@zairakai/js-dev-tools 3.3.0 → 3.3.2

package/.gitlab/ci/pipeline-js-package.yml

@@ -134,6 +134,8 @@ variables:
 secret_detection:
   stage: security
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_MERGE_REQUEST_ID
     - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"
 
@@ -144,6 +146,8 @@ js:tag-format:
   stage: security
   image: ${ALPINE_IMAGE}
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG
   script:
     - |
@@ -166,6 +170,10 @@ js:tag-format:
 js:install:
   <<: [*base_job, *cache_node_push]
   stage: install
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${NODE_IMAGE}
   script:
     - npm ci --cache .npm --prefer-offline
@@ -184,6 +192,10 @@ js:install:
 js:validate:markdownlint:
   <<: [*base_job, *cache_node]
   stage: validate
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${NODE_IMAGE}
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/markdownlint.sh"
@@ -191,6 +203,10 @@ js:validate:markdownlint:
 js:validate:shellcheck:
   <<: *base_job
   stage: validate
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${SHELLCHECK_IMAGE}
   before_script:
     - apk add --no-cache bash
@@ -208,6 +224,10 @@ js:validate:shellcheck:
 js:quality:lint:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/eslint.sh"
   artifacts:
@@ -221,18 +241,30 @@ js:quality:lint:
 js:quality:format:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/prettier.sh"
 
 js:quality:stylelint:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/stylelint.sh"
 
 js:quality:typecheck:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - |
       if [ -f tsconfig.json ] && [ -f node_modules/.bin/tsc ]; then
@@ -244,12 +276,20 @@ js:quality:typecheck:
 js:quality:knip:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/knip.sh"
 
 js:quality:bats:
   <<: [*base_job, *cache_node]
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${ALPINE_IMAGE}
   before_script:
     - apk add --no-cache bash bats git
@@ -265,6 +305,8 @@ js:quality:outdated:
   <<: *job_node
   stage: quality
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_PIPELINE_SOURCE == "schedule"
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/outdated.sh"
@@ -280,6 +322,10 @@ js:quality:outdated:
 js:test:
   <<: [*base_job, *cache_node]
   stage: test
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${NODE_TEST_IMAGE}
   script:
     - CI=true bash "$JS_DEV_TOOLS_SCRIPTS/test.sh"
@@ -314,6 +360,8 @@ js:build:
     expire_in: 1 week
     when: on_success
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
     - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"
     - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_MERGE_REQUEST_ID
@@ -326,6 +374,8 @@ js:publish:
   stage: publish
   image: ${NODE_IMAGE}
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
   script:
     - |
@@ -356,6 +406,8 @@ js:release:
   stage: release
   image: ${RELEASE_CLI_IMAGE}
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
   before_script:
     - apk add --no-cache bash git jq
@@ -402,6 +454,7 @@ deps:update:
   script:
     - node --version
     - "[ -d node_modules ] || npm ci --no-audit --no-fund"
+    - '[ "${JS_DEV_TOOLS_SCRIPTS}" = "scripts" ] || npm install --no-save --no-audit --no-fund "@zairakai/js-dev-tools@latest"'
     - node "${JS_DEV_TOOLS_SCRIPTS}/update-dependencies.mjs" update
   rules:
     - if: $UPDATE_DEPENDENCIES == "true" && $CI_COMMIT_BRANCH == "develop"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zairakai/js-dev-tools",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "The unified and centralized development toolkit for JavaScript/TypeScript projects - ESLint, Prettier, Stylelint, Knip, Vitest, Git Hooks, and GitLab CI pipeline templates",
   "keywords": [
     "dev-tools",

package/scripts/update-dependencies.mjs

@@ -111,6 +111,23 @@ export function formatChanges(rows) {
   return lines.join('\n')
 }
 
+/** The identity and the key used to sign, from the group variables. It fails when one is missing: no unsigned tag. */
+export function signerIdentity(env) {
+  const missing = ['GPG_PRIVATE_KEY_B64', 'RELEASE_SIGNER_NAME', 'RELEASE_SIGNER_EMAIL'].filter((name) => !env[name])
+
+  if (0 < missing.length) {
+    throw new Error(
+      `${missing.join(', ')} not set: the commits and the tags are signed, see the handbook (versioning).`
+    )
+  }
+
+  return {
+    name: env.RELEASE_SIGNER_NAME,
+    email: env.RELEASE_SIGNER_EMAIL,
+    key: Buffer.from(env.GPG_PRIVATE_KEY_B64, 'base64').toString('utf8'),
+  }
+}
+
 /** What `tag` has to do: the version to create, or null (and why). */
 export function planTag({ config, last, commits, before, after }) {
   if ('never' === config.tag.when) return { version: null, reason: 'the project is never tagged by the update' }
@@ -179,9 +196,52 @@ function assertEnvironment() {
   run('git', ['config', '--global', '--add', 'safe.directory', process.cwd()])
 }
 
-function configureGit() {
-  run('git', ['config', 'user.name', 'Stanislas Poisson (autoupdate)'])
-  run('git', ['config', 'user.email', 'contact@stanislas-poisson.fr'])
+/** GPG is not in the image of the CI: add it with the package manager of the image (Alpine or Debian). */
+function ensureGpg() {
+  const available = () => {
+    try {
+      run('gpg', ['--version'])
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  if (available()) return
+
+  for (const [command, args] of [
+    ['apk', ['add', '--no-cache', 'gnupg']],
+    ['apt-get', ['install', '-y', '--no-install-recommends', 'gnupg']],
+  ]) {
+    try {
+      run(command, args)
+    } catch {
+      continue
+    }
+
+    if (available()) return
+  }
+
+  throw new Error('gpg is not installed and could not be added: add gnupg to the image of the job.')
+}
+
+/** Import the signing key and make Git sign the commits and the tags with it. */
+function configureSigning() {
+  const signer = signerIdentity(process.env)
+
+  ensureGpg()
+
+  run('gpg', ['--batch', '--import'], { input: signer.key, stdio: ['pipe', 'pipe', 'pipe'] })
+  const fingerprint = run('gpg', ['--list-secret-keys', '--with-colons'])
+    .split('\n')
+    .find((line) => line.startsWith('fpr'))
+    .split(':')[9]
+
+  run('git', ['config', 'user.name', signer.name])
+  run('git', ['config', 'user.email', signer.email])
+  run('git', ['config', 'user.signingkey', fingerprint])
+  run('git', ['config', 'commit.gpgsign', 'true'])
+  run('git', ['config', 'tag.gpgsign', 'true'])
 }
 
 function remoteUrl() {
@@ -244,7 +304,7 @@ async function update(config) {
     return
   }
 
-  configureGit()
+  configureSigning()
   const before = JSON.parse(readFileSync('package.json', 'utf8'))
   const branch = `${BRANCH_PREFIX}-${new Date().toISOString().slice(0, 10).replaceAll('-', '')}`
   run('git', ['switch', '-c', branch])
@@ -333,16 +393,11 @@ async function tag(config) {
     return
   }
 
-  const result = await api('POST', `/projects/${projectId()}/repository/tags`, {
-    tag_name: plan.version,
-    ref: process.env.CI_COMMIT_SHA,
-    message: plan.version,
-  })
-
-  if (!result.ok)
-    throw new Error(`The tag ${plan.version} could not be created: ${secret(JSON.stringify(result.data))}`)
+  configureSigning()
+  run('git', ['tag', '-s', plan.version, '-m', plan.version, process.env.CI_COMMIT_SHA])
+  run('git', ['push', remoteUrl(), `refs/tags/${plan.version}`])
 
-  log(`Tag ${plan.version} created (last tag ${last}): ${plan.reason}. Its pipeline publishes the package.`)
+  log(`Tag ${plan.version} signed and pushed (last tag ${last}): ${plan.reason}. Its pipeline publishes the package.`)
 }
 
 async function cascade(config) {