@zairakai/js-dev-tools 3.3.2 → 3.4.0

package/.gitlab/ci/pipeline-js-package.yml

@@ -77,6 +77,9 @@ variables:
   NODE_VERSION: "24"
   NODE_IMAGE: "zairakai/node:latest-dev"
   NODE_TEST_IMAGE: "zairakai/node:latest-test"
+  # The jobs of the automatic updates sign with gpg: the image has it since 1.3.0. It is an exact version, published on
+  # Docker Hub like our other images: the runner pulls it, whatever the old image it keeps locally.
+  NODE_UPDATE_IMAGE: "zairakai/node:1.3.0-dev"
   SHELLCHECK_IMAGE: "koalaman/shellcheck-alpine:v0.10.0"
   RELEASE_CLI_IMAGE: "registry.gitlab.com/gitlab-org/release-cli:v0.18.0"
   ALPINE_IMAGE: "alpine:3.18"
@@ -449,7 +452,7 @@ js:release:
 deps:update:
   <<: *base_job
   stage: install
-  image: ${NODE_IMAGE}
+  image: ${NODE_UPDATE_IMAGE}
   needs: []
   script:
     - node --version
@@ -474,7 +477,7 @@ deps:release:
 deps:tag:
   <<: *base_job
   stage: release
-  image: ${NODE_IMAGE}
+  image: ${NODE_UPDATE_IMAGE}
   variables:
     GIT_DEPTH: 0
   script:

package/README.md

@@ -178,6 +178,8 @@ The pipeline template updates the dependencies of a project by itself, and this
 - `deps:release` brings `develop` into `main` after such an update, and `deps:tag` tags `main` when a published range (`dependencies`, `peerDependencies`) changed. A project that changed only its development dependencies is not tagged: its published archive is the same.
 - After the publication of a tag, `deps:cascade` waits for the version to be on the registry, then starts the update of the projects that have a `.dependency-update.json`.
 
+The same script serves the PHP projects (`composer.json`): a job in the PHP image runs `composer update`, then this script commits, signs and opens the merge request, and `deps:tag` looks at `require` only. The jobs that sign (`deps:update`, `deps:tag`) run on an exact version of the node image (`NODE_UPDATE_IMAGE`, published on Docker Hub), because they need `gpg` and the image of the runner is not updated by itself.
+
 The exceptions of a project live in `.dependency-update.json` at its root (everything is optional):
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zairakai/js-dev-tools",
-  "version": "3.3.2",
+  "version": "3.4.0",
   "description": "The unified and centralized development toolkit for JavaScript/TypeScript projects - ESLint, Prettier, Stylelint, Knip, Vitest, Git Hooks, and GitLab CI pipeline templates",
   "keywords": [
     "dev-tools",

package/scripts/update-dependencies.mjs

@@ -39,6 +39,17 @@ const DEFAULTS = {
 const RUNTIME_SECTIONS = ['dependencies', 'peerDependencies', 'optionalDependencies']
 const ALL_SECTIONS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
 
+/** The manifest of each ecosystem, with the sections that are published and all of them. */
+const ECOSYSTEMS = {
+  npm: { file: 'package.json', runtime: RUNTIME_SECTIONS, all: ALL_SECTIONS },
+  composer: { file: 'composer.json', runtime: ['require'], all: ['require', 'require-dev'] },
+}
+
+/** The ecosystem of the project: a package.json at its root, otherwise a composer.json. */
+export function detectEcosystem(exists = existsSync) {
+  return exists('package.json') ? 'npm' : 'composer'
+}
+
 /** The configuration of the project, completed with the defaults. */
 export function loadConfig(path = CONFIG_FILE) {
   const user = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {}
@@ -78,15 +89,15 @@ function sorted(section) {
 }
 
 /** True when a range that is published (dependencies, peerDependencies, optionalDependencies) is not the same. */
-export function runtimeChanged(before, after) {
-  return RUNTIME_SECTIONS.some((section) => sorted(before?.[section]) !== sorted(after?.[section]))
+export function runtimeChanged(before, after, sections = RUNTIME_SECTIONS) {
+  return sections.some((section) => sorted(before?.[section]) !== sorted(after?.[section]))
 }
 
 /** The dependencies whose range changed, with the section, the old range and the new one. */
-export function diffDependencies(before, after) {
+export function diffDependencies(before, after, sections = ALL_SECTIONS) {
   const rows = []
 
-  for (const section of ALL_SECTIONS) {
+  for (const section of sections) {
     const old = before?.[section] ?? {}
     const current = after?.[section] ?? {}
 
@@ -129,12 +140,12 @@ export function signerIdentity(env) {
 }
 
 /** What `tag` has to do: the version to create, or null (and why). */
-export function planTag({ config, last, commits, before, after }) {
+export function planTag({ config, last, commits, before, after, sections = RUNTIME_SECTIONS }) {
   if ('never' === config.tag.when) return { version: null, reason: 'the project is never tagged by the update' }
   if (!last) return { version: null, reason: 'there is no tag yet' }
   if (0 === commits.length) return { version: null, reason: 'no update since the last tag' }
 
-  if ('runtime' === config.tag.when && !runtimeChanged(before, after)) {
+  if ('runtime' === config.tag.when && !runtimeChanged(before, after, sections)) {
     return { version: null, reason: 'only the development dependencies changed: the published archive is the same' }
   }
 
@@ -305,18 +316,22 @@ async function update(config) {
   }
 
   configureSigning()
-  const before = JSON.parse(readFileSync('package.json', 'utf8'))
+  const ecosystem = ECOSYSTEMS[detectEcosystem()]
+  const before = JSON.parse(run('git', ['show', `HEAD:${ecosystem.file}`]))
   const branch = `${BRANCH_PREFIX}-${new Date().toISOString().slice(0, 10).replaceAll('-', '')}`
   run('git', ['switch', '-c', branch])
 
-  // The new versions wait for the cooling period. The packages of the group are trusted: no waiting for them.
-  const reject = 0 < config.reject.length ? ['--reject', config.reject.join(',')] : []
-  ncu(['--cooldown', config.cooldown, ...reject])
-  ncu(['--filter', '@zairakai/*', ...reject])
-  run('npm', ['install', '--no-audit', '--no-fund'])
+  // A PHP project was prepared by the job before this one, in its own image: only npm is updated here.
+  if ('package.json' === ecosystem.file) {
+    // The new versions wait for the cooling period. The packages of the group are trusted: no waiting for them.
+    const reject = 0 < config.reject.length ? ['--reject', config.reject.join(',')] : []
+    ncu(['--cooldown', config.cooldown, ...reject])
+    ncu(['--filter', '@zairakai/*', ...reject])
+    run('npm', ['install', '--no-audit', '--no-fund'])
+  }
 
-  const after = JSON.parse(readFileSync('package.json', 'utf8'))
-  const rows = diffDependencies(before, after)
+  const after = JSON.parse(readFileSync(ecosystem.file, 'utf8'))
+  const rows = diffDependencies(before, after, ecosystem.all)
 
   if ('' === run('git', ['status', '--porcelain'])) {
     log('Everything is up to date.')
@@ -383,10 +398,11 @@ async function tag(config) {
         .split('\n')
         .filter(Boolean)
     : []
-  const before = last ? JSON.parse(run('git', ['show', `${last}:package.json`])) : null
-  const after = JSON.parse(readFileSync('package.json', 'utf8'))
+  const ecosystem = ECOSYSTEMS[detectEcosystem()]
+  const before = last ? JSON.parse(run('git', ['show', `${last}:${ecosystem.file}`])) : null
+  const after = JSON.parse(readFileSync(ecosystem.file, 'utf8'))
 
-  const plan = planTag({ config, last, commits, before, after })
+  const plan = planTag({ config, last, commits, before, after, sections: ecosystem.runtime })
 
   if (!plan.version) {
     log(`No tag: ${plan.reason}.`)
@@ -400,6 +416,21 @@ async function tag(config) {
   log(`Tag ${plan.version} signed and pushed (last tag ${last}): ${plan.reason}. Its pipeline publishes the package.`)
 }
 
+/** True when the registry of the ecosystem (npm or Packagist) lists the version. */
+async function isAvailable(ecosystem, name, version) {
+  if ('npm' === ecosystem) {
+    return run('npm', ['view', `${name}@${version}`, 'version', '--prefer-online']) === version
+  }
+
+  const response = await fetch(`https://repo.packagist.org/p2/${name}.json`)
+
+  if (!response.ok) return false
+
+  const data = await response.json()
+
+  return (data.packages?.[name] ?? []).some((release) => release.version === version)
+}
+
 async function cascade(config) {
   assertEnvironment()
 
@@ -408,7 +439,8 @@ async function cascade(config) {
     return
   }
 
-  const name = JSON.parse(readFileSync('package.json', 'utf8')).name
+  const ecosystem = detectEcosystem()
+  const name = JSON.parse(readFileSync(ECOSYSTEMS[ecosystem].file, 'utf8')).name
   const version = process.env.CI_COMMIT_TAG
 
   if (!version) throw new Error('The cascade runs on the pipeline of a tag.')
@@ -418,7 +450,7 @@ async function cascade(config) {
 
   for (let attempt = 0; 60 > attempt && !available; attempt++) {
     try {
-      available = run('npm', ['view', `${name}@${version}`, 'version', '--prefer-online']) === version
+      available = await isAvailable(ecosystem, name, version)
     } catch {
       available = false
     }