@leverege/build-tools 2.38.2 → 2.39.0-beta.2

package/src/refresh-npm-token.mjs

@@ -9,10 +9,11 @@
  * reported via slack to allow DevOps operators to clean up old tokens in npm.
  *
  * For testing the Unix touch command may be used to modify the access access
- * time of the npmrc token. The REFRESH_NPM_TOKEN_DEBUG env variable may also
- * be set to enable debugging and disable the slack channel spam.
+ * time of the npmrc token or the --force switch to ignore the age of the file.
+ * The BUILD_TOOLS_DEBUG env variable may also be set to enable debugging and
+ * disable the slack channel spam.
  *
- * touch -d 2023-08-20 ~/.npmrc; REFRESH_NPM_TOKEN_DEBUG=1 refresh-npm-token.mjs
+ * touch -d 2023-08-20 ~/.npmrc; BUILD_TOOLS_DEBUG=1 refresh-npm-token.mjs
  */
 
 /* eslint-disable security/detect-non-literal-fs-filename */
@@ -20,24 +21,105 @@ import fs from 'node:fs'
 import os from 'node:os'
 
 import chalk from 'chalk'
-import execa from 'execa' // we can't use $ until we upgrade to ESM execa
-
+import commandLineArgs from 'command-line-args'
+import commandLineUsage from 'command-line-usage'
+import ms from 'ms'
 import { lt as semverLt } from 'semver'
 
+import { debug, log, shellCmd } from './Utils.mjs'
+
+const refreshTokenOptions = [ // Use refreshTokenOptions to tie into the Usage statements
+  /* eslint-disable max-len */
+  {
+    name : 'project',
+    type : String,
+    default : false,
+    description : '{green the name of the google project containing the npmrc and slack config secrets (default leverege-registry)}',
+  },
+  {
+    name : 'npmrc-age',
+    type : String,
+    default : '24h',
+    description : '{green the age of the local ~/.npmrc file before a refetch is performed (default 24h)}'
+  },
+  {
+    name : 'force',
+    type : Boolean,
+    default : false,
+    description : '{green ignores age of the ~/.npmrc file and always fetches}',
+  },
+  {
+    name : 'dry-run',
+    type : Boolean,
+    default : false,
+    description : '{green performs sanity checks on the settings / environment without updating ~/.npmrc}',
+  },
+  {
+    name : 'help',
+    type : Boolean,
+    default : false,
+    description : '{green display this help screen}',
+  },
+  /* eslint-enable max-len */
+]
+
+const sections = [
+  {
+    header : 'Leverege NPM Token Refresher',
+    content : `{green
+This tool helps you retrieve an npmrc file stored in a secret within a GCP
+Secret Manager. It enables NPM administrators to manage a single NPM token
+for use by a development team. The tool checks the age of your local ~/.npmrc
+file, and if it exceeds the specified --npmrc-age setting, it will fetch the
+secret, overwriting the existing ~/.npmrc file.
+
+This tool may be invoked directly from the command line, or from scripts in
+the build-tools repository. For example, helmup will invoke this command for
+refreshing the token and to provide an audit log to slack when deployments
+are made.}
+`
+  },
+  { header : 'Options',
+    optionList : refreshTokenOptions,
+  },
+  { header : 'Environment Variables (optional)',
+    content : '{bold REFRESH_NPM_PROJECT}  {green may be used in lieu of --project}',
+  },
+]
+
+const args = commandLineArgs( refreshTokenOptions, { camelCase : true, partial : true } )
+const usage = commandLineUsage( sections )
+
+if ( args.help ) {
+  log( usage )
+  process.exit( 0 )
+}
+
+/* eslint-disable no-underscore-dangle */
+if ( args._unknown ) {
+  log( usage )
+  log( `\nUnrecognized argument [${chalk.bold.red( args._unknown )}]\n` )
+  process.exit( 1 )
+}
+/* eslint-enable no-underscore-dangle */
+
+const gcpProject = args.project ? args.project : process.env.REFRESH_NPM_PROJECT || 'leverege-registry'
+
 if ( semverLt( process.version, '18.0.0' ) ) {
-  console.log( chalk.red( '\n\n***ERROR: must be running at least node 18\n' ) ) // eslint-disable-line no-console
+  log( chalk.red( '\n\n***ERROR: must be running at least node 18\n' ) )
   process.exit( 1 )
 }
 
 // max age in seconds of the npmrc file before refresh
-const refreshThreshold = 3600 * 24 // 1 day
-
-// eslint-disable-next-line no-console
-const log = console.log
-const debug = ( obj, text ) => {
-  if ( process.env.REFRESH_NPM_TOKEN_DEBUG ) { log( obj, chalk.yellow( text ) ) }
+const refreshThreshold = ms( args.npmrcAge || '24h' ) / 1000 // 1 day of seconds
+if ( refreshThreshold < 60 ) {
+  log( chalk.yellow.bold( `
+***WARNING the npmrc-age of ${args.npmrcAge} results in an age threshold of ${refreshThreshold} seconds
+           try using 24h for one day or 60m for an hour
+` ) )
 }
 
+// used to pull the sanitized token [npm_mQZ0......Xmvp] reference from the npmrc file
 const fetchToken = ( filename ) => {
   const results = {
     filename,
@@ -65,60 +147,80 @@ const fetchToken = ( filename ) => {
   return results
 }
 
-// fetch the tokens - note the RO token is deprecated and may not exist
+// fetch the tokens - note the RO token is deprecated and might not exist
 const npmrc = fetchToken( `${os.homedir()}/.npmrc` )
 const npmrcRo = fetchToken( `${os.homedir()}/.npmrc.ro` )
 
 debug( { npmrc, npmrcRo }, '<==Your current tokens' ) // debug
 
-if ( npmrc.exists && npmrc.lastUpdated < refreshThreshold ) { process.exit( 0 ) }
-
-// fetch the contents of the npmrc secret stored on leverege-registry
-let npmrcSecret
-const execaOpts = [
-  'secrets',
-  'versions',
-  'access',
-  'latest',
-  '--secret=NPM_DEVELOPER_NPMRC',
-  '--project=leverege-registry',
-]
+// skip file age check if this is a dry or forced run
+if ( !args.dryRun && !args.force ) {
+  if ( npmrc.exists && npmrc.lastUpdated < refreshThreshold ) { process.exit( 0 ) }
+}
+
+const getGcpSecretCommand = ( secretName ) => {
+  return `gcloud secrets versions access latest --project=${gcpProject} --secret=${secretName}`
+}
+
+// fetch the contents of the npmrc secret file stored on the specified project
+let npmrcFile
 try {
-  const execaOut = await execa( 'gcloud', execaOpts )
-  npmrcSecret = execaOut.stdout
-  debug( { execaOut, execaOpts }, '<==exec info' )// debug
+  const npmTokenFetcher = getGcpSecretCommand( 'REFRESH_NPM_NPMRC' )
+  debug( { npmTokenFetcher }, '<==Secret Fetcher' )
+
+  npmrcFile = await shellCmd( npmTokenFetcher )
+  debug( { npmrcFile }, '<==shellCmd Output npmrc file' )// debug
 } catch ( err ) {
   log( chalk.yellow( `\nFailed Command => [${err.escapedCommand}]\n\n` ), chalk.red( err.stderr ) )
   process.exit( 1 )
 }
 
-// now update the user's npmrc file
-log( chalk.yellow( '\n*** Refreshing your ~/.npmrc npm token file' ) )
+// fetch and parse the slack config for audits
+const slackSecretName = 'REFRESH_NPM_SLACK_CONFIG'
+let slackConfig
+try {
+  const slackConfigFetcher = getGcpSecretCommand( slackSecretName )
+  const slackSecret = await shellCmd( slackConfigFetcher ) 
+  slackConfig = JSON.parse( slackSecret )
+  debug( { slackSecretName, slackConfig, slackConfigFetcher }, `<==shellCmd Output ${slackSecretName}` )
+} catch ( err ) {
+  if ( err.escapedCommand && err.stderr ) {
+    log( chalk.yellow( `\nFailed Fetching Slack Secret => [${err.escapedCommand}]\n\n` ), chalk.red( err.stderr ) )
+  } else {
+    log( err, chalk.red( `\n\nFailed to fetch and / or parse secret ${slackSecretName} from ${gcpProject}` ) )
+  }
+  process.exit( 1 )
+}
 
+// update the user's npmrc file if this isn't a dry run
 try {
-  if ( fs.existsSync( npmrc ) ) {
-    fs.copyFileSync( npmrc, `${npmrc}-BAK` ) // make a backup for safety
+  if ( args.dryRun ) {
+    log( chalk.yellow( '\n*** Dry Run - files will not be updated' ) )
+  } else {
+    log( chalk.yellow( '\n*** Refreshing your ~/.npmrc npm token file' ) )
+    if ( fs.existsSync( npmrc ) ) {
+      fs.copyFileSync( npmrc, `${npmrc}-BAK` ) // make a backup for safety
+    }
+    fs.writeFileSync( npmrc.filename, npmrcFile )
   }
-  fs.writeFileSync( npmrc.filename, npmrcSecret )
 } catch ( fileErr ) {
   log( fileErr, 'fs failed' )
   process.exit( 1 )
 }
 
+// slack out the details to the configured channel
 const now = ( new Date() ).toLocaleString()
-const slackURL = 'https://hooks.slack.com/services/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'
-const execaAct = await execa( 'gcloud', [ 'config', 'get', 'account', ] )
-const account = execaAct.stdout
+const account = await shellCmd( 'gcloud config get account' )
 const slackData = {
   // eslint-disable-next-line max-len
   text : `--- npmrc refreshed by \`${account}\` at ${now}\n     tokens RW [\`${npmrc.token}\`] RO [\`${npmrcRo.token}\`]`,
-  channel : '#dev-ops-helm',
+  channel : slackConfig.channel,
 }
 
-if ( process.env.REFRESH_NPM_TOKEN_DEBUG ) {
-  log( { slackURL, slackData }, '<==Slack skipped' )
+if ( process.env.BUILD_TOOLS_DEBUG || args.dryRun ) {
+  log( { slackConfig, slackData }, '<==Slack skipped' )
 } else {
-  fetch( slackURL, {
+  fetch( slackConfig.url, {
     method : 'POST',
     body : JSON.stringify( slackData ),
     headers : {

package/src/unleash.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 
-import execa from 'execa'
 import SimpleGit from 'simple-git'
 
+import { shellCmd } from './Utils.mjs'
+
 const git = new SimpleGit()
 
 const getCurrentBranchName = async () => {
@@ -35,7 +36,8 @@ const isProtected = async () => {
 
 const npmRunner = async ( script ) => {
   try {
-    const results = await execa( 'npm', [ 'run', script ], { stdio : 'inherit' } )
+    const cmd = `npm run ${script}`
+    const results = await shellCmd( cmd, { stdio : 'inherit' } )
     return results
   } catch ( err ) {
     process.exit( 1 )

package/lib/server/build-tools.js

@@ -1,138 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-const fs = require('node:fs');
-const path = require('node:path');
-const chalk = require('chalk');
-const cliArgs = require('command-line-args');
-const cliHelp = require('command-line-usage');
-const npmRegistryFetch = require('npm-registry-fetch');
-const semverLt = require('semver/functions/lt');
-
-/* eslint-disable no-console */
-
-const optionList = [
-// Use optionList to tie into the Usage statements
-{
-  name: 'root',
-  type: Boolean,
-  default: false,
-  description: 'returns the root of the build-tools installation'
-}, {
-  name: 'latest',
-  type: Boolean,
-  default: false,
-  description: 'verifies the latest build-tools are installed'
-}, {
-  name: 'bashfun',
-  type: Boolean,
-  default: false,
-  description: 'source the output to define common bash helper functions'
-}, {
-  name: 'reporoot',
-  type: Boolean,
-  default: false,
-  description: 'the root of the build-tools repo - for finding other config files'
-}, {
-  name: 'help',
-  type: Boolean,
-  default: false,
-  description: 'display this help screen'
-}, {
-  name: 'version',
-  type: Boolean,
-  default: false,
-  description: 'returns the build-tools repo version'
-}, {
-  name: 'verbose',
-  alias: 'v',
-  type: Boolean,
-  default: false,
-  description: 'emit additional info at run time'
-}];
-const sections = [{
-  header: 'A collection of build / support tools for all Leverege code',
-  content: `README: {green https://bitbucket.org/leverege/build-tools/src/development}
-`
-}, {
-  header: 'Options',
-  optionList
-}];
-const args = cliArgs(optionList, {
-  partial: true
-});
-const help = cliHelp(sections);
-const repoRoot = path.dirname(__dirname);
-const thisPackage = require(`${repoRoot}/package.json`);
-const thisVersion = thisPackage.version;
-if (args.root) {
-  console.log(repoRoot);
-  process.exit(0);
-}
-if (args.bashfun) {
-  console.log(`${repoRoot}/src/bash-funcs`);
-  process.exit(0);
-}
-if (args.reporoot) {
-  console.log(`${repoRoot}`);
-  process.exit(0);
-}
-const checkForLatest = async (pkg = '@leverege/build-tools') => {
-  const getToken = () => {
-    const tokenFile = `${process.env.HOME}/.npmrc`;
-    if (!fs.existsSync(tokenFile)) {
-      console.error(`Cannot find token file ${tokenFile}`);
-      process.exit(1);
-    }
-    try {
-      const tokenLine = fs.readFileSync(tokenFile).toString();
-      const tokenRegX = new RegExp('.*registry.npmjs.org\\/:\\w+=+(.*)');
-      const tokenStr = tokenLine.match(tokenRegX);
-      if (!tokenStr) {
-        console.error(`\n***ERROR: malformed npm token in ${tokenFile}\n`);
-        process.exit(1);
-      }
-      return tokenLine.match(tokenRegX)[1];
-    } catch (err) {
-      console.error(err);
-    }
-  };
-  try {
-    const list = await npmRegistryFetch.json(pkg, {
-      '//registry.npmjs.org/:_authToken': getToken()
-    });
-    return list['dist-tags'].latest;
-  } catch (err) {
-    console.log(err);
-  }
-};
-const checkAndAnnounce = () => {
-  checkForLatest().then(latestVersion => {
-    if (semverLt(thisVersion, latestVersion)) {
-      console.log(chalk.white`
-  Update available ${chalk.grey(thisVersion)} \u2b62 ${chalk.green(latestVersion)}
-  Run ${chalk.cyan('npm i -g @leverege/build-tools')} to update
-`);
-      process.exit(1);
-    } else {
-      process.exit(0);
-    }
-  }).catch(err => {});
-};
-if (args.latest) {
-  checkAndAnnounce();
-}
-if (args.version) {
-  console.log(`build-tools version ${thisVersion}`);
-  checkAndAnnounce();
-}
-if (args.help) {
-  console.log(help);
-  process.exit(0);
-}
-
-/* eslint-disable no-underscore-dangle */
-if (args._unknown) {
-  console.log(`\nUnrecognized argument [${args._unknown}] try --help\n`);
-  process.exit(1);
-}

package/lib/server/firebaseDeploy.js

@@ -1,195 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable no-console */
-// https://github.com/google/zx
-/* eslint-disable max-len */
-"use strict";
-
-var _enquirer = _interopRequireDefault(require("enquirer"));
-var _ansiColors = _interopRequireDefault(require("ansi-colors"));
-var _zx = require("zx");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-const {
-  prompt
-} = _enquirer.default;
-
-// This will preserve coloration from spawned child processes
-process.env.FORCE_COLORS = 3;
-process.env.FORCE_COLOR = '1';
-let TARGET;
-let CHANNEL;
-
-// A single unnamed parameter is assumed to be a deploy target.
-// If named parameters exist, they may not be stored in argv,
-// so don't look for a larger length of argv to decide whether to look for named paramters
-if (_zx.argv._.length === 1) {
-  TARGET = _zx.argv._[0];
-} else {
-  TARGET = _zx.argv.target;
-  if (_zx.argv.channelName) {
-    CHANNEL = {};
-    CHANNEL.name = _zx.argv.channelName;
-    CHANNEL.expiration = _zx.argv.channelExpiration ?? '7d';
-  }
-}
-
-// If target has not been defined on the command line,
-// then enter interactive mode
-const INTERACTIVE_MODE = !TARGET;
-let exited = false;
-const SECRETS_DIR = 'secrets';
-const EXIT_EVENTS = ['SIGINT', 'exit', 'uncaughException', 'unhandledRejection'];
-const [firebaserc, firebaseJson, gitBranch] = await Promise.all([_zx.fs.exists(_zx.path.join(process.cwd(), '.firebaserc')), _zx.fs.exists(_zx.path.join(process.cwd(), 'firebase.json')), (0, _zx.$)`git rev-parse --abbrev-ref HEAD -C ${process.cwd()}`.then(({
-  stdout
-}) => {
-  return stdout.split('\n')[0];
-})]);
-if (!firebaserc) {
-  console.log(_zx.chalk.red('No .firebaserc file found. Make sure that you are executing firebaseDeploy from within a firebase project directory.'));
-}
-if (!firebaseJson) {
-  console.log(_zx.chalk.red('No firebase.json file found. Make sure that you are executing firebaseDeploy from within a firebase project directory.'));
-}
-if (!firebaserc || !firebaseJson) {
-  process.exit();
-}
-const firebasercContent = JSON.parse(await _zx.fs.readFile(_zx.path.join(process.cwd(), '.firebaserc'), {
-  encoding: 'utf-8'
-}));
-let maxSiteIdLength = 0;
-const targets = Object.entries(firebasercContent.targets).reduce((prev, [projectId, config]) => {
-  Object.entries(config.hosting).forEach(([siteId, aliases]) => {
-    aliases.forEach(alias => {
-      // Store the longest length of site id for formatting later on
-      maxSiteIdLength = Math.max(siteId.length, maxSiteIdLength);
-      prev[alias] = {
-        projectId,
-        siteId,
-        alias,
-        production: config.production
-      };
-    });
-  });
-  return prev;
-}, {});
-if (INTERACTIVE_MODE) {
-  const {
-    targetEnv
-  } = await prompt([{
-    type: 'autocomplete',
-    name: 'targetEnv',
-    message: 'To which environment would you like to deploy?',
-    choices: Object.values(targets).map(t => {
-      const productionLabel = t.production ? _ansiColors.default.bold.red('--PRODUCTION--') : '';
-      return {
-        message: `${_ansiColors.default.bold.cyan('Site: ')}${t.siteId.padEnd(maxSiteIdLength)} ${_ansiColors.default.bold.green('Project: ')}${t.projectId} ${productionLabel}`,
-        value: t.alias
-      };
-    })
-  }]);
-  TARGET = targets[targetEnv];
-  if (TARGET.production) {
-    const {
-      confirmProductionDeploy
-    } = await prompt([{
-      type: 'confirm',
-      name: 'confirmProductionDeploy',
-      message: `${_ansiColors.default.bold.red('WARNING: ')} This is a ${_ansiColors.default.bold.yellow('PRODUCTION')} environment. Are you sure you want to deploy here?`
-    }]);
-    if (!confirmProductionDeploy) {
-      console.log('Cancelling deployment...');
-      process.exit();
-    }
-  }
-  const {
-    useChannel
-  } = await prompt([{
-    type: 'confirm',
-    name: 'useChannel',
-    message: 'Do you want to deploy to a temporary preview channel?'
-  }]);
-  if (useChannel) {
-    const {
-      channelName,
-      channelExpiration
-    } = await prompt([{
-      type: 'input',
-      name: 'channelName',
-      message: 'To which channel would you like to deploy?',
-      initial: gitBranch ?? 'temp-deploy'
-    }, {
-      type: 'input',
-      name: 'channelExpiration',
-      message: 'When should the channel expire?',
-      initial: '7d'
-    }]);
-    CHANNEL = {
-      name: channelName,
-      expiration: channelExpiration
-    };
-  }
-} else {
-  TARGET = targets[TARGET];
-}
-if (!TARGET) {
-  console.log(_zx.chalk.red('No such target exists in .firebaserc config.'));
-  process.exit();
-}
-const [aliasFileExists, siteIdFileExists, sharedFileExists] = await Promise.all([_zx.fs.exists(_zx.path.join(process.cwd(), SECRETS_DIR, `${TARGET.alias}.env`)), _zx.fs.exists(_zx.path.join(process.cwd(), SECRETS_DIR, `${TARGET.siteId}.env`)), _zx.fs.exists(_zx.path.join(process.cwd(), SECRETS_DIR, 'shared.env'))]);
-if (!aliasFileExists && !siteIdFileExists) {
-  console.log(_zx.chalk.red(`No env file for ${TARGET.alias} exists. Check your secrets directory and try again`));
-  process.exit();
-}
-const exec = [];
-if (sharedFileExists) {
-  exec.push(_zx.fs.readFile(_zx.path.join(process.cwd(), SECRETS_DIR, 'shared.env'), {
-    encoding: 'utf-8'
-  }));
-}
-if (aliasFileExists) {
-  exec.push(_zx.fs.readFile(_zx.path.join(process.cwd(), SECRETS_DIR, `${TARGET.alias}.env`), {
-    encoding: 'utf-8'
-  }));
-} else {
-  exec.push(_zx.fs.readFile(_zx.path.join(process.cwd(), SECRETS_DIR, `${TARGET.siteId}.env`), {
-    encoding: 'utf-8'
-  }));
-}
-console.log(`\n\n\n${_ansiColors.default.bold.green('====== Deployment Summary ======')}`);
-console.log(`${_ansiColors.default.blue('Firebase project:')} ${TARGET.projectId} ${TARGET.production ? _ansiColors.default.yellow('--PRODUCTION--') : ''}`);
-console.log(`${_ansiColors.default.blue('Site ID:')} ${TARGET.siteId}`);
-console.log(`${_ansiColors.default.blue('Channel Name:')} ${CHANNEL?.name ?? _ansiColors.default.italic.gray('(none)')}`);
-console.log(`${_ansiColors.default.blue('Channel Expiration date:')} ${CHANNEL?.name ? CHANNEL.expiration ?? _ansiColors.default.italic.gray('(none)') : _ansiColors.default.italic.gray('(n/a)')}`);
-console.log(`${_ansiColors.default.blue('Shared .env file:')} ${sharedFileExists ? `${SECRETS_DIR}/shared.env` : _ansiColors.default.italic.gray('(none)')}`);
-console.log(`${_ansiColors.default.blue('Additional .env overrides:')} ${aliasFileExists ? `${SECRETS_DIR}/${TARGET.alias}.env` : `${SECRETS_DIR}/${TARGET.siteId}.env`}`);
-console.log(`${_ansiColors.default.bold.green('===============================')}`);
-if (INTERACTIVE_MODE) {
-  const {
-    confirmSelections
-  } = await prompt([{
-    type: 'confirm',
-    name: 'confirmSelections',
-    message: 'Proceed with this deployment?'
-  }]);
-  if (!confirmSelections) {
-    console.log('Cancelling deployment...');
-    process.exit();
-  }
-}
-const envFileContent = (await Promise.all(exec)).join('\n');
-EXIT_EVENTS.forEach(event => {
-  process.on(event, () => {
-    if (!exited) {
-      exited = true;
-      _zx.fs.removeSync(_zx.path.join(process.cwd(), '.env.temp'));
-    }
-  });
-});
-await _zx.fs.writeFile(_zx.path.join(process.cwd(), '.env.temp'), envFileContent);
-try {
-  // deploying to a channel requires slightly different parameter structure 
-  const deployType = CHANNEL ? `hosting:channel:deploy ${CHANNEL.name} ${CHANNEL.expiration ? `--expires ${CHANNEL.expiration}` : ''}`.split(' ') : 'deploy';
-  const hostingPrefix = CHANNEL ? '' : 'hosting:';
-  await (0, _zx.$)`npm run clean && DOTENV_CONFIG_PATH=${_zx.path.join(process.cwd(), '.env.temp')} DEPLOYMENT_TARGET=${TARGET.siteId} npm run build && firebase use ${TARGET.projectId} && firebase ${deployType} --only ${hostingPrefix}${TARGET.siteId}`;
-} catch (err) {
-  console.error(err);
-}