@mui/internal-code-infra 0.0.4-canary.95 → 0.0.4-canary.97

package/README.md

@@ -37,6 +37,9 @@ This is stored in the `docs` top-level directory.
 
 Whenever new packages are added to the repo (that will get published to npm) or a private package is turned into a public one, follow the below steps before invoking the publish workflow of the previous section.
 
+> [!NOTE]
+> This applies to packages published to npm, which is where Trusted Publishing needs the package to already exist. Packages that set `publishConfig.registry` to another registry are skipped by this check and need none of these steps.
+
 1. Go to your repo's code base on your system, then log in to npm using
 
 ```bash

package/build/cli/cmdListWorkspaces.d.mts

@@ -2,14 +2,14 @@
 export type PublicPackage = import('../utils/pnpm.mjs').PublicPackage;
 export type Args = {
     publicOnly?: boolean;
-    output?: 'json' | 'path' | 'name';
+    output?: 'json' | 'path' | 'name' | 'publish-dir';
     sinceRef?: string;
     filter?: string[];
 };
 /**
  * @typedef {Object} Args
  * @property {boolean} [publicOnly] - Whether to filter to only public packages
- * @property {'json'|'path'|'name'} [output] - Output format (name, path, or json)
+ * @property {'json'|'path'|'name'|'publish-dir'} [output] - Output format (name, path, or json)
  * @property {string} [sinceRef] - Git reference to filter changes since
  * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.
  */

package/build/utils/pnpm.d.mts

@@ -29,22 +29,45 @@ export type PnpmListResultItem = {
 export type GetWorkspacePackagesOptions = {
     sinceRef?: string | null;
     publicOnly?: boolean;
-    nonPublishedOnly?: boolean;
     cwd?: string;
     filter?: string[];
 };
 export declare function getWorkspacePackages(options?: {
     publicOnly: true;
 } & GetWorkspacePackagesOptions): Promise<PublicPackage[]>;
-export declare function getWorkspacePackages(options?: {
-    nonPublishedOnly: true;
-} & GetWorkspacePackagesOptions): Promise<PublicPackage[]>;
 export declare function getWorkspacePackages(options?: {
     publicOnly?: false | undefined;
 } & GetWorkspacePackagesOptions): Promise<PrivatePackage[]>;
 export declare function getWorkspacePackages(options?: GetWorkspacePackagesOptions): Promise<(PrivatePackage | PublicPackage)[]>;
 /**
- * Get package version info from registry
+ * Resolve the registry a package will be published to.
+ *
+ * Only `publishConfig.registry` and the ambient `npm_config_registry` are
+ * consulted — `.npmrc` layering and `@scope:registry` entries are not.
+ *
+ * @param {string} packagePath - Path to the package directory
+ * @returns {Promise<string>} Normalized registry URL, ending in a slash
+ */
+export declare function getPublishRegistry(packagePath: string): Promise<string>;
+/**
+ * Filter to the packages that must be published by hand before CI can take over.
+ *
+ * A brand new package has to be pushed once manually (see
+ * `code-infra publish-new-package`) before the OIDC-based workflow can publish
+ * it, so the release fails with a clear message instead of a confusing 404
+ * midway through. See {@link getPackageVersionInfo} for the version-level check.
+ *
+ * @param {PublicPackage[]} packages - Packages to check
+ * @returns {Promise<PublicPackage[]>} The subset needing a manual first publish
+ */
+export declare function getPackagesNeedingManualPublish(packages: PublicPackage[]): Promise<PublicPackage[]>;
+/**
+ * Get package version info from registry.
+ *
+ * Resolves through `pnpm view`, which reports a lookup failure the same way it
+ * reports a missing version. Use {@link getPackagesNeedingManualPublish} where
+ * absence has to be told apart from an error.
+ *
  * @param {string} packageName - Name of the package
  * @param {string} baseVersion - Base version to check
  * @returns {Promise<VersionInfo>} Version information

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mui/internal-code-infra",
-  "version": "0.0.4-canary.95",
+  "version": "0.0.4-canary.97",
   "author": "MUI Team",
   "description": "Infra scripts and configs to be used across MUI repos.",
   "license": "MIT",
@@ -136,8 +136,8 @@
     "yaml": "^2.9.0",
     "yargs": "^18.0.0",
     "@mui/internal-babel-plugin-display-name": "1.0.4-canary.23",
-    "@mui/internal-babel-plugin-resolve-imports": "2.0.7-canary.40",
-    "@mui/internal-babel-plugin-minify-errors": "2.0.8-canary.30"
+    "@mui/internal-babel-plugin-minify-errors": "2.0.8-canary.30",
+    "@mui/internal-babel-plugin-resolve-imports": "2.0.7-canary.40"
   },
   "peerDependencies": {
     "@next/eslint-plugin-next": "*",
@@ -188,7 +188,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitSha": "446bfbb8d10f0a108322553b707a5f54d2993c24",
+  "gitSha": "f5098e75e68dc8dcfc3c4535b1a0a3fb97c6c68d",
   "scripts": {
     "build": "tsgo -p tsconfig.build.json",
     "typescript": "tsgo -noEmit",

package/src/cli/cmdListWorkspaces.mjs

@@ -6,12 +6,14 @@
  * @typedef {import('../utils/pnpm.mjs').PublicPackage} PublicPackage
  */
 
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
 import { getWorkspacePackages } from '../utils/pnpm.mjs';
 
 /**
  * @typedef {Object} Args
  * @property {boolean} [publicOnly] - Whether to filter to only public packages
- * @property {'json'|'path'|'name'} [output] - Output format (name, path, or json)
+ * @property {'json'|'path'|'name'|'publish-dir'} [output] - Output format (name, path, or json)
  * @property {string} [sinceRef] - Git reference to filter changes since
  * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.
  */
@@ -28,10 +30,10 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       })
       .option('output', {
         type: 'string',
-        choices: ['json', 'path', 'name'],
+        choices: ['json', 'path', 'name', 'publish-dir'],
         default: 'path',
         description:
-          'Output format: name (package names), path (package paths), or json (full JSON)',
+          'Output format: name (package names), path (package paths), publish-dir (publish directories), or json (full JSON)',
       })
       .option('since-ref', {
         type: 'string',
@@ -58,6 +60,32 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       packages.forEach((pkg) => {
         console.log(pkg.path);
       });
+    } else if (output === 'publish-dir') {
+      // Works around https://github.com/stackblitz-labs/pkg.pr.new/issues/389: pkg-pr-new rewrites
+      // workspace:* deps to its URLs in the source package.json, but `pnpm pack` honors
+      // publishConfig.directory and packs the build package.json, whose workspace:* deps are left to
+      // resolve to plain versions. Pointing pkg-pr-new at the build dir makes both act on the same file.
+      // Note: #389 was closed by pkg-pr-new#499, but that only fixed the tarball location, not the dep
+      // resolution — verified still broken on 0.0.78. Do not remove until the packed deps are URLs
+      // without this. Removing it prematurely regressed publishing once (see mui-public#1354).
+      // Print publish directories (package.json publishConfig.directory or package path)
+      const publishDirs = await Promise.all(
+        packages.map(async (pkg) => {
+          const packageJsonPath = path.join(pkg.path, 'package.json');
+          const packageJsonContent = await fs.readFile(packageJsonPath, 'utf8');
+          const packageJson = JSON.parse(packageJsonContent);
+
+          if (packageJson.publishConfig?.directory) {
+            return path.join(pkg.path, packageJson.publishConfig.directory);
+          }
+
+          return pkg.path;
+        }),
+      );
+
+      publishDirs.forEach((dir) => {
+        console.log(dir);
+      });
     } else if (output === 'name') {
       // Print package names (default)
       packages.forEach((pkg) => {

package/src/cli/cmdPublish.mjs

@@ -19,6 +19,7 @@ import * as semver from 'semver';
 
 import { persistentAuthStrategy } from '../utils/github.mjs';
 import {
+  getPackagesNeedingManualPublish,
   getWorkspacePackages,
   publishPackages,
   validatePublishDependencies,
@@ -327,9 +328,9 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
     // Get all packages
     console.log('🔍 Discovering all workspace packages...');
 
-    const allPackages = await getWorkspacePackages({ publicOnly: true, filter });
+    const filteredPackages = await getWorkspacePackages({ publicOnly: true, filter });
 
-    if (allPackages.length === 0) {
+    if (filteredPackages.length === 0) {
       console.log(
         `⚠️  No publishable packages found in workspace${filter.length > 0 ? ` matching filter "${filter.join(', ')}"` : ''}`,
       );
@@ -339,7 +340,7 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
     if (filter.length > 0) {
       console.log('🔍 Validating workspace dependencies for filtered packages...');
 
-      const { issues } = await validatePublishDependencies(allPackages);
+      const { issues } = await validatePublishDependencies(filteredPackages);
 
       if (issues.length > 0) {
         throw new Error(
@@ -369,20 +370,23 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       githubReleaseData = await validateGitHubRelease(version);
     }
 
-    const newPackages = await getWorkspacePackages({ nonPublishedOnly: true });
+    const newPackages = await getPackagesNeedingManualPublish(filteredPackages);
 
     if (newPackages.length > 0) {
+      const newPackageNames = newPackages.map((pkg) => pkg.name).join(', ');
       throw new Error(
-        `The following packages are new and need to be published manually first: ${newPackages.join(
-          ', ',
-        )}. Read more about it here: https://github.com/mui/mui-public/blob/master/packages/code-infra/README.md#adding-and-publishing-new-packages`,
+        `The following packages are new and need to be published to npm manually first: ${newPackageNames}. Read more about it here: https://github.com/mui/mui-public/blob/master/packages/code-infra/README.md#adding-and-publishing-new-packages`,
       );
     }
 
     // Publish to npm (pnpm handles duplicate checking automatically)
     // No git checks, we'll do our own
     console.log('\n📦 Publishing packages to npm...');
-    const publishedPackages = await publishToNpm(allPackages, { dryRun, noGitChecks: true, tag });
+    const publishedPackages = await publishToNpm(filteredPackages, {
+      dryRun,
+      noGitChecks: true,
+      tag,
+    });
 
     if (publishedPackages.length === 0) {
       console.log('ℹ️  No packages were published (all may already be up to date on npm)');
@@ -428,11 +432,13 @@ const PUBLISH_WORKFLOW_ID = `.github/${WORKFLOW_PATH}`;
  */
 async function triggerLocalGithubPublishWorkflow(opts) {
   console.log(`🔍 Checking if there are new packages to publish in the workspace...`);
-  const newPackages = await getWorkspacePackages({ nonPublishedOnly: true });
+  const newPackages = await getPackagesNeedingManualPublish(
+    await getWorkspacePackages({ publicOnly: true }),
+  );
   if (newPackages.length) {
     console.warn(
       `⚠️  Found new packages that should be published to npm first before triggering a release:
-  * ${newPackages.map((pkg) => pkg.name).join('  * ')}
+${newPackages.map((pkg) => `  * ${pkg.name}`).join('\n')}
 Please run the command "${chalk.bold('pnpm code-infra publish-new-package')}" first to publish and configure npm.`,
     );
     return;

package/src/cli/cmdPublishNewPackage.mjs

@@ -11,7 +11,7 @@ import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
 
 import { getRepositoryInfo } from '../utils/git.mjs';
 import { toPosixPath } from '../utils/path.mjs';
-import { getWorkspacePackages } from '../utils/pnpm.mjs';
+import { getPackagesNeedingManualPublish, getWorkspacePackages } from '../utils/pnpm.mjs';
 
 /**
  * @typedef {Object} Args
@@ -46,7 +46,9 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       }),
   async handler(args) {
     console.log(`🔍 Detecting new packages to publish in workspace...`);
-    const newPackages = await getWorkspacePackages({ nonPublishedOnly: true });
+    const newPackages = await getPackagesNeedingManualPublish(
+      await getWorkspacePackages({ publicOnly: true }),
+    );
 
     if (!newPackages.length) {
       console.log('No new packages to publish.');

package/src/utils/pnpm.mjs

@@ -7,6 +7,9 @@ import * as path from 'node:path';
 import * as semver from 'semver';
 import { parseDocument, isMap } from 'yaml';
 
+/** Canonical npm registry URL, in the form `getPublishRegistry` returns. */
+const NPMJS_REGISTRY = 'https://registry.npmjs.org/';
+
 /**
  * @typedef {Object} PrivatePackage
  * @property {string} [name] - Package name
@@ -48,7 +51,6 @@ import { parseDocument, isMap } from 'yaml';
  * @typedef {Object} GetWorkspacePackagesOptions
  * @property {string|null} [sinceRef] - Git reference to filter changes since
  * @property {boolean} [publicOnly=false] - Whether to filter to only public packages
- * @property {boolean} [nonPublishedOnly=false] - Whether to filter to only non-published packages. It by default means public packages yet to be published.
  * @property {string} [cwd] - Current working directory to run pnpm command in
  * @property {string[]} [filter] - Same as filtering packages with --filter in pnpm. Only include packages matching the filter. See https://pnpm.io/filtering.
  */
@@ -61,10 +63,6 @@ import { parseDocument, isMap } from 'yaml';
  * @returns {Promise<PublicPackage[]>} Array of packages
  *
  * @overload
- * @param {{ nonPublishedOnly: true } & GetWorkspacePackagesOptions} [options={}] - Options for filtering packages
- * @returns {Promise<PublicPackage[]>} Array of packages
- *
- * @overload
  * @param {{ publicOnly?: false | undefined } & GetWorkspacePackagesOptions} [options={}] - Options for filtering packages
  * @returns {Promise<PrivatePackage[]>} Array of packages
  *
@@ -76,7 +74,7 @@ import { parseDocument, isMap } from 'yaml';
  * @returns {Promise<(PrivatePackage | PublicPackage)[]>} Array of packages
  */
 export async function getWorkspacePackages(options = {}) {
-  const { sinceRef = null, publicOnly = false, nonPublishedOnly = false, filter = [] } = options;
+  const { sinceRef = null, publicOnly = false, filter = [] } = options;
 
   /**
    * Run `pnpm ls` with the given --filter args and return the parsed list.
@@ -125,24 +123,100 @@ export async function getWorkspacePackages(options = {}) {
     ];
   });
 
-  if (nonPublishedOnly) {
-    // Check if any of the packages are new/need manual publishing first.
-    const filteredPublicPackages = filteredPackages.filter((pkg) => !pkg.isPrivate);
+  return filteredPackages;
+}
 
-    const results = await Promise.all(
-      filteredPublicPackages.map(async (pkg) => {
-        const url = `${process.env.npm_config_registry || 'https://registry.npmjs.org'}/${pkg.name}`;
-        return fetch(url).then((res) => res.status === 404);
-      }),
+/**
+ * Resolve the registry a package will be published to.
+ *
+ * Only `publishConfig.registry` and the ambient `npm_config_registry` are
+ * consulted — `.npmrc` layering and `@scope:registry` entries are not.
+ *
+ * @param {string} packagePath - Path to the package directory
+ * @returns {Promise<string>} Normalized registry URL, ending in a slash
+ */
+export async function getPublishRegistry(packagePath) {
+  const packageJson = await readPackageJson(packagePath);
+  const registry =
+    packageJson.publishConfig?.registry || process.env.npm_config_registry || NPMJS_REGISTRY;
+
+  // Normalizing through the URL parser keeps host casing and default ports from
+  // defeating the equality check in `requiresTrustedPublisherBootstrap`. The
+  // trailing slash is required because `new URL(name, base)` replaces the last
+  // path segment of a base that lacks one, mangling registries served under a
+  // path prefix such as Artifactory's `/api/npm/<repo>`.
+  let registryUrl;
+  try {
+    registryUrl = new URL(registry);
+  } catch (error) {
+    // Node's own message names neither the offending value nor where it came
+    // from, leaving the operator to bisect package.json files mid-release.
+    throw new Error(
+      `Invalid publish registry ${JSON.stringify(registry)} for the package at ${packagePath}`,
+      { cause: error },
     );
-    return filteredPublicPackages.filter((_pkg, index) => !!results[index]);
   }
+  registryUrl.pathname = `${registryUrl.pathname.replace(/\/+$/, '')}/`;
+  return registryUrl.href;
+}
 
-  return filteredPackages;
+/**
+ * Whether a registry requires a package to exist before CI can publish to it.
+ * @param {string} registry - Normalized registry URL
+ * @returns {boolean}
+ */
+function requiresTrustedPublisherBootstrap(registry) {
+  // npm won't attach a Trusted Publisher to a name that doesn't exist yet. No
+  // other registry we publish to has an equivalent step.
+  return registry === NPMJS_REGISTRY;
+}
+
+/**
+ * Filter to the packages that must be published by hand before CI can take over.
+ *
+ * A brand new package has to be pushed once manually (see
+ * `code-infra publish-new-package`) before the OIDC-based workflow can publish
+ * it, so the release fails with a clear message instead of a confusing 404
+ * midway through. See {@link getPackageVersionInfo} for the version-level check.
+ *
+ * @param {PublicPackage[]} packages - Packages to check
+ * @returns {Promise<PublicPackage[]>} The subset needing a manual first publish
+ */
+export async function getPackagesNeedingManualPublish(packages) {
+  const results = await Promise.all(
+    packages.map(async (pkg) => {
+      const registry = await getPublishRegistry(pkg.path);
+      if (!requiresTrustedPublisherBootstrap(registry)) {
+        return false;
+      }
+
+      // HEAD, because only the status matters — a packument runs to megabytes.
+      const res = await fetch(new URL(pkg.name, registry), { method: 'HEAD' });
+      if (res.status === 404) {
+        return true;
+      }
+      if (!res.ok) {
+        // Anything else (401, 5xx, a proxy hiccup) tells us nothing about
+        // whether the package exists. Treating it as "already published" would
+        // silently disable the check, so fail loudly instead.
+        throw new Error(
+          `Failed to check whether ${pkg.name} exists on ${registry}: HTTP ${res.status}`,
+        );
+      }
+      return false;
+    }),
+  );
+
+  return packages.filter((_pkg, index) => results[index]);
 }
 
 /**
- * Get package version info from registry
+ * Get package version info from registry.
+ *
+ * Resolves through `pnpm view`, which reports a lookup failure the same way it
+ * reports a missing version. Use {@link getPackagesNeedingManualPublish} where
+ * absence has to be told apart from an error.
+ *
  * @param {string} packageName - Name of the package
  * @param {string} baseVersion - Base version to check
  * @returns {Promise<VersionInfo>} Version information