@mnci/cli 4.4.0 → 4.6.0

package/dist/cli.js

@@ -313,8 +313,24 @@ function npmrcContent(registry, scope) {
   if (registry.kind === "npm") {
     return `; Publish authentication for the public npm registry.
 ;
-; NODE_AUTH_TOKEN is exported by the generated CI's release step; an unset value
-; is harmless locally, so no token is needed for day-to-day work.
+; NODE_AUTH_TOKEN is exported by the generated CI's release step. Nothing needs
+; it for day-to-day work here - installing, building and testing never
+; authenticate.
+;
+; It is NOT harmless the moment you DO want to authenticate from this directory,
+; which an earlier version of this comment claimed. A project .npmrc wins over
+; your user one, so with NODE_AUTH_TOKEN unset this line hands npm an empty
+; token and overrides 'npm login': inside this repo 'npm whoami' fails with a
+; 401 and any write is refused. The refusal is easy to misread, because for a
+; scoped package the registry answers a write you are not allowed to make with
+;
+;   npm error 404 Not Found - PUT https://registry.npmjs.org/@scope%2fthing
+;
+; and everything above it is npm listing what it intended to send, so a long
+; healthy-looking run still changes nothing.
+;
+; To publish or deprecate by hand, run it from outside this directory, or export
+; a real token first.
 //registry.npmjs.org/:_authToken=\${NODE_AUTH_TOKEN}
 
 ; There is deliberately NO '${scope}:registry' line here. npmjs.org is already
@@ -415,6 +431,14 @@ function withSharedGlobals(nxJson) {
     namedInputs: { ...namedInputs, sharedGlobals: [...existing, ...missing] }
   };
 }
+var PYTHON_GRAPH_PLUGIN = "@mnci/nx-python-pip/graph";
+function withPythonGraphPlugin(nxJson, pluginInstalled) {
+  const plugins = nxJson.plugins ?? [];
+  if (!pluginInstalled || plugins.some((entry) => pluginName(entry) === PYTHON_GRAPH_PLUGIN)) {
+    return nxJson.plugins === void 0 ? nxJson : { ...nxJson, plugins };
+  }
+  return { ...nxJson, plugins: [...plugins, PYTHON_GRAPH_PLUGIN] };
+}
 function withReleaseConfig(nxJson, ci) {
   return { ...nxJson, defaultBase: "main", release: releaseConfig(ci) };
 }
@@ -865,12 +889,27 @@ var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp
 var VERIFY_TARGETS = "lint,typecheck,test,build";
 var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
+var NPM_AUTH_PREFLIGHT = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(fs.globSync('packages/*/package.json').length===0){console.log('No npm packages to release - skipping.');process.exit(0)}if(!process.env.NODE_AUTH_TOKEN){console.error('NPM_TOKEN is empty or unset, so the publish would fail AFTER nx release has already tagged. Add it as a repository secret named exactly NPM_TOKEN - under Actions, not the Dependabot or Codespaces tab, and not an Environment secret. Use an npm Automation token - a Publish token is refused by 2FA in CI.');process.exit(1)}const r=cp.spawnSync('npm',['whoami','--registry=https://registry.npmjs.org/'],{encoding:'utf8',shell:process.platform==='win32'});if(r.status!==0){console.error('NPM_TOKEN is set but the registry rejected it - '+((r.stderr||'')+(r.stdout||'')).trim()+'. Check that it has not expired and that it grants publish rights on this scope.');process.exit(1)}console.log('npm auth OK as '+r.stdout.trim())"`;
+function npmAuthPreflight(registryKind) {
+  return registryKind === "npm" ? NPM_AUTH_PREFLIGHT : "";
+}
 var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
   return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
-function pythonPublishEnvFragment(pythonPublishUrl2) {
-  return pythonPublishUrl2 ? `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}` : "";
+var PYPI_TOKEN_VARIABLE = "PYPI_TOKEN";
+function pypiTokenEnvLine(registryKind, variableReference, indent) {
+  return registryKind === "npm" ? `
+${indent}${PYPI_TOKEN_VARIABLE}: ${variableReference(PYPI_TOKEN_VARIABLE)}` : "";
+}
+function pythonPublishEnvFragment(pythonPublishUrl2, registryKind) {
+  if (pythonPublishUrl2 !== void 0) {
+    return `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}`;
+  }
+  if (registryKind !== "npm") {
+    return "";
+  }
+  return `if(hasPython){if(!process.env.${PYPI_TOKEN_VARIABLE}){console.error('This workspace has '+pythonCount+' Python package(s) to publish but ${PYPI_TOKEN_VARIABLE} is empty. Add a PyPI API token as a secret named ${PYPI_TOKEN_VARIABLE}, or remove the Python packages from release.projects.');process.exit(1)}env.TWINE_USERNAME='__token__';env.TWINE_PASSWORD=process.env.${PYPI_TOKEN_VARIABLE};env.TWINE_NON_INTERACTIVE='1'}`;
 }
 function nugetPublishEnvFragment(nugetFeedUrl2) {
   return nugetFeedUrl2 ? "if(hasCsharp){env.NUGET_PAT=Buffer.from(process.env.PAT,'base64').toString()}" : "";
@@ -1129,7 +1168,17 @@ steps:
   - script: ${SHALLOW_CLONE_GUARD}
     displayName: Verify this is a full checkout (nx release needs the real tag history)
     condition: ${onMain}
-
+${npmAuthPreflight(registryKind) ? `
+  # Prove npm will accept us BEFORE anything irreversible happens. nx release
+  # tags first and publishes last, so a rejected token leaves a version tagged
+  # with nothing on the registry - and that number is then skipped forever,
+  # because the next run resolves the current version from the newest tag.
+  - script: ${npmAuthPreflight(registryKind)}
+    displayName: Preflight \u2014 npm must accept the token before anything is tagged
+    condition: ${onMain}
+    env:
+      NODE_AUTH_TOKEN: $(NPM_TOKEN)
+` : ""}
   # Version + tag + publish, in one release, for npm (packages/*), Python
   # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional commits,
   # tag-only push. Portable guard: nx release errors on an empty scope, so
@@ -1148,11 +1197,11 @@ steps:
   # it whenever more than one package is releasable. The guard below fails
   # the run rather than under-bumping silently: clear the variable back to
   # '' once the override is no longer needed.
-  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
+  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
     displayName: Release \u2014 version, tag and publish (npm + Python + C#)
     condition: ${onMain}
     env:
-      ${npmAuthName}: ${npmAuthValue}
+      ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `$(${name})`, " ".repeat(6))}
       RELEASE_SPECIFIER: $(RELEASE_SPECIFIER)
 
   # nx release's own git push (release.git.push) is deliberately left off: it
@@ -1355,7 +1404,18 @@ jobs:
       - run: ${SHALLOW_CLONE_GUARD}
         name: Verify this is a full checkout (nx release needs the real tag history)
         if: \${{ ${onMain} }}
-
+${npmAuthPreflight(registryKind) ? `
+      # Prove npm will accept us BEFORE anything irreversible happens. nx
+      # release tags first and publishes last, so a rejected token leaves a
+      # version tagged with nothing on the registry - and that number is then
+      # skipped forever, because the next run resolves the current version
+      # from the newest tag.
+      - run: ${npmAuthPreflight(registryKind)}
+        name: Preflight \u2014 npm must accept the token before anything is tagged
+        if: \${{ ${onMain} }}
+        env:
+          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
+` : ""}
       # Version + tag + publish, in one release, for npm (packages/*), Python
       # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional
       # commits, tag-only push. Portable guard: nx release errors on an empty
@@ -1381,11 +1441,11 @@ jobs:
       # which is why 'nx release' pushes the tag itself here \u2014 see
       # releaseConfig's remarks for why that is safe on this Nx version and
       # why every other provider combination keeps the explicit push step below.` : ""}
-      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2), nugetPublishEnvFragment(nugetFeedUrl2))}
+      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
         name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C#)
         if: \${{ ${onMain} }}
         env:
-          ${npmAuthName}: ${npmAuthValue}
+          ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `\${{ secrets.${name} }}`, " ".repeat(10))}
           RELEASE_SPECIFIER: \${{ vars.RELEASE_SPECIFIER }}${githubReleases ? `
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
 ${githubReleases ? "" : `
@@ -1498,7 +1558,13 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
   };
   const sync = { ...nxJson.sync, ...SYNC_CONFIG };
   const mnci = { ...nxJson.mnci, ...mnciConfig(options) };
-  const patched = withSharedGlobals(withEslintPlugin(withReleaseConfig(nxJson, options.ci)));
+  const rootManifest = readJson((0, import_node_path2.join)(workspaceRoot, "package.json"));
+  const hasPythonPlugin = (rootManifest.devDependencies ?? {})["@mnci/nx-python-pip"] !== void 0 || (rootManifest.dependencies ?? {})["@mnci/nx-python-pip"] !== void 0;
+  const withRelease = withReleaseConfig(nxJson, options.ci);
+  const patched = withPythonGraphPlugin(
+    withSharedGlobals(withEslintPlugin(withRelease)),
+    hasPythonPlugin
+  );
   onProgress("nx.json \u2014 release, sync, generators, shared inputs, mnci block");
   writeFileEnsured(nxJsonPath, toJson({ ...patched, generators, sync, mnci }));
   onProgress("package.json \u2014 root scripts, TS compilers, ESLint toolchain, overrides");
@@ -1892,14 +1958,22 @@ function pascalScope(scope) {
 var CSHARP_VERSION_ACTIONS_PATH = "tools/csharp-version-actions.cjs";
 var CSHARP_VERSION_ACTIONS = `'use strict'
 
-const { join } = require('node:path')
+const { posix } = require('node:path')
 const { VersionActions } = require('nx/release')
 
 const VERSION_TAG = /<Version>([^<]*)<\\/Version>/
 
+/*
+ * posix.join, never plain join. An Nx Tree path is workspace-relative and
+ * forward-slashed on EVERY platform, while join emits a backslashed path on
+ * Windows. This value is handed back to nx release for changelog and manifest
+ * bookkeeping, and interpolated into the user-facing error below, so it was
+ * wrong on every Windows machine. The same bug was already fixed in the
+ * Python and Flutter plugins' release actions; this third copy was missed.
+ */
 function findCsproj (tree, root) {
   const name = tree.children(root).find((entry) => entry.endsWith('.csproj'))
-  return name ? join(root, name) : null
+  return name ? posix.join(root, name) : null
 }
 
 /**
@@ -2836,18 +2910,35 @@ function pythonPipPluginSpec() {
   return process.env.MNCI2_PYTHON_PIP_SPEC ?? "@mnci/nx-python-pip";
 }
 function ensurePythonPipPlugin(workspaceRoot) {
-  if (hasPlugin(workspaceRoot, "@mnci/nx-python-pip")) {
+  if (!hasPlugin(workspaceRoot, "@mnci/nx-python-pip")) {
+    const spec = pythonPipPluginSpec();
+    logger.step(`Installing the Python toolchain plugin (${spec})`);
+    if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+      throw new Error("npm install of @mnci/nx-python-pip failed");
+    }
+  }
+  registerPythonGraphPlugin(workspaceRoot);
+}
+function registerPythonGraphPlugin(workspaceRoot) {
+  const nxJsonPath = (0, import_node_path12.join)(workspaceRoot, "nx.json");
+  if (!fileExists(nxJsonPath)) {
     return;
   }
-  const spec = pythonPipPluginSpec();
-  logger.step(`Installing the Python toolchain plugin (${spec})`);
-  if (runShell("npm", ["install", "--save-dev", spec, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
-    throw new Error("npm install of @mnci/nx-python-pip failed");
+  const nxJson = readJson(nxJsonPath);
+  const patched = withPythonGraphPlugin(nxJson, true);
+  if (patched.plugins?.includes(PYTHON_GRAPH_PLUGIN) !== true) {
+    return;
+  }
+  if (nxJson.plugins?.includes(PYTHON_GRAPH_PLUGIN) === true) {
+    return;
   }
+  logger.step(`Registering ${PYTHON_GRAPH_PLUGIN} so nx affected sees Python dependencies`);
+  writeFileEnsured(nxJsonPath, toJson(patched));
 }
 var PYTHON_REQUIREMENTS_DEV = `build
 twine
 ruff
+mypy
 pytest
 pip-audit
 `;