@smoothbricks/cli 0.10.2 → 0.10.3

package/src/release/__tests__/fixture-repo.test.ts

@@ -175,7 +175,9 @@ describe('release planning with fixture git repositories', () => {
       const summaries = await repairPendingTargets(shell, pending, restoreRef, false);
 
       expect(shell.checkouts).toEqual([githubOnlySha, npmAndGithubSha, restoreRef]);
-      expect(shell.devenvLoads).toBe(2);
+      expect(shell.devenvLoads).toBe(3);
+      expect(shell.devenvRefs).toEqual([githubOnlySha, npmAndGithubSha, headSha]);
+      await expect(readFile(join(runner, '.generated-tool-ref'), 'utf8')).resolves.toBe(`${headSha}\n`);
       expect(shell.builds).toEqual([['@scope/b']]);
       expect(shell.publishes).toEqual([{ name: '@scope/b', version: '2.0.0-beta.1', distTag: 'next', dryRun: false }]);
       expect(shell.githubCreates).toEqual([
@@ -189,40 +191,36 @@ describe('release planning with fixture git repositories', () => {
     });
   });
 
-  it('pushes current release refs to a local bare remote and another clone can fetch them', async () => {
+  it('pushes current release refs to a local bare remote', async () => {
     await withFixtureRepo(async (author) => {
       await writeWorkspace(author);
       await writeBuildablePackage(author, '@scope/pushed', 'packages/pushed', '1.0.0');
       await git(author, ['add', '.']);
       await git(author, ['commit', '-m', 'release pushed package']);
+      const releaseSha = await gitOutput(author, ['rev-parse', 'HEAD']);
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main']);
-      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
-      const runner = join(author, 'runner');
-      await git(runner, ['config', 'user.name', 'Test User']);
-      await git(runner, ['config', 'user.email', 'test@example.com']);
       const pkg: ReleasePackageInfo = {
         name: '@scope/pushed',
         projectName: 'pushed',
         path: 'packages/pushed',
         version: '1.0.0',
       };
-      const shell = new LocalGitRepairShell(runner);
+      const shell = new LocalGitRepairShell(author);
 
       const summary = await completeReleaseAtHead(shell, [pkg], false, false);
 
       expect(summary.pushed).toBe(true);
       expect(shell.pushes).toEqual([['pushed@1.0.0']]);
-      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'auditor']);
-      const auditor = join(author, 'auditor');
-      await git(auditor, ['fetch', '--tags', 'origin', 'main']);
-      await expect(gitOutput(auditor, ['rev-parse', 'refs/tags/pushed@1.0.0^{}'])).resolves.toBe(
-        await gitOutput(runner, ['rev-parse', 'HEAD']),
-      );
-      await expect(gitSucceeds(auditor, ['rev-parse', '--verify', 'refs/tags/@scope/pushed@1.0.0'])).resolves.toBe(
-        false,
-      );
+      const remoteTags = await gitOutput(author, [
+        'ls-remote',
+        '--tags',
+        'origin',
+        'refs/tags/pushed@1.0.0^{}',
+        'refs/tags/@scope/pushed@1.0.0^{}',
+      ]);
+      expect(remoteTags).toBe(`${releaseSha}\trefs/tags/pushed@1.0.0^{}`);
     });
   });
 
@@ -295,6 +293,7 @@ class LocalGitRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
   readonly publishes: Array<{ name: string; version: string; distTag: string; dryRun: boolean }> = [];
   readonly githubCreates: Array<{ name: string; version: string; dryRun: boolean }> = [];
   devenvLoads = 0;
+  readonly devenvRefs: string[] = [];
 
   constructor(private readonly root: string) {}
 
@@ -360,6 +359,9 @@ class LocalGitRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
 
   async withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T> {
     this.devenvLoads += 1;
+    const currentRef = await this.gitHead();
+    this.devenvRefs.push(currentRef);
+    await writeFile(join(this.root, '.generated-tool-ref'), `${currentRef}\n`);
     return runWithEnv();
   }
 

package/src/release/__tests__/github-release.test.ts

@@ -4,6 +4,7 @@ import type { ReleasePackageInfo } from '../core.js';
 import {
   createOrUpdateGithubRelease,
   type GithubReleaseWriteShell,
+  githubReleaseLookupExists,
   nxProjectChangelogArgs,
   projectChangelogContents,
 } from '../github-release.js';
@@ -26,6 +27,7 @@ describe('GitHub release helpers', () => {
       gitPush: false,
       stageChanges: false,
       createRelease: false,
+      forceChangelogGeneration: true,
       deleteVersionPlans: false,
       dryRun: false,
       from: 'pkg@1.2.2',
@@ -41,6 +43,7 @@ describe('GitHub release helpers', () => {
       gitPush: false,
       stageChanges: false,
       createRelease: false,
+      forceChangelogGeneration: true,
       deleteVersionPlans: false,
       dryRun: true,
       firstRelease: true,
@@ -66,6 +69,14 @@ describe('GitHub release helpers', () => {
     );
   });
 
+  it('distinguishes missing releases from transient GitHub lookup failures', () => {
+    expect(githubReleaseLookupExists('pkg@1.2.3', 0, '{"tagName":"pkg@1.2.3"}', '')).toBe(true);
+    expect(githubReleaseLookupExists('pkg@1.2.3', 1, '', 'HTTP 404: release not found')).toBe(false);
+    expect(() => githubReleaseLookupExists('pkg@1.2.3', 1, '', 'HTTP 503: Service Unavailable')).toThrow(
+      'Unable to inspect GitHub Release pkg@1.2.3.\nHTTP 503: Service Unavailable',
+    );
+  });
+
   it('creates a missing stable GitHub Release from the generated notes file', async () => {
     const shell = new RecordingGithubReleaseShell(false);
 

package/src/release/__tests__/orchestration.test.ts

@@ -2,7 +2,9 @@ import { describe, expect, it } from 'bun:test';
 import { type ReleasePackageInfo, type ReleaseTarget, releaseTag } from '../core.js';
 import {
   bumpStableReleaseToNext,
+  collectRepairPlatformOutputs,
   completeReleaseAtHead,
+  type ReleaseRepairOutputsShell,
   type ReleaseRepairShell,
   type ReleaseVersionShell,
   repairPendingTargets,
@@ -23,14 +25,16 @@ const prerelease: ReleasePackageInfo = {
 };
 
 describe('release orchestration', () => {
-  it('repairs an older target with one checkout, one devenv load, npm-only build, and GitHub create calls', async () => {
+  it('repairs an older target and refreshes devenv after restoring the caller ref', async () => {
     const target = releaseTarget('older-release', [stable, prerelease], [stable], [prerelease]);
     const shell = new RecordingRepairShell();
 
     const summaries = await repairPendingTargets(shell, [target], 'restore-ref', false);
 
     expect(shell.checkouts).toEqual(['older-release', 'restore-ref']);
-    expect(shell.devenvLoads).toBe(1);
+    expect(shell.devenvLoads).toBe(2);
+    expect(shell.devenvRefs).toEqual(['older-release', 'restore-ref']);
+    expect(shell.prepares).toEqual(['older-release']);
     expect(shell.builds).toEqual([['@scope/stable']]);
     expect(shell.publishes).toEqual([{ name: '@scope/stable', distTag: 'latest', dryRun: false }]);
     expect(shell.githubCreates).toEqual([{ name: '@scope/prerelease', dryRun: false }]);
@@ -78,6 +82,29 @@ describe('release orchestration', () => {
     ]);
   });
 
+  it('collects historical platform outputs only for npm-missing repair targets', async () => {
+    const githubOnly = releaseTarget('github-only', [prerelease], [], [prerelease]);
+    const npmMissing = releaseTarget('npm-missing', [stable], [stable], []);
+    const shell = new RecordingRepairOutputsShell();
+
+    await collectRepairPlatformOutputs(shell, [githubOnly, npmMissing], 'restore-ref');
+
+    expect(shell.checkouts).toEqual(['npm-missing', 'restore-ref']);
+    expect(shell.devenvRefs).toEqual(['npm-missing', 'restore-ref']);
+    expect(shell.collected).toEqual(['npm-missing']);
+  });
+
+  it('does nothing when no pending release needs npm platform outputs', async () => {
+    const shell = new RecordingRepairOutputsShell();
+    const githubOnly = releaseTarget('github-only', [prerelease], [], [prerelease]);
+
+    await collectRepairPlatformOutputs(shell, [githubOnly], 'restore-ref');
+
+    expect(shell.checkouts).toEqual([]);
+    expect(shell.devenvRefs).toEqual([]);
+    expect(shell.collected).toEqual([]);
+  });
+
   it('publishes a partial HEAD release by building npm-missing packages and creating missing GitHub Releases', async () => {
     const shell = new RecordingRepairShell({ npmMissing: ['@scope/stable'], githubMissing: ['@scope/prerelease'] });
 
@@ -216,15 +243,21 @@ class RecordingRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
   readonly npmQueries: string[][] = [];
   readonly githubQueries: string[][] = [];
   devenvLoads = 0;
+  readonly devenvRefs: string[] = [];
   currentRef = 'head';
   private readonly npmMissing: Set<string>;
   private readonly githubMissing: Set<string>;
+  readonly prepares: string[] = [];
 
   constructor(options: { npmMissing?: string[]; githubMissing?: string[] } = {}) {
     this.npmMissing = new Set(options.npmMissing ?? []);
     this.githubMissing = new Set(options.githubMissing ?? []);
   }
 
+  async prepareRepairTarget(target: ReleaseTarget<ReleasePackageInfo>): Promise<void> {
+    this.prepares.push(target.sha);
+  }
+
   async gitHead(): Promise<string> {
     return this.currentRef;
   }
@@ -264,10 +297,32 @@ class RecordingRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
 
   async withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T> {
     this.devenvLoads += 1;
+    this.devenvRefs.push(this.currentRef);
     return runWithEnv();
   }
 }
 
+class RecordingRepairOutputsShell implements ReleaseRepairOutputsShell<ReleasePackageInfo> {
+  readonly checkouts: string[] = [];
+  readonly collected: string[] = [];
+  readonly devenvRefs: string[] = [];
+  private currentRef = 'head';
+
+  async checkout(ref: string): Promise<void> {
+    this.currentRef = ref;
+    this.checkouts.push(ref);
+  }
+
+  async withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T> {
+    this.devenvRefs.push(this.currentRef);
+    return runWithEnv();
+  }
+
+  async collectRepairTargetOutputs(target: ReleaseTarget<ReleasePackageInfo>): Promise<void> {
+    this.collected.push(target.sha);
+  }
+}
+
 class RecordingVersionShell implements ReleaseVersionShell<ReleasePackageInfo> {
   readonly ensureCalls: string[][] = [];
   readonly nxRuns: Array<{ packages: string[]; bump: string; dryRun: boolean }> = [];

package/src/release/__tests__/trust-publisher.test.ts

@@ -3,8 +3,11 @@ import type { BootstrapNpmPackagesOptions } from '../bootstrap-npm-packages.js';
 import type { ReleasePackageInfo } from '../core.js';
 import {
   configureTrustedPublishers,
+  npmTrustGithubArgs,
+  npmTrustListAccessDenied,
   parseTrustedPublishers,
   type TrustedPublisher,
+  type TrustedPublisherLookup,
   type TrustPublisherShell,
 } from '../index.js';
 
@@ -101,6 +104,84 @@ describe('trusted publisher setup', () => {
     expect(shell.events).toEqual([`exists:${missing.name}`, `list:${missing.name}`, `trust:${missing.name}:false`]);
   });
 
+  it('reports package owners and opens npm login after trust access is denied', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublisherResponses: {
+        [stable.name]: [
+          {
+            status: 'access-denied',
+            identity: 'current-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+          [],
+        ],
+      },
+    });
+
+    await configureTrustedPublishers(shell, {});
+
+    expect(shell.events).toEqual([
+      `exists:${stable.name}`,
+      `list:${stable.name}`,
+      'login',
+      `list:${stable.name}`,
+      `trust:${stable.name}:false`,
+    ]);
+    expect(shell.errors.join('\n')).toContain('npm account "current-user"');
+    expect(shell.errors.join('\n')).toContain('package-owner <owner@example.test>');
+    expect(shell.logs).toContain(
+      `${stable.name}: opening npm browser login. Sign in as a listed package owner, then return here.`,
+    );
+  });
+
+  it('stops after one owner login when the selected account still lacks access', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublisherResponses: {
+        [stable.name]: [
+          {
+            status: 'access-denied',
+            identity: 'current-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+          {
+            status: 'access-denied',
+            identity: 'wrong-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+        ],
+      },
+    });
+
+    await expect(configureTrustedPublishers(shell, {})).rejects.toThrow(
+      'npm browser login completed, but the selected account still cannot manage this package',
+    );
+    expect(shell.events).toEqual([`exists:${stable.name}`, `list:${stable.name}`, 'login', `list:${stable.name}`]);
+  });
+
+  it('grants the trusted workflow permission to run npm publish', () => {
+    expect(npmTrustGithubArgs(stable.name, 'scope/repo', 'publish.yml', false)).toEqual([
+      'trust',
+      'github',
+      stable.name,
+      '--file',
+      'publish.yml',
+      '--repo',
+      'scope/repo',
+      '--allow-publish',
+      '--yes',
+    ]);
+    expect(npmTrustGithubArgs(stable.name, 'scope/repo', 'publish.yml', true).at(-1)).toBe('--dry-run');
+  });
+
+  it('recognizes npm trust access-denied output', () => {
+    expect(npmTrustListAccessDenied('{"error":{"code":"E403"}}', '')).toBe(true);
+    expect(npmTrustListAccessDenied('', 'npm error code EOTP')).toBe(false);
+  });
+
   it('parses empty npm trust list output as no trusted publishers', () => {
     expect(parseTrustedPublishers('', stable.name)).toEqual([]);
     expect(parseTrustedPublishers('null', stable.name)).toEqual([]);
@@ -116,15 +197,18 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
   private readonly packages: ReleasePackageInfo[];
   private readonly existing: Set<string>;
   private readonly trustedPublisherByPackage: Record<string, TrustedPublisher[]>;
+  private readonly trustedPublisherResponses: Record<string, TrustedPublisherLookup[]>;
 
   constructor(options: {
     packages: ReleasePackageInfo[];
     existing: string[];
     trustedPublishers?: Record<string, TrustedPublisher[]>;
+    trustedPublisherResponses?: Record<string, TrustedPublisherLookup[]>;
   }) {
     this.packages = options.packages;
     this.existing = new Set(options.existing);
     this.trustedPublisherByPackage = options.trustedPublishers ?? {};
+    this.trustedPublisherResponses = options.trustedPublisherResponses ?? {};
   }
 
   listReleasePackages(): ReleasePackageInfo[] {
@@ -145,14 +229,19 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
     return missingPackages;
   }
 
+  async login(): Promise<void> {
+    this.events.push('login');
+  }
+
   async trustPublisher(pkg: ReleasePackageInfo, dryRun: boolean): Promise<'configured' | 'already-configured'> {
     this.events.push(`trust:${pkg.name}:${dryRun}`);
     return 'configured';
   }
 
-  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisher[]> {
+  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisherLookup> {
     this.events.push(`list:${pkg.name}`);
-    return this.trustedPublisherByPackage[pkg.name] ?? [];
+    const response = this.trustedPublisherResponses[pkg.name]?.shift();
+    return response ?? this.trustedPublisherByPackage[pkg.name] ?? [];
   }
 
   log(message: string): void {

package/src/release/github-release.ts

@@ -71,6 +71,7 @@ export function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previousTag: str
     gitPush: false,
     stageChanges: false,
     createRelease: false,
+    forceChangelogGeneration: true,
     deleteVersionPlans: false,
     dryRun,
   } satisfies ChangelogOptions;
@@ -85,6 +86,17 @@ export function projectChangelogContents(result: ProjectChangelogLookupResult, p
   return changelog.contents;
 }
 
+export function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean {
+  if (exitCode === 0) {
+    return true;
+  }
+  const details = [stderr.trim(), stdout.trim()].filter(Boolean).join('\n');
+  if (/\bHTTP 404\b|release not found/i.test(details)) {
+    return false;
+  }
+  throw new Error(`Unable to inspect GitHub Release ${tag}.${details ? `\n${details}` : ''}`);
+}
+
 export function githubReleaseCommandArgs(
   tag: string,
   notesFile: string,