@mnci/cli 4.39.0 → 4.40.1

package/dist/cli.js

@@ -492,6 +492,189 @@ function fileExists(path) {
   return (0, import_node_fs4.existsSync)(path);
 }
 
+// src/pipeline-customization/legacy-pipeline-steps.algorithm.ts
+var MNCI_STEP_NAMES = /* @__PURE__ */ new Set([
+  "Add Go tool bin to PATH",
+  "Add the Flutter SDK to PATH",
+  "Attach HEAD and fetch refs",
+  "Attach HEAD to the source branch",
+  "Attach the per-platform zips to the GitHub Release (releasable Go apps)",
+  "Attach this OS's zip to the GitHub Release (releasable native apps)",
+  "Audit dependencies (fails on an actionable npm advisory)",
+  "Authenticate npm against the feed (build identity, no PAT)",
+  "Authenticate npm registry",
+  "Build all deployables",
+  "Cache npm packages",
+  "Check formatting (run 'npm run format' locally to fix)",
+  "Detect .NET projects",
+  "Download Go module dependencies",
+  "Ensure the function-apps folder exists",
+  "Fetch branches and release tags",
+  "Install Azure Functions Core Tools",
+  "Install dependencies",
+  "Install golangci-lint",
+  "Install native prerequisites (Linux)",
+  "Install Python dependencies (ruff, pytest, build, twine)",
+  "Install Python dependencies (ruff, pytest, build, twine, pip-audit)",
+  "Install Python project dependencies (editable, workspace-wide)",
+  "Lint",
+  "Lint, test and build affected projects",
+  "Lint, test and build affected projects (PR)",
+  "Lint, test and build everything",
+  "Lint, test, build and package the native apps",
+  "Lint, typecheck, test and build everything",
+  "npm audit (fails on an actionable advisory)",
+  "npm audit (non-blocking)",
+  "Pack all apps (one zip per app -> dist/drop)",
+  "Package function apps",
+  "Pin npm to the major mnci verifies against",
+  "pip-audit (non-blocking)",
+  "Preflight \u2014 name the PyPI projects this release would create",
+  "Preflight \u2014 npm must accept the token before anything is tagged",
+  "Publish function app packages",
+  "Publish packages and tag main",
+  "Publish Python packages (uv)",
+  "Publish the drop (one zip per app)",
+  "Push release tags (nx release's own push never runs without a remote Release configured)",
+  "Release (version from commits, tag-only, publish)",
+  "Resolve Dart dependencies (one pub get for the whole workspace)",
+  "Set the git identity used for release tags",
+  "Set up the Go toolchain",
+  "Set up the language toolchains (Python, Go, Flutter)",
+  "Sign in to Microsoft Entra ID (VS Code Marketplace)",
+  "Tag the run per app (type-name)",
+  "Test and build everything",
+  "Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)",
+  "Verify this is a full checkout (nx release needs the real tag history)"
+]);
+var MNCI_STEP_NAME_PATTERNS = [
+  /^Install the (\.NET SDK|Flutter SDK)/,
+  /^Release — version, tag/,
+  /^Verify \(/,
+  /^Publish this OS's native zips/
+];
+var MNCI_USES = ["actions/checkout@", "actions/setup-node@", "actions/setup-dotnet@", "actions/upload-artifact@", "azure/login@"];
+var MNCI_TASKS = ["UseNode@", "Cache@", "PublishBuildArtifacts@", "UseDotNet@", "npmAuthenticate@"];
+var MNCI_COMMANDS = ["npm ci", "npm install -g npm@", "git fetch --all", 'git config user.name "github-actions', "git checkout -B", "npx mnci ci", "npx nx sync"];
+function findFirstStepList(lines) {
+  const keyAt = lines.findIndex((line) => line.trim() === "steps:");
+  if (keyAt === -1) {
+    return void 0;
+  }
+  const firstItem = lines.findIndex((line, index) => index > keyAt && /^\s*- /.test(line));
+  if (firstItem === -1) {
+    return void 0;
+  }
+  const indent = lines[firstItem].length - lines[firstItem].trimStart().length;
+  const itemStart = " ".repeat(indent) + "- ";
+  const steps = [];
+  let pending = [];
+  let current;
+  for (let index = firstItem; index < lines.length; index++) {
+    const line = lines[index];
+    const lineIndent = line.length - line.trimStart().length;
+    const isBlank = line.trim() === "";
+    const isComment = line.trimStart().startsWith("#");
+    if (line.startsWith(itemStart)) {
+      current = { lead: pending, body: [line] };
+      steps.push(current);
+      pending = [];
+    } else if (isBlank || isComment && lineIndent <= indent) {
+      pending.push(line);
+    } else if (current && lineIndent > indent) {
+      current.body.push(...pending, line);
+      pending = [];
+    } else {
+      break;
+    }
+  }
+  return { steps, indent };
+}
+function topLevelFields(step) {
+  const fields = /* @__PURE__ */ new Map();
+  const keyIndent = step.body[0].length - step.body[0].trimStart().length + 2;
+  for (const [index, line] of step.body.entries()) {
+    const text = index === 0 ? line.trimStart().replace(/^- /, "") : line;
+    const lineIndent = index === 0 ? keyIndent : line.length - line.trimStart().length;
+    const trimmed = text.trimStart();
+    const colon = trimmed.indexOf(":");
+    const key = colon === -1 ? "" : trimmed.slice(0, colon);
+    if (lineIndent === keyIndent && /^[\w-]+$/.test(key) && !fields.has(key)) {
+      fields.set(key, trimmed.slice(colon + 1).trim().replaceAll(/^["']|["']$/g, ""));
+    }
+  }
+  return fields;
+}
+function isGeneratedStep(step) {
+  const fields = topLevelFields(step);
+  const name = fields.get("name") ?? fields.get("displayName");
+  if (name !== void 0 && (MNCI_STEP_NAMES.has(name) || MNCI_STEP_NAME_PATTERNS.some((pattern) => pattern.test(name)))) {
+    return true;
+  }
+  const uses = fields.get("uses");
+  if (uses !== void 0 && MNCI_USES.some((prefix) => uses.startsWith(prefix))) {
+    return true;
+  }
+  const task = fields.get("task");
+  if (task !== void 0 && MNCI_TASKS.some((prefix) => task.startsWith(prefix))) {
+    return true;
+  }
+  if (fields.has("checkout")) {
+    return true;
+  }
+  const command = fields.get("run") ?? fields.get("script");
+  return command !== void 0 && MNCI_COMMANDS.some((prefix) => command.startsWith(prefix));
+}
+function describeStep(step) {
+  const fields = topLevelFields(step);
+  return fields.get("name") ?? fields.get("displayName") ?? (fields.get("run") ?? fields.get("script") ?? step.body[0].trim()).slice(0, 60);
+}
+function landmark(step) {
+  const name = topLevelFields(step).get("name") ?? topLevelFields(step).get("displayName") ?? "";
+  if (/^(?:Verify \(|Lint|Test and build|Typecheck)/.test(name)) {
+    return "verify";
+  }
+  if (name.startsWith("Pack all apps")) {
+    return "pack";
+  }
+  if (/^(?:Release|Publish packages and tag)/.test(name)) {
+    return "release";
+  }
+  return void 0;
+}
+function readLegacyPipeline(lines) {
+  const reading = { slots: /* @__PURE__ */ new Map(), kept: [], hasPack: false, hasRelease: false };
+  const list = findFirstStepList(lines);
+  if (!list) {
+    return reading;
+  }
+  const marks = list.steps.map((step) => landmark(step));
+  const gate = marks.indexOf("verify");
+  const release = marks.indexOf("release");
+  reading.hasPack = marks.includes("pack");
+  reading.hasRelease = release !== -1;
+  for (const [index, step] of list.steps.entries()) {
+    if (isGeneratedStep(step)) {
+      continue;
+    }
+    let slot = "after-install";
+    if (release !== -1 && index > release) {
+      slot = "after-release";
+    } else if (gate !== -1 && index > gate) {
+      slot = "before-release";
+    }
+    const lines_ = [...step.lead, ...step.body].map((line) => line.startsWith(" ".repeat(list.indent)) ? line.slice(list.indent) : line.trimStart());
+    const existing = reading.slots.get(slot) ?? [];
+    reading.slots.set(slot, [...existing, ...existing.length > 0 ? [""] : [], ...trimBlank(lines_)]);
+    reading.kept.push(describeStep(step));
+  }
+  return reading;
+}
+function trimBlank(lines) {
+  const first = lines.findIndex((line) => line.trim() !== "");
+  return first === -1 ? [] : lines.slice(first);
+}
+
 // src/pipeline-customization/pipeline-markers.algorithm.ts
 var CHOOSABLE_PHASES = ["pack", "release"];
 var SLOT_BEGIN = /^(\s*)# mnci:slot (\S+)/;
@@ -597,6 +780,31 @@ function inspectPipeline(text) {
   };
 }
 
+// src/pipeline-customization/migrate-legacy-pipeline.use-case.ts
+function migrateLegacyPipeline(legacy, generated) {
+  const reading = readLegacyPipeline(legacy.split("\n"));
+  const off = [];
+  if (reading.kept.length > 0 || reading.hasPack || reading.hasRelease) {
+    if (!reading.hasPack) {
+      off.push("pack");
+    }
+    if (!reading.hasRelease) {
+      off.push("release");
+    }
+  }
+  const text = commentOutPhases(injectSlots(generated, reading.slots), off);
+  const notes = [
+    "This pipeline was written before mnci kept user slots, so it was regenerated. Edits to the steps mnci generated, and anything outside the step list (triggers, variables, extra jobs), are in git history."
+  ];
+  if (reading.kept.length > 0) {
+    notes.push(`Kept ${reading.kept.length} step${reading.kept.length === 1 ? "" : "s"} of your own in the new slots: ${reading.kept.join("; ")}. Check their order.`);
+  }
+  for (const phase of off) {
+    notes.push(`The old pipeline had no ${phase} step, so the ${phase} phase is switched off.`);
+  }
+  return { text, notes };
+}
+
 // src/pipeline-customization/merge-pipeline.use-case.ts
 function mergePipeline(existing, generated) {
   if (existing === void 0) {
@@ -604,10 +812,7 @@ function mergePipeline(existing, generated) {
   }
   const normalized = existing.replaceAll("\r\n", "\n");
   if (!/^\s*# mnci:(?:slot|phase) /m.test(normalized)) {
-    return {
-      text: generated,
-      notes: ['This pipeline was written before mnci kept user slots, so it was regenerated whole. Edits outside the generated steps are in git history: re-apply them inside the new "# mnci:slot" blocks.']
-    };
+    return migrateLegacyPipeline(normalized, generated);
   }
   const off = switchedOffPhases(normalized);
   const text = commentOutPhases(injectSlots(generated, extractSlots(normalized)), off);
@@ -805,7 +1010,19 @@ function releaseConfig(ci) {
       //
       // A workspace that DOES want the lock file refreshed should commit the
       // bump too (`git.commit: true`), at which point this can be dropped.
-      versionActionsOptions: { skipLockFileUpdate: true }
+      versionActionsOptions: { skipLockFileUpdate: true },
+      // OFF, because under this tag-only model it can only ever refuse a release.
+      //
+      // With it on, nx will not release a package whose internal dependency range
+      // cannot absorb the bump, and `git.commit: false` means the manifests on disk
+      // stay at the scaffold version for ever, so the range is always the one that
+      // was written then. Packages start at 0.0.1 and `npm install <pkg> -w <other>`
+      // writes `^0.0.1`, which on a 0.0.x version matches that version alone: the
+      // first bump to 0.0.2 is outside it, and the release dies in the version phase,
+      // before anything is tagged, with lint, typecheck, test and build all green
+      // (the release runs on the default branch only, so nothing else ever tries it).
+      // Measured on a fresh workspace of two interdependent packages (#345).
+      preserveMatchingDependencyRanges: false
     },
     changelog: githubReleases ? {
       workspaceChangelog: false,
@@ -7959,6 +8176,17 @@ function checkNativeBuildConfig(workspaceRoot) {
     remedy: "fix the entry in the mnci block of nx.json, then run `mnci upgrade`"
   }];
 }
+function checkDependencyRangesNotPreserved(nxJson) {
+  if (nxJson.release === void 0) {
+    return void 0;
+  }
+  return {
+    check: "nx release does not preserve matching dependency ranges",
+    ok: nxJson.release.version?.preserveMatchingDependencyRanges === false,
+    detail: "release.version.preserveMatchingDependencyRanges is not false, so the first release of interdependent packages fails in the version phase, before anything is tagged",
+    remedy: "run `mnci upgrade`, or set release.version.preserveMatchingDependencyRanges to false in nx.json"
+  };
+}
 function collectFindings(workspaceRoot) {
   const nxJsonPath = (0, import_node_path32.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
@@ -7985,7 +8213,8 @@ function collectFindings(workspaceRoot) {
     checkGoWorkInSync(workspaceRoot),
     ...checkNativeApps(workspaceRoot),
     ...checkPipelinePhases(workspaceRoot),
-    ...checkNativeBuildConfig(workspaceRoot)
+    ...checkNativeBuildConfig(workspaceRoot),
+    checkDependencyRangesNotPreserved(nxJson)
   ].filter((finding) => finding !== void 0);
 }
 function runDoctor(workspaceRoot, options = {}) {