@mnci/cli 4.7.1 → 4.8.1

package/dist/cli.js

@@ -944,13 +944,17 @@ function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
   return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
 var PYPI_TOKEN_VARIABLE = "PYPI_TOKEN";
+var AZURE_PAT_VARIABLE = "PAT";
+function azurePatPreflight(countExpression, subject) {
+  return `if(!process.env.${AZURE_PAT_VARIABLE}){console.error('This workspace has '+${countExpression}+' ${subject} package(s) to publish to Azure Artifacts but ${AZURE_PAT_VARIABLE} is empty. Add your base64-encoded Azure DevOps PAT as a secret named ${AZURE_PAT_VARIABLE}, or remove the ${subject} packages from release.projects.');process.exit(1)}`;
+}
 function pypiTokenEnvLine(registryKind, variableReference, indent) {
   return registryKind === "npm" ? `
 ${indent}${PYPI_TOKEN_VARIABLE}: ${variableReference(PYPI_TOKEN_VARIABLE)}` : "";
 }
 function pythonPublishEnvFragment(pythonPublishUrl2, registryKind) {
   if (pythonPublishUrl2 !== void 0) {
-    return `if(hasPython){env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.PAT,'base64').toString()}`;
+    return `if(hasPython){${azurePatPreflight("pythonCount", "Python")}env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.${AZURE_PAT_VARIABLE},'base64').toString()}`;
   }
   if (registryKind !== "npm") {
     return "";
@@ -958,10 +962,10 @@ function pythonPublishEnvFragment(pythonPublishUrl2, registryKind) {
   return `if(hasPython){if(!process.env.${PYPI_TOKEN_VARIABLE}){console.error('This workspace has '+pythonCount+' Python package(s) to publish but ${PYPI_TOKEN_VARIABLE} is empty. Add a PyPI API token as a secret named ${PYPI_TOKEN_VARIABLE}, or remove the Python packages from release.projects.');process.exit(1)}env.TWINE_USERNAME='__token__';env.TWINE_PASSWORD=process.env.${PYPI_TOKEN_VARIABLE};env.TWINE_NON_INTERACTIVE='1'}`;
 }
 function nugetPublishEnvFragment(nugetFeedUrl2) {
-  return nugetFeedUrl2 ? "if(hasCsharp){env.NUGET_PAT=Buffer.from(process.env.PAT,'base64').toString()}" : "";
+  return nugetFeedUrl2 ? `if(hasCsharp){${azurePatPreflight("csharpCount", "C#")}env.NUGET_PAT=Buffer.from(process.env.${AZURE_PAT_VARIABLE},'base64').toString()}` : "";
 }
 function npmAuthEnvVariable(registryKind, variableReference) {
-  return registryKind === "npm" ? ["NODE_AUTH_TOKEN", variableReference("NPM_TOKEN")] : ["PAT", variableReference("PAT")];
+  return registryKind === "npm" ? ["NODE_AUTH_TOKEN", variableReference("NPM_TOKEN")] : [AZURE_PAT_VARIABLE, variableReference(AZURE_PAT_VARIABLE)];
 }
 function poolBlock(agent) {
   return /^(?:ubuntu|windows|macos)-/i.test(agent) ? `  vmImage: ${agent}` : `  name: ${agent}`;
@@ -4718,6 +4722,53 @@ function checkNpmrc(workspaceRoot, registry, scope) {
     remedy: "run `mnci upgrade`"
   };
 }
+function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
+  const npmrcPath = (0, import_node_path19.join)(workspaceRoot, ".npmrc");
+  if (!fileExists(npmrcPath)) {
+    return void 0;
+  }
+  const npmrc = (0, import_node_fs12.readFileSync)(npmrcPath, "utf8");
+  const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const referenced = [
+    ...new Set(
+      credentials.flatMap(
+        (line) => Array.from(line.matchAll(/\$\{(\w+)\}/gu), (match) => match[1])
+      )
+    )
+  ];
+  if (referenced.length === 0) {
+    return void 0;
+  }
+  const unset = referenced.filter((name) => (environment[name] ?? "") === "");
+  if (unset.length === 0) {
+    return npmjsCredentialShape(credentials, environment);
+  }
+  return {
+    check: "npm credentials in this workspace resolve to something",
+    ok: false,
+    detail: `.npmrc authenticates with \${${unset.join("}, ${")}}, which ${unset.length > 1 ? "are" : "is"} unset here \u2014 and a project .npmrc beats your user one, so npm will send an EMPTY token from this directory rather than the one \`npm login\` wrote. Writes are then refused as a 404 on the PUT, which reads like a missing package`,
+    remedy: "nothing, for installing or building \u2014 this only affects authenticated commands. To publish or deprecate by hand, run it from outside this workspace, or export a real token first. If it still fails there, `npm whoami` \u2014 an expired token gives the same 404"
+  };
+}
+var NPM_TOKEN_PREFIX = "npm_";
+var LEGACY_NPM_TOKEN = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu;
+function npmjsCredentialShape(credentials, environment) {
+  const line = credentials.find((entry) => entry.includes("//registry.npmjs.org/:_authToken="));
+  const variable = line === void 0 ? void 0 : /\$\{(\w+)\}/u.exec(line)?.[1];
+  if (variable === void 0) {
+    return void 0;
+  }
+  const value = environment[variable] ?? "";
+  if (value.startsWith(NPM_TOKEN_PREFIX) || LEGACY_NPM_TOKEN.test(value)) {
+    return void 0;
+  }
+  return {
+    check: "the credential bound for npmjs.org looks like an npm token",
+    ok: false,
+    detail: `\${${variable}} is set (${value.length} characters) but does not start with '${NPM_TOKEN_PREFIX}' and is not a legacy UUID token, so it is probably a credential for somewhere else \u2014 '${variable}' is a generic name that other tooling also sets, and inside this workspace it is sent to the PUBLIC registry. A write then fails as a 404 on the PUT, which reads like a missing package`,
+    remedy: `\`npm whoami\` to confirm \u2014 it is the only thing that separates a wrong token from an expired one. Then unset \`${variable}\` for local work, or set it to a real npm token`
+  };
+}
 function checkVersionActions(workspaceRoot) {
   const candidates = [
     ...(0, import_node_fs12.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
@@ -4902,6 +4953,7 @@ function collectFindings(workspaceRoot) {
     checkEslintPlugin(nxJson),
     checkResolvedEslint(workspaceRoot),
     checkNpmrc(workspaceRoot, nxJson.mnci?.registry, nxJson.mnci?.scope),
+    checkNpmrcCredentialResolves(workspaceRoot),
     checkNoRootRuntimeDependencies(workspaceRoot),
     ...checkRollupSourceMaps(workspaceRoot),
     ...checkDeclarationSpecifiers(workspaceRoot),