@pnpm/resolving.git-resolver 1100.1.14 → 1100.1.16

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @pnpm/git-resolver
 
+## 1100.1.16
+
+### Patch Changes
+
+- Fixed a CI regression where `github:owner/repo` dependencies (and other shorthand Git specifiers) would fail to install with `Permission denied (publickey)` on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. `git+ssh://` or `git@host:...`):
+
+  - The repository visibility probe (an HTTP HEAD request) now retries transient failures such as `429 Too Many Requests`, so host throttling of CI runners is no longer mistaken for a private repository.
+  - For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
+  - When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
+  - A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. `codeload.github.com`, which would fail to download for a private repository); it stays a regular `git` resolution so installs can use ambient Git credentials such as credential helpers and tokens.
+
+  Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.
+
+  Fixes [pnpm/pnpm#13276](https://github.com/pnpm/pnpm/issues/13276).
+
+  <!-- cspell:ignore publickey -->
+
+- Resolving a private git repository no longer blocks on an interactive credential prompt: `git ls-remote` now fails fast with an authentication error when git has no credentials for the repository [#13522](https://github.com/pnpm/pnpm/issues/13522).
+
+## 1100.1.15
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.1
+  - @pnpm/network.fetch@1100.1.11
+  - @pnpm/resolving.resolver-base@1101.1.0
+
 ## 1100.1.14
 
 ### Patch Changes

package/lib/index.js

@@ -99,7 +99,6 @@ export async function getRepoRefs(repo, ref) {
         // This is needed because annotated tags have their own SHA, and we need the commit SHA they point to
         gitArgs.push(`${ref}^{}`);
     }
-    // graceful-git by default retries 10 times, reduce to single retry
     const result = await lsRemote(gitArgs, { retries: 1 });
     const refs = {};
     for (const line of result.stdout.split('\n')) {

package/lib/lsRemote.d.ts

@@ -2,6 +2,8 @@
  * Runs `git ls-remote` with interactive credential prompts disabled, so it
  * fails fast on private repos instead of blocking on user input. All
  * ls-remote invocations must go through this function to keep that guarantee.
+ *
+ * Failed runs are retried immediately, matching the Rust runner's policy.
  */
 export declare function lsRemote(args: string[], opts: {
     retries: number;

package/lib/lsRemote.js

@@ -1,15 +1,26 @@
-import { gracefulGit as git } from 'graceful-git';
+import { safeExeca as execa } from 'execa';
 /**
  * Runs `git ls-remote` with interactive credential prompts disabled, so it
  * fails fast on private repos instead of blocking on user input. All
  * ls-remote invocations must go through this function to keep that guarantee.
+ *
+ * Failed runs are retried immediately, matching the Rust runner's policy.
  */
 export async function lsRemote(args, opts) {
-    return git(['ls-remote', ...args], {
-        retries: opts.retries,
-        // Snapshotted per call so changes to auth/proxy env vars made by a
-        // long-lived host process are picked up.
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-    });
+    let lastErr;
+    for (let attempt = 0; attempt <= opts.retries; attempt++) {
+        try {
+            const { stdout } = await execa('git', ['ls-remote', ...args], {
+                // Snapshotted per call so changes to auth/proxy env vars made by a
+                // long-lived host process are picked up.
+                env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+            });
+            return { stdout: stdout };
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw lastErr;
 }
 //# sourceMappingURL=lsRemote.js.map

package/lib/parseBareSpecifier.js

@@ -49,53 +49,46 @@ function urlToFetchSpec(url) {
 }
 async function fromHostedGit(hosted, dispatcherOptions) {
     let fetchSpec = null;
-    // try git/https url before fallback to ssh url
-    const gitHttpsUrl = hosted.https({ noCommittish: true, noGitPlus: true });
-    if (gitHttpsUrl && await isRepoPublic(gitHttpsUrl, dispatcherOptions) && await accessRepository(gitHttpsUrl)) {
-        fetchSpec = gitHttpsUrl;
+    const httpsUrl = hosted.https({ noCommittish: true, noGitPlus: true });
+    const sshUrl = hosted.ssh({ noCommittish: true });
+    // SSH is probed before the HTTPS fallbacks (and used as the last-resort guess)
+    // only when the user explicitly wrote an SSH URL. For every other representation
+    // (`shortcut`, `https`, ...) an SSH remote was never asked for, and recording one
+    // in the lockfile breaks installs in environments without SSH keys, so every
+    // HTTPS transport is exhausted first.
+    const preferSsh = hosted.default === 'sshurl';
+    const repoIsPublic = httpsUrl != null && await isRepoPublic(httpsUrl, dispatcherOptions);
+    if (httpsUrl && repoIsPublic && await accessRepository(httpsUrl)) {
+        fetchSpec = httpsUrl;
     }
-    else {
-        const gitSshUrl = hosted.ssh({ noCommittish: true });
-        if (gitSshUrl && await accessRepository(gitSshUrl)) {
-            fetchSpec = gitSshUrl;
-        }
+    if (!fetchSpec && preferSsh && sshUrl && await accessRepository(sshUrl)) {
+        fetchSpec = sshUrl;
     }
-    if (!fetchSpec) {
-        const httpsUrl = hosted.https({ noGitPlus: true, noCommittish: true });
-        if (httpsUrl) {
-            if ((hosted.auth || !await isRepoPublic(httpsUrl, dispatcherOptions)) && await accessRepository(httpsUrl)) {
-                return {
-                    fetchSpec: httpsUrl,
-                    hosted: {
-                        ...hosted,
-                        _fill: hosted._fill,
-                        tarball: undefined,
-                    },
-                    normalizedBareSpecifier: `git+${httpsUrl}`,
-                    ...parseGitParams(hosted.committish),
-                };
-            }
-            else {
-                try {
-                    // when git ls-remote private repo, it asks for login credentials.
-                    // use HTTP HEAD request to test whether this is a private repo, to avoid login prompt.
-                    // this is very similar to yarn classic's behavior.
-                    // npm instead tries git ls-remote directly which prompts user for login credentials.
-                    // HTTP HEAD on https://domain/user/repo, strip out ".git"
-                    const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', redirect: 'manual', retry: { retries: 0 }, dispatcherOptions });
-                    if (response.ok) {
-                        fetchSpec = httpsUrl;
-                    }
-                }
-                catch {
-                    // ignore
-                }
-            }
+    if (!fetchSpec && httpsUrl) {
+        if ((hosted.auth || !repoIsPublic) && await accessRepository(httpsUrl)) {
+            // Reachable over HTTPS without being provably public, so resolve as
+            // `type: git` against this exact URL: the host's archive endpoint would
+            // carry neither the URL's credentials nor ambient ones (helpers, tokens).
+            return {
+                fetchSpec: httpsUrl,
+                hosted: {
+                    ...hosted,
+                    _fill: hosted._fill,
+                    tarball: undefined,
+                },
+                normalizedBareSpecifier: `git+${httpsUrl}`,
+                ...parseGitParams(hosted.committish),
+            };
+        }
+        if (repoIsPublic) {
+            fetchSpec = httpsUrl;
         }
     }
+    if (!fetchSpec && !preferSsh && sshUrl && await accessRepository(sshUrl)) {
+        fetchSpec = sshUrl;
+    }
     if (!fetchSpec) {
-        // use ssh url for likely private repo
-        fetchSpec = hosted.sshurl({ noCommittish: true });
+        fetchSpec = preferSsh ? hosted.sshurl({ noCommittish: true }) : httpsUrl;
     }
     return {
         fetchSpec: fetchSpec,
@@ -103,7 +96,10 @@ async function fromHostedGit(hosted, dispatcherOptions) {
             ...hosted,
             tarballtemplate: hosted.type === 'gitlab' ? gitlabTarballTemplate : hosted.tarballtemplate,
             _fill: hosted._fill,
-            tarball: hosted.tarball,
+            // Same rationale as the early return above: without proof that the repo
+            // is public, the host's anonymous archive endpoint cannot be assumed to
+            // work, so the resolution must stay `type: git`.
+            tarball: repoIsPublic ? hosted.tarball : undefined,
         },
         normalizedBareSpecifier: hosted.shortcut(),
         ...parseGitParams(hosted.committish),
@@ -116,9 +112,20 @@ function gitlabTarballTemplate({ domain, user, project, committish }) {
     const ref = committish ? encodeURIComponent(committish) : 'HEAD';
     return `https://${domain}/${user}/${project}/-/archive/${ref}/${project}-${ref}.tar.gz`;
 }
+// An HTTP HEAD on the project page (without ".git") instead of `git ls-remote`:
+// probing a private repo with ls-remote would trigger a credential prompt. This is
+// very similar to yarn classic's behavior; npm instead tries git ls-remote directly,
+// which prompts for login credentials. Transient failures (429/5xx/network errors)
+// are retried by the fetch layer so registry throttling of CI runners is not
+// mistaken for a private repository.
 async function isRepoPublic(httpsUrl, dispatcherOptions) {
     try {
-        const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', redirect: 'manual', retry: { retries: 0 }, dispatcherOptions });
+        const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), {
+            method: 'HEAD',
+            redirect: 'manual',
+            retry: { retries: 2, factor: 2, minTimeout: 500, maxTimeout: 2_000 },
+            dispatcherOptions,
+        });
         return response.ok;
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.git-resolver",
-  "version": "1100.1.14",
+  "version": "1100.1.16",
   "description": "Resolver for git-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,19 +29,19 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.0",
-    "@pnpm/network.fetch": "1100.1.10",
-    "@pnpm/resolving.resolver-base": "1101.0.0",
-    "graceful-git": "^5.0.0",
+    "@pnpm/error": "1100.1.1",
+    "@pnpm/network.fetch": "1100.1.11",
+    "@pnpm/resolving.resolver-base": "1101.1.0",
+    "execa": "npm:safe-execa@0.3.0",
     "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
     "semver": "^7.8.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.git-resolver": "1100.1.14",
+    "@pnpm/resolving.git-resolver": "1100.1.16",
     "@types/hosted-git-info": "^3.0.5",
     "@types/is-windows": "^1.0.2",
-    "@types/semver": "7.7.1",
+    "@types/semver": "7.8.0",
     "is-windows": "^1.0.2"
   },
   "engines": {