@smoothbricks/cli 0.10.2 → 0.10.4

package/src/release/__tests__/trust-publisher.test.ts

@@ -3,8 +3,11 @@ import type { BootstrapNpmPackagesOptions } from '../bootstrap-npm-packages.js';
 import type { ReleasePackageInfo } from '../core.js';
 import {
   configureTrustedPublishers,
+  npmTrustGithubArgs,
+  npmTrustListAccessDenied,
   parseTrustedPublishers,
   type TrustedPublisher,
+  type TrustedPublisherLookup,
   type TrustPublisherShell,
 } from '../index.js';
 
@@ -101,6 +104,91 @@ describe('trusted publisher setup', () => {
     expect(shell.events).toEqual([`exists:${missing.name}`, `list:${missing.name}`, `trust:${missing.name}:false`]);
   });
 
+  it('reports package owners and opens npm login after trust access is denied', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublisherResponses: {
+        [stable.name]: [
+          {
+            status: 'access-denied',
+            identity: 'current-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+          [],
+        ],
+      },
+    });
+
+    await configureTrustedPublishers(shell, {});
+
+    expect(shell.events).toEqual([
+      `exists:${stable.name}`,
+      `list:${stable.name}`,
+      'login',
+      `list:${stable.name}`,
+      `trust:${stable.name}:false`,
+    ]);
+    expect(shell.errors.join('\n')).toContain('npm account "current-user"');
+    expect(shell.errors.join('\n')).toContain('package-owner <owner@example.test>');
+    expect(shell.logs).toContain(
+      `${stable.name}: opening npm browser login. Sign in as a listed package owner, then return here.`,
+    );
+  });
+
+  it('stops after one owner login when the selected account still lacks access', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublisherResponses: {
+        [stable.name]: [
+          {
+            status: 'access-denied',
+            identity: 'current-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+          {
+            status: 'access-denied',
+            identity: 'wrong-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+        ],
+      },
+    });
+
+    await expect(configureTrustedPublishers(shell, {})).rejects.toThrow(
+      'npm browser login completed, but the selected account still cannot manage this package',
+    );
+    expect(shell.events).toEqual([`exists:${stable.name}`, `list:${stable.name}`, 'login', `list:${stable.name}`]);
+  });
+
+  it('grants the trusted workflow permission to run npm publish', () => {
+    expect(npmTrustGithubArgs(stable.name, 'scope/repo', 'publish.yml', false)).toEqual([
+      'trust',
+      'github',
+      stable.name,
+      '--file',
+      'publish.yml',
+      '--repo',
+      'scope/repo',
+      '--allow-publish',
+      '--yes',
+    ]);
+    expect(npmTrustGithubArgs(stable.name, 'scope/repo', 'publish.yml', true).at(-1)).toBe('--dry-run');
+  });
+
+  it('recognizes npm trust access-denied output', () => {
+    expect(npmTrustListAccessDenied('{"error":{"code":"E403"}}', '')).toBe(true);
+    expect(npmTrustListAccessDenied('', 'npm error code E401')).toBe(true);
+    expect(
+      npmTrustListAccessDenied(
+        '',
+        'npm error 401 Unauthorized - GET https://registry.npmjs.org/-/package/@scope%2fpkg/trust - {"success":false,"error":"You must be logged in to publish packages."}',
+      ),
+    ).toBe(true);
+    expect(npmTrustListAccessDenied('', 'npm error code EOTP')).toBe(false);
+  });
+
   it('parses empty npm trust list output as no trusted publishers', () => {
     expect(parseTrustedPublishers('', stable.name)).toEqual([]);
     expect(parseTrustedPublishers('null', stable.name)).toEqual([]);
@@ -116,15 +204,18 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
   private readonly packages: ReleasePackageInfo[];
   private readonly existing: Set<string>;
   private readonly trustedPublisherByPackage: Record<string, TrustedPublisher[]>;
+  private readonly trustedPublisherResponses: Record<string, TrustedPublisherLookup[]>;
 
   constructor(options: {
     packages: ReleasePackageInfo[];
     existing: string[];
     trustedPublishers?: Record<string, TrustedPublisher[]>;
+    trustedPublisherResponses?: Record<string, TrustedPublisherLookup[]>;
   }) {
     this.packages = options.packages;
     this.existing = new Set(options.existing);
     this.trustedPublisherByPackage = options.trustedPublishers ?? {};
+    this.trustedPublisherResponses = options.trustedPublisherResponses ?? {};
   }
 
   listReleasePackages(): ReleasePackageInfo[] {
@@ -145,14 +236,19 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
     return missingPackages;
   }
 
+  async login(): Promise<void> {
+    this.events.push('login');
+  }
+
   async trustPublisher(pkg: ReleasePackageInfo, dryRun: boolean): Promise<'configured' | 'already-configured'> {
     this.events.push(`trust:${pkg.name}:${dryRun}`);
     return 'configured';
   }
 
-  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisher[]> {
+  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisherLookup> {
     this.events.push(`list:${pkg.name}`);
-    return this.trustedPublisherByPackage[pkg.name] ?? [];
+    const response = this.trustedPublisherResponses[pkg.name]?.shift();
+    return response ?? this.trustedPublisherByPackage[pkg.name] ?? [];
   }
 
   log(message: string): void {

package/src/release/candidates.ts

@@ -1,4 +1,4 @@
-import { isRecord } from '../lib/json.js';
+import type { PackageJson } from '../lib/json.js';
 import type { ReleasePackageInfo } from './core.js';
 import { releaseTag } from './core.js';
 
@@ -6,8 +6,8 @@ export interface AutoReleaseCandidateShell {
   gitRefExists(ref: string): Promise<boolean>;
   latestStableReleaseRef(projectName: string): Promise<string | null>;
   packageChangedFilesSince(ref: string, packagePath: string): Promise<string[]>;
-  packageJsonAtRef(ref: string, packagePath: string): Promise<Record<string, unknown> | null>;
-  currentPackageJson(packagePath: string): Promise<Record<string, unknown> | null>;
+  packageJsonAtRef(ref: string, packagePath: string): Promise<PackageJson | null>;
+  currentPackageJson(packagePath: string): Promise<PackageJson | null>;
   packageBuildInputPatterns(projectName: string, packagePath: string): Promise<string[]>;
   packageHasHistory(packagePath: string): Promise<boolean>;
 }
@@ -104,23 +104,16 @@ async function packageHasReleasableChangesSince<Package extends ReleasePackageIn
   return false;
 }
 
-function releasableManifestChanged(
-  previousManifest: Record<string, unknown>,
-  currentManifest: Record<string, unknown>,
-): boolean {
+function releasableManifestChanged(previousManifest: PackageJson, currentManifest: PackageJson): boolean {
   for (const key of releasableManifestKeys) {
-    if (!stableJsonEqual(previousManifest[key], currentManifest[key])) {
+    if (!stableJsonEqual(Reflect.get(previousManifest, key), Reflect.get(currentManifest, key))) {
       return true;
     }
   }
   return false;
 }
 
-function isReleasablePackagePath(
-  path: string,
-  manifest: Record<string, unknown> | null,
-  buildInputPatterns: string[],
-): boolean {
+function isReleasablePackagePath(path: string, manifest: PackageJson | null, buildInputPatterns: string[]): boolean {
   return (
     isBuildInputPath(path, buildInputPatterns) || isPackageMetadataPath(path) || isManifestFilesPath(path, manifest)
   );
@@ -195,13 +188,13 @@ function isPackageMetadataPath(path: string): boolean {
   return /^(README|LICENSE|CHANGELOG)(\.|$)/.test(path);
 }
 
-function isManifestFilesPath(path: string, manifest: Record<string, unknown> | null): boolean {
+function isManifestFilesPath(path: string, manifest: PackageJson | null): boolean {
   const files = manifest?.files;
   if (!Array.isArray(files)) {
     return false;
   }
   for (const entry of files) {
-    if (typeof entry !== 'string' || entry.length === 0 || entry.startsWith('!')) {
+    if (entry.length === 0 || entry.startsWith('!')) {
       continue;
     }
     if (matchesManifestFilesEntry(path, entry)) {
@@ -227,10 +220,10 @@ function stableJson(value: unknown): unknown {
   if (Array.isArray(value)) {
     return value.map(stableJson);
   }
-  if (isRecord(value)) {
+  if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
     const normalized: Record<string, unknown> = {};
     for (const key of Object.keys(value).sort()) {
-      normalized[key] = stableJson(value[key]);
+      normalized[key] = stableJson(Reflect.get(value, key));
     }
     return normalized;
   }

package/src/release/github-release.ts

@@ -71,6 +71,7 @@ export function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previousTag: str
     gitPush: false,
     stageChanges: false,
     createRelease: false,
+    forceChangelogGeneration: true,
     deleteVersionPlans: false,
     dryRun,
   } satisfies ChangelogOptions;
@@ -85,6 +86,17 @@ export function projectChangelogContents(result: ProjectChangelogLookupResult, p
   return changelog.contents;
 }
 
+export function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean {
+  if (exitCode === 0) {
+    return true;
+  }
+  const details = [stderr.trim(), stdout.trim()].filter(Boolean).join('\n');
+  if (/\bHTTP 404\b|release not found/i.test(details)) {
+    return false;
+  }
+  throw new Error(`Unable to inspect GitHub Release ${tag}.${details ? `\n${details}` : ''}`);
+}
+
 export function githubReleaseCommandArgs(
   tag: string,
   notesFile: string,