@leverege/build-tools 2.103.0 → 2.105.0

package/.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

package/README.md

@@ -17,6 +17,7 @@ Most tools assume the following are installed and configured:
 - `helm` (v3+)
 - `fzf` (for interactive pod selection in `k8x` and `klog`)
 - Node.js 22+ - prefer 24
+- npm 11.10+
 
 ---
 
@@ -121,12 +122,14 @@ Secrets are defined as JSON files in `src/service-man/config/secrets/`. See the
 ### Docker Image Management
 
 **`docker-to-registry`** — Builds and pushes Docker images (Node.js/general) to GCP
-Artifact Registry with git tagging.
+Artifact Registry with git tagging. Any non-semver version string (e.g. `latest`) is
+treated as a beta build and skips git tagging.
 ```bash
-docker-to-registry <version>          # e.g. docker-to-registry v1.2.3
-docker-to-registry latest             # beta build — any non-semver version skips git tagging
+docker-to-registry v1.2.3            # tagged release build
+docker-to-registry latest            # beta build — skips git tagging
 docker-to-registry v1.2.3 --dry-run  # skip confirmation prompt
 docker-to-registry guide-me          # print helm/registry migration guidance
+docker-to-registry v1.2.3 --debug    # enable debug logging
 ```
 
 **`build-cnpg-image`** — Builds a custom CloudNative PostgreSQL image with jsquery and
@@ -221,11 +224,20 @@ package releases. Runs automatically as the npm `prepare` lifecycle hook.
 prepack [--compile] [--manual-tag] [--force-tag] [--push-tag]
 ```
 
-**`refresh-npm-token`** — Refreshes the Leverege npm registry token from GCP Secret
-Manager, updating `.npmrc` / `.yarnrc.yml`. Skips refresh if the token is less than
-24 hours old.
-```bash
-refresh-npm-token [--project <id>] [--force] [--dry-run]
+**`refresh-npm-token`** — Fetches the current npm token and rc file templates from GCP
+Secret Manager and overwrites `~/.npmrc` and `~/.yarnrc.yml`. DevOps controls the full
+content of both files via three secrets: `REFRESH_NPM_TOKEN` (raw token),
+`REFRESH_NPM_NPMRC`, and `REFRESH_NPM_YARNRC` (templates with `${REFRESH_NPM_TOKEN}`
+placeholder). Skips refresh if `~/.npmrc` is less than 24 hours old. On first run,
+existing rc files are preserved as `.LEGACY` before being overwritten.
+```bash
+refresh-npm-token                        # refresh if older than 24h
+refresh-npm-token --force                # always refresh
+refresh-npm-token --beta                 # use _BETA template secrets (migration testing)
+refresh-npm-token --dry-run              # fetch and validate without writing files
+refresh-npm-token --no-version-check     # warn on version requirements but continue
+refresh-npm-token --no-update-yarnrc     # skip ~/.yarnrc.yml update
+refresh-npm-token --npmrc-age 1h         # custom age threshold
 ```
 
 **`repo-panopticon`** — Multi-repo health dashboard. Checks each repository against a suite

package/eslint.config.mjs

@@ -0,0 +1,13 @@
+import eslintConfig from '@leverege/eslint-config-leverege'
+
+export default [
+  ...eslintConfig,
+  {
+    rules: {
+      '@stylistic/curly-newline': 'off',
+      '@stylistic/key-spacing': 'off',
+      '@stylistic/object-curly-newline': 'off',
+      '@stylistic/nonblock-statement-body-position': 'off'
+    }
+  }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.103.0",
+  "version": "2.105.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "clean": "rm -rf lib",
-    "lint": "find ./src -name \\*.\\*js | xargs npx eslint --report-unused-disable-directives",
+    "lint": "eslint",
     "prepare": "[ $SKIP_PREPARE ] && exit 0 || ./src/hook-and-release.mjs",
     "test": "mocha -t 60000 --exit 'test/**/!(*e2e*).mjs'",
     "test-all": "mocha -t 60000 --exit 'test/**/**.mjs'",
@@ -66,14 +66,13 @@
     "send-to-slack": "src/send-to-slack.mjs",
     "service-man": "src/service-man/service-man.mjs",
     "snapshot-cnpg": "src/snapshot-cnpg.mjs",
-    "unleash": "src/unleash.mjs",
     "upload-model": "src/upload-model.sh",
     "yarn-build": "src/yarn-build.mjs"
   },
   "author": "Leverege Devs",
   "engines": {
-    "node": "^22.11 || >=24",
-    "npm": ">=10.2 || >=11.6"
+    "node": "^22.22 || >=24.15",
+    "npm": ">=11.10"
   },
   "license": "SEE LICENSE IN LICENSE.md",
   "dependencies": {
@@ -88,32 +87,33 @@
     "execa": "^9.6.1",
     "find-yarn-workspace-root": "^2.0.0",
     "glob": "^13.0.6",
-    "googleapis": "^171.4.0",
+    "googleapis": "^172.0.0",
     "handlebars": "^4.7.9",
     "ignore": "^7.0.5",
-    "inquirer": "^13.4.3",
+    "inquirer": "^14.0.0",
     "js-yaml": "^4.1.1",
     "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
-    "npm-registry-fetch": "^19.1.1",
+    "npm-registry-fetch": "^20.0.0",
     "ora": "^9.4.0",
     "p-limit": "^7.3.0",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
-    "semver": "^7.8.0",
-    "shell-quote": "^1.8.3",
+    "semver": "^7.8.1",
+    "shell-quote": "^1.8.4",
     "simple-git": "^3.36.0",
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
-    "tmp": "^0.2.5",
+    "tmp": "^0.2.6",
     "toml": "^4.1.1",
     "yaml": "^2.9.0",
     "zx": "^8.8.5"
   },
   "devDependencies": {
-    "@leverege/eslint-config-leverege": "^5.1.2",
+    "@leverege/eslint-config-leverege": "^9.0.1",
     "chai": "^6.2.2",
-    "mocha": "^11.7.5",
-    "npm": "^11.14.1"
+    "eslint": "^9",
+    "mocha": "^11.7.6",
+    "npm": "^11.15.0"
   }
 }

package/src/Docker.mjs

@@ -98,7 +98,7 @@ const generateDockerfile = async ( options ) => {
   // could probably be tightened up a little.
   try {
     fs.readdirSync( './docker' )
-  } catch ( err ) {
+  } catch ( err ) { // eslint-disable-line no-unused-vars
     warning( 'creating the missing ./docker directory' )
     fs.mkdirSync( './docker' ) // TODO: blindly assumes the mkdir succeeds
   }
@@ -120,7 +120,7 @@ const generateDockerfile = async ( options ) => {
   try {
     fs.writeFileSync( bashrcFile, bashrcTemplate )
     fs.appendFileSync( bashrcFile, bashrcPlugin )
-  } catch ( err ) {
+  } catch ( err ) { // eslint-disable-line no-unused-vars
     errorExit( `***ERROR: failed creation of the ${bashrcFile} file` )
   }
 
@@ -136,7 +136,7 @@ const generateDockerfile = async ( options ) => {
     if ( build.length === 0 ) {
       errorExit( `***ERROR: the build dir is empty - ${chalk.yellow( 'npm run build' )}` )
     }
-  } catch ( err ) {
+  } catch ( err ) { // eslint-disable-line no-unused-vars
     errorExit( `***ERROR: expected the ${buildDir} directory to exist - ${chalk.yellow( 'npm run build' )}` )
   }
 

package/src/Utils.mjs

@@ -132,7 +132,7 @@ export const shellCmd = async ( cmd, opts = {} ) => {
     } else {
       const parsed = parse( cmd ).filter( x => typeof x === 'string' )
       // the leading ; forces a break from previous line otherwise trailing ) and leading [ collide
-      ;[ command, ...args ] = parsed // eslint-disable-line semi-style
+      ;[ command, ...args ] = parsed // eslint-disable-line @stylistic/semi-style
     }
 
     debug( { command, args }, '<== execa $ invoke' )
@@ -146,6 +146,35 @@ export const shellCmd = async ( cmd, opts = {} ) => {
   }
 }
 
+export const versionChecks = async ( { node, npm, strict = true } = {} ) => {
+  const check = ( tool, raw, { min, preferred, hint } = {} ) => {
+    const current = semver.coerce( raw )
+    if ( !current ) {
+      warning( `could not parse ${tool} version: "${raw}"` )
+      return
+    }
+    debug( { tool, current : current.version, min, preferred, strict }, '<==versionChecks' )
+    const hintSuffix = hint ? ` — ${hint}` : ''
+    if ( min && semver.lt( current, min ) ) {
+      const msg = `${tool} ${min} or later is required (found ${current.version})${hintSuffix}`
+      if ( strict ) {
+        errorExit( `***ERROR: ${msg}` )
+      } else {
+        warning( `${msg} — continuing due to --no-version-check` )
+      }
+    }
+    if ( preferred && semver.lt( current, preferred ) ) {
+      warning( `${tool} ${preferred} or later is preferred (found ${current.version})` )
+    }
+  }
+
+  if ( node ) { check( 'node', process.version, node ) }
+  if ( npm ) {
+    const raw = ( await shellCmd( 'npm --version' ) ).trim()
+    check( 'npm', raw, npm )
+  }
+}
+
 export const establishOauthAccess = async ( registryLocation = 'us-docker.pkg.dev' ) => {
   // gcloud auth print-access-token | helm registry login -u oauth2accesstoken \
   // -p ${password} https://us-docker.pkg.dev
@@ -271,7 +300,7 @@ export const getGitBranchAndUpstream = async () => {
   let upstream = 'no-upstream'
   try {
     upstream = await tryCommand( `git rev-parse --abbrev-ref ${branch}@{u}`, 'getGitUpstream' ) ?? 'no-upstream'
-  } catch ( error ) {}
+  } catch ( error ) {} // eslint-disable-line no-unused-vars
   return { branch, upstream }
 }
 
@@ -710,12 +739,12 @@ export const analyzeRepository = async ( giveGuidance ) => {
   let wsName
   try {
     wsName = await shellCmd( 'npm exec -c pwd -ws' )
-  } catch ( err ) { }
+  } catch ( err ) { } // eslint-disable-line no-unused-vars
 
   let gitRemote
   try {
     gitRemote = await shellCmd( 'git config --get remote.origin.url' )
-  } catch ( err ) { }
+  } catch ( err ) { } // eslint-disable-line no-unused-vars
 
   // TODO: Add in Define VERBOSE_DOCKREATE_NPM="yes" for verbose build logging
   // TODO: Validity check for version and package.json

package/src/bash-funcs

@@ -270,7 +270,7 @@ function sendToSlack() {
   read -rd '' slackmsg<<EOSLACK
 --- $running by \`$account\` in \`$GCP_PROJECT_ID\` @ $dts
 \`$toPost\`
-node `node --version` / `build-tools --version` /  helm `helm version --short`
+node `node --version` / npm `npm --version` / `build-tools --version` /  helm `helm version --short`
 EOSLACK
   send-to-slack --project ${REFRESH_NPM_PROJECT:-leverege-registry} \
                 --config REFRESH_NPM_SLACK_CONFIG \

package/src/build-cnpg-image.mjs

@@ -139,7 +139,7 @@ const buildAndPushImage = async () => {
   const dockerfilePath = path.join( buildDir, 'Dockerfile' )
 
   try {
-    fs.writeFileSync( dockerfilePath, renderedDockerfile )
+    fs.writeFileSync( dockerfilePath, renderedDockerfile ) // eslint-disable-line security/detect-non-literal-fs-filename
 
     log( chalk.yellow( '\nBuilding Docker image...' ) )
     const cloudBuildSubmit = 'gcloud builds submit --project leverege-registry'

package/src/chart-compass.mjs

@@ -96,7 +96,7 @@ if ( args.init ) {
     errorExit( '\n***ERROR: expected to run in the root of a platform-k8s branch - no overwhelm.yaml present' )
   }
 
-  if ( fs.existsSync( args.compass ) ) {
+  if ( fs.existsSync( args.compass ) ) { // eslint-disable-line security/detect-non-literal-fs-filename
     errorExit( `\n***ERROR: ${args.compass} compass file already exists - not overwriting` )
   }
 
@@ -107,12 +107,12 @@ if ( args.init ) {
 
 // simply wraps the YAML read/sync
 const buildCompassMap = ( yamlFile ) => {
-  if ( !fs.existsSync( yamlFile ) ) {
+  if ( !fs.existsSync( yamlFile ) ) { // eslint-disable-line security/detect-non-literal-fs-filename
     debug( `chart-compass file ${yamlFile} does not exist` )
     process.exit( 1 )
   }
 
-  const chartCompass = YAML.load( fs.readFileSync( yamlFile, 'utf8' ) )
+  const chartCompass = YAML.load( fs.readFileSync( yamlFile, 'utf8' ) ) // eslint-disable-line security/detect-non-literal-fs-filename
   return chartCompass
 }
 

package/src/chart-to-registry.mjs

@@ -151,7 +151,7 @@ try {
   } else {
     errorExit( `\n***ERROR: chart ${chartName} version ${chartVersion} already exists` )
   }
-} catch ( error ) {
+} catch ( error ) { // eslint-disable-line no-unused-vars
   debug( `Chart ${chartName} version ${chartVersion} does not exist - proceeding` )
 }
 

package/src/custom-images/bitnami-audits/bitnami-audit.mjs

@@ -123,7 +123,7 @@ const runner = async ( projects ) => {
     log( `Project [${project}]` )
     try {
       await prepareContext( project ) // eslint-disable-line no-await-in-loop
-    } catch ( error ) {
+    } catch ( error ) { // eslint-disable-line no-unused-vars
       log( `Project or context is invalid, skipping [${chalk.redBright( project )}]` )
       continue
     }

package/src/dashboard/DashboardManager.mjs

@@ -59,6 +59,7 @@ export default class DashboardManager {
       // leaf directory — apply JSON files using basename as the Grafana folder name
       const folderName = path.basename( dir )
       for ( const file of jsonFiles ) {
+        // eslint-disable-next-line no-await-in-loop
         const name = await this.#applyDashboard( folderName, path.join( dir, file.name ) )
         if ( name ) applied.add( name )
       }
@@ -79,6 +80,7 @@ export default class DashboardManager {
           .filter( f => f.endsWith( '.json' ) )
 
         for ( const file of files ) {
+          // eslint-disable-next-line no-await-in-loop
           const name = await this.#applyDashboard( folder.name, path.join( dir, folder.name, file ) )
           if ( name ) applied.add( name )
         }
@@ -159,6 +161,7 @@ export default class DashboardManager {
     if ( subDirs.length === 0 ) {
       const folderName = path.basename( dir )
       for ( const file of jsonFiles ) {
+        // eslint-disable-next-line no-await-in-loop
         const name = await this.#applyDashboard( folderName, path.join( dir, file.name ), local )
         if ( name ) applied.add( name )
       }
@@ -168,6 +171,7 @@ export default class DashboardManager {
           .filter( f => f.endsWith( '.json' ) )
 
         for ( const file of files ) {
+        // eslint-disable-next-line no-await-in-loop
           const name = await this.#applyDashboard( folder.name, path.join( dir, folder.name, file ), local )
           if ( name ) applied.add( name )
         }
@@ -259,6 +263,7 @@ export default class DashboardManager {
         continue
       }
       try {
+        // eslint-disable-next-line no-await-in-loop
         await api.deleteNamespacedConfigMap( { name, namespace : this.#namespace } )
         log( chalk.red( `  ✗ pruned ${name}` ) )
       } catch ( e ) {
@@ -290,6 +295,7 @@ export default class DashboardManager {
         continue
       }
       try {
+        // eslint-disable-next-line no-await-in-loop
         await api.deleteNamespacedConfigMap( { name, namespace : this.#namespace } )
         log( chalk.red( `  ✗ pruned (local) ${name}` ) )
       } catch ( e ) {