@node-core/utils 6.4.0 → 7.0.0

package/lib/run.js

@@ -77,7 +77,7 @@ export function forceRunAsync(cmd, args, options) {
       throw error;
     }
   });
-};
+}
 
 export function runPromise(promise) {
   return promise.catch((error) => {
@@ -86,11 +86,11 @@ export function runPromise(promise) {
     }
     exit();
   });
-};
+}
 
 export function runAsync(cmd, args, options) {
   return runPromise(runAsyncBase(cmd, args, options));
-};
+}
 
 export function runSync(cmd, args, options) {
   if (cmd instanceof URL) {
@@ -111,8 +111,8 @@ export function runSync(cmd, args, options) {
   } else {
     return child.stdout.toString();
   }
-};
+}
 
 export function exit() {
   process.exit(1);
-};
+}

package/lib/security-announcement.js

@@ -1,4 +1,3 @@
-import fs from 'node:fs';
 import {
   NEXT_SECURITY_RELEASE_REPOSITORY,
   checkoutOnSecurityReleaseBranch,
@@ -7,7 +6,8 @@ import {
   validateDate,
   formatDateToYYYYMMDD,
   commitAndPushVulnerabilitiesJSON,
-  createIssue
+  createIssue,
+  writeSecurityFile
 } from './security-release/security-release.js';
 import auth from './auth.js';
 import Request from './request.js';
@@ -30,7 +30,7 @@ export default class SecurityAnnouncement {
     this.req = new Request(credentials);
 
     // checkout on security release branch
-    checkoutOnSecurityReleaseBranch(cli, this.repository);
+    await checkoutOnSecurityReleaseBranch(cli, this.repository);
     // read vulnerabilities JSON file
     const content = getVulnerabilitiesJSON(cli);
     // validate the release date read from vulnerabilities JSON
@@ -52,9 +52,14 @@ export default class SecurityAnnouncement {
     content.dockerIssue = dockerIssue;
 
     const vulnerabilitiesJSONPath = getVulnerabilitiesJSONPath();
-    fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
+    await writeSecurityFile(
+      cli,
+      vulnerabilitiesJSONPath,
+      JSON.stringify(content, null, 2),
+      'This records the build and docker tracking issue links in vulnerabilities.json.'
+    );
     const commitMessage = 'chore: add build and docker issue link';
-    commitAndPushVulnerabilitiesJSON([vulnerabilitiesJSONPath],
+    await commitAndPushVulnerabilitiesJSON([vulnerabilitiesJSONPath],
       commitMessage, { cli: this.cli, repository: this.repository });
 
     this.cli.ok('Added docker and build issue in vulnerabilities.json');

package/lib/security-release/security-release.js

@@ -11,6 +11,10 @@ export const NEXT_SECURITY_RELEASE_REPOSITORY = {
   repo: 'security-release'
 };
 
+export const SEVERITY_RANKS = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+const RELEASE_LINE_RE = /^v?(\d+)(?:\.x)?$/;
+const SEMVER_RE = /^v?(\d+)\.\d+\.\d+/;
+
 export const PLACEHOLDERS = {
   releaseDate: '%RELEASE_DATE%',
   vulnerabilitiesPRURL: '%VULNERABILITIES_PR_URL%',
@@ -28,7 +32,34 @@ export const PLACEHOLDERS = {
   downloads: '%DOWNLOADS%'
 };
 
-export function checkRemote(cli, repository) {
+function formatCommand(command, args) {
+  return [command, ...args].join(' ');
+}
+
+export async function confirmSecurityStep(cli, action, detail) {
+  let message = `Allow action: ${action}?`;
+  if (detail) {
+    message += `\n\n${detail}`;
+  }
+
+  const allowed = await cli.prompt(message, { defaultAnswer: false });
+  if (!allowed) {
+    throw new Error(`Aborted: ${action}.`);
+  }
+}
+
+export async function runSecurityGitCommand(cli, args, detail) {
+  const command = formatCommand('git', args);
+  await confirmSecurityStep(cli, `run \`${command}\``, detail);
+  return runSync('git', args);
+}
+
+export async function writeSecurityFile(cli, filePath, content, detail) {
+  await confirmSecurityStep(cli, `write \`${filePath}\``, detail);
+  return fs.writeFileSync(filePath, content);
+}
+
+export async function checkRemote(cli, repository) {
   const remote = runSync('git', ['ls-remote', '--get-url', 'origin']).trim();
   const { owner, repo } = repository;
   const securityReleaseOrigin = [
@@ -42,23 +73,31 @@ export function checkRemote(cli, repository) {
   }
 }
 
-export function checkoutOnSecurityReleaseBranch(cli, repository) {
-  checkRemote(cli, repository);
+export async function checkoutOnSecurityReleaseBranch(cli, repository) {
+  await checkRemote(cli, repository);
   const currentBranch = runSync('git', ['branch', '--show-current']).trim();
   cli.info(`Current branch: ${currentBranch} `);
 
   if (currentBranch !== NEXT_SECURITY_RELEASE_BRANCH) {
-    runSync('git', ['checkout', '-B', NEXT_SECURITY_RELEASE_BRANCH]);
+    await runSecurityGitCommand(
+      cli,
+      ['checkout', '-B', NEXT_SECURITY_RELEASE_BRANCH],
+      `This checks out or recreates the ${NEXT_SECURITY_RELEASE_BRANCH} branch locally.`
+    );
     cli.ok(`Checkout on branch: ${NEXT_SECURITY_RELEASE_BRANCH} `);
-  };
+  }
 }
 
-export function commitAndPushVulnerabilitiesJSON(filePath, commitMessage, { cli, repository }) {
-  checkRemote(cli, repository);
+export async function commitAndPushVulnerabilitiesJSON(
+  filePath,
+  commitMessage,
+  { cli, repository }
+) {
+  await checkRemote(cli, repository);
 
   if (Array.isArray(filePath)) {
-    for (const path of filePath) {
-      runSync('git', ['add', path]);
+    for (const currentPath of filePath) {
+      runSync('git', ['add', currentPath]);
     }
   } else {
     runSync('git', ['add', filePath]);
@@ -70,15 +109,31 @@ export function commitAndPushVulnerabilitiesJSON(filePath, commitMessage, { cli,
     return;
   }
 
-  runSync('git', ['commit', '-m', commitMessage]);
+  await runSecurityGitCommand(
+    cli,
+    ['commit', '-m', commitMessage],
+    `This creates a local commit with message: ${commitMessage}`
+  );
 
   try {
-    runSync('git', ['push', '-u', 'origin', NEXT_SECURITY_RELEASE_BRANCH]);
-  } catch (error) {
+    await runSecurityGitCommand(
+      cli,
+      ['push', '-u', 'origin', NEXT_SECURITY_RELEASE_BRANCH],
+      `This pushes the security release branch to origin/${NEXT_SECURITY_RELEASE_BRANCH}.`
+    );
+  } catch {
     cli.warn('Rebasing...');
     // try to pull rebase and push again
-    runSync('git', ['pull', 'origin', NEXT_SECURITY_RELEASE_BRANCH, '--rebase']);
-    runSync('git', ['push', '-u', 'origin', NEXT_SECURITY_RELEASE_BRANCH]);
+    await runSecurityGitCommand(
+      cli,
+      ['pull', 'origin', NEXT_SECURITY_RELEASE_BRANCH, '--rebase'],
+      `This rebases local changes on origin/${NEXT_SECURITY_RELEASE_BRANCH}.`
+    );
+    await runSecurityGitCommand(
+      cli,
+      ['push', '-u', 'origin', NEXT_SECURITY_RELEASE_BRANCH],
+      `This retries pushing the security release branch to origin/${NEXT_SECURITY_RELEASE_BRANCH}.`
+    );
   }
   cli.ok(`Pushed commit: ${commitMessage} to ${NEXT_SECURITY_RELEASE_BRANCH}`);
 }
@@ -130,6 +185,74 @@ export function formatDateToYYYYMMDD(date) {
   return `${year}/${month}/${day}`;
 }
 
+export function getHighestSeverityAnnouncement(reports, releaseLine = 'this release') {
+  const highestSeverityIndex = Math.max(...reports.map(
+    r => SEVERITY_RANKS.indexOf(r.severity.rating.toUpperCase())
+  ));
+
+  return `The highest severity issue fixed in ${releaseLine} is ${
+    SEVERITY_RANKS[highestSeverityIndex] ?? 'NONE'
+  }.`;
+}
+
+function normalizeReleaseLine(version) {
+  if (typeof version !== 'string') return;
+
+  const trimmed = version.trim();
+  let match = RELEASE_LINE_RE.exec(trimmed);
+  if (match) return `${match[1]}.x`;
+
+  match = SEMVER_RE.exec(trimmed);
+  if (match) return `${match[1]}.x`;
+}
+
+function uniqueReleaseLines(releaseLines) {
+  return [...new Set(releaseLines.filter(Boolean))];
+}
+
+export function getAffectedVersionLines(affectedVersions) {
+  if (!affectedVersions) return [];
+
+  if (typeof affectedVersions === 'string') {
+    return uniqueReleaseLines(affectedVersions.split(',').map(normalizeReleaseLine));
+  }
+
+  if (Array.isArray(affectedVersions)) {
+    return uniqueReleaseLines(affectedVersions.flatMap((version) => {
+      if (typeof version === 'string') {
+        return normalizeReleaseLine(version);
+      }
+
+      if (version && typeof version === 'object') {
+        return normalizeReleaseLine(version.version);
+      }
+
+      return [];
+    }));
+  }
+
+  if (typeof affectedVersions === 'object') {
+    const releaseLines = Object.keys(affectedVersions).map(normalizeReleaseLine);
+    if (releaseLines.some(Boolean)) {
+      return uniqueReleaseLines(releaseLines);
+    }
+
+    return uniqueReleaseLines(
+      Object.values(affectedVersions).flatMap(getAffectedVersionLines)
+    );
+  }
+
+  return [];
+}
+
+// `dependencies` maps a dependency name to its update, or to a list of updates
+// when the release lines got different ones. Flatten it into a list of updates
+// that each know their name.
+export function getDependencyUpdates(dependencies) {
+  return Object.entries(dependencies ?? {}).flatMap(([name, update]) =>
+    (Array.isArray(update) ? update : [update]).map((entry) => ({ ...entry, name })));
+}
+
 export function promptDependencies(cli) {
   return cli.prompt('Enter the link to the dependency update PR (leave empty to exit): ', {
     defaultAnswer: '',
@@ -138,6 +261,11 @@ export function promptDependencies(cli) {
 }
 
 export async function createIssue(title, content, repository, { cli, req }) {
+  await confirmSecurityStep(
+    cli,
+    `create GitHub issue \`${repository.owner}/${repository.repo}: ${title}\``,
+    `This creates an issue in ${repository.owner}/${repository.repo}.`
+  );
   const data = await req.createIssue(title, content, repository);
   if (data.html_url) {
     cli.ok(`Created: ${data.html_url}`);
@@ -183,7 +311,7 @@ export async function pickReport(report, { cli, req }) {
   });
 
   let prURL = '';
-  let patchAuthors = [];
+  let patchAuthors;
   if (custom_field_values.data.length) {
     prURL = custom_field_values.data[0].attributes.value;
     const { user } = await req.getPullRequest(prURL);
@@ -240,33 +368,45 @@ export class SecurityRelease {
       NEXT_SECURITY_RELEASE_FOLDER, 'vulnerabilities.json');
   }
 
-  updateReleaseFolder(releaseDate) {
+  async updateReleaseFolder(releaseDate) {
     const folder = path.join(process.cwd(),
       NEXT_SECURITY_RELEASE_FOLDER);
     const newFolder = path.join(process.cwd(), 'security-release', releaseDate);
+    await confirmSecurityStep(
+      this.cli,
+      `rename \`${folder}\` to \`${newFolder}\``,
+      'This moves the next-security-release folder to the dated release folder.'
+    );
     fs.renameSync(folder, newFolder);
     return newFolder;
   }
 
-  updateVulnerabilitiesJSON(content) {
+  async updateVulnerabilitiesJSON(content) {
     try {
       const vulnerabilitiesJSONPath = this.getVulnerabilitiesJSONPath();
       this.cli.startSpinner(`Updating vulnerabilities.json from ${vulnerabilitiesJSONPath}...`);
-      fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
-      commitAndPushVulnerabilitiesJSON(vulnerabilitiesJSONPath,
+      await writeSecurityFile(
+        this.cli,
+        vulnerabilitiesJSONPath,
+        JSON.stringify(content, null, 2),
+        'This updates vulnerabilities.json with the latest security release data.'
+      );
+      await commitAndPushVulnerabilitiesJSON(vulnerabilitiesJSONPath,
         'chore: updated vulnerabilities.json',
         { cli: this.cli, repository: this.repository });
       this.cli.stopSpinner(`Done updating vulnerabilities.json from ${vulnerabilitiesJSONPath}`);
+      return true;
     } catch (error) {
       this.cli.error('Error updating vulnerabilities.json');
       this.cli.error(error);
+      return false;
     }
   }
 
   getAffectedVersions(content) {
     const affectedVersions = new Set();
     for (const report of Object.values(content.reports)) {
-      for (const affectedVersion of report.affectedVersions) {
+      for (const affectedVersion of getAffectedVersionLines(report.affectedVersions)) {
         affectedVersions.add(affectedVersion);
       }
     }