@xemahq/repo-build-tooling 0.13.0 → 0.14.0

package/README.md

@@ -33,7 +33,7 @@ pnpm exec xema-scrub-swagger-paths dist
 | `xema-check-no-vendored-deps` | Fails on a `workspace:` range for a package the repository does not own |
 | `xema-check-workspace-ranges` | Fails on a `workspace:` range the local package does not satisfy |
 
-`xema-composed-image members --write|--check` accepts `--manifests <glob>` (repeatable, default `**/xema-biome.json`), `--canonical-dockerfile <path>` and `--cross-repo-manifest <path>`. `xema-composed-image dockerfile` requires `--tooling-version`, `--copy`, `--cache-id` and `--build-source`. `dockerfile --prebuilt` renders the Dockerfile and `Dockerfile.dockerignore` of an image assembled from `stage <dir> [--output <rel>]… [--also <pkg>]…` output (requires `--tooling-version`, `--cache-id`, `--build-source`; `--copy` and `--stage-dir` optional); `load --each` loads every member in its own process. `stage` and `filters` accept `--also <workspace package name>` (repeatable): the package's closure is built and staged (built outputs only, no Prisma checks) alongside the members; an unknown name is refused. Run `xema-composed-image` with no arguments for the full usage.
+`xema-composed-image members --write|--check` accepts `--manifests <glob>` (repeatable, default `**/xema-biome.json`), `--canonical-dockerfile <path>` and `--cross-repo-manifest <path>`. `xema-composed-image dockerfile` requires `--copy`, `--cache-id` and `--build-source`; it pins the version of this tool itself, and there is no flag for it (`--tooling-version` is refused as an unknown option). `dockerfile --prebuilt` renders the Dockerfile and `Dockerfile.dockerignore` of an image assembled from `stage <dir> [--output <rel>]… [--also <pkg>]…` output (requires `--cache-id`, `--build-source`; `--copy` and `--stage-dir` optional); `load --each` loads every member in its own process. `stage` and `filters` accept `--also <workspace package name>` (repeatable): the package's closure is built and staged (built outputs only, no Prisma checks) alongside the members; an unknown name is refused. Run `xema-composed-image` with no arguments for the full usage.
 
 Every step refuses rather than skips. The package has no dependencies.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -44,6 +44,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-migrate.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a3994566dfeac8ede246a07315647fa7f10828b510cf5835a0640a8a97650f5c"
+    "sourceDigest": "sha256:003d770229d6ab378573068cfaf5b02e89b6bbd632dcfce3ccb17125d94322e1"
   }
 }

package/src/composed-image-dockerfile.mjs

@@ -5,7 +5,7 @@
 // build context carries (`--copy`, repeatable), its pnpm cache id (`--cache-id`),
 // the repository its member subjects name in an edition's image lock
 // (`--build-source`) and the EXACT version of this tool the builder installs
-// (`--tooling-version`). The tool is pinned exactly so the image directory, which
+// (its own package version, never a flag). The tool is pinned exactly so the image directory, which
 // the content tag hashes, changes whenever the tool does.
 //
 // NOTHING OF THE TOOL SHIPS: it is installed globally in the builder stage only,
@@ -17,19 +17,16 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, posix } from 'node:path';
 
 import { COMPOSED_IMAGE_DIR } from './composed-image-paths.mjs';
+import { toolVersion } from './composed-image-stage.mjs';
 
 const TOKEN_REFERENCE = /_authToken\b|\$\{(?:NPM_TOKEN|GH_PACKAGES_TOKEN)\}/;
-const VERSION = /^\d+\.\d+\.\d+$/;
 const DIRECTORY = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*\/?$/;
 const CACHE_ID = /^[a-z0-9][a-z0-9-]*$/;
 const REPOSITORY = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/;
 export const NODE_BASE =
   'mirror.gcr.io/library/node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436';
 
-function validate({ toolingVersion, copy, cacheId, buildSource }) {
-  if (!VERSION.test(toolingVersion ?? '')) {
-    throw new Error(`--tooling-version must be an exact x.y.z version, got "${toolingVersion}"`);
-  }
+function validate({ copy, cacheId, buildSource }) {
   if (!Array.isArray(copy) || copy.length === 0) throw new Error('--copy needs at least one directory');
   for (const directory of copy) {
     if (!DIRECTORY.test(directory) || directory.startsWith('/') || directory.split('/').includes('..')) {
@@ -46,9 +43,10 @@ export function npmrcUsesToken(npmrcText) {
 }
 
 /** The Dockerfile text. `usesToken` mounts the `npm_token` build secret; derive it with `npmrcUsesToken`. `imageDir` is where the repository keeps the image (and so where this is written). */
-export function renderComposedDockerfile({ toolingVersion, copy, cacheId, buildSource, usesToken, imageDir = COMPOSED_IMAGE_DIR }) {
+export function renderComposedDockerfile({ copy, cacheId, buildSource, usesToken, imageDir = COMPOSED_IMAGE_DIR }) {
   if (typeof usesToken !== 'boolean') throw new Error('usesToken must be a boolean derived from .npmrc');
-  validate({ toolingVersion, copy, cacheId, buildSource });
+  validate({ copy, cacheId, buildSource });
+  const toolingVersion = toolVersion();
   const dirFlag = imageDir === COMPOSED_IMAGE_DIR ? '' : ` --image-dir ${imageDir}`;
   const tool = (command) => `xema-composed-image ${command}${dirFlag}`;
   const copies = [...new Set([...copy.map((d) => posix.normalize(`${d}/`)), posix.normalize(`${imageDir}/`)])]

package/src/composed-image-dockerfile.test.mjs

@@ -4,10 +4,11 @@ import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
 
+import { toolVersion } from './composed-image-stage.mjs';
+
 import { npmrcUsesToken, renderComposedDockerfile, syncComposedDockerfile } from './composed-image-dockerfile.mjs';
 
 const OPTIONS = {
-  toolingVersion: '0.9.0',
   copy: ['packages', 'tooling/dev/', 'biomes'],
   cacheId: 'alpha-composed-process',
   buildSource: 'alpha',
@@ -16,7 +17,7 @@ const OPTIONS = {
 
 test('the template carries every parameter and no per-repository literal', () => {
   const text = renderComposedDockerfile(OPTIONS);
-  assert.match(text, /npm install --global --ignore-scripts @xemahq\/repo-build-tooling@0\.9\.0\n/);
+  assert.ok(text.includes(`npm install --global --ignore-scripts @xemahq/repo-build-tooling@${toolVersion()}\n`));
   assert.match(text, /^COPY packages\/ \.\/packages\/\nCOPY tooling\/dev\/ \.\/tooling\/dev\/\nCOPY biomes\/ \.\/biomes\/\nCOPY infra\/composed-process\/ \.\/infra\/composed-process\/$/m);
   assert.match(text, /id=pnpm-store-alpha-composed-process,/);
   assert.match(text, /id=pnpm-metadata-alpha-composed-process,/);
@@ -39,9 +40,7 @@ test('nothing of the tool reaches the final stage; load runs in the builder as n
   assert.match(final, /CMD \["node", "\/monorepo\/xema-composed-process"\]/);
 });
 
-test('the tool version, the directories and the ids are validated', () => {
-  assert.throws(() => renderComposedDockerfile({ ...OPTIONS, toolingVersion: '^0.9.0' }), /exact x\.y\.z/);
-  assert.throws(() => renderComposedDockerfile({ ...OPTIONS, toolingVersion: undefined }), /exact x\.y\.z/);
+test('the directories and the ids are validated', () => {
   assert.throws(() => renderComposedDockerfile({ ...OPTIONS, copy: [] }), /at least one/);
   for (const bad of ['../x', '/abs', 'a b', 'a;b']) assert.throws(() => renderComposedDockerfile({ ...OPTIONS, copy: [bad] }), /repository-relative/);
   assert.throws(() => renderComposedDockerfile({ ...OPTIONS, cacheId: 'Bad_Id' }), /--cache-id/);
@@ -56,7 +55,7 @@ test('--write renders and --check refuses a stale or missing file', () => {
   assert.throws(() => syncComposedDockerfile({ mode: 'check', root, ...OPTIONS }), /is stale/);
   assert.equal(syncComposedDockerfile({ mode: 'write', root, ...OPTIONS }), 'infra/composed-process/Dockerfile');
   syncComposedDockerfile({ mode: 'check', root, ...OPTIONS });
-  assert.throws(() => syncComposedDockerfile({ mode: 'check', root, ...OPTIONS, toolingVersion: '0.9.1' }), /is stale/);
+  assert.throws(() => syncComposedDockerfile({ mode: 'check', root, ...OPTIONS, cacheId: 'beta-composed-process' }), /is stale/);
   assert.throws(() => syncComposedDockerfile({ mode: 'sideways', root, ...OPTIONS }), /write or check/);
 });
 

package/src/composed-image-prebuilt-dockerfile.mjs

@@ -7,17 +7,16 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, posix } from 'node:path';
 
 import { COMPOSED_IMAGE_DIR } from './composed-image-paths.mjs';
+import { toolVersion } from './composed-image-stage.mjs';
 import { NODE_BASE, npmrcUsesToken } from './composed-image-dockerfile.mjs';
 import { memberClosure, memberFilters, memberManifests } from './composed-image-members.mjs';
 
 export const DEFAULT_STAGE_DIR = '.xema-stage';
-const VERSION = /^\d+\.\d+\.\d+$/;
 const DIRECTORY = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*\/?$/;
 const CACHE_ID = /^[a-z0-9][a-z0-9-]*$/;
 const REPOSITORY = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/;
 
-function validate({ toolingVersion, copy, cacheId, buildSource, stageDir }) {
-  if (!VERSION.test(toolingVersion ?? '')) throw new Error(`--tooling-version must be an exact x.y.z version, got "${toolingVersion}"`);
+function validate({ copy, cacheId, buildSource, stageDir }) {
   for (const directory of [...(copy ?? []), stageDir]) {
     if (!DIRECTORY.test(directory) || directory.startsWith('/') || directory.split('/').includes('..')) {
       throw new Error(`"${directory}" is not a repository-relative directory`);
@@ -69,7 +68,6 @@ const parts = (sources) => sources.map((source) => `    ${source} \\`).join('\n'
 export function renderPrebuiltDockerfile({
   root = process.cwd(),
   imageDir = COMPOSED_IMAGE_DIR,
-  toolingVersion,
   copy = [],
   cacheId,
   buildSource,
@@ -78,7 +76,8 @@ export function renderPrebuiltDockerfile({
   exec,
 }) {
   if (typeof usesToken !== 'boolean') throw new Error('usesToken must be a boolean derived from .npmrc');
-  validate({ toolingVersion, copy, cacheId, buildSource, stageDir });
+  validate({ copy, cacheId, buildSource, stageDir });
+  const toolingVersion = toolVersion();
   const workspaceFile = join(root, 'pnpm-workspace.yaml');
   const built = existsSync(workspaceFile) ? onlyBuiltDependencies(readFileSync(workspaceFile, 'utf8')) : [];
   if (built.length === 0) {

package/src/composed-image-prebuilt-dockerfile.test.mjs

@@ -8,7 +8,7 @@ import { parseArguments } from './composed-image.mjs';
 import { CLOSURE, fakePnpm, workspace } from './composed-image-fixture.test.mjs';
 
 function options(root, extra = {}) {
-  return { root, toolingVersion: '0.11.0', copy: ['tooling/dev'], cacheId: 'alpha-composed-process', buildSource: 'alpha', usesToken: true, exec: fakePnpm(root), ...extra };
+  return { root, copy: ['tooling/dev'], cacheId: 'alpha-composed-process', buildSource: 'alpha', usesToken: true, exec: fakePnpm(root), ...extra };
 }
 
 test('the closure comes from pnpm ls with the members filters, and the filters are literal per member', () => {

package/src/composed-image.mjs

@@ -61,10 +61,10 @@
 //   smoke-refusal <image> [--member <biomeId>/<componentKey>]x2
 //            boot the pushed image with a declaration the host must refuse
 //            (`smoke-refusal.mjs`).
-//   dockerfile --write|--check --tooling-version <x.y.z> --copy <dir>… --cache-id <id> --build-source <repo>
+//   dockerfile --write|--check --copy <dir>… --cache-id <id> --build-source <repo>
 //            render `<image-dir>/Dockerfile` from the package's template
 //            (`composed-image-dockerfile.mjs`).
-//   dockerfile --prebuilt --write|--check --tooling-version <x.y.z> --cache-id <id> --build-source <repo> [--copy <dir>]… [--stage-dir <dir>]
+//   dockerfile --prebuilt --write|--check --cache-id <id> --build-source <repo> [--copy <dir>]… [--stage-dir <dir>]
 //            render the Dockerfile that ASSEMBLES the image from `stage` output, and its
 //            `Dockerfile.dockerignore` (`composed-image-prebuilt-dockerfile.mjs`).
 //
@@ -462,13 +462,13 @@ const USAGE =
   '  coordinate --image-name <name>   (env: SHA REGISTRY REGISTRY_ORG [TAG_ARGS_FILE])\n' +
   '  load-image <image>\n' +
   '  smoke-refusal <image> [--member <biomeId>/<componentKey>]x2\n' +
-  '  dockerfile --write|--check --tooling-version <x.y.z> --copy <dir>… --cache-id <id> --build-source <repo>\n' +
-  '  dockerfile --prebuilt --write|--check --tooling-version <x.y.z> --cache-id <id> --build-source <repo> [--copy <dir>]… [--stage-dir <dir>]';
+  '  dockerfile --write|--check --copy <dir>… --cache-id <id> --build-source <repo>\n' +
+  '  dockerfile --prebuilt --write|--check --cache-id <id> --build-source <repo> [--copy <dir>]… [--stage-dir <dir>]';
 
 const REPEATABLE = new Set(['manifests', 'copy', 'member', 'output', 'also']);
 const BOOLEAN = new Set(['prebuilt', 'each']);
 const VALUED = new Set(['root', 'image-dir', 'manifests', 'canonical-dockerfile', 'cross-repo-manifest', 'build-source',
-  'image-name', 'tooling-version', 'cache-id', 'copy', 'member', 'stage-dir', 'output', 'also',
+  'image-name', 'cache-id', 'copy', 'member', 'stage-dir', 'output', 'also',
 ]);
 
 export function parseArguments(argv) {
@@ -573,7 +573,6 @@ export function main(argv, { log = console.log, write = (text) => process.stdout
           mode: options.mode,
           root,
           imageDir,
-          toolingVersion: options['tooling-version'],
           copy: options.copy,
           cacheId: options['cache-id'],
           buildSource: options['build-source'],
@@ -586,7 +585,6 @@ export function main(argv, { log = console.log, write = (text) => process.stdout
         mode: options.mode,
         root,
         imageDir,
-        toolingVersion: options['tooling-version'],
         copy: options.copy,
         cacheId: options['cache-id'],
         buildSource: options['build-source'],

package/src/composed-image.test.mjs

@@ -239,12 +239,13 @@ test('the bin runs through a symlink, as npm installs it, and exits non-zero on
 });
 
 test('the new commands parse their options; coordinate refuses without an image name', async () => {
-  const parsed = parseArguments(['dockerfile', '--write', '--copy', 'a', '--copy', 'b', '--cache-id', 'c', '--tooling-version', '1.2.3']);
+  const parsed = parseArguments(['dockerfile', '--write', '--copy', 'a', '--copy', 'b', '--cache-id', 'c']);
   assert.deepEqual(parsed.options.copy, ['a', 'b']);
   assert.equal(parsed.options['cache-id'], 'c');
   assert.deepEqual(parseArguments(['smoke-refusal', 'img', '--member', 'x/y', '--member', 'x/z']).options.member, ['x/y', 'x/z']);
   assert.throws(() => main(['coordinate'], { log() {} }), /--image-name/);
-  assert.throws(() => main(['dockerfile', '--write'], { log() {} }), /exact x\.y\.z/);
+  assert.throws(() => main(['dockerfile', '--write'], { log() {} }), /at least one/);
+  assert.throws(() => parseArguments(['dockerfile', '--write', '--tooling-version', '1.2.3']), /unknown option --tooling-version/);
   assert.throws(() => main(['smoke-refusal'], { log() {} }), /usage/);
 });