@mui/internal-code-infra 0.1.1-canary.20 → 0.1.1-canary.22

package/README.md

@@ -24,12 +24,15 @@ This is stored in the `docs` top-level directory.
    > - **Commit SHA to release from:** the commit that contains the merged release on master. This commit is linked to the GitHub release.
    > - **Run in dry-run mode:** Used for debugging.
    > - **Create GitHub release:** Keep selected if you want a GitHub release to be automatically created from the changelog.
-   > - **npm dist tag to publish to** Use to publish legacy or canary versions.
+   > - **npm dist tag to publish to** Use to publish legacy or canary versions. The publish fails before it publishes anything when a dist-tag would move to a lower version. `latest` and `latest-*` also cannot move to a prerelease unless they already point to one, and `latest-*` cannot change its major.
 
 3. Click "Run workflow"
 4. Refresh the page to see the newly created workflow, and click it.
 5. The next screen shows "@username requested your review to deploy to npm-publish", click "Review deployments" and authorize your workflow run. **Never approve workflow runs you didn't initiaite.**
 
+> [!NOTE]
+> A CI dry run (`code-infra publish --ci --dry-run`) runs the same dist-tag check. On a branch that does not publish to `latest`, pass the dist-tag of the release to it, for example `--tag next` for prereleases or `--tag latest-v8` for a previous major.
+
 > [!IMPORTANT]
 > Go through the below steps if there is an error that says `The following packages are new and need to be published manually first` in the publish flow.
 

package/build/utils/pnpm.d.mts

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+/** Version that `publish-new-package` publishes to reserve the name of a new package. */
+export declare const PLACEHOLDER_VERSION = "0.0.1";
 export type PrivatePackage = {
     /**
      * - Package name
@@ -122,6 +124,43 @@ export declare function getPublishRegistry(packagePath: string): Promise<string>
  * @returns {Promise<string | null>} Version string, or null when absent/invalid
  */
 export declare function getReleaseVersion(cwd?: string): Promise<string | null>;
+export type RegistryPackage = {
+    /**
+     * - Registry that the package publishes to
+     */
+    registry: string;
+    /**
+     * - Whether the package is on the registry
+     */
+    exists: boolean;
+    /**
+     * - Dist-tags of the package
+     */
+    distTags: Record<string, string>;
+    /**
+     * - Published versions of the package
+     */
+    versions: string[];
+};
+/**
+ * @typedef {Object} RegistryPackage
+ * @property {string} registry - Registry that the package publishes to
+ * @property {boolean} exists - Whether the package is on the registry
+ * @property {Record<string, string>} distTags - Dist-tags of the package
+ * @property {string[]} versions - Published versions of the package
+ */
+/**
+ * Read each package from its publish registry with `pnpm view`, so the lookup uses the
+ * same registry configuration and credentials as `pnpm publish`.
+ *
+ * @param {PublicPackage[]} packages - Packages to read
+ * @param {{ npmOnly?: boolean }} [options] - `npmOnly` reads only the packages that publish to npm.
+ *   Checks that only concern npm use it, so a missing credential for another registry does not block them.
+ * @returns {Promise<Map<string, RegistryPackage>>} By package name
+ */
+export declare function getRegistryPackages(packages: PublicPackage[], { npmOnly }?: {
+    npmOnly?: boolean;
+}): Promise<Map<string, RegistryPackage>>;
 /**
  * Filter to the packages that must be published by hand before CI can take over.
  *
@@ -131,14 +170,39 @@ export declare function getReleaseVersion(cwd?: string): Promise<string | null>;
  * midway through. See {@link getPackageVersionInfo} for the version-level check.
  *
  * @param {PublicPackage[]} packages - Packages to check
- * @returns {Promise<PublicPackage[]>} The subset needing a manual first publish
+ * @param {Map<string, RegistryPackage>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {PublicPackage[]} The subset needing a manual first publish
+ */
+export declare function getPackagesNeedingManualPublish(packages: PublicPackage[], registryPackages: Map<string, RegistryPackage>): PublicPackage[];
+export type DistTagConflict = {
+    /**
+     * - Package to publish
+     */
+    pkg: PublicPackage;
+    /**
+     * - Why the dist-tag would move to the wrong release line
+     */
+    reason: string;
+};
+/**
+ * @typedef {Object} DistTagConflict
+ * @property {PublicPackage} pkg - Package to publish
+ * @property {string} reason - Why the dist-tag would move to the wrong release line
+ */
+/**
+ * Find the packages whose publish with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {PublicPackage[]} packages - Packages to publish
+ * @param {string} tag - Dist-tag to publish with
+ * @param {Map<string, RegistryPackage>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {DistTagConflict[]}
  */
-export declare function getPackagesNeedingManualPublish(packages: PublicPackage[]): Promise<PublicPackage[]>;
+export declare function getDistTagConflicts(packages: PublicPackage[], tag: string, registryPackages: Map<string, RegistryPackage>): DistTagConflict[];
 /**
  * Get package version info from registry.
  *
  * Resolves through `pnpm view`, which reports a lookup failure the same way it
- * reports a missing version. Use {@link getPackagesNeedingManualPublish} where
+ * reports a missing version. Use {@link getRegistryPackages} where
  * absence has to be told apart from an error.
  *
  * @param {string} packageName - Name of the package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mui/internal-code-infra",
-  "version": "0.1.1-canary.20",
+  "version": "0.1.1-canary.22",
   "author": "MUI Team",
   "description": "Infra scripts and configs to be used across MUI repos.",
   "license": "MIT",
@@ -190,7 +190,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitSha": "98dec53f859a1480bed0e813be9a37cce8fea796",
+  "gitSha": "7be938414716e74df30e861271c65d7885da8c98",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typescript": "tsc -noEmit",

package/src/cli/cmdPublish.mjs

@@ -19,7 +19,9 @@ import * as semver from 'semver';
 
 import { persistentAuthStrategy } from '../utils/github.mjs';
 import {
+  getDistTagConflicts,
   getPackagesNeedingManualPublish,
+  getRegistryPackages,
   getReleaseVersion,
   getWorkspacePackages,
   publishPackages,
@@ -364,7 +366,8 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       githubReleaseData = await validateGitHubRelease(version);
     }
 
-    const newPackages = await getPackagesNeedingManualPublish(filteredPackages);
+    const registryPackages = await getRegistryPackages(filteredPackages);
+    const newPackages = getPackagesNeedingManualPublish(filteredPackages, registryPackages);
 
     if (newPackages.length > 0) {
       const newPackageNames = newPackages.map((pkg) => pkg.name).join(', ');
@@ -373,6 +376,15 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       );
     }
 
+    const distTagConflicts = getDistTagConflicts(filteredPackages, tag, registryPackages);
+    if (distTagConflicts.length > 0) {
+      throw new Error(
+        `Publishing with the "${tag}" dist-tag would move it to the wrong release line:
+${distTagConflicts.map(({ pkg, reason }) => `  * ${pkg.name}: ${reason}`).join('\n')}
+Publish a previous major with its "latest-vX" dist-tag and a prerelease of the next major with "next". On a release branch, also make that dist-tag the "dist-tag" default of the publish workflow. If the dist-tag on npm is outdated, fix it with "npm dist-tag" first.`,
+      );
+    }
+
     // Publish to npm (pnpm handles duplicate checking automatically)
     // No git checks, we'll do our own
     console.log('\n📦 Publishing packages to npm...');
@@ -426,8 +438,10 @@ const PUBLISH_WORKFLOW_ID = `.github/${WORKFLOW_PATH}`;
  */
 async function triggerLocalGithubPublishWorkflow(opts) {
   console.log(`🔍 Checking if there are new packages to publish in the workspace...`);
-  const newPackages = await getPackagesNeedingManualPublish(
-    await getWorkspacePackages({ publicOnly: true }),
+  const packages = await getWorkspacePackages({ publicOnly: true });
+  const newPackages = getPackagesNeedingManualPublish(
+    packages,
+    await getRegistryPackages(packages, { npmOnly: true }),
   );
   if (newPackages.length) {
     console.warn(

package/src/cli/cmdPublishNewPackage.mjs

@@ -11,7 +11,12 @@ import { findWorkspaceDir } from '@pnpm/find-workspace-dir';
 
 import { getRepositoryInfo } from '../utils/git.mjs';
 import { toPosixPath } from '../utils/path.mjs';
-import { getPackagesNeedingManualPublish, getWorkspacePackages } from '../utils/pnpm.mjs';
+import {
+  getPackagesNeedingManualPublish,
+  getRegistryPackages,
+  getWorkspacePackages,
+  PLACEHOLDER_VERSION,
+} from '../utils/pnpm.mjs';
 
 /**
  * @typedef {Object} Args
@@ -46,8 +51,10 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
       }),
   async handler(args) {
     console.log(`🔍 Detecting new packages to publish in workspace...`);
-    const newPackages = await getPackagesNeedingManualPublish(
-      await getWorkspacePackages({ publicOnly: true }),
+    const packages = await getWorkspacePackages({ publicOnly: true });
+    const newPackages = getPackagesNeedingManualPublish(
+      packages,
+      await getRegistryPackages(packages, { npmOnly: true }),
     );
 
     if (!newPackages.length) {
@@ -78,7 +85,7 @@ export default /** @type {import('yargs').CommandModule<{}, Args>} */ ({
           const repo = await getRepositoryInfo();
           const packageJson = {
             name: pkg.name,
-            version: '0.0.1',
+            version: PLACEHOLDER_VERSION,
             repository: {
               type: 'git',
               url: `git+https://github.com/${repo.owner}/${repo.repo}.git`,

package/src/utils/pnpm.mjs

@@ -12,6 +12,9 @@ import { parseDocument, isMap } from 'yaml';
 /** Canonical npm registry URL, in the form `getPublishRegistry` returns. */
 const NPMJS_REGISTRY = 'https://registry.npmjs.org/';
 
+/** Version that `publish-new-package` publishes to reserve the name of a new package. */
+export const PLACEHOLDER_VERSION = '0.0.1';
+
 /**
  * @typedef {Object} PrivatePackage
  * @property {string} [name] - Package name
@@ -189,49 +192,147 @@ function requiresTrustedPublisherBootstrap(registry) {
 }
 
 /**
- * Filter to the packages that must be published by hand before CI can take over.
- *
- * A brand new package has to be pushed once manually (see
- * `code-infra publish-new-package`) before the OIDC-based workflow can publish
- * it, so the release fails with a clear message instead of a confusing 404
- * midway through. See {@link getPackageVersionInfo} for the version-level check.
+ * @typedef {Object} RegistryPackage
+ * @property {string} registry - Registry that the package publishes to
+ * @property {boolean} exists - Whether the package is on the registry
+ * @property {Record<string, string>} distTags - Dist-tags of the package
+ * @property {string[]} versions - Published versions of the package
+ */
+
+/**
+ * Read each package from its publish registry with `pnpm view`, so the lookup uses the
+ * same registry configuration and credentials as `pnpm publish`.
  *
- * @param {PublicPackage[]} packages - Packages to check
- * @returns {Promise<PublicPackage[]>} The subset needing a manual first publish
+ * @param {PublicPackage[]} packages - Packages to read
+ * @param {{ npmOnly?: boolean }} [options] - `npmOnly` reads only the packages that publish to npm.
+ *   Checks that only concern npm use it, so a missing credential for another registry does not block them.
+ * @returns {Promise<Map<string, RegistryPackage>>} By package name
  */
-export async function getPackagesNeedingManualPublish(packages) {
-  const results = await Promise.all(
+export async function getRegistryPackages(packages, { npmOnly = false } = {}) {
+  const entries = await Promise.all(
     packages.map(async (pkg) => {
       const registry = await getPublishRegistry(pkg.path);
-      if (!requiresTrustedPublisherBootstrap(registry)) {
-        return false;
+      if (npmOnly && registry !== NPMJS_REGISTRY) {
+        return null;
       }
-
-      // HEAD, because only the status matters — a packument runs to megabytes.
-      const res = await fetch(new URL(pkg.name, registry), { method: 'HEAD' });
-      if (res.status === 404) {
-        return true;
+      const { exitCode, stdout, stderr } = await $({
+        cwd: pkg.path,
+        reject: false,
+        // pnpm resolves its own `packageManager` version from `--registry`, which may not serve it.
+        env: { PNPM_CONFIG_PM_ON_FAIL: 'ignore' },
+      })`pnpm view ${pkg.name} dist-tags versions --json --registry ${registry}`;
+      let info;
+      try {
+        info = JSON.parse(stdout || '{}');
+      } catch {
+        info = {};
       }
-      if (!res.ok) {
-        // Anything else (401, 5xx, a proxy hiccup) tells us nothing about
-        // whether the package exists. Treating it as "already published" would
-        // silently disable the check, so fail loudly instead.
+      // Anything but a 404 tells nothing about whether the package exists. Treating it as
+      // "not published" would silently disable the checks, so fail loudly instead.
+      if (exitCode !== 0 && info.error?.code !== 'ERR_PNPM_FETCH_404') {
         throw new Error(
-          `Failed to check whether ${pkg.name} exists on ${registry}: HTTP ${res.status}`,
+          `Failed to read ${pkg.name} from ${registry}: ${info.error?.message ?? stderr}`,
         );
       }
-      return false;
+      /** @type {RegistryPackage} */
+      const registryPackage = {
+        registry,
+        exists: exitCode === 0,
+        distTags: info['dist-tags'] ?? {},
+        versions: [info.versions ?? []].flat(),
+      };
+      return /** @type {const} */ ([pkg.name, registryPackage]);
     }),
   );
+  return new Map(entries.filter((entry) => entry !== null));
+}
 
-  return packages.filter((_pkg, index) => results[index]);
+/**
+ * Filter to the packages that must be published by hand before CI can take over.
+ *
+ * A brand new package has to be pushed once manually (see
+ * `code-infra publish-new-package`) before the OIDC-based workflow can publish
+ * it, so the release fails with a clear message instead of a confusing 404
+ * midway through. See {@link getPackageVersionInfo} for the version-level check.
+ *
+ * @param {PublicPackage[]} packages - Packages to check
+ * @param {Map<string, RegistryPackage>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {PublicPackage[]} The subset needing a manual first publish
+ */
+export function getPackagesNeedingManualPublish(packages, registryPackages) {
+  return packages.filter((pkg) => {
+    const registryPackage = registryPackages.get(pkg.name);
+    return (
+      registryPackage !== undefined &&
+      !registryPackage.exists &&
+      requiresTrustedPublisherBootstrap(registryPackage.registry)
+    );
+  });
+}
+
+/**
+ * Why publishing `version` with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {string} tag - Dist-tag to publish with
+ * @param {string} version - Version to publish
+ * @param {string} current - Version that the dist-tag points to on the registry
+ * @returns {string | null} The reason, or null when the publish is safe
+ */
+function getDistTagConflict(tag, version, current) {
+  if (semver.lt(version, current)) {
+    return `"${tag}" can only move to a newer version, but ${version} is lower than the current ${current}`;
+  }
+  // A tag that already points to a prerelease can move to the next one, for packages still in beta.
+  if (
+    (tag === 'latest' || tag.startsWith('latest-')) &&
+    semver.prerelease(version) &&
+    !semver.prerelease(current)
+  ) {
+    return `"${tag}" cannot point to a prerelease (${version})`;
+  }
+  if (tag.startsWith('latest-') && semver.major(version) !== semver.major(current)) {
+    return `"${tag}" cannot cross a major (${current} to ${version})`;
+  }
+  return null;
+}
+
+/**
+ * @typedef {Object} DistTagConflict
+ * @property {PublicPackage} pkg - Package to publish
+ * @property {string} reason - Why the dist-tag would move to the wrong release line
+ */
+
+/**
+ * Find the packages whose publish with `tag` would move the dist-tag to the wrong release line.
+ *
+ * @param {PublicPackage[]} packages - Packages to publish
+ * @param {string} tag - Dist-tag to publish with
+ * @param {Map<string, RegistryPackage>} registryPackages - Registry data from {@link getRegistryPackages}
+ * @returns {DistTagConflict[]}
+ */
+export function getDistTagConflicts(packages, tag, registryPackages) {
+  return packages.flatMap((pkg) => {
+    const registryPackage = registryPackages.get(pkg.name);
+    // pnpm skips versions that are already published, such as unchanged packages on a legacy branch.
+    if (!registryPackage || registryPackage.versions.includes(pkg.version)) {
+      return [];
+    }
+    // A package that is not on the registry yet has no dist-tags to protect, and npm points
+    // `latest` at the first version, which is the placeholder for a new package.
+    const current = semver.valid(registryPackage.distTags[tag]);
+    if (!current || current === PLACEHOLDER_VERSION) {
+      return [];
+    }
+    const reason = getDistTagConflict(tag, pkg.version, current);
+    return reason ? [{ pkg, reason }] : [];
+  });
 }
 
 /**
  * Get package version info from registry.
  *
  * Resolves through `pnpm view`, which reports a lookup failure the same way it
- * reports a missing version. Use {@link getPackagesNeedingManualPublish} where
+ * reports a missing version. Use {@link getRegistryPackages} where
  * absence has to be told apart from an error.
  *
  * @param {string} packageName - Name of the package