@payfit/nx-core 4.9.1-ephemeral.2 → 4.9.1-ephemeral.3

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@payfit/nx-core",
-  "version": "4.9.1-ephemeral.2",
+  "version": "4.9.1-ephemeral.3",
   "type": "commonjs",
-  "main": "dist/src/index.js",
-  "types": "dist/src/index.d.ts",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
   "dependencies": {
     "@nx/devkit": "21.0.1",
     "get-port": "^7.1.0",
@@ -17,7 +17,7 @@
   },
   "executors": "./executors.json",
   "files": [
-    "dist",
+    "src/**/*",
     "!**/*.tsbuildinfo",
     "generators.json",
     "executors.json"

package/src/executors/publisher/docker.ts

@@ -0,0 +1,34 @@
+import * as fs from 'node:fs'
+import { join } from 'path'
+
+import { ExecutorContext } from '@nx/devkit'
+
+import { checkAwsAuth, loginToEcr, pushImageToEcr } from '../../utils/aws-auth'
+import { buildDockerImage } from '../../utils/docker'
+import { PublisherExecutorOptions } from './schema'
+
+export async function publishDocker(
+  options: PublisherExecutorOptions,
+  context: ExecutorContext,
+  version: string,
+): Promise<{
+  success: boolean
+}> {
+  await checkAwsAuth()
+  await loginToEcr()
+
+  const projectRoot =
+    context.projectsConfigurations.projects[context.projectName].root
+  const projectDockerfile = join(projectRoot, 'Dockerfile')
+
+  if (!fs.existsSync(projectDockerfile)) {
+    throw new Error('Dockerfile not found in project root')
+  }
+  console.log('Building docker image with version ' + version)
+  await buildDockerImage(options.ecrRegistry, projectDockerfile, version)
+
+  console.log(
+    `Publishing docker image to ${options.ecrRegistry} with version ${version}`,
+  )
+  return await pushImageToEcr(options.ecrRegistry, version)
+}

package/src/executors/publisher/executor.ts

@@ -0,0 +1,30 @@
+import { ExecutorContext } from '@nx/devkit'
+
+import { getVersion } from '../../utils/get-version'
+import { publishDocker } from './docker'
+import { publishHelm } from './helm'
+import { PublisherExecutorOptions, PublisherExecutorSchema } from './schema'
+
+const runExecutor: (
+  options: PublisherExecutorOptions,
+  context: ExecutorContext,
+) => Promise<PublisherExecutorSchema> = async (
+  options: PublisherExecutorOptions,
+  context: ExecutorContext,
+) => {
+  try {
+    const version = getVersion(context.projectName)
+    await publishDocker(options, context, version)
+    await publishHelm(options, context, version)
+  } catch (error) {
+    console.error(error)
+    return {
+      success: false,
+    }
+  }
+  return {
+    success: true,
+  }
+}
+
+export default runExecutor

package/src/executors/publisher/helm.ts

@@ -0,0 +1,55 @@
+import * as fs from 'node:fs'
+
+import { ExecutorContext } from '@nx/devkit'
+
+import { checkAwsAuth } from '../../utils/aws-auth'
+import { getSanitizedCurrentGitBranch } from '../../utils/github'
+import {
+  installHelmRepo,
+  packageHelm,
+  pushPackagedHelm,
+  resetTeleportProxyHelmChartFile,
+  setupTeleportProxyHelmChartFile,
+} from '../../utils/helm'
+import { getLocalPortForChartMuseum } from '../../utils/tsh'
+import { PublisherExecutorOptions } from './schema'
+
+export async function publishHelm(
+  options: PublisherExecutorOptions,
+  context: ExecutorContext,
+  version: string,
+): Promise<{
+  success: boolean
+  stdout: any
+  stderr: any
+}> {
+  const projectHelmFolder = `apps/${context.projectName}/.deploy`
+  const destinationHelmFolder = `dist/apps/${context.projectName}/chart/`
+  const gitBranchName = await getSanitizedCurrentGitBranch()
+
+  if (!gitBranchName) throw new Error('Unable to get current Git branch')
+
+  await checkAwsAuth()
+
+  if (!fs.existsSync(projectHelmFolder)) {
+    throw new Error(
+      `.deploy folder not found for project ${context.projectName}`,
+    )
+  }
+  console.log(
+    `Publishing Helm chart to ${options.chartRegistry}/${gitBranchName} with version ${version}`,
+  )
+  // connect to the chartmuseum through teleport
+  using proxyData = await getLocalPortForChartMuseum()
+  await proxyData.isReady()
+
+  await setupTeleportProxyHelmChartFile(projectHelmFolder, proxyData.port)
+  await installHelmRepo(projectHelmFolder)
+  await packageHelm(projectHelmFolder, version, destinationHelmFolder)
+  await resetTeleportProxyHelmChartFile(projectHelmFolder, proxyData.port)
+  return pushPackagedHelm(
+    `${destinationHelmFolder}${context.projectName}-${version}.tgz`,
+    options.chartRegistry,
+    gitBranchName,
+  )
+}

package/src/executors/publisher/schema.d.ts

@@ -0,0 +1,5 @@
+export interface PublisherExecutorSchema {} // eslint-disable-line
+export interface PublisherExecutorOptions {
+  chartRegistry: string
+  ecrRegistry: string
+}

package/src/executors/publisher/schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Publisher executor",
+  "description": "Publish the helm chart to the chartmuseum and docker image to ECR",
+  "type": "object",
+  "properties": {
+    "chartRegistry": {
+      "type": "string",
+      "description": "The helm chart registry"
+    },
+    "ecrRegistry": {
+      "type": "string",
+      "description": "The docker registry"
+    }
+  },
+  "required": []
+}

package/src/index.ts

@@ -0,0 +1,77 @@
+import { existsSync } from 'fs'
+import { dirname, join } from 'path'
+
+import {
+  CreateNodesContextV2,
+  createNodesFromFiles,
+  CreateNodesV2,
+  readJsonFile,
+} from '@nx/devkit'
+
+// eslint-disable-next-line @typescript-eslint/no-empty-interface, @typescript-eslint/no-empty-object-type
+export interface MyPluginOptions {}
+
+export const createNodesV2: CreateNodesV2<MyPluginOptions> = [
+  '**/project.json',
+  async (configFiles, options, context) => {
+    return await createNodesFromFiles(
+      (configFile, options, context) =>
+        createNodesInternal(configFile, options, context),
+      configFiles,
+      options,
+      context,
+    )
+  },
+]
+
+async function createNodesInternal(
+  configFilePath: string,
+  options: MyPluginOptions,
+  context: CreateNodesContextV2,
+) {
+  const projectConfiguration = readJsonFile(configFilePath)
+  const projectRoot = dirname(configFilePath)
+
+  const isDockerProject = existsSync(join(projectRoot, 'Dockerfile'))
+  const isHelmProject = existsSync(join(projectRoot, '.deploy/Chart.yaml'))
+
+  const targets = {}
+
+  const ecrRegistry = isDockerProject
+    ? projectConfiguration.metadata &&
+      projectConfiguration.metadata['ecrRepository']
+    : undefined
+  const chartRegistry = isHelmProject
+    ? projectConfiguration.metadata &&
+      projectConfiguration.metadata['chartRegistry']
+    : undefined
+
+  if (isHelmProject || isDockerProject) {
+    const publisherConfig = readJsonFile(
+      join(__dirname, '/executors/publisher/schema.json'),
+    )
+    targets['nx-release-publish'] = {
+      executor: '@payfit/nx-core:publisher',
+      options: {
+        ecrRegistry,
+        chartRegistry,
+      },
+      cache: true,
+      inputs: ['production', '^production'],
+      outputs: [`{workspaceRoot}/dist/apps/${projectConfiguration.name}/chart`],
+      metadata: {
+        technologies: ['helm', 'docker'],
+        description: publisherConfig.description,
+      },
+    }
+  }
+
+  return {
+    projects: {
+      [projectRoot]: {
+        ...projectConfiguration,
+        targets,
+      },
+    },
+  }
+}

package/src/scripts/version-action.ts

@@ -0,0 +1,89 @@
+import { ProjectGraph, Tree } from '@nx/devkit'
+import { VersionActions } from 'nx/release'
+import { NxReleaseVersionConfiguration } from 'nx/src/config/nx-json'
+import { inc } from 'semver'
+
+export default class customVersionAction extends VersionActions {
+  validManifestFilenames: string[]
+  async readCurrentVersionFromSourceManifest(
+    tree: Tree,
+  ): Promise<{ currentVersion: string; manifestPath: string } | null> {
+    return {
+      currentVersion: '0.0.0',
+      manifestPath: 'apps/my-nest-app/project.json',
+    }
+  }
+  async readCurrentVersionFromRegistry(
+    tree: Tree,
+    currentVersionResolverMetadata: NxReleaseVersionConfiguration['currentVersionResolverMetadata'],
+  ): Promise<{ currentVersion: string | null; logText: string } | null> {
+    return {
+      currentVersion: '0.0.0',
+      logText: 'Current version from registry',
+    }
+  }
+  async readCurrentVersionOfDependency(
+    tree: Tree,
+    projectGraph: ProjectGraph,
+    dependencyProjectName: string,
+  ): Promise<{
+    currentVersion: string | null
+    dependencyCollection: string | null
+  }> {
+    return {
+      currentVersion: '0.0.0',
+      dependencyCollection: '0.0.0',
+    }
+  }
+  async isLocalDependencyProtocol(versionSpecifier: string): Promise<boolean> {
+    return false
+  }
+  async updateProjectVersion(
+    tree: Tree,
+    newVersion: string,
+  ): Promise<string[]> {
+    // Update the version in the VERSION file
+    const currentProject = this.projectGraphNode.name
+    const versionFilePath = `dist/apps/${currentProject}/VERSION`
+    tree.write(versionFilePath, newVersion)
+    return []
+  }
+  async updateProjectDependencies(
+    tree: Tree,
+    projectGraph: ProjectGraph,
+    dependenciesToUpdate: Record<string, string>,
+  ): Promise<string[]> {
+    return []
+  }
+  async calculateNewVersion(
+    currentVersion: string | null,
+    newVersionInput: string,
+    newVersionInputReason: string,
+    newVersionInputReasonData: Record<string, unknown>,
+    preid: string,
+  ): Promise<{
+    newVersion: string
+    logText: string
+  }> {
+    function formatDate() {
+      const date = new Date()
+      const year = date.getFullYear()
+      const month = String(date.getMonth() + 1).padStart(2, '0') // getMonth() returns 0-11
+      const day = date.getDate()
+
+      return `${year}${month}.${day}.`
+    }
+
+    function getNewVersionFromCurrentVersion(currentVersion: string) {
+      const expectedPattern = formatDate()
+      return !currentVersion.startsWith(expectedPattern)
+        ? `${expectedPattern}0`
+        : inc(currentVersion, 'patch')
+    }
+
+    return {
+      newVersion: getNewVersionFromCurrentVersion(currentVersion),
+      logText: `New version: ${getNewVersionFromCurrentVersion(currentVersion)}`,
+    }
+  }
+}

package/src/utils/aws-auth.ts

@@ -0,0 +1,100 @@
+import { getDockerOrPodman } from './docker'
+import { exec_command } from './exec'
+
+let profileName = 'OIDC-PROFILE'
+
+/**
+ * Return the AWS profile name to use in AWS cli commands
+ */
+export function getProfileName() {
+  return profileName
+}
+
+/**
+ * Retrieves the AWS credentials from environment variables.
+ * Ensures that `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_DEFAULT_REGION` are properly set.
+ * Throws an error if credentials or region are missing.
+ *
+ * @return {Object} An object containing AWS credentials.
+ * @return {string} return.accessKeyId The AWS Access Key ID.
+ * @return {string} return.secretAccessKey The AWS Secret Access Key.
+ * @return {string} return.region The AWS Region.
+ */
+export function getAwsCredentialsSet(): {
+  accessKeyId: string
+  secretAccessKey: string
+  region: string
+} {
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY
+  const region = process.env.AWS_DEFAULT_REGION
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error(
+      'AWS credentials not found, please set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables (or attach GLOBAL_ORG context if you are using CircleCI)',
+    )
+  }
+  if (!region) {
+    throw new Error(
+      'AWS region not found, please set AWS_DEFAULT_REGION environment variable (or attach GLOBAL_ORG context if you are using CircleCI)',
+    )
+  }
+  return { accessKeyId, secretAccessKey, region }
+}
+
+/**
+ * Retrieves the authentication information for a given OIDC profile.
+ * If the specified profile exists, it fetches the configuration; otherwise, it returns false.
+ *
+ * @return {Promise<string | boolean>} The authentication details if the profile exists, or false if the profile does not exist.
+ */
+export async function getAuthWithOidcProfile(): Promise<string | boolean> {
+  try {
+    const profileExist = await exec_command(
+      `aws configure list-profiles | grep ${profileName}`,
+    )
+    if (profileExist.success) {
+      return profileExist.stdout
+    }
+    return false
+  } catch (e) {
+    console.error(e)
+    return false
+  }
+}
+
+export async function loginToEcr() {
+  return exec_command(
+    `aws ecr get-login-password --profile ${profileName} --region eu-west-3 | ${await getDockerOrPodman()} login --username AWS --password-stdin ${process.env.AWS_ECR_REGISTRY}`,
+  )
+}
+
+/**
+ * Check AWS CLI with the OIDC profile otherwise use the default credentials
+ * @returns {string} the profile's name
+ */
+export async function checkAwsAuth(): Promise<string> {
+  const profileExist = await getAuthWithOidcProfile()
+  if (profileExist) {
+    console.log('OIDC profile found, using it')
+    profileName = 'OIDC-PROFILE'
+  } else if (getAwsCredentialsSet()) {
+    console.log(
+      'OIDC profile not found, using AWS_KEY_ID and AWS_SECRET_ACCESS_KEY',
+    )
+    profileName = 'default'
+  } else {
+    throw new Error(
+      'AWS credentials not found, please attach CORE-PLATFORM_SHARED_ENV context if you are using CircleCI or export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables',
+    )
+  }
+  return profileName
+}
+
+export function pushImageToEcr(
+  repositoryName: string,
+  version: string,
+): Promise<{ success: boolean }> {
+  return exec_command(
+    `docker push ${process.env.AWS_ECR_REGISTRY}/${repositoryName}:${version}`,
+  )
+}

package/src/utils/docker.ts

@@ -0,0 +1,35 @@
+import { exec_command } from './exec'
+
+/**
+ * Determines the available container management tool by checking for Docker and fallback to Podman if Docker is unavailable.
+ *
+ * @return {Promise<string>} A promise that resolves to the string 'docker' if Docker is available, or 'podman' if Podman is used as a fallback.
+ */
+export async function getDockerOrPodman(): Promise<string> {
+  try {
+    await exec_command('docker --version')
+    return 'docker'
+  } catch (e) {
+    console.log('docker not found, trying podman')
+    return 'podman'
+  }
+}
+
+/**
+ * Builds a Docker image using the provided Dockerfile.
+ *
+ * @param imageName The name of the image to build.
+ * @param dockerfilePath The path to the Dockerfile.
+ * @param version The version of the image to build.
+ * @return {Promise<{success: boolean, stdout: string, stderr: string}>} A promise that resolves to an object containing the success status, stdout, and stderr of the command.
+ */
+export async function buildDockerImage(
+  imageName: string,
+  dockerfilePath: string,
+  version: string,
+): Promise<{ success: boolean; stdout: string; stderr: string }> {
+  const dockerOrPodman = await getDockerOrPodman()
+  return exec_command(
+    `${dockerOrPodman} buildx build -t ${process.env.AWS_ECR_REGISTRY}/${imageName}:${version} -f ${dockerfilePath} --secret id=NPM_TOKEN  .`,
+  )
+}

package/src/utils/exec.spec.ts

@@ -0,0 +1,16 @@
+import { exec_command } from './exec'
+
+describe('exec', () => {
+  it('can run', async () => {
+    const output = await exec_command('echo "Hello World"')
+    expect(output.success).toBe(true)
+    expect(output.stdout).toBe('Hello World\n')
+  })
+
+  it('can run with stderr', async () => {
+    const output = await exec_command('echo "Hello World" 1>&2')
+    expect(output.success).toBe(false)
+    expect(output.stdout).toBe('')
+    expect(output.stderr).toBe('Hello World\n')
+  })
+})

package/src/utils/exec.ts

@@ -0,0 +1,31 @@
+import { exec } from 'child_process'
+import { promisify } from 'util'
+
+import type { Options, TinyExec } from 'tinyexec'
+
+import { x } from 'tinyexec'
+
+export async function exec_command(command: string) {
+  const { stdout, stderr } = await promisify(exec)(command)
+  console.log(stdout)
+  console.error(stderr)
+
+  const success = !stderr
+  return { success, stdout, stderr }
+}
+
+function createLoggingExecWrapper(execFn: TinyExec): TinyExec {
+  return (
+    command: string,
+    args: string[] = [],
+    options: Partial<Options> = {},
+  ) => {
+    console.log(`Running '${command} ${args.join(' ')}'...`)
+    return execFn(command, args, {
+      throwOnError: true,
+      ...options,
+    })
+  }
+}
+
+export const execTiny = createLoggingExecWrapper(x)

package/src/utils/get-version.ts

@@ -0,0 +1,11 @@
+import * as fs from 'node:fs'
+
+/**
+ * Get the version of a project
+ * @param projectName
+ * @returns {string}
+ */
+export function getVersion(projectName: string): string {
+  const versionFilePath = `dist/apps/${projectName}/VERSION`
+  return fs.readFileSync(versionFilePath, 'utf8')
+}

package/src/utils/github.ts

@@ -0,0 +1,14 @@
+import { exec_command } from './exec'
+
+/**
+ * Get sanitized current git branch name
+ */
+export async function getSanitizedCurrentGitBranch() {
+  const branchName = await exec_command(`git branch --show-current`)
+  return branchName.success
+    ? branchName.stdout
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, '')
+    : ''
+}

package/src/utils/helm.ts

@@ -0,0 +1,125 @@
+import * as fs from 'node:fs'
+import * as process from 'node:process'
+
+import { parse, stringify } from 'yaml'
+
+import { getProfileName } from './aws-auth'
+import { exec_command } from './exec'
+
+const tshProxy = 'http://localhost'
+
+/**
+ * Read & parse the Helm chart.yaml file
+ * @param helmFolderPath
+ */
+export async function getHelmChartFile(helmFolderPath: string) {
+  return parse(fs.readFileSync(`${helmFolderPath}/Chart.yaml`, 'utf8'))
+}
+
+/**
+ * Prepare the Chart.yaml config file for the Tsh proxy
+ * @param helmFolderPath
+ * @param tshPort
+ */
+export async function setupTeleportProxyHelmChartFile(
+  helmFolderPath: string,
+  tshPort: number,
+) {
+  console.log(
+    `Replacing charts.shared.payfit.tech -> localhost:${tshPort} for the Teleport proxy`,
+  )
+  let chartConfigStr = stringify(await getHelmChartFile(helmFolderPath))
+  chartConfigStr = chartConfigStr.replace(
+    /(https?:\/\/)charts(\.shared)?\.payfit\.tech/gi,
+    `${tshProxy}:${tshPort}`,
+  )
+  return fs.writeFileSync(`${helmFolderPath}/Chart.yaml`, chartConfigStr)
+}
+
+/**
+ * Revert the Tsh proxy config in the Chart.yaml config file
+ * @param helmFolderPath
+ * @param tshPort
+ */
+export async function resetTeleportProxyHelmChartFile(
+  helmFolderPath: string,
+  tshPort: number,
+) {
+  let chartConfigStr = stringify(await getHelmChartFile(helmFolderPath))
+  chartConfigStr = chartConfigStr.replace(
+    `${tshProxy}:${tshPort}`,
+    'https://charts.shared.payfit.tech',
+  )
+  return fs.writeFileSync(`${helmFolderPath}/Chart.yaml`, chartConfigStr)
+}
+
+/**
+ * Install all the helm repositories defined in the Chart config
+ * @param helmFolderPath
+ */
+export async function installHelmRepo(helmFolderPath: string) {
+  const chartConfig = await getHelmChartFile(helmFolderPath)
+  if (chartConfig.dependencies) {
+    for (let i = 0; i < chartConfig.dependencies.length; i++) {
+      const dep = chartConfig.dependencies[i]
+      const repoName = `tsh-${dep.name}-${dep.alias}`
+      // check if the repository is our private payfit repo or a public one
+      if (dep.repository.includes(tshProxy)) {
+        // if  it's our repo, we need the username and password to authenticate
+        if (
+          !process.env.CHARTMUSEUM_USERNAME ||
+          !process.env.CHARTMUSEUM_PASSWORD
+        )
+          throw new Error(
+            'Missing CHARTMUSEUM_USERNAME, CHARTMUSEUM_PASSWORD in environment!',
+          )
+        await exec_command(
+          `helm repo add --username '${process.env.CHARTMUSEUM_USERNAME}' --password '${process.env.CHARTMUSEUM_PASSWORD}' '${repoName}' '${dep.repository}' --force-update`,
+        )
+      } else {
+        await exec_command(
+          `helm repo add '${repoName}' '${dep.repository}' --force-update`,
+        )
+      }
+      await exec_command(`helm repo update ${repoName}`)
+    }
+  }
+  return exec_command(`helm dependency update ${helmFolderPath}`)
+}
+
+/**
+ * Package the Helm chart
+ * @param helmFolderPath
+ * @param version
+ * @param destinationPath
+ */
+export async function packageHelm(
+  helmFolderPath: string,
+  version: string,
+  destinationPath: string,
+) {
+  return exec_command(
+    `helm package ${helmFolderPath} --version ${version} --destination ${destinationPath}`,
+  )
+}
+
+/**
+ * Push the packaged Helm chart in the chartmuseum
+ * @param packagedHelmChartFilePath
+ * @param projectName
+ * @param branch
+ */
+export async function pushPackagedHelm(
+  packagedHelmChartFilePath: string,
+  projectName: string,
+  branch: string,
+) {
+  if (!process.env.CHARTMUSEUM_BUCKET_NAME)
+    throw new Error('Missing CHARTMUSEUM_BUCKET_NAME in environment!')
+  // aws s3api put-object-tagging --bucket ${process.env.CHARTMUSEUM_BUCKET_NAME} --key ${projectName}/${branch}/${packagedHelmChartFilePath} --tagging '{"TagSet": [{ "Key": "auto-purge", "Value": "false" }]}' // todo
+  const profile =
+    getProfileName() === 'default' ? '' : `--profile ${getProfileName()}`
+  return exec_command(
+    `aws s3 cp ${profile} --sse AES256 ${packagedHelmChartFilePath} s3://${process.env.CHARTMUSEUM_BUCKET_NAME}/${projectName}/${branch}/`,
+  )
+}

package/src/utils/import-esm.ts

@@ -0,0 +1,10 @@
+// Needed since we have to have dynamic import to esm module, since we are stuck with cjs on the nx tool runner
+export function importKy(): Promise<typeof import('ky')> {
+  return Function('return import("ky")')() as Promise<typeof import('ky')>
+}
+
+export function importGetPort(): Promise<typeof import('get-port')> {
+  return Function('return import("get-port")')() as Promise<
+    typeof import('get-port')
+  >
+}

package/src/utils/tsh.ts

@@ -0,0 +1,127 @@
+import { workspaceRoot } from 'nx/src/utils/workspace-root'
+import { z } from 'zod'
+
+import { execTiny } from './exec'
+import { importGetPort, importKy } from './import-esm'
+
+const expectedProfileUrl = 'https://payfit.teleport.sh:443'
+const expectedAppName = 'charts-shared'
+
+const profile = z.object({
+  profile_url: z.string(),
+})
+
+const statusSchema = z.object({
+  active: profile,
+  profiles: z.array(profile).optional(),
+})
+
+const getStatusOfTsh = async () => {
+  const { stdout } = await execTiny('tsh', `status -f json`.split(' '))
+  return statusSchema.parse(JSON.parse(stdout))
+}
+
+export async function isLoggedInToTsh(): Promise<boolean> {
+  try {
+    const status = await getStatusOfTsh()
+    return status.active.profile_url === expectedProfileUrl
+  } catch {
+    return false
+  }
+}
+
+export async function ensureIsLoggedInToTsh(): Promise<boolean> {
+  if (await isLoggedInToTsh()) {
+    return true
+  }
+  await execTiny(
+    'tsh',
+    `login --proxy=${expectedProfileUrl} --auth=okta`.split(' '),
+    {
+      throwOnError: true,
+    },
+  )
+  return await isLoggedInToTsh()
+}
+
+const getAppConfigOfTsh = async () => {
+  const { stdout } = await execTiny(
+    'tsh',
+    `apps config -f json --proxy=${expectedProfileUrl} ${expectedAppName}`.split(
+      ' ',
+    ),
+    {
+      throwOnError: true,
+    },
+  )
+
+  return JSON.parse(stdout)
+}
+
+export async function isConnectedToChartMuseum(): Promise<boolean> {
+  try {
+    const apps = await getAppConfigOfTsh()
+    return apps.name === expectedAppName
+  } catch {
+    return false
+  }
+}
+
+export async function ensureAppIsChartMuseum(): Promise<boolean> {
+  if (await isConnectedToChartMuseum()) {
+    return true
+  }
+  await execTiny(
+    'tsh',
+    `apps login ${expectedAppName} --proxy=${expectedProfileUrl}`.split(' '),
+    {
+      throwOnError: true,
+    },
+  )
+  return await isConnectedToChartMuseum()
+}
+
+export const getLocalPortForChartMuseum = async () => {
+  if (!process.env.CI) {
+    await ensureIsLoggedInToTsh()
+    await ensureAppIsChartMuseum()
+  }
+
+  const { default: getPort } = await importGetPort()
+  const { default: ky } = await importKy()
+  const port = await getPort()
+
+  const command = process.env.CI
+    ? `-i ./certs/identity --proxy payfit.teleport.sh:443 proxy app ${expectedAppName} --port ${port}`
+    : `proxy app ${expectedAppName} -p ${port}`
+  const execHandle = execTiny('tsh', command.split(' '), {
+    nodeOptions: {
+      cwd: workspaceRoot,
+    },
+  })
+
+  const isReady = async (): Promise<boolean> => {
+    for await (const line of execHandle) {
+      console.log(`[TSH] ${line}`)
+      if (line.includes('Proxying connections')) {
+        return true
+      }
+    }
+    // line will be from stderr/stdout in the order you'd see it in a term
+    return false
+  }
+
+  const fetchClient = ky.create({
+    prefixUrl: `http://localhost:${port}`,
+  })
+
+  return {
+    [Symbol.dispose]: async () => {
+      console.log(`Terminating tsh proxy on port ${port}`)
+      execHandle.kill()
+    },
+    fetchClient,
+    isReady,
+    port,
+  }
+}