@voxgig/sdkgen-infrapack 0.0.7 → 0.0.9

package/.sdk/model/target/seneca-provider.aon

@@ -84,6 +84,17 @@ main: kit: target: 'seneca-provider': {
   # Windows alike. A knob that produces an uninstallable dependency is worse
   # than no knob.
   #
+  # NPM 12 REFUSES BOTH BY DEFAULT. `allow-git` and `allow-remote` default to
+  # "none", so a git or tarball dependency is rejected before anything is
+  # fetched (EALLOWGIT / EALLOWREMOTE). The generated CI passes the matching
+  # `--allow-*=all` for whichever kind is configured, because the project
+  # opting into what it declared is reasonable — but a CONSUMER of the
+  # published provider gets no such flag, and will hit the same wall.
+  #
+  # So this is a stopgap for an SDK that is not published YET, not a
+  # substitute for publishing it. An SDK on a registry needs none of it, and
+  # the default `npm` kind is the one that works everywhere.
+  #
   # `spec` states the whole dependency value outright and wins over
   # everything.
   sdk: dep: {

package/.sdk/src/cmp/seneca-provider/Extras_seneca-provider.ts

@@ -1699,7 +1699,7 @@ ${!provider.liveApp ? '' : `
           done
           echo "server did not start; live tests will skip"
 `}
-      - run: npm install
+      - run: npm install${provider.sdkInstallFlag}
 
       # The Seneca host framework is a PEER dependency, so the test suite needs
       # it installed explicitly. --no-save keeps npm from rewriting the peer
@@ -1741,14 +1741,30 @@ ${!provider.liveApp ? '' : `
 # lets npm exchange a GitHub OIDC token for a short-lived publish credential,
 # and provenance is attached automatically.
 #
+# TWO JOBS, BECAUSE THEY NEED DIFFERENT PRIVILEGES.
+#
+#   verify   contents: read, and nothing else. Runs npm install, the build
+#            and the tests — i.e. dependency lifecycle scripts and project
+#            code. It holds no publish credential.
+#   publish  id-token: write, contents: read. Installs NO project
+#            dependencies and runs NO project code: this package ships
+#            \`dist\`, which is committed, so nothing needs building to pack.
+#
+# THE SPLIT IS THE POINT. A compromised dependency lifecycle script can ask
+# the runner for any OIDC token the JOB is permitted to mint, so a job that
+# both installs dependencies and holds \`id-token: write\` can be made to
+# publish as this package before its own gates finish. Keeping the install in
+# a job with no id-token, and the credential in a job that installs nothing,
+# is what makes the isolation real rather than nominal.
+#
 # The trusted publisher must be registered on npmjs.com for this package
 # against THIS filename (publish.yml); renaming this file breaks publishing
 # until the npm-side config is updated to match.
 #
-# npm cannot publish a package's FIRST version this way — the settings page
-# that configures a trusted publisher only exists once a version is there. So
-# release ${provider.version} by hand once, configure the publisher, and every
-# release after that is a tag push.
+# npm cannot configure a trusted publisher for a package that does not exist
+# yet — the settings page appears once a version is on the registry. So the
+# FIRST version of a new package is published by hand, once, with an
+# authenticated npm; every release after that is a tag push.
 #
 # Release flow: bump the version in the SDK model
 # (\`main: kit: target: 'seneca-provider': publish: version\`), regenerate,
@@ -1762,38 +1778,36 @@ on:
   workflow_dispatch:
 
 jobs:
-  publish:
-    name: npm publish
+  verify:
+    name: verify
     runs-on: ubuntu-latest
     timeout-minutes: 15
+
+    # Deliberately the default-minimum. This job runs third-party code.
     permissions:
-      id-token: write
       contents: read
 
+    outputs:
+      version: \${{ steps.version.outputs.version }}
+
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 24.x
-          registry-url: 'https://registry.npmjs.org'
-
-      # Trusted publishing requires npm >= 11.5.1.
-      - name: Use a trusted-publishing capable npm
-        run: npm install -g npm@latest
 
       # install, not ci: this package does not commit a lockfile.
-      - run: npm install
+      - run: npm install${provider.sdkInstallFlag}
 
       # The Seneca host framework is a PEER dependency, so the test suite
       # needs it installed explicitly.
       #
       # --no-save IS LOAD-BEARING. Without it npm rewrites the peer ranges in
-      # package.json to carets on whatever it resolved, and \`npm publish\`
-      # below then ships that rewritten manifest — so an authored \`>=26\`
-      # reaches consumers as \`^28.1.0\` and the package refuses to install for
-      # anyone on a newer major. The repo looks fine; only the artifact is
-      # narrowed. Install into node_modules, leave the manifest alone.
+      # package.json to carets on whatever it resolved, and a later publish
+      # ships that rewritten manifest — so an authored \`>=26\` reaches
+      # consumers as \`^28.1.0\` and the package refuses to install for anyone
+      # on a newer major. The repo looks fine; only the artifact is narrowed.
       - run: npm i --no-save seneca seneca-entity seneca-promisify @seneca/provider @seneca/env
 
       - run: npm run build
@@ -1802,15 +1816,75 @@ jobs:
       # The tag must match what the manifest declares, or a tag push silently
       # republishes whatever version happens to be in package.json.
       - name: Check the tag matches the manifest version
+        id: version
+        run: |
+          set -euo pipefail
+          PKG=\$(node -p "require('./package.json').version")
+          if [ "\${GITHUB_REF_TYPE:-}" = "tag" ]; then
+            TAG="\${GITHUB_REF_NAME#v}"
+            if [ "\$TAG" != "\$PKG" ]; then
+              echo "::error::tag v\$TAG does not match package.json \$PKG"
+              exit 1
+            fi
+          fi
+          echo "version=\$PKG" >> "\$GITHUB_OUTPUT"
+
+      # WHAT THE PUBLISH JOB WILL PACK, checked HERE where the code already
+      # ran. That job builds nothing, so a missing or stale \`dist\` would
+      # otherwise be discovered by consumers rather than by this workflow.
+      - name: The committed dist matches the source
         run: |
-          TAG="\${GITHUB_REF_NAME#v}"
-          PKG=$(node -p "require('./package.json').version")
-          if [ "$TAG" != "$PKG" ]; then
-            echo "tag v$TAG does not match package.json $PKG"
+          set -euo pipefail
+          if ! git diff --quiet -- dist; then
+            echo "::error::dist/ is not up to date with src/ -- rebuild and commit it"
+            git diff --stat -- dist
             exit 1
           fi
 
+  publish:
+    name: npm publish
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    # The ONLY job holding the publish credential — and it installs no
+    # project dependencies and runs no project code. See the header.
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24.x
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted publishing requires npm >= 11.5.1. This is npm itself, not a
+      # project dependency: no package.json here is consulted.
+      - name: Use a trusted-publishing capable npm
+        run: npm install -g npm@latest
+
+      # THE REGISTRY IS THE SOURCE OF TRUTH FOR "IS THIS RELEASED", not the
+      # tag. A re-run of a workflow that already published would otherwise
+      # fail on a version conflict and report a red release that in fact
+      # succeeded.
+      - name: Is this version already on npm?
+        id: registry
+        env:
+          VERSION: \${{ needs.verify.outputs.version }}
+        run: |
+          set -euo pipefail
+          if npm view "${provider.pkgName}@\$VERSION" version >/dev/null 2>&1; then
+            echo "published=true" >> "\$GITHUB_OUTPUT"
+            echo "\$VERSION is already on npm — skipping publish"
+          else
+            echo "published=false" >> "\$GITHUB_OUTPUT"
+          fi
+
       - name: Publish to npm
+        if: steps.registry.outputs.published == 'false'
         run: npm publish --access public
 `)
       })

package/.sdk/src/cmp/seneca-provider/Main_seneca-provider.ts

@@ -723,6 +723,21 @@ const Main = cmp(function Main(props: any) {
     // CI note says so, because "npm install is all you need" stops being
     // true the moment git or a tarball URL is in the path.
     sdkGit: !sdkDep.startsWith('^'),
+    // THE OPT-IN A NON-REGISTRY DEPENDENCY NEEDS, or ''.
+    //
+    // npm 12 defaults `allow-git` and `allow-remote` to "none" and REFUSES
+    // such a dependency outright — EALLOWGIT / EALLOWREMOTE, before it
+    // fetches anything. Older npm allowed both, so a workflow that passes
+    // today fails the moment its runner image updates; this provider's own
+    // publish run failed that way within hours of the build run passing,
+    // because publishing upgrades npm first.
+    //
+    // Emitted ONLY where the project chose such a dependency: it is the
+    // project opting into what it already declared, not a default weakened
+    // for everyone. Publishing the SDK remains the durable answer, and this
+    // flag exists so an unpublished one is workable meanwhile.
+    sdkInstallFlag: sdkDep.startsWith('github:') ? ' --allow-git=all' :
+      (sdkDep.startsWith('http') ? ' --allow-remote=all' : ''),
     repoUrl: repo.url,
     // The SDK's own repo, for pointing at the companion test server which is
     // only distributed in source.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voxgig/sdkgen-infrapack",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Infrastructure-provider targets for the Voxgig SDK Generator: Seneca provider.",
   "type": "commonjs",
   "license": "MIT",

package/sdkgen-package.json

@@ -3,7 +3,7 @@
     "package": 1
   },
   "name": "@voxgig/sdkgen-infrapack",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "engines": {
     "sdkgen": ">=4.12.0"
   },