@smoothbricks/cli 0.1.0 → 0.2.0

package/src/release/__tests__/trust-publisher.test.ts

@@ -0,0 +1,133 @@
+import { describe, expect, it } from 'bun:test';
+import type { BootstrapNpmPackagesOptions } from '../bootstrap-npm-packages.js';
+import type { ReleasePackageInfo } from '../core.js';
+import { configureTrustedPublishers, type TrustPublisherShell } from '../index.js';
+
+const stable: ReleasePackageInfo = {
+  name: '@scope/stable',
+  projectName: 'stable',
+  path: 'packages/stable',
+  version: '1.2.3',
+};
+const missing: ReleasePackageInfo = {
+  name: '@scope/missing',
+  projectName: 'missing',
+  path: 'packages/missing',
+  version: '2.0.0',
+};
+
+describe('trusted publisher setup', () => {
+  it('bootstraps missing npm packages before configuring trust', async () => {
+    const shell = new RecordingTrustPublisherShell({ packages: [stable, missing], existing: [stable.name] });
+
+    await configureTrustedPublishers(shell, { bootstrap: true, skipLogin: false, otp: '123456' });
+
+    expect(shell.events).toEqual([
+      'bootstrap:false:false',
+      `exists:${stable.name}`,
+      `exists:${missing.name}`,
+      `trust:${stable.name}:false:123456`,
+      `trust:${missing.name}:false:123456`,
+    ]);
+    expect(shell.logins).toBe(0);
+  });
+
+  it('directs missing packages to trust-publisher --bootstrap', async () => {
+    const shell = new RecordingTrustPublisherShell({ packages: [missing], existing: [] });
+
+    await expect(configureTrustedPublishers(shell, { otp: '123456' })).rejects.toThrow(
+      'Run smoo release trust-publisher --bootstrap locally',
+    );
+    expect(shell.events).toEqual([`exists:${missing.name}`]);
+  });
+
+  it('still logs in for trust when bootstrap finds no missing packages', async () => {
+    const shell = new RecordingTrustPublisherShell({ packages: [stable], existing: [stable.name] });
+
+    await configureTrustedPublishers(shell, { bootstrap: true, otp: '123456' });
+
+    expect(shell.events).toEqual([
+      'bootstrap:false:false',
+      `exists:${stable.name}`,
+      `trust:${stable.name}:false:123456`,
+    ]);
+    expect(shell.logins).toBe(1);
+  });
+
+  it('treats npm trust conflicts as already configured', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      alreadyTrusted: [stable.name],
+    });
+
+    await configureTrustedPublishers(shell, { skipLogin: true, otp: '123456' });
+
+    expect(shell.events).toEqual([`exists:${stable.name}`, `trust:${stable.name}:false:123456`]);
+    expect(shell.logs).toContain(`${stable.name}: npm trusted publisher is already configured; skipping.`);
+  });
+});
+
+class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackageInfo> {
+  readonly repository = 'scope/repo';
+  readonly workflow = 'publish.yml';
+  readonly events: string[] = [];
+  readonly logs: string[] = [];
+  readonly errors: string[] = [];
+  logins = 0;
+  private readonly packages: ReleasePackageInfo[];
+  private readonly existing: Set<string>;
+  private readonly alreadyTrusted: Set<string>;
+
+  constructor(options: { packages: ReleasePackageInfo[]; existing: string[]; alreadyTrusted?: string[] }) {
+    this.packages = options.packages;
+    this.existing = new Set(options.existing);
+    this.alreadyTrusted = new Set(options.alreadyTrusted ?? []);
+  }
+
+  listReleasePackages(): ReleasePackageInfo[] {
+    return this.packages;
+  }
+
+  async packageExists(name: string): Promise<boolean> {
+    this.events.push(`exists:${name}`);
+    return this.existing.has(name);
+  }
+
+  async bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<ReleasePackageInfo[]> {
+    this.events.push(`bootstrap:${options.dryRun}:${options.skipLogin}`);
+    const missingPackages = this.packages.filter((pkg) => !this.existing.has(pkg.name));
+    for (const pkg of missingPackages) {
+      this.existing.add(pkg.name);
+    }
+    return missingPackages;
+  }
+
+  async login(): Promise<void> {
+    this.logins += 1;
+  }
+
+  async trustPublisher(
+    pkg: ReleasePackageInfo,
+    dryRun: boolean,
+    env?: Record<string, string>,
+  ): Promise<'configured' | 'already-configured'> {
+    this.events.push(`trust:${pkg.name}:${dryRun}:${env?.NPM_CONFIG_OTP ?? ''}`);
+    if (this.alreadyTrusted.has(pkg.name)) {
+      return 'already-configured';
+    }
+    return 'configured';
+  }
+
+  async promptOtp(packageName: string): Promise<string> {
+    throw new Error(`unexpected OTP prompt for ${packageName}`);
+  }
+
+  log(message: string): void {
+    this.logs.push(message);
+  }
+
+  error(message: string): void {
+    this.errors.push(message);
+  }
+}

package/src/release/bootstrap-npm-packages.ts

@@ -0,0 +1,88 @@
+import type { ReleasePackageInfo } from './core.js';
+
+export const NPM_BOOTSTRAP_VERSION = '0.0.0-bootstrap.0';
+export const NPM_BOOTSTRAP_DIST_TAG = 'bootstrap';
+
+export interface BootstrapNpmPackagesOptions {
+  dryRun: boolean;
+  skipLogin: boolean;
+  packages: string[];
+  otp?: string;
+}
+
+export interface BootstrapNpmPackagesShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  listReleasePackages(): Package[];
+  packageExists(name: string): Promise<boolean>;
+  login(): Promise<void>;
+  publishPlaceholder(pkg: Package, env?: Record<string, string>): Promise<void>;
+  promptOtp(packageName: string): Promise<string>;
+  log(message: string): void;
+}
+
+export async function bootstrapNpmPackages<Package extends ReleasePackageInfo>(
+  shell: BootstrapNpmPackagesShell<Package>,
+  options: BootstrapNpmPackagesOptions,
+): Promise<Package[]> {
+  const packages = selectedReleasePackages(shell.listReleasePackages(), options.packages);
+  if (packages.length === 0) {
+    throw new Error('No owned release packages found.');
+  }
+
+  const missing: Package[] = [];
+  for (const pkg of packages) {
+    if (await shell.packageExists(pkg.name)) {
+      shell.log(`${pkg.name}: already exists on npm; skipping placeholder bootstrap.`);
+    } else {
+      missing.push(pkg);
+    }
+  }
+
+  if (missing.length === 0) {
+    shell.log('All selected owned release packages already exist on npm.');
+    return [];
+  }
+
+  shell.log(
+    `Bootstrap npm placeholders (${NPM_BOOTSTRAP_VERSION}, dist-tag ${NPM_BOOTSTRAP_DIST_TAG}): ${missing
+      .map((pkg) => pkg.name)
+      .join(', ')}`,
+  );
+  if (options.dryRun) {
+    return missing;
+  }
+
+  if (!options.skipLogin) {
+    await shell.login();
+  }
+  for (const pkg of missing) {
+    shell.log(`${pkg.name}: publishing npm placeholder.`);
+    const otp = options.otp ?? (await shell.promptOtp(pkg.name));
+    await shell.publishPlaceholder(pkg, { NPM_CONFIG_OTP: otp });
+  }
+  shell.log('Bootstrap complete. Run smoo release trust-publisher before the first CI publish.');
+  return missing;
+}
+
+function selectedReleasePackages<Package extends ReleasePackageInfo>(
+  packages: Package[],
+  selections: string[],
+): Package[] {
+  if (selections.length === 0) {
+    return packages;
+  }
+  const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+  const selected: Package[] = [];
+  const unknown: string[] = [];
+  for (const name of selections) {
+    const pkg = byName.get(name);
+    if (pkg) {
+      selected.push(pkg);
+    } else {
+      unknown.push(name);
+    }
+  }
+  if (unknown.length > 0) {
+    throw new Error(`Unknown owned release package selection: ${unknown.join(', ')}`);
+  }
+  return selected;
+}

package/src/release/candidates.ts

@@ -0,0 +1,225 @@
+import { isRecord } from '../lib/json.js';
+import type { ReleasePackageInfo } from './core.js';
+import { releaseTag } from './core.js';
+
+export interface AutoReleaseCandidateShell {
+  gitRefExists(ref: string): Promise<boolean>;
+  packageChangedFilesSince(ref: string, packagePath: string): Promise<string[]>;
+  packageJsonAtRef(ref: string, packagePath: string): Promise<Record<string, unknown> | null>;
+  currentPackageJson(packagePath: string): Promise<Record<string, unknown> | null>;
+  packageBuildInputPatterns(projectName: string, packagePath: string): Promise<string[]>;
+  packageHasHistory(packagePath: string): Promise<boolean>;
+}
+
+const releasableManifestKeys = [
+  'author',
+  'bin',
+  'browser',
+  'bugs',
+  'cpu',
+  'dependencies',
+  'description',
+  'engines',
+  'exports',
+  'files',
+  'funding',
+  'homepage',
+  'imports',
+  'keywords',
+  'license',
+  'main',
+  'module',
+  'name',
+  'optionalDependencies',
+  'os',
+  'peerDependencies',
+  'peerDependenciesMeta',
+  'publishConfig',
+  'repository',
+  'sideEffects',
+  'types',
+  'typesVersions',
+] as const;
+
+export async function autoReleaseCandidatePackages<Package extends ReleasePackageInfo>(
+  shell: AutoReleaseCandidateShell,
+  packages: Package[],
+): Promise<Package[]> {
+  const candidates: Package[] = [];
+  for (const pkg of packages) {
+    if (await isAutoReleaseCandidate(shell, pkg)) {
+      candidates.push(pkg);
+    }
+  }
+  return candidates;
+}
+
+async function isAutoReleaseCandidate<Package extends ReleasePackageInfo>(
+  shell: AutoReleaseCandidateShell,
+  pkg: Package,
+): Promise<boolean> {
+  const tagRef = `refs/tags/${releaseTag(pkg)}`;
+  if (await shell.gitRefExists(tagRef)) {
+    return packageHasReleasableChangesSince(shell, tagRef, pkg);
+  }
+  return shell.packageHasHistory(pkg.path);
+}
+
+async function packageHasReleasableChangesSince<Package extends ReleasePackageInfo>(
+  shell: AutoReleaseCandidateShell,
+  ref: string,
+  pkg: Package,
+): Promise<boolean> {
+  const changedFiles = await shell.packageChangedFilesSince(ref, pkg.path);
+  if (changedFiles.length === 0) {
+    return false;
+  }
+  const currentManifest = await shell.currentPackageJson(pkg.path);
+  const buildInputPatterns = await shell.packageBuildInputPatterns(pkg.projectName, pkg.path);
+  for (const changedFile of changedFiles) {
+    if (changedFile === 'package.json') {
+      const previousManifest = await shell.packageJsonAtRef(ref, pkg.path);
+      if (!previousManifest || !currentManifest || releasableManifestChanged(previousManifest, currentManifest)) {
+        return true;
+      }
+      continue;
+    }
+    if (isReleasablePackagePath(changedFile, currentManifest, buildInputPatterns)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function releasableManifestChanged(
+  previousManifest: Record<string, unknown>,
+  currentManifest: Record<string, unknown>,
+): boolean {
+  for (const key of releasableManifestKeys) {
+    if (!stableJsonEqual(previousManifest[key], currentManifest[key])) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function isReleasablePackagePath(
+  path: string,
+  manifest: Record<string, unknown> | null,
+  buildInputPatterns: string[],
+): boolean {
+  return (
+    isBuildInputPath(path, buildInputPatterns) || isPackageMetadataPath(path) || isManifestFilesPath(path, manifest)
+  );
+}
+
+function isBuildInputPath(path: string, patterns: string[]): boolean {
+  if (isReleaseIgnoredBuildInputPath(path)) {
+    return false;
+  }
+  let matched = false;
+  for (const pattern of patterns) {
+    const excluded = pattern.startsWith('!');
+    const rawPattern = excluded ? pattern.slice(1) : pattern;
+    if (matchesBuildInputPattern(path, rawPattern)) {
+      matched = !excluded;
+    }
+  }
+  return matched;
+}
+
+function matchesBuildInputPattern(path: string, pattern: string): boolean {
+  const normalized = pattern.replace(/^\.\//, '').replace(/\/$/, '');
+  if (!normalized) {
+    return false;
+  }
+  return globPatternToRegExp(normalized).test(path);
+}
+
+function globPatternToRegExp(pattern: string): RegExp {
+  let source = '^';
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === '*') {
+      if (pattern[index + 1] === '*') {
+        if (pattern[index + 2] === '/') {
+          source += '(?:.*/)?';
+          index += 2;
+        } else {
+          source += '.*';
+          index += 1;
+        }
+      } else {
+        source += '[^/]*';
+      }
+    } else {
+      source += escapeRegExpChar(char);
+    }
+  }
+  return new RegExp(`${source}$`);
+}
+
+function escapeRegExpChar(char: string | undefined): string {
+  if (!char) {
+    return '';
+  }
+  return /[\\^$+?.()|[\]{}]/.test(char) ? `\\${char}` : char;
+}
+
+function isReleaseIgnoredBuildInputPath(path: string): boolean {
+  return (
+    path === 'package.json' ||
+    path === 'tsconfig.test.json' ||
+    path.includes('/__tests__/') ||
+    path.endsWith('.test.ts') ||
+    path.endsWith('.test.tsx') ||
+    path.endsWith('.spec.ts') ||
+    path.endsWith('.spec.tsx')
+  );
+}
+
+function isPackageMetadataPath(path: string): boolean {
+  return /^(README|LICENSE|CHANGELOG)(\.|$)/.test(path);
+}
+
+function isManifestFilesPath(path: string, manifest: Record<string, unknown> | null): boolean {
+  const files = manifest?.files;
+  if (!Array.isArray(files)) {
+    return false;
+  }
+  for (const entry of files) {
+    if (typeof entry !== 'string' || entry.length === 0 || entry.startsWith('!')) {
+      continue;
+    }
+    if (matchesManifestFilesEntry(path, entry)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function matchesManifestFilesEntry(path: string, entry: string): boolean {
+  const normalized = entry.replace(/^\.\//, '').replace(/\/$/, '');
+  if (!normalized || normalized.includes('*')) {
+    return false;
+  }
+  return path === normalized || path.startsWith(`${normalized}/`);
+}
+
+function stableJsonEqual(left: unknown, right: unknown): boolean {
+  return JSON.stringify(stableJson(left)) === JSON.stringify(stableJson(right));
+}
+
+function stableJson(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(stableJson);
+  }
+  if (isRecord(value)) {
+    const normalized: Record<string, unknown> = {};
+    for (const key of Object.keys(value).sort()) {
+      normalized[key] = stableJson(value[key]);
+    }
+    return normalized;
+  }
+  return value;
+}

package/src/release/core.ts

@@ -0,0 +1,171 @@
+export interface ReleasePackageInfo {
+  name: string;
+  projectName: string;
+  path: string;
+  version: string;
+}
+
+export interface GitReleaseTagInfo {
+  name: string;
+  sha: string;
+  timestamp: number;
+}
+
+export interface MatchedReleaseTag<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  tag: string;
+  sha: string;
+  timestamp: number;
+  pkg: Package;
+}
+
+export interface ReleaseTagRecord<Package extends ReleasePackageInfo = ReleasePackageInfo>
+  extends MatchedReleaseTag<Package> {
+  needsNpmPublish: boolean;
+  needsGithubRelease: boolean;
+}
+
+export interface ReleaseTarget<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  sha: string;
+  timestamp: number;
+  packages: Package[];
+  npmPackages: Package[];
+  githubPackages: Package[];
+}
+
+export interface DurableTagState {
+  npmPublished: boolean;
+  githubReleaseExists: boolean;
+}
+
+export interface ReleasePlanningShell {
+  listReleaseTagsByCreatorDate(): Promise<GitReleaseTagInfo[]>;
+  isAncestor(ancestor: string, descendant: string): Promise<boolean>;
+  packageVersionAtRef(packagePath: string, ref: string): Promise<string | null>;
+  durableTagState(pkg: ReleasePackageInfo, tag: string): Promise<DurableTagState>;
+}
+
+export function releaseTag(pkg: Pick<ReleasePackageInfo, 'name' | 'version'>): string {
+  return `${pkg.name}@${pkg.version}`;
+}
+
+export function npmDistTagForVersion(version: string): string {
+  return version.includes('-') ? 'next' : 'latest';
+}
+
+export function releasePackageForTag<Package extends Omit<ReleasePackageInfo, 'version'>>(
+  packages: Package[],
+  tag: string,
+): { pkg: Package; version: string } | null {
+  for (const pkg of packages) {
+    const prefix = `${pkg.name}@`;
+    if (tag.startsWith(prefix)) {
+      const version = tag.slice(prefix.length);
+      if (!version) {
+        throw new Error(`Release tag ${tag} does not include a version.`);
+      }
+      return { pkg, version };
+    }
+  }
+  return null;
+}
+
+export function classifyReleaseTag<Package extends ReleasePackageInfo>(
+  tag: MatchedReleaseTag<Package>,
+  state: DurableTagState,
+): ReleaseTagRecord<Package> {
+  return {
+    ...tag,
+    needsNpmPublish: !state.npmPublished,
+    needsGithubRelease: !state.githubReleaseExists,
+  };
+}
+
+export async function collectOwnedReleaseTagRecords<Package extends Omit<ReleasePackageInfo, 'version'>>(
+  packages: Package[],
+  ref: string,
+  shell: ReleasePlanningShell,
+): Promise<Array<ReleaseTagRecord<Package & { version: string }>>> {
+  const records: Array<ReleaseTagRecord<Package & { version: string }>> = [];
+  const completedPackages = new Set<string>();
+  for (const tag of await shell.listReleaseTagsByCreatorDate()) {
+    const match = releasePackageForTag(packages, tag.name);
+    if (match && completedPackages.has(match.pkg.name)) {
+      continue;
+    }
+    if (!match || !(await shell.isAncestor(tag.sha, ref))) {
+      continue;
+    }
+    const versionAtTag = await shell.packageVersionAtRef(match.pkg.path, tag.sha);
+    if (versionAtTag !== match.version) {
+      throw new Error(
+        `Release tag ${tag.name} points at ${tag.sha.slice(0, 12)}, but ${match.pkg.path}/package.json has version ${
+          versionAtTag ?? 'missing'
+        }.`,
+      );
+    }
+    const pkg = { ...match.pkg, version: match.version };
+    const state = await shell.durableTagState(pkg, tag.name);
+    records.push(classifyReleaseTag({ tag: tag.name, sha: tag.sha, timestamp: tag.timestamp, pkg }, state));
+    if (state.npmPublished && state.githubReleaseExists) {
+      completedPackages.add(pkg.name);
+    }
+  }
+  return records;
+}
+
+export function groupReleaseTargets<Package extends ReleasePackageInfo>(
+  records: ReleaseTagRecord<Package>[],
+): ReleaseTarget<Package>[] {
+  const targets = new Map<string, ReleaseTarget<Package>>();
+  const packageNamesByTarget = new Map<string, Set<string>>();
+  for (const record of records) {
+    let target = targets.get(record.sha);
+    let packageNames = packageNamesByTarget.get(record.sha);
+    if (!target) {
+      target = { sha: record.sha, timestamp: record.timestamp, packages: [], npmPackages: [], githubPackages: [] };
+      targets.set(record.sha, target);
+      packageNames = new Set<string>();
+      packageNamesByTarget.set(record.sha, packageNames);
+    } else if (record.timestamp > target.timestamp) {
+      target.timestamp = record.timestamp;
+    }
+    if (!packageNames) {
+      throw new Error(`Release target ${record.sha.slice(0, 12)} lost package tracking state.`);
+    }
+    if (packageNames.has(record.pkg.name)) {
+      throw new Error(
+        `Release target ${record.sha.slice(0, 12)} has more than one release tag for ${record.pkg.name}.`,
+      );
+    }
+    packageNames.add(record.pkg.name);
+    if (record.needsNpmPublish || record.needsGithubRelease) {
+      target.packages.push(record.pkg);
+    }
+    if (record.needsNpmPublish) {
+      target.npmPackages.push(record.pkg);
+    }
+    if (record.needsGithubRelease) {
+      target.githubPackages.push(record.pkg);
+    }
+  }
+  return [...targets.values()].sort(
+    (left, right) => right.timestamp - left.timestamp || right.sha.localeCompare(left.sha),
+  );
+}
+
+export function pendingReleaseTargets<Package extends ReleasePackageInfo>(
+  records: ReleaseTagRecord<Package>[],
+  headSha: string,
+): ReleaseTarget<Package>[] {
+  const pending: ReleaseTarget<Package>[] = [];
+  for (const target of groupReleaseTargets(records)) {
+    if (target.sha === headSha) {
+      continue;
+    }
+    if (target.npmPackages.length === 0 && target.githubPackages.length === 0) {
+      break;
+    }
+    pending.push(target);
+  }
+  return pending.reverse();
+}