@tikoci/rosetta 0.8.13 → 0.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tikoci/rosetta",
-  "version": "0.8.13",
+  "version": "0.9.1",
   "description": "RouterOS documentation as SQLite FTS5 — RAG search + command glossary via MCP",
   "type": "module",
   "license": "MIT",

package/src/extract-skills.test.ts

@@ -0,0 +1,39 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+process.env.DB_PATH = ":memory:";
+
+const { githubApiHeaders } = await import("./extract-skills.ts");
+
+describe("extract-skills GitHub API headers", () => {
+  afterEach(() => {
+    delete process.env.GITHUB_TOKEN;
+    delete process.env.GH_TOKEN;
+  });
+
+  test("keeps unauthenticated headers when no token is configured", () => {
+    delete process.env.GITHUB_TOKEN;
+    delete process.env.GH_TOKEN;
+
+    expect(githubApiHeaders()).toEqual({
+      Accept: "application/vnd.github.v3+json",
+    });
+  });
+
+  test("uses GITHUB_TOKEN for authenticated API requests", () => {
+    process.env.GITHUB_TOKEN = "test-token";
+
+    expect(githubApiHeaders()).toEqual({
+      Accept: "application/vnd.github.v3+json",
+      Authorization: "Bearer test-token",
+    });
+  });
+
+  test("falls back to GH_TOKEN for local authenticated runs", () => {
+    process.env.GH_TOKEN = "gh-token";
+
+    expect(githubApiHeaders()).toEqual({
+      Accept: "application/vnd.github.v3+json",
+      Authorization: "Bearer gh-token",
+    });
+  });
+});

package/src/extract-skills.ts

@@ -70,9 +70,16 @@ function countWords(text: string): number {
 
 // ── GitHub API fetching ──
 
+export function githubApiHeaders(): Record<string, string> {
+  const headers: Record<string, string> = { Accept: "application/vnd.github.v3+json" };
+  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return headers;
+}
+
 async function getDefaultBranchSha(): Promise<string> {
   const res = await fetch(`${GITHUB_API_BASE}/commits/HEAD`, {
-    headers: { Accept: "application/vnd.github.v3+json" },
+    headers: githubApiHeaders(),
   });
   if (!res.ok) throw new Error(`Failed to get HEAD SHA: HTTP ${res.status}`);
   const data = (await res.json()) as { sha: string };
@@ -81,7 +88,7 @@ async function getDefaultBranchSha(): Promise<string> {
 
 async function listSkillDirs(sha: string): Promise<string[]> {
   const res = await fetch(`${GITHUB_API_BASE}/contents/?ref=${sha}`, {
-    headers: { Accept: "application/vnd.github.v3+json" },
+    headers: githubApiHeaders(),
   });
   if (!res.ok) throw new Error(`Failed to list repo contents: HTTP ${res.status}`);
   const entries = (await res.json()) as Array<{ name: string; type: string }>;
@@ -102,7 +109,7 @@ async function fetchRawFile(sha: string, path: string): Promise<string | null> {
 
 async function listReferences(sha: string, skillName: string): Promise<string[]> {
   const res = await fetch(`${GITHUB_API_BASE}/contents/${skillName}/references?ref=${sha}`, {
-    headers: { Accept: "application/vnd.github.v3+json" },
+    headers: githubApiHeaders(),
   });
   if (!res.ok) {
     if (res.status === 404) return [];
@@ -387,4 +394,6 @@ async function main() {
   populateDb(skills, sha);
 }
 
-await main();
+if (import.meta.main) {
+  await main();
+}

package/src/release.test.ts

@@ -411,7 +411,13 @@ describe("release.yml", () => {
 
   test("extracts agent skills in CI", () => {
     const src = readText(".github/workflows/release.yml");
-    expect(src).toContain("extract-skills.ts");
+    const skillsIdx = mustIndex(src, "Extract agent skills from GitHub");
+    const linkIdx = mustIndex(src, "Link commands to pages");
+    const skillsBlock = src.slice(skillsIdx, linkIdx);
+
+    expect(skillsBlock).toContain("extract-skills.ts");
+    expect(skillsBlock).toContain("GITHUB_TOKEN");
+    expect(skillsBlock).toContain("$" + "{{ github.token }}");
   });
 
   test("runs quality gate before release", () => {
@@ -436,6 +442,26 @@ describe("release.yml", () => {
     expect(earlyTestIdx).toBeLessThan(downloadIdx);
   });
 
+  test("preflights npm publish access before release side effects", () => {
+    const src = readText(".github/workflows/release.yml");
+    const preflightIdx = mustIndex(src, "Verify npm publish access");
+    const downloadIdx = mustIndex(src, "Download HTML export");
+    const ociIdx = mustIndex(src, "Build and push OCI images");
+    const releaseIdx = mustIndex(src, "Create or update GitHub Release");
+    const publishIdx = mustIndex(src, "Publish to npm");
+    const preflightBlock = src.slice(preflightIdx, downloadIdx);
+
+    expect(preflightIdx).toBeLessThan(downloadIdx);
+    expect(preflightIdx).toBeLessThan(ociIdx);
+    expect(preflightIdx).toBeLessThan(releaseIdx);
+    expect(preflightIdx).toBeLessThan(publishIdx);
+    expect(preflightBlock).toContain("NODE_AUTH_TOKEN");
+    expect(preflightBlock).toContain("npm whoami");
+    expect(preflightBlock).toContain("npm access list collaborators");
+    expect(preflightBlock).toContain("read-write access");
+    expect(preflightBlock).toContain("npm view");
+  });
+
   test("keeps post-extraction DB-wipe guard after extraction", () => {
     const src = readText(".github/workflows/release.yml");
     const linkIdx = mustIndex(src, "Link commands to pages");
@@ -510,6 +536,8 @@ describe("release.yml", () => {
     const clobberIdx = mustIndex(src, "gh release upload");
     expect(src.slice(clobberIdx, clobberIdx + 120)).toContain("--clobber");
     expect(republishBranchIdx).toBeLessThan(clobberIdx);
+    expect(src).toContain('elif gh release view "$VERSION"');
+    expect(src).toContain("updated before npm publish retry");
 
     expect(src).toContain("if: inputs.republish_assets != true");
     expect(src).toContain("if: inputs.republish_assets == true");
@@ -542,7 +570,7 @@ describe("release.yml", () => {
 
   test("publishes to npm", () => {
     const src = readText(".github/workflows/release.yml");
-    expect(src).toContain("npm publish");
+    expect(src).toContain("npm publish --access public --registry https://registry.npmjs.org/");
     expect(src).toContain("NPM_TOKEN");
   });
 
@@ -566,7 +594,7 @@ describe("release.yml", () => {
     const validateIdx = src.indexOf("Validate DB has expected content");
     const buildIdx = src.indexOf("Build release artifacts");
     const releaseIdx = src.indexOf("gh release create");
-    const npmIdx = src.indexOf("npm publish");
+    const npmIdx = src.indexOf("Publish to npm");
     expect(validateIdx).toBeGreaterThan(0);
     expect(validateIdx).toBeLessThan(buildIdx);
     expect(validateIdx).toBeLessThan(releaseIdx);