@zairakai/js-dev-tools 3.3.1 → 3.4.0

package/.gitlab/ci/pipeline-js-package.yml

@@ -77,6 +77,9 @@ variables:
   NODE_VERSION: "24"
   NODE_IMAGE: "zairakai/node:latest-dev"
   NODE_TEST_IMAGE: "zairakai/node:latest-test"
+  # The jobs of the automatic updates sign with gpg: the image has it since 1.3.0. It is an exact version, published on
+  # Docker Hub like our other images: the runner pulls it, whatever the old image it keeps locally.
+  NODE_UPDATE_IMAGE: "zairakai/node:1.3.0-dev"
   SHELLCHECK_IMAGE: "koalaman/shellcheck-alpine:v0.10.0"
   RELEASE_CLI_IMAGE: "registry.gitlab.com/gitlab-org/release-cli:v0.18.0"
   ALPINE_IMAGE: "alpine:3.18"
@@ -134,6 +137,8 @@ variables:
 secret_detection:
   stage: security
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_MERGE_REQUEST_ID
     - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"
 
@@ -144,6 +149,8 @@ js:tag-format:
   stage: security
   image: ${ALPINE_IMAGE}
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG
   script:
     - |
@@ -166,6 +173,10 @@ js:tag-format:
 js:install:
   <<: [*base_job, *cache_node_push]
   stage: install
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${NODE_IMAGE}
   script:
     - npm ci --cache .npm --prefer-offline
@@ -184,6 +195,10 @@ js:install:
 js:validate:markdownlint:
   <<: [*base_job, *cache_node]
   stage: validate
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${NODE_IMAGE}
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/markdownlint.sh"
@@ -191,6 +206,10 @@ js:validate:markdownlint:
 js:validate:shellcheck:
   <<: *base_job
   stage: validate
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${SHELLCHECK_IMAGE}
   before_script:
     - apk add --no-cache bash
@@ -208,6 +227,10 @@ js:validate:shellcheck:
 js:quality:lint:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/eslint.sh"
   artifacts:
@@ -221,18 +244,30 @@ js:quality:lint:
 js:quality:format:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/prettier.sh"
 
 js:quality:stylelint:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/stylelint.sh"
 
 js:quality:typecheck:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - |
       if [ -f tsconfig.json ] && [ -f node_modules/.bin/tsc ]; then
@@ -244,12 +279,20 @@ js:quality:typecheck:
 js:quality:knip:
   <<: *job_node
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/knip.sh"
 
 js:quality:bats:
   <<: [*base_job, *cache_node]
   stage: quality
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${ALPINE_IMAGE}
   before_script:
     - apk add --no-cache bash bats git
@@ -265,6 +308,8 @@ js:quality:outdated:
   <<: *job_node
   stage: quality
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_PIPELINE_SOURCE == "schedule"
   script:
     - bash "$JS_DEV_TOOLS_SCRIPTS/outdated.sh"
@@ -280,6 +325,10 @@ js:quality:outdated:
 js:test:
   <<: [*base_job, *cache_node]
   stage: test
+  rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
+    - when: on_success
   image: ${NODE_TEST_IMAGE}
   script:
     - CI=true bash "$JS_DEV_TOOLS_SCRIPTS/test.sh"
@@ -314,6 +363,8 @@ js:build:
     expire_in: 1 week
     when: on_success
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
     - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "develop"
     - if: $CI_PIPELINE_SOURCE == "merge_request_event" || $CI_MERGE_REQUEST_ID
@@ -326,6 +377,8 @@ js:publish:
   stage: publish
   image: ${NODE_IMAGE}
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
   script:
     - |
@@ -356,6 +409,8 @@ js:release:
   stage: release
   image: ${RELEASE_CLI_IMAGE}
   rules:
+    - if: $UPDATE_DEPENDENCIES == "true"
+      when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
   before_script:
     - apk add --no-cache bash git jq
@@ -397,11 +452,12 @@ js:release:
 deps:update:
   <<: *base_job
   stage: install
-  image: ${NODE_IMAGE}
+  image: ${NODE_UPDATE_IMAGE}
   needs: []
   script:
     - node --version
     - "[ -d node_modules ] || npm ci --no-audit --no-fund"
+    - '[ "${JS_DEV_TOOLS_SCRIPTS}" = "scripts" ] || npm install --no-save --no-audit --no-fund "@zairakai/js-dev-tools@latest"'
     - node "${JS_DEV_TOOLS_SCRIPTS}/update-dependencies.mjs" update
   rules:
     - if: $UPDATE_DEPENDENCIES == "true" && $CI_COMMIT_BRANCH == "develop"
@@ -421,7 +477,7 @@ deps:release:
 deps:tag:
   <<: *base_job
   stage: release
-  image: ${NODE_IMAGE}
+  image: ${NODE_UPDATE_IMAGE}
   variables:
     GIT_DEPTH: 0
   script:

package/README.md

@@ -178,6 +178,8 @@ The pipeline template updates the dependencies of a project by itself, and this
 - `deps:release` brings `develop` into `main` after such an update, and `deps:tag` tags `main` when a published range (`dependencies`, `peerDependencies`) changed. A project that changed only its development dependencies is not tagged: its published archive is the same.
 - After the publication of a tag, `deps:cascade` waits for the version to be on the registry, then starts the update of the projects that have a `.dependency-update.json`.
 
+The same script serves the PHP projects (`composer.json`): a job in the PHP image runs `composer update`, then this script commits, signs and opens the merge request, and `deps:tag` looks at `require` only. The jobs that sign (`deps:update`, `deps:tag`) run on an exact version of the node image (`NODE_UPDATE_IMAGE`, published on Docker Hub), because they need `gpg` and the image of the runner is not updated by itself.
+
 The exceptions of a project live in `.dependency-update.json` at its root (everything is optional):
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zairakai/js-dev-tools",
-  "version": "3.3.1",
+  "version": "3.4.0",
   "description": "The unified and centralized development toolkit for JavaScript/TypeScript projects - ESLint, Prettier, Stylelint, Knip, Vitest, Git Hooks, and GitLab CI pipeline templates",
   "keywords": [
     "dev-tools",

package/scripts/update-dependencies.mjs

@@ -39,6 +39,17 @@ const DEFAULTS = {
 const RUNTIME_SECTIONS = ['dependencies', 'peerDependencies', 'optionalDependencies']
 const ALL_SECTIONS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
 
+/** The manifest of each ecosystem, with the sections that are published and all of them. */
+const ECOSYSTEMS = {
+  npm: { file: 'package.json', runtime: RUNTIME_SECTIONS, all: ALL_SECTIONS },
+  composer: { file: 'composer.json', runtime: ['require'], all: ['require', 'require-dev'] },
+}
+
+/** The ecosystem of the project: a package.json at its root, otherwise a composer.json. */
+export function detectEcosystem(exists = existsSync) {
+  return exists('package.json') ? 'npm' : 'composer'
+}
+
 /** The configuration of the project, completed with the defaults. */
 export function loadConfig(path = CONFIG_FILE) {
   const user = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {}
@@ -78,15 +89,15 @@ function sorted(section) {
 }
 
 /** True when a range that is published (dependencies, peerDependencies, optionalDependencies) is not the same. */
-export function runtimeChanged(before, after) {
-  return RUNTIME_SECTIONS.some((section) => sorted(before?.[section]) !== sorted(after?.[section]))
+export function runtimeChanged(before, after, sections = RUNTIME_SECTIONS) {
+  return sections.some((section) => sorted(before?.[section]) !== sorted(after?.[section]))
 }
 
 /** The dependencies whose range changed, with the section, the old range and the new one. */
-export function diffDependencies(before, after) {
+export function diffDependencies(before, after, sections = ALL_SECTIONS) {
   const rows = []
 
-  for (const section of ALL_SECTIONS) {
+  for (const section of sections) {
     const old = before?.[section] ?? {}
     const current = after?.[section] ?? {}
 
@@ -129,12 +140,12 @@ export function signerIdentity(env) {
 }
 
 /** What `tag` has to do: the version to create, or null (and why). */
-export function planTag({ config, last, commits, before, after }) {
+export function planTag({ config, last, commits, before, after, sections = RUNTIME_SECTIONS }) {
   if ('never' === config.tag.when) return { version: null, reason: 'the project is never tagged by the update' }
   if (!last) return { version: null, reason: 'there is no tag yet' }
   if (0 === commits.length) return { version: null, reason: 'no update since the last tag' }
 
-  if ('runtime' === config.tag.when && !runtimeChanged(before, after)) {
+  if ('runtime' === config.tag.when && !runtimeChanged(before, after, sections)) {
     return { version: null, reason: 'only the development dependencies changed: the published archive is the same' }
   }
 
@@ -196,16 +207,40 @@ function assertEnvironment() {
   run('git', ['config', '--global', '--add', 'safe.directory', process.cwd()])
 }
 
+/** GPG is not in the image of the CI: add it with the package manager of the image (Alpine or Debian). */
+function ensureGpg() {
+  const available = () => {
+    try {
+      run('gpg', ['--version'])
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  if (available()) return
+
+  for (const [command, args] of [
+    ['apk', ['add', '--no-cache', 'gnupg']],
+    ['apt-get', ['install', '-y', '--no-install-recommends', 'gnupg']],
+  ]) {
+    try {
+      run(command, args)
+    } catch {
+      continue
+    }
+
+    if (available()) return
+  }
+
+  throw new Error('gpg is not installed and could not be added: add gnupg to the image of the job.')
+}
+
 /** Import the signing key and make Git sign the commits and the tags with it. */
 function configureSigning() {
   const signer = signerIdentity(process.env)
 
-  try {
-    run('gpg', ['--version'])
-  } catch {
-    run('apt-get', ['update'])
-    run('apt-get', ['install', '-y', '--no-install-recommends', 'gnupg'])
-  }
+  ensureGpg()
 
   run('gpg', ['--batch', '--import'], { input: signer.key, stdio: ['pipe', 'pipe', 'pipe'] })
   const fingerprint = run('gpg', ['--list-secret-keys', '--with-colons'])
@@ -281,18 +316,22 @@ async function update(config) {
   }
 
   configureSigning()
-  const before = JSON.parse(readFileSync('package.json', 'utf8'))
+  const ecosystem = ECOSYSTEMS[detectEcosystem()]
+  const before = JSON.parse(run('git', ['show', `HEAD:${ecosystem.file}`]))
   const branch = `${BRANCH_PREFIX}-${new Date().toISOString().slice(0, 10).replaceAll('-', '')}`
   run('git', ['switch', '-c', branch])
 
-  // The new versions wait for the cooling period. The packages of the group are trusted: no waiting for them.
-  const reject = 0 < config.reject.length ? ['--reject', config.reject.join(',')] : []
-  ncu(['--cooldown', config.cooldown, ...reject])
-  ncu(['--filter', '@zairakai/*', ...reject])
-  run('npm', ['install', '--no-audit', '--no-fund'])
+  // A PHP project was prepared by the job before this one, in its own image: only npm is updated here.
+  if ('package.json' === ecosystem.file) {
+    // The new versions wait for the cooling period. The packages of the group are trusted: no waiting for them.
+    const reject = 0 < config.reject.length ? ['--reject', config.reject.join(',')] : []
+    ncu(['--cooldown', config.cooldown, ...reject])
+    ncu(['--filter', '@zairakai/*', ...reject])
+    run('npm', ['install', '--no-audit', '--no-fund'])
+  }
 
-  const after = JSON.parse(readFileSync('package.json', 'utf8'))
-  const rows = diffDependencies(before, after)
+  const after = JSON.parse(readFileSync(ecosystem.file, 'utf8'))
+  const rows = diffDependencies(before, after, ecosystem.all)
 
   if ('' === run('git', ['status', '--porcelain'])) {
     log('Everything is up to date.')
@@ -359,10 +398,11 @@ async function tag(config) {
         .split('\n')
         .filter(Boolean)
     : []
-  const before = last ? JSON.parse(run('git', ['show', `${last}:package.json`])) : null
-  const after = JSON.parse(readFileSync('package.json', 'utf8'))
+  const ecosystem = ECOSYSTEMS[detectEcosystem()]
+  const before = last ? JSON.parse(run('git', ['show', `${last}:${ecosystem.file}`])) : null
+  const after = JSON.parse(readFileSync(ecosystem.file, 'utf8'))
 
-  const plan = planTag({ config, last, commits, before, after })
+  const plan = planTag({ config, last, commits, before, after, sections: ecosystem.runtime })
 
   if (!plan.version) {
     log(`No tag: ${plan.reason}.`)
@@ -376,6 +416,21 @@ async function tag(config) {
   log(`Tag ${plan.version} signed and pushed (last tag ${last}): ${plan.reason}. Its pipeline publishes the package.`)
 }
 
+/** True when the registry of the ecosystem (npm or Packagist) lists the version. */
+async function isAvailable(ecosystem, name, version) {
+  if ('npm' === ecosystem) {
+    return run('npm', ['view', `${name}@${version}`, 'version', '--prefer-online']) === version
+  }
+
+  const response = await fetch(`https://repo.packagist.org/p2/${name}.json`)
+
+  if (!response.ok) return false
+
+  const data = await response.json()
+
+  return (data.packages?.[name] ?? []).some((release) => release.version === version)
+}
+
 async function cascade(config) {
   assertEnvironment()
 
@@ -384,7 +439,8 @@ async function cascade(config) {
     return
   }
 
-  const name = JSON.parse(readFileSync('package.json', 'utf8')).name
+  const ecosystem = detectEcosystem()
+  const name = JSON.parse(readFileSync(ECOSYSTEMS[ecosystem].file, 'utf8')).name
   const version = process.env.CI_COMMIT_TAG
 
   if (!version) throw new Error('The cascade runs on the pipeline of a tag.')
@@ -394,7 +450,7 @@ async function cascade(config) {
 
   for (let attempt = 0; 60 > attempt && !available; attempt++) {
     try {
-      available = run('npm', ['view', `${name}@${version}`, 'version', '--prefer-online']) === version
+      available = await isAvailable(ecosystem, name, version)
     } catch {
       available = false
     }