@ogcio/o11y-validator 0.2.1 → 0.2.3

package/lib/rules.mjs

@@ -7,15 +7,18 @@
 // NOTE: if the rules directory is relocated in a future release, update
 // RULES_SUBPATH to match.
 
+import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+let cachedToken;
 
 export const pkg = JSON.parse(readFileSync(join(pkgRoot, "package.json"), "utf8"));
 export const RULES_SUBPATH = "o11y-validator/rules";
-export const RULES_REF = `${pkg.name}@${pkg.version}`;
+// release-please tags as "<name>@v<version>".
+export const RULES_REF = `${pkg.name}@v${pkg.version}`;
 
 export function rulesCacheDir() {
   // Cache inside the installed package, alongside the binary, scoped to the version.
@@ -39,10 +42,51 @@ function ghRepo() {
   return `${match[1]}/${match[2]}`;
 }
 
+function tokenFromGhCli() {
+  try {
+    return execFileSync("gh", ["auth", "token"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8",
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+
+function tokenFromGitCredential() {
+  try {
+    // Ask git's configured credential helper github.com credential.
+    // GIT_TERMINAL_PROMPT=0 makes it fail instead of prompting interactively when nothing is stored.
+    const out = execFileSync("git", ["credential", "fill"], {
+      input: "protocol=https\nhost=github.com\n\n",
+      stdio: ["pipe", "pipe", "ignore"],
+      encoding: "utf8",
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+    });
+    return out.match(/^password=(.+)$/m)?.[1].trim() || "";
+  } catch {
+    return "";
+  }
+}
+
+function resolveToken() {
+  if (cachedToken !== undefined) return cachedToken;
+  // Prefer explicit env tokens, then fall back to the user's existing GitHub
+  // auth (gh CLI, then git credential helper) so the package works as a drop-in
+  // without requiring a token at invocation time.
+  cachedToken =
+    process.env.GITHUB_TOKEN ||
+    process.env.GH_TOKEN ||
+    process.env.NODE_AUTH_TOKEN ||
+    tokenFromGhCli() ||
+    tokenFromGitCredential() ||
+    "";
+  return cachedToken;
+}
+
 function ghHeaders(accept = "application/vnd.github+json") {
   const headers = { "user-agent": "o11y-validator-cli", accept };
-  // GITHUB_TOKEN required for private repos.
-  const token = process.env.GITHUB_TOKEN || process.env.NODE_AUTH_TOKEN;
+  const token = resolveToken();
   if (token) headers.authorization = `Bearer ${token}`;
   return headers;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogcio/o11y-validator",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Telemetry rules validator for OGCIO services — wraps the Go binary for npx execution",
   "type": "module",
   "repository": {