@smoothbricks/cli 0.11.15 → 0.11.16

package/src/release/__tests__/private-npm-status.test.ts

@@ -433,6 +433,43 @@ describe('private npm published-version status', () => {
     });
   });
 
+  it('reads through a repository .npmrc whose own auth line names an unset env', async () => {
+    // The shape that cost a day: AxE commits
+    // `//host/path:_authToken=${AXE_NPM_PUBLISH_TOKEN}` at the workspace root.
+    // npm ranks that project file ABOVE the userconfig this CLI writes, so with
+    // the publish env unset it sent the unexpanded value and the registry
+    // answered 401 — with a perfectly good read credential in hand.
+    await withStatusFixture(async ({ fixture, root, userconfig }) => {
+      await fixture.privateRegistry.publishPackage({ name: PRIVATE_PACKAGE, version: PRIVATE_VERSION });
+      const resolved = loopbackRegistry(fixture.privateRegistry);
+      await writeFile(
+        join(root, '.npmrc'),
+        `${resolved.scope}:registry=${resolved.registry}\n${resolved.authKey}=\${NOT_SET_ANYWHERE}\n`,
+      );
+
+      // Control: with the userconfig alone the project file wins, so the token
+      // npm sends is the unexpanded reference — the registry sees no usable
+      // credential. Asserted on the wire, because a fixture that answers
+      // anonymous reads would let the server's verdict hide it.
+      await npmPublishedVersionExists(root, PRIVATE_PACKAGE, PRIVATE_VERSION, {
+        registry: fixture.privateRegistry.registry,
+        userconfig,
+      });
+      const overridden = fixture.privateRegistry.requestsFor('probe').at(-1);
+      expect(overridden?.authorization ?? '').not.toContain(FIXTURE_READ_TOKEN);
+
+      await expect(
+        npmPublishedVersionExists(root, PRIVATE_PACKAGE, PRIVATE_VERSION, {
+          registry: fixture.privateRegistry.registry,
+          userconfig,
+          credential: { authKey: resolved.authKey, tokenEnv: FIXTURE_READ_TOKEN_ENV },
+        }),
+      ).resolves.toBe(true);
+      const authenticated = fixture.privateRegistry.requestsFor('probe').at(-1);
+      expect(authenticated?.authorization ?? '').toContain(FIXTURE_READ_TOKEN);
+    });
+  });
+
   it('reports a genuine not-found as absent', async () => {
     await withStatusFixture(async ({ fixture, root, userconfig }) => {
       fixture.privateRegistry.failWith(404);

package/src/release/__tests__/private-npm-workflow.test.ts

@@ -86,17 +86,37 @@ describe('private npm workflow token selection', () => {
   });
 
   it('ignores workspace and link specs so a producer install does not look like a registry consume', async () => {
+    // Without a declared read token, the .npmrc credential is a publish
+    // credential and must never be promoted into the read role by inference.
     await withRepo(
       {
         privatePackage: `${SCOPE}/sdk`,
         rootDeps: { [`${SCOPE}/sdk`]: 'workspace:*' },
         extraDeps: { [`${SCOPE}/other`]: 'link:@priv.test/other' },
         npmrcAuthEnv: PUBLISH_ENV,
+        declared: { scope: SCOPE, publishTokenEnv: PUBLISH_ENV },
+      },
+      (root) => {
+        expect(resolvePrivateNpmWorkflowConfig(root)).toEqual({
+          scope: SCOPE,
+          publishTokenEnv: PUBLISH_ENV,
+        });
+      },
+    );
+  });
+
+  it('renders a declared read token for a producer, whose later releases read the previous tag state', async () => {
+    await withRepo(
+      {
+        privatePackage: `${SCOPE}/sdk`,
+        rootDeps: { [`${SCOPE}/sdk`]: 'workspace:*' },
+        npmrcAuthEnv: PUBLISH_ENV,
         declared: { scope: SCOPE, readTokenEnv: READ_ENV, publishTokenEnv: PUBLISH_ENV },
       },
       (root) => {
         expect(resolvePrivateNpmWorkflowConfig(root)).toEqual({
           scope: SCOPE,
+          readTokenEnv: READ_ENV,
           publishTokenEnv: PUBLISH_ENV,
         });
       },

package/src/release/index.ts

@@ -48,6 +48,7 @@ export {
   type PrivateNpmRegistryConfigErrorKind,
   type PublishDestination,
   privateNpmPublishArgs,
+  privateNpmTokenEnvForMode,
   privateNpmUserconfigContent,
   publishPrivateWithDiagnostics,
   type Result as PrivateNpmResult,
@@ -58,6 +59,7 @@ export {
   withPrivateNpmUserconfig,
 } from './private-npm.js';
 
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { ciApiContext } from '../github-ci/api.js';
 import { readProjectTargets } from '../nx/index.js';
 import {
@@ -114,6 +116,7 @@ import {
   npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry,
   type PrivateNpmRegistry,
   privateNpmPublishArgs,
+  privateNpmTokenEnvForMode,
   publishPrivateWithDiagnostics,
   selectPublishDestination,
   selectRegistryForPackage,
@@ -754,7 +757,13 @@ async function publishPrivatePackedPackage(
       await publishPrivateWithDiagnostics(
         pkg,
         {
-          publish: () => runNpm(root, args, { NPM_CONFIG_USERCONFIG: userconfig }),
+          publish: () =>
+            runNpm(root, args, {
+              NPM_CONFIG_USERCONFIG: userconfig,
+              // Env config outranks a committed project `.npmrc` auth line; see
+              // npmStatusEnv in private-npm.ts for why that matters here.
+              [`npm_config_${registry.authKey}`]: process.env[privateNpmTokenEnvForMode(registry, 'publish')] ?? '',
+            }),
           // The open publish userconfig already authenticates this registry,
           // so the failure probe reuses it. Opening a second read-mode
           // userconfig here demanded a read credential the publishing job need
@@ -764,6 +773,7 @@ async function publishPrivatePackedPackage(
             npmPublishedVersionExistsOnRegistry(root, pkg.name, pkg.version, {
               registry: registry.registry,
               userconfig,
+              credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'publish') },
             }),
           log: (message) => console.log(message),
           error: (message) => console.error(message),
@@ -1197,6 +1207,17 @@ function releaseRepairShell(root: string, platformOutputs: readonly string[]): R
       const sourceSha = await gitHead(root);
       const outputs = platformOutputs.map((base) => join(base, sourceSha));
       if (outputs.length === 0) {
+        // No producer job handed outputs over, so this runner is the producer:
+        // build the platform legs at the checked-out ref. `build` alone gives a
+        // package only the legs its own graph depends on — the host one and
+        // whatever it declares — and the release gate demands the whole declared
+        // native closure, so a foreign leg it never asked for was simply absent.
+        console.log('Repair pending releases: building cross-platform outputs on this runner.');
+        await githubCiNxRunMany(root, {
+          targets: PLATFORM_TARGET_GLOBS.join(','),
+          projects: releasePackageProjects(packages),
+          allowEmptyProjects: true,
+        });
         return;
       }
       console.log(`Repair pending releases: applying cross-platform outputs from ${outputs.join(', ')}.`);
@@ -1865,7 +1886,11 @@ async function npmVersionExists(root: string, name: string, version: string): Pr
     return npmPublishedVersionExistsOnRegistry(root, name, version);
   }
   return withPrivateNpmUserconfig(registry, 'read', (userconfig) =>
-    npmPublishedVersionExistsOnRegistry(root, name, version, { registry: registry.registry, userconfig }),
+    npmPublishedVersionExistsOnRegistry(root, name, version, {
+      registry: registry.registry,
+      userconfig,
+      credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'read') },
+    }),
   );
 }
 

package/src/release/private-npm.ts

@@ -247,7 +247,12 @@ export function resolvePrivateNpmWorkflowConfig(root: string): PackagePrivateNpm
     return undefined;
   }
   const npmrcEnv = npmrcAuthTokenEnv(root, declared.scope);
-  const readTokenEnv = consumes ? (declared.readTokenEnv ?? npmrcEnv) : undefined;
+  // A publishing workspace reads the registry too: every release after the
+  // first checks the previous tag's durable state, and that check runs in the
+  // producer jobs that never see the publish credential. A declared read token
+  // therefore always renders; only the .npmrc fallback stays consumer-only, so
+  // a publish token is never promoted into a read role by inference.
+  const readTokenEnv = declared.readTokenEnv ?? (consumes ? npmrcEnv : undefined);
   const publishTokenEnv = publishes ? (declared.publishTokenEnv ?? npmrcEnv) : undefined;
   if (!readTokenEnv && !publishTokenEnv) {
     return undefined;
@@ -412,10 +417,30 @@ export async function withPrivateNpmUserconfig<T>(
 export interface NpmStatusOptions {
   registry?: string;
   userconfig?: string;
+  /** Path-scoped auth key and token env, so the credential can ride env config. */
+  credential?: { authKey: string; tokenEnv: string };
 }
 
-function npmStatusEnv(userconfig: string | undefined): Record<string, string> | undefined {
-  return userconfig ? { NPM_CONFIG_USERCONFIG: userconfig } : undefined;
+/**
+ * npm config precedence is cli > env > project `.npmrc` > userconfig. A
+ * repository that commits its own `//host/path:_authToken=${SOME_ENV}` line
+ * therefore OVERRIDES the userconfig this module writes, and when that env is
+ * unset npm sends the unexpanded value: the registry answers 401 on reads with
+ * a perfectly good read credential, naming nothing. So the credential also
+ * rides as env config, which the project file cannot outrank, and the token
+ * value stays out of every file on disk.
+ */
+function npmStatusEnv(
+  userconfig: string | undefined,
+  credential?: { authKey: string; tokenEnv: string },
+): Record<string, string> | undefined {
+  if (!userconfig) return undefined;
+  const env: Record<string, string> = { NPM_CONFIG_USERCONFIG: userconfig };
+  const token = credential ? process.env[credential.tokenEnv] : undefined;
+  if (credential && token) {
+    env[`npm_config_${credential.authKey}`] = token;
+  }
+  return env;
 }
 
 function npmCommandFailedMessage(npmArgs: string[], exitCode: number, stdout = '', stderr = ''): string {
@@ -439,7 +464,7 @@ export async function npmPublishedVersionExists(
   if (options.registry) {
     args.push('--registry', options.registry);
   }
-  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
   if (result.exitCode === 0) {
     return true;
   }
@@ -455,7 +480,7 @@ export async function npmPackageExists(root: string, name: string, options: NpmS
   if (options.registry) {
     args.push('--registry', options.registry);
   }
-  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
   if (result.exitCode === 0) {
     return true;
   }