@node-core/utils 6.2.0 → 6.3.0

package/bin/ncu-ci.js

@@ -119,6 +119,11 @@ const args = yargs(hideBin(process.argv))
                     'If not provided, the command will use the SHA of the last approved commit.',
           type: 'string'
         })
+        .option('check-for-duplicates', {
+          describe: 'When set, NCU will query Jenkins recent builds to ensure ' +
+                    'there is not an existing job for the same commit.',
+          type: 'boolean'
+        })
         .option('owner', {
           default: '',
           describe: 'GitHub repository owner'
@@ -298,7 +303,10 @@ class RunPRJobCommand {
       this.cli.setExitCode(1);
       return;
     }
-    const jobRunner = new RunPRJob(cli, request, owner, repo, prid, this.argv.certifySafe);
+    const { certifySafe, checkForDuplicates } = this.argv;
+    const jobRunner = new RunPRJob(
+      cli, request, owner, repo, prid,
+      certifySafe, checkForDuplicates);
     if (!(await jobRunner.start())) {
       this.cli.setExitCode(1);
       process.exitCode = 1;

package/components/git/land.js

@@ -168,7 +168,7 @@ async function main(state, argv, cli, dir) {
     github: true
   });
   const req = new Request(credentials);
-  let session = new LandingSession(cli, req, dir);
+  let session = new LandingSession(cli, req, dir, argv);
 
   if (state !== AMEND &&
       state !== CONTINUE &&
@@ -189,6 +189,7 @@ async function main(state, argv, cli, dir) {
     cli.warn(
       'Failed to detect previous session. ' +
       'please run `git node land --abort`');
+    cli.setErrorCode(1);
     return;
   }
 
@@ -197,17 +198,12 @@ async function main(state, argv, cli, dir) {
       cli.warn(
         'Previous `git node land` session for ' +
         `${session.pullName} in progress.`);
-      cli.log('run `git node land --abort` before starting a new session');
-      return;
+      const response = await cli.prompt('Do you want to abort it?', { defaultAnswer: false });
+      if (!response) throw new Error('Please run `git node land --abort`');
+      await session.abort();
+      session = new LandingSession(cli, req, dir, argv);
     }
-    session = new LandingSession(cli, req, dir, argv);
     const metadata = await getMetadata(session.argv, argv.skipRefs, cli);
-    if (argv.backport) {
-      const split = metadata.metadata.split('\n')[0];
-      if (split === 'PR-URL: ') {
-        cli.error('Commit message is missing PR-URL');
-      }
-    }
     return session.start(metadata);
   } else if (state === APPLY) {
     return session.apply();

package/components/git/security.js

@@ -92,110 +92,93 @@ export function builder(yargs) {
 }
 
 export function handler(argv) {
+  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const cli = new CLI(logStream);
+
   if (argv.start) {
-    return startSecurityRelease(argv);
+    return startSecurityRelease(cli, argv);
   }
   if (argv.sync) {
-    return syncSecurityRelease(argv);
+    return syncSecurityRelease(cli, argv);
   }
   if (argv['update-date']) {
-    return updateReleaseDate(argv);
+    return updateReleaseDate(cli, argv);
   }
   if (argv['pre-release']) {
-    return createPreRelease(argv);
+    return createPreRelease(cli, argv);
   }
   if (argv['add-report']) {
-    return addReport(argv);
+    return addReport(cli, argv);
   }
   if (argv['remove-report']) {
-    return removeReport(argv);
+    return removeReport(cli, argv);
   }
   if (argv['notify-pre-release']) {
-    return notifyPreRelease(argv);
+    return notifyPreRelease(cli, argv);
   }
   if (argv['request-cve']) {
-    return requestCVEs(argv);
+    return requestCVEs(cli, argv);
   }
   if (argv['post-release']) {
-    return createPostRelease(argv);
+    return createPostRelease(cli, argv);
   }
   if (argv.cleanup) {
-    return cleanupSecurityRelease(argv);
+    return cleanupSecurityRelease(cli, argv);
   }
   yargsInstance.showHelp();
 }
 
-async function removeReport(argv) {
+async function removeReport(cli, argv) {
   const reportId = argv['remove-report'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const update = new UpdateSecurityRelease(cli);
   return update.removeReport(reportId);
 }
 
-async function addReport(argv) {
+async function addReport(cli, argv) {
   const reportId = argv['add-report'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const update = new UpdateSecurityRelease(cli);
   return update.addReport(reportId);
 }
 
-async function updateReleaseDate(argv) {
+async function updateReleaseDate(cli, argv) {
   const releaseDate = argv['update-date'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const update = new UpdateSecurityRelease(cli);
   return update.updateReleaseDate(releaseDate);
 }
 
-async function createPreRelease(argv) {
+async function createPreRelease(cli, argv) {
   const nodejsOrgFolder = argv['pre-release'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const preRelease = new SecurityBlog(cli);
   return preRelease.createPreRelease(nodejsOrgFolder);
 }
 
-async function requestCVEs() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function requestCVEs(cli) {
   const hackerOneCve = new UpdateSecurityRelease(cli);
   return hackerOneCve.requestCVEs();
 }
 
-async function createPostRelease(argv) {
+async function createPostRelease(cli, argv) {
   const nodejsOrgFolder = argv['post-release'];
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
   const blog = new SecurityBlog(cli);
   return blog.createPostRelease(nodejsOrgFolder);
 }
 
-async function startSecurityRelease() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function startSecurityRelease(cli) {
   const release = new PrepareSecurityRelease(cli);
   return release.start();
 }
 
-async function cleanupSecurityRelease() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function cleanupSecurityRelease(cli) {
   const release = new PrepareSecurityRelease(cli);
   return release.cleanup();
 }
 
-async function syncSecurityRelease(argv) {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function syncSecurityRelease(cli) {
   const release = new UpdateSecurityRelease(cli);
   return release.sync();
 }
 
-async function notifyPreRelease() {
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
-  const cli = new CLI(logStream);
+async function notifyPreRelease(cli) {
   const preRelease = new SecurityAnnouncement(cli);
   return preRelease.notifyPreRelease();
 }

package/lib/auth.js

@@ -7,26 +7,21 @@ import { clearCachedConfig, encryptValue, getMergedConfig, getNcurcPath } from '
 
 export default lazy(auth);
 
-function errorExit(message) {
-  process.stderr.write(`${message}\n`);
-  process.exit(1);
-}
-
 function check(username, token, format = /^[A-Za-z0-9_]+$/) {
   if (typeof username !== 'string') {
-    errorExit(`username must be a string, received ${typeof username}`);
+    throw new Error(`username must be a string, received ${typeof username}`);
   }
   if (!/^[a-zA-Z0-9-]+$/.test(username)) {
-    errorExit(
+    throw new Error(
       'username may only contain alphanumeric characters or hyphens, ' +
       `received ${username}`
     );
   }
   if (typeof token !== 'string') {
-    errorExit(`token must be a string, received ${typeof token}`);
+    throw new Error(`token must be a string, received ${typeof token}`);
   }
   if (!format.test(token)) {
-    errorExit(`token is misformatted: ${token}`);
+    throw new Error(`token is misformatted: ${token}`);
   }
 }
 
@@ -51,7 +46,7 @@ async function tryCreateGitHubToken(githubAuth) {
       noDeviceFlow: true
     });
   } catch (e) {
-    errorExit(`Could not get token: ${e.message}`);
+    throw new Error(`Could not get token: ${e.message}`, { cause: e });
   }
   return credentials;
 }
@@ -93,7 +88,7 @@ async function auth(
     get jenkins() {
       const { username, jenkins_token } = getMergedConfig();
       if (!username || !jenkins_token) {
-        errorExit(
+        throw new Error(
           'Get your Jenkins API token in https://ci.nodejs.org/me/security ' +
           'and run the following command to add it to your ncu config: ' +
           'ncu-config --global set -x jenkins_token'

package/lib/ci/build-types/pr_build.js

@@ -15,9 +15,8 @@ const {
 } = CIFailureParser;
 
 export class PRBuild extends TestBuild {
-  constructor(cli, request, id, skipMoreThan) {
+  constructor(cli, request, id, skipMoreThan, tree = PR_TREE) {
     const path = `job/node-test-pull-request/${id}/`;
-    const tree = PR_TREE;
     super(cli, request, path, tree);
     this.skipMoreThan = skipMoreThan;
     this.commitBuild = null;

package/lib/ci/run_ci.js

@@ -1,6 +1,7 @@
 import { FormData } from 'undici';
 
 import {
+  JobParser,
   CI_DOMAIN,
   CI_TYPES,
   CI_TYPES_KEYS
@@ -8,6 +9,7 @@ import {
 import PRData from '../pr_data.js';
 import { debuglog } from '../verbosity.js';
 import PRChecker from '../pr_checker.js';
+import { PRBuild } from './build-types/pr_build.js';
 
 export const CI_CRUMB_URL = `https://${CI_DOMAIN}/crumbIssuer/api/json`;
 const CI_PR_NAME = CI_TYPES.get(CI_TYPES_KEYS.PR).jobName;
@@ -17,7 +19,7 @@ const CI_V8_NAME = CI_TYPES.get(CI_TYPES_KEYS.V8).jobName;
 export const CI_V8_URL = `https://${CI_DOMAIN}/job/${CI_V8_NAME}/build`;
 
 export class RunPRJob {
-  constructor(cli, request, owner, repo, prid, certifySafe) {
+  constructor(cli, request, owner, repo, prid, certifySafe, checkForDuplicates) {
     this.cli = cli;
     this.request = request;
     this.owner = owner;
@@ -29,6 +31,7 @@ export class RunPRJob {
       Promise.all([this.prData.getReviews(), this.prData.getCommits()]).then(() =>
         (this.certifySafe = new PRChecker(cli, this.prData, request, {}).getApprovedTipOfHead())
       );
+    this.checkForDuplicates = checkForDuplicates;
   }
 
   async getCrumb() {
@@ -70,7 +73,7 @@ export class RunPRJob {
   }
 
   async start() {
-    const { cli, certifySafe } = this;
+    const { cli, request, certifySafe, checkForDuplicates } = this;
 
     if (!(await certifySafe)) {
       cli.error('Refusing to run CI on potentially unsafe PR');
@@ -87,9 +90,25 @@ export class RunPRJob {
     }
     cli.stopSpinner('Jenkins credentials valid');
 
+    if (checkForDuplicates) {
+      await this.prData.getComments();
+      const { jobid, link } = new JobParser(this.prData.comments).parse().get('PR') ?? {};
+      const { actions } = jobid
+        ? (await new PRBuild(cli, request, jobid, undefined, 'actions[parameters[name,value]]')
+            .getBuildData())
+        : {};
+      const { parameters } = actions?.find(a => 'parameters' in a) ?? {};
+      if (parameters?.find(c => c.name === 'COMMIT_SHA_CHECK')?.value === certifySafe) {
+        cli.info('Existing CI run found: ' + link);
+        cli.error('Refusing to start a potentially duplicate CI job. Use the ' +
+          '"Resume build" button in the Jenkins UI, or start a new CI manually.');
+        return false;
+      }
+    }
+
     try {
       cli.startSpinner('Starting PR CI job');
-      const response = await this.request.fetch(CI_PR_URL, {
+      const response = await request.fetch(CI_PR_URL, {
         method: 'POST',
         headers: {
           'Jenkins-Crumb': crumb
@@ -106,10 +125,10 @@ export class RunPRJob {
 
       // check if the job need a v8 build and trigger it
       await this.prData.getPR();
-      const labels = this.prData.pr.labels;
-      if (labels.nodes.map(i => i.name).includes('v8 engine')) {
+      const { labels } = this.prData.pr;
+      if (labels?.nodes.some(i => i.name === 'v8 engine')) {
         cli.startSpinner('Starting V8 CI job');
-        const response = await this.request.fetch(CI_V8_URL, {
+        const response = await request.fetch(CI_V8_URL, {
           method: 'POST',
           headers: {
             'Jenkins-Crumb': crumb

package/lib/config.js

@@ -25,9 +25,21 @@ export function getMergedConfig(dir, home, additional) {
     const globalConfig = getConfig(GLOBAL_CONFIG, home);
     const projectConfig = getConfig(PROJECT_CONFIG, dir);
     const localConfig = getConfig(LOCAL_CONFIG, dir);
-    mergedConfig = Object.assign(globalConfig, projectConfig, localConfig, additional);
+
+    // Using property descriptors to avoid calling any setter if e.g. a
+    // localConfig value overrides a globalConfig key.
+    mergedConfig = Object.create(null, {
+      ...Object.getOwnPropertyDescriptors(globalConfig),
+      ...Object.getOwnPropertyDescriptors(projectConfig),
+      ...Object.getOwnPropertyDescriptors(localConfig),
+    });
   }
-  return mergedConfig;
+  return additional
+    ? Object.create(null, {
+      ...Object.getOwnPropertyDescriptors(mergedConfig),
+      ...Object.getOwnPropertyDescriptors(additional),
+    })
+    : mergedConfig;
 };
 export function clearCachedConfig() {
   mergedConfig = null;

package/lib/landing_session.js

@@ -82,12 +82,38 @@ export default class LandingSession extends Session {
   }
 
   async downloadAndPatch() {
-    const { cli, upstream, prid, expectedCommitShas } = this;
+    const { cli, upstream, prid, expectedCommitShas, crossRepoPR } = this;
+
+    if (crossRepoPR) {
+      const { owner, repo } = this;
+      cli.warn(`The configured remote "${upstream}" does not point to the ` +
+        'Pull Request repository.');
+      const isHeadAMergeCommit = () => {
+        try {
+          return runSync('git', ['rev-parse', 'FETCH_HEAD^2']).trim();
+        } catch {}
+      };
+      do {
+        cli.warn('Fetching commits from a different upstream might require user intervention.');
+
+        cli.info('Run the following command to fetch the commit(s):');
+        cli.info(`git fetch git@github.com:${owner}/${repo}.git refs/pull/${prid}/merge`);
+        const response = await cli.prompt('Should NCU run the command for you?',
+          { defaultAnswer: false });
+        if (response) {
+          cli.startSpinner(`Downloading patch for ${prid}`);
+          await forceRunAsync('git',
+            ['fetch', `git@github.com:${owner}/${repo}.git`, `refs/pull/${prid}/merge`],
+            { ignoreFailure: false });
+        }
+      } while (!isHeadAMergeCommit());
+    } else {
+      cli.startSpinner(`Downloading patch for ${prid}`);
+      await runAsync('git', [
+        'fetch', upstream,
+        `refs/pull/${prid}/merge`]);
+    }
 
-    cli.startSpinner(`Downloading patch for ${prid}`);
-    await runAsync('git', [
-      'fetch', upstream,
-      `refs/pull/${prid}/merge`]);
     // We fetched the commit that would result if we used `git merge`.
     // ^1 and ^2 refer to the PR base and the PR head, respectively.
     const [base, head] = await runAsync('git',
@@ -286,6 +312,12 @@ export default class LandingSession extends Session {
       cli.warn('Not yet ready to amend, run `git node land --abort`');
       return;
     }
+
+    const BACKPORT_RE = /^BACKPORT-PR-URL\s*:\s*(\S+)$/i;
+    const PR_RE = /^PR-URL\s*:\s*(\S+)$/i;
+    const REVIEW_RE = /^Reviewed-By\s*:\s*(\S+)$/i;
+    const CVE_RE = /^CVE-ID\s*:\s*(\S+)$/i;
+
     this.startAmending();
 
     const rev = this.getCurrentRev();
@@ -303,7 +335,12 @@ export default class LandingSession extends Session {
     }).trim().length !== 0;
 
     const metadata = this.metadata.trim().split('\n');
-    const amended = original.split('\n');
+    // Filtering out metadata that we will add ourselves:
+    const isFiltered = line =>
+      (!PR_RE.test(line) || this.backport) &&
+      !BACKPORT_RE.test(line) &&
+      !REVIEW_RE.test(line);
+    const amended = original.split('\n').filter(isFiltered);
 
     // If the original commit message already contains trailers (such as
     // "Co-authored-by"), we simply add our own metadata after those. Otherwise,
@@ -313,35 +350,29 @@ export default class LandingSession extends Session {
       amended.push('');
     }
 
-    const BACKPORT_RE = /BACKPORT-PR-URL\s*:\s*(\S+)/i;
-    const PR_RE = /PR-URL\s*:\s*(\S+)/i;
-    const REVIEW_RE = /Reviewed-By\s*:\s*(\S+)/i;
-    const CVE_RE = /CVE-ID\s*:\s*(\S+)/i;
-
     let containCVETrailer = false;
     for (const line of metadata) {
-      if (line.length !== 0 && original.includes(line)) {
-        if (line.match(CVE_RE)) {
-          containCVETrailer = true;
-        }
+      if (line.length !== 0 && original.includes(line) && !isFiltered(line)) {
+        containCVETrailer ||= CVE_RE.test(line);
         if (originalHasTrailers) {
           cli.warn(`Found ${line}, skipping..`);
+          continue;
         } else {
           cli.error('Git found no trailers in the original commit message, ' +
                     `but '${line}' is present and should be a trailer.`);
           process.exit(1);  // make it work with git rebase -x
         }
-      } else {
-        if (line.match(BACKPORT_RE)) {
-          let prIndex = amended.findIndex(datum => datum.match(PR_RE));
-          if (prIndex === -1) {
-            prIndex = amended.findIndex(datum => datum.match(REVIEW_RE)) - 1;
-          }
-          amended.splice(prIndex + 1, 0, line);
-        } else {
-          amended.push(line);
+      }
+      if (BACKPORT_RE.test(line)) {
+        const prIndex =
+          (amended.findIndex(datum => PR_RE.test(datum)) + 1) ||
+          amended.findIndex(datum => REVIEW_RE.test(datum));
+        if (prIndex !== -1) {
+          amended.splice(prIndex, 0, line);
+          continue;
         }
       }
+      amended.push(line);
     }
 
     if (!containCVETrailer && this.includeCVE) {
@@ -472,7 +503,7 @@ export default class LandingSession extends Session {
     }
 
     cli.separator();
-    cli.log('The following commits are ready to be pushed to ' +
+    cli.log('The following commits are landable on ' +
       `${upstream}/${branch}`);
     cli.log(`- ${strayVerbose.join('\n- ')}`);
     cli.separator();
@@ -483,8 +514,15 @@ export default class LandingSession extends Session {
       willBeLanded = `${head}...${willBeLanded}`;
     }
 
+    cli.startSpinner('Removing temporary files');
     this.cleanFiles();
-    cli.log('Temporary files removed.');
+    cli.stopSpinner('Temporary files removed.');
+    if (this.crossRepoPR) {
+      cli.warn(`The configured remote "${upstream}" does not point to the ` +
+          'Pull Request repository.');
+      cli.info(`${willBeLanded} should likely not be pushed to "${upstream}"`);
+      return;
+    }
     cli.log('To finish landing:');
     cli.log('1. Run: ');
     cli.log(`   git push ${upstream} ${branch}`);

package/lib/metadata_gen.js

@@ -31,7 +31,6 @@ export default class MetadataGenerator {
     const parser = new LinkParser(owner, repo, op);
     const fixes = parser.getFixes();
     const refs = parser.getRefs().filter(f => f !== prUrl);
-    const altPrUrl = parser.getAltPrUrl();
 
     const meta = [];
 
@@ -44,17 +43,10 @@ export default class MetadataGenerator {
       meta.push(...refs.map((ref) => `Refs: ${ref}`));
     }
     const backport = this.argv ? this.argv.backport : undefined;
-    if (backport) {
-      meta.unshift(`Backport-PR-URL: ${prUrl}`);
-      meta.unshift(`PR-URL: ${altPrUrl}`);
-    } else {
-      // Reviews are only added here as backports should not contain reviews
-      // for the backport itself in the metadata
-      meta.unshift(`PR-URL: ${prUrl}`);
-      meta.push(
-        ...reviewedBy.map((r) => `Reviewed-By: ${r.reviewer.getContact()}`)
-      );
-    }
+    meta.unshift(`${backport ? 'Backport-' : ''}PR-URL: ${prUrl}`);
+    meta.push(
+      ...reviewedBy.map((r) => `Reviewed-By: ${r.reviewer.getContact()}`)
+    );
     meta.push(''); // creates final EOL
     return meta.join('\n');
   }

package/lib/prepare_release.js

@@ -133,88 +133,12 @@ export default class ReleasePreparation extends Session {
     return true;
   }
 
-  async prepareSecurity() {
-    const {
-      cli,
-      newVersion,
-      versionComponents,
-      releaseBranch,
-      filterLabels
-    } = this;
-
-    // Create new proposal branch.
-    cli.startSpinner(`Switching to proposal branch for ${newVersion}`);
-    const proposalBranch = await this.createProposalBranch(releaseBranch);
-    cli.stopSpinner(`Switched to proposal branch for ${newVersion}`);
-
-    const success = await this.cherryPickSecurityPRs(filterLabels);
-    if (!success) {
-      cli.error('Aborting security release preparation. ' +
-        'Remember to exclude the proposal branch.' +
-        'git branch -D ' + proposalBranch);
-      return;
-    }
-    // Update version and release info in src/node_version.h.
-    cli.startSpinner(`Updating 'src/node_version.h' for ${newVersion}`);
-    await this.updateNodeVersion();
-    cli.stopSpinner(`Updated 'src/node_version.h' for ${newVersion}`);
-
-    // Update any REPLACEME tags in the docs.
-    cli.startSpinner('Updating REPLACEME items in docs');
-    await this.updateREPLACEMEs();
-    cli.stopSpinner('Updated REPLACEME items in docs');
-
-    // Fetch date to use in release commit & changelogs.
-    const todayDate = new Date().toISOString().split('T')[0];
-    this.date = await cli.prompt('Enter release date in YYYY-MM-DD format:',
-      { questionType: 'input', defaultAnswer: todayDate });
-
-    cli.startSpinner('Updating CHANGELOG.md');
-    await this.updateMainChangelog();
-    cli.stopSpinner('Updated CHANGELOG.md');
-
-    cli.startSpinner(`Updating CHANGELOG_V${versionComponents.major}.md`);
-    await this.updateMajorChangelog();
-    cli.stopSpinner(`Updated CHANGELOG_V${versionComponents.major}.md`);
-
-    // Create release commit.
-    const shouldCreateReleaseCommit = await cli.prompt(
-      'Create release commit?');
-    if (!shouldCreateReleaseCommit) {
-      cli.warn(`Aborting \`git node release\` for version ${newVersion}`);
-      return;
-    }
-
-    // Proceed with release only after the releaser has amended
-    // it to their liking.
-    const createDefaultCommit = await this.createReleaseCommit();
-    if (!createDefaultCommit) {
-      const lastCommitSha = runSync('git', ['rev-parse', '--short', 'HEAD']);
-      cli.warn(`Please manually edit commit ${lastCommitSha} by running ` +
-      '`git commit --amend` before proceeding.');
-    }
-
-    cli.separator();
-    cli.ok(`Release preparation for ${newVersion} complete.\n`);
-    cli.info(
-      'To finish the release proposal, run: \n' +
-      `      $ git push -u ${this.upstream} v${newVersion}-proposal\n` +
-      'Finally, proceed to Jenkins and begin the following CI jobs:\n' +
-      '      * https://ci.nodejs.org/job/node-test-pull-request/\n' +
-      '      * https://ci.nodejs.org/job/citgm-smoker/');
-    cli.info(
-      'If this release has deps/v8 changes, you\'ll also need to run:\n' +
-      '      * https://ci.nodejs.org/job/node-test-commit-v8-linux/'
-    );
-  }
-
   async prepare() {
     const { cli, newVersion, versionComponents, isSecurityRelease } = this;
 
     if (isSecurityRelease) {
       this.config.owner = 'nodejs-private';
       this.config.repo = 'node-private';
-      return this.prepareSecurity();
     }
 
     const runBranchDiff = await cli.prompt(
@@ -222,30 +146,38 @@ export default class ReleasePreparation extends Session {
       '(recommended except for Maintenance releases)?',
       { defaultAnswer: this.runBranchDiff });
     if (runBranchDiff) {
-      // TODO: UPDATE re-use
-      // Check the branch diff to determine if the releaser
-      // wants to backport any more commits before proceeding.
-      cli.startSpinner('Fetching branch-diff');
-      const raw = await this.getBranchDiff({
-        onlyNotableChanges: false,
-        comparisonBranch: newVersion
-      });
-
-      const diff = raw.split('*');
-      cli.stopSpinner('Got branch diff');
-
-      const outstandingCommits = diff.length - 1;
-      if (outstandingCommits !== 0) {
-        const proceed = await cli.prompt(
+      if (isSecurityRelease) {
+        const success = await this.cherryPickSecurityPRs(this.filterLabels);
+        if (!success) {
+          cli.error('Aborting security release preparation.');
+          return;
+        }
+      } else {
+        // TODO: UPDATE re-use
+        // Check the branch diff to determine if the releaser
+        // wants to backport any more commits before proceeding.
+        cli.startSpinner('Fetching branch-diff');
+        const raw = await this.getBranchDiff({
+          onlyNotableChanges: false,
+          comparisonBranch: newVersion
+        });
+
+        const diff = raw.split('*');
+        cli.stopSpinner('Got branch diff');
+
+        const outstandingCommits = diff.length - 1;
+        if (outstandingCommits !== 0) {
+          const proceed = await cli.prompt(
           `There are ${outstandingCommits} commits that may be ` +
           `backported to ${this.stagingBranch} - do you still want to proceed?`,
           { defaultAnswer: false });
 
-        if (!proceed) {
-          const seeDiff = await cli.prompt(
-            'Do you want to see the branch diff?');
-          if (seeDiff) cli.log(raw);
-          return;
+          if (!proceed) {
+            const seeDiff = await cli.prompt(
+              'Do you want to see the branch diff?');
+            if (seeDiff) cli.log(raw);
+            return;
+          }
         }
       }
     }

package/lib/prepare_security.js

@@ -203,23 +203,19 @@ export default class PrepareSecurityRelease extends SecurityRelease {
   }
 
   async createVulnerabilitiesJSON(reports, dependencies, releaseDate) {
-    this.cli.separator('Creating vulnerabilities.json...');
-    const file = JSON.stringify({
+    this.cli.startSpinner('Creating vulnerabilities.json...');
+    const fileContent = JSON.stringify({
       releaseDate,
       reports,
       dependencies
-    }, null, 2);
+    }, null, 2) + '\n';
 
-    const folderPath = path.join(process.cwd(), NEXT_SECURITY_RELEASE_FOLDER);
-    try {
-      fs.accessSync(folderPath);
-    } catch (error) {
-      fs.mkdirSync(folderPath, { recursive: true });
-    }
+    const folderPath = path.resolve(NEXT_SECURITY_RELEASE_FOLDER);
+    await fs.promises.mkdir(folderPath, { recursive: true });
 
     const fullPath = path.join(folderPath, 'vulnerabilities.json');
-    fs.writeFileSync(fullPath, file);
-    this.cli.ok(`Created ${fullPath} `);
+    await fs.promises.writeFile(fullPath, fileContent);
+    this.cli.stopSpinner(`Created ${fullPath}`);
 
     return fullPath;
   }

package/lib/request.js

@@ -32,6 +32,14 @@ export default class Request {
     if (url.startsWith(`https://${CI_DOMAIN}`)) {
       options.headers = options.headers || {};
       Object.assign(options.headers, this.getJenkinsHeaders());
+    } else if (!url.startsWith('https://')) {
+      url = new URL(url, 'https://api.github.com/').href;
+      options.headers = {
+        Authorization: `Basic ${this.credentials.github}`,
+        'User-Agent': 'node-core-utils',
+        Accept: 'application/vnd.github+json',
+        ...options.headers
+      };
     }
     return wrappedFetch(url, options);
   }
@@ -65,14 +73,9 @@ export default class Request {
   }
 
   async createIssue(title, body, { owner, repo }) {
-    const url = `https://api.github.com/repos/${owner}/${repo}/issues`;
+    const url = `/repos/${owner}/${repo}/issues`;
     const options = {
       method: 'POST',
-      headers: {
-        Authorization: `Basic ${this.credentials.github}`,
-        'User-Agent': 'node-core-utils',
-        Accept: 'application/vnd.github+json'
-      },
       body: JSON.stringify({
         title,
         body
@@ -82,15 +85,9 @@ export default class Request {
   }
 
   async commentIssue(fullUrl, comment) {
-    const commentUrl = fullUrl.replace('https://github.com/', 'https://api.github.com/repos/') +
-      '/comments';
+    const commentUrl = fullUrl.replace('https://github.com/', '/repos/') + '/comments';
     const options = {
       method: 'POST',
-      headers: {
-        Authorization: `Basic ${this.credentials.github}`,
-        'User-Agent': 'node-core-utils',
-        Accept: 'application/vnd.github+json'
-      },
       body: JSON.stringify({
         body: comment,
       })
@@ -99,27 +96,14 @@ export default class Request {
   }
 
   async getPullRequest(fullUrl) {
-    const prUrl = fullUrl.replace('https://github.com/', 'https://api.github.com/repos/').replace('pull', 'pulls');
-    const options = {
-      method: 'GET',
-      headers: {
-        Authorization: `Basic ${this.credentials.github}`,
-        'User-Agent': 'node-core-utils',
-        Accept: 'application/vnd.github+json'
-      }
-    };
-    return this.json(prUrl, options);
+    const prUrl = fullUrl.replace('https://github.com/', '/repos/').replace('pull', 'pulls');
+    return this.json(prUrl);
   }
 
   async createPullRequest(title, body, { owner, repo, head, base }) {
-    const url = `https://api.github.com/repos/${owner}/${repo}/pulls`;
+    const url = `/repos/${owner}/${repo}/pulls`;
     const options = {
       method: 'POST',
-      headers: {
-        Authorization: `Basic ${this.credentials.github}`,
-        'User-Agent': 'node-core-utils',
-        Accept: 'application/vnd.github+json'
-      },
       body: JSON.stringify({
         title,
         body,
@@ -131,13 +115,10 @@ export default class Request {
   }
 
   async closePullRequest(id, { owner, repo }) {
-    const url = `https://api.github.com/repos/${owner}/${repo}/pulls/${id}`;
+    const url = `/repos/${owner}/${repo}/pulls/${id}`;
     const options = {
       method: 'POST',
       headers: {
-        Authorization: `Basic ${this.credentials.github}`,
-        'User-Agent': 'node-core-utils',
-        Accept: 'application/vnd.github+json',
         'Content-Type': 'application/json'
       },
       body: JSON.stringify({
@@ -299,13 +280,11 @@ export default class Request {
       throw new Error('The request has not been ' +
                       'authenticated with a GitHub token');
     }
-    const url = 'https://api.github.com/graphql';
+    const url = '/graphql';
     const options = {
       agent: this.proxyAgent,
       method: 'POST',
       headers: {
-        Authorization: `Basic ${githubCredentials}`,
-        'User-Agent': 'node-core-utils',
         Accept: 'application/vnd.github.antiope-preview+json'
       },
       body: JSON.stringify({

package/lib/session.js

@@ -33,10 +33,11 @@ export default class Session {
       const upstreamHref = runSync('git', [
         'config', '--get',
       `remote.${upstream}.url`]).trim();
-      if (!new RegExp(`${owner}/${repo}(?:.git)?$`).test(upstreamHref)) {
+      if (!upstreamHref.endsWith(`${owner}/${repo}.git`) &&
+          !upstreamHref.endsWith(`${owner}/${repo}`)) {
         cli.warn('Remote repository URL does not point to the expected ' +
         `repository ${owner}/${repo}`);
-        cli.setExitCode(1);
+        this.crossRepoPR = true;
       }
     }
   }

package/lib/voting_session.js

@@ -72,14 +72,10 @@ export default class VotingSession extends Session {
     const subPath = `${prInfo.headRef.name}/vote.yml`;
     this.cli.startSpinner('Downloading vote file from remote...');
     const yamlString = await this.req.text(
-        `https://api.github.com/repos/${this.owner}/${this.repo}/contents/${encodeURIComponent(subPath)}?ref=${prInfo.commits.nodes[0].commit.oid}`, {
-          agent: this.req.proxyAgent,
-          headers: {
-            Authorization: `Basic ${this.req.credentials.github}`,
-            'User-Agent': 'node-core-utils',
-            Accept: 'application/vnd.github.raw'
-          }
-        });
+      `/repos/${this.owner}/${this.repo}/contents/${
+        encodeURIComponent(subPath)}?ref=${prInfo.commits.nodes[0].commit.oid}`,
+      { agent: this.req.proxyAgent }
+    );
     this.cli.stopSpinner('Download complete');
 
     const { shares } = yaml.load(yamlString);
@@ -114,16 +110,15 @@ export default class VotingSession extends Session {
     const body = 'I would like to close this vote, and for this effect, I\'m revealing my ' +
                  `key part:\n\n${'```'}\n${keyPart}\n${'```'}\n`;
     if (this.postComment) {
-      const { message, html_url } = await this.req.json(`https://api.github.com/repos/${this.owner}/${this.repo}/issues/${this.prid}/comments`, {
-        agent: this.req.proxyAgent,
-        method: 'POST',
-        headers: {
-          Authorization: `Basic ${this.req.credentials.github}`,
-          'User-Agent': 'node-core-utils',
-          Accept: 'application/vnd.github.antiope-preview+json'
-        },
-        body: JSON.stringify({ body })
-      });
+      const { message, html_url } = await this.req.json(
+        `/repos/${this.owner}/${this.repo}/issues/${this.prid}/comments`,
+        {
+          agent: this.req.proxyAgent,
+          method: 'POST',
+          headers: { Accept: 'application/vnd.github.antiope-preview+json' },
+          body: JSON.stringify({ body })
+        }
+      );
       if (html_url) {
         this.cli.log(`Comment posted at: ${html_url}`);
         return;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@node-core/utils",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@node-core/utils",
-      "version": "6.2.0",
+      "version": "6.3.0",
       "license": "MIT",
       "dependencies": {
         "@inquirer/prompts": "^7.4.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node-core/utils",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "description": "Utilities for Node.js core collaborators",
   "type": "module",
   "engines": {