@naturalcycles/dev-lib 20.52.2 → 20.52.3

package/dist/release/git.util.d.ts

@@ -8,14 +8,18 @@ export declare function getCurrentBranch(): string;
 /**
  * Make sure the full git history and all tags are available:
  * CI checkouts are often shallow and without tags, while release calculation is based on tags.
- * Tolerates fetch failures (e.g. offline local dry-run) with a warning.
+ *
+ * On a complete (non-shallow) clone a failed fetch is tolerated with a warning (e.g. offline
+ * local dry-run) - the local tags are complete enough. On a shallow clone a failed unshallow
+ * is fatal: a truncated history hides release tags and would make a released package look like
+ * a first release, publishing a wrong version.
  */
-export declare function ensureFullGitHistory(): void;
+export declare function ensureFullGitHistory(repo: RepoInfo): void;
 /**
  * Abort if someone pushed to the branch since this checkout - releasing from a stale HEAD
  * would compute wrong versions/notes. No-op if the branch has no remote counterpart.
  */
-export declare function checkHeadIsUpToDateWithRemote(branch: string): void;
+export declare function checkHeadIsUpToDateWithRemote(branch: string, repo: RepoInfo): void;
 /**
  * All git tags reachable from HEAD.
  * Reachability matters: on a prerelease branch this naturally excludes tags of other
@@ -29,7 +33,5 @@ export declare function getReachableTags(): string[];
 export declare function getCommitsSince(tag: string | undefined, relativeDir?: string): RawCommit[];
 /**
  * Create the release tag on HEAD and push it to origin.
- * Uses a token-authenticated url when GITHUB_TOKEN is available,
- * since CI checkouts don't persist git credentials.
  */
 export declare function createAndPushTag(tag: string, repo: RepoInfo): void;

package/dist/release/git.util.js

@@ -24,33 +24,52 @@ export function getCurrentBranch() {
 /**
  * Make sure the full git history and all tags are available:
  * CI checkouts are often shallow and without tags, while release calculation is based on tags.
- * Tolerates fetch failures (e.g. offline local dry-run) with a warning.
+ *
+ * On a complete (non-shallow) clone a failed fetch is tolerated with a warning (e.g. offline
+ * local dry-run) - the local tags are complete enough. On a shallow clone a failed unshallow
+ * is fatal: a truncated history hides release tags and would make a released package look like
+ * a first release, publishing a wrong version.
  */
-export function ensureFullGitHistory() {
-    try {
-        const shallow = exec2.exec('git rev-parse --is-shallow-repository').trim() === 'true';
-        if (shallow) {
-            exec2.exec('git fetch --unshallow --tags --quiet', { log: true });
+export function ensureFullGitHistory(repo) {
+    // Fetch from an authenticated url, not `origin`: private repos reject unauthenticated fetches,
+    // and CI checkouts don't persist git credentials (persist-credentials: false).
+    const remote = getAuthenticatedRemote(repo);
+    const shallow = exec2.exec('git rev-parse --is-shallow-repository').trim() === 'true';
+    if (shallow) {
+        console.log(dimGrey('git fetch --unshallow --tags'));
+        try {
+            exec2.exec(`git fetch --unshallow --tags --quiet "${remote}"`);
         }
-        else {
-            exec2.exec('git fetch --tags --quiet', { log: true });
+        catch {
+            // Sanitized: the original error contains the failed command incl. the token
+            throw new Error('git fetch --unshallow failed - refusing to release with a shallow git history, as version calculation depends on it');
         }
     }
-    catch (err) {
-        console.log(dimGrey(`git fetch failed, continuing with local tags/history: ${err}`));
+    else {
+        console.log(dimGrey('git fetch --tags'));
+        try {
+            exec2.exec(`git fetch --tags --quiet "${remote}"`);
+        }
+        catch {
+            console.log(dimGrey('git fetch --tags failed, continuing with local tags/history'));
+        }
     }
 }
 /**
  * Abort if someone pushed to the branch since this checkout - releasing from a stale HEAD
  * would compute wrong versions/notes. No-op if the branch has no remote counterpart.
  */
-export function checkHeadIsUpToDateWithRemote(branch) {
+export function checkHeadIsUpToDateWithRemote(branch, repo) {
+    const remote = getAuthenticatedRemote(repo);
     let remoteSha;
     try {
-        remoteSha = exec2.exec(`git ls-remote origin "refs/heads/${branch}"`).split('\t')[0]?.trim();
+        remoteSha = exec2
+            .exec(`git ls-remote "${remote}" "refs/heads/${branch}"`)
+            .split('\t')[0]
+            ?.trim();
     }
-    catch (err) {
-        console.log(dimGrey(`git ls-remote failed, skipping up-to-date check: ${err}`));
+    catch {
+        console.log(dimGrey('git ls-remote failed, skipping up-to-date check'));
         return;
     }
     if (!remoteSha)
@@ -91,20 +110,26 @@ export function getCommitsSince(tag, relativeDir) {
 }
 /**
  * Create the release tag on HEAD and push it to origin.
- * Uses a token-authenticated url when GITHUB_TOKEN is available,
- * since CI checkouts don't persist git credentials.
  */
 export function createAndPushTag(tag, repo) {
     exec2.exec(`git tag "${tag}"`);
-    const token = process.env['GITHUB_TOKEN'] || process.env['GH_TOKEN'];
-    const pushUrl = token
-        ? `https://x-access-token:${token}@github.com/${repo.owner}/${repo.repo}.git`
-        : 'origin';
     try {
-        exec2.exec(`git push "${pushUrl}" "refs/tags/${tag}"`);
+        exec2.exec(`git push "${getAuthenticatedRemote(repo)}" "refs/tags/${tag}"`);
     }
     catch {
         // Sanitized rethrow: the original error message contains the failed command incl. the token
         throw new Error(`Failed to push tag ${tag} to origin`);
     }
 }
+/**
+ * Token-authenticated remote url when GITHUB_TOKEN is available, `origin` otherwise.
+ * CI checkouts don't persist git credentials (persist-credentials: false), so all remote
+ * git operations (fetch, ls-remote, push) go through this.
+ * NEVER log commands containing this url, and sanitize their errors - they carry the token.
+ */
+function getAuthenticatedRemote(repo) {
+    const token = process.env['GITHUB_TOKEN'] || process.env['GH_TOKEN'];
+    return token
+        ? `https://x-access-token:${token}@github.com/${repo.owner}/${repo.repo}.git`
+        : 'origin';
+}

package/dist/release/release.command.js

@@ -50,9 +50,9 @@ export async function releaseCommand() {
     if (!dryRun) {
         _assert(token, 'GITHUB_TOKEN (or GH_TOKEN) is required to release, or use --dry-run');
     }
-    ensureFullGitHistory();
+    ensureFullGitHistory(repo);
     if (!dryRun) {
-        checkHeadIsUpToDateWithRemote(branch);
+        checkHeadIsUpToDateWithRemote(branch, repo);
     }
     const mode = resolveReleaseMode(cfg.mode);
     const packages = discoverReleasePackages(mode, argv.filter);

package/dist/release/version.util.js

@@ -49,9 +49,12 @@ export function getNextVersion(input) {
     const { prereleaseId } = channel;
     if (!lastRelease) {
         const { firstReleaseVersion } = input;
+        // 0.0.0 is the "version is managed by git tags" placeholder, never a real first release
         const first = (firstReleaseVersion &&
             !semver.prerelease(firstReleaseVersion) &&
-            semver.valid(firstReleaseVersion)) ||
+            semver.valid(firstReleaseVersion) &&
+            semver.gt(firstReleaseVersion, '0.0.0') &&
+            firstReleaseVersion) ||
             '1.0.0';
         return prereleaseId ? `${first}-${prereleaseId}.1` : first;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/dev-lib",
   "type": "module",
-  "version": "20.52.2",
+  "version": "20.52.3",
   "dependencies": {
     "prompts": "^2",
     "@naturalcycles/js-lib": "^15",