@smoothbricks/cli 0.11.14 → 0.11.16

package/src/release/index.ts

@@ -48,6 +48,7 @@ export {
   type PrivateNpmRegistryConfigErrorKind,
   type PublishDestination,
   privateNpmPublishArgs,
+  privateNpmTokenEnvForMode,
   privateNpmUserconfigContent,
   publishPrivateWithDiagnostics,
   type Result as PrivateNpmResult,
@@ -58,6 +59,7 @@ export {
   withPrivateNpmUserconfig,
 } from './private-npm.js';
 
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { ciApiContext } from '../github-ci/api.js';
 import { readProjectTargets } from '../nx/index.js';
 import {
@@ -88,6 +90,7 @@ import {
 import {
   createOrUpdateGithubRelease,
   githubReleaseLookupExists,
+  importWorkspaceNx,
   renderNxProjectChangelogContents,
   withNxWorkspaceRoot,
 } from './github-release.js';
@@ -113,6 +116,7 @@ import {
   npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry,
   type PrivateNpmRegistry,
   privateNpmPublishArgs,
+  privateNpmTokenEnvForMode,
   publishPrivateWithDiagnostics,
   selectPublishDestination,
   selectRegistryForPackage,
@@ -753,7 +757,13 @@ async function publishPrivatePackedPackage(
       await publishPrivateWithDiagnostics(
         pkg,
         {
-          publish: () => runNpm(root, args, { NPM_CONFIG_USERCONFIG: userconfig }),
+          publish: () =>
+            runNpm(root, args, {
+              NPM_CONFIG_USERCONFIG: userconfig,
+              // Env config outranks a committed project `.npmrc` auth line; see
+              // npmStatusEnv in private-npm.ts for why that matters here.
+              [`npm_config_${registry.authKey}`]: process.env[privateNpmTokenEnvForMode(registry, 'publish')] ?? '',
+            }),
           // The open publish userconfig already authenticates this registry,
           // so the failure probe reuses it. Opening a second read-mode
           // userconfig here demanded a read credential the publishing job need
@@ -763,6 +773,7 @@ async function publishPrivatePackedPackage(
             npmPublishedVersionExistsOnRegistry(root, pkg.name, pkg.version, {
               registry: registry.registry,
               userconfig,
+              credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'publish') },
             }),
           log: (message) => console.log(message),
           error: (message) => console.error(message),
@@ -881,8 +892,8 @@ async function runNxReleaseVersion(
 
 async function runNxReleaseVersionPreview(root: string, projects: string, bump: string): Promise<ReleasePackage[]> {
   return withNxWorkspaceRoot(root, async () => {
-    const { createAPI } = await import('nx/src/command-line/release/version.js');
-    const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+    const { createAPI } = await importWorkspaceNx(root, 'src/command-line/release/version.js');
+    const { createAPI: createChangelogAPI } = await importWorkspaceNx(root, 'src/command-line/release/changelog.js');
     const projectNames = projects.split(',').filter(Boolean);
     const result = await createAPI(
       {},
@@ -1196,6 +1207,17 @@ function releaseRepairShell(root: string, platformOutputs: readonly string[]): R
       const sourceSha = await gitHead(root);
       const outputs = platformOutputs.map((base) => join(base, sourceSha));
       if (outputs.length === 0) {
+        // No producer job handed outputs over, so this runner is the producer:
+        // build the platform legs at the checked-out ref. `build` alone gives a
+        // package only the legs its own graph depends on — the host one and
+        // whatever it declares — and the release gate demands the whole declared
+        // native closure, so a foreign leg it never asked for was simply absent.
+        console.log('Repair pending releases: building cross-platform outputs on this runner.');
+        await githubCiNxRunMany(root, {
+          targets: PLATFORM_TARGET_GLOBS.join(','),
+          projects: releasePackageProjects(packages),
+          allowEmptyProjects: true,
+        });
         return;
       }
       console.log(`Repair pending releases: applying cross-platform outputs from ${outputs.join(', ')}.`);
@@ -1864,7 +1886,11 @@ async function npmVersionExists(root: string, name: string, version: string): Pr
     return npmPublishedVersionExistsOnRegistry(root, name, version);
   }
   return withPrivateNpmUserconfig(registry, 'read', (userconfig) =>
-    npmPublishedVersionExistsOnRegistry(root, name, version, { registry: registry.registry, userconfig }),
+    npmPublishedVersionExistsOnRegistry(root, name, version, {
+      registry: registry.registry,
+      userconfig,
+      credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'read') },
+    }),
   );
 }
 

package/src/release/private-npm.ts

@@ -247,7 +247,12 @@ export function resolvePrivateNpmWorkflowConfig(root: string): PackagePrivateNpm
     return undefined;
   }
   const npmrcEnv = npmrcAuthTokenEnv(root, declared.scope);
-  const readTokenEnv = consumes ? (declared.readTokenEnv ?? npmrcEnv) : undefined;
+  // A publishing workspace reads the registry too: every release after the
+  // first checks the previous tag's durable state, and that check runs in the
+  // producer jobs that never see the publish credential. A declared read token
+  // therefore always renders; only the .npmrc fallback stays consumer-only, so
+  // a publish token is never promoted into a read role by inference.
+  const readTokenEnv = declared.readTokenEnv ?? (consumes ? npmrcEnv : undefined);
   const publishTokenEnv = publishes ? (declared.publishTokenEnv ?? npmrcEnv) : undefined;
   if (!readTokenEnv && !publishTokenEnv) {
     return undefined;
@@ -412,10 +417,30 @@ export async function withPrivateNpmUserconfig<T>(
 export interface NpmStatusOptions {
   registry?: string;
   userconfig?: string;
+  /** Path-scoped auth key and token env, so the credential can ride env config. */
+  credential?: { authKey: string; tokenEnv: string };
 }
 
-function npmStatusEnv(userconfig: string | undefined): Record<string, string> | undefined {
-  return userconfig ? { NPM_CONFIG_USERCONFIG: userconfig } : undefined;
+/**
+ * npm config precedence is cli > env > project `.npmrc` > userconfig. A
+ * repository that commits its own `//host/path:_authToken=${SOME_ENV}` line
+ * therefore OVERRIDES the userconfig this module writes, and when that env is
+ * unset npm sends the unexpanded value: the registry answers 401 on reads with
+ * a perfectly good read credential, naming nothing. So the credential also
+ * rides as env config, which the project file cannot outrank, and the token
+ * value stays out of every file on disk.
+ */
+function npmStatusEnv(
+  userconfig: string | undefined,
+  credential?: { authKey: string; tokenEnv: string },
+): Record<string, string> | undefined {
+  if (!userconfig) return undefined;
+  const env: Record<string, string> = { NPM_CONFIG_USERCONFIG: userconfig };
+  const token = credential ? process.env[credential.tokenEnv] : undefined;
+  if (credential && token) {
+    env[`npm_config_${credential.authKey}`] = token;
+  }
+  return env;
 }
 
 function npmCommandFailedMessage(npmArgs: string[], exitCode: number, stdout = '', stderr = ''): string {
@@ -439,7 +464,7 @@ export async function npmPublishedVersionExists(
   if (options.registry) {
     args.push('--registry', options.registry);
   }
-  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
   if (result.exitCode === 0) {
     return true;
   }
@@ -455,7 +480,7 @@ export async function npmPackageExists(root: string, name: string, options: NpmS
   if (options.registry) {
     args.push('--registry', options.registry);
   }
-  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
   if (result.exitCode === 0) {
     return true;
   }