@leverege/build-tools 2.122.0 → 2.124.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.122.0",
+  "version": "2.124.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -25,6 +25,7 @@
     "chart-compass": "src/chart-compass.mjs",
     "chart-to-registry": "src/chart-to-registry.mjs",
     "clone-cnpg-from-snapshot": "src/clone-cnpg-from-snapshot.mjs",
+    "close-dependabot-prs": "src/close-dependabot-prs.mjs",
     "count-lines-of-code": "src/count-lines-of-code.mjs",
     "dashboard": "src/dashboard/dashboard.mjs",
     "decrypt-secrets": "src/decrypt-secrets.sh",
@@ -103,14 +104,14 @@
     "glob": "^13.0.6",
     "googleapis": "^176.0.0",
     "handlebars": "^4.7.9",
-    "ignore": "^7.0.6",
-    "inquirer": "^14.2.0",
-    "js-yaml": "^4.2.0",
+    "ignore": "^7.0.9",
+    "inquirer": "^14.2.2",
+    "js-yaml": "^4.3.2",
     "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
     "npm-registry-fetch": "^20.0.1",
     "ora": "^9.4.1",
-    "p-limit": "^7.3.1",
+    "p-limit": "^7.3.2",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
     "semver": "^7.8.5",
@@ -127,7 +128,7 @@
     "@leverege/eslint-config-leverege": "^9",
     "chai": "^6.2.2",
     "eslint": "^9",
-    "mocha": "^11.8.0",
+    "mocha": "^12.0.0",
     "npm": "^12.0.2"
   },
   "allowScripts": {

package/src/Utils.mjs

@@ -740,7 +740,7 @@ export const analyzeRepository = async ( giveGuidance ) => {
   }
  
   const containerName = closestPackageJson?.name.replace( /^@[^/]+\//, '' ) || rootPyProjectToml?.project.name
-  const imagePlatform = closestPackageJson?.leverege.imagePlatform || rootPyProjectToml?.leverege['image-platform'] || [ 'linux/amd64' ]
+  const imagePlatform = closestPackageJson?.leverege.imagePlatform || rootPyProjectToml?.leverege['image-platform'] || [ 'linux/amd64', 'linux/arm64' ]
   const artifactRegistry = closestPackageJson?.leverege.registry || rootPyProjectToml?.leverege.registry
   const artifactProject = closestPackageJson?.artifactRegistry.project || rootPyProjectToml?.artifactRegistry.project || 'unknown'
   const packageVersion = `v${closestPackageJson?.version || rootPyProjectToml?.project.version}`

package/src/build-cnpg-image.mjs

@@ -85,6 +85,22 @@ const LEVEREGE_REGISTRY = 'us-docker.pkg.dev/leverege-registry/system/images/lev
 const LEVEREGE_IMAGE_TAG = `${PG_VERSION}-cnpg-lvrg-${subTag}`
 const LEVEREGE_IMAGE_NAME_WITH_TAG = `${LEVEREGE_REGISTRY}:${LEVEREGE_IMAGE_TAG}`
 
+const CLOUDBUILD_YAML_TEMPLATE = `steps:
+  - name: 'gcr.io/cloud-builders/docker'
+    entrypoint: bash
+    args:
+      - '-c'
+      - |
+        docker run --privileged --rm tonistiigi/binfmt --install all
+        docker buildx create --use --name builder --driver docker-container
+        docker buildx inspect --bootstrap
+        docker buildx build \\
+          --platform linux/amd64,linux/arm64 \\
+          --tag {{IMAGE_TAG}} \\
+          --push \\
+          /workspace
+`
+
 const DOCKERFILE_TEMPLATE = `
 FROM ghcr.io/cloudnative-pg/postgresql:{{PG_VERSION}}-bookworm
 
@@ -130,22 +146,27 @@ const checkExistingImage = async ( imageName ) => {
 
 // Build and push Docker image
 const buildAndPushImage = async () => {
-  const template = Handlebars.compile( DOCKERFILE_TEMPLATE )
-  const renderedDockerfile = template( { PG_VERSION } )
-  debug( { renderedDockerfile }, '<==Dockerfile' )
+  const dockerfileTemplate = Handlebars.compile( DOCKERFILE_TEMPLATE )
+  const cloudbuildTemplate = Handlebars.compile( CLOUDBUILD_YAML_TEMPLATE )
+
+  const renderedDockerfile = dockerfileTemplate( { PG_VERSION } )
+  const renderedCloudbuild = cloudbuildTemplate( { IMAGE_TAG : LEVEREGE_IMAGE_NAME_WITH_TAG } )
+  debug( { renderedDockerfile, renderedCloudbuild }, '<==Build files' )
 
   // Create a temporary directory to build from
   const buildDir = fs.mkdtempSync( path.join( os.tmpdir(), 'docker-build-' ) )
   const dockerfilePath = path.join( buildDir, 'Dockerfile' )
+  const cloudbuildPath = path.join( buildDir, 'cloudbuild.yaml' )
 
   try {
     fs.writeFileSync( dockerfilePath, renderedDockerfile ) // eslint-disable-line security/detect-non-literal-fs-filename
+    fs.writeFileSync( cloudbuildPath, renderedCloudbuild ) // eslint-disable-line security/detect-non-literal-fs-filename
 
-    log( chalk.yellow( '\nBuilding Docker image...' ) )
+    log( chalk.yellow( '\nBuilding Docker image (multi-arch: linux/amd64, linux/arm64)...' ) )
     const cloudBuildSubmit = 'gcloud builds submit --project leverege-registry'
     const cloudBuildLog = '--gcs-log-dir gs://leverege-registry_cloudbuild/log'
-    const imageTag = `--tag ${LEVEREGE_IMAGE_NAME_WITH_TAG}`
-    await shellCmd( `${cloudBuildSubmit} ${cloudBuildLog} ${imageTag} ${buildDir}`, { stdio : 'inherit' } )
+    const configFlag = `--config ${cloudbuildPath}`
+    await shellCmd( `${cloudBuildSubmit} ${cloudBuildLog} ${configFlag} ${buildDir}`, { stdio : 'inherit' } )
   } finally {
     // Ensure cleanup even if the build fails
     fs.rmSync( buildDir, { recursive : true, force : true } )

package/src/close-dependabot-prs.mjs

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+
+import { $ } from 'zx'
+import { program } from 'commander'
+import chalk from 'chalk'
+
+import { enableDebug, errorExit, log } from './Utils.mjs'
+
+$.verbose = false
+
+const DEFAULT_OWNER = 'Leverege'
+
+const COMMENT = (
+  'Closing in favor of the new grouped Dependabot config (patch/minor ' +
+  'updates now batch into a single PR). Not a rejection of this specific ' +
+  'bump - Dependabot will re-propose it as part of a grouped PR on its ' +
+  'next scan.'
+)
+
+const TITLE_RE = /^Bump (\S+) from (\S+) to (\S+)$/
+
+program
+  .name( 'close-dependabot-prs' )
+  .description( chalk.green( 'Close open Dependabot PRs superseded by a newly-grouped dependabot.yml config' ) )
+  .argument( '<repos...>', 'repo names - bare name uses --owner, or pass owner/repo to override' )
+  .option( '--owner <name>', 'GitHub org/owner for bare repo names', DEFAULT_OWNER )
+  .option( '--dry-run', 'show what would be closed without closing anything' )
+  .option( '--debug', 'Enable debug logging' )
+  .addHelpText( 'after', `
+${chalk.yellow( 'Examples:' )}
+  ${chalk.green( 'close-dependabot-prs array-util base62-util' )}
+  ${chalk.green( 'close-dependabot-prs --dry-run cache' )}
+  ${chalk.green( 'close-dependabot-prs --owner SomeOtherOrg some-repo' )}
+
+${chalk.yellow( 'Notes:' )}
+  Closes open Dependabot PRs that are superseded by a newly-added groups:
+  config in dependabot.yml (patch/minor updates now batch into one PR).
+  Leaves major-version PRs open, since they aren't covered by grouping and
+  closing them risks Dependabot never re-proposing that exact version.
+
+  Skips any repo whose dependabot.yml has no groups: block at all - closing
+  PRs there would lose them rather than get them re-proposed.
+
+  Requires the gh CLI, authenticated.
+` )
+  .parse()
+
+const opts = program.opts()
+if ( opts.debug ) { enableDebug(); $.verbose = true }
+
+const repos = program.args.map( repo => ( repo.includes( '/' ) ? repo : `${opts.owner}/${repo}` ) )
+
+if ( repos.length === 0 ) {
+  errorExit( 'No repos provided.' )
+}
+
+// ---------- Helpers ----------
+
+async function hasGroupingConfigured( repo ) {
+  let stdout
+  try {
+    ( { stdout } = await $`gh api repos/${repo}/contents/.github/dependabot.yml --jq .content` )
+  } catch {
+    return null // couldn't fetch - treat as unknown, caller should skip
+  }
+  const content = Buffer.from( stdout.trim(), 'base64' ).toString( 'utf8' )
+  return content.includes( 'groups:' )
+}
+
+function versionTuple( v ) {
+  const m = v.match( /^(\d+(?:\.\d+)*)/ )
+  if ( !m ) return null
+  return m[1].split( '.' ).map( Number )
+}
+
+function classifyBump( fromV, toV ) {
+  const a = versionTuple( fromV )
+  const b = versionTuple( toV )
+  if ( !a || !b ) return 'unknown'
+  const length = Math.max( a.length, b.length )
+  while ( a.length < length ) a.push( 0 )
+  while ( b.length < length ) b.push( 0 )
+  if ( a[0] !== b[0] ) return 'major'
+  if ( a.length > 1 && a[1] !== b[1] ) return 'minor'
+  return 'patch'
+}
+
+async function openDependabotPrs( repo ) {
+  const { stdout } = await $`gh pr list --repo ${repo} --state open --search head:dependabot --json number,title,headRefName`
+  return JSON.parse( stdout )
+}
+
+async function processRepo( repo, dryRun ) {
+  log( `\n=== ${repo} ===` )
+  const grouped = await hasGroupingConfigured( repo )
+  if ( grouped === null ) {
+    log( '  ! could not read .github/dependabot.yml - skipping' )
+    return
+  }
+  if ( !grouped ) {
+    log(
+      '  ! no `groups:` block found in dependabot.yml - skipping ' +
+      '(closing PRs here would lose them, not get them re-proposed)'
+    )
+    return
+  }
+
+  const prs = await openDependabotPrs( repo )
+  if ( prs.length === 0 ) {
+    log( '  no open dependabot PRs' )
+    return
+  }
+
+  let closedCount = 0
+  let keptCount = 0
+  let skippedCount = 0
+
+  for ( const pr of prs ) {
+    const m = pr.title.match( TITLE_RE )
+    if ( !m ) {
+      skippedCount++
+      log( `  skip   #${pr.number} (title didn't match expected pattern) ${pr.title}` )
+      continue
+    }
+    const [ , , fromV, toV ] = m
+    const bumpType = classifyBump( fromV, toV )
+    if ( bumpType === 'patch' || bumpType === 'minor' ) {
+      closedCount++
+      log( `  close  #${String( pr.number ).padEnd( 4 )} ${bumpType.padEnd( 7 )} ${pr.title}` )
+      if ( !dryRun ) {
+        // eslint-disable-next-line no-await-in-loop
+        await $`gh pr close ${pr.number} --repo ${repo} --comment ${COMMENT}`
+      }
+    } else {
+      keptCount++
+      log( `  keep   #${String( pr.number ).padEnd( 4 )} ${bumpType.padEnd( 7 )} ${pr.title}` )
+    }
+  }
+
+  log( `  -> ${closedCount} closed, ${keptCount} left open (major), ${skippedCount} skipped` )
+}
+
+// ---------- Run ----------
+
+for ( const repo of repos ) {
+  // eslint-disable-next-line no-await-in-loop
+  await processRepo( repo, opts.dryRun )
+}