@wpelevator/wp-release 0.14.0 → 0.15.0

package/README.md

@@ -41,7 +41,7 @@ npx wp-release --help
 | `wp-release changeset-version [options]` | Apply version bumps and changelog entries. |
 | `wp-release changeset-tag [options]` | Create missing package release tags. |
 
-Run `npx wp-release <command> --help` for the options of each command. Every command reads the plugin or theme directory from the first argument or `--source-dir`, defaulting to the current directory, and prints its result as JSON with `--json`. In GitHub Actions, `--github-output` sets the result as JSON to the `result` output of the step instead, for later steps and jobs to read with `fromJSON( steps.<id>.outputs.result )`.
+Run `npx wp-release <command> --help` for the options of each command. Every command reads the plugin or theme directory from the first argument or `--source-dir`, defaulting to the current directory, and prints its result as JSON with `--json`. In GitHub Actions, `--github-output` sets the result as JSON to the `result` output of the step instead, for later steps and jobs to read with `fromJSON( steps.<id>.outputs.result )`. Each top-level string, number or boolean of the result is also its own output, like `steps.<id>.outputs.zipPath` for `zip`, so a step reads it without `fromJSON()`; lists, like the `tags` of `changeset-tag` or the `deploys` of `deploy-git`, are only in `result`. Since GitHub evaluates the `env` of a step also when its `if` is false, and `fromJSON()` fails for the empty output of a skipped step, read the plain outputs in steps that run conditionally.
 
 ### GitHub Actions annotations and job summaries
 
@@ -65,7 +65,7 @@ Each command also adds a section to the [job summary](https://docs.github.com/en
 |---|---|
 | `deploy-svn` | Plugin, linked to its WordPress.org page, version, written SVN paths, the commit linked to its WordPress.org changeset (or the dry run or no-op result), and the SVN changes in a collapsed table. |
 | `deploy-git` | Repository, release commit and the pushed branch and tag. |
-| `zip` | ZIP, number of files and checksums manifest. |
+| `zip` | ZIP, number of files and checksums manifest; with `--sign`, signature files and the public key of each written format. |
 | `checksums` | Manifest and number of files. |
 | `sign` | Signature files and the public key of each written format. |
 | `verify` | That all files match, or the counts and a table of the changed, missing and extra files. |
@@ -281,7 +281,7 @@ Each concept has one name, written in the syntax of each interface:
 | Concept | CLI | GitHub Action | Library | Meaning |
 |---|---|---|---|---|
 | Plugin or theme directory | `<source-dir>` argument or `--source-dir` | `source-dir` | `sourceDir` | Directory that a command reads, whether it's the repository or a build directory. |
-| Generated file | `--output <file>` | | `outputPath` | File written by `zip` or `checksums`. |
+| Generated file | `--output <file>` | `output` | `outputPath` | File written by `zip` or `checksums`. |
 | ZIP to deploy | `--from-zip <file>` | `from-zip` | `fromZip` | Existing ZIP read as the deploy source. |
 | Git tag to compare | `--git-tag <tag>` | | `gitTag` | Git tag checked by `version-check`. |
 | SVN tag to create | `--svn-tag <version>` | `svn-tag` | `svnTag` | Tag written by `deploy-svn`, distinct from a git tag. |
@@ -291,9 +291,14 @@ Each concept has one name, written in the syntax of each interface:
 | Source history | `--split-prefix <dir>` | | `splitPrefix` | Directory of a monorepo package whose history, from `git subtree split`, becomes the source history of `deploy-git` releases. |
 | SVN credentials | `--svn-username <name>`, `SVN_USERNAME` and `SVN_PASSWORD` env vars | `svn-username`, `svn-password` | `svnUsername`, `svnPassword` | Needed only to commit. There's no password flag, since it would show in the process list; the action inputs and library options fall back to the env vars. |
 | Log format | `--log-format <text\|github>`, `--ci` for `github` | always `github` | `writer: new TextWriter()` or `new GitHubActionsWriter()` | How the log is printed: plain text, or GitHub Actions annotations and job summaries. Each name matches the start of its writer class. |
+| Release config | `--config <path>` | `config` in ZIP and SVN actions | `configFile` | Explicit JavaScript config path for configured packaging or deployment. |
+| Release tag format | `--tag-format <format>` | `tag-format` in SVN action | `tagFormat` | How `release-ref` identifies a package and its version. |
+| Release ref to deploy | `--release-ref <ref>` | `release-ref` in SVN action | `ref` | Read configured packages and deployment targets from a release ref. |
 | Assets sync | `--no-assets` to skip | `assets: false` to skip | `assets` | Booleans are positive in the library and the action; `--no-assets` is only the CLI negation, never `noAssets` or a `no-assets` input. |
 
-CLI JSON results use camelCase keys like `zipPath`, and GitHub Action outputs use kebab-case like `zip-path`. Library classes are named after the capability (`SvnDeploy`, `Svn`, `GitDeploy`) without repeating "release".
+CLI JSON results use camelCase keys like `zipPath`, and GitHub Action outputs use kebab-case like `zip-path`. The ZIP action supports `package` and `config`, and the SVN action supports `release-ref`, repeated `package` values as newline-separated input, `list`, `config` and `tag-format`.
+
+Library classes are named after the capability (`SvnDeploy`, `Svn`, `GitDeploy`) without repeating "release".
 
 ### File selection
 
@@ -328,6 +333,7 @@ wp-release zip dist --slug my-plugin --checksums
 - `--filename-format` changes the name, like `--filename-format {slug}` for `my-plugin.zip`.
 - Entries are sorted and use a fixed timestamp and file mode, so the same files always give the same ZIP.
 - `--checksums` also writes the [checksums manifest](#checksums) of the archived files next to the ZIP, with `.checksums.json` instead of `.zip`.
+- `--sign` also [signs](#sign) the ZIP and the manifest with the `WP_RELEASE_SIGNING_KEY` key in the same command that writes them, like `wp-release sign` with the same files, writing a WordPress `.sig` next to each. `--sign-format <names>` picks the [signature formats](#signature-formats), like the `--format` of `sign`, such as `--sign-format wordpress,minisign`, and implies `--sign`. The signature formats, signing key and existing signature paths are checked before writing the ZIP or manifest, so correcting invalid signing options permits a retry without `--force`. `--force` also overwrites existing signatures. With the GitHub log format, the job summary includes the signatures and the public key of each written format. The result lists the signature files in `signatures` and the public key of the signing key in `publicKey`.
 - An existing ZIP or manifest isn't overwritten without `--force`. A ZIP or manifest written inside the source directory is never archived.
 - `--package <name>` zips a package of the [configured packages](#deploy-configured-packages), by identifier or path under the configured root like `plugins/alpha`, instead of a source directory: its directory with the `files` config of its package group, the same files that its deploys select. The slug defaults to the directory name and the version to the `Version` header, and `--slug` and `--version` still set them. Any package of the config works, with or without a version or deploy targets. To zip what a deploy just released, pass the `package` and `version` of the `deploy-git --release-ref` result, in the same job and from the same build, so the ZIP has exactly the files of the release tag in the release repository. It can't be combined with `<source-dir>` or the file selection options. The `--json` result has the `package`, `slug` and `version`. `zipPackage()` builds the same ZIP from a script, with `getPackageFiles()` for the directory and the files of a package.
 
@@ -414,6 +420,7 @@ WP_RELEASE_SIGNING_KEY=… wp-release sign my-plugin.1.2.0.zip my-plugin.1.2.0.c
 - The key is read from the `WP_RELEASE_SIGNING_KEY` environment variable only, as a base64 32-byte Ed25519 seed or a 64-byte libsodium secret key, the formats that `sodium_crypto_sign_seed_keypair()` and the update-pilot-server package signing key take. There's no flag for it, since it would show in the process list, and it's never logged.
 - `--verbose` prints the public key of the signing key in the form of each written format. `--json` returns it as `publicKey`, and in every form as `publicKeys`. Pass it to `verify --public-key` and to the plugin that checks the signatures.
 - An existing signature file isn't overwritten without `--force`.
+- `zip --sign` signs a ZIP and its manifest as it writes them, and `signFiles()` signs files from a script.
 
 #### Signature formats
 
@@ -745,7 +752,9 @@ npm run lint --workspace @wpelevator/wp-release
 - `test` runs the `.ts` tests directly with `node --test`, using Node.js type stripping, so it needs Node.js 22.18 or later but no build. The SVN integration tests in `svn-deploy.integration.test.ts` create repositories with `svnadmin` and deploy to their `file://` URLs; they're skipped when `svn` or `svnadmin` isn't installed.
 - `lint` runs ESLint and a `tsc` type check.
 
-The `wpelevator-source` export condition points at `src/index.ts`. The tests and the `wp-release-deploy-svn` action build use it to work with the source instead of a `dist/` build. It's not set by other tools, so the published package always resolves to `dist/`.
+The `wpelevator-source` export condition points at `src/index.ts`. The wp-release tests and monorepo CLI scripts use it to work with the source instead of a `dist/` build. Action builds use the declared dependency's default export, which resolves to `dist/` for the workspace copy and the published package. Build wp-release before building the actions.
+
+`execute( 'deploy-svn', args, { cwd, logger, svnRunner } )` runs a single-plugin deployment or a configured plan or deployment. The optional `svnRunner` replaces the external command runner in both modes; without it, the command uses its normal runner.
 
 ### Architecture
 
@@ -756,6 +765,8 @@ wp-release has two layers, so that it fits any repository layout:
 
 Nothing assumes a directory structure or naming convention that the config doesn't set.
 
+The GitHub Actions are adapters to these commands: they use the same flag names and `execute()` entry point, with secrets supplied through environment variables. The SVN action injects a command runner that checks or installs SVN only when a deployment runs its first SVN command; config planning and deployment behavior remain in `wp-release`.
+
 The package uses ES modules as its unit of encapsulation, like most Node.js CLI tools: a module exports a few functions and keeps its helpers private, so there's no class to wrap them in. A class is used only when it holds state across steps or binds dependencies, so that callers and tests can replace them:
 
 - **Workflows with steps** are classes, so that their steps share state and dependencies on the instance: `SvnDeploy` shares the temporary working copy across `prepare()`, `checkout()`, `sync()` and `commit()`, `GitDeploy` binds the options and the git runner to its steps, and `ChangesetRelease` binds the repository and the runners to `add()`, `version()` and `tag()`.

package/dist/cli.d.ts

@@ -3,9 +3,8 @@ import type { SignResult } from './commands/sign.ts';
 import type { KeygenResult } from './commands/keygen.ts';
 import type { ZipResult } from './commands/zip.ts';
 import type { ChangesetVersionResult } from './commands/changeset-version.ts';
-import { Logger } from './logger.ts';
 import type { OutputStream } from './logger.ts';
-import type { Command, CommandOutcome } from './commands/command.ts';
+import type { CommandContext, Command, CommandOutcome } from './commands/command.ts';
 /** Input stream that interactive prompts read from in a terminal. */
 export type InputStream = NodeJS.ReadableStream & {
     isTTY?: boolean;
@@ -44,10 +43,23 @@ export declare function getCommandHelp(command: Command): string;
  * @return Command definition.
  */
 export declare function findCommand(args: string[]): Command | undefined;
+/**
+ * Format the result of a command as GitHub Actions step outputs: the whole
+ * result as JSON in "result", and each top-level string, number or boolean
+ * as its own output, like "zipPath", so that a workflow reads it without
+ * fromJSON(). Lists and objects are only in "result". Every value but the
+ * compact JSON, which has no line breaks, uses a random delimiter, so that a
+ * value with line breaks can't set other outputs.
+ *
+ * @param result Command result.
+ * @return Lines for the GITHUB_OUTPUT file.
+ */
+export declare function formatGitHubOutputs(result: unknown): string;
 /**
  * Results of the commands that can be run with execute(), by command name.
  */
 export interface CommandResults {
+    'deploy-svn': import('./commands/deploy-svn.ts').DeploySvnResult;
     zip: ZipResult;
     checksums: ChecksumsResult;
     sign: SignResult;
@@ -68,14 +80,11 @@ export interface CommandResults {
  * @param  context.cwd        Working directory that relative paths resolve against.
  * @param  context.configFile Explicit config file path, when supplied by a wrapper.
  * @param  context.logger     Logger for the command output.
+ * @param  context.svnRunner  Optional SVN command runner supplied by a wrapper.
  * @return Exit code and result of the command.
  * @throws {Error} If the command is unknown, the arguments are invalid or the command fails.
  */
-export declare function execute<Name extends keyof CommandResults>(name: Name, args: string[], context: {
-    cwd: string;
-    logger: Logger;
-    configFile?: string;
-}): Promise<CommandOutcome<CommandResults[Name]>>;
+export declare function execute<Name extends keyof CommandResults>(name: Name, args: string[], context: Pick<CommandContext, 'cwd' | 'logger' | 'configFile' | 'svnRunner'>): Promise<CommandOutcome<CommandResults[Name]>>;
 /**
  * Run the CLI.
  *

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { appendFileSync } from 'node:fs';
 import { parseArgs } from 'node:util';
 import zip from "./commands/zip.js";
@@ -177,6 +178,28 @@ function createLogWriter(values, streams) {
     }
     return create(streams);
 }
+/**
+ * Format the result of a command as GitHub Actions step outputs: the whole
+ * result as JSON in "result", and each top-level string, number or boolean
+ * as its own output, like "zipPath", so that a workflow reads it without
+ * fromJSON(). Lists and objects are only in "result". Every value but the
+ * compact JSON, which has no line breaks, uses a random delimiter, so that a
+ * value with line breaks can't set other outputs.
+ *
+ * @param result Command result.
+ * @return Lines for the GITHUB_OUTPUT file.
+ */
+export function formatGitHubOutputs(result) {
+    const values = 'object' === typeof result && null !== result
+        ? Object.entries(result).filter(([name, value]) => 'result' !== name &&
+            ['string', 'number', 'boolean'].includes(typeof value))
+        : [];
+    const delimiter = `ghadelimiter_${randomUUID()}`;
+    return [
+        `result=${JSON.stringify(result)}\n`,
+        ...values.map(([name, value]) => `${name}<<${delimiter}\n${String(value)}\n${delimiter}\n`),
+    ].join('');
+}
 /**
  * Get the GitHub Actions step output file for --github-output, checked before
  * the command runs.
@@ -241,8 +264,7 @@ async function runCommand(command, args, io) {
             stdout.write(JSON.stringify(result, null, '\t') + '\n');
         }
         if (githubOutputFile) {
-            // Compact JSON has no line breaks, so it fits a single output line.
-            appendFileSync(githubOutputFile, `result=${JSON.stringify(result)}\n`);
+            appendFileSync(githubOutputFile, formatGitHubOutputs(result));
         }
         return exitCode;
     }
@@ -262,6 +284,7 @@ async function runCommand(command, args, io) {
  * @param  context.cwd        Working directory that relative paths resolve against.
  * @param  context.configFile Explicit config file path, when supplied by a wrapper.
  * @param  context.logger     Logger for the command output.
+ * @param  context.svnRunner  Optional SVN command runner supplied by a wrapper.
  * @return Exit code and result of the command.
  * @throws {Error} If the command is unknown, the arguments are invalid or the command fails.
  */

package/dist/commands/args.d.ts

@@ -1,4 +1,5 @@
 import type { ParseArgsOptionsConfig } from 'node:util';
+import type { SignatureFormat } from '../signing.ts';
 import type { ParsedValues } from './command.ts';
 /**
  * Options shared by the commands that select files with .distignore and
@@ -69,3 +70,13 @@ export interface ResolveOutputInput {
  * @return Absolute file path.
  */
 export declare function resolveOutput(input: ResolveOutputInput): string;
+/**
+ * Get the signature formats from the --format values of sign or the
+ * --sign-format values of zip, which can be repeated
+ * or comma-separated.
+ *
+ * @param  values Option values.
+ * @return Unique formats, the default when none are given.
+ * @throws {ValidationError} If a format is unknown.
+ */
+export declare function parseSignatureFormats(values: string[]): SignatureFormat[];

package/dist/commands/args.js

@@ -1,6 +1,7 @@
 import { stat } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { ValidationError } from "../errors.js";
+import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, isSignatureFormat, } from "../signing.js";
 import { getBoolean, getString, getStrings } from "./command.js";
 /**
  * Options shared by the commands that select files with .distignore and
@@ -95,3 +96,25 @@ export function getSourceDirArg(values, positionals) {
 export function resolveOutput(input) {
     return resolve(input.cwd, input.output ?? input.filename);
 }
+/**
+ * Get the signature formats from the --format values of sign or the
+ * --sign-format values of zip, which can be repeated
+ * or comma-separated.
+ *
+ * @param  values Option values.
+ * @return Unique formats, the default when none are given.
+ * @throws {ValidationError} If a format is unknown.
+ */
+export function parseSignatureFormats(values) {
+    const names = values
+        .flatMap((value) => value.split(','))
+        .map((name) => name.trim())
+        .filter(Boolean);
+    const unknown = names.filter((name) => !isSignatureFormat(name));
+    if (unknown.length) {
+        throw new ValidationError(`Unknown signature format ${unknown.join(', ')}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
+    }
+    return names.length
+        ? [...new Set(names.filter(isSignatureFormat))]
+        : [DEFAULT_SIGNATURE_FORMAT];
+}

package/dist/commands/command.d.ts

@@ -1,6 +1,7 @@
 import type { ParseArgsOptionsConfig } from 'node:util';
 import type { PromptTerminal } from '../changeset-prompt.ts';
 import type { Logger } from '../logger.ts';
+import type { SvnRunner } from '../svn.ts';
 /**
  * Parsed option values from node:util parseArgs().
  */
@@ -18,6 +19,8 @@ export interface CommandContext {
     tagFormat?: string;
     /** Logger for the command output. */
     logger: Logger;
+    /** SVN command runner supplied by a wrapper, instead of spawning svn directly. */
+    svnRunner?: SvnRunner;
     /** Terminal for interactive prompts, only when the CLI runs in one and prints no JSON. */
     terminal?: PromptTerminal;
 }

package/dist/commands/deploy-svn.d.ts

@@ -1,5 +1,14 @@
 import type { DeployInput } from '../deploy-options.ts';
-import type { ParsedValues } from './command.ts';
+import type { DeployResult } from '../svn-deploy.ts';
+import type { PackageDeployPlanItem } from '../package-deploy.ts';
+import type { CommandOutcome, ParsedValues } from './command.ts';
+import type { PackageDeployOutcome } from './package-deploys.ts';
+/** Results of a single deploy, a configured plan or configured deploys. */
+export type DeploySvnResult = DeployResult | {
+    packages: PackageDeployPlanItem[];
+} | {
+    deploys: PackageDeployOutcome<DeployResult>[];
+};
 export interface DeployArgsInput {
     /** Parsed CLI values. */
     values: ParsedValues;
@@ -76,19 +85,6 @@ declare const _default: {
             type: "string";
         };
     };
-    run({ values, positionals, cwd, configFile, tagFormat, logger }: import("./command.ts").CommandContext): Promise<{
-        exitCode: number;
-        result: {
-            packages: import("../package-deploy.ts").PackageDeployPlanItem[];
-        };
-    } | {
-        exitCode: number;
-        result: {
-            deploys: import("./package-deploys.ts").PackageDeployOutcome<import("../svn-deploy.ts").DeployResult>[];
-        };
-    } | {
-        exitCode: number;
-        result: import("../svn-deploy.ts").DeployResult;
-    }>;
+    run({ values, positionals, cwd, configFile, tagFormat, logger, svnRunner, }: import("./command.ts").CommandContext): Promise<CommandOutcome<DeploySvnResult>>;
 };
 export default _default;

package/dist/commands/deploy-svn.js

@@ -1,6 +1,7 @@
 import { resolveDeployOptions } from "../deploy-options.js";
 import { getSvnDeploys } from "../package-deploy.js";
 import { SvnDeploy } from "../svn-deploy.js";
+import { Svn } from "../svn.js";
 import { fileSelectionArgs, getFileSelectionInput, getSourceDirArg, sourceDirArgs, } from "./args.js";
 import { getBoolean, getString } from "./command.js";
 import { getPackageDeployArgs, listPackageDeploys, packageDeployArgs, runPackageDeploys, } from "./package-deploys.js";
@@ -23,6 +24,26 @@ const TARGET_FLAGS = [
     'svn-url',
     'message',
 ];
+/**
+ * Run an SVN deploy with the optional command runner supplied by a wrapper.
+ *
+ * @param input  Deploy input.
+ * @param logger Logger for the deploy.
+ * @param runner Optional SVN command runner.
+ * @return Deploy result.
+ */
+async function runDeploy(input, logger, runner) {
+    const options = resolveDeployOptions(input);
+    const svn = runner
+        ? new Svn({
+            runner,
+            username: options.svnUsername,
+            password: options.svnPassword,
+            logger,
+        })
+        : undefined;
+    return new SvnDeploy(options, logger, svn).run();
+}
 /**
  * Map the parsed "deploy-svn" arguments to resolveDeployOptions() input.
  * Flags that aren't passed stay undefined, so that the same defaults apply
@@ -135,7 +156,7 @@ Examples:
         ...packageDeployArgs,
         'dry-run': { type: 'boolean' },
     },
-    async run({ values, positionals, cwd, configFile, tagFormat, logger }) {
+    async run({ values, positionals, cwd, configFile, tagFormat, logger, svnRunner, }) {
         const { ref, packages, list } = getPackageDeployArgs(values, positionals, TARGET_FLAGS);
         if (ref) {
             const deploys = await getSvnDeploys({
@@ -148,14 +169,13 @@ Examples:
             });
             return list
                 ? listPackageDeploys(deploys, logger, ref)
-                : runPackageDeploys(deploys, (input) => new SvnDeploy(resolveDeployOptions({
+                : runPackageDeploys(deploys, (input) => runDeploy({
                     ...input,
                     svnUsername: getString(values, 'svn-username'),
                     force: getBoolean(values, 'force'),
-                }), logger).run(), logger, ref);
+                }, logger, svnRunner), logger, ref);
         }
-        const options = resolveDeployOptions(getDeployInputFromArgs({ values, positionals, cwd }));
-        const result = await new SvnDeploy(options, logger).run();
+        const result = await runDeploy(getDeployInputFromArgs({ values, positionals, cwd }), logger, svnRunner);
         return { exitCode: 0, result };
     },
 };

package/dist/commands/sign.d.ts

@@ -11,15 +11,6 @@ export interface SignResult {
     /** Public key of the signing key in the form of each signature format. */
     publicKeys: Record<SignatureFormat, string>;
 }
-/**
- * Get the signature formats from the --format values, which can be repeated
- * or comma-separated.
- *
- * @param  values Option values.
- * @return Unique formats, the default when none are given.
- * @throws {ValidationError} If a format is unknown.
- */
-export declare function parseSignatureFormats(values: string[]): SignatureFormat[];
 declare const _default: {
     name: string;
     usage: string;

package/dist/commands/sign.js

@@ -1,30 +1,9 @@
 import { resolve } from 'node:path';
-import { stat } from 'node:fs/promises';
 import { ValidationError } from "../errors.js";
 import { getSignSummary } from "../summary.js";
-import { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_FORMATS, SIGNING_KEY_ENV, getPublicKey, getPublicKeys, isSignatureFormat, parseSigningKey, writeSignature, } from "../signing.js";
+import { SIGNING_KEY_ENV, signFiles } from "../signing.js";
+import { parseSignatureFormats } from "./args.js";
 import { getBoolean, getStrings } from "./command.js";
-/**
- * Get the signature formats from the --format values, which can be repeated
- * or comma-separated.
- *
- * @param  values Option values.
- * @return Unique formats, the default when none are given.
- * @throws {ValidationError} If a format is unknown.
- */
-export function parseSignatureFormats(values) {
-    const names = values
-        .flatMap((value) => value.split(','))
-        .map((name) => name.trim())
-        .filter(Boolean);
-    const unknown = names.filter((name) => !isSignatureFormat(name));
-    if (unknown.length) {
-        throw new ValidationError(`Unknown signature format ${unknown.join(', ')}, use ${Object.keys(SIGNATURE_FORMATS).join(', ')}.`);
-    }
-    return names.length
-        ? [...new Set(names.filter(isSignatureFormat))]
-        : [DEFAULT_SIGNATURE_FORMAT];
-}
 export default {
     name: 'sign',
     usage: 'sign <file>... [options]',
@@ -58,34 +37,18 @@ form of each format.`,
         force: { type: 'boolean' },
     },
     async run({ values, positionals, cwd, logger, }) {
-        const encoded = process.env[SIGNING_KEY_ENV];
         const formats = parseSignatureFormats(getStrings(values, 'format'));
         if (!positionals.length) {
             throw new ValidationError('Pass the files to sign.');
         }
-        if (!encoded?.trim()) {
-            throw new ValidationError(`Set the ${SIGNING_KEY_ENV} environment variable to the base64 Ed25519 signing key.`);
-        }
-        const privateKey = parseSigningKey(encoded);
-        const publicKey = getPublicKey(privateKey);
-        const publicKeys = getPublicKeys(privateKey);
-        const paths = positionals.map((file) => resolve(cwd, file));
-        await Promise.all(paths.map(async (path) => {
-            if (!(await stat(path).catch(() => null))?.isFile()) {
-                throw new ValidationError(`${path} is not a file.`);
-            }
-        }));
-        formats.forEach((format) => logger.debug(`Signing ${format} with the public key ${publicKeys[format]}.`));
-        const signatures = [];
-        const force = getBoolean(values, 'force');
-        const jobs = paths.flatMap((path) => formats.map((format) => ({ path, format })));
-        // Sign in order, so that a failure leaves a predictable set of files.
-        for (const { path, format } of jobs) {
-            const signaturePath = await writeSignature(path, privateKey, force, format);
-            logger.info(signaturePath);
-            signatures.push(signaturePath);
-        }
-        const result = { signatures, formats, publicKey, publicKeys };
+        const signed = await signFiles({
+            paths: positionals.map((file) => resolve(cwd, file)),
+            formats,
+            force: getBoolean(values, 'force'),
+        });
+        formats.forEach((format) => logger.debug(`Signed ${format} with the public key ${signed.publicKeys[format]}.`));
+        signed.signatures.forEach((path) => logger.info(path));
+        const result = { ...signed, formats };
         logger.summary((context) => getSignSummary(context, result));
         return { exitCode: 0, result };
     },

package/dist/commands/zip.d.ts

@@ -8,6 +8,10 @@ export interface ZipResult extends ZipPackageResult {
     version: string | null;
     /** Zipped package, with --package. */
     package?: string;
+    /** Absolute paths of the signatures of the ZIP and the manifest, with --sign. */
+    signatures?: string[];
+    /** Base64 public key of the signing key, with --sign. */
+    publicKey?: string;
 }
 declare const _default: {
     name: string;
@@ -21,6 +25,13 @@ declare const _default: {
         checksums: {
             type: "boolean";
         };
+        sign: {
+            type: "boolean";
+        };
+        'sign-format': {
+            type: "string";
+            multiple: true;
+        };
         force: {
             type: "boolean";
         };

package/dist/commands/zip.js

@@ -4,9 +4,10 @@ import { resolveFileSelection } from "../file-selection.js";
 import { FILENAME_FORMAT, formatFilename } from "../filename.js";
 import { getPackageFiles } from "../package-deploy.js";
 import { readPackageMeta } from "../package-meta.js";
-import { zipPackage } from "../package-zip.js";
-import { getZipSummary } from "../summary.js";
-import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, resolveOutput, sourceDirArgs, } from "./args.js";
+import { getChecksumsPath, zipPackage } from "../package-zip.js";
+import { SIGNING_KEY_ENV, checkSigningInput, signFiles } from "../signing.js";
+import { getSignSummary, getZipSummary } from "../summary.js";
+import { checkDirectory, fileSelectionArgs, getFileSelectionInput, getSourceDirArg, parseSignatureFormats, resolveOutput, sourceDirArgs, } from "./args.js";
 import { getBoolean, getString, getStrings } from "./command.js";
 /** Options of a source directory and its files, which --package takes from the config. */
 const SOURCE_FLAGS = [
@@ -134,6 +135,14 @@ Options:
   --checksums                 Also write the checksums manifest of the archived
                               files next to the ZIP, with .checksums.json
                               instead of .zip
+  --sign                      Also sign the ZIP and the checksums manifest with
+                              the ${SIGNING_KEY_ENV} key, like
+                              "wp-release sign", writing a WordPress .sig next
+                              to each
+  --sign-format <names>       Signature formats of --sign, comma-separated or
+                              repeated, like wordpress,minisign,ssh, as the
+                              --format of "wp-release sign" (default:
+                              wordpress); implies --sign
   --force                     Overwrite existing output files
 
 Entries are sorted and use a fixed timestamp and file mode, so the same files
@@ -155,6 +164,8 @@ Examples:
         ...fileSelectionArgs,
         package: { type: 'string' },
         checksums: { type: 'boolean' },
+        sign: { type: 'boolean' },
+        'sign-format': { type: 'string', multiple: true },
         force: { type: 'boolean' },
     },
     async run({ values, positionals, cwd, configFile, logger, }) {
@@ -163,14 +174,31 @@ Examples:
             ? await getPackageSource(values, cwd, name, configFile)
             : await getDirectorySource(values, positionals, cwd);
         const filename = formatFilename(getString(values, 'filename-format') ?? FILENAME_FORMAT, { slug: source.slug, version: source.version });
+        const zipPath = resolveOutput({
+            cwd,
+            output: getString(values, 'output'),
+            filename: `${filename}.zip`,
+        });
+        const signFormats = getStrings(values, 'sign-format');
+        const signing = getBoolean(values, 'sign') || signFormats.length
+            ? {
+                paths: [
+                    zipPath,
+                    ...(getBoolean(values, 'checksums')
+                        ? [getChecksumsPath(zipPath)]
+                        : []),
+                ],
+                formats: parseSignatureFormats(signFormats),
+                force: getBoolean(values, 'force'),
+            }
+            : undefined;
+        if (signing) {
+            checkSigningInput(signing);
+        }
         const zipped = await zipPackage({
             sourceDir: source.sourceDir,
             selection: source.selection,
-            zipPath: resolveOutput({
-                cwd,
-                output: getString(values, 'output'),
-                filename: `${filename}.zip`,
-            }),
+            zipPath,
             rootFolder: getBoolean(values, 'no-root-folder')
                 ? null
                 : getString(values, 'root-folder') ?? source.slug,
@@ -185,13 +213,26 @@ Examples:
         if (zipped.checksumsPath) {
             logger.info(zipped.checksumsPath);
         }
+        const signed = signing
+            ? { ...(await signFiles(signing)), formats: signing.formats }
+            : undefined;
+        signed?.signatures.forEach((path) => logger.info(path));
         const result = {
             ...zipped,
+            ...(signed
+                ? {
+                    signatures: signed.signatures,
+                    publicKey: signed.publicKey,
+                }
+                : {}),
             slug: source.slug,
             version: source.version,
             ...(source.package ? { package: source.package } : {}),
         };
         logger.summary((context) => getZipSummary(context, result));
+        if (signed) {
+            logger.summary((context) => getSignSummary(context, signed));
+        }
         return { exitCode: 0, result };
     },
 };

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from './filename.ts';
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from './checksums.ts';
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from './package-meta.ts';
-export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, signFiles, verifyFileSignature, } from './signing.ts';
 export type { SignatureFormat, SignatureFormatHandler } from './signing.ts';
 export { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from './minisign.ts';
 export { SSH_SIGNATURE_EXTENSION, SSH_SIGNATURE_NAMESPACE, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from './ssh-signature.ts';
@@ -34,10 +34,11 @@ export type { PackageDeployOutcome } from './commands/package-deploys.ts';
 export type { CliIo, CommandResults } from './cli.ts';
 export type { ChecksumsResult } from './commands/checksums.ts';
 export type { SignResult } from './commands/sign.ts';
+export type { SignFilesInput, SignFilesResult } from './signing.ts';
 export type { KeygenResult } from './commands/keygen.ts';
 export type { ZipResult } from './commands/zip.ts';
 export type { Command, CommandContext, CommandOutcome, ParsedValues, } from './commands/command.ts';
-export type { DeployArgsInput } from './commands/deploy-svn.ts';
+export type { DeployArgsInput, DeploySvnResult, } from './commands/deploy-svn.ts';
 export type { Annotation, LogEntry, LogLevel, LogWriter, LoggerOptions, OutputStream, SummaryBuilder, TextWriterOptions, } from './logger.ts';
 export type { GitHubActionsWriterOptions } from './github-actions-writer.ts';
 export type { Problem } from './errors.ts';

package/dist/index.js

@@ -9,7 +9,7 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from "./filename.js";
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from "./checksums.js";
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from "./package-meta.js";
-export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, signFiles, verifyFileSignature, } from "./signing.js";
 export { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from "./minisign.js";
 export { SSH_SIGNATURE_EXTENSION, SSH_SIGNATURE_NAMESPACE, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from "./ssh-signature.js";
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from "./zip.js";

package/dist/signing.d.ts

@@ -119,6 +119,42 @@ export declare function getPublicKeys(key: KeyObject): Record<SignatureFormat, s
  * @throws {ValidationError} If the signature file exists and force isn't set.
  */
 export declare function writeSignature(path: string, privateKey: KeyObject, force?: boolean, format?: SignatureFormat): Promise<string>;
+export interface SignFilesInput {
+    /** Absolute paths of the files to sign. */
+    paths: string[];
+    /** Signature formats to write, the WordPress .sig by default. */
+    formats?: SignatureFormat[];
+    /** Base64 signing key, from the WP_RELEASE_SIGNING_KEY environment variable by default. */
+    key?: string;
+    /** Overwrite existing signature files. */
+    force?: boolean;
+}
+export interface SignFilesResult {
+    /** Absolute paths of the written signature files. */
+    signatures: string[];
+    /** Base64 public key of the signing key. */
+    publicKey: string;
+    /** Public key of the signing key in the form of each signature format. */
+    publicKeys: Record<SignatureFormat, string>;
+}
+/**
+ * Validate the signing key and destinations before writing files. The input
+ * files need not exist yet, so zip can check before creating its artifacts.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return Parsed signing key.
+ * @throws {ValidationError} Without a valid key or when a signature already exists without force.
+ */
+export declare function checkSigningInput(input: SignFilesInput): KeyObject;
+/**
+ * Sign files with a signature file of each format next to each, in order,
+ * so that a failure leaves a predictable set of files.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return The written signature files and the public keys.
+ * @throws {ValidationError} Without a key, for an invalid key, a missing file or an existing signature file without force.
+ */
+export declare function signFiles(input: SignFilesInput): Promise<SignFilesResult>;
 /**
  * Check a file against a signature file. A wordpress .sig file can hold one
  * signature per line, and is valid when any of them match, so that a file

package/dist/signing.js

@@ -1,5 +1,6 @@
 import { createPrivateKey, generateKeyPairSync, sign, verify, } from 'node:crypto';
-import { readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { readFile, stat, writeFile } from 'node:fs/promises';
 import { PUBLIC_KEY_BYTES, createRawPublicKey, digestFile, getRawPublicKey, } from "./ed25519.js";
 import { ValidationError } from "./errors.js";
 import { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from "./minisign.js";
@@ -214,6 +215,56 @@ export async function writeSignature(path, privateKey, force = false, format = D
     });
     return signaturePath;
 }
+/**
+ * Validate the signing key and destinations before writing files. The input
+ * files need not exist yet, so zip can check before creating its artifacts.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return Parsed signing key.
+ * @throws {ValidationError} Without a valid key or when a signature already exists without force.
+ */
+export function checkSigningInput(input) {
+    const encoded = input.key ?? process.env[SIGNING_KEY_ENV];
+    const formats = input.formats ?? [DEFAULT_SIGNATURE_FORMAT];
+    if (!encoded?.trim()) {
+        throw new ValidationError(`Set the ${SIGNING_KEY_ENV} environment variable to the base64 Ed25519 signing key.`);
+    }
+    const privateKey = parseSigningKey(encoded);
+    const existing = input.paths
+        .flatMap((path) => formats.map((format) => getSignaturePath(path, format)))
+        .filter((path) => !input.force && existsSync(path));
+    if (existing.length) {
+        throw new ValidationError(`${existing.join(' and ')} already exists, pass --force to overwrite it.`);
+    }
+    return privateKey;
+}
+/**
+ * Sign files with a signature file of each format next to each, in order,
+ * so that a failure leaves a predictable set of files.
+ *
+ * @param  input Files, formats, key and whether to overwrite.
+ * @return The written signature files and the public keys.
+ * @throws {ValidationError} Without a key, for an invalid key, a missing file or an existing signature file without force.
+ */
+export async function signFiles(input) {
+    const formats = input.formats ?? [DEFAULT_SIGNATURE_FORMAT];
+    const privateKey = checkSigningInput(input);
+    await Promise.all(input.paths.map(async (path) => {
+        if (!(await stat(path).catch(() => null))?.isFile()) {
+            throw new ValidationError(`${path} is not a file.`);
+        }
+    }));
+    const signatures = [];
+    const jobs = input.paths.flatMap((path) => formats.map((format) => ({ path, format })));
+    for (const { path, format } of jobs) {
+        signatures.push(await writeSignature(path, privateKey, input.force, format));
+    }
+    return {
+        signatures,
+        publicKey: getPublicKey(privateKey),
+        publicKeys: getPublicKeys(privateKey),
+    };
+}
 /**
  * Check a file against a signature file. A wordpress .sig file can hold one
  * signature per line, and is valid when any of them match, so that a file

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wpelevator/wp-release",
-	"version": "0.14.0",
+	"version": "0.15.0",
 	"description": "Package, checksum, sign, verify and version-check WordPress plugins and themes, and deploy plugins to WordPress.org SVN",
 	"license": "MIT",
 	"repository": {