@ykdz/template 0.0.33 → 0.0.36

package/node_modules/@ykdz/template-builtin-presets/templates/ts-cli/publication/publish.ts

@@ -0,0 +1,483 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+/** Direct npm/OIDC adapter.  It deliberately imports Node built-ins only. */
+import { randomUUID } from "node:crypto";
+import { mkdtemp, lstat, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import {
+  acceptDownloadedPublicationArtifact,
+  fail,
+  PublicationFailure,
+} from "./handoff.ts";
+
+export { PublicationFailure } from "./handoff.ts";
+
+const packagePath = "{{PUBLIC_CLI_PACKAGE_PATH}}";
+const registry = "https://registry.npmjs.org/";
+
+export type ProcessResult = {
+  readonly exitCode: number;
+  readonly stdout: string;
+  readonly stderr: string;
+};
+
+export type DirectPublicationOptions = {
+  readonly repositoryRoot: string;
+  readonly artifactDirectory: string;
+  readonly environment: Readonly<Record<string, string | undefined>>;
+  readonly run?: (
+    command: string,
+    arguments_: readonly string[],
+    options: { readonly cwd: string; readonly env: NodeJS.ProcessEnv },
+  ) => Promise<ProcessResult>;
+};
+
+function canonicalEnvironmentKey(key: string): string {
+  return key.toLowerCase().replaceAll(/[^a-z0-9]/gu, "");
+}
+
+export function assertNoAmbientCredentials(
+  environment: Readonly<Record<string, string | undefined>>,
+): void {
+  for (const key of Object.keys(environment)) {
+    const canonical = canonicalEnvironmentKey(key);
+    if (
+      canonical === "nodeauthtoken" ||
+      ((canonical.startsWith("npm") || canonical.startsWith("pnpm")) &&
+        (canonical.includes("auth") ||
+          canonical.includes("token") ||
+          canonical.includes("password")))
+    ) {
+      fail(
+        "credential-fallback",
+        `ambient credential variable is forbidden: ${key}`,
+      );
+    }
+  }
+}
+
+type LockedSemver = {
+  readonly valid: (value: string) => string | null;
+  readonly prerelease: (value: string) => readonly unknown[] | null;
+  readonly gt: (left: string, right: string) => boolean;
+};
+
+async function loadLockedSemver(): Promise<LockedSemver> {
+  return await import("semver");
+}
+
+function isStableSemver(semver: LockedSemver, value: string): boolean {
+  return semver.valid(value) !== null && semver.prerelease(value) === null;
+}
+
+async function defaultRun(
+  command: string,
+  arguments_: readonly string[],
+  options: { readonly cwd: string; readonly env: NodeJS.ProcessEnv },
+): Promise<ProcessResult> {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(command, arguments_, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (value: Buffer) => (stdout += value));
+    child.stderr.on("data", (value: Buffer) => (stderr += value));
+    child.once("error", reject);
+    child.once("close", (exitCode) =>
+      resolve({ exitCode: exitCode ?? 1, stdout, stderr }),
+    );
+  });
+}
+
+function parseJson(value: string, code: string): unknown {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fail(code, "command returned invalid JSON");
+  }
+}
+
+function stringValue(value: unknown, code: string): string {
+  if (typeof value !== "string" || value.length === 0)
+    fail(code, "expected string");
+  return value;
+}
+
+function isolatedEnvironment(
+  source: Readonly<Record<string, string | undefined>>,
+  session: string,
+): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = {};
+  for (const key of [
+    "PATH",
+    "GITHUB_REPOSITORY",
+    "GITHUB_RUN_ATTEMPT",
+    "GITHUB_SHA",
+    "GITHUB_REF",
+    "GITHUB_EVENT_NAME",
+    "GITHUB_ACTIONS",
+    "GITHUB_WORKFLOW_REF",
+    "GITHUB_SERVER_URL",
+    "GITHUB_RUN_ID",
+    "RUNNER_ENVIRONMENT",
+    "GITHUB_REPOSITORY_ID",
+    "GITHUB_REPOSITORY_OWNER_ID",
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+  ]) {
+    if (source[key] !== undefined) environment[key] = source[key];
+  }
+  const home = path.join(session, "home");
+  return {
+    ...environment,
+    HOME: home,
+    USERPROFILE: home,
+    COREPACK_HOME: path.join(session, "corepack"),
+    COREPACK_NPM_REGISTRY: registry,
+    NPM_CONFIG_USERCONFIG: path.join(session, "user-npmrc"),
+    NPM_CONFIG_GLOBALCONFIG: path.join(session, "global-npmrc"),
+    NPM_CONFIG_CACHE: path.join(session, "npm-cache"),
+    PNPM_HOME: path.join(session, "pnpm-home"),
+  };
+}
+
+async function command(
+  run: NonNullable<DirectPublicationOptions["run"]>,
+  cwd: string,
+  env: NodeJS.ProcessEnv,
+  arguments_: readonly string[],
+  code: string,
+): Promise<string> {
+  const result = await run("corepack", ["pnpm", "exec", "npm", ...arguments_], {
+    cwd,
+    env,
+  });
+  if (result.exitCode !== 0) fail(code, "npm command failed");
+  return result.stdout.trim();
+}
+
+function npmArguments(
+  prefix: string,
+  configurationRoot = prefix,
+): readonly string[] {
+  return [
+    `--prefix=${prefix}`,
+    `--registry=${registry}`,
+    `--userconfig=${path.join(configurationRoot, "user-npmrc")}`,
+    `--globalconfig=${path.join(configurationRoot, "global-npmrc")}`,
+    `--cache=${path.join(configurationRoot, "npm-cache")}`,
+  ];
+}
+
+function isExplicitNotFound(result: ProcessResult): boolean {
+  return /^npm error code E404\s*$/mu.test(result.stderr);
+}
+
+async function assertNoCheckoutNpmrc(repositoryRoot: string): Promise<void> {
+  try {
+    await lstat(path.join(repositoryRoot, ".npmrc"));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    fail("checkout-npmrc-conflict", "checkout .npmrc cannot be inspected");
+  }
+  fail("checkout-npmrc-conflict", "checkout root .npmrc is forbidden");
+}
+
+function assertOidcAvailable(
+  environment: Readonly<Record<string, string | undefined>>,
+): void {
+  if (
+    environment.ACTIONS_ID_TOKEN_REQUEST_URL === undefined ||
+    environment.ACTIONS_ID_TOKEN_REQUEST_URL.length === 0 ||
+    environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN === undefined ||
+    environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN.length === 0
+  ) {
+    fail("oidc-unavailable", "GitHub OIDC request variables are required");
+  }
+}
+
+export async function runDirectOidcPublication(
+  options: DirectPublicationOptions,
+): Promise<void> {
+  assertNoAmbientCredentials(options.environment);
+  await assertNoCheckoutNpmrc(options.repositoryRoot);
+  assertOidcAvailable(options.environment);
+  const { receipt, tgz } = await acceptDownloadedPublicationArtifact({
+    repositoryRoot: options.repositoryRoot,
+    packagePath,
+    artifactDirectory: options.artifactDirectory,
+    githubRepository: options.environment.GITHUB_REPOSITORY,
+  });
+
+  const session = await mkdtemp(
+    path.join(options.environment.RUNNER_TEMP ?? tmpdir(), "npm-publication-"),
+  );
+  const run = options.run ?? defaultRun;
+  const env = isolatedEnvironment(options.environment, session);
+  try {
+    await Promise.all([
+      mkdir(path.join(session, "home")),
+      mkdir(path.join(session, "corepack")),
+      mkdir(path.join(session, "npm-cache")),
+      mkdir(path.join(session, "pnpm-home")),
+      mkdir(path.join(session, "pnpm-store")),
+    ]);
+    await writeFile(
+      path.join(session, ".npmrc"),
+      `registry=${registry}\nfetch-retries=1\n`,
+    );
+    await writeFile(path.join(session, "user-npmrc"), "");
+    await writeFile(path.join(session, "global-npmrc"), "");
+    const install = await run(
+      "corepack",
+      [
+        "pnpm",
+        "install",
+        "--frozen-lockfile",
+        "--ignore-scripts",
+        `--registry=${registry}`,
+        `--store-dir=${path.join(session, "pnpm-store")}`,
+      ],
+      { cwd: options.repositoryRoot, env },
+    );
+    if (install.exitCode !== 0)
+      fail("isolated-install-failed", "frozen install failed");
+    const common = npmArguments(session);
+    const semver = await loadLockedSemver();
+    if (
+      (await command(
+        run,
+        options.repositoryRoot,
+        env,
+        [...common, "config", "get", "fetch-retries"],
+        "effective-config-invalid",
+      )) !== "1"
+    ) {
+      fail(
+        "effective-config-invalid",
+        "session fetch-retries marker is not active",
+      );
+    }
+    if (
+      (await command(
+        run,
+        options.repositoryRoot,
+        env,
+        [...common, "config", "get", "registry"],
+        "effective-config-invalid",
+      )) !== registry
+    ) {
+      fail("effective-config-invalid", "session registry is not active");
+    }
+    const publication = receipt.publication;
+    const latestRaw = await command(
+      run,
+      options.repositoryRoot,
+      env,
+      [...common, "view", publication.packageName, "dist-tags", "--json"],
+      "registry-preflight-failed",
+    );
+    const latest = (
+      parseJson(latestRaw, "registry-preflight-failed") as { latest?: unknown }
+    ).latest;
+    if (typeof latest !== "string" || !isStableSemver(semver, latest))
+      fail("latest-invalid", "daily lane needs stable latest");
+    const exact = await run(
+      "corepack",
+      [
+        "pnpm",
+        "exec",
+        "npm",
+        ...common,
+        "view",
+        `${publication.packageName}@${publication.version}`,
+        "dist.integrity",
+        "--json",
+      ],
+      { cwd: options.repositoryRoot, env },
+    );
+    const attempt = Number(options.environment.GITHUB_RUN_ATTEMPT);
+    if (!Number.isInteger(attempt) || attempt < 1)
+      fail("registry-preflight-failed", "invalid run attempt");
+    const exactExists = exact.exitCode === 0;
+    if (!exactExists && !isExplicitNotFound(exact)) {
+      fail(
+        "registry-preflight-failed",
+        exact.stderr ||
+          exact.stdout ||
+          "exact version lookup was not a not-found response",
+      );
+    }
+    let alreadyWritten = false;
+    if (attempt === 1 && exactExists)
+      fail("fresh-version-exists", "fresh run cannot reuse a version");
+    if (exactExists && attempt > 1) {
+      const integrity = stringValue(
+        parseJson(exact.stdout, "rerun-integrity-conflict"),
+        "rerun-integrity-conflict",
+      );
+      if (integrity !== receipt.artifact.integrity)
+        fail("rerun-integrity-conflict", "existing integrity differs");
+      if (latest !== publication.version)
+        fail("rerun-latest-conflict", "latest differs from candidate");
+      alreadyWritten = true;
+    }
+    if (!exactExists && !semver.gt(publication.version, latest))
+      fail("latest-stale", "candidate must be newer than latest");
+    if (!alreadyWritten) {
+      await command(
+        run,
+        options.repositoryRoot,
+        env,
+        [...common, "publish", tgz, "--access=public", "--provenance"],
+        "publish-failed",
+      );
+    }
+    const readIntegrity = stringValue(
+      parseJson(
+        await command(
+          run,
+          options.repositoryRoot,
+          env,
+          [
+            ...common,
+            "view",
+            `${publication.packageName}@${publication.version}`,
+            "dist.integrity",
+            "--json",
+          ],
+          "postwrite-integrity-conflict",
+        ),
+        "postwrite-integrity-conflict",
+      ),
+      "postwrite-integrity-conflict",
+    );
+    const postTags = parseJson(
+      await command(
+        run,
+        options.repositoryRoot,
+        env,
+        [...common, "view", publication.packageName, "dist-tags", "--json"],
+        "postwrite-integrity-conflict",
+      ),
+      "postwrite-integrity-conflict",
+    ) as { latest?: unknown };
+    if (
+      readIntegrity !== receipt.artifact.integrity ||
+      postTags.latest !== publication.version
+    )
+      fail(
+        "postwrite-integrity-conflict",
+        "registry does not point to receipt artifact",
+      );
+    const consumer = path.join(session, `consumer-${randomUUID()}`);
+    await mkdir(consumer);
+    await writeFile(
+      path.join(consumer, "package.json"),
+      JSON.stringify({
+        private: true,
+        dependencies: { [publication.packageName]: publication.version },
+      }),
+    );
+    await writeFile(
+      path.join(consumer, ".npmrc"),
+      `registry=${registry}\nfetch-retries=1\n`,
+    );
+    const consumerArguments = npmArguments(consumer, session);
+    await command(
+      run,
+      options.repositoryRoot,
+      env,
+      [...consumerArguments, "install", "--ignore-scripts"],
+      "exact-install-failed",
+    );
+    const audit = parseJson(
+      await command(
+        run,
+        options.repositoryRoot,
+        env,
+        [
+          ...consumerArguments,
+          "audit",
+          "signatures",
+          "--json",
+          "--include-attestations",
+        ],
+        "signature-audit-invalid",
+      ),
+      "signature-audit-invalid",
+    ) as { invalid?: unknown; missing?: unknown; verified?: unknown };
+    if (
+      typeof audit !== "object" ||
+      audit === null ||
+      !Array.isArray(audit.invalid) ||
+      audit.invalid.length !== 0 ||
+      !Array.isArray(audit.missing) ||
+      audit.missing.length !== 0 ||
+      !Array.isArray(audit.verified)
+    ) {
+      fail(
+        "signature-audit-invalid",
+        "npm audit schema is incomplete or invalid",
+      );
+    }
+    const matches = audit.verified.filter(
+      (item) =>
+        typeof item === "object" &&
+        item !== null &&
+        !Array.isArray(item) &&
+        (item as { name?: unknown }).name === publication.packageName &&
+        (item as { version?: unknown }).version === publication.version,
+    );
+    if (matches.length !== 1)
+      fail(
+        "signature-audit-invalid",
+        "exact package attestation is missing or ambiguous",
+      );
+    const exactVerified = matches[0] as { attestationBundles?: unknown };
+    if (
+      !Array.isArray(exactVerified.attestationBundles) ||
+      exactVerified.attestationBundles.length === 0
+    ) {
+      fail(
+        "signature-audit-invalid",
+        "exact package attestation bundle is missing",
+      );
+    }
+  } finally {
+    await rm(session, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) {
+  const artifactDirectory = process.env.PUBLICATION_ARTIFACT_DIRECTORY;
+  if (artifactDirectory === undefined || !path.isAbsolute(artifactDirectory)) {
+    throw new PublicationFailure(
+      "artifact-unavailable",
+      "PUBLICATION_ARTIFACT_DIRECTORY must be absolute",
+    );
+  }
+  try {
+    await runDirectOidcPublication({
+      repositoryRoot: process.cwd(),
+      artifactDirectory,
+      environment: process.env,
+    });
+  } catch (error) {
+    if (!(error instanceof PublicationFailure)) throw error;
+    console.error(`ERROR ${error.code}`);
+    console.error("Observed: publication precondition was not accepted");
+    console.error(
+      "Expected: a verified artifact and isolated GitHub OIDC session",
+    );
+    console.error(
+      "Next action: correct the reported publication precondition and rerun the failed job",
+    );
+    process.exitCode = 1;
+  }
+}