@leverege/build-tools 2.35.1 → 2.36.1

package/lib/server/refresh-npm-token.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+"use strict";
+
+var _nodeFs = _interopRequireDefault(require("node:fs"));
+var _nodeOs = _interopRequireDefault(require("node:os"));
+var _chalk = _interopRequireDefault(require("chalk"));
+var _execa = _interopRequireDefault(require("execa"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+// we can't use $ until we upgrade to ESM execa
+// the standard user npmrc token is stored here
+const npmrc = `${_nodeOs.default.homedir()}/.npmrc`;
+
+// max age in seconds of the npmrc file before refresh
+const refreshThreshold = 3600 * 24; // 1 day
+
+const log = console.log;
+
+// calculate number of seconds since last update and exit if the file
+// was recently updated
+let lastUpdated = refreshThreshold * 2; // forces refresh if npmrc file does not exist
+let oldToken;
+try {
+  if (_nodeFs.default.existsSync(npmrc)) {
+    const stat = _nodeFs.default.statSync(npmrc);
+    lastUpdated = Math.trunc((Date.now() - stat.mtimeMs) / 1000);
+    // grab the old token for logging a redacted version
+    const oldNpmrc = _nodeFs.default.readFileSync(npmrc, 'utf8');
+    const found = oldNpmrc.match(/_authToken=(.*)\n/);
+    if (found) {
+      oldToken = `${found[1].slice(0, 8)}......${found[1].slice(-4)}`;
+    }
+  }
+} catch (statErr) {
+  log({
+    statErr
+  }, `<==fs.statSync failed on file ${npmrc}`);
+}
+if (lastUpdated < refreshThreshold) {
+  process.exit(0);
+}
+
+// fetch the contents of the npmrc secret stored on leverege-registry
+let npmrcSecret;
+try {
+  const {
+    stdout
+  } = await (0, _execa.default)('gcloud', ['secrets', 'versions', 'access', 'latest', '--secret=NPM_DEVELOPER_NPMRC', '--project=leverege-registry']);
+  npmrcSecret = stdout;
+} catch (err) {
+  log(_chalk.default.yellow(`\nFailed Command => [${err.escapedCommand}]\n\n`), _chalk.default.red(err.stderr));
+  process.exit(1);
+}
+
+// now update the user's npmrc file
+log(_chalk.default.yellow('\n*** Refreshing your ~/.npmrc npm token file'));
+try {
+  if (_nodeFs.default.existsSync(npmrc)) {
+    _nodeFs.default.copyFileSync(npmrc, `${npmrc}-BAK`); // make a backup for safety
+  }
+
+  _nodeFs.default.writeFileSync(`${npmrc}`, npmrcSecret);
+} catch (fileErr) {
+  log(fileErr, 'fs failed');
+  process.exit(1);
+}
+const now = new Date().toLocaleString();
+const slackURL = 'https://hooks.slack.com/services/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';
+const slackData = {
+  text: `--- npmrc refreshed by \`${process.env['USER']}\` at ${now}\n     token [\`${oldToken}\`]`,
+  channel: '#dev-ops-helm'
+};
+fetch(slackURL, {
+  method: 'POST',
+  body: JSON.stringify(slackData),
+  headers: {
+    'Content-Type': 'application/json'
+  }
+}).catch(err => console.log(err));

package/lib/web/refresh-npm-token.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+"use strict";
+
+var _nodeFs = _interopRequireDefault(require("node:fs"));
+var _nodeOs = _interopRequireDefault(require("node:os"));
+var _chalk = _interopRequireDefault(require("chalk"));
+var _execa = _interopRequireDefault(require("execa"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+// we can't use $ until we upgrade to ESM execa
+// the standard user npmrc token is stored here
+const npmrc = `${_nodeOs.default.homedir()}/.npmrc`;
+
+// max age in seconds of the npmrc file before refresh
+const refreshThreshold = 3600 * 24; // 1 day
+
+const log = console.log;
+
+// calculate number of seconds since last update and exit if the file
+// was recently updated
+let lastUpdated = refreshThreshold * 2; // forces refresh if npmrc file does not exist
+let oldToken;
+try {
+  if (_nodeFs.default.existsSync(npmrc)) {
+    const stat = _nodeFs.default.statSync(npmrc);
+    lastUpdated = Math.trunc((Date.now() - stat.mtimeMs) / 1000);
+    // grab the old token for logging a redacted version
+    const oldNpmrc = _nodeFs.default.readFileSync(npmrc, 'utf8');
+    const found = oldNpmrc.match(/_authToken=(.*)\n/);
+    if (found) {
+      oldToken = `${found[1].slice(0, 8)}......${found[1].slice(-4)}`;
+    }
+  }
+} catch (statErr) {
+  log({
+    statErr
+  }, `<==fs.statSync failed on file ${npmrc}`);
+}
+if (lastUpdated < refreshThreshold) {
+  process.exit(0);
+}
+
+// fetch the contents of the npmrc secret stored on leverege-registry
+let npmrcSecret;
+try {
+  const {
+    stdout
+  } = await (0, _execa.default)('gcloud', ['secrets', 'versions', 'access', 'latest', '--secret=NPM_DEVELOPER_NPMRC', '--project=leverege-registry']);
+  npmrcSecret = stdout;
+} catch (err) {
+  log(_chalk.default.yellow(`\nFailed Command => [${err.escapedCommand}]\n\n`), _chalk.default.red(err.stderr));
+  process.exit(1);
+}
+
+// now update the user's npmrc file
+log(_chalk.default.yellow('\n*** Refreshing your ~/.npmrc npm token file'));
+try {
+  if (_nodeFs.default.existsSync(npmrc)) {
+    _nodeFs.default.copyFileSync(npmrc, `${npmrc}-BAK`); // make a backup for safety
+  }
+
+  _nodeFs.default.writeFileSync(`${npmrc}`, npmrcSecret);
+} catch (fileErr) {
+  log(fileErr, 'fs failed');
+  process.exit(1);
+}
+const now = new Date().toLocaleString();
+const slackURL = 'https://hooks.slack.com/services/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';
+const slackData = {
+  text: `--- npmrc refreshed by \`${process.env['USER']}\` at ${now}\n     token [\`${oldToken}\`]`,
+  channel: '#dev-ops-helm'
+};
+fetch(slackURL, {
+  method: 'POST',
+  body: JSON.stringify(slackData),
+  headers: {
+    'Content-Type': 'application/json'
+  }
+}).catch(err => console.log(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.35.1",
+  "version": "2.36.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -24,14 +24,17 @@
     "dirty-git": "src/dirty-git",
     "dockreate": "src/dockreate",
     "encrypt-secrets": "src/encrypt-secrets",
+    "firebaseDeploy": "src/firebaseDeploy.mjs",
+    "firebaseServe": "src/firebaseServe.mjs",
     "getfbcfg": "src/getfbcfg.js",
     "getjson": "src/getjson.js",
     "git-tar": "src/git-tar",
     "helmdn": "src/helmdn",
     "helmup": "src/helmup",
+    "helminit": "src/helmup",
     "helmwhat": "src/helmup",
-    "k8scale": "src/k8scale",
     "k8cryo": "src/k8cryo",
+    "k8scale": "src/k8scale",
     "k8thaw": "src/k8cryo",
     "k8x": "src/k8x",
     "klog": "src/klog",
@@ -43,10 +46,9 @@
     "prune-git": "src/prune-git",
     "pull-git": "src/pull-git",
     "push-my-chart": "src/push-my-chart",
-    "unleash": "src/unleash.js",
-    "firebaseDeploy": "src/firebaseDeploy.mjs",
-    "firebaseServe": "src/firebaseServe.mjs",
-    "tag-release": "src/tag-release.mjs"
+    "refresh-npm-token": "src/refresh-npm-token.mjs",
+    "tag-release": "src/tag-release.mjs",
+    "unleash": "src/unleash.js"
   },
   "author": "Leverege Devs",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -71,8 +73,8 @@
     "zx": "^7.2.3"
   },
   "devDependencies": {
-    "@babel/cli": "^7.22.9",
-    "@babel/core": "^7.22.9",
+    "@babel/cli": "^7.22.10",
+    "@babel/core": "^7.22.10",
     "@leverege/babel-preset-leverege-node": "^2.0.0",
     "@leverege/eslint-config-leverege": "^3.0.1",
     "npm": "^9.8.1"

package/src/bash-funcs

@@ -73,7 +73,7 @@ function setOrUnset() {
 
 function getManagedSecret() {
   local SECNAME=$1
-  local PROJECT="${2:-leverege-docker-images}"
+  local PROJECT="${2:-leverege-registry}" # was leverege-docker-images
   SECRET=$(gcloud secrets versions access latest --secret="$SECNAME" --project=$PROJECT)
   if [ $? -ne 0 ];
   then

package/src/circle-lib.yml

@@ -0,0 +1,150 @@
+version: 2.1
+jobs:
+  install:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - restore_cache:
+          keys:
+            - v1-npm-deps-{{ checksum "package-lock.json" }}
+            - v1-npm-deps-
+
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+
+      - run: npm install
+
+      - save_cache:
+          key: v1-npm-deps-{{ checksum "package-lock.json" }}
+          paths:
+            - ./node_modules
+
+      - persist_to_workspace:
+          root: /home/circleci/project
+          paths:
+            - ./node_modules
+
+  security-check:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Check for vulnerabilities
+          command: npm audit --production --audit-level=moderate
+
+  license-check:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Check for LICENSE and README files
+          command: npm run pkglint
+
+      - run:
+          name: Check for license violations (e.g. GPL)
+          command: npx license-checker --production --summary --failOn GPL
+
+  lint:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Lint and save results
+          command: npm run lint-ci
+
+      - store_test_results:
+          path: reports
+
+  docs:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Generate docs
+          command: npx jsdoc -r src -R README.md -d docs
+      - store_artifacts:
+          path: docs
+          prefix: docs
+
+  coverage:
+    # coverage runs tests, generates coverage, and saves docs
+    environment:
+      TZ: 'America/New_York'
+    docker:
+      - image: $CIRCLE_NODE_IMG
+      # IF YOU NEED ANY OF THESE, UNCOMMENT TO USE
+      # - image: redis
+      # - image: circleci/mysql:5.7
+      #   environment:
+      #     MYSQL_USER: root
+      #     MYSQL_ROOT_PASSWORD: root
+      #     MYSQL_ALLOW_EMPTY_PASSWORD: true
+      #     MYSQL_HOST: 127.0.0.1
+      # - image: nsqio/nsq
+      #   command: /nsqlookupd -broadcast-address localhost:4160 -tcp-address 0.0.0.0:4160 -http-address 0.0.0.0:4161
+
+      # - image: nsqio/nsq
+      #   command: >
+      #     /nsqd
+      #     -broadcast-address localhost:4150
+      #     -tcp-address 0.0.0.0:4150
+      #     -http-address 0.0.0.0:4151
+      #     -lookupd-tcp-address localhost:4160
+
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+
+      # UNCOMMENT IF YOU NEED DECRYPTING SECRETS
+      # - run:
+      #     name: Load secrets
+      #     command: npm run decrypt
+
+      - run:
+          name: Run Tests and Generate Code Coverage
+          command: npm run coverage
+
+      - run:
+          name: Check if coverage meets at least 70%
+          command: npx c8 check-coverage --functions 70 --lines 70 --statements 70
+
+      - store_artifacts:
+          path: coverage
+          prefix: coverage
+
+workflows:
+  version: 2.1
+  test-build-deploy:
+    jobs:
+      - install:
+          context: npm
+      - security-check:
+          requires:
+            - install
+      - license-check:
+          requires:
+            - install
+      - lint:
+          requires:
+            - install
+      - coverage:
+          requires:
+            - install
+      - docs:
+          requires:
+            - install

package/src/circle-srv.yml

@@ -0,0 +1,213 @@
+version: 2.1
+#orbs:
+#  gcp-gcr: circleci/gcp-gcr@0.6.1
+executors:
+  default:
+    description: >
+      A debian-based machine executor.
+    machine: true
+jobs:
+  install:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - restore_cache:
+          keys:
+            - v1-npm-deps-{{ checksum "package-lock.json" }}
+            - v1-npm-deps-
+
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc
+
+      - run: npm install
+
+      - save_cache:
+          key: v1-npm-deps-{{ checksum "package-lock.json" }}
+          paths:
+            - ./node_modules
+
+      - persist_to_workspace:
+          root: /home/circleci/project
+          paths:
+            - ./node_modules
+
+  security-check:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Check for vulnerabilities
+          command: npm audit --production --audit-level=moderate
+
+  license-check:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Check for LICENSE and README files
+          command: npm run pkglint
+
+      - run:
+          name: Check for license violations (e.g. GPL)
+          command: npx license-checker --production --summary --failOn GPL
+
+  lint:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Lint and save results
+          command: npm run lint-ci
+
+      - store_test_results:
+          path: reports
+
+  docs:
+    docker:
+      - image: $CIRCLE_NODE_IMG
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          name: Generate docs
+          command: npx jsdoc -r src -R README.md -d docs
+      - store_artifacts:
+          path: docs
+          prefix: docs
+
+  coverage:
+    # coverage runs tests, generates coverage, and saves docs
+    environment:
+      TZ: 'America/New_York'
+    docker:
+      - image: $CIRCLE_NODE_IMG
+      # IF YOU NEED ANY OF THESE, UNCOMMENT TO USE
+      # - image: redis
+      # - image: circleci/mysql:5.7
+      #   environment:
+      #     MYSQL_USER: root
+      #     MYSQL_ROOT_PASSWORD: root
+      #     MYSQL_ALLOW_EMPTY_PASSWORD: true
+      #     MYSQL_HOST: 127.0.0.1
+      # - image: nsqio/nsq
+      #   command: /nsqlookupd -broadcast-address localhost:4160 -tcp-address 0.0.0.0:4160 -http-address 0.0.0.0:4161
+
+      # - image: nsqio/nsq
+      #   command: >
+      #     /nsqd
+      #     -broadcast-address localhost:4150
+      #     -tcp-address 0.0.0.0:4150
+      #     -http-address 0.0.0.0:4151
+      #     -lookupd-tcp-address localhost:4160
+
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+
+      # UNCOMMENT IF YOU NEED DECRYPTING SECRETS
+      # - run:
+      #     name: Load secrets
+      #     command: npm run decrypt
+
+      - run:
+          name: Run Tests and Generate Code Coverage
+          command: npm run coverage
+
+      - run:
+          name: Check if coverage meets at least 70%
+          command: npx c8 check-coverage --functions 70 --lines 70 --statements 70
+
+      - store_artifacts:
+          path: coverage
+          prefix: coverage
+
+  build:
+    # build should make dist image and prepare docker file
+    docker:
+      - image: $CIRCLE_NODE_IMG
+
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+
+      - run:
+          name: Setup @leverege Token
+          command: echo \${NPMRC} > ~/.npmrc.ro
+
+      - run:
+          name: Determine version number and container name
+          command: |
+            container="\`node -p \"require('./package.json').leverege.container\"\`"
+            if [ "\$container" == "undefined" ];
+            then
+              container=\$CIRCLE_PROJECT_REPONAME
+            fi
+            NODE_IMAGE="\`node -p \"require('./package.json').leverege.nodeimg\"\`"
+
+            echo \$(git describe --tags) > package_version
+            echo \${container} > container_name
+            echo \${NODE_IMAGE} > node_img
+
+      - run:
+          name: Create Dockerfile and build dist directory
+          command: mkdir -p docker && npm run dockerize \$(git describe --tags)
+
+      - persist_to_workspace:
+          root: ~/project
+          paths:
+            - docker/*
+            - package_version
+            - container_name
+            - node_img
+
+workflows:
+  version: 2.1
+  test-build-deploy:
+    jobs:
+      - install:
+          context: npm
+      - security-check:
+          requires:
+            - install
+      - license-check:
+          requires:
+            - install
+      - lint:
+          requires:
+            - install
+      - coverage:
+          requires:
+            - install
+      - docs:
+          requires:
+            - install
+      - build:
+          context: npm
+          filters:
+            branches:
+              only:
+                - development
+                - /release-.*/
+                - master
+          requires:
+            - install
+            - security-check
+            - license-check
+            - lint
+            - coverage
+            - docs
+

package/src/dockreate

@@ -202,23 +202,8 @@ cmclear()
 EOBASHRC
 } # end of create_bashrc
 
-NPMRC="$HOME/.npmrc.ro"
-if [ ! -f "$NPMRC" ];
-then
-  cat<<ROTOKEN
-
-  $(color r '***ERROR: expecting to see a readonly npmjs token')
-
-  For security purposes, we deploy images with read-only npmjs tokens.
-  These may be acquired from another developer, or can be created with the
-  npmjs leverege account.
-  
-  Obtain the token and drop it here => $(color g "$NPMRC")
-
-
-ROTOKEN
-  exit 1
-fi
+# make sure we have a current npmrc file
+refresh-npm-token
 
 # Look for leverege specifics, but only require the project name.
 project=$(packageJson .leverege.project)
@@ -406,8 +391,8 @@ create_bashrc "$version" "$nodeimg"
 rm -rf ./workspace && mkdir -p ./workspace
 cp -rfp ${PKGTOP}/package*json ${PKGTOP}/dist/* ./workspace
  
-# grab the read only npmrc token for the image
-cp -f $NPMRC .npmrc
+# grab the npmrc token for the image
+cp -f "$HOME/.npmrc" .npmrc
 
 [ "$CIRCLECI" == "true" ] && exit 0
 

package/src/helm-charts/geotile-server/gitignore

@@ -0,0 +1 @@
+geotile-local.yaml

package/src/helm-charts/geotile-server/helmup.plugin

@@ -0,0 +1,6 @@
+#!/bin/bash
+#
+showInstalling "Geotile Server"
+
+helm upgrade --install geotile-server leverege/geotile-server \
+             --values geotile-server/geotile-values.yaml

package/src/helmup

@@ -260,19 +260,6 @@ function monitoringHelp() {
 ACCESS
 }
 
-function getManagedSecret() {
-  local SECNAME=$1
-  local PROJECT="${2:-leverege-docker-images}"
-  SECRET=$(gcloud secrets versions access latest --secret="$SECNAME" --project=$PROJECT)
-  if [ $? -ne 0 ];
-  then
-    printf "This failed=>[gcloud secrets versions access latest --secret="$SECNAME" --project=$PROJECT]\n"
-    printf "Returned   =>[$SECRET]\n\n"
-    exit 1
-  fi
-  echo $SECRET
-}
-
 # https://github.com/estafette/estafette-gke-preemptible-killer
 function installPreemptibleKiller() {
   showInstalling "Preemptible Node Killing Coordinator"
@@ -404,32 +391,6 @@ NEED_MANAGED_SECRET
   fi
 }
 
-function installTraefikEnvironment() {
-  showInstalling "Traefik Namespace and Cloudflare Secret"
-  createNamespaceIfNeeded traefik
-
-  kubectl get secret cloudflare --namespace traefik &>/dev/null
-  if [[ $? -eq 1 ]];
-  then
-    cat<<NEED_TRAEFIK_SECRET
-   $RED_ERROR missing secret: `color y cloudflare` namespace: `color y traefik`
-
-   Injecting the `color y cloudflare` secret from the `color g leverege-docker-images` cluster.
-
-NEED_TRAEFIK_SECRET
-    TOKEN=$(getManagedSecret "CLOUDFLARE_API_TOKEN")
-    if [ $? -ne 0 ];
-    then
-      printf "$RED_ERROR getManagedSecret reponse=>[$TOKEN]"
-      exitOnError 1 "Failed to fetch the secret from leverege-docker-images"
-    fi
-    printf "\nInjecting=[$TOKEN] into cloudflare secret\n"
-    kubectl create secret generic cloudflare \
-      --namespace traefik \
-      --from-literal=dns-token=$TOKEN
-  fi
-}
-
 function installVeleroEnvironment() {
   # Follows instructions => https://github.com/vmware-tanzu/velero-plugin-for-gcp
   showInstalling "Velero Backup Management"
@@ -614,8 +575,29 @@ function doInstall() {
     # slap additional helm syntax in there if the version is set
     [ ! -z "$CHARTVER" ] && CHARTVER="--version $CHARTVER"
 
+    local INVOKED_AS=`basename $0`
     # set the dry-run flag on what
-    [ "`basename $0`" == "helmwhat" ] && HELM_WHAT="--dry-run --debug"
+    [ "$INVOKED_AS" == "helmwhat" ] && HELM_WHAT="--dry-run --debug"
+
+    # helminit is used to redeploy an existing service
+    if [ "$INVOKED_AS" == "helminit" ] && [ -f "$SERVICE/helmup.plugin" ];
+    then
+      local BACKUP_DIR="$SERVICE-bak"
+      if [ ! -d "$BACKUP_DIR" ];
+      then
+        printf "Moving existing `color y $SERVICE` to backup `color g $BACKUP_DIR`\n\n"
+        mv $SERVICE $BACKUP_DIR
+      else
+        cat<<CATBACKUP
+    $RED_ERROR `color y "Existing backup directories detected"`
+
+    In order to proceed the backup directories must not pre-exist or helminit
+    may overrite important information. Clean up the backups and try again.
+
+CATBACKUP
+       ls -ld *-bak && exit 1
+      fi
+    fi
 
     # If we're referencing a plugin then execute it and continue
     ifPluggedIn $SERVICE && continue
@@ -642,6 +624,12 @@ function doInstall() {
         kubectl create -f https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-stackdriver/master/custom-metrics-stackdriver-adapter/deploy/production/adapter.yaml
         ;;
 
+      db-curator*)
+        # db-curator / db-curator-dh diffs are defined in values-local.yaml
+        HELMUP="helm upgrade --install $SERVICE leverege/db-curator --values $SERVICE/values.yaml $CHARTVER $HELM_WHAT"
+        doHelmup "$HELMUP"
+        ;;
+
       "elasticsearch") # simple 3 master v7.16 cluster
         bootstrapLocalSetup $SERVICE
         ;;

package/src/refresh-npm-token.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+
+import chalk from 'chalk'
+import execa from 'execa' // we can't use $ until we upgrade to ESM execa
+
+// the standard user npmrc token is stored here
+const npmrc = `${os.homedir()}/.npmrc`
+
+// max age in seconds of the npmrc file before refresh
+const refreshThreshold = 3600 *24 // 1 day
+
+const log = console.log
+
+// calculate number of seconds since last update and exit if the file
+// was recently updated
+let lastUpdated = refreshThreshold * 2 // forces refresh if npmrc file does not exist
+let oldToken
+try {
+  if ( fs.existsSync( npmrc ) ) {
+    const stat = fs.statSync( npmrc )
+    lastUpdated = Math.trunc( ( Date.now() - stat.mtimeMs ) / 1000 )
+    // grab the old token for logging a redacted version
+    const oldNpmrc = fs.readFileSync( npmrc, 'utf8' )
+    const found = oldNpmrc.match( /_authToken=(.*)\n/ )
+    if( found ) {
+      oldToken = `${found[1].slice(0,8)}......${found[1].slice(-4)}`
+    }
+  }
+} catch ( statErr ) {
+  log( { statErr }, `<==fs.statSync failed on file ${npmrc}` )
+}
+if ( lastUpdated < refreshThreshold ) { process.exit( 0 ) }
+
+// fetch the contents of the npmrc secret stored on leverege-registry
+let npmrcSecret
+try {
+  const { stdout } = await execa( 'gcloud', [
+    'secrets',
+    'versions',
+    'access',
+    'latest',
+    '--secret=NPM_DEVELOPER_NPMRC',
+    '--project=leverege-registry',
+  ] )
+  npmrcSecret = stdout
+} catch( err ) {
+  log( chalk.yellow( `\nFailed Command => [${err.escapedCommand}]\n\n` ), chalk.red( err.stderr ) )
+  process.exit( 1 )
+}
+
+// now update the user's npmrc file
+log( chalk.yellow( '\n*** Refreshing your ~/.npmrc npm token file' ) )
+
+try {
+  if ( fs.existsSync( npmrc ) ) {
+    fs.copyFileSync( npmrc, `${npmrc}-BAK` ) // make a backup for safety
+  }
+  fs.writeFileSync( `${npmrc}`, npmrcSecret )
+} catch( fileErr ) {
+  log( fileErr, 'fs failed' )
+  process.exit( 1 )
+}
+
+const now = ( new Date() ).toLocaleString()
+const slackURL = 'https://hooks.slack.com/services/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'
+const slackData = {
+  text: `--- npmrc refreshed by \`${process.env['USER']}\` at ${now}\n     token [\`${oldToken}\`]`,
+  channel: '#dev-ops-helm',
+}
+
+fetch( slackURL, {
+  method: 'POST',
+  body: JSON.stringify( slackData ),
+  headers: {
+    'Content-Type': 'application/json',
+  },
+} )
+  .catch( err => console.log( err ) )