@leverege/build-tools 2.124.1 → 2.126.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.124.1",
+  "version": "2.126.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -102,21 +102,21 @@
     "execa": "^10.0.1",
     "find-yarn-workspace-root": "^2.0.0",
     "glob": "^13.0.6",
-    "googleapis": "^181.0.0",
+    "googleapis": "^182.0.0",
     "handlebars": "^4.7.9",
-    "ignore": "^7.0.9",
+    "ignore": "^7.0.10",
     "inquirer": "^14.2.2",
     "js-yaml": "^4.3.2",
     "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
     "npm-registry-fetch": "^20.0.1",
     "ora": "^9.4.1",
-    "p-limit": "^7.3.2",
+    "p-limit": "^7.3.3",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
     "semver": "^7.8.5",
     "shell-quote": "^1.10.0",
-    "simple-git": "^3.36.0",
+    "simple-git": "^4.0.2",
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
     "tmp": "^0.2.7",
@@ -125,11 +125,11 @@
     "zx": "^8.8.5"
   },
   "devDependencies": {
-    "@leverege/eslint-config-leverege": "^9",
+    "@leverege/eslint-config-leverege": "^10",
     "chai": "^6.2.2",
-    "eslint": "^9",
-    "mocha": "^12.0.1",
-    "npm": "^12.0.2"
+    "eslint": "^10",
+    "mocha": "^12.0.2",
+    "npm": "^12.1.0"
   },
   "allowScripts": {
     "unrs-resolver@1.12.2": true

package/src/Utils.mjs

@@ -322,7 +322,7 @@ export const parseYamlFile = async ( filePath ) => {
     const fileContent = await fs.promises.readFile( filePath, 'utf8' ) /* eslint-disable-line security/detect-non-literal-fs-filename */
     return YAML.load( fileContent )
   } catch ( error ) {
-    throw new Error( `Failed to parse YAML file ${filePath}: ${error.message}` )
+    throw new Error( `Failed to parse YAML file ${filePath}: ${error.message}`, { cause : error } )
   }
 }
 
@@ -334,7 +334,7 @@ export const parseJsonFile = async ( jsonFile ) => {
     const json = JSON.parse( fs.readFileSync( jsonFile, 'utf8' ) )  
     return json
   } catch ( error ) {
-    throw new Error( `${error} in ${jsonFile}` )
+    throw new Error( `${error} in ${jsonFile}`, { cause : error } )
   }
 }
 

package/src/chart-compass.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /*
- * chart-to-registry will use a chart 
+ * chart-to-registry will use a chart
  */
 import fs from 'node:fs'
 

package/src/close-dependabot-prs.mjs

@@ -3,6 +3,7 @@
 import { $ } from 'zx'
 import { program } from 'commander'
 import chalk from 'chalk'
+import semver from 'semver'
 
 import { enableDebug, errorExit, log } from './Utils.mjs'
 
@@ -10,14 +11,21 @@ $.verbose = false
 
 const DEFAULT_OWNER = 'Leverege'
 
-const COMMENT = (
+const GROUPED_COMMENT = (
   'Closing in favor of the new grouped Dependabot config (patch/minor ' +
   'updates now batch into a single PR). Not a rejection of this specific ' +
   'bump - Dependabot will re-propose it as part of a grouped PR on its ' +
   'next scan.'
 )
 
+const SATISFIED_COMMENT = (
+  'Closing because the target branch already declares a version that ' +
+  'satisfies this bump (it was applied through a different PR). Not a ' +
+  'rejection of this specific bump.'
+)
+
 const TITLE_RE = /^Bump (\S+) from (\S+) to (\S+)$/
+const DEP_SECTIONS = [ 'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies' ]
 
 program
   .name( 'close-dependabot-prs' )
@@ -25,12 +33,20 @@ program
   .argument( '<repos...>', 'repo names - bare name uses --owner, or pass owner/repo to override' )
   .option( '--owner <name>', 'GitHub org/owner for bare repo names', DEFAULT_OWNER )
   .option( '--dry-run', 'show what would be closed without closing anything' )
+  .option(
+    '--close-satisfied',
+    'also CLOSE PRs (any bump type, including major) whose proposed version is ' +
+    'already satisfied by the target branch\'s package.json - e.g. a manual bump ' +
+    'landed through a different PR while this one sat stale. Without this flag, ' +
+    'such PRs are only reported as a "hint" line, never closed'
+  )
   .option( '--debug', 'Enable debug logging' )
   .addHelpText( 'after', `
 ${chalk.yellow( 'Examples:' )}
   ${chalk.green( 'close-dependabot-prs array-util base62-util' )}
   ${chalk.green( 'close-dependabot-prs --dry-run cache' )}
   ${chalk.green( 'close-dependabot-prs --owner SomeOtherOrg some-repo' )}
+  ${chalk.green( 'close-dependabot-prs --close-satisfied --dry-run overdose' )}
 
 ${chalk.yellow( 'Notes:' )}
   Closes open Dependabot PRs that are superseded by a newly-added groups:
@@ -39,7 +55,21 @@ ${chalk.yellow( 'Notes:' )}
   closing them risks Dependabot never re-proposing that exact version.
 
   Skips any repo whose dependabot.yml has no groups: block at all - closing
-  PRs there would lose them rather than get them re-proposed.
+  PRs there would lose them rather than get them re-proposed - unless
+  --close-satisfied finds a reason to close a specific PR anyway.
+
+  --close-satisfied handles a different, unrelated situation: a PR (of any
+  bump type) that Dependabot never auto-closed as superseded because it sat
+  idle past GitHub's 30-day auto-rebase cutoff, even though the dependency
+  was already bumped to (or past) the PR's target version through a separate
+  PR. This is checked with real semver comparison against the target
+  branch's declared range, so it is safe for major bumps too - if the base
+  branch's range doesn't already guarantee the proposed version, the PR is
+  left alone. Always sanity-check with --dry-run first.
+
+  This "already satisfied" check always runs, even without --close-satisfied
+  - a plain run will surface a "hint" line for any PR it finds satisfied, so
+  you know --close-satisfied is worth trying instead of guessing.
 
   Requires the gh CLI, authenticated.
 ` )
@@ -90,20 +120,51 @@ async function openDependabotPrs( repo ) {
   return JSON.parse( stdout )
 }
 
-async function processRepo( repo, dryRun ) {
+async function fetchPackageJson( repo ) {
+  let stdout
+  try {
+    ( { stdout } = await $`gh api repos/${repo}/contents/package.json --jq .content` )
+  } catch {
+    return null // couldn't fetch - treat as unknown, caller should skip
+  }
+  try {
+    return JSON.parse( Buffer.from( stdout.trim(), 'base64' ).toString( 'utf8' ) )
+  } catch {
+    return null // unparseable - treat as unknown, caller should skip
+  }
+}
+
+// Returns true if the target branch's package.json already declares a range for
+// depName whose minimum version satisfies-or-exceeds toV. Returns false if it
+// definitely doesn't. Returns null if this can't be determined safely (dependency
+// missing, range unparseable, etc) - callers should treat null as "don't know".
+function isAlreadySatisfied( pkgJson, depName, toV ) {
+  const toVersion = semver.valid( toV )
+  if ( toVersion == null ) return null
+
+  const declaredRange = DEP_SECTIONS
+    .map( section => pkgJson[section] && pkgJson[section][depName] )
+    .find( range => range != null )
+  if ( declaredRange == null ) return null
+
+  let minCurrent
+  try {
+    minCurrent = semver.minVersion( declaredRange )
+  } catch {
+    return null
+  }
+  if ( minCurrent == null ) return null
+
+  return semver.gte( minCurrent, toVersion )
+}
+
+async function processRepo( repo, opts ) {
   log( `\n=== ${repo} ===` )
   const grouped = await hasGroupingConfigured( repo )
   if ( grouped === null ) {
     log( '  ! could not read .github/dependabot.yml - skipping' )
     return
   }
-  if ( !grouped ) {
-    log(
-      '  ! no `groups:` block found in dependabot.yml - skipping ' +
-      '(closing PRs here would lose them, not get them re-proposed)'
-    )
-    return
-  }
 
   const prs = await openDependabotPrs( repo )
   if ( prs.length === 0 ) {
@@ -111,7 +172,25 @@ async function processRepo( repo, dryRun ) {
     return
   }
 
+  // Always check for already-satisfied PRs (cheap - one extra API call) so we can
+  // at least *report* them even when --close-satisfied wasn't passed. Acting on
+  // them still requires the flag; finding them shouldn't.
+  const pkgJson = await fetchPackageJson( repo )
+  if ( pkgJson == null ) {
+    log( '  ! package.json could not be read/parsed - the "already satisfied" check will be skipped' )
+  }
+
+  if ( !grouped && pkgJson == null ) {
+    log(
+      '  ! no `groups:` block found in dependabot.yml - skipping ' +
+      '(closing PRs here would lose them, not get them re-proposed)'
+    )
+    return
+  }
+
   let closedCount = 0
+  let closedSatisfiedCount = 0
+  let hintCount = 0
   let keptCount = 0
   let skippedCount = 0
 
@@ -122,14 +201,37 @@ async function processRepo( repo, dryRun ) {
       log( `  skip   #${pr.number} (title didn't match expected pattern) ${pr.title}` )
       continue
     }
-    const [ , , fromV, toV ] = m
+    const [ , depName, , toV ] = m
+
+    if ( pkgJson != null && isAlreadySatisfied( pkgJson, depName, toV ) === true ) {
+      if ( opts.closeSatisfied ) {
+        closedSatisfiedCount++
+        log( `  close  #${String( pr.number ).padEnd( 4 )} satisfied ${pr.title}` )
+        if ( !opts.dryRun ) {
+          // eslint-disable-next-line no-await-in-loop
+          await $`gh pr close ${pr.number} --repo ${repo} --comment ${SATISFIED_COMMENT}`
+        }
+      } else {
+        hintCount++
+        log( `  hint   #${String( pr.number ).padEnd( 4 )} satisfied ${pr.title} (rerun with --close-satisfied to close)` )
+      }
+      continue
+    }
+
+    if ( !grouped ) {
+      keptCount++
+      log( `  keep   #${String( pr.number ).padEnd( 4 )} ungrouped ${pr.title}` )
+      continue
+    }
+
+    const [ , , fromV ] = m
     const bumpType = classifyBump( fromV, toV )
     if ( bumpType === 'patch' || bumpType === 'minor' ) {
       closedCount++
       log( `  close  #${String( pr.number ).padEnd( 4 )} ${bumpType.padEnd( 7 )} ${pr.title}` )
-      if ( !dryRun ) {
+      if ( !opts.dryRun ) {
         // eslint-disable-next-line no-await-in-loop
-        await $`gh pr close ${pr.number} --repo ${repo} --comment ${COMMENT}`
+        await $`gh pr close ${pr.number} --repo ${repo} --comment ${GROUPED_COMMENT}`
       }
     } else {
       keptCount++
@@ -137,12 +239,16 @@ async function processRepo( repo, dryRun ) {
     }
   }
 
-  log( `  -> ${closedCount} closed, ${keptCount} left open (major), ${skippedCount} skipped` )
+  log(
+    `  -> ${closedCount} closed (grouped), ${closedSatisfiedCount} closed (satisfied), ` +
+    `${hintCount} satisfied but not closed (see --close-satisfied), ` +
+    `${keptCount} left open, ${skippedCount} skipped`
+  )
 }
 
 // ---------- Run ----------
 
 for ( const repo of repos ) {
   // eslint-disable-next-line no-await-in-loop
-  await processRepo( repo, opts.dryRun )
+  await processRepo( repo, opts )
 }

package/src/refresh-npm-token.mjs

@@ -76,18 +76,29 @@ ${chalk.bold( 'Environment Variables (optional)' )}
 
   ${chalk.bold( 'REFRESH_NPM_PROJECT' )}  ${chalk.green( 'may be used in lieu of --project' )}
 
-${chalk.bold( 'Manually Bootstraping the Token' )}
+${chalk.bold( 'Manually Bootstrapping the Token' )}
   ${chalk.green( `
-  There may be times when a token is expired, lost or a new developer needs
-  to seed their ~/.npmrc file for the first time. Help a brother out and let
-  them know to run this command to fetch the current npmrc file:
-
+  There may be times when a token is expired, lost, or a new developer needs
+  to seed their ~/.npmrc for the first time. Because the REFRESH_NPM_NPMRC
+  secret is a template (not a rendered file), you must fetch the token and
+  substitute it in one step. Run the following — requires only gcloud and a
+  valid gcloud auth login:
+
+    TOKEN=$(gcloud secrets versions access latest \\
+         --secret=REFRESH_NPM_TOKEN \\
+         --project=leverege-registry) && \\
     gcloud secrets versions access latest \\
-         --secret=REFRESH_NPM_NPMRC       \\
-         --project=leverege-registry > ~/.npmrc
+         --secret=REFRESH_NPM_NPMRC \\
+         --project=leverege-registry | \\
+      sed "s/\\\${REFRESH_NPM_TOKEN}/\${TOKEN}/g" > ~/.npmrc
+
+  Once ~/.npmrc is seeded with a valid token, install build-tools and let it
+  manage the rc files going forward:
+
+    npm install -g @leverege/build-tools
+    refresh-npm-token --force
 
-  Note, ^^that command will need a different --project name for non-leverege
-  developers.` )}
+  Note: the --project flag above may differ for non-leverege environments.` )}
 ` )
   .parse()
 

package/src/repo-panopticon.mjs

@@ -8,7 +8,7 @@ import chalk from 'chalk'
 import { glob } from 'glob'
 import ora from 'ora'
 import pLimit from 'p-limit'
-import simpleGit from 'simple-git'
+import { simpleGit } from 'simple-git'
 import { $ } from 'zx'
 
 import { clear, enableDebug, log, parseJsonFile } from './Utils.mjs'
@@ -23,6 +23,7 @@ const SYM_BAD  = chalk.red( '✘' )
 // Add new checks here — the table expands automatically.
 
 let latestOrbVersion = null
+const pulledRoots = new Set()
 
 const CHECKS = [
   {
@@ -194,18 +195,19 @@ async function checkRepo( dir, { pull } ) {
   const pkgVer = parseVersion( pkg?.version )
 
   let syncOk = true
-  if ( isWorkspace ) {
+  if ( pull && !pulledRoots.has( gitRoot ) ) {
+    pulledRoots.add( gitRoot )
     try {
-      const relDir = path.relative( gitRoot, dir )
-      const status = await git.status( [ '--', relDir ] )
-      syncOk = status.files.length === 0
+      await git.pull()
+      await git.fetch( [ '--tags' ] )
     } catch {
       syncOk = false
     }
-  } else if ( pull ) {
+  } else if ( isWorkspace ) {
     try {
-      await git.pull()
-      await git.fetch( [ '--tags' ] )
+      const relDir = path.relative( gitRoot, dir )
+      const status = await git.status( [ '--', relDir ] )
+      syncOk = status.files.length === 0
     } catch {
       syncOk = false
     }

package/src/send-to-slack.mjs

@@ -70,8 +70,8 @@ if ( args._unknown ) {
 }
 /* eslint-enable no-underscore-dangle */
 
-if ( semverLt( process.version, '18.0.0' ) ) {
-  log( chalk.red( '\n\n***ERROR: must be running at least node 18\n' ) )
+if ( semverLt( process.version, '24.0.0' ) ) {
+  log( chalk.red( '\n\n***ERROR: must be running at least node 24\n' ) )
   process.exit( 1 )
 }
 
@@ -104,7 +104,7 @@ const slackData = {
   channel : slackConfig.channel,
 }
 
-if ( process.env.BUILD_TOOLS_DEBUG || args.dryRun ) {
+if ( process.env.BUILD_TOOLS_DEBUG || args.dryRun ) { // || process.env.SKIP_SEND_TO_SLACK ) {
   const account = await shellCmd( 'gcloud config get account' )
   log( { account, slackConfig, slackData }, '<==Slack skipped' )
 } else {

package/src/service-man/config/Config.mjs

@@ -4,7 +4,7 @@ import fs from 'node:fs/promises' /* eslint-disable security/detect-non-literal-
 import chalk from 'chalk'
 import { execa } from 'execa'
 import inquirer from 'inquirer'
-import SimpleGit from 'simple-git'
+import { simpleGit as SimpleGit } from 'simple-git'
 
 import { log, } from '../../Utils.mjs'
 
@@ -12,7 +12,7 @@ export default class Config {
   constructor( options ) {
     // we cannot async in the constructor - so use init to do the rest
     this.configRoot = `${options.sourceTop}/config`
-    this.git = new SimpleGit()
+    this.git = SimpleGit()
   }
 
   // expects a directory name containing text files with a .json extension

package/src/service-man/gcloud-k8s/SecretsManager.mjs

@@ -42,8 +42,7 @@ export default class SecretsManager {
     try {
       await shellCmd( `gcloud secrets describe ${key} --project ${project}` )
       exists = true
-    } catch ( err ) { // eslint-disable-line no-unused-vars
-      exists = false
+    } catch {
     }
 
     if ( exists ) {