@node-core/utils 5.15.0 → 5.16.1

package/README.md

@@ -47,7 +47,7 @@ If you would prefer to build from the source, install and link:
 ```
 git clone git@github.com:nodejs/node-core-utils.git
 cd node-core-utils
-npm install
+npm ci
 npm link
 ```
 
@@ -89,14 +89,6 @@ After the token is generated, create an rc file with the following content:
 Note: you could use `ncu-config` to configure these variables, but it's not
 recommended to leave your tokens in your command line history.
 
-If you have `gpg` installed and setup on your local machine, it is recommended
-to store an encrypted version of this file:
-
-```console
-$ gpg --default-recipient-self --encrypt ~/.ncurc
-$ rm ~/.ncurc
-```
-
 ### Setting up Jenkins credentials
 
 The `git-node` and `ncu-ci` commands need to query the Node.js Jenkins API for
@@ -124,14 +116,30 @@ To obtain the Jenkins API token
    }
    ```
 
+### Protecting your credentials
 
-### Make sure your credentials won't be committed
+If you have `gpg` installed and setup on your local machine, it is strongly recommended
+to store an encrypted version of this file:
+
+```console
+$ gpg --default-recipient-self --encrypt ~/.ncurc
+$ rm ~/.ncurc
+```
+
+The credentials are now encrypted in `~/.ncurc.gpg` and everytime it's needed,
+node-core-utils will invoke `gpg` that may ask you to decrypt it using
+your default key via pinentry.
 
 Put the following entries into your
 [global `gitignore` file](https://git-scm.com/docs/git-config#Documentation/git-config.txt-coreexcludesFile)
-(`$XDG_CONFIG_HOME/git/ignore` or a file specified by `core.excludesFile`):
+(`$XDG_CONFIG_HOME/git/ignore` or a file specified by `core.excludesFile`). For example:
+
+```console
+$ git config --global core.excludesfile ~/.gitignore_global
+```
 
 ```
+# In ~/.gitignore_global
 # node-core-utils configuration file
 .ncurc
 .ncurc.gpg

package/lib/config.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import os from 'node:os';
 
 import { readJson, writeJson } from './file.js';
-import { existsSync } from 'node:fs';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 
 export const GLOBAL_CONFIG = Symbol('globalConfig');
@@ -61,13 +61,31 @@ export function getConfigPath(configType, dir) {
 };
 
 export function writeConfig(configType, obj, dir) {
-  writeJson(getConfigPath(configType, dir), obj);
+  const configPath = getConfigPath(configType, dir);
+  const encryptedConfigPath = configPath + '.gpg';
+  if (existsSync(encryptedConfigPath)) {
+    const tmpDir = mkdtempSync(path.join(os.tmpdir(), 'ncurc-'));
+    const tmpFile = path.join(tmpDir, 'config.json');
+    try {
+      writeJson(tmpFile, obj);
+      const { status } = spawnSync('gpg',
+        ['--default-recipient-self', '--yes', '--encrypt', '--output', encryptedConfigPath, tmpFile]
+      );
+      if (status !== 0) {
+        throw new Error('Failed to encrypt config file: ' + encryptedConfigPath);
+      }
+    } finally {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+    return encryptedConfigPath;
+  }
+  writeJson(configPath, obj);
+  return configPath;
 };
 
 export function updateConfig(configType, obj, dir) {
   const config = getConfig(configType, dir);
-  const configPath = getConfigPath(configType, dir);
-  writeJson(configPath, Object.assign(config, obj));
+  writeConfig(configType, Object.assign(config, obj), dir);
 };
 
 export function getHomeDir(home) {

package/lib/prepare_security.js

@@ -55,6 +55,22 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     // For now, close the ones with Security Release label
     await this.closePRWithLabel('Security Release');
 
+    if (vulnerabilityJSON.buildIssue) {
+      this.cli.info('Commenting on nodejs/build issue');
+      await this.req.commentIssue(
+        vulnerabilityJSON.buildIssue,
+        'Security release is out'
+      );
+    }
+
+    if (vulnerabilityJSON.dockerIssue) {
+      this.cli.info('Commenting on nodejs/docker-node issue');
+      await this.req.commentIssue(
+        vulnerabilityJSON.dockerIssue,
+        'Security release is out'
+      );
+    }
+
     const updateFolder = await this.cli.prompt(
       `Would you like to update the next-security-release folder to ${
         vulnerabilityJSON.releaseDate}?`,

package/lib/request.js

@@ -81,6 +81,23 @@ export default class Request {
     return this.json(url, options);
   }
 
+  async commentIssue(fullUrl, comment) {
+    const commentUrl = fullUrl.replace('https://github.com/', 'https://api.github.com/repos/') +
+      '/comments';
+    const options = {
+      method: 'POST',
+      headers: {
+        Authorization: `Basic ${this.credentials.github}`,
+        'User-Agent': 'node-core-utils',
+        Accept: 'application/vnd.github+json'
+      },
+      body: JSON.stringify({
+        body: comment,
+      })
+    };
+    return this.json(commentUrl, options);
+  }
+
   async getPullRequest(fullUrl) {
     const prUrl = fullUrl.replace('https://github.com/', 'https://api.github.com/repos/').replace('pull', 'pulls');
     const options = {

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@node-core/utils",
-  "version": "5.15.0",
+  "version": "5.16.1",
   "description": "Utilities for Node.js core collaborators",
   "type": "module",
   "engines": {
     "node": "^18.18.0 || >=20.0.0"
   },
   "bin": {
-    "get-metadata": "./bin/get-metadata.js",
-    "git-node": "./bin/git-node.js",
-    "ncu-config": "./bin/ncu-config.js",
-    "ncu-team": "./bin/ncu-team.js",
-    "ncu-ci": "./bin/ncu-ci.js"
+    "get-metadata": "bin/get-metadata.js",
+    "git-node": "bin/git-node.js",
+    "ncu-config": "bin/ncu-config.js",
+    "ncu-team": "bin/ncu-team.js",
+    "ncu-ci": "bin/ncu-ci.js"
   },
   "scripts": {
     "test": "npm run test-unit && npm run lint",
@@ -25,7 +25,7 @@
   "author": "Joyee Cheung <joyeec9h3@gmail.com>",
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@github.com:nodejs/node-core-utils.git"
+    "url": "git+ssh://git@github.com/nodejs/node-core-utils.git"
   },
   "files": [
     "lib/",