@zairakai/js-dev-tools 3.6.0 → 3.7.1

package/.gitlab/ci/pipeline-js-package.yml

@@ -60,6 +60,15 @@ stages:
   - publish
   - release
 
+# ================================
+# RUNNERS
+# ================================
+# Every job runs on the self-hosted runner of the group, whatever the shared runners enabled on the project.
+# Only js:publish leaves it: npm trusted publishing does not accept a self-hosted runner.
+default:
+  tags:
+    - zairakai-ci
+
 # ================================
 # DEFAULT VARIABLES
 # ================================
@@ -376,18 +385,22 @@ js:publish:
   <<: [*base_job, *cache_node]
   stage: publish
   image: ${NODE_IMAGE}
+  # Trusted publishing: npm trusts this project and this job, and the OIDC token below authenticates the publication.
+  # No npm token is stored anywhere. npm accepts only the shared runners of GitLab.com (not a self-hosted runner),
+  # so this job is the only one that uses them. The tag is the one of GitLab, it cannot be renamed.
+  tags:
+    - saas-linux-small-amd64
+  id_tokens:
+    NPM_ID_TOKEN:
+      aud: "npm:registry.npmjs.org"
+    # Lets npm sign the provenance: the package page shows it was built on GitLab from this project.
+    SIGSTORE_ID_TOKEN:
+      aud: sigstore
   rules:
     - if: $UPDATE_DEPENDENCIES == "true"
       when: never
     - if: $CI_COMMIT_TAG =~ $VERSION_TAG_REGEX
   script:
-    - |
-      if [[ -z "${NPM_TOKEN:-}" ]]; then
-        echo "ERROR: NPM_TOKEN is not set or empty"
-        echo "Go to: GitLab → Settings → CI/CD → Variables → add NPM_TOKEN (type: Variable, protected, masked)"
-        exit 1
-      fi
-    - echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > "${CI_PROJECT_DIR}/.npmrc"
     - |
       # A pre-release (2.3.0-rc.1) goes to the npm tag "next", so it never becomes "latest"
       npm_tag="latest"
@@ -396,7 +409,7 @@ js:publish:
       fi
       echo "Publishing ${NPM_PACKAGE_NAME}@${CI_COMMIT_TAG} to npm (tag ${npm_tag})..."
       npm version "${CI_COMMIT_TAG}" --no-git-tag-version --allow-same-version
-      npm publish --access public --tag "${npm_tag}"
+      npm publish --provenance --access public --tag "${npm_tag}"
   environment:
     name: production
     url: https://www.npmjs.com/package/${NPM_PACKAGE_NAME}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zairakai/js-dev-tools",
-  "version": "3.6.0",
+  "version": "3.7.1",
   "description": "The unified and centralized development toolkit for JavaScript/TypeScript projects - ESLint, Prettier, Stylelint, Knip, Vitest, Git Hooks, and GitLab CI pipeline templates",
   "keywords": [
     "dev-tools",

package/scripts/update-dependencies.mjs

@@ -26,6 +26,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { pathToFileURL } from 'node:url'
 
 const CONFIG_FILE = '.dependency-update.json'
+const PIPELINE_FILE = '.gitlab-ci.yml'
 const COMMIT_SUBJECT = 'chore(deps): update the dependencies'
 const BRANCH_PREFIX = 'chore/update-dependencies'
 
@@ -152,6 +153,16 @@ export function planTag({ config, last, commits, before, after, sections = RUNTI
   return { version: nextVersion(last, config.tag.level), reason: 'a published range changed' }
 }
 
+/**
+ * True when a diff changes one `ref:` line and nothing else. The install of the tools moves the `ref:` of the shared
+ * pipeline to the installed version: that is the only change of the pipeline file an update may commit.
+ */
+export function isRefOnlyChange(diff) {
+  const changed = diff.split('\n').filter((line) => /^[+-]/.test(line) && !/^(\+\+\+|---)/.test(line))
+
+  return 2 === changed.length && changed.every((line) => /^[+-]\s*ref:\s*\S+\s*$/.test(line))
+}
+
 // ---------------------------------------------------------------------------------------------------------------------
 
 const log = (message) => console.info(message)
@@ -336,6 +347,11 @@ async function update(config) {
   // Only the manifest and the lock file: the postinstall of the tools can rewrite other files of the project in CI.
   const files = [ecosystem.file, ...['package-lock.json', 'composer.lock'].filter((file) => existsSync(file))]
 
+  // The one exception: the `ref:` of the shared pipeline follows the installed version of the tools.
+  if (existsSync(PIPELINE_FILE) && isRefOnlyChange(run('git', ['diff', '-U0', '--', PIPELINE_FILE]))) {
+    files.push(PIPELINE_FILE)
+  }
+
   if ('' === run('git', ['status', '--porcelain', '--', ...files])) {
     log('Everything is up to date.')
     return