@node-core/utils 6.4.0 → 7.0.0

package/lib/prepare_security.js

@@ -11,10 +11,12 @@ import {
   promptDependencies,
   getSupportedVersions,
   getReportSeverity,
+  getSummary,
   pickReport,
+  confirmSecurityStep,
+  writeSecurityFile,
   SecurityRelease
 } from './security-release/security-release.js';
-import _ from 'lodash';
 
 function relativeDate(date) {
   const days = Math.floor((Date.now() - date) / (1000 * 60 * 60 * 24));
@@ -23,6 +25,131 @@ function relativeDate(date) {
   return months === 1 ? '1 month ago' : `${months} months ago`;
 }
 
+function formatDate(date) {
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, '0');
+  const day = String(date.getDate()).padStart(2, '0');
+  return `${year}/${month}/${day}`;
+}
+
+function formatDaysFromNow(days) {
+  return days === 1 ? 'in 1 day' : `in ${days} days`;
+}
+
+function getNextTuesdayReleaseDateObjects(fromDate = new Date(), count = 4) {
+  const TUESDAY = 2;
+  const start = new Date(
+    fromDate.getFullYear(),
+    fromDate.getMonth(),
+    fromDate.getDate()
+  );
+  const daysUntilTuesday = (TUESDAY - start.getDay() + 7) % 7 || 7;
+  start.setDate(start.getDate() + daysUntilTuesday);
+
+  return Array.from({ length: count }, (_, index) => {
+    const date = new Date(start);
+    date.setDate(start.getDate() + (index * 7));
+    return {
+      date,
+      daysFromNow: daysUntilTuesday + (index * 7)
+    };
+  });
+}
+
+export function getNextTuesdayReleaseDates(fromDate = new Date(), count = 4) {
+  return getNextTuesdayReleaseDateObjects(fromDate, count)
+    .map(({ date }) => formatDate(date));
+}
+
+export function getNextTuesdayReleaseDateChoices(fromDate = new Date(), count = 4) {
+  const choices = getNextTuesdayReleaseDateObjects(fromDate, count)
+    .map(({ date, daysFromNow }) => {
+      const formattedDate = formatDate(date);
+      return {
+        name: formattedDate,
+        value: formattedDate,
+        description: `Tuesday, ${formatDaysFromNow(daysFromNow)}`
+      };
+    });
+
+  choices.push({
+    name: 'TBD',
+    value: 'TBD',
+    description: 'Release date not defined yet'
+  });
+
+  return choices;
+}
+
+function getReportPRURL(report) {
+  const customFieldValues = report.relationships.custom_field_values?.data ?? [];
+  return customFieldValues[0]?.attributes?.value ?? '';
+}
+
+export function buildIncludedTriagedReport(report, options = {}) {
+  const {
+    affectedVersions = '',
+    patchAuthors = [],
+    prURL = getReportPRURL(report)
+  } = options;
+  const {
+    id,
+    attributes: { title, cve_ids = [] },
+    relationships: { reporter }
+  } = report;
+  const link = `https://hackerone.com/reports/${id}`;
+  const summaryContent = getSummary(report);
+
+  return {
+    id,
+    title,
+    cveIds: cve_ids,
+    severity: getReportSeverity(report),
+    summary: summaryContent ?? '',
+    patchAuthors,
+    prURL,
+    affectedVersions: affectedVersions
+      .split(',')
+      .map((v) => v.replace('v', '').trim())
+      .filter(Boolean),
+    link,
+    reporter: reporter?.data?.attributes?.username ?? ''
+  };
+}
+
+export function getMissingReportInformation(report) {
+  const missing = [];
+
+  if (!report.severity?.rating) missing.push('severity rating');
+  if (!report.severity?.cvss_vector_string) missing.push('CVSS vector');
+  if (!report.severity?.weakness_id) missing.push('weakness ID');
+  if (!report.summary) missing.push('team summary');
+  if (!report.prURL) missing.push('PR URL');
+  if (!report.patchAuthors?.length) missing.push('patch authors');
+  if (!report.affectedVersions?.length) missing.push('affected versions');
+
+  return missing;
+}
+
+export function groupMissingReportInformation(reports) {
+  const grouped = new Map();
+
+  for (const report of reports) {
+    for (const field of report.missing) {
+      const current = grouped.get(field) ?? [];
+      current.push(report);
+      grouped.set(field, current);
+    }
+  }
+
+  return Array.from(grouped.entries())
+    .map(([field, fieldReports]) => ({
+      field,
+      reports: fieldReports
+    }))
+    .sort((a, b) => b.reports.length - a.reports.length);
+}
+
 export default class PrepareSecurityRelease extends SecurityRelease {
   title = 'Next Security Release';
 
@@ -35,22 +162,23 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     this.req = new Request(credentials);
 
     let excludedReports = [];
-    const showTriaged = await this.promptShowTriagedWithoutPR();
-    if (showTriaged) {
-      excludedReports = await this.showTriagedReportsWithoutPR();
-    }
-
     const releaseDate = await this.promptReleaseDate();
     if (releaseDate !== 'TBD') {
       validateDate(releaseDate);
     }
     const createVulnerabilitiesJSON = await this.promptVulnerabilitiesJSON();
 
-    let securityReleasePRUrl;
-    const content = await this.buildDescription(releaseDate, securityReleasePRUrl);
+    const content = await this.buildDescription(releaseDate);
     if (createVulnerabilitiesJSON) {
-      securityReleasePRUrl = await this.startVulnerabilitiesJSONCreation(
-        releaseDate, content, excludedReports);
+      const reportSelectionMode = await this.promptReportSelectionMode();
+      if (reportSelectionMode === 'review') {
+        const showTriaged = await this.promptShowTriagedWithoutPR();
+        if (showTriaged) {
+          excludedReports = await this.showTriagedReportsWithoutPR();
+        }
+      }
+      await this.startVulnerabilitiesJSONCreation(
+        releaseDate, content, excludedReports, reportSelectionMode);
     }
 
     this.cli.ok('Done!');
@@ -73,6 +201,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
 
     if (vulnerabilityJSON.buildIssue) {
       this.cli.info('Commenting on nodejs/build issue');
+      await confirmSecurityStep(
+        this.cli,
+        `comment on GitHub issue \`${vulnerabilityJSON.buildIssue}\``,
+        'This posts that the security release is out on the build tracking issue.'
+      );
       await this.req.commentIssue(
         vulnerabilityJSON.buildIssue,
         'Security release is out'
@@ -81,6 +214,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
 
     if (vulnerabilityJSON.dockerIssue) {
       this.cli.info('Commenting on nodejs/docker-node issue');
+      await confirmSecurityStep(
+        this.cli,
+        `comment on GitHub issue \`${vulnerabilityJSON.dockerIssue}\``,
+        'This posts that the security release is out on the docker-node tracking issue.'
+      );
       await this.req.commentIssue(
         vulnerabilityJSON.dockerIssue,
         'Security release is out'
@@ -92,11 +230,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
         vulnerabilityJSON.releaseDate}?`,
       { defaultAnswer: true });
     if (updateFolder) {
-      this.updateReleaseFolder(
+      await this.updateReleaseFolder(
         vulnerabilityJSON.releaseDate.replaceAll('/', '-')
       );
       const securityReleaseFolder = path.join(process.cwd(), 'security-release');
-      commitAndPushVulnerabilitiesJSON(
+      await commitAndPushVulnerabilitiesJSON(
         securityReleaseFolder,
         'chore: change next-security-release folder',
         { cli: this.cli, repository: this.repository }
@@ -109,14 +247,20 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     this.cli.ok('Done!');
   }
 
-  async startVulnerabilitiesJSONCreation(releaseDate, content, excludedReports = []) {
+  async startVulnerabilitiesJSONCreation(
+    releaseDate,
+    content,
+    excludedReports = [],
+    reportSelectionMode = 'review'
+  ) {
     // checkout on the next-security-release branch
-    checkoutOnSecurityReleaseBranch(this.cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(this.cli, this.repository);
 
     // choose the reports to include in the security release
-    const reports = await this.chooseReports(excludedReports);
-    const depUpdates = await this.getDependencyUpdates();
-    const deps = _.groupBy(depUpdates, 'name');
+    const reports = reportSelectionMode === 'include-all'
+      ? await this.includeAllTriagedReports(excludedReports)
+      : await this.chooseReports(excludedReports);
+    const deps = await this.getDependencyUpdates();
 
     // create the vulnerabilities.json file in the security-release repo
     const filePath = await this.createVulnerabilitiesJSON(reports, deps, releaseDate);
@@ -131,11 +275,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
         - git push -u origin ${NEXT_SECURITY_RELEASE_BRANCH}
         - open a PR on ${this.repository.owner}/${this.repository.repo}`);
       return;
-    };
+    }
 
     // commit and push the vulnerabilities.json file
     const commitMessage = 'chore: create vulnerabilities.json for next security release';
-    commitAndPushVulnerabilitiesJSON(filePath,
+    await commitAndPushVulnerabilitiesJSON(filePath,
       commitMessage,
       { cli: this.cli, repository: this.repository });
 
@@ -165,21 +309,18 @@ export default class PrepareSecurityRelease extends SecurityRelease {
         return body.substring(index);
       }
       return body;
-    } catch (error) {
+    } catch {
       this.cli.error(`Could not retrieve the security issue template from ${url}`);
     }
   }
 
   async promptReleaseDate() {
-    const nextWeekDate = new Date();
-    nextWeekDate.setDate(nextWeekDate.getDate() + 7);
-    // Format the date as YYYY/MM/DD
-    const formattedDate = nextWeekDate.toISOString().slice(0, 10).replace(/-/g, '/');
-    return this.cli.prompt(
-      'Enter target release date in YYYY/MM/DD format (TBD if not defined yet):', {
-        questionType: 'input',
-        defaultAnswer: formattedDate
-      });
+    const choices = getNextTuesdayReleaseDateChoices();
+    return this.cli.promptSelect(
+      'Select target release date:',
+      choices,
+      { defaultAnswer: choices[0].value }
+    );
   }
 
   async promptVulnerabilitiesJSON() {
@@ -188,6 +329,25 @@ export default class PrepareSecurityRelease extends SecurityRelease {
       { defaultAnswer: true });
   }
 
+  async promptReportSelectionMode() {
+    return this.cli.promptSelect(
+      'How would you like to choose reports for the next security release?',
+      [
+        {
+          name: 'Review each triaged report',
+          value: 'review',
+          description: 'Iterate over reports and fill missing details interactively'
+        },
+        {
+          name: 'Include all triaged reports',
+          value: 'include-all',
+          description: 'Add every triaged report and summarize missing information'
+        }
+      ],
+      { defaultAnswer: 'review' }
+    );
+  }
+
   async promptCreateRelaseIssue() {
     return this.cli.prompt(
       'Create the Next Security Release issue?',
@@ -262,6 +422,80 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     return selectedReports;
   }
 
+  async includeAllTriagedReports(excludedReports = []) {
+    this.cli.info('Getting triaged H1 reports...');
+    const reports = await this.req.getTriagedReports();
+    const supportedVersions = await getSupportedVersions();
+    const selectedReports = [];
+    const missingInformation = [];
+
+    for (const report of reports.data) {
+      if (excludedReports.includes(report.id)) continue;
+
+      const reportData = await this.buildIncludedTriagedReport(
+        report,
+        supportedVersions
+      );
+      selectedReports.push(reportData);
+
+      const missing = getMissingReportInformation(reportData);
+      if (missing.length) {
+        missingInformation.push({
+          id: reportData.id,
+          title: reportData.title,
+          link: reportData.link,
+          missing
+        });
+      }
+    }
+
+    this.displayMissingReportInformationSummary(missingInformation);
+    return selectedReports;
+  }
+
+  async buildIncludedTriagedReport(report, supportedVersions) {
+    const prURL = getReportPRURL(report);
+    const patchAuthors = await this.getPatchAuthorsFromPR(prURL);
+    return buildIncludedTriagedReport(report, {
+      affectedVersions: supportedVersions,
+      patchAuthors,
+      prURL
+    });
+  }
+
+  async getPatchAuthorsFromPR(prURL) {
+    if (!prURL) return [];
+
+    try {
+      const { user } = await this.req.getPullRequest(prURL);
+      return user?.login ? [user.login] : [];
+    } catch (error) {
+      this.cli.warn(`Could not fetch patch author from ${prURL}`);
+      this.cli.error(error);
+      return [];
+    }
+  }
+
+  displayMissingReportInformationSummary(reports) {
+    if (!reports.length) {
+      this.cli.ok('All included reports have the expected information.');
+      return;
+    }
+
+    const grouped = groupMissingReportInformation(reports);
+    this.cli.warn(
+      `${reports.length} included reports are missing information:`
+    );
+    for (const { field, reports: fieldReports } of grouped) {
+      const reportList = fieldReports
+        .map(({ id }) => `H1 #${id}`)
+        .join(', ');
+      this.cli.info(
+        `- ${field} (${fieldReports.length}): ${reportList}`
+      );
+    }
+  }
+
   async createVulnerabilitiesJSON(reports, dependencies, releaseDate) {
     this.cli.startSpinner('Creating vulnerabilities.json...');
     const fileContent = JSON.stringify({
@@ -271,10 +505,19 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     }, null, 2) + '\n';
 
     const folderPath = path.resolve(NEXT_SECURITY_RELEASE_FOLDER);
-    await fs.promises.mkdir(folderPath, { recursive: true });
-
     const fullPath = path.join(folderPath, 'vulnerabilities.json');
-    await fs.promises.writeFile(fullPath, fileContent);
+    await confirmSecurityStep(
+      this.cli,
+      `create directory \`${folderPath}\``,
+      'This creates the security release folder if it does not already exist.'
+    );
+    await fs.promises.mkdir(folderPath, { recursive: true });
+    await writeSecurityFile(
+      this.cli,
+      fullPath,
+      fileContent,
+      'This creates vulnerabilities.json for the next security release.'
+    );
     this.cli.stopSpinner(`Created ${fullPath}`);
 
     return fullPath;
@@ -282,6 +525,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
 
   async createPullRequest(content) {
     const { owner, repo } = this.repository;
+    await confirmSecurityStep(
+      this.cli,
+      `create GitHub pull request \`${owner}/${repo}: ${this.title}\``,
+      `This opens a pull request from ${NEXT_SECURITY_RELEASE_BRANCH} to main.`
+    );
     const response = await this.req.createPullRequest(
       this.title,
       content ?? 'List of vulnerabilities to be included in the next security release',
@@ -308,10 +556,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     process.exit(1);
   }
 
+  // Collect dependency updates using the same schema as the reports: each
+  // dependency maps every affected release line to the PR that lands it, e.g.
+  //   { undici: { affectedVersions: { '22.x': '<prURL>', '24.x': '<prURL>' } } }
   async getDependencyUpdates() {
-    const deps = [];
-    this.cli.log('\n');
-    this.cli.separator('Dependency Updates');
+    const deps = {};
     const updates = await this.cli.prompt('Are there dependency updates in this security release?',
       {
         defaultAnswer: true,
@@ -322,11 +571,9 @@ export default class PrepareSecurityRelease extends SecurityRelease {
 
     const supportedVersions = await getSupportedVersions();
 
-    let asking = true;
-    while (asking) {
+    while (true) {
       const dep = await promptDependencies(this.cli);
       if (!dep) {
-        asking = false;
         break;
       }
 
@@ -337,20 +584,24 @@ export default class PrepareSecurityRelease extends SecurityRelease {
         });
 
       const versions = await this.cli.prompt(
-        'Which release line does this dependency update affect?', {
+        'Which release line(s) does this dependency update PR affect? ' +
+        '(comma-separated)', {
           defaultAnswer: supportedVersions,
           questionType: 'input'
         });
 
       try {
         const res = await this.req.getPullRequest(dep);
-        const { html_url, title } = res;
-        deps.push({
-          name,
-          url: html_url,
-          title,
-          affectedVersions: versions.split(',').map((v) => v.replace('v', '').trim())
-        });
+        const { html_url: prURL } = res;
+        const affectedVersions = versions
+          .split(',')
+          .map((v) => v.replace('v', '').trim())
+          .filter(Boolean);
+
+        deps[name] ??= { affectedVersions: {} };
+        for (const line of affectedVersions) {
+          deps[name].affectedVersions[line] = prURL;
+        }
         this.cli.separator();
       } catch (error) {
         this.cli.error('Invalid PR url. Please provide a valid PR url.');
@@ -364,6 +615,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     this.cli.startSpinner('Closing HackerOne reports');
     for (const report of jsonReports) {
       this.cli.updateSpinner(`Closing report ${report.id}...`);
+      await confirmSecurityStep(
+        this.cli,
+        `resolve HackerOne report \`${report.id}\``,
+        'This marks the HackerOne report as resolved.'
+      );
       await this.req.updateReportState(
         report.id,
         'resolved',
@@ -371,6 +627,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
       );
 
       this.cli.updateSpinner(`Requesting disclosure to report ${report.id}...`);
+      await confirmSecurityStep(
+        this.cli,
+        `request disclosure for HackerOne report \`${report.id}\``,
+        'This asks HackerOne to disclose the resolved report.'
+      );
       await this.req.requestDisclosure(report.id);
     }
     this.cli.stopSpinner('Done closing H1 Reports and requesting disclosure');
@@ -388,6 +649,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     for (const pr of prs) {
       if (pr.labels.some((l) => labels.includes(l.name))) {
         this.cli.updateSpinner(`Closing Pull Request: ${pr.number}`);
+        await confirmSecurityStep(
+          this.cli,
+          `close GitHub pull request \`nodejs-private/node-private#${pr.number}\``,
+          'This closes a pull request labeled for the security release.'
+        );
         await this.req.closePullRequest(pr.number,
           { owner: 'nodejs-private', repo: 'node-private' });
       }

package/lib/promote_release.js

@@ -5,7 +5,7 @@ import { pipeline } from 'node:stream/promises';
 import semver from 'semver';
 import * as gst from 'git-secure-tag';
 
-import { forceRunAsync } from './run.js';
+import { forceRunAsync, runSync } from './run.js';
 import PRData from './pr_data.js';
 import PRChecker from './pr_checker.js';
 import Session from './session.js';
@@ -59,7 +59,8 @@ export default class ReleasePromotion extends Session {
     if (!localCloneIsClean) {
       if (await cli.prompt('Should we checkout the release proposal?')) {
         cli.startSpinner('Fetching the proposal upstream...');
-        await forceRunAsync('git', ['fetch', proposalUpstreamRemote, releaseCommitSha],
+        // We need a sync spawn here to avoid the spinner getting in the way of SSH key passphrase
+        runSync('git', ['fetch', proposalUpstreamRemote, releaseCommitSha],
           { ignoreFailure: false });
         await forceRunAsync('git', ['checkout', releaseCommitSha], { ignoreFailure: false });
         cli.stopSpinner('Local HEAD is now in sync with the proposal');
@@ -523,11 +524,7 @@ export default class ReleasePromotion extends Session {
       cli.separator();
       cli.info('Resolve the conflicts and commit the result');
       cli.separator();
-      const didResolveConflicts = await cli.prompt(
-        'Finished resolving cherry-pick conflicts?', { defaultAnswer: true });
-      if (!didResolveConflicts) {
-        throw new Error('Aborted');
-      }
+      await cli.prompt('Ready to continue?', { defaultAnswer: true });
     }
 
     if (existsSync('.git/CHERRY_PICK_HEAD')) {
@@ -537,16 +534,22 @@ export default class ReleasePromotion extends Session {
     }
 
     // Validate release commit on the default branch
-    const releaseCommitOnDefaultBranch =
-      await forceRunAsync('git', ['show', 'HEAD', '--name-only', '--pretty=format:%s'],
-        { captureStdout: true, ignoreFailure: false });
-    const [commitTitle, ...modifiedFiles] = releaseCommitOnDefaultBranch.trim().split('\n');
-    await this.validateReleaseCommit(commitTitle);
-    if (modifiedFiles.some(file => !file.endsWith('.md'))) {
-      cli.warn('Some modified files are not markdown, that\'s unusual.');
+    while (true) {
+      const releaseCommitOnDefaultBranch =
+        await forceRunAsync('git', ['show', 'HEAD', '--name-only', '--pretty=format:%s'],
+          { captureStdout: true, ignoreFailure: false });
+      const [commitTitle, ...modifiedFiles] = releaseCommitOnDefaultBranch.trim().split('\n');
+      await this.validateReleaseCommit(commitTitle);
+      if (!modifiedFiles.some(file => !file.endsWith('.md'))) break;
+
+      cli.warn(
+        'Some modified files are not markdown, that\'s unusual. Consider amending the commit.'
+      );
       cli.info(`The list of modified files: ${modifiedFiles.map(f => `- ${f}`).join('\n')}`);
-      if (!await cli.prompt('Do you want to proceed anyway?', { defaultAnswer: false })) {
-        throw new Error('Aborted');
+      if (await cli.prompt('Ignore and continue anyway?', {
+        defaultAnswer: false
+      })) {
+        break;
       }
     }
   }

package/lib/queries/ListSecurityReleasePRs.gql

@@ -0,0 +1,19 @@
+query PR($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequests(states: OPEN, first: 2, headRefName: "next-security-release", orderBy: {field: CREATED_AT, direction: DESC}) {
+      nodes {
+        number
+        headRefOid
+        author {
+          login
+        }
+
+        files(first: 2) {
+          nodes {
+            path
+          }
+        }
+      }
+    }
+  }
+}

package/lib/queries/PR.gql

@@ -31,7 +31,10 @@ query PR($prid: Int!, $owner: String!, $repo: String!) {
       closed,
       closedAt,
       merged,
-      mergedAt
+      mergedAt,
+      mergeCommit {
+        oid
+      }
     }
   }
 }

package/lib/request.js

@@ -100,6 +100,47 @@ export default class Request {
     return this.json(prUrl);
   }
 
+  async * getPullRequestFiles({ owner, repo, prid }) {
+    let page = 1;
+    for (;;) {
+      const url =
+        `/repos/${owner}/${repo}/pulls/${prid}/files?per_page=100&page=${page}`;
+      const batch = await this.json(url);
+      if (!Array.isArray(batch) || batch.length === 0) {
+        break;
+      }
+      yield * batch;
+      if (batch.length < 100) {
+        break;
+      }
+      page++;
+    }
+  }
+
+  async listDirectory({ owner, repo, path, ref }) {
+    let url = `/repos/${owner}/${repo}/contents/${path}`;
+    if (ref) {
+      url += `?ref=${encodeURIComponent(ref)}`;
+    }
+    return this.json(url);
+  }
+
+  async dispatchWorkflow(workflowId, { owner, repo, ref, inputs }) {
+    const url =
+      `/repos/${owner}/${repo}/actions/workflows/${workflowId}/dispatches`;
+    const res = await this.fetch(url, {
+      method: 'POST',
+      body: JSON.stringify({ ref, inputs })
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(
+        `Failed to dispatch workflow ${workflowId} on ${owner}/${repo}: ` +
+        `${res.status} ${res.statusText}${text ? `\n${text}` : ''}`);
+    }
+    return res;
+  }
+
   async createPullRequest(title, body, { owner, repo, head, base }) {
     const url = `/repos/${owner}/${repo}/pulls`;
     const options = {