@node-core/utils 5.7.0 → 5.8.0

package/components/git/security.js

@@ -29,8 +29,8 @@ const securityOptions = {
     type: 'string'
   },
   'pre-release': {
-    describe: 'Create the pre-release announcement',
-    type: 'boolean'
+    describe: 'Create the pre-release announcement to the given nodejs.org folder',
+    type: 'string'
   },
   'notify-pre-release': {
     describe: 'Notify the community about the security release',
@@ -41,8 +41,8 @@ const securityOptions = {
     type: 'boolean'
   },
   'post-release': {
-    describe: 'Create the post-release announcement',
-    type: 'boolean'
+    describe: 'Create the post-release announcement to the given nodejs.org folder',
+    type: 'string'
   },
   cleanup: {
     describe: 'cleanup the security release.',
@@ -73,7 +73,7 @@ export function builder(yargs) {
       'git node security --remove-report=H1-ID',
       'Removes the Hackerone report based on ID provided from vulnerabilities.json'
     ).example(
-      'git node security --pre-release',
+      'git node security --pre-release="../nodejs.org/"',
       'Create the pre-release announcement on the Nodejs.org repo'
     ).example(
       'git node security --notify-pre-release',
@@ -83,7 +83,7 @@ export function builder(yargs) {
       'Request CVEs for a security release of Node.js based on' +
       ' the next-security-release/vulnerabilities.json'
     ).example(
-      'git node security --post-release',
+      'git node security --post-release="../nodejs.org/"',
       'Create the post-release announcement on the Nodejs.org repo'
     ).example(
       'git node security --cleanup',
@@ -149,11 +149,12 @@ async function updateReleaseDate(argv) {
   return update.updateReleaseDate(releaseDate);
 }
 
-async function createPreRelease() {
+async function createPreRelease(argv) {
+  const nodejsOrgFolder = argv['pre-release'];
   const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
   const cli = new CLI(logStream);
   const preRelease = new SecurityBlog(cli);
-  return preRelease.createPreRelease();
+  return preRelease.createPreRelease(nodejsOrgFolder);
 }
 
 async function requestCVEs() {
@@ -163,11 +164,12 @@ async function requestCVEs() {
   return hackerOneCve.requestCVEs();
 }
 
-async function createPostRelease() {
+async function createPostRelease(argv) {
+  const nodejsOrgFolder = argv['post-release'];
   const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
   const cli = new CLI(logStream);
   const blog = new SecurityBlog(cli);
-  return blog.createPostRelease();
+  return blog.createPostRelease(nodejsOrgFolder);
 }
 
 async function startSecurityRelease() {

package/lib/prepare_release.js

@@ -367,6 +367,16 @@ export default class ReleasePreparation extends Session {
       runSync('git', ['fetch', this.upstream, 'tag', '-n', tagName]);
       this.cli.stopSpinner(`Tag fetched: ${tagName}`);
     }
+    try {
+      if (runSync('git', ['describe', '--abbrev=0', '--tags']).trim() !== tagName) {
+        this.cli.warn(`${tagName} is not the closest tag`);
+      }
+    } catch {
+      this.cli.startSpinner(`${tagName} is unreachable from the current HEAD`);
+      runSync('git', ['fetch', '--shallow-exclude', tagName, this.upstream, this.branch]);
+      runSync('git', ['fetch', '--deepen=1', this.upstream, this.branch]);
+      this.cli.stopSpinner('Local clone unshallowed');
+    }
     return tagName;
   }
 

package/lib/security_blog.js

@@ -11,12 +11,10 @@ import {
 import auth from './auth.js';
 import Request from './request.js';
 
-const kChanged = Symbol('changed');
-
 export default class SecurityBlog extends SecurityRelease {
   req;
 
-  async createPreRelease() {
+  async createPreRelease(nodejsOrgFolder) {
     const { cli } = this;
 
     // checkout on security release branch
@@ -45,14 +43,32 @@ export default class SecurityBlog extends SecurityRelease {
     };
     const month = releaseDate.toLocaleString('en-US', { month: 'long' }).toLowerCase();
     const year = releaseDate.getFullYear();
-    const fileName = `${month}-${year}-security-releases.md`;
+    const fileName = `${month}-${year}-security-releases`;
+    const fileNameExt = fileName + '.md';
     const preRelease = this.buildPreRelease(template, data);
-    const file = path.join(process.cwd(), fileName);
+
+    const pathToBlogPosts = 'apps/site/pages/en/blog/release';
+    const pathToBannerJson = 'apps/site/site.json';
+
+    const file = path.resolve(process.cwd(), nodejsOrgFolder, pathToBlogPosts, fileNameExt);
+    const site = path.resolve(process.cwd(), nodejsOrgFolder, pathToBannerJson);
+
+    const endDate = new Date(data.annoucementDate);
+    endDate.setDate(endDate.getDate() + 7);
+
+    this.updateWebsiteBanner(site, {
+      startDate: data.annoucementDate,
+      endDate: endDate.toISOString(),
+      text: `New security releases to be made available ${data.releaseDate}`,
+      link: `https://nodejs.org/en/blog/vulnerability/${fileName}`,
+      type: 'warning'
+    });
+
     fs.writeFileSync(file, preRelease);
-    cli.ok(`Pre-release announcement file created at ${file}`);
+    cli.ok(`Announcement file created and banner has been updated. Folder: ${nodejsOrgFolder}`);
   }
 
-  async createPostRelease() {
+  async createPostRelease(nodejsOrgFolder) {
     const { cli } = this;
     const credentials = await auth({
       github: true,
@@ -65,7 +81,7 @@ export default class SecurityBlog extends SecurityRelease {
     checkoutOnSecurityReleaseBranch(cli, this.repository);
 
     // read vulnerabilities JSON file
-    const content = this.readVulnerabilitiesJSON(cli);
+    const content = this.readVulnerabilitiesJSON();
     if (!content.releaseDate) {
       cli.error('Release date is not set in vulnerabilities.json,' +
         ' run `git node security --update-date=YYYY/MM/DD` to set the release date.');
@@ -76,47 +92,54 @@ export default class SecurityBlog extends SecurityRelease {
     const releaseDate = new Date(content.releaseDate);
     const template = this.getSecurityPostReleaseTemplate();
     const data = {
-      // TODO: read from pre-sec-release
-      annoucementDate: await this.getAnnouncementDate(cli),
+      annoucementDate: releaseDate.toISOString(),
       releaseDate: this.formatReleaseDate(releaseDate),
       affectedVersions: this.getAffectedVersions(content),
       vulnerabilities: this.getVulnerabilities(content),
       slug: this.getSlug(releaseDate),
-      author: await this.promptAuthor(cli),
+      author: 'The Node.js Project',
       dependencyUpdates: content.dependencies
     };
-    const postReleaseContent = await this.buildPostRelease(template, data, content);
 
-    const pathPreRelease = await this.promptExistingPreRelease(cli);
-    // read the existing pre-release announcement
-    let preReleaseContent = fs.readFileSync(pathPreRelease, 'utf-8');
+    const pathToBlogPosts = path.resolve(nodejsOrgFolder, 'apps/site/pages/en/blog/release');
+    const pathToBannerJson = path.resolve(nodejsOrgFolder, 'apps/site/site.json');
+
+    const preReleasePath = path.resolve(pathToBlogPosts, data.slug + '.md');
+    let preReleaseContent = this.findExistingPreRelease(preReleasePath);
+    if (!preReleaseContent) {
+      cli.error(`Existing pre-release not found! Path: ${preReleasePath} `);
+      process.exit(1);
+    }
+
+    const postReleaseContent = await this.buildPostRelease(template, data, content);
     // cut the part before summary
     const preSummary = preReleaseContent.indexOf('# Summary');
     if (preSummary !== -1) {
       preReleaseContent = preReleaseContent.substring(preSummary);
     }
-
     const updatedContent = postReleaseContent + preReleaseContent;
 
-    fs.writeFileSync(pathPreRelease, updatedContent);
-    cli.ok(`Post-release announcement file updated at ${pathPreRelease}`);
+    const endDate = new Date(data.annoucementDate);
+    endDate.setDate(endDate.getDate() + 7);
+    const month = releaseDate.toLocaleString('en-US', { month: 'long' });
+    const capitalizedMonth = month[0].toUpperCase() + month.slice(1);
 
-    // if the vulnerabilities.json has been changed, update the file
-    if (!content[kChanged]) return;
-    this.updateVulnerabilitiesJSON(content);
-  }
+    this.updateWebsiteBanner(pathToBannerJson, {
+      startDate: releaseDate,
+      endDate,
+      text: `${capitalizedMonth} Security Release is available`
+    });
 
-  async promptExistingPreRelease(cli) {
-    const pathPreRelease = await cli.prompt(
-      'Please provide the path of the existing pre-release announcement:', {
-        questionType: 'input',
-        defaultAnswer: ''
-      });
+    fs.writeFileSync(preReleasePath, updatedContent);
+    cli.ok(`Announcement file and banner has been updated. Folder: ${nodejsOrgFolder}`);
+  }
 
-    if (!pathPreRelease || !fs.existsSync(path.resolve(pathPreRelease))) {
-      return this.promptExistingPreRelease(cli);
+  findExistingPreRelease(filepath) {
+    if (!fs.existsSync(filepath)) {
+      return null;
     }
-    return pathPreRelease;
+
+    return fs.readFileSync(filepath, 'utf-8');
   }
 
   promptAuthor(cli) {
@@ -127,6 +150,20 @@ export default class SecurityBlog extends SecurityRelease {
     });
   }
 
+  updateWebsiteBanner(siteJsonPath, content) {
+    const siteJson = JSON.parse(fs.readFileSync(siteJsonPath));
+
+    const currentValue = siteJson.websiteBanners.index;
+    siteJson.websiteBanners.index = {
+      startDate: content.startDate ?? currentValue.startDate,
+      endDate: content.endDate ?? currentValue.endDate,
+      text: content.text ?? currentValue.text,
+      link: content.link ?? currentValue.link,
+      type: content.type ?? currentValue.type
+    };
+    fs.writeFileSync(siteJsonPath, JSON.stringify(siteJson, null, 2));
+  }
+
   formatReleaseDate(releaseDate) {
     const options = {
       weekday: 'long',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node-core/utils",
-  "version": "5.7.0",
+  "version": "5.8.0",
   "description": "Utilities for Node.js core collaborators",
   "type": "module",
   "engines": {