@mnci/cli 4.9.0 → 4.10.0

package/dist/cli.js

@@ -1015,6 +1015,10 @@ var NPM_AUTH_PREFLIGHT = `node -e "const fs=require('node:fs'),cp=require('node:
 function npmAuthPreflight(registryKind) {
   return registryKind === "npm" ? NPM_AUTH_PREFLIGHT : "";
 }
+var PYPI_RELEASE_PREFLIGHT = String.raw`node -e "const fs=require('node:fs');const files=fs.globSync('python-packages/*/pyproject.toml');if(files.length===0){console.log('No Python packages to release - skipping.');process.exit(0)}if(!process.env.PYPI_TOKEN){console.error('PYPI_TOKEN is empty or unset, so the publish would fail AFTER nx release has already tagged. Add it as a repository secret named exactly PYPI_TOKEN - under Actions, not the Dependabot or Codespaces tab, and not an Environment secret.');process.exit(1)}if(!process.env.PYPI_TOKEN.startsWith('pypi-')){console.error('PYPI_TOKEN does not look like a PyPI API token - every one of them begins with pypi-. A password or a truncated paste is rejected only at upload time, which is AFTER nx release has tagged.');process.exit(1)}const names=files.map(f=>{const t=fs.readFileSync(f,'utf8');const b=t.slice(t.indexOf('[project]'));const l=b.split('\n').find(x=>x.trim().startsWith('name'));return l?l.split('=')[1].replace(/[^a-zA-Z0-9._-]/g,''):''}).filter(Boolean);(async()=>{const fresh=[];for(const n of names){try{const r=await fetch('https://pypi.org/pypi/'+n.toLowerCase().replace(/[-_.]+/g,'-')+'/json',{signal:AbortSignal.timeout(10000)});if(r.status===404)fresh.push(n)}catch{console.log('Could not reach PyPI to check '+n+' - continuing.')}}if(fresh.length===0){console.log('Every Python package already exists on PyPI - this release creates none.');return}console.log('NOTE - this release may CREATE '+fresh.length+' new PyPI project(s) - '+fresh.join(', ')+'. Project creation is rate limited per account, and a 429 there arrives AFTER nx release has tagged - leaving those versions tagged with nothing published, and skipped forever, because the next run resolves the current version from the newest tag. If that happens, delete the tags for the versions that did not publish before releasing again. PyPI offers no way to check the limit, or the token, in advance.')})()"`;
+function pypiReleasePreflight(registryKind) {
+  return registryKind === "npm" ? PYPI_RELEASE_PREFLIGHT : "";
+}
 var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
   return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
@@ -1317,6 +1321,16 @@ ${npmAuthPreflight(registryKind) ? `
     condition: ${onMain}
     env:
       NODE_AUTH_TOKEN: $(NPM_TOKEN)
+` : ""}${pypiReleasePreflight(registryKind) ? `
+  # PyPI cannot be asked whether a token is good - the only endpoint that
+  # authenticates is the upload itself - so this checks the token's SHAPE and
+  # names the projects this release would have to CREATE. Project creation is
+  # rate limited per account, and a 429 arrives AFTER nx release has tagged.
+  - script: ${pypiReleasePreflight(registryKind)}
+    displayName: Preflight \u2014 name the PyPI projects this release would create
+    condition: ${onMain}
+    env:
+      PYPI_TOKEN: $(PYPI_TOKEN)
 ` : ""}
   # Version + tag + publish, in one release, for npm (packages/*), Python
   # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional commits,
@@ -1554,6 +1568,17 @@ ${npmAuthPreflight(registryKind) ? `
         if: \${{ ${onMain} }}
         env:
           NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
+` : ""}${pypiReleasePreflight(registryKind) ? `
+      # PyPI cannot be asked whether a token is good - the only endpoint that
+      # authenticates is the upload itself - so this checks the token's SHAPE
+      # and names the projects this release would have to CREATE. Project
+      # creation is rate limited per account, and a 429 arrives AFTER nx
+      # release has tagged.
+      - run: ${pypiReleasePreflight(registryKind)}
+        name: Preflight \u2014 name the PyPI projects this release would create
+        if: \${{ ${onMain} }}
+        env:
+          PYPI_TOKEN: \${{ secrets.PYPI_TOKEN }}
 ` : ""}
       # Version + tag + publish, in one release, for npm (packages/*), Python
       # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional