@mnci/cli 1.13.0 → 1.14.0

package/README.md

@@ -126,7 +126,7 @@ that would just fail felt worse than being upfront that it doesn't exist yet.
    is ever pushed to `main`; future runs resolve versions from tag names.
 3. Writes `eslint.config.mjs` (three lines importing `@mnci/eslint-config` —
    the whole linting opinion, in one root config), `.prettierrc.json` +
-   `.prettierignore`, `.npmrc` (comment-only — see **Known gaps** below),
+   `.prettierignore`, `.npmrc` (publish auth — see **Publish auth** below),
    `commitlint.config.mjs`, a husky `commit-msg` hook, the chosen CI provider's
    pipeline file(s)
    (`azure-pipelines.yml` and/or `.github/workflows/ci.yml`, `--ci`, default
@@ -404,6 +404,42 @@ lint,test,build`. Pushes to `main` then:
   _only_ configured provider, since that's the one case a `GITHUB_TOKEN` is
   guaranteed to exist.
 
+### Publish auth
+
+The generated `.npmrc` differs by registry kind, because the honest answer does.
+
+**`--registry azure-artifacts`** routes the workspace's own scope to the feed and
+supplies the feed's credentials:
+
+```ini
+@my:registry=https://pkgs.dev.azure.com/<org>/<proj>/_packaging/<feed>/npm/registry/
+//pkgs.dev.azure.com/.../npm/registry/:username=AzureArtifacts
+//pkgs.dev.azure.com/.../npm/registry/:_password=${PAT}
+```
+
+Scope routing is **real protection** here, not decoration: npm prefers a scope's
+registry over the global one when publishing a scoped package, so `@my/*` cannot
+reach npmjs.org by accident. Verified against a real registry — with only the
+scope line set, npm reports `Publishing to <feed>` — and again from a generated
+workspace, whose `npm publish --dry-run` targets the feed.
+
+Only the scope is routed, deliberately. A global `registry=` would push every
+install through the feed as well, so `npm ci` would need feed auth just to fetch
+public packages; as generated, public dependencies still come from npmjs.org and
+a developer with no `PAT` set can install normally.
+
+**`--registry npm`** gets the auth line and nothing else:
+
+```ini
+//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+```
+
+There is no `@scope:registry` line, and the generated file explains why: npmjs.org
+is already the default, so routing the scope there changes nothing — and calling
+it protection against an accidental public publish would be false, because the
+public registry is the intended target. Worth stating plainly because this file
+previously claimed exactly that protection while emitting no routing line at all.
+
 **npm auth** is the base64 `PAT`, read the same way on both providers but from
 a different place: on Azure Pipelines, a **variable group**
 (`--variable-group`, default `Build`) exposes it as `$(PAT)`; on GitHub
@@ -516,13 +552,10 @@ than a surprise:
 
 ## Known gaps (accepted for the experiment)
 
-- **The generated `.npmrc` is empty (comments only), so `npm publish` will not
-  authenticate.** This is a deliberate deferral, not an oversight: the previous
-  file claimed here that scope routing made accidental public publishes
-  impossible, when in fact no `@scope:registry` line was ever emitted. Rather
-  than ship half-wired auth, the CI token export (`NODE_AUTH_TOKEN`/`PAT`) is
-  left in place so wiring it later is one line, and the generated `.npmrc`
-  carries a comment saying so. Publish-path e2e assertions are relaxed to match.
+- **A scoped package on public npm has no accidental-publish protection**, and
+  cannot: npmjs.org is the intended target there, so no `.npmrc` line could
+  prevent it. Generate with `--registry azure-artifacts` if you need a scope kept
+  off the public registry — that variant routes it (see **Publish auth** above).
 - No `doctor`/`resurrect`/`spell` — out of scope until the model is proven.
 - **Flutter apps build for web only.** Android would require the Android SDK and
   NDK on every build agent; iOS is impossible on a Linux agent regardless. Add

package/dist/cli.js

@@ -1250,15 +1250,49 @@ var TS_COMPILER_DEPENDENCIES = {
   "@typescript/native": "npm:typescript@^7.0.2",
   typescript: "npm:@typescript/typescript6@^6.0.2"
 };
-function npmrcContent(_registry, _scope) {
-  return `; Intentionally empty.
+function registryUrl(registry) {
+  if (registry.kind === "azure-artifacts") {
+    return `https://pkgs.dev.azure.com/${registry.organization}/${registry.project}/_packaging/${registry.artifactsFeed}/npm/registry/`;
+  }
+  return void 0;
+}
+function npmrcContent(registry, scope) {
+  if (registry.kind === "npm") {
+    return `; Publish authentication for the public npm registry.
 ;
-; Publish authentication is not configured yet. The generated CI exports a
-; token for the release step (NODE_AUTH_TOKEN for public npm, PAT for Azure
-; Artifacts), but nothing here consumes it, so 'npm publish' will not
-; authenticate until this is wired up.
+; NODE_AUTH_TOKEN is exported by the generated CI's release step; an unset value
+; is harmless locally, so no token is needed for day-to-day work.
+//registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}
+
+; There is deliberately NO '${scope}:registry' line here. npmjs.org is already
+; the default registry, so routing the scope to it would change nothing \u2014 and
+; presenting that as protection against an accidental public publish would be
+; false, because the public registry is the intended target. (An earlier version
+; of this file made exactly that claim while emitting no routing line at all.)
+; To keep a scoped package off npmjs.org, use a private feed: generate with
+; --registry azure-artifacts, which does route the scope.
+`;
+  }
+  const feedUrl = registryUrl(registry);
+  const feedKey = feedUrl.replace(/^https:/, "");
+  return `; Publish + resolution routing for this workspace's own scope.
 ;
-; See "Known gaps" in the @mnci/cli README.
+; '${scope}:registry' sends BOTH resolution and 'npm publish' of ${scope}/* to the
+; feed: npm prefers a scope's registry over the global one when publishing a
+; scoped package, so a ${scope}/* package cannot reach npmjs.org by accident.
+;
+; Only the scope is routed, on purpose. A global 'registry=' would send every
+; install through the feed as well, so 'npm ci' would need feed auth just to fetch
+; public packages.
+${scope}:registry=${feedUrl}
+
+; Feed credentials. PAT is the BASE64 value Azure Artifacts' "Connect to feed"
+; instructions give you, which is exactly what _password expects, so it is used
+; as-is. (twine wants the RAW token; the CI release step decodes it there.)
+; Azure ignores the username, and npm requires an email it never uses.
+${feedKey}:username=AzureArtifacts
+${feedKey}:_password=\${PAT}
+${feedKey}:email=npm-requires-this-and-never-uses-it
 `;
 }
 function releaseConfig(ci) {
@@ -1502,9 +1536,18 @@ function azurePipelinesYaml(agent, variableGroup, pythonPublishUrl2, registryKin
 # runs unchanged on Linux, macOS and Windows agents.
 
 trigger:
+  # While a run is in progress, queue further pushes and run them together rather
+  # than concurrently. This is the closest thing Azure Pipelines YAML has to
+  # GitHub's concurrency group, and it is load-bearing on main for the same
+  # reason: two concurrent 'nx release' runs would race to create the same tag.
+  batch: true
   branches:
     include: [main]
 
+# Note: cancelling a superseded PR validation run is NOT a YAML setting on Azure
+# \u2014 it lives in the branch policy ("Build validation -> automatically cancel").
+# Nothing here can express it, so it is left to whoever configures the policy
+# rather than faked with a batch setting that would only delay PR runs.
 pr:
   branches:
     include: [main]
@@ -1517,6 +1560,12 @@ variables:
   # for an Azure Artifacts feed, or a raw npm automation token as \`NPM_TOKEN\`
   # for public npm. Mark it secret in Library. Add app build vars here too if needed.
   - group: ${variableGroup}
+  # Relocates npm's cache inside the pipeline workspace so Cache@2 can restore it
+  # (the default ~/.npm is outside the cacheable area on hosted agents). npm reads
+  # this as an ordinary env var, so it needs no config file and works on every
+  # agent OS.
+  - name: npm_config_cache
+    value: $(Pipeline.Workspace)/.npm
 
 steps:
   - checkout: self
@@ -1541,6 +1590,20 @@ steps:
     inputs:
       version: 24.x
 
+  # The Azure counterpart of \`cache: npm\` on actions/setup-node: restores npm's
+  # download cache so \`npm ci\` does not re-fetch every tarball on every run.
+  # Keyed on the lockfile, so a dependency change misses and anything else hits;
+  # restoreKeys falls back to the newest cache for this OS on a miss, which still
+  # avoids a fully cold install. Agent.OS is in the key because a cached native
+  # module built for one OS is not reusable on another.
+  - task: Cache@2
+    displayName: Cache npm packages
+    inputs:
+      key: 'npm | "$(Agent.OS)" | package-lock.json'
+      restoreKeys: |
+        npm | "$(Agent.OS)"
+      path: $(npm_config_cache)
+
   - script: npm ci
     displayName: Install dependencies
     env:
@@ -1698,6 +1761,19 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  # One run at a time per ref, but \`cancel-in-progress\` is an **expression** on
+  # purpose rather than a flat \`true\`.
+  #
+  # A superseded PR run is pure waste, so cancel it. A run on \`main\` must never
+  # be cancelled: it publishes packages and pushes release tags, and killing it
+  # part-way can leave a tag pushed with the publish only half done \u2014 a state no
+  # rerun repairs cleanly, because the version is then already tagged. Those runs
+  # queue instead, which also stops two \`nx release\` invocations racing to create
+  # the same tag when two commits land close together.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+
 permissions:
   # Lets the release step push the version tag nx release creates back to main,
   # and (github-only provider) create the GitHub Release itself.
@@ -1721,6 +1797,11 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          # Caches ~/.npm keyed on package-lock.json, so \`npm ci\` restores from
+          # the local cache instead of re-downloading every tarball on every run.
+          # Nothing to invalidate by hand: the action keys on the lockfile, so a
+          # dependency change misses the cache and a no-op change hits it.
+          cache: npm
 
       - run: npm ci
         name: Install dependencies