@leverege/build-tools 2.113.4 → 2.113.5-pedro.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.113.4",
+  "version": "2.113.5-pedro.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {

package/src/bash-funcs

@@ -120,6 +120,18 @@ function getManagedSecret() {
   echo "$SECRET"
 }
 
+# Fail fast when gcloud cannot mint tokens. Downstream tools capture gcloud
+# output, so reauthentication cannot prompt there; surfacing it here lets
+# gcloud reauth interactively on the TTY when policy allows. stdout goes to a
+# literal /dev/null (NOT $DEVNULL, which is /dev/stderr in debug mode) so the
+# access tokens are never printed.
+function errorIfStaleGcloudAuth() {
+  gcloud auth print-access-token > /dev/null
+  exitOnError $? "GCP credentials expired. Please run: `color g 'gcloud auth login'`"
+  gcloud auth application-default print-access-token > /dev/null
+  exitOnError $? "GCP application-default credentials expired. Please run: `color g 'gcloud auth application-default login'`"
+}
+
 function getProjectIdFromK8sContext() {
   local currContext=`kubectl config current-context`
 

package/src/helmup.sh

@@ -85,6 +85,9 @@ BAD_IDEA
   exit 1
 fi
 
+# stop here rather than half way through a deploy if the creds cannot mint tokens
+errorIfStaleGcloudAuth
+
 # artifact-registry => https://console.cloud.google.com/artifacts?project=leverege-registry
 REGISTRY_DOMAIN="us-docker.pkg.dev"
 # open container initiative (oci) => https://opencontainers.org/
@@ -95,6 +98,7 @@ gcloud auth application-default print-access-token | helm registry login \
 
 # make sure we have a current npmrc file
 refresh-npm-token
+exitOnError $? "refresh-npm-token failed - the rc files were not refreshed"
 
 # removed geotile-server from standard platform 3/20/22 - low usage
 PLATFORM=(