_material_sha: readEnv("BUILDCHAIN_RELEASE_MATERIAL_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
+    publish_tooling_sha: readEnv("BUILDCHAIN_PUBLISH_TOOLING_SHA", readEnv("BUILDCHAIN_RELEASE_SHA")),
+    artifacts: [{
+      group: "node",
+      kind: "npm",
+      name: pkg.name,
+      ref: pkg.version,
+      digest,
+    }],
+  };
+  const resolvedEvidencePath = writeEvidence({ cwd: resolvedCwd, evidencePath, evidence });
+  writeGitHubOutputs({
+    version: pkg.version,
+    "exact-tag": exactTag,
+    "dist-tag": distTag,
+    "artifact-digest": digest,
+    "publish-action": publishAction,
+    "publish-evidence": resolvedEvidencePath,
+  });
+  return {
+    schemaVersion: 1,
+    package: {
+      name: pkg.name,
+      version: pkg.version,
+    },
+    exactTag,
+    distTag,
+    registry,
+    publishAction,
+    pack,
+    evidencePath: resolvedEvidencePath,
+    evidence,
+  };
+}
+
+function usage() {
+  return `Usage:
+  node scripts/npm-publish-transaction.mjs [--cwd <dir>] [--registry <url>]
+                                           [--dry-run-publish] [--skip-registry-lookup]
+`;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const argv = process.argv.slice(2);
+    if (hasFlag(argv, "help") || argv.includes("-h")) {
+      process.stdout.write(usage());
+      process.exit(0);
+    }
+    const result = npmPublishTransaction({
+      cwd: readArg(argv, "cwd", process.cwd()),
+      registry: readArg(argv, "registry", "https://registry.npmjs.org/"),
+      dryRunPublish: hasFlag(argv, "dry-run-publish"),
+      skipRegistryLookup: hasFlag(argv, "skip-registry-lookup"),
+    });
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } catch (error) {
+    console.error(`npm-publish-transaction: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/publish-source-ref-resolver.mjs

@@ -0,0 +1,113 @@
+const DEFAULT_GITHUB_API_URL = "https://api.github.com";
+
+function readEnv(env, name, fallback = "") {
+  return env[name] || fallback;
+}
+
+function assertGitSha(sha, label = "sourceSha") {
+  const value = String(sha || "").trim();
+  if (!/^[0-9a-f]{40}$/i.test(value)) {
+    throw new Error(`${label} must be a 40-character Git SHA`);
+  }
+  return value;
+}
+
+export function normalizeSourceRef(value, fallback = "") {
+  return String(value || fallback || "")
+    .trim()
+    .replace(/^refs\/heads\//, "")
+    .replace(/^refs\/tags\//, "");
+}
+
+function splitRepository(repository) {
+  const value = String(repository || "").trim();
+  const match = value.match(/^([^/\s]+)\/([^/\s]+)$/);
+  if (!match) {
+    throw new Error(`BUILDCHAIN_SOURCE_REPOSITORY must be owner/repo, got: ${value || "<empty>"}`);
+  }
+  return { owner: match[1], repo: match[2] };
+}
+
+function encodeRefPath(ref) {
+  return String(ref)
+    .split("/")
+    .map((segment) => encodeURIComponent(segment))
+    .join("/");
+}
+
+export function sourceRefFromEnv(env = process.env) {
+  const configured = normalizeSourceRef(readEnv(env, "BUILDCHAIN_PUBLISH_SOURCE_REF"));
+  if (configured) {
+    return configured;
+  }
+  const refName = normalizeSourceRef(readEnv(env, "GITHUB_REF_NAME"));
+  if (refName.startsWith("publish-gate/") || refName === "major-gate") {
+    return refName;
+  }
+  return "";
+}
+
+export function currentGitHubRefSha(sourceRef, env = process.env) {
+  const ref = normalizeSourceRef(sourceRef);
+  const githubRefName = normalizeSourceRef(readEnv(env, "GITHUB_REF_NAME"));
+  const githubRef = String(readEnv(env, "GITHUB_REF")).trim();
+  if (ref && ref === githubRefName && githubRef === `refs/heads/${ref}`) {
+    return assertGitSha(readEnv(env, "GITHUB_SHA"), "GITHUB_SHA");
+  }
+  return "";
+}
+
+export async function resolveRemoteGitHubRefSha({
+  repository,
+  sourceRef,
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const ref = normalizeSourceRef(sourceRef);
+  if (!ref) {
+    throw new Error("publish source ref is required");
+  }
+  if (typeof fetchImpl !== "function") {
+    throw new Error("fetch is required to resolve publish source ref through GitHub REST API");
+  }
+
+  const { owner, repo } = splitRepository(repository);
+  const apiBase = String(readEnv(env, "GITHUB_API_URL", DEFAULT_GITHUB_API_URL)).replace(/\/+$/, "");
+  const url = `${apiBase}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/git/ref/heads/${encodeRefPath(ref)}`;
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "buildchain-publish-source-resolver",
+    "X-GitHub-Api-Version": "2022-11-28",
+  };
+  const token = readEnv(env, "GITHUB_TOKEN");
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+
+  const response = await fetchImpl(url, { headers });
+  if (!response?.ok) {
+    let detail = "";
+    try {
+      const body = await response.json();
+      detail = body?.message ? `: ${body.message}` : "";
+    } catch {
+      detail = "";
+    }
+    throw new Error(`publish source ref not found: ${ref} (GitHub API ${response?.status || "unknown"}${detail})`);
+  }
+  const body = await response.json();
+  return assertGitSha(body?.object?.sha, `GitHub ref ${ref} object.sha`);
+}
+
+export async function resolvePublishSourceRefSha({
+  repository,
+  sourceRef,
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const currentSha = currentGitHubRefSha(sourceRef, env);
+  if (currentSha) {
+    return currentSha;
+  }
+  return await resolveRemoteGitHubRefSha({ repository, sourceRef, env, fetchImpl });
+}

package/scripts/release-line-dry-run.mjs

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import {
+  explainReleaseLineDryRun,
+  formatReleaseLineDryRun,
+} from "../packages/core/release-line-dry-run.js";
+
+function readFlag(args, name, fallback = "") {
+  const index = args.indexOf(`--${name}`);
+  if (index === -1) {
+    return fallback;
+  }
+  return args[index + 1] || "";
+}
+
+function hasFlag(args, name) {
+  return args.includes(`--${name}`);
+}
+
+function usage() {
+  return `Usage:
+  node scripts/release-line-dry-run.mjs --target-ref <ref> [--cwd <dir>]
+                                        [--sha <sha>] [--source-ref <ref>]
+                                        [--tags <comma-list>] [--json]
+`;
+}
+
+function main(argv = process.argv.slice(2)) {
+  if (hasFlag(argv, "help") || argv.includes("-h")) {
+    process.stdout.write(usage());
+    return;
+  }
+  const plan = explainReleaseLineDryRun({
+    cwd: readFlag(argv, "cwd", process.cwd()),
+    targetRef: readFlag(argv, "target-ref", ""),
+    sourceRef: readFlag(argv, "source-ref", ""),
+    sha: readFlag(argv, "sha", ""),
+    tags: readFlag(argv, "tags", ""),
+    publishTransaction: hasFlag(argv, "publish-transaction"),
+    publishCommand: readFlag(argv, "publish-command", ""),
+  });
+  if (hasFlag(argv, "json")) {
+    process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);
+  } else {
+    process.stdout.write(formatReleaseLineDryRun(plan));
+  }
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`release-line-dry-run: ${error.message}`);
+  process.exitCode = 1;
+}