@leverege/build-tools 2.52.0-pedro.10 → 2.52.0-pedro.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.52.0-pedro.10",
+  "version": "2.52.0-pedro.2",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -47,7 +47,8 @@
     "pull-git": "src/pull-git.sh",
     "push-my-chart": "src/push-my-chart.mjs",
     "refresh-npm-token": "src/refresh-npm-token.mjs",
-    "refresh-py-idx": "src/refresh-py-idx.mjs",
+    "refresh-py-idx-sa": "src/refresh-py-idx-sa.sh",
+    "refresh-py-idx": "src/refresh-py-idx.sh",
     "send-to-slack": "src/send-to-slack.mjs",
     "tag-release": "src/tag-release.mjs",
     "unleash": "src/unleash.mjs"

package/src/refresh-py-idx-sa.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# Description: Refreshes the service account key for the leverege-python-packages artifact registry repository and updates current configuration.
+
+GCP_ORGANIZATION_ID=741866105355
+GCP_PROJECT_ID=leverege-registry
+GCP_LOCATION=us
+
+echo "GCP Organization ID: $GCP_ORGANIZATION_ID"
+echo "GCP Project ID: $GCP_PROJECT_ID"
+echo "GCP Location: $GCP_LOCATION"
+
+# Get account from gcloud core config and set everything before the @ as the name variable and replace . with -.
+NAME=$(gcloud config get-value account | cut -d'@' -f1 | sed 's/\./-/g')
+SERVICE_ACCOUNT_NAME="$NAME-py"
+
+echo "GCP Service Account Name: $SERVICE_ACCOUNT_NAME"
+echo ""
+
+# Fetch or create service account
+SERVICE_ACCOUNTS=$(gcloud iam service-accounts list --format="value(email)" --filter="email:$SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com" 2>/dev/null)
+
+# If service account does not exist, create it
+if [ -z "$SERVICE_ACCOUNTS" ]; then
+  gcloud iam service-accounts create $SERVICE_ACCOUNT_NAME --display-name "$SERVICE_ACCOUNT_NAME"
+  echo "Service Account Created: $SERVICE_ACCOUNT_NAME"
+echo ""
+fi
+
+# Enable service account
+gcloud iam service-accounts enable $SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com
+echo "Service Account Enabled: $SERVICE_ACCOUNT_NAME"
+echo ""
+
+# Permission key against the leverege-python-packages artifact registry repository
+gcloud artifacts repositories add-iam-policy-binding leverege-python-packages \
+    --location=$GCP_LOCATION \
+    --member="serviceAccount:$SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+    --role="organizations/$GCP_ORGANIZATION_ID/roles/leveregeRegistryAccess" >/dev/null
+echo "Service Account Permission Granted: $SERVICE_ACCOUNT_NAME"
+echo ""
+
+# List service account keys
+SERVICE_ACCOUNT_KEYS=$(gcloud iam service-accounts keys list --iam-account=$SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com --format="value(name)")
+
+# If service account keys exist, delete them
+if [ ! -z "$SERVICE_ACCOUNT_KEYS" ]; then
+    for key in $SERVICE_ACCOUNT_KEYS; do
+        echo ""
+        gcloud iam service-accounts keys delete $key --iam-account=$SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com --quiet
+        echo "Service Account Key Deleted: $key"
+    done
+fi
+
+echo ""
+
+SERVICE_ACCOUNT_KEY_PATH=$HOME/.config/gcloud/$SERVICE_ACCOUNT_NAME.json
+
+# Silence the command
+gcloud iam service-accounts keys create $SERVICE_ACCOUNT_KEY_PATH --iam-account=$SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com
+echo "Service Account Key Created and Saved: $SERVICE_ACCOUNT_KEY_PATH"
+echo ""
+
+# Encode key to base64
+ENCODED_KEY=$(base64 -i $SERVICE_ACCOUNT_KEY_PATH -o -)
+
+# Write to pip.conf
+mkdir -p $HOME/.config/pip
+cat <<EOF > $HOME/.config/pip/pip.conf
+[global]
+extra-index-url = https://_json_key_base64:$ENCODED_KEY@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple/
+EOF
+echo "Updated $HOME/.config/pip/pip.conf"
+
+# Write to pypirc
+cat <<EOF > $HOME/.pypirc
+[distutils]
+index-servers =
+    leverege-python-packages
+
+[leverege-python-packages]
+repository: https://us-python.pkg.dev/leverege-registry/leverege-python-packages/
+username: _json_key_base64
+password: $ENCODED_KEY
+EOF
+echo "Updated $HOME/.pypirc"
+
+# Set UV_EXTRA_INDEX_URL env var
+export UV_EXTRA_INDEX_URL="https://_json_key_base64:$ENCODED_KEY@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple"
+echo "Updated UV_EXTRA_INDEX_URL"

package/src/refresh-py-idx.sh

@@ -0,0 +1,32 @@
+# Description: Refresh service account key using gcloud cli
+
+# SERVICE_ACCOUNT_NAME="leverege-py-index"
+# GCP_PROJECT_ID="leverege-registry"
+
+# TOKEN=$(gcloud auth print-access-token --impersonate-service-account $SERVICE_ACCOUNT_NAME@$GCP_PROJECT_ID.iam.gserviceaccount.com --lifetime=12h)
+TOKEN=$(gcloud auth print-access-token)
+
+# Write to pip.conf
+mkdir -p $HOME/.config/pip
+cat <<EOF > $HOME/.config/pip/pip.conf
+[global]
+extra-index-url = https://oauth2accesstoken:$TOKEN@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple/
+EOF
+echo "Updated $HOME/.config/pip/pip.conf"
+
+# Write to pypirc
+cat <<EOF > $HOME/.pypirc
+[distutils]
+index-servers =
+    leverege-python-packages
+
+[leverege-python-packages]
+repository: https://us-python.pkg.dev/leverege-registry/leverege-python-packages/
+username: oauth2accesstoken
+password: $TOKEN
+EOF
+echo "Updated $HOME/.pypirc"
+
+# Set UV_EXTRA_INDEX_URL env var
+export UV_EXTRA_INDEX_URL="https://oauth2accesstoken:$TOKEN@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple"
+echo "Updated UV_EXTRA_INDEX_URL"

package/src/refresh-py-idx.mjs

@@ -1,123 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable max-len */
-/* eslint-disable security/detect-non-literal-fs-filename */
-/* eslint-disable no-console */
-
-import { execSync } from 'child_process';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-// Execute gcloud command to get the token
-const TOKEN = execSync( 'gcloud auth print-access-token' ).toString().trim();
-
-// Write to pip.conf
-const pipConfigDir = path.join( os.homedir(), '.config', 'pip' );
-fs.mkdirSync( pipConfigDir, { recursive : true } );
-const pipConfigContent = `
-[global]
-extra-index-url = https://oauth2accesstoken:${TOKEN}@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple/
-`;
-fs.writeFileSync( path.join( pipConfigDir, 'pip.conf' ), pipConfigContent );
-console.log( 'Updated ~/.config/pip/pip.conf' );
-
-// Write to pypirc
-const pypircContent = `
-[distutils]
-index-servers =
-    leverege-python-packages
-
-[leverege-python-packages]
-repository: https://us-python.pkg.dev/leverege-registry/leverege-python-packages/
-username: oauth2accesstoken
-password: ${TOKEN}
-`;
-fs.writeFileSync( path.join( os.homedir(), '.pypirc' ), pypircContent );
-console.log( 'Updated ~/.pypirc\n' );
-
-// Escape for sed
-
-const UV_EXTRA_INDEX_URL = `https://foo:${TOKEN}@us-python.pkg.dev/leverege-registry/leverege-python-packages/simple`;
-
-const SHELLS = [ 'bash', 'dash', 'zsh', 'fish' ];
-
-SHELLS.forEach( ( shell ) => {
-  try {
-    execSync( `command -v ${shell}` );
-    let configFile;
-    switch ( shell ) {
-      case 'bash':
-        configFile = path.join( os.homedir(), '.bashrc' );
-        break;
-      case 'dash':
-        configFile = path.join( os.homedir(), '.profile' );
-        break;
-      case 'zsh':
-        configFile = path.join( os.homedir(), '.zshrc' );
-        break;
-      case 'fish':
-        configFile = path.join( os.homedir(), '.config', 'fish', 'config.fish' );
-        break;
-      default:
-        console.log( `Shell ${shell} is not supported.` );
-        return;
-    }
-
-    console.log( `Updating shell configuration in ${configFile}` );
-
-    let configContent = fs.readFileSync( configFile, 'utf8' );
-    const regex = /export UV_EXTRA_INDEX_URL=.*/;
-    const newLine = `export UV_EXTRA_INDEX_URL=${UV_EXTRA_INDEX_URL}`;
-
-    if ( regex.test( configContent ) ) {
-      configContent = configContent.replace( regex, newLine );
-    } else {
-      configContent += `\n${newLine}\n`;
-    }
-
-    fs.writeFileSync( configFile, configContent );
-  } catch ( error ) {
-    console.log( `Shell ${shell} is not installed.` );
-  }
-} );
-
-function getParentShell() {
-  let ppid = execSync( 'ps -p $$ -o ppid=' ).toString().trim();
-  let shell = execSync( `ps -p ${ppid} -o comm=` ).toString().trim();
-
-  while ( ppid !== '1' ) {
-    ppid = execSync( `ps -p ${ppid} -o ppid=` ).toString().trim();
-    shell = execSync( `ps -p ${ppid} -o comm=` ).toString().trim();
-
-    const shellMatch = shell.match( /bash|dash|zsh|fish/ );
-    if ( shellMatch ) {
-      return shellMatch[0];
-    }
-  }
-
-  return null
-}
-
-const shell = getParentShell();
-
-if ( !shell ) {
-  console.log( '\nCould not determine parent shell. Please source your shell configuration to apply the changes.\n' );
-  console.log( 'Example (bash): source ~/.bashrc' );
-  console.log( 'Example (dash): source ~/.profile' );
-  console.log( 'Example (zsh): source ~/.zshrc' );
-  console.log( 'Example (fish): source ~/.config/fish/config.fish' );
-  process.exit( 1 );
-}
-
-console.log( `\nReloading ${shell} shell with new configuration.\n` );
-
-switch ( shell ) {
-  case 'bash':
-  case 'dash':
-  case 'zsh':
-  case 'fish':
-    execSync( shell, { stdio : 'inherit' } );
-    break;
-  default:
-    console.log( `Shell ${shell} is not supported.\n` );
-}