@mnci/cli 4.7.0 → 4.8.0

package/dist/cli.js

@@ -1637,6 +1637,38 @@ function ensureEslintCacheIgnored(workspaceRoot) {
 `
   );
 }
+var PYTHON_ARTEFACT_IGNORES = ["__pycache__/", "*.py[cod]"];
+function ensurePythonArtefactsIgnored(workspaceRoot) {
+  const gitignorePath = (0, import_node_path2.join)(workspaceRoot, ".gitignore");
+  if (!fileExists(gitignorePath)) {
+    return;
+  }
+  const hasPython = (0, import_node_fs2.globSync)(
+    ["python-packages/*/pyproject.toml", "apps/*/pyproject.toml", "libs/*/pyproject.toml"],
+    { cwd: workspaceRoot }
+  ).length > 0;
+  if (!hasPython) {
+    return;
+  }
+  const current = (0, import_node_fs2.readFileSync)(gitignorePath, "utf8");
+  const present = new Set(current.split("\n").map((line) => line.trim()));
+  const missing = PYTHON_ARTEFACT_IGNORES.filter((line) => !present.has(line));
+  if (missing.length === 0) {
+    return;
+  }
+  const withoutTrailingBlankLines = current.replace(/\n+$/u, "");
+  const separator = withoutTrailingBlankLines.length > 0 ? "\n\n" : "";
+  const heading = [
+    "# Added by MoNecromanCI: Python bytecode. The tool caches (.mypy_cache,",
+    "# .pytest_cache, .ruff_cache) write their own .gitignore; CPython does not."
+  ].join("\n");
+  writeFileEnsured(
+    gitignorePath,
+    `${withoutTrailingBlankLines}${separator}${heading}
+${missing.join("\n")}
+`
+  );
+}
 function removeProjectEslintConfigs(workspaceRoot) {
   const matches = (0, import_node_fs2.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
@@ -1728,6 +1760,7 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
   writeFileEnsured((0, import_node_path2.join)(workspaceRoot, ESLINT_MNCI_FILENAME), ESLINT_MNCI_CONFIG);
   writeEslintEntryPoint(workspaceRoot, onProgress);
   ensureEslintCacheIgnored(workspaceRoot);
+  ensurePythonArtefactsIgnored(workspaceRoot);
   for (const retired of RETIRED_FORMATTER_FILES) {
     removeIfPresent((0, import_node_path2.join)(workspaceRoot, retired));
   }
@@ -4685,6 +4718,53 @@ function checkNpmrc(workspaceRoot, registry, scope) {
     remedy: "run `mnci upgrade`"
   };
 }
+function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
+  const npmrcPath = (0, import_node_path19.join)(workspaceRoot, ".npmrc");
+  if (!fileExists(npmrcPath)) {
+    return void 0;
+  }
+  const npmrc = (0, import_node_fs12.readFileSync)(npmrcPath, "utf8");
+  const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const referenced = [
+    ...new Set(
+      credentials.flatMap(
+        (line) => Array.from(line.matchAll(/\$\{(\w+)\}/gu), (match) => match[1])
+      )
+    )
+  ];
+  if (referenced.length === 0) {
+    return void 0;
+  }
+  const unset = referenced.filter((name) => (environment[name] ?? "") === "");
+  if (unset.length === 0) {
+    return npmjsCredentialShape(credentials, environment);
+  }
+  return {
+    check: "npm credentials in this workspace resolve to something",
+    ok: false,
+    detail: `.npmrc authenticates with \${${unset.join("}, ${")}}, which ${unset.length > 1 ? "are" : "is"} unset here \u2014 and a project .npmrc beats your user one, so npm will send an EMPTY token from this directory rather than the one \`npm login\` wrote. Writes are then refused as a 404 on the PUT, which reads like a missing package`,
+    remedy: "nothing, for installing or building \u2014 this only affects authenticated commands. To publish or deprecate by hand, run it from outside this workspace, or export a real token first. If it still fails there, `npm whoami` \u2014 an expired token gives the same 404"
+  };
+}
+var NPM_TOKEN_PREFIX = "npm_";
+var LEGACY_NPM_TOKEN = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu;
+function npmjsCredentialShape(credentials, environment) {
+  const line = credentials.find((entry) => entry.includes("//registry.npmjs.org/:_authToken="));
+  const variable = line === void 0 ? void 0 : /\$\{(\w+)\}/u.exec(line)?.[1];
+  if (variable === void 0) {
+    return void 0;
+  }
+  const value = environment[variable] ?? "";
+  if (value.startsWith(NPM_TOKEN_PREFIX) || LEGACY_NPM_TOKEN.test(value)) {
+    return void 0;
+  }
+  return {
+    check: "the credential bound for npmjs.org looks like an npm token",
+    ok: false,
+    detail: `\${${variable}} is set (${value.length} characters) but does not start with '${NPM_TOKEN_PREFIX}' and is not a legacy UUID token, so it is probably a credential for somewhere else \u2014 '${variable}' is a generic name that other tooling also sets, and inside this workspace it is sent to the PUBLIC registry. A write then fails as a 404 on the PUT, which reads like a missing package`,
+    remedy: `\`npm whoami\` to confirm \u2014 it is the only thing that separates a wrong token from an expired one. Then unset \`${variable}\` for local work, or set it to a real npm token`
+  };
+}
 function checkVersionActions(workspaceRoot) {
   const candidates = [
     ...(0, import_node_fs12.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
@@ -4869,6 +4949,7 @@ function collectFindings(workspaceRoot) {
     checkEslintPlugin(nxJson),
     checkResolvedEslint(workspaceRoot),
     checkNpmrc(workspaceRoot, nxJson.mnci?.registry, nxJson.mnci?.scope),
+    checkNpmrcCredentialResolves(workspaceRoot),
     checkNoRootRuntimeDependencies(workspaceRoot),
     ...checkRollupSourceMaps(workspaceRoot),
     ...checkDeclarationSpecifiers(workspaceRoot),