@rtorcato/repo-tooling 4.3.1 → 4.4.0

package/dist/base/checks.js

@@ -100,7 +100,7 @@ export async function checkCommunityHealth(dir) {
         hint: 'Run `npx @rtorcato/repo-tooling fix community-health` to scaffold them',
     };
 }
-const BRAND_HINT = 'Run `npx @rtorcato/repo-tooling fix brand` to scaffold brand/ (SVG sources + render.sh), then run `brand/render.sh`';
+const BRAND_HINT = 'Run `npx @rtorcato/repo-tooling fix brand` to scaffold brand/ (SVG sources + render.sh) and render the PNGs (needs librsvg)';
 /** The two banners the README consumes — the pair `brand/` exists to keep regenerable. */
 const BANNERS = ['banner', 'banner-mobile'];
 /**

package/dist/base/fixers.js

@@ -15,7 +15,7 @@ import path from 'node:path';
 import chalk from 'chalk';
 import fs from 'fs-extra';
 import { installAgentRules, installAiSetup } from '../cli/generators/agent-rules.js';
-import { generateBrand } from '../cli/generators/brand.js';
+import { addReadmeBanner, generateBrand, renderBrand, resolveBrandMeta, } from '../cli/generators/brand.js';
 import { generateCommunityHealth } from '../cli/generators/community-health.js';
 import { generateCommitlintConfig } from '../cli/generators/git.js';
 import { generateCodeowners, generateEditorConfig } from '../cli/generators/misc.js';
@@ -164,12 +164,13 @@ export const BASE_FIXERS = [
     },
     {
         target: 'github-settings',
-        description: 'Apply branch protection + auto-merge + workflow permissions + code-scanning ruleset on GitHub via gh api (mutates the remote repo, not files)',
+        description: 'Apply branch protection + auto-merge + workflow permissions + Dependabot security updates + code-scanning ruleset on GitHub via gh api (mutates the remote repo, not files)',
         appliesTo: [
             'Branch protection',
             'Merge settings',
             'Workflow permissions',
             'Code-scanning gate',
+            'Security updates',
         ],
         outputs: ['GitHub repo settings (remote, via gh api)'],
         // safe-add is load-bearing: it exempts this fixer from the `--diff` shadow-run
@@ -249,24 +250,34 @@ export const BASE_FIXERS = [
     {
         target: 'brand',
         selfSafe: true,
-        description: 'Scaffold brand/ — banner, mobile-banner and social-card SVG sources + render.sh, and repoint a README still on root-level banner paths',
+        description: 'Scaffold brand/ — favicon, banner, mobile-banner and social-card SVG sources + render.sh — render the PNGs and favicon.ico when rsvg-convert is on PATH, and add the README banner',
         appliesTo: ['Brand assets'],
         outputs: [
+            'brand/favicon.svg',
             'brand/banner.svg',
             'brand/banner-mobile.svg',
             'brand/social-card.svg',
             'brand/render.sh',
+            'brand/banner.png',
+            'brand/banner-mobile.png',
+            'brand/social-card.png',
+            'brand/favicon-512.png',
+            'brand/favicon.ico',
             'README.md',
         ],
-        // Every SVG is written only when absent and the README edit rewrites two
-        // image paths — hand-edited art is never clobbered.
+        // Every SVG is written only when absent, PNGs are re-rendered only when
+        // older than their source, and the README edit is a delimited block (or
+        // two image paths) — hand-edited art is never clobbered.
         riskLevel: 'safe-merge',
         canFixDrift: true,
         async run({ targetDir, pkg, lock }) {
-            const filesWritten = await generateBrand(pkg, targetDir, lock?.rules?.brand?.tagline);
-            if (filesWritten.some((f) => f.endsWith('.svg'))) {
-                console.error(chalk.dim('   next: run `brand/render.sh` to render the PNGs (needs librsvg — `brew install librsvg`)'));
-            }
+            const tagline = lock?.rules?.brand?.tagline;
+            const filesWritten = await generateBrand(pkg, targetDir, tagline);
+            filesWritten.push(...((await renderBrand(targetDir)) ?? []));
+            const { name } = await resolveBrandMeta(pkg, targetDir, tagline);
+            const readme = await addReadmeBanner(targetDir, name);
+            if (readme && !filesWritten.includes(readme))
+                filesWritten.push(readme);
             return { filesWritten };
         },
     },

package/dist/base/github-settings.js

@@ -54,10 +54,12 @@ export const GITHUB_STANDARD = {
 const CODE_SCANNING_CHECK = 'Code-scanning gate';
 export const RELEASE_GATE_CHECK = 'Release gate';
 export const RELEASE_ENV_CHECK = 'Release environment';
+const SECURITY_UPDATES_CHECK = 'Security updates';
 const CHECK_NAMES = [
     'Branch protection',
     'Merge settings',
     'Workflow permissions',
+    SECURITY_UPDATES_CHECK,
     CODE_SCANNING_CHECK,
     RELEASE_GATE_CHECK,
     RELEASE_ENV_CHECK,
@@ -147,6 +149,7 @@ export async function checkGitHubSettings(dir, exec) {
         await checkBranchProtection(gh, info.nwo, info.branch),
         checkMergeSettings(info),
         await checkWorkflowPermissions(gh, info.nwo),
+        await checkSecurityUpdates(gh, info.nwo),
         await checkCodeScanningRuleset(gh, info.nwo, info.branch, dir),
         ...(await checkReleaseGate(gh, info.nwo, dir)),
     ];
@@ -277,6 +280,60 @@ async function checkWorkflowPermissions(exec, nwo) {
         };
     return { check, status: 'ok', detail: 'read-only default, no workflow PR approvals' };
 }
+/**
+ * Dependabot vulnerability alerts and automated security fixes (#692). A
+ * `dependabot.yml` only schedules version bumps; these two repo toggles are what
+ * surface and patch advisories, and both default off on a new repo. Neither
+ * endpoint has a body worth reading for alerts: 204 is on, 404 is off.
+ */
+async function readSecurityUpdates(exec, nwo) {
+    const enabled = async (endpoint) => {
+        const r = await exec(['api', `repos/${nwo}/${endpoint}`]);
+        if (!r.ok) {
+            if (/404|not found/i.test(r.stderr))
+                return false;
+            if (/403|forbidden/i.test(r.stderr))
+                return { skip: 'token lacks admin access' };
+            return { skip: `could not read ${endpoint}` };
+        }
+        if (endpoint === 'vulnerability-alerts')
+            return true;
+        try {
+            return JSON.parse(r.stdout).enabled === true;
+        }
+        catch {
+            return { skip: `could not parse ${endpoint} response` };
+        }
+    };
+    const alerts = await enabled('vulnerability-alerts');
+    if (typeof alerts !== 'boolean')
+        return alerts;
+    const fixes = await enabled('automated-security-fixes');
+    if (typeof fixes !== 'boolean')
+        return fixes;
+    return { alerts, fixes };
+}
+async function checkSecurityUpdates(exec, nwo) {
+    const check = SECURITY_UPDATES_CHECK;
+    const s = await readSecurityUpdates(exec, nwo);
+    if ('skip' in s)
+        return skip(check, s.skip);
+    const deltas = [];
+    if (!s.alerts)
+        deltas.push('vulnerability alerts disabled');
+    if (!s.fixes)
+        deltas.push('automated security fixes disabled');
+    // optional-missing, not drift: doctor promotes it when the lock records
+    // securityAutomation: true, and demotes it when the lock records false.
+    if (deltas.length)
+        return {
+            check,
+            status: 'optional-missing',
+            detail: deltas.join('; '),
+            hint: 'Run `npx @rtorcato/repo-tooling fix github-settings` to enable Dependabot alerts and security updates',
+        };
+    return { check, status: 'ok', detail: 'vulnerability alerts and automated security fixes on' };
+}
 /**
  * True when CodeQL/code-scanning is enabled for the repo. Covers both ways it
  * ships: an advanced-setup workflow on disk (what `fix codeql` scaffolds) or
@@ -764,6 +821,17 @@ export function buildGhApplyCommands(state) {
                 'can_approve_pull_request_reviews=false',
             ],
         });
+    // Alerts first: GitHub refuses security fixes on a repo with alerts off.
+    if (state.alerts)
+        commands.push({
+            label: 'vulnerability alerts',
+            args: ['api', '-X', 'PUT', `repos/${state.nwo}/vulnerability-alerts`],
+        });
+    if (state.securityFixes)
+        commands.push({
+            label: 'automated security fixes',
+            args: ['api', '-X', 'PUT', `repos/${state.nwo}/automated-security-fixes`],
+        });
     return commands;
 }
 /**
@@ -795,12 +863,15 @@ export async function applyGithubSettings(dir, exec) {
     // (no admin) reports `ok` → treated as "nothing to apply", never a failed PUT.
     const bp = await checkBranchProtection(gh, info.nwo, info.branch);
     const wp = await checkWorkflowPermissions(gh, info.nwo);
+    const sec = await readSecurityUpdates(gh, info.nwo);
     const commands = buildGhApplyCommands({
         nwo: info.nwo,
         branch: info.branch,
         merge: checkMergeSettings(info).status === 'drift',
         protection: bp.status === 'optional-missing' || bp.status === 'drift',
         workflow: wp.status === 'drift',
+        alerts: !('skip' in sec) && !sec.alerts,
+        securityFixes: !('skip' in sec) && !sec.fixes,
     });
     const applied = [];
     for (const cmd of commands) {

package/dist/cli/commands/doctor.js

@@ -140,14 +140,26 @@ function checkLockfile(lock) {
         detail: `.repo-tooling.json v${lock.version} (record written by ${lock.record.writtenBy})`,
     };
 }
+// Checks whose absence `securityAutomation: true` turns from an optional gap
+// into drift (#692): the lock says the repo chose them, so silence is a lie.
+const REQUIRED_BY_SECURITY_AUTOMATION = new Set(['Dependabot', 'Security updates']);
 // Lockfile-driven demotion: if the lock records an intentional opt-out for a
 // check that's currently optional-missing, demote it to ok with a clear detail.
+// The converse holds for a recorded opt-in (#692): promote it to drift.
 function demoteDeclined(results, lock) {
     if (!lock)
         return results;
     return results.map((r) => {
         if (r.status !== 'optional-missing')
             return r;
+        if (lock.record.config.securityAutomation === true &&
+            REQUIRED_BY_SECURITY_AUTOMATION.has(r.check)) {
+            return {
+                ...r,
+                status: 'drift',
+                detail: `${r.detail}, but .repo-tooling.json records securityAutomation: true`,
+            };
+        }
         if (!declinedInLock(lock, r.check))
             return r;
         return {

package/dist/cli/commands/fix-targets.js

@@ -28,6 +28,7 @@ export const FIX_TARGETS = {
     'Merge settings': 'github-settings',
     'Workflow permissions': 'github-settings',
     'Code-scanning gate': 'github-settings',
+    'Security updates': 'github-settings',
     Milestones: 'milestones',
     CODEOWNERS: 'codeowners',
     'GitLab CI': 'gitlab-ci',
@@ -159,6 +160,7 @@ export function declinedInLock(lock, checkName) {
         case 'Merge settings':
         case 'Workflow permissions':
         case 'Code-scanning gate':
+        case 'Security updates':
             return c.securityAutomation === false;
         case 'publint':
             return c.publint === false;

package/dist/cli/generators/brand.js

@@ -12,6 +12,7 @@
  * and falls back to a neutral grey. Nothing about any particular org is baked
  * in; the templates are meant to be hand-edited afterwards.
  */
+import { execFileSync, spawnSync } from 'node:child_process';
 import path from 'node:path';
 import fs from 'fs-extra';
 /** Grey, so an unbranded repo reads as unbranded rather than borrowing a colour. */
@@ -80,10 +81,11 @@ async function accentFromDocsTheme(targetDir) {
         return dark[1];
     return css.match(/--ifm-color-primary:\s*(#[0-9a-fA-F]{6})/)?.[1] ?? null;
 }
+/** Where a repo already keeps a favicon — the docs site's first. */
+const EXISTING_FAVICONS = [path.join('apps', 'docs', 'static', 'img', 'favicon.svg'), 'favicon.svg'];
 /** Failing that, the favicon's own ink — the other place a repo commits its colour. */
 async function accentFromFavicon(targetDir) {
-    const candidates = [path.join('apps', 'docs', 'static', 'img', 'favicon.svg'), 'favicon.svg'];
-    for (const rel of candidates) {
+    for (const rel of EXISTING_FAVICONS) {
         const file = path.join(targetDir, rel);
         if (!(await fs.pathExists(file)))
             continue;
@@ -123,17 +125,23 @@ export async function resolveBrandMeta(pkg, targetDir, tagline) {
     };
 }
 /**
- * The logo mark: a rounded square in the accent carrying the project's initial.
- * Authored on a 32 viewBox so it matches the favicon's geometry and can be
- * swapped for the real favicon glyph verbatim.
+ * The logo tile: a rounded square in the accent carrying the project's
+ * initial. It *is* `brand/favicon.svg`, and every canvas below draws that file
+ * rather than a copy of it, so swapping in a real glyph is a one-file edit (#678).
  */
-function mark(meta, translate, scale) {
+export function faviconSvg(meta) {
     const initial = esc((meta.name[0] ?? '?').toUpperCase());
-    return `	<!-- Logo mark: a 32 viewBox, so the real favicon glyph can be pasted in over it. -->
-	<g transform="translate(${translate}) scale(${scale})">
-		<rect width="32" height="32" rx="8" fill="${meta.accent}"/>
-		<text x="16" y="23" text-anchor="middle" font-family="Avenir Next" font-weight="800" font-size="19" fill="${INK}">${initial}</text>
-	</g>`;
+    return `<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+	<title>${esc(meta.name)}</title>
+	<rect width="32" height="32" rx="8" fill="${meta.accent}"/>
+	<text x="16" y="23" text-anchor="middle" font-family="Avenir Next" font-weight="800" font-size="19" fill="${INK}">${initial}</text>
+</svg>
+`;
+}
+/** The logo mark: `brand/favicon.svg`, drawn `size` px square. */
+function mark(x, y, size) {
+    return `	<!-- Logo mark: brand/favicon.svg — edit that file to change it on every canvas. -->
+	<image href="favicon.svg" x="${x}" y="${y}" width="${size}" height="${size}"/>`;
 }
 /** `repo-tooling` renders as a muted `repo-` and an accented `tooling`. */
 function wordmark(meta) {
@@ -188,7 +196,7 @@ function canvas(meta, w, h, glow) {
 /** 1280×320 README banner — left-aligned lockup, install pill on the right. */
 export function bannerSvg(meta) {
     return `${canvas(meta, 1280, 320, { cx: 0.16, cy: 0 })}
-${mark(meta, '60 88', 2.25)}
+${mark(60, 88, 72)}
 
 	<text x="156" y="150" font-family="Avenir Next" font-weight="800" font-size="62" letter-spacing="-1.5">${wordmark(meta)}</text>
 
@@ -200,7 +208,7 @@ ${installPanel(meta, { x: 845, y: 118, w: 378, h: 84, size: 20 })}
 /** 1280×786 mobile banner — the same content stacked so it stays legible on a phone. */
 export function bannerMobileSvg(meta) {
     return `${canvas(meta, 1280, 786, { cx: 0.12, cy: 0.05 })}
-${mark(meta, '565 104', 4.6875)}
+${mark(565, 104, 150)}
 
 	<text x="640" y="360" text-anchor="middle" font-family="Avenir Next" font-weight="800" font-size="76" letter-spacing="-1.8">${wordmark(meta)}</text>
 
@@ -212,7 +220,7 @@ ${installPanel(meta, { x: 427, y: 650, w: 426, h: 78, size: 24 })}
 /** 1280×640 Open Graph / GitHub social card. Keep content inside an ~8% safe inset. */
 export function socialCardSvg(meta) {
     return `${canvas(meta, 1280, 640, { cx: 0.1, cy: 0.05 })}
-${mark(meta, '590 120', 3.125)}
+${mark(590, 120, 100)}
 
 	<text x="640" y="300" text-anchor="middle" font-family="Avenir Next" font-weight="800" font-size="76" letter-spacing="-1.8">${wordmark(meta)}</text>
 
@@ -229,7 +237,7 @@ ${installPanel(meta, { x: 427, y: 470, w: 426, h: 78, size: 24 })}
 export const RENDER_SH = `#!/usr/bin/env bash
 # Render the committed brand PNGs from their SVG sources.
 # Sizes come from the brand-asset spec: 1280x320 banner, 1280x786 mobile,
-# 1280x640 social card, 512x512 PWA icon.
+# 1280x640 social card, 512x512 PWA icon. (\`fix brand\` also packs favicon.ico.)
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -241,7 +249,9 @@ fi
 
 rsvg-convert -w 1280 -h 320 brand/banner.svg        -o brand/banner.png
 rsvg-convert -w 1280 -h 786 brand/banner-mobile.svg -o brand/banner-mobile.png
-echo "rendered: brand/banner.png brand/banner-mobile.png"
+rsvg-convert -w 1280 -h 640 brand/social-card.svg   -o brand/social-card.png
+rsvg-convert -w 512  -h 512 brand/favicon.svg       -o brand/favicon-512.png
+echo "rendered: brand/banner.png brand/banner-mobile.png brand/social-card.png brand/favicon-512.png"
 
 # The docs-site assets, rendered only when the site exists to hold them.
 img=apps/docs/static/img
@@ -279,15 +289,25 @@ export async function repointReadmeBanners(targetDir) {
     await fs.writeFile(file, next);
     return 'README.md';
 }
+/** A favicon the repo already commits beats the generated initial tile. */
+async function existingFavicon(targetDir) {
+    for (const rel of EXISTING_FAVICONS) {
+        const file = path.join(targetDir, rel);
+        if (await fs.pathExists(file))
+            return fs.readFile(file, 'utf-8');
+    }
+    return null;
+}
 /**
- * Scaffold `brand/`: three SVG sources + the render script, then repoint a
- * README still on the old root-level paths. Every file is written only when
- * absent, so `fix brand` is idempotent.
+ * Scaffold `brand/`: the favicon tile, three SVG sources that draw it, and the
+ * render script, then repoint a README still on the old root-level paths.
+ * Every file is written only when absent, so `fix brand` is idempotent.
  */
 export async function generateBrand(pkg, targetDir, tagline) {
     const meta = await resolveBrandMeta(pkg, targetDir, tagline);
     const written = [];
     const files = [
+        ['brand/favicon.svg', (await existingFavicon(targetDir)) ?? faviconSvg(meta)],
         ['brand/banner.svg', bannerSvg(meta)],
         ['brand/banner-mobile.svg', bannerMobileSvg(meta)],
         ['brand/social-card.svg', socialCardSvg(meta)],
@@ -307,3 +327,118 @@ export async function generateBrand(pkg, targetDir, tagline) {
         written.push(readme);
     return written;
 }
+/** Printed when `rsvg-convert` is not on PATH — the sources are still written. */
+export const RSVG_HINT = '   next: install librsvg to render the brand PNGs (`brew install librsvg`, apt: `apt-get install librsvg2-bin`), then re-run `fix brand` or `brand/render.sh`';
+/** `[source, output, width, height]` under `brand/` — the same set render.sh draws. */
+const RENDERS = [
+    ['banner.svg', 'banner.png', 1280, 320],
+    ['banner-mobile.svg', 'banner-mobile.png', 1280, 786],
+    ['social-card.svg', 'social-card.png', 1280, 640],
+    ['favicon.svg', 'favicon-512.png', 512, 512],
+    ['favicon.svg', 'favicon.ico', 32, 32],
+];
+/** Classic favicon sizes packed into favicon.ico. */
+const ICO_SIZES = [16, 32];
+/**
+ * An ICO container holding PNG frames — every browser since IE Vista reads
+ * PNG-in-ICO, so no bitmap conversion is needed.
+ */
+export function packIco(frames) {
+    const header = Buffer.alloc(6 + 16 * frames.length);
+    header.writeUInt16LE(1, 2); // type: icon
+    header.writeUInt16LE(frames.length, 4);
+    let offset = header.length;
+    frames.forEach(([size, png], i) => {
+        const e = 6 + 16 * i;
+        header.writeUInt8(size % 256, e); // 0 means 256
+        header.writeUInt8(size % 256, e + 1);
+        header.writeUInt16LE(1, e + 4); // colour planes
+        header.writeUInt16LE(32, e + 6); // bits per pixel
+        header.writeUInt32LE(png.length, e + 8);
+        header.writeUInt32LE(offset, e + 12);
+        offset += png.length;
+    });
+    return Buffer.concat([header, ...frames.map(([, png]) => png)]);
+}
+async function mtime(file) {
+    return (await fs.stat(file)).mtimeMs;
+}
+/**
+ * Render every `brand/` PNG (and favicon.ico) that is missing or older than its
+ * source — or than favicon.svg, which every canvas draws. Returns the files
+ * written, or null when `rsvg-convert` is not on PATH (after printing
+ * {@link RSVG_HINT}). Nothing stale means nothing to do and no PATH lookup.
+ */
+export async function renderBrand(targetDir) {
+    const brand = path.join(targetDir, 'brand');
+    const favicon = path.join(brand, 'favicon.svg');
+    const stale = [];
+    for (const job of RENDERS) {
+        const [src, out] = job;
+        const srcFile = path.join(brand, src);
+        const outFile = path.join(brand, out);
+        if (!(await fs.pathExists(srcFile)))
+            continue;
+        const newest = Math.max(await mtime(srcFile), (await fs.pathExists(favicon)) ? await mtime(favicon) : 0);
+        if (!(await fs.pathExists(outFile)) || (await mtime(outFile)) < newest)
+            stale.push(job);
+    }
+    if (stale.length === 0)
+        return [];
+    if (spawnSync('rsvg-convert', ['--version']).error) {
+        // stderr, not stdout: `fix --json` owns stdout (#357).
+        console.error(RSVG_HINT);
+        return null;
+    }
+    // cwd = brand/ so each canvas's `href="favicon.svg"` resolves beside it.
+    const rsvg = (src, w, h) => execFileSync('rsvg-convert', ['-w', String(w), '-h', String(h), src], { cwd: brand });
+    const written = [];
+    for (const [src, out, w, h] of stale) {
+        const png = out.endsWith('.ico')
+            ? packIco(ICO_SIZES.map((s) => [s, rsvg(src, s, s)]))
+            : rsvg(src, w, h);
+        await fs.writeFile(path.join(brand, out), png);
+        written.push(`brand/${out}`);
+    }
+    return written;
+}
+export const BANNER_START = '<!-- js-tooling:banner:start -->';
+export const BANNER_END = '<!-- js-tooling:banner:end -->';
+/** The README `<picture>` banner, mobile variant under 640px, as a delimited block. */
+export function buildBannerBlock(name) {
+    return `${BANNER_START}
+<picture>
+  <source media="(max-width: 640px)" srcset="./brand/banner-mobile.png">
+  <img src="./brand/banner.png" alt="${esc(name)} banner" width="1600">
+</picture>
+${BANNER_END}`;
+}
+/**
+ * Put the banner block at the top of a README. Refreshes an existing block in
+ * place; leaves alone a README that already shows a banner outside one (a
+ * hand-written `<picture>`); otherwise prepends. Idempotent.
+ */
+export function upsertBanner(readme, block) {
+    const start = readme.indexOf(BANNER_START);
+    const end = readme.indexOf(BANNER_END);
+    if (start !== -1 && end > start) {
+        return readme.slice(0, start) + block + readme.slice(end + BANNER_END.length);
+    }
+    if (/banner(?:-mobile)?\.png/.test(readme))
+        return readme;
+    return `${block}\n\n${readme}`;
+}
+/** Add the banner block to README.md once `brand/banner.png` exists to show. */
+export async function addReadmeBanner(targetDir, name) {
+    const file = path.join(targetDir, 'README.md');
+    if (!(await fs.pathExists(file)))
+        return null;
+    if (!(await fs.pathExists(path.join(targetDir, 'brand', 'banner.png'))))
+        return null;
+    const readme = await fs.readFile(file, 'utf-8');
+    const next = upsertBanner(readme, buildBannerBlock(name));
+    if (next === readme)
+        return null;
+    await fs.writeFile(file, next);
+    return 'README.md';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "4.3.1",
+	"version": "4.4.0",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [