@mui/internal-code-infra 0.1.1-canary.20 → 0.1.1-canary.21

package/README.md

@@ -24,12 +24,15 @@ This is stored in the `docs` top-level directory.
    > - **Commit SHA to release from:** the commit that contains the merged release on master. This commit is linked to the GitHub release.
    > - **Run in dry-run mode:** Used for debugging.
    > - **Create GitHub release:** Keep selected if you want a GitHub release to be automatically created from the changelog.
-   > - **npm dist tag to publish to** Use to publish legacy or canary versions.
+   > - **npm dist tag to publish to** Use to publish legacy or canary versions. The publish fails before it publishes anything when a dist-tag would move to a lower version. `latest` and `latest-*` also cannot move to a prerelease unless they already point to one, and `latest-*` cannot change its major.
 
 3. Click "Run workflow"
 4. Refresh the page to see the newly created workflow, and click it.
 5. The next screen shows "@username requested your review to deploy to npm-publish", click "Review deployments" and authorize your workflow run. **Never approve workflow runs you didn't initiaite.**
 
+> [!NOTE]
+> A CI dry run (`code-infra publish --ci --dry-run`) runs the same dist-tag check. On a branch that does not publish to `latest`, pass the dist-tag of the release to it, for example `--tag next` for prereleases or `--tag latest-v8` for a previous major.
+
 > [!IMPORTANT]
 > Go through the below steps if there is an error that says `The following packages are new and need to be published manually first` in the publish flow.
 

package/build/utils/pnpm.d.mts

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+/** Version that `publish-new-package` publishes to reserve the name of a new package. */
+export declare const PLACEHOLDER_VERSION = "0.0.1";
 export type PrivatePackage = {
     /**
      * - Package name
@@ -134,6 +136,53 @@ export declare function getReleaseVersion(cwd?: string): Promise<string | null>;
  * @returns {Promise<PublicPackage[]>} The subset needing a manual first publish
  */
 export declare function getPackagesNeedingManualPublish(packages: PublicPackage[]): Promise<PublicPackage[]>;
+export type RegistryPackage = {
+    /**
+     * - Dist-tags of the package
+     */
+    distTags: Record<string, string>;
+    /**
+     * - Published versions of the package
+     */
+    versions: string[];
+};
+/**
+ * @typedef {Object} RegistryPackage
+ * @property {Record<string, string>} distTags - Dist-tags of the package
+ * @property {string[]} versions - Published versions of the package
+ */
+/**
+ * Read the dist-tags and the published versions of each package with `pnpm view`, so
+ * the lookup uses the same registry configuration and credentials as `pnpm publish`.
+ *
+ * @param {PublicPackage[]} packages - Packages to read
+ * @returns {Promise<Map<string, RegistryPackage | null>>} By package name, null for a package that is not on the registry
+ */
+export declare function getRegistryPackages(packages: PublicPackage[]): Promise<Map<string, RegistryPackage | null>>;
+export type DistTagConflict = {
+    /**
+     * - Package to publish
+     */
+    pkg: PublicPackage;
+    /**
+     * - Why the dist-tag would move to the wrong release line
+     */
+    reason: string;
+};
+/**
+ * @typedef {Object} DistTagConflict
+ * @property {PublicPackage} pkg - Package to publish
+ * @property {string} reason - Why the dist-tag would move to the wrong release line
+ */
+/**
+ * Find the packages whose publish with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {PublicPackage[]} packages - Packages to publish
+ * @param {string} tag - Dist-tag to publish with
+ * @param {Map<string, RegistryPackage | null>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {DistTagConflict[]}
+ */
+export declare function getDistTagConflicts(packages: PublicPackage[], tag: string, registryPackages: Map<string, RegistryPackage | null>): DistTagConflict[];
 /**
  * Get package version info from registry.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mui/internal-code-infra",
-  "version": "0.1.1-canary.20",
+  "version": "0.1.1-canary.21",
   "author": "MUI Team",
   "description": "Infra scripts and configs to be used across MUI repos.",
   "license": "MIT",
@@ -190,7 +190,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitSha": "98dec53f859a1480bed0e813be9a37cce8fea796",
+  "gitSha": "e8aec3f286672d4639af7b385ef313c3d8ec74f3",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typescript": "tsc -noEmit",

package/src/cli/cmdPublish.mjs

@@ -19,7 +19,9 @@ import * as semver from 'semver';
 
 import { persistentAuthStrategy } from '../utils/github.mjs';
 import {
+  getDistTagConflicts,
   getPackagesNeedingManualPublish,
+  getRegistryPackages,
   getReleaseVersion,
   getWorkspacePackages,
   publishPackages,
@@ -373,6 +375,19 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       );
     }
 
+    const distTagConflicts = getDistTagConflicts(
+      filteredPackages,
+      tag,
+      await getRegistryPackages(filteredPackages),
+    );
+    if (distTagConflicts.length > 0) {
+      throw new Error(
+        `Publishing with the "${tag}" dist-tag would move it to the wrong release line:
+${distTagConflicts.map(({ pkg, reason }) => `  * ${pkg.name}: ${reason}`).join('\n')}
+Publish a previous major with its "latest-vX" dist-tag and a prerelease of the next major with "next". On a release branch, also make that dist-tag the "dist-tag" default of the publish workflow. If the dist-tag on npm is outdated, fix it with "npm dist-tag" first.`,
+      );
+    }
+
     // Publish to npm (pnpm handles duplicate checking automatically)
     // No git checks, we'll do our own
     console.log('\n📦 Publishing packages to npm...');

package/src/cli/cmdPublishNewPackage.mjs

@@ -11,7 +11,11 @@ import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
 
 import { getRepositoryInfo } from '../utils/git.mjs';
 import { toPosixPath } from '../utils/path.mjs';
-import { getPackagesNeedingManualPublish, getWorkspacePackages } from '../utils/pnpm.mjs';
+import {
+  getPackagesNeedingManualPublish,
+  getWorkspacePackages,
+  PLACEHOLDER_VERSION,
+} from '../utils/pnpm.mjs';
 
 /**
  * @typedef {Object} Args
@@ -78,7 +82,7 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
           const repo = await getRepositoryInfo();
           const packageJson = {
             name: pkg.name,
-            version: '0.0.1',
+            version: PLACEHOLDER_VERSION,
             repository: {
               type: 'git',
               url: `git+https://github.com/${repo.owner}/${repo.repo}.git`,

package/src/utils/pnpm.mjs

@@ -12,6 +12,9 @@ import { parseDocument, isMap } from 'yaml';
 /** Canonical npm registry URL, in the form `getPublishRegistry` returns. */
 const NPMJS_REGISTRY = 'https://registry.npmjs.org/';
 
+/** Version that `publish-new-package` publishes to reserve the name of a new package. */
+export const PLACEHOLDER_VERSION = '0.0.1';
+
 /**
  * @typedef {Object} PrivatePackage
  * @property {string} [name] - Package name
@@ -227,6 +230,112 @@ export async function getPackagesNeedingManualPublish(packages) {
   return packages.filter((_pkg, index) => results[index]);
 }
 
+/**
+ * Why publishing `version` with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {string} tag - Dist-tag to publish with
+ * @param {string} version - Version to publish
+ * @param {string} current - Version that the dist-tag points to on the registry
+ * @returns {string | null} The reason, or null when the publish is safe
+ */
+function getDistTagConflict(tag, version, current) {
+  if (semver.lt(version, current)) {
+    return `"${tag}" can only move to a newer version, but ${version} is lower than the current ${current}`;
+  }
+  // A tag that already points to a prerelease can move to the next one, for packages still in beta.
+  if (
+    (tag === 'latest' || tag.startsWith('latest-')) &&
+    semver.prerelease(version) &&
+    !semver.prerelease(current)
+  ) {
+    return `"${tag}" cannot point to a prerelease (${version})`;
+  }
+  if (tag.startsWith('latest-') && semver.major(version) !== semver.major(current)) {
+    return `"${tag}" cannot cross a major (${current} to ${version})`;
+  }
+  return null;
+}
+
+/**
+ * @typedef {Object} RegistryPackage
+ * @property {Record<string, string>} distTags - Dist-tags of the package
+ * @property {string[]} versions - Published versions of the package
+ */
+
+/**
+ * Read the dist-tags and the published versions of each package with `pnpm view`, so
+ * the lookup uses the same registry configuration and credentials as `pnpm publish`.
+ *
+ * @param {PublicPackage[]} packages - Packages to read
+ * @returns {Promise<Map<string, RegistryPackage | null>>} By package name, null for a package that is not on the registry
+ */
+export async function getRegistryPackages(packages) {
+  const entries = await Promise.all(
+    packages.map(async (pkg) => {
+      const registry = await getPublishRegistry(pkg.path);
+      const { exitCode, stdout, stderr } = await $({
+        cwd: pkg.path,
+        reject: false,
+        // pnpm resolves its own `packageManager` version from `--registry`, which may not serve it.
+        env: { PNPM_CONFIG_PM_ON_FAIL: 'ignore' },
+      })`pnpm view ${pkg.name} dist-tags versions --json --registry ${registry}`;
+      let info;
+      try {
+        info = JSON.parse(stdout || '{}');
+      } catch {
+        info = {};
+      }
+      if (exitCode !== 0) {
+        if (info.error?.code === 'ERR_PNPM_FETCH_404') {
+          return /** @type {const} */ ([pkg.name, null]);
+        }
+        throw new Error(
+          `Failed to read the dist-tags of ${pkg.name} from ${registry}: ${info.error?.message ?? stderr}`,
+        );
+      }
+      /** @type {RegistryPackage} */
+      const registryPackage = {
+        distTags: info['dist-tags'] ?? {},
+        versions: [info.versions ?? []].flat(),
+      };
+      return /** @type {const} */ ([pkg.name, registryPackage]);
+    }),
+  );
+  return new Map(entries);
+}
+
+/**
+ * @typedef {Object} DistTagConflict
+ * @property {PublicPackage} pkg - Package to publish
+ * @property {string} reason - Why the dist-tag would move to the wrong release line
+ */
+
+/**
+ * Find the packages whose publish with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {PublicPackage[]} packages - Packages to publish
+ * @param {string} tag - Dist-tag to publish with
+ * @param {Map<string, RegistryPackage | null>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {DistTagConflict[]}
+ */
+export function getDistTagConflicts(packages, tag, registryPackages) {
+  return packages.flatMap((pkg) => {
+    const registryPackage = registryPackages.get(pkg.name);
+    // A package that is not on the registry yet has no dist-tags to protect. pnpm skips versions
+    // that are already published, such as unchanged packages on a legacy branch.
+    if (!registryPackage || registryPackage.versions.includes(pkg.version)) {
+      return [];
+    }
+    const current = semver.valid(registryPackage.distTags[tag]);
+    // npm points `latest` at the first version, which is the placeholder for a new package.
+    if (!current || current === PLACEHOLDER_VERSION) {
+      return [];
+    }
+    const reason = getDistTagConflict(tag, pkg.version, current);
+    return reason ? [{ pkg, reason }] : [];
+  });
+}
+
 /**
  * Get package version info from registry.
  *