@scaleway/npm-trust 0.0.1

package/README.md

@@ -0,0 +1,84 @@
+# @scaleway/npm-trust
+
+Configure [npm trusted publishers](https://docs.npmjs.com/trusted-publishers) (GitHub Actions OIDC) for all public packages in a pnpm workspace.
+
+Trusted publishing lets GitHub Actions publish to npm without a long-lived `NPM_TOKEN` — npm exchanges a short-lived GitHub OIDC token for a publish token at release time. This CLI automates the npm-side configuration: it registers each public workspace package's GitHub Actions workflow as a trusted publisher.
+
+## Prerequisites
+
+- `npm login` (needed for `npm trust` commands)
+- Node >= 22, pnpm >= 12
+
+## Usage
+
+### Configure trust for all public packages
+
+```bash
+pnpm exec npm-trust --repo <owner/name>
+```
+
+This will:
+
+1. List all non-private workspace packages.
+2. Detect any that are not yet published to npm and offer to publish them first.
+3. For each package, check if trust is already configured. If not, run `npm trust github` to register the GitHub Actions workflow as a trusted publisher.
+
+### Check mode (CI gate)
+
+```bash
+pnpm exec npm-trust --check --repo <owner/name>
+```
+
+Exits with code `1` if any public package is not yet published on npm. Use this in CI to block merges that add a new publishable package without publishing it first. No npm auth required — uses anonymous `npm view` queries.
+
+### Options
+
+```
+Options:
+  -f, --file <workflow>   GitHub Actions workflow file (default: deploy-package.yml)
+  -r, --repo <owner/name> GitHub repository
+      --dry-run           Report what would happen, no changes
+      --check             Only check for unpublished packages; exit 1 if any found
+  -y, --yes               Skip prompts, answer yes to everything
+  -h, --help              Show this help
+```
+
+## CI integration
+
+### Block PRs that add unpublished packages
+
+```yaml
+# .github/workflows/ci.yml
+jobs:
+  npm-trust-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup-node-pnpm
+      - run: pnpm exec npm-trust --check --repo ${{ github.repository }}
+```
+
+### Gate releases on trust configuration
+
+```yaml
+# .github/workflows/release.yml
+steps:
+  - name: Check npm trust
+    run: pnpm exec npm-trust --check --repo ${{ github.repository }}
+```
+
+The check runs before the changesets publish step, ensuring no release proceeds with unpublished packages that lack trusted publishing.
+
+## OIDC setup
+
+Once trust is configured via this CLI, the release workflow can publish without `NPM_TOKEN`:
+
+```yaml
+permissions:
+  id-token: write # required for OIDC
+
+env:
+  NPM_CONFIG_PROVENANCE: 'true'
+```
+
+See the [npm trusted publishers guide](https://docs.npmjs.com/trusted-publishers) for more details.

package/dist/index.mjs

@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+import { exec, findWorkspaceRoot, hasExistingTrust, isPackagePublished, listPublicWorkspacePackages } from "./utils.mjs";
+import { realpathSync } from "node:fs";
+import { stdin, stdout } from "node:process";
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+//#region src/index.ts
+const HELP = `Usage: npm-trust [options]
+
+Configure npm trusted publishers (GitHub Actions) for all non-private
+workspace packages. Detects unpublished packages and offers to publish
+them first. Skips packages that already have a trust relationship.
+
+Options:
+  -f, --file <workflow>   GitHub Actions workflow file (default: deploy-package.yml)
+  -r, --repo <owner/name> GitHub repository
+      --dry-run           Report what would happen, no changes
+      --check             Only check for unpublished packages; exit 1 if any found
+  -y, --yes               Skip prompts, answer yes to everything
+  -h, --help              Show this help
+
+Note: requires "npm login" first (npm trust list needs auth to check
+existing trusts). If the check fails, the package is tried anyway and
+npm itself will report conflicts (E409).
+`;
+function parseArgs_() {
+	const { values } = parseArgs({
+		args: process.argv.slice(2),
+		options: {
+			file: {
+				type: "string",
+				short: "f",
+				default: "deploy-package.yml"
+			},
+			repo: {
+				type: "string",
+				short: "r"
+			},
+			"dry-run": {
+				type: "boolean",
+				default: false
+			},
+			check: {
+				type: "boolean",
+				default: false
+			},
+			yes: {
+				type: "boolean",
+				short: "y",
+				default: false
+			},
+			help: {
+				type: "boolean",
+				short: "h",
+				default: false
+			}
+		}
+	});
+	if (values.help) {
+		console.log(HELP);
+		return null;
+	}
+	return {
+		dryRun: values["dry-run"],
+		check: values.check,
+		workflowFile: values.file,
+		repo: values.repo,
+		yes: values.yes
+	};
+}
+async function promptYesNo(question, defaultValue = false) {
+	const rl = createInterface({
+		input: stdin,
+		output: stdout
+	});
+	try {
+		const answer = (await rl.question(`${question} (y/N) `)).trim().toLowerCase();
+		return answer === "y" || answer === "yes";
+	} catch {
+		return defaultValue;
+	} finally {
+		rl.close();
+	}
+}
+function findUnpublishedPackages(packages) {
+	const unpublished = [];
+	for (const pkg of packages) if (!isPackagePublished(pkg.name)) unpublished.push(pkg);
+	return unpublished;
+}
+async function publishUnpublished(packages, options) {
+	if (packages.length === 0) return;
+	console.log(`\n[trust] ${packages.length} unpublished package(s) detected:`);
+	for (const pkg of packages) console.log(`  - ${pkg.name} (v${pkg.version})`);
+	if (options.dryRun) {
+		console.log("[dry-run] would prompt to publish these packages first");
+		return;
+	}
+	if (!(options.yes || await promptYesNo("\nPublish these packages first?"))) {
+		console.log("[trust] skipping publish, proceeding to trust setup");
+		return;
+	}
+	for (const pkg of packages) {
+		const cmd = `npm publish --access public --force`;
+		console.log(`>>> ${cmd} (in ${pkg.path})`);
+		try {
+			exec(cmd, {
+				cwd: pkg.path,
+				stdio: "inherit"
+			});
+			console.log(`published: ${pkg.name}`);
+		} catch {
+			console.error(`WARN: publish failed for ${pkg.name}`);
+		}
+	}
+}
+function configureTrust(packages, options) {
+	let applied = 0;
+	let skipped = 0;
+	let failed = 0;
+	for (const pkg of packages) {
+		const cmd = `npm trust github ${pkg.name} --file ${options.workflowFile} --repo ${options.repo} -y --allow-publish --force`;
+		if (options.dryRun) {
+			console.log(`[dry-run] ${cmd}`);
+			applied++;
+		} else if (hasExistingTrust(pkg.name)) {
+			console.log(`SKIP: ${pkg.name} — trust already configured`);
+			skipped++;
+		} else {
+			console.log(`>>> ${cmd}`);
+			try {
+				exec(cmd, { stdio: "inherit" });
+				applied++;
+			} catch {
+				console.error(`WARN: failed for ${pkg.name}`);
+				failed++;
+			}
+		}
+	}
+	console.log(`[trust] done: ${applied} applied, ${skipped} skipped, ${failed} failed`);
+}
+async function main() {
+	const options = parseArgs_();
+	if (!options) return;
+	if (!options.repo) {
+		console.error("missing --repo");
+		process.exit(1);
+	}
+	const root = findWorkspaceRoot(process.cwd());
+	const packages = listPublicWorkspacePackages(root);
+	console.log(`[trust] ${packages.length} non-private packages`);
+	if (options.check) {
+		const unpublished = findUnpublishedPackages(packages);
+		if (unpublished.length === 0) {
+			console.log("[check] all packages are published on npm");
+			process.exit(0);
+		}
+		console.log(`[check] ${unpublished.length} unpublished package(s) found:`);
+		for (const pkg of unpublished) console.log(`  - ${pkg.name} (v${pkg.version})`);
+		console.log("[check] publish and configure trust before merging");
+		process.exit(1);
+	}
+	if (!options.dryRun) await publishUnpublished(findUnpublishedPackages(packages), options);
+	configureTrust(packages, options);
+}
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(import.meta.filename)) try {
+	await main();
+} catch (error) {
+	console.error(error);
+	process.exit(1);
+}
+//#endregion
+export {};

package/dist/utils.mjs

@@ -0,0 +1,69 @@
+import { readFileSync } from "node:fs";
+import { execSync } from "node:child_process";
+import path from "node:path";
+//#region src/utils.ts
+const hasPnpm = (() => {
+	try {
+		execSync("pnpm --version", { stdio: "ignore" });
+		return true;
+	} catch {
+		return false;
+	}
+})();
+const findWorkspaceRoot = (start) => {
+	let dir = start;
+	while (dir !== "/") try {
+		readFileSync(path.join(dir, "pnpm-workspace.yaml"), "utf8");
+		return dir;
+	} catch {
+		dir = path.join(dir, "..");
+	}
+	return start;
+};
+const exec = (cmd, opts = {}) => {
+	return (execSync(cmd, {
+		cwd: opts.cwd,
+		encoding: "utf8",
+		stdio: opts.stdio === "inherit" ? "inherit" : [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		maxBuffer: 52428800
+	}) ?? "").trim();
+};
+const isPnpmListEntry = (e) => typeof e === "object" && e !== null && "name" in e && "path" in e;
+const listPublicWorkspacePackages = (root) => {
+	const raw = exec("pnpm ls -r --depth -1 --json", { cwd: root });
+	const parsed = JSON.parse(raw);
+	return (Array.isArray(parsed) ? parsed : []).filter(isPnpmListEntry).filter((e) => e.version && e.private !== true);
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+const countTrustEntries = (json) => {
+	try {
+		const parsed = JSON.parse(json);
+		if (!isRecord(parsed)) return 0;
+		return Object.values(parsed).flat().filter(Boolean).length;
+	} catch {
+		return 0;
+	}
+};
+const hasExistingTrust = (pkgName) => {
+	try {
+		const listJson = exec(`npm trust list ${pkgName} --json --force`);
+		return countTrustEntries(listJson) > 0;
+	} catch {
+		return false;
+	}
+};
+const isPackagePublished = (pkgName) => {
+	const cmd = hasPnpm ? `pnpm view ${pkgName} version` : `npm view ${pkgName} version --force`;
+	try {
+		exec(cmd);
+		return true;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+export { exec, findWorkspaceRoot, hasExistingTrust, isPackagePublished, listPublicWorkspacePackages };

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@scaleway/npm-trust",
+  "version": "0.0.1",
+  "private": false,
+  "description": "Configure npm trusted publishers (GitHub Actions) for workspace packages",
+  "homepage": "https://github.com/scaleway/scaleway-lib/tree/main/packages/npm-trust",
+  "bugs": {
+    "url": "https://github.com/scaleway/scaleway-lib/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scaleway/scaleway-lib.git",
+    "directory": "packages/npm-trust"
+  },
+  "bin": {
+    "npm-trust": "dist/index.mjs"
+  },
+  "files": [
+    "dist/"
+  ],
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "tsdown"
+  },
+  "engines": {
+    "node": "24.x || 25.x || 26.x"
+  }
+}