@leverege/build-tools 2.104.0 → 2.105.0

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="85.0.2"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="85.3.3"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -223,6 +223,8 @@ alertmanager:
             color: >-
               {{- if eq .Status "resolved" -}}
                 good
+              {{- else if eq .CommonLabels.severity "page" -}}
+                danger
               {{- else if eq .CommonLabels.severity "critical" -}}
                 danger
               {{- else if eq .CommonLabels.severity "warning" -}}
@@ -287,12 +289,28 @@ alertmanager:
       - name: opsgenie
         opsgenie_configs:
           - api_key: "${OPSGENIE_APIKEY}"
+            send_resolved: true
+            message: '{{ .CommonLabels.alertname }}{{ if .CommonLabels.namespace }} [{{ .CommonLabels.namespace }}]{{ end }}'
+            source: "${PROJECT_NAME} / ${CLUSTER_NAME}"
+            entity: '{{ if .CommonLabels.app }}{{ .CommonLabels.app }}{{ else }}{{ .CommonLabels.namespace }}{{ end }}'
             priority: "{{ .CommonLabels.priority }}"
-            tags: "{{ range .Alerts }}{{ .Labels.severity }},{{ end }}"
+            tags: "{{ range $i, $a := .Alerts }}{{ if $i }},{{ end }}{{ $a.Labels.severity }}{{ end }}"
+            details:
+              namespace: "{{ .CommonLabels.namespace }}"
+              alertname: "{{ .CommonLabels.alertname }}"
+              app: "{{ .CommonLabels.app }}"
+              severity: "{{ .CommonLabels.severity }}"
+              cluster: "${CLUSTER_NAME}"
+              project: "${PROJECT_ID}"
             description: |-
               {{ range .Alerts }}
-                *Alert:* {{ .Annotations.summary }} - `{{ .Labels.severity }}`
+                *Project:* ${PROJECT_NAME}
+                *Cluster:* ${CLUSTER_NAME}
+                *Alert:* {{ .Annotations.summary }} - {{ .Labels.severity }}
                 *Description:* {{ .Annotations.description }}
+                {{- if .Annotations.runbook_url }}
+                *Runbook:* {{ .Annotations.runbook_url }}
+                {{- end }}
                 *Dashboard:* {{ .Annotations.dashboard }}
               {{ end }}
 
@@ -363,3 +381,7 @@ alertmanager:
             - severity="page" # 📢 paging DevOps
           receiver: opsgenie
           continue: true # 👈 KEEP GOING to slack
+
+        - matchers:
+            - severity="page"
+          receiver: slack

package/src/helm-charts/prom-operator/rules/cnpg-rules.yaml

@@ -3,6 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   name: cnpg-rules
+  namespace: prometheus
 spec:
   groups:
   - name: CNPG
@@ -93,7 +94,7 @@ spec:
 
     - alert: PostgresqlRestarted
       expr: time() - cnpg_pg_postmaster_start_time < 60
-      for: 0m
+      for: 2m
       labels:
         severity: critical
       annotations:

package/src/helm-charts/prom-operator/test-alert.yaml

@@ -15,7 +15,7 @@ spec:
           expr: vector(1)  # This will always be true, triggering the alert
           for: 1m  # Alert if condition is true for 1 minute
           labels:
-            severity: warning
+            severity: page # warning
           annotations:
             summary: "Test Alert for Slack"
             description: "This is a test alert to verify the Slack receiver configuration."

package/src/refresh-npm-token.mjs

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 /*
- * refresh-npm-token will check the access time of the $HOME/.npmrc npm token
- * file and if it is older than 24 hours then it will be updated to whatever
- * value is currently in the NPM_DEVELOPER_SECRET on leverege-artifacts. It
- * will also check to see if the deprecated $HOME/.npmrc.ro file exists and
- * will suggest to the user to remove it. If either of the token files exist
- * the first 6 and last four characters of the token will be extracted and
- * reported via slack to allow DevOps operators to clean up old tokens in npm.
+ * refresh-npm-token checks the modification time of $HOME/.npmrc and if it
+ * is older than the configured age threshold, fetches three secrets from GCP
+ * Secret Manager: the raw npm token (REFRESH_NPM_TOKEN) and two rc file
+ * templates (REFRESH_NPM_NPMRC, REFRESH_NPM_YARNRC). The ${REFRESH_NPM_TOKEN}
+ * placeholder in each template is replaced with the live token and the result
+ * is written to ~/.npmrc and ~/.yarnrc.yml, giving DevOps full control over
+ * both files.
  *
- * For testing the Unix touch command may be used to modify the access access
- * time of the npmrc token or the --force switch to ignore the age of the file.
+ * For testing, the Unix touch command may be used to modify the modification
+ * time of ~/.npmrc or the --force switch may be used to ignore the age check.
  * The BUILD_TOOLS_DEBUG env variable may also be set to enable debugging and
- * disable the slack channel spam.
+ * disable the slack channel notifications.
  *
  * touch -d 2023-08-20 ~/.npmrc; BUILD_TOOLS_DEBUG=1 refresh-npm-token.mjs
  */
@@ -21,210 +21,135 @@ import fs from 'node:fs'
 import os from 'node:os'
 
 import chalk from 'chalk'
-import commandLineArgs from 'command-line-args'
-import commandLineUsage from 'command-line-usage'
+import { program } from 'commander'
 import ms from 'ms'
-import { lt as semverLt } from 'semver'
-import YAML from 'js-yaml'
 
-import { debug, log, shellCmd, touchFile } from './Utils.mjs'
-
-const AUTH_TOKEN_REGEX = /_authToken=(.+)/
-const YARNRC_FILE_NAME = `${os.homedir()}/.yarnrc.yml`
-
-const refreshTokenOptions = [ // Use refreshTokenOptions to tie into the Usage statements
-  {
-    name : 'project',
-    type : String,
-    default : false,
-    description : '{green the name of the google project containing the npmrc and slack config secrets (default leverege-registry)}',
-  },
-  {
-    name : 'npmrc-age',
-    type : String,
-    default : '24h',
-    description : '{green the age of the local ~/.npmrc file before a refetch is performed (default 24h)}'
-  },
-  {
-    name : 'force',
-    type : Boolean,
-    default : false,
-    description : '{green ignores age of the ~/.npmrc file and always fetches}',
-  },
-  {
-    name : 'dry-run',
-    type : Boolean,
-    default : false,
-    description : '{green performs sanity checks on the settings / environment without updating ~/.npmrc}',
-  },
-  {
-    name : 'help',
-    type : Boolean,
-    default : false,
-    description : '{green display this help screen}',
-  },
-  {
-    name : 'update-yarnrc',
-    type : Boolean,
-    defaultValue : true,
-    description : '{green updates the npmAuthToken variable of your .yarnrc.yml file (in addition to .npmrc/.npmrc.ro)}'
-  }
-]
-
-const sections = [
-  {
-    header : 'Leverege NPM Token Refresher',
-    content : `{green This tool helps you retrieve an npmrc file stored in a secret within a GCP
-Secret Manager. It enables NPM administrators to manage a single NPM token
-for use by a development team. The tool checks the age of your local ~/.npmrc
-file, and if it exceeds the specified --npmrc-age setting, it will fetch the
-secret, overwriting the existing ~/.npmrc file.
-
-This tool may be invoked directly from the command line, or from scripts in
-the build-tools repository. For example, helmup will invoke this command for
-refreshing the token and to provide an audit log to slack when deployments
-are made.}`
-  },
-  { header : 'Options',
-    optionList : refreshTokenOptions,
-  },
-  {
-    header : 'Secret Manager Secrets (required)',
-    content : [
-      '{bold REFRESH_NPM_NPMRC}    {green full npmrc file with a valid token}',
-      `{green     ;;;;
-    ; lines that start with semi-colons are comments
-    ; run "npm help 7 config" for documentation of the various options
-    ;
-    ; expires on 11/20/23
-    //registry.npmjs.org/:_authToken=<a valid npm token goes here>
+import { debug, log, shellCmd, versionChecks } from './Utils.mjs'
+
+const MIN_NODE_VERSION = '22.0.0'
+const MIN_NPM_VERSION = '11.10.0'
+
+const NPMRC_FILE = `${os.homedir()}/.npmrc`
+const YARNRC_FILE = `${os.homedir()}/.yarnrc.yml`
+
+program
+  .name( 'refresh-npm-token' )
+  .description( chalk.green( `Fetches the current npm token and rc file templates from GCP Secret Manager
+and overwrites ~/.npmrc and ~/.yarnrc.yml. DevOps controls the full content
+of both rc files via the template secrets, ensuring consistent security
+policies (e.g. npmMinimalAgeGate) across all developer machines.
+
+Run automatically via helmup or directly from the command line. The tool
+exits silently if the local ~/.npmrc is younger than the configured age.` ) )
+  .option( '--project <id>', 'GCP project containing the token and rc template secrets', process.env.REFRESH_NPM_PROJECT || 'leverege-registry' )
+  .option( '--npmrc-age <duration>', 'age of ~/.npmrc before a refresh is triggered (default 24h)', '24h' )
+  .option( '--force', 'ignore file age and always fetch' )
+  .option( '--beta', 'use the _BETA suffix on the rc templates for testing' )
+  .option( '--dry-run', 'fetch and validate secrets without overwriting local rc files' )
+  .option( '--no-update-yarnrc', 'skip writing the REFRESH_NPM_YARNRC template to ~/.yarnrc.yml' )
+  .option( '--no-version-check', 'warn on version requirements but do not exit' )
+  .addHelpText( 'after', `
+${chalk.bold( 'Secret Manager Secrets (required)' )}
+
+  ${chalk.bold( 'REFRESH_NPM_TOKEN' )}        ${chalk.green( 'the raw npm token used to authenticate with the npm registry' )}
+  ${chalk.bold( 'REFRESH_NPM_NPMRC' )}        ${chalk.green( 'complete ~/.npmrc template — use ${REFRESH_NPM_TOKEN} as the token placeholder' )}
+  ${chalk.green( `    e.g.
+    //registry.npmjs.org/:_authToken=\${REFRESH_NPM_TOKEN}
     loglevel=error
     progress=true
 
     init.license=SEE LICENSE IN LICENSE.md
-    init.private=true
+    init.private=true` )}
+  ${chalk.bold( 'REFRESH_NPM_YARNRC' )}       ${chalk.green( 'complete ~/.yarnrc.yml template — use ${REFRESH_NPM_TOKEN} as the token placeholder' )}
+  ${chalk.green( `    e.g.
+    # Don't allow installing dependencies published less than this setting
+    npmMinimalAgeGate: 1d
+    npmAuthToken: \${REFRESH_NPM_TOKEN}` )}
 
-  There may be times when a token is expired, lost or a new developer needs
-  to seed their ~/.npmrc file for the first time. Help a brother out and let
-  them know to run this command to fetch the current npmrc file:
+  ${chalk.bold( 'REFRESH_NPM_NPMRC_BETA' )}   ${chalk.yellow( 'same as REFRESH_NPM_NPMRC, used when --beta is set' )}
+  ${chalk.bold( 'REFRESH_NPM_YARNRC_BETA' )}  ${chalk.yellow( 'same as REFRESH_NPM_YARNRC, used when --beta is set' )}
 
-    gcloud secrets versions access latest \\
-         --secret=REFRESH_NPM_NPMRC       \\
-         --project=leverege-registry > ~/.npmrc
+  ${chalk.bold( 'REFRESH_NPM_SLACK_CONFIG' )}  ${chalk.green( `resembles the following JSON struct
+    {
+      "url" : "https://hooks.slack.com/services/T....H/Bx....1/44....gLr7",
+      "channel" : "#some-devops-channel"
+    }` )}
 
-  Note, ^^that command will need a different --project name for non-leverege
-  developers.
-      }`,
-      `{bold REFRESH_NPM_SLACK_CONFIG} {green resembles the following JSON struct
-  \\{
-    "url" : "https://hooks.slack.com/services/T....H/Bx....1/44....gLr7",
-    "channel" : "#some-devops-channel"
-  \\} }`
-    ],
-  },
-  { header : 'Environment Variables (optional)',
-    content : `{bold REFRESH_NPM_PROJECT}  {green may be used in lieu of --project
-    }`,
-  },
-]
+${chalk.bold( 'Environment Variables (optional)' )}
 
-const args = commandLineArgs( refreshTokenOptions, { camelCase : true, partial : true } )
-const usage = commandLineUsage( sections )
+  ${chalk.bold( 'REFRESH_NPM_PROJECT' )}  ${chalk.green( 'may be used in lieu of --project' )}
+` )
+  .parse()
 
-if ( args.help ) {
-  log( usage )
-  process.exit( 0 )
-}
+const opts = program.opts()
+const gcpProject = opts.project
 
-/* eslint-disable no-underscore-dangle */
-if ( args._unknown ) {
-  log( usage )
-  log( `\nUnrecognized argument [${chalk.bold.red( args._unknown )}]\n` )
-  process.exit( 1 )
-}
-/* eslint-enable no-underscore-dangle */
-
-const gcpProject = args.project ? args.project : process.env.REFRESH_NPM_PROJECT || 'leverege-registry'
-
-if ( semverLt( process.version, '18.0.0' ) ) {
-  log( chalk.red( '\n\n***ERROR: must be running at least node 18\n' ) )
-  process.exit( 1 )
-}
+await versionChecks( {
+  node   : { min : MIN_NODE_VERSION },
+  npm    : { min : MIN_NPM_VERSION, hint : 'required for npmMinimalAgeGate support' },
+  strict : opts.versionCheck,
+} )
 
 // max age in seconds of the npmrc file before refresh
-const refreshThreshold = ms( args.npmrcAge || '24h' ) / 1000 // 1 day of seconds
+const refreshThreshold = ms( opts.npmrcAge || '24h' ) / 1000
 if ( refreshThreshold < 60 ) {
   log( chalk.yellow.bold( `
-***WARNING the npmrc-age of ${args.npmrcAge} results in an age threshold of ${refreshThreshold} seconds
+***WARNING the npmrc-age of ${opts.npmrcAge} results in an age threshold of ${refreshThreshold} seconds
            try using 24h for one day or 60m for an hour
 ` ) )
 }
 
-// used to pull the sanitized token [npm_mQZ0......Xmvp] reference from the npmrc file
-const fetchToken = ( filename ) => {
-  const results = {
-    filename,
-    exists : false,
-    token : 'none',
-    lastUpdated : -1
-  }
-
+const getNpmrcAge = () => {
   try {
-    if ( fs.existsSync( filename ) ) {
-      results.exists = true
-      const stat = fs.statSync( filename )
-      results.lastUpdated = Math.trunc( ( Date.now() - stat.mtimeMs ) / 1000 )
-      // grab the current token for logging a redacted version
-      const currentNpmrc = fs.readFileSync( filename, 'utf8' )
-      const found = currentNpmrc.match( /_authToken=(.*)\n/ )
-      if ( found ) {
-        results.token = `${found[1].slice( 0, 8 )}......${found[1].slice( -4 )}`
-      }
-    }
-  } catch ( statErr ) {
-    log( { statErr }, `<==fs.statSync failed on file ${filename}` )
+    if ( !fs.existsSync( NPMRC_FILE ) ) return Infinity
+    const stat = fs.statSync( NPMRC_FILE )
+    return Math.trunc( ( Date.now() - stat.mtimeMs ) / 1000 )
+  } catch {
+    return Infinity
   }
-
-  return results
 }
 
-// fetch the tokens - note the RO token is deprecated and might not exist
-const npmrc = fetchToken( `${os.homedir()}/.npmrc` )
-const npmrcRo = fetchToken( `${os.homedir()}/.npmrc.ro` )
-
-debug( { npmrc, npmrcRo }, '<==Your current tokens' ) // debug
+debug( { npmrcAge : getNpmrcAge(), refreshThreshold }, '<==Age check' )
 
 // skip file age check if this is a dry or forced run
-if ( !args.dryRun && !args.force ) {
-  if ( npmrc.exists && npmrc.lastUpdated < refreshThreshold ) { process.exit( 0 ) }
+if ( !opts.dryRun && !opts.force ) {
+  if ( getNpmrcAge() < refreshThreshold ) { process.exit( 0 ) }
 }
 
 const getGcpSecretCommand = ( secretName ) => {
   return `gcloud secrets versions access latest --project=${gcpProject} --secret=${secretName}`
 }
 
-// fetch the contents of the npmrc secret file stored on the specified project
-let npmrcFile
-let npmAuthToken
+// fetch the token and both rc file templates from Secret Manager
+let token
+let npmrcTemplate
+let yarnrcTemplate
 try {
-  const npmTokenFetcher = getGcpSecretCommand( 'REFRESH_NPM_NPMRC' )
-  debug( { npmTokenFetcher }, '<==Secret Fetcher' )
-
-  npmrcFile = await shellCmd( npmTokenFetcher )
-  npmAuthToken = npmrcFile.match( AUTH_TOKEN_REGEX )?.[1]
-  debug( { npmAuthToken }, '<==npmAuthToken' )
-  debug( { npmrcFile }, '<==shellCmd Output npmrc file' )// debug
+  const betaSuffix = opts.beta ? '_BETA' : ''
+  const tokenFetcher = getGcpSecretCommand( 'REFRESH_NPM_TOKEN' )
+  const npmrcFetcher = getGcpSecretCommand( `REFRESH_NPM_NPMRC${betaSuffix}` )
+  const yarnrcFetcher = getGcpSecretCommand( `REFRESH_NPM_YARNRC${betaSuffix}` )
+  debug( { tokenFetcher, npmrcFetcher, yarnrcFetcher }, '<==Secret fetchers' )
+
+  token = ( await shellCmd( tokenFetcher ) ).trim()
+  npmrcTemplate = await shellCmd( npmrcFetcher )
+  yarnrcTemplate = await shellCmd( yarnrcFetcher )
+  debug( { token : `${token.slice( 0, 8 )}......${token.slice( -4 )}` }, '<==Token (redacted)' )
 } catch ( err ) {
   log( chalk.yellow( `\nFailed Command => [${err.escapedCommand}]\n\n` ), chalk.red( err.stderr ) )
   process.exit( 1 )
 }
 
+// substitute ${REFRESH_NPM_TOKEN} placeholder in both templates
+const npmrcContent = npmrcTemplate.replaceAll( '${REFRESH_NPM_TOKEN}', () => token )
+const yarnrcContent = yarnrcTemplate.replaceAll( '${REFRESH_NPM_TOKEN}', () => token )
+
 // fetch and parse the slack config for audits
 const slackSecretName = 'REFRESH_NPM_SLACK_CONFIG'
 let slackConfig
 try {
   const slackConfigFetcher = getGcpSecretCommand( slackSecretName )
-  const slackSecret = await shellCmd( slackConfigFetcher ) 
+  const slackSecret = await shellCmd( slackConfigFetcher )
   slackConfig = JSON.parse( slackSecret )
   debug( { slackSecretName, slackConfig, slackConfigFetcher }, `<==shellCmd Output ${slackSecretName}` )
 } catch ( err ) {
@@ -236,29 +161,27 @@ try {
   process.exit( 1 )
 }
 
-// update the user's npmrc file if this isn't a dry run
+// play nice and capture legacy rc file if it doesn't already exist
+const captureLegacyRc = ( file ) => {
+  if ( fs.existsSync( file ) && !fs.existsSync( `${file}.LEGACY` ) ) {
+    fs.renameSync( file, `${file}.LEGACY` )
+    log( chalk.yellow( `    preserved ${file} as ${file}.LEGACY` ) )
+  }
+}
+
+// overwrite the local rc files unless this is a dry run
 try {
-  if ( args.dryRun ) {
-    log( chalk.yellow( '\n*** Dry Run - files will not be updated' ) )
+  if ( opts.dryRun ) {
+    log( chalk.yellow( '\n*** Dry Run - local rc files will not be updated' ) )
   } else {
-    const { filename } = npmrc
-    log( chalk.yellow( '\n*** Refreshing your ~/.npmrc npm token file' ) )
-    if ( fs.existsSync( filename ) ) {
-      fs.copyFileSync( filename, `${filename}-BAK` ) // make a backup for safety
-    }
-    fs.writeFileSync( filename, npmrcFile )
+    log( chalk.yellow( '\n*** Refreshing ~/.npmrc and ~/.yarnrc.yml' ) )
 
-    if ( args.updateYarnrc && npmAuthToken ) {
-      if ( !fs.existsSync( YARNRC_FILE_NAME ) ) {
-        touchFile( YARNRC_FILE_NAME ) // create the file if it doesn't exist to avoid js-yaml errors
-      } else {
-        fs.copyFileSync( YARNRC_FILE_NAME, `${YARNRC_FILE_NAME}-BAK` )
-      }
-      const yarnRcContent = YAML.load( fs.readFileSync( YARNRC_FILE_NAME, 'utf-8' ) ) || { npmAuthToken : 'none' }
-      debug( { yarnRcContent }, '<==yarnrc content' )
-      yarnRcContent.npmAuthToken = npmAuthToken
+    captureLegacyRc( NPMRC_FILE )
+    fs.writeFileSync( NPMRC_FILE, npmrcContent )
 
-      fs.writeFileSync( YARNRC_FILE_NAME, YAML.dump( yarnRcContent ) )
+    if ( opts.updateYarnrc ) {
+      captureLegacyRc( YARNRC_FILE )
+      fs.writeFileSync( YARNRC_FILE, yarnrcContent )
     }
   }
 } catch ( fileErr ) {
@@ -267,14 +190,15 @@ try {
 }
 
 // slack out the details to the configured channel
+const redactedToken = `${token.slice( 0, 8 )}......${token.slice( -4 )}`
 const now = ( new Date() ).toLocaleString()
 const account = await shellCmd( 'gcloud config get account' )
 const slackData = {
-  text : `--- npmrc refreshed by \`${account}\` at ${now}\n     tokens RW [\`${npmrc.token}\`] RO [\`${npmrcRo.token}\`]`,
+  text : `--- npmrc refreshed by \`${account}\` at ${now}\n     token [\`${redactedToken}\`]`,
   channel : slackConfig.channel,
 }
 
-if ( process.env.BUILD_TOOLS_DEBUG || args.dryRun ) {
+if ( process.env.BUILD_TOOLS_DEBUG || opts.dryRun ) {
   log( { slackConfig, slackData }, '<==Slack skipped' )
 } else {
   try {
@@ -290,8 +214,3 @@ if ( process.env.BUILD_TOOLS_DEBUG || args.dryRun ) {
     log( { fetchError }, chalk.red( '\n\n***ERROR: fetch call failed\n' ) )
   }
 }
-
-if ( npmrcRo.exists ) {
-  log( chalk.red( '\nWARNING - the need for the ~/.npmrc.ro file has been eliminated - please remove' ) )
-  process.exit( 1 )
-}