@tahminator/pipeline 1.0.22 → 1.0.24

package/dist/gh/client.d.ts

@@ -7,7 +7,33 @@ export declare class GitHubClient {
     private readonly tagManager;
     private readonly outputManager;
     private readonly prManager;
-    constructor(ghToken?: string);
+    private constructor();
+    /**
+     * @note `appId` can be `Client ID` or `App ID`. Hover over `appId` for more details.
+     */
+    static createWithGithubAppToken({ appId, privateKey, installationId, }: {
+        /**
+         * get it from https://github.com/settings/apps/<appName> -> `Client ID` or `App ID`
+         */
+        appId: string;
+        privateKey: string;
+        /**
+         * get it from github.com/settings/installations/<installationId>
+         */
+        installationId: string;
+    }): Promise<GitHubClient>;
+    /**
+     * __It is highly recommended that you use `createWithGithubAppToken`, unless you need the "dumb"
+     * features of this client such as, for example, outputting data to `$GITHUB_ENV`__
+     *
+     * This is because the default CI token is not eligible for any automation whatsoever. That includes triggering
+     * CI based off pushes, merges, or anything else of the like.
+     */
+    static createWithDefaultCiToken(): Promise<GitHubClient>;
+    /**
+     * @deprecated use `createWithGithubAppToken`
+     */
+    static createWithPatCiToken(pat: string): Promise<GitHubClient>;
     createTag(...args: Parameters<GitHubTagManager["createTag"]>): Promise<void>;
     outputToGithubOutput(...args: Parameters<GitHubOutputManager["outputToGithubOutput"]>): Promise<void>;
     updateK8sTagWithPR(...args: Parameters<GitHubPRManager["updateK8sTagWithPR"]>): Promise<void>;

package/dist/gh/client.js

@@ -1,3 +1,4 @@
+import { createAppAuth } from "@octokit/auth-app";
 import { Octokit } from "@octokit/rest";
 import { GitHubOutputManager } from "./output";
 import { GitHubPRManager } from "./pr";
@@ -8,19 +9,50 @@ export class GitHubClient {
     tagManager;
     outputManager;
     prManager;
-    constructor(ghToken) {
-        this.isExplicitToken = !!ghToken;
-        const token = ghToken ?? process.env.GH_TOKEN;
-        if (!token) {
-            throw new Error("No GitHub token has been provided & GH_TOKEN cannot be found in environment");
-        }
-        this.client = new Octokit({
-            auth: token,
-        });
+    constructor(client, isExplicitToken) {
+        this.client = client;
+        this.isExplicitToken = isExplicitToken;
         this.tagManager = new GitHubTagManager(this.client, this.isExplicitToken);
         this.outputManager = new GitHubOutputManager();
         this.prManager = new GitHubPRManager(this.client);
     }
+    /**
+     * @note `appId` can be `Client ID` or `App ID`. Hover over `appId` for more details.
+     */
+    static async createWithGithubAppToken({ appId, privateKey, installationId, }) {
+        return new this(new Octokit({
+            authStrategy: createAppAuth,
+            auth: {
+                appId,
+                privateKey,
+                installationId,
+            },
+        }), true);
+    }
+    /**
+     * __It is highly recommended that you use `createWithGithubAppToken`, unless you need the "dumb"
+     * features of this client such as, for example, outputting data to `$GITHUB_ENV`__
+     *
+     * This is because the default CI token is not eligible for any automation whatsoever. That includes triggering
+     * CI based off pushes, merges, or anything else of the like.
+     */
+    static async createWithDefaultCiToken() {
+        const token = process.env.GH_TOKEN;
+        if (!token) {
+            throw new Error("GH_TOKEN cannot be found in environment");
+        }
+        return new this(new Octokit({
+            auth: token,
+        }), false);
+    }
+    /**
+     * @deprecated use `createWithGithubAppToken`
+     */
+    static async createWithPatCiToken(pat) {
+        return new this(new Octokit({
+            auth: pat,
+        }), true);
+    }
     createTag(...args) {
         return this.tagManager.createTag(...args);
     }

package/dist/internal/create-tag/index.js

@@ -1,8 +1,12 @@
 import { GitHubClient } from "../../gh";
 import { Utils } from "../../utils";
 async function main() {
-    const { githubPat } = parseCiEnv(await Utils.getEnvVariables(["ci"]));
-    const ghClient = new GitHubClient(githubPat);
+    const { githubAppAppId, githubAppInstallationId, githubAppPrivateKeyB64 } = parseCiEnv(await Utils.getEnvVariables(["ci"]));
+    const ghClient = await GitHubClient.createWithGithubAppToken({
+        appId: githubAppAppId,
+        installationId: githubAppInstallationId,
+        privateKey: await Utils.decodeBase64EncodedString(githubAppPrivateKeyB64),
+    });
     await ghClient.createTag({
         onPreTagCreate: async (tag) => {
             const file = Bun.file("./package.json");
@@ -14,14 +18,28 @@ async function main() {
     });
 }
 function parseCiEnv(ciEnv) {
-    const githubPat = (() => {
-        const v = ciEnv["GITHUB_PAT"];
+    const githubAppAppId = (() => {
+        const v = ciEnv["GITHUB_APP_APP_ID"];
+        if (!v) {
+            throw new Error("Missing GITHUB_APP_APP_ID from .env.ci");
+        }
+        return v;
+    })();
+    const githubAppInstallationId = (() => {
+        const v = ciEnv["GITHUB_APP_INSTALLATION_ID"];
+        if (!v) {
+            throw new Error("Missing GITHUB_APP_INSTALLATION_ID from .env.ci");
+        }
+        return v;
+    })();
+    const githubAppPrivateKeyB64 = (() => {
+        const v = ciEnv["GITHUB_APP_PRIVATE_KEY_B64"];
         if (!v) {
-            throw new Error("Missing GITHUB_PAT from .env.ci");
+            throw new Error("Missing GITHUB_APP_PRIVATE_KEY_B64 from .env.ci");
         }
         return v;
     })();
-    return { githubPat };
+    return { githubAppAppId, githubAppInstallationId, githubAppPrivateKeyB64 };
 }
 main()
     .then(() => {

package/dist/utils/b64.d.ts

@@ -0,0 +1 @@
+export declare function decodeBase64EncodedString(s: string): string;

package/dist/utils/b64.js

@@ -0,0 +1,3 @@
+export function decodeBase64EncodedString(s) {
+    return Buffer.from(s, "base64").toString("utf-8");
+}

package/dist/utils/client.d.ts

@@ -1,3 +1,4 @@
+import { decodeBase64EncodedString } from "./b64";
 import { isCmdAvailable } from "./cmd";
 import { Colors } from "./colors";
 import { getEnvVariables } from "./env";
@@ -10,4 +11,5 @@ export declare class Utils {
     static generateShortId(...args: Parameters<typeof generateShortId>): string;
     static updateAllPackageJsonsWithVersion(version: string): Promise<void>;
     static isCmdAvailable(...args: Parameters<typeof isCmdAvailable>): Promise<boolean>;
+    static decodeBase64EncodedString(...args: Parameters<typeof decodeBase64EncodedString>): Promise<string>;
 }

package/dist/utils/client.js

@@ -1,4 +1,5 @@
 import { $ } from "bun";
+import { decodeBase64EncodedString } from "./b64";
 import { isCmdAvailable } from "./cmd";
 import { Colors } from "./colors";
 import { getEnvVariables } from "./env";
@@ -29,4 +30,7 @@ export class Utils {
     static async isCmdAvailable(...args) {
         return isCmdAvailable(...args);
     }
+    static async decodeBase64EncodedString(...args) {
+        return decodeBase64EncodedString(...args);
+    }
 }

package/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "author": "Tahmid Ahmed",
   "description": "A collection of Bun shell scripts that can be re-used in various CICD pipelines.",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "repository": {
     "url": "git+https://github.com/tahminator/pipeline.git"
   },
@@ -46,6 +46,7 @@
     "typescript": "^5"
   },
   "dependencies": {
+    "@octokit/auth-app": "^8.2.0",
     "@octokit/rest": "^22.0.1",
     "@types/semver": "^7.7.1",
     "@types/yargs": "^17.0.35",