@node-core/utils 6.3.3 → 7.0.0

package/README.md

@@ -29,9 +29,6 @@ CLI tools for Node.js Core collaborators.
   to use.
 - [`ncu-team`](./docs/ncu-team.md): Listing members of a team, synchronizing
   special blocks in files with the list of members.
-- [`get-metadata`](./docs/get-metadata.md): Retrieving metadata for a Pull Request.
-  **DEPRECATED**: use [`git node metadata`](./docs/git-node.md#git-node-metadata)
-  instead.
 - [`ncu-ci`](./docs/ncu-ci.md): Parse the results of a Jenkins CI run and display a summary for all the failures.
 
 ## Usage
@@ -66,8 +63,8 @@ to create the token.
 
 When creating the token, the following boxes need to be checked:
 
-- `user:email`: Used by `git-node` and `get-metadata` to read the email of the
-  PR author in order to check if it matches the email of the commit author.
+- `user:email`: Used by `git-node` to read the email of the PR author in order
+  to check if it matches the email of the commit author.
 - `read:org`: Used by `ncu-team` to read the list of team members.
 
 Optionally, if you want to grant write access so `git-node` can write comments:

package/bin/ncu-ci.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 
 import yargs from 'yargs';
-import clipboardy from 'clipboardy';
 
 import {
   JobParser,
@@ -222,11 +221,6 @@ const args = yargs(hideBin(process.argv))
     handler
   })
   .demandCommand(1, 'must provide a valid command')
-  .option('copy', {
-    describe: 'Write the results as markdown to clipboard',
-    default: false,
-    type: 'boolean'
-  })
   .option('skip-more-than', {
     describe: 'Skip jobs that fail more than <limit> builds, when --stat is true, default to 10.',
     type: 'number',
@@ -397,7 +391,7 @@ class CICommand {
         this.json = this.json.concat(json);
       }
 
-      if ((argv.copy || argv.markdown) && !argv.stats) {
+      if (argv.markdown && !argv.stats) {
         this.markdown += build.formatAsMarkdown();
       }
     }
@@ -408,16 +402,6 @@ class CICommand {
   async serialize() {
     const { argv, cli } = this;
 
-    if (argv.copy) {
-      if (this.markdown) {
-        clipboardy.writeSync(this.markdown);
-        cli.separator('');
-        cli.log('Written markdown to clipboard');
-      } else {
-        cli.error('No markdown generated');
-      }
-    }
-
     if (argv.markdown) {
       if (this.markdown) {
         writeFile(argv.markdown, this.markdown);
@@ -483,7 +467,7 @@ class WalkCommand extends CICommand {
     cli.log('');
     aggregator.display();
 
-    if (argv.markdown || argv.copy) {
+    if (argv.markdown) {
       this.markdown = aggregator.formatAsMarkdown();
     }
   }
@@ -564,7 +548,7 @@ class DailyCommand extends CICommand {
     cli.log('');
     aggregator.display();
 
-    if (argv.markdown || argv.copy) {
+    if (argv.markdown) {
       this.markdown = aggregator.formatAsMarkdown();
     }
   }

package/components/git/benchmark.js

@@ -0,0 +1,112 @@
+import auth from '../../lib/auth.js';
+import { parsePRFromURL } from '../../lib/links.js';
+import CLI from '../../lib/cli.js';
+import Request from '../../lib/request.js';
+import { runPromise } from '../../lib/run.js';
+import BenchmarkSession from '../../lib/benchmark.js';
+
+export const command = 'benchmark <identifier>';
+export const describe =
+  'Trigger the benchmark GitHub Actions workflow for a pull request';
+
+const options = {
+  owner: {
+    alias: 'o',
+    describe: 'GitHub owner of the PR repository',
+    default: 'nodejs',
+    type: 'string'
+  },
+  repo: {
+    alias: 'r',
+    describe: 'GitHub repository of the PR',
+    default: 'node',
+    type: 'string'
+  },
+  'workflow-owner': {
+    describe: 'GitHub owner of the repository hosting the benchmark workflow ' +
+      '(defaults to the PR owner)',
+    type: 'string'
+  },
+  'workflow-repo': {
+    describe: 'GitHub repository hosting the benchmark workflow ' +
+      '(defaults to the PR repository)',
+    type: 'string'
+  },
+  workflow: {
+    describe: 'The workflow file to dispatch',
+    default: 'benchmark.yml',
+    type: 'string'
+  },
+  ref: {
+    describe: 'The git ref of the workflow repository to run the workflow from',
+    default: 'main',
+    type: 'string'
+  },
+  runs: {
+    describe: 'How many times to repeat each benchmark',
+    type: 'number'
+  }
+};
+
+let yargsInstance;
+
+export function builder(yargs) {
+  yargsInstance = yargs;
+  return yargs
+    .options(options)
+    .positional('identifier', {
+      type: 'string',
+      describe: 'ID or URL of the pull request. A commit URL ' +
+        '(…/pull/<id>/commits/<sha>) benchmarks that commit instead of the ' +
+        'PR head.'
+    })
+    .example('git node benchmark 12344',
+      'Pick benchmark categories to run on ' +
+      'https://github.com/nodejs/node/pull/12344')
+    .example('git node benchmark https://github.com/nodejs/node/pull/12344',
+      'Pick benchmark categories to run on ' +
+      'https://github.com/nodejs/node/pull/12344')
+    .example(
+      'git node benchmark ' +
+      'https://github.com/nodejs/node/pull/12344/commits/abc1234',
+      'Benchmark commit abc1234 rather than the current PR head')
+    .wrap(90);
+}
+
+const COMMIT_URL_RE = /\/pull\/\d+\/commits\/([0-9a-f]{7,40})/i;
+
+// Parse the positional identifier into { prid, owner?, repo?, commit? }.
+// A PR commit URL (…/pull/<id>/commits/<sha>) also yields the commit SHA.
+export function parseIdentifier(identifier) {
+  const prid = Number.parseInt(identifier);
+  if (!Number.isNaN(prid)) {
+    return { prid };
+  }
+  const parsed = parsePRFromURL(identifier);
+  if (!parsed) {
+    return undefined;
+  }
+  const commit = COMMIT_URL_RE.exec(identifier);
+  if (commit) {
+    parsed.commit = commit[1];
+  }
+  return parsed;
+}
+
+export function handler(argv) {
+  const parsed = parseIdentifier(argv.identifier);
+  if (!parsed) {
+    return yargsInstance.showHelp();
+  }
+  Object.assign(argv, parsed);
+
+  return runPromise(main(argv));
+}
+
+async function main(argv) {
+  const cli = new CLI(process.stderr);
+  const credentials = await auth({ github: true });
+  const request = new Request(credentials);
+  const session = new BenchmarkSession(cli, request, argv);
+  return session.start();
+}

package/components/git/land.js

@@ -48,8 +48,8 @@ const landActions = {
     type: 'boolean'
   },
   fixupAll: {
-    describe: 'Automatically fixup all commits to the first one dismissing ' +
-      'other commit messages',
+    describe: 'Automatically fixup ("squash") all commits to the first one ' +
+      'dismissing other commit messages',
     default: false,
     type: 'boolean'
   },
@@ -181,7 +181,7 @@ async function main(state, argv, cli, dir) {
   }
   try {
     session.restore();
-  } catch (err) { // JSON error?
+  } catch { // JSON error?
     if (state === ABORT) {
       await session.abort();
       return;

package/components/git/metadata.js

@@ -36,6 +36,10 @@ const options = {
     describe: 'Check for \'LGTM\' in comments',
     type: 'boolean'
   },
+  json: {
+    describe: 'Print metadata and PR readiness result as JSON',
+    type: 'boolean'
+  },
   'max-commits': {
     describe: 'Number of commits to warn',
     type: 'number',
@@ -45,6 +49,29 @@ const options = {
 
 let yargsInstance;
 
+function writeStdout(text) {
+  return new Promise((resolve, reject) => {
+    process.stdout.write(text, (error) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+export async function writeMetadataJsonResult(metadataPromise) {
+  try {
+    const { json } = await metadataPromise;
+    await writeStdout(`${JSON.stringify(json, null, 2)}\n`);
+    process.exitCode = json.exitCode;
+  } catch (error) {
+    console.error(error);
+    process.exitCode = 1;
+  }
+}
+
 export function builder(yargs) {
   yargsInstance = yargs;
   return yargs
@@ -81,10 +108,16 @@ export function handler(argv) {
     return yargsInstance.showHelp();
   }
 
-  const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
+  const logStream = argv.json || !process.stdout.isTTY
+    ? process.stderr
+    : process.stdout;
   const cli = new CLI(logStream);
 
   const merged = Object.assign({}, argv, parsed, config);
+  if (argv.json) {
+    return writeMetadataJsonResult(getMetadata(merged, false, cli));
+  }
+
   return runPromise(getMetadata(merged, false, cli)
     .then(({ status }) => {
       if (status === false) {

package/components/git/release.js

@@ -14,10 +14,6 @@ const PROMOTE = 'promote';
 const RELEASERS = 'releasers';
 
 const releaseOptions = {
-  filterLabel: {
-    describe: 'Labels separated by "," to filter security PRs',
-    type: 'string'
-  },
   'gpg-sign': {
     describe: 'GPG-sign commits, will be passed to the git process',
     alias: 'S'
@@ -51,7 +47,9 @@ const releaseOptions = {
   },
   security: {
     describe: 'Demarcate the new security release as a security release. ' +
-              'Optionally provide path to security-release repository for CVE auto-population',
+              'Optionally provide the path to vulnerabilities.json (or the ' +
+              'security-release repository) to cherry-pick the reports and ' +
+              'dependency updates for this release line and auto-populate CVEs',
     type: 'string',
     coerce: (arg) => {
       // If --security=path is used, return the path

package/components/git/security.js

@@ -1,17 +1,37 @@
+import auth from '../../lib/auth.js';
+import Request from '../../lib/request.js';
+import LandingSession from '../../lib/landing_session.js';
+import Session from '../../lib/session.js';
 import CLI from '../../lib/cli.js';
+import { getMetadata } from '../metadata.js';
+import { checkCwd } from '../../lib/update-v8/common.js';
+import { parsePRFromURL } from '../../lib/links.js';
 import PrepareSecurityRelease from '../../lib/prepare_security.js';
 import UpdateSecurityRelease from '../../lib/update_security_release.js';
 import SecurityBlog from '../../lib/security_blog.js';
 import SecurityAnnouncement from '../../lib/security-announcement.js';
+import { forceRunAsync } from '../../lib/run.js';
+import { getAffectedVersionLines } from '../../lib/security-release/security-release.js';
+import { getPullRequestURLForLine } from '../../lib/prepare_release.js';
 
 export const command = 'security [options]';
 export const describe = 'Manage an in-progress security release or start a new one.';
 
+const SECURITY_REPO = {
+  owner: 'nodejs-private',
+  repo: 'node-private',
+};
+
 const securityOptions = {
   start: {
     describe: 'Start security release process',
     type: 'boolean'
   },
+  'apply-patches': {
+    describe: 'Start an interactive session to make local HEAD ready to create ' +
+      'a security release proposal',
+    type: 'boolean'
+  },
   sync: {
     describe: 'Synchronize an ongoing security release with HackerOne',
     type: 'boolean'
@@ -52,6 +72,26 @@ const securityOptions = {
 
 let yargsInstance;
 
+function isPromptInterrupted(error) {
+  return error?.name === 'ExitPromptError' ||
+    error?.name === 'AbortPromptError' ||
+    error?.message?.includes('User force closed');
+}
+
+function runSecurityAction(cli, action) {
+  return Promise.resolve(action).catch((error) => {
+    if (!isPromptInterrupted(error)) {
+      throw error;
+    }
+
+    if (cli.spinner.isSpinning) {
+      cli.spinner.stop();
+    }
+    cli.warn('Aborted.');
+    cli.setExitCode(1);
+  });
+}
+
 export function builder(yargs) {
   yargsInstance = yargs;
   return yargs.options(securityOptions)
@@ -59,6 +99,10 @@ export function builder(yargs) {
       'git node security --start',
       'Prepare a security release of Node.js'
     )
+    .example(
+      'git node security --apply-patches',
+      'Fetch all the patches for an upcoming security release'
+    )
     .example(
       'git node security --sync',
       'Synchronize an ongoing security release with HackerOne'
@@ -94,37 +138,36 @@ export function builder(yargs) {
 export function handler(argv) {
   const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
   const cli = new CLI(logStream);
+  let action;
 
   if (argv.start) {
-    return startSecurityRelease(cli, argv);
-  }
-  if (argv.sync) {
-    return syncSecurityRelease(cli, argv);
-  }
-  if (argv['update-date']) {
-    return updateReleaseDate(cli, argv);
+    action = startSecurityRelease(cli, argv);
+  } else if (argv['apply-patches']) {
+    action = applySecurityPatches(cli, argv);
+  } else if (argv.sync) {
+    action = syncSecurityRelease(cli, argv);
+  } else if (argv['update-date']) {
+    action = updateReleaseDate(cli, argv);
+  } else if (argv['pre-release']) {
+    action = createPreRelease(cli, argv);
+  } else if (argv['add-report']) {
+    action = addReport(cli, argv);
+  } else if (argv['remove-report']) {
+    action = removeReport(cli, argv);
+  } else if (argv['notify-pre-release']) {
+    action = notifyPreRelease(cli, argv);
+  } else if (argv['request-cve']) {
+    action = requestCVEs(cli, argv);
+  } else if (argv['post-release']) {
+    action = createPostRelease(cli, argv);
+  } else if (argv.cleanup) {
+    action = cleanupSecurityRelease(cli, argv);
   }
-  if (argv['pre-release']) {
-    return createPreRelease(cli, argv);
-  }
-  if (argv['add-report']) {
-    return addReport(cli, argv);
-  }
-  if (argv['remove-report']) {
-    return removeReport(cli, argv);
-  }
-  if (argv['notify-pre-release']) {
-    return notifyPreRelease(cli, argv);
-  }
-  if (argv['request-cve']) {
-    return requestCVEs(cli, argv);
-  }
-  if (argv['post-release']) {
-    return createPostRelease(cli, argv);
-  }
-  if (argv.cleanup) {
-    return cleanupSecurityRelease(cli, argv);
+
+  if (action) {
+    return runSecurityAction(cli, action);
   }
+
   yargsInstance.showHelp();
 }
 
@@ -168,6 +211,194 @@ async function startSecurityRelease(cli) {
   return release.start();
 }
 
+async function fetchVulnerabilitiesDotJSON(cli, req) {
+  const { owner } = SECURITY_REPO;
+  const repo = 'security-release';
+
+  cli.startSpinner(`Looking for Security Release PR on ${owner}/${repo}`);
+  const { repository: { pullRequests: { nodes: { length, 0: pr } } } } =
+    await req.gql('ListSecurityReleasePRs', { owner, repo });
+  if (length !== 1) {
+    cli.stopSpinner('Expected exactly one open Pull Request on the ' +
+      `${owner}/${repo} repository, found ${length}`,
+    cli.SPINNER_STATUS.FAILED);
+    cli.setExitCode(1);
+    return;
+  }
+  if (pr.files.nodes.length !== 1 || !pr.files.nodes[0].path.endsWith('vulnerabilities.json')) {
+    cli.stopSpinner(
+      `${owner}/${repo}#${pr.number} does not contain only vulnerabilities.json`,
+      cli.SPINNER_STATUS.FAILED
+    );
+    cli.setExitCode(1);
+    return;
+  }
+  cli.stopSpinner(`Found ${owner}/${repo}#${pr.number} by @${pr.author.login}`);
+  cli.startSpinner('Fetching vulnerabilities.json...');
+  const result = await req.json(
+    `/repos/${owner}/${repo}/contents/${pr.files.nodes[0].path}?ref=${pr.headRefOid}`,
+    { headers: { Accept: 'application/vnd.github.raw+json' } }
+  );
+  cli.stopSpinner('Fetched vulnerabilities.json');
+  return result;
+}
+
+async function skipIfExisting(cli, prURL) {
+  const existingCommit = await forceRunAsync('git',
+    ['--no-pager', 'log', 'HEAD', '--grep', `^PR-URL: ${prURL}$`, '--format=%h %s'],
+    { ignoreFailure: false, captureStdout: true });
+  if (existingCommit.trim()) {
+    cli.info(`${prURL} seems to already be on the current tree: ${existingCommit}`);
+    return await cli.prompt('Do you want to skip it?', { defaultAnswer: true });
+  }
+  return false;
+}
+async function landingSession(cli, req, prURL, argv, cveIds = undefined) {
+  const response = await cli.prompt('Do you want to land it on the current HEAD?',
+    { defaultAnswer: true });
+  if (!response) {
+    cli.info('Skipping');
+    cli.warn('The resulting HEAD will not be ready for a release proposal');
+    return true;
+  }
+
+  if (!cli.hasDetachedHEAD) {
+    // Moving to a detached HEAD, we don't want security patches to be pushed to the public repo.
+    await forceRunAsync('git', ['checkout', '--detach'], { ignoreFailure: false });
+  }
+  cli.hasDetachedHEAD = (await forceRunAsync(
+    'git', ['rev-parse', 'HEAD'],
+    { ignoreFailure: false, captureStdout: true })).trim();
+
+  const session = new LandingSession(cli, req, process.cwd(), {
+    autorebase: true, oneCommitMax: false, ...argv
+  });
+  Object.defineProperty(session, 'tryResetBranch', {
+    __proto__: null,
+    value: Function.prototype,
+    configurable: true,
+  });
+  const metadata = await getMetadata(session.argv, true, cli);
+  if (argv?.backport) {
+    metadata.metadata += `PR-URL: ${prURL}\n`;
+  }
+  if (cveIds?.length) {
+    metadata.metadata += cveIds.map(cve => `CVE-ID: ${cve}\n`).join('');
+  }
+  await session.start(metadata);
+  return false;
+}
+async function applySecurityPatches(cli) {
+  const { nodeMajorVersion } = await checkCwd({ nodeDir: process.cwd() });
+  const branch = `v${nodeMajorVersion}.x`;
+  const credentials = await auth({
+    github: true
+  });
+  const req = new Request(credentials);
+
+  cli.info('N.B.: if there are commits on the staging branch that need to be included in the ' +
+    'security release, please rebase them manually and answer no to the following question');
+  // Try reset to the public upstream
+  const session = new Session(cli, process.cwd(), undefined, { branch });
+  await session.tryResetBranch();
+
+  const { owner, repo } = SECURITY_REPO;
+  const { releaseDate, reports, dependencies } = await fetchVulnerabilitiesDotJSON(cli, req);
+
+  let patchedVersion;
+  const releaseLine = `${nodeMajorVersion}.x`;
+  for (const [name, dep] of Object.entries(dependencies ?? {})) {
+    const prURL = getPullRequestURLForLine(
+      dep.affectedVersions, releaseLine, dep.prURL);
+    if (!prURL) continue;
+    cli.separator(`Taking care of ${name}...`);
+    if (await skipIfExisting(cli, prURL)) continue;
+
+    const argv = parsePRFromURL(prURL);
+    if (argv.owner === SECURITY_REPO.owner && argv.repo === SECURITY_REPO.repo) {
+      await landingSession(cli, req, prURL, argv);
+      continue;
+    }
+
+    const existingCommits = (await forceRunAsync('git',
+      ['--no-pager', 'log', `${session.upstream}/v${nodeMajorVersion}.x-staging`,
+        '--grep', `^PR-URL: ${prURL}$`,
+        '--format=%H %h %s'],
+      { ignoreFailure: false, captureStdout: true })).trim().split('\n');
+    if (existingCommits[0] === '') {
+      cli.error(`${prURL} was not found on ${session.upstream}/v${nodeMajorVersion}.x-staging.`);
+      cli.info('Please cherry-pick the adequate commits to the public staging branch.');
+      cli.info('Skipping');
+      cli.warn('The resulting HEAD will not be ready for a release proposal');
+      continue;
+    }
+    cli.info(`The following commit(s) have been found on ${session.upstream}/v${nodeMajorVersion
+      }.x-staging:\n${existingCommits.map(c => ` - ${c.slice(41)}`).join('\n')}`);
+    if (!await cli.prompt('Cherry-pick those for the current proposal?')) {
+      cli.info('Skipping');
+      cli.warn('The resulting HEAD will not be ready for a release proposal');
+      continue;
+    }
+    await forceRunAsync('git',
+      ['cherry-pick', ...existingCommits.map(c => c.slice(0, 40))],
+      { ignoreFailure: false });
+  }
+
+  cli.startSpinner(`Fetching open PRs on ${owner}/${repo}...`);
+  const { repository: { pullRequests: { nodes } } } = await req.gql('PRs', {
+    owner, repo, labels: [branch],
+  });
+  cli.stopSpinner(`Fetched all PRs labeled for v${nodeMajorVersion}.x`);
+
+  for (const { affectedVersions, prURL, cveIds, patchedVersions } of reports) {
+    if (!getAffectedVersionLines(affectedVersions).includes(`${nodeMajorVersion}.x`)) continue;
+    patchedVersion ??= patchedVersions?.find(v => v.startsWith(`${nodeMajorVersion}.`));
+    cli.separator(`Taking care of ${cveIds.join(', ')}...`);
+
+    if (await skipIfExisting(cli, prURL)) continue;
+
+    let pr = nodes.find(({ url }) => url === prURL);
+    if (!pr) {
+      cli.info(
+        `${prURL} is not labelled for v${nodeMajorVersion}.x, there might be a backport PR.`
+      );
+
+      cli.startSpinner('Fetching PR title to find a match...');
+      const { title } = await req.getPullRequest(prURL);
+      pr = nodes.find((pr) => pr.title.endsWith(title));
+      if (pr) {
+        cli.stopSpinner(`Found ${pr.url}`);
+      } else {
+        cli.stopSpinner(`Did not find a match for "${title}"`, cli.SPINNER_STATUS.WARN);
+        const prID = await cli.prompt(
+          'Please enter the PR number to use:',
+          { questionType: cli.QUESTION_TYPE.NUMBER, defaultAnswer: NaN }
+        );
+        pr = nodes.find(({ number }) => number === prID);
+        if (!pr) {
+          cli.error(`${prID} is not in the list of PRs labelled for v${nodeMajorVersion}.x`);
+          cli.info('The list of labelled PRs and vulnerabilities.json are fetched ' +
+            'once at the start of the session; to refresh those, start a new NCU session');
+          const response = await cli.prompt('Do you want to skip that CVE?',
+            { defaultAnswer: false });
+          if (response) continue;
+          throw new Error(`Found no patch for ${cveIds}`);
+        }
+      }
+    }
+    cli.ok(`${pr.url} is labelled for v${nodeMajorVersion}.x.`);
+
+    const backport = prURL !== pr.url;
+
+    await landingSession(cli, req, prURL, { prid: pr.number, backport, ...SECURITY_REPO }, cveIds);
+  }
+  cli.ok('All patches are on the local HEAD!');
+  cli.info('You can now build and test, and create a proposal with the following commands:');
+  cli.info(`git switch -C v${nodeMajorVersion}.x HEAD`);
+  cli.info(`git node release --prepare --security --newVersion=${patchedVersion} ` +
+    `--releaseDate=${releaseDate.replaceAll('/', '-')} --skipBranchDiff`);
+}
+
 async function cleanupSecurityRelease(cli) {
   const release = new PrepareSecurityRelease(cli);
   return release.cleanup();

package/components/git/v8.js

@@ -1,11 +1,10 @@
 import path from 'node:path';
 
-import logSymbols from 'log-symbols';
-
 import { minor, major, backport, deps } from '../../lib/update-v8/index.js';
 import { defaultBaseDir } from '../../lib/update-v8/constants.js';
 import { checkCwd } from '../../lib/update-v8/common.js';
 import { forceRunAsync } from '../../lib/run.js';
+import { error } from '../../lib/figures.js';
 
 export const command = 'v8 [major|minor|backport|deps]';
 export const describe = 'Update or patch the V8 engine';
@@ -31,6 +30,10 @@ export function builder(yargs) {
           describe: 'Update dependencies concurrently',
           default: true,
         });
+        yargs.option('cargo', {
+          describe: 'The cargo binary that will be executed when updating the Rust crates',
+          default: 'cargo',
+        });
       }
     })
     .command({
@@ -150,7 +153,7 @@ export function handler(argv) {
     })
     .catch((err) => {
       console.error(
-        logSymbols.error,
+        error,
         options.verbose ? err.stack : err.message
       );
       process.exitCode = 1;