aws-delivlib 13.5.19 → 13.6.2

package/lib/package-integrity/handler/repository.js

@@ -0,0 +1,111 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Repository = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// eslint-disable-next-line import/no-extraneous-dependencies
+const AWS = __importStar(require("aws-sdk"));
+/**
+ * Repository containing a node project.
+ */
+class Repository {
+    constructor(repoDir) {
+        this.repoDir = repoDir;
+        const manifestPath = path.join(repoDir, 'package.json');
+        this.manifest = JSON.parse(fs.readFileSync(manifestPath, { encoding: 'utf-8' }));
+        const isProjen = fs.existsSync(path.join(repoDir, '.projen'));
+        const isYarn = fs.existsSync(path.join(repoDir, 'yarn.lock'));
+        if (!isProjen) {
+            // this makes packing much simpler since projen standrardizes it.
+            // for now it will suffice, re-evaluate if a use-case arrises.
+            throw new Error('Only projen managed repositories are supported at this time');
+        }
+        if (!isYarn) {
+            // the projen version we use has to match the one in the repo since otherwise
+            // synthesis may result in a diff. so we use and enforce a yarn.lock file
+            // to make it simpler and not have to worry about other package managers.
+            // for now it will suffice, re-evaluate if a use-case arrises.
+            throw new Error('Only yarn managed repositories are supported at this time');
+        }
+        this.isJsii = !!this.manifest.jsii;
+    }
+    /**
+     * Create a repository from a local directory.
+     */
+    static async fromDir(options) {
+        return new Repository(options.repoDir);
+    }
+    /**
+     * Create a repository from a GitHub repository.
+     */
+    static async fromGitHub(options) {
+        const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'work'));
+        const sm = new AWS.SecretsManager();
+        let token = undefined;
+        if (options.githubTokenSecretArn) {
+            const secret = await sm.getSecretValue({ SecretId: options.githubTokenSecretArn }).promise();
+            token = secret.SecretString;
+        }
+        const repoDir = fs.mkdtempSync(path.join(workdir, 'repo'));
+        console.log(`Cloning ${options.slug} into ${repoDir}`);
+        (0, child_process_1.execSync)(`git clone https://${token ? `${token}@` : ''}github.com/${options.slug}.git ${repoDir}`);
+        const latestTag = findLatestTag(repoDir, options.tagPrefix);
+        (0, child_process_1.execSync)(`git checkout ${latestTag}`, { cwd: repoDir });
+        return new Repository(repoDir);
+    }
+    /**
+     * Pack the repository to produce the artifacts.
+     */
+    pack(command) {
+        var _a;
+        const installCommand = 'yarn install --frozen-lockfile';
+        console.log(`Installing | ${installCommand}`);
+        this._shell(installCommand);
+        const dist = this.isJsii ? (_a = this.manifest.jsii.outdir) !== null && _a !== void 0 ? _a : 'dist' : 'dist';
+        const outdir = path.join(this.repoDir, dist);
+        console.log(`Packing | ${command}`);
+        // crapy: https://github.com/projen/projen/pull/1631
+        this._shell(this.isJsii ? `unset CI && ${command}` : command);
+        const artifacts = [];
+        for (const lang of fs.readdirSync(outdir)) {
+            const langDir = path.join(outdir, lang);
+            if (!fs.lstatSync(langDir).isDirectory()) {
+                // dist folder may contain files such as changelog.md
+                // so we ignore these
+                continue;
+            }
+            artifacts.push({ lang, directory: path.join(outdir, lang) });
+        }
+        return artifacts;
+    }
+    _shell(command) {
+        (0, child_process_1.execSync)(command, { cwd: this.repoDir, stdio: ['ignore', 'inherit', 'inherit'] });
+    }
+}
+exports.Repository = Repository;
+function findLatestTag(repoDir, prefix) {
+    const tags = (0, child_process_1.execSync)(`git tag -l --sort=-creatordate "${prefix !== null && prefix !== void 0 ? prefix : ''}*"`, { cwd: repoDir }).toString();
+    return tags.split(os.EOL)[0].trim();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVwb3NpdG9yeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInJlcG9zaXRvcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGlEQUF5QztBQUN6Qyx1Q0FBeUI7QUFDekIsdUNBQXlCO0FBQ3pCLDJDQUE2QjtBQUM3Qiw2REFBNkQ7QUFDN0QsNkNBQStCO0FBeUUvQjs7R0FFRztBQUNILE1BQWEsVUFBVTtJQXFDckIsWUFBb0MsT0FBZTtRQUFmLFlBQU8sR0FBUCxPQUFPLENBQVE7UUFDakQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFFeEQsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQztRQUVqRixNQUFNLFFBQVEsR0FBRyxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDOUQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO1FBRTlELElBQUksQ0FBQyxRQUFRLEVBQUU7WUFDYixpRUFBaUU7WUFDakUsOERBQThEO1lBQzlELE1BQU0sSUFBSSxLQUFLLENBQUMsNkRBQTZELENBQUMsQ0FBQztTQUNoRjtRQUVELElBQUksQ0FBQyxNQUFNLEVBQUU7WUFDWCw2RUFBNkU7WUFDN0UseUVBQXlFO1lBQ3pFLHlFQUF5RTtZQUN6RSw4REFBOEQ7WUFDOUQsTUFBTSxJQUFJLEtBQUssQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1NBQzlFO1FBRUQsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDckMsQ0FBQztJQTFERDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQWlDO1FBQzNELE9BQU8sSUFBSSxVQUFVLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFFRDs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLE9BQW9DO1FBRWpFLE1BQU0sT0FBTyxHQUFHLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvRCxNQUFNLEVBQUUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUVwQyxJQUFJLEtBQUssR0FBRyxTQUFTLENBQUM7UUFDdEIsSUFBSSxPQUFPLENBQUMsb0JBQW9CLEVBQUU7WUFDaEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxFQUFFLENBQUMsY0FBYyxDQUFDLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDN0YsS0FBSyxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUM7U0FDN0I7UUFDRCxNQUFNLE9BQU8sR0FBRyxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFFM0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLE9BQU8sQ0FBQyxJQUFJLFNBQVMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUN2RCxJQUFBLHdCQUFRLEVBQUMscUJBQXFCLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLE9BQU8sQ0FBQyxJQUFJLFFBQVEsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUVuRyxNQUFNLFNBQVMsR0FBRyxhQUFhLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM1RCxJQUFBLHdCQUFRLEVBQUMsZ0JBQWdCLFNBQVMsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFFeEQsT0FBTyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUVqQyxDQUFDO0lBOEJEOztPQUVHO0lBQ0ksSUFBSSxDQUFDLE9BQWU7O1FBRXpCLE1BQU0sY0FBYyxHQUFHLGdDQUFnQyxDQUFDO1FBQ3hELE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUU1QixNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFBLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sbUNBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFDeEUsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBRTdDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBRXBDLG9EQUFvRDtRQUNwRCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLGVBQWUsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRTlELE1BQU0sU0FBUyxHQUFlLEVBQUUsQ0FBQztRQUNqQyxLQUFLLE1BQU0sSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDekMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDeEMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUU7Z0JBQ3hDLHFEQUFxRDtnQkFDckQscUJBQXFCO2dCQUNyQixTQUFTO2FBQ1Y7WUFDRCxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDOUQ7UUFFRCxPQUFPLFNBQVMsQ0FBQztJQUVuQixDQUFDO0lBRU8sTUFBTSxDQUFDLE9BQWU7UUFDNUIsSUFBQSx3QkFBUSxFQUFDLE9BQU8sRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7Q0FFRjtBQWxHRCxnQ0FrR0M7QUFFRCxTQUFTLGFBQWEsQ0FBQyxPQUFlLEVBQUUsTUFBZTtJQUNyRCxNQUFNLElBQUksR0FBRyxJQUFBLHdCQUFRLEVBQUMsbUNBQW1DLE1BQU0sYUFBTixNQUFNLGNBQU4sTUFBTSxHQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDeEcsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUN0QyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZXhlY1N5bmMgfSBmcm9tICdjaGlsZF9wcm9jZXNzJztcbmltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIG9zIGZyb20gJ29zJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG4vLyBlc2xpbnQtZGlzYWJsZS1uZXh0LWxpbmUgaW1wb3J0L25vLWV4dHJhbmVvdXMtZGVwZW5kZW5jaWVzXG5pbXBvcnQgKiBhcyBBV1MgZnJvbSAnYXdzLXNkayc7XG5cbi8qKlxuICogUHJvcGVydGllcyBmb3IgYFJlcG9zaXRvcnlgLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlcG9zaXRvcnlQcm9wcyB7XG4gIC8qKlxuICAgKiBMb2NhbCBkaXJlY3Rvcnkgd2hlcmUgdGhlIHJlcG9zaXRvcnkgd2FzIGNsb25lZCB0by5cbiAgICovXG4gIHJlYWRvbmx5IHJlcG9EaXI6IHN0cmluZztcbn1cblxuLyoqXG4gKiBBcnRpZmFjdCBwcm9kdWNlZCBieSB0aGlzIHJlcG9zaXRvcnkuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXJ0aWZhY3Qge1xuICAvKipcbiAgICogTGFuZ3VhZ2Ugb2YgdGhlIGFydGlmYWN0LlxuICAgKi9cbiAgcmVhZG9ubHkgbGFuZzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBEaXJlY3RvcnkgY29udGFpbmluZyB0aGUgYXJ0aWZhY3QuXG4gICAqL1xuICByZWFkb25seSBkaXJlY3Rvcnk6IHN0cmluZztcbn1cblxuLyoqXG4gKiBPcHRpb25zIGZvciBgUmVwb3NpdG9yeS5mcm9tR2l0SHViYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlcG9zaXRvcnlGcm9tR2l0SHViT3B0aW9ucyB7XG5cbiAgLyoqXG4gICAqIFJlcG9zaXRvcnkgc2x1ZyAoZS5nIGNkazhzLXRlYW0vY2RrOHMtY29yZSlcbiAgICovXG4gIHJlYWRvbmx5IHNsdWc6IHN0cmluZztcblxuICAvKipcbiAgICogUmVwb3NpdG9yeSB0YWcuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbGF0ZXN0IHRhZyBiYXNlZCBvbiBjcmVhdGlvbiBkYXRlLlxuICAgKi9cbiAgcmVhZG9ubHkgdGFnPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgICogUHJlZml4IGZvciBkZXRlY3RpbmcgdGhlIGxhdGVzdCB0YWcgb2YgdGhlIHJlcG8uIE9ubHkgYXBwbGllcyBpZiBgdGFnYCBpc24ndCBzcGVjaWZpZWQuXG4gICAgKiBUaGlzIGlzIHVzZWZ1bCBmb3IgcmVwb3NpdG9yaWVzIHRoYXQgcHJvZHVjZSBtdWx0aXBsZSBwYWNrYWdlcywgYW5kIGhlbmNlIG11bHRpcGxlIHRhZ3NcbiAgICAqIGZvciBleGFtcGxlOiBodHRwczovL2dpdGh1Yi5jb20vY2RrOHMtdGVhbS9jZGs4cy1wbHVzL3RhZ3MuXG4gICAgKi9cbiAgcmVhZG9ubHkgdGFnUHJlZml4Pzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBBUk4gb2YgYW4gQVdTIHNlY3JldHMgbWFuYWdlciBzZWNyZXQgY29udGFpbmluZyBhIEdpdEh1YiB0b2tlbi5cbiAgICogUmVxdWlyZWQgZm9yIHByaXZhdGUgcmVwb3NpdG9yaWVzLiBSZWNvbW1lbmRlZCBmb3IgcHVibGljIG9uZXMsIHRvIGF2b2lkIHRocm90bGxpbmcgaXNzdWVzLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIHRoZSByZXBvc2l0b3J5IGlzIGNsb25lZCB3aXRob3V0IGNyZWRlbnRpYWxzLlxuICAgKi9cbiAgcmVhZG9ubHkgZ2l0aHViVG9rZW5TZWNyZXRBcm4/OiBzdHJpbmc7XG5cbn1cblxuLyoqXG4gKiBPcHRpb25zIGZvciBgUmVwb3NpdG9yeS5mcm9tRGlyYFxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlcG9zaXRvcnlGcm9tRGlyT3B0aW9ucyB7XG5cbiAgLyoqXG4gICAqIFRoZSBkaXJlY3Rvcnkgb2YgdGhlIHJlcG8uXG4gICAqL1xuICByZWFkb25seSByZXBvRGlyOiBzdHJpbmc7XG5cbn1cblxuLyoqXG4gKiBSZXBvc2l0b3J5IGNvbnRhaW5pbmcgYSBub2RlIHByb2plY3QuXG4gKi9cbmV4cG9ydCBjbGFzcyBSZXBvc2l0b3J5IHtcblxuICAvKipcbiAgICogQ3JlYXRlIGEgcmVwb3NpdG9yeSBmcm9tIGEgbG9jYWwgZGlyZWN0b3J5LlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhc3luYyBmcm9tRGlyKG9wdGlvbnM6IFJlcG9zaXRvcnlGcm9tRGlyT3B0aW9ucyk6IFByb21pc2U8UmVwb3NpdG9yeT4ge1xuICAgIHJldHVybiBuZXcgUmVwb3NpdG9yeShvcHRpb25zLnJlcG9EaXIpO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIHJlcG9zaXRvcnkgZnJvbSBhIEdpdEh1YiByZXBvc2l0b3J5LlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhc3luYyBmcm9tR2l0SHViKG9wdGlvbnM6IFJlcG9zaXRvcnlGcm9tR2l0SHViT3B0aW9ucyk6IFByb21pc2U8UmVwb3NpdG9yeT4ge1xuXG4gICAgY29uc3Qgd29ya2RpciA9IGZzLm1rZHRlbXBTeW5jKHBhdGguam9pbihvcy50bXBkaXIoKSwgJ3dvcmsnKSk7XG4gICAgY29uc3Qgc20gPSBuZXcgQVdTLlNlY3JldHNNYW5hZ2VyKCk7XG5cbiAgICBsZXQgdG9rZW4gPSB1bmRlZmluZWQ7XG4gICAgaWYgKG9wdGlvbnMuZ2l0aHViVG9rZW5TZWNyZXRBcm4pIHtcbiAgICAgIGNvbnN0IHNlY3JldCA9IGF3YWl0IHNtLmdldFNlY3JldFZhbHVlKHsgU2VjcmV0SWQ6IG9wdGlvbnMuZ2l0aHViVG9rZW5TZWNyZXRBcm4gfSkucHJvbWlzZSgpO1xuICAgICAgdG9rZW4gPSBzZWNyZXQuU2VjcmV0U3RyaW5nO1xuICAgIH1cbiAgICBjb25zdCByZXBvRGlyID0gZnMubWtkdGVtcFN5bmMocGF0aC5qb2luKHdvcmtkaXIsICdyZXBvJykpO1xuXG4gICAgY29uc29sZS5sb2coYENsb25pbmcgJHtvcHRpb25zLnNsdWd9IGludG8gJHtyZXBvRGlyfWApO1xuICAgIGV4ZWNTeW5jKGBnaXQgY2xvbmUgaHR0cHM6Ly8ke3Rva2VuID8gYCR7dG9rZW59QGAgOiAnJ31naXRodWIuY29tLyR7b3B0aW9ucy5zbHVnfS5naXQgJHtyZXBvRGlyfWApO1xuXG4gICAgY29uc3QgbGF0ZXN0VGFnID0gZmluZExhdGVzdFRhZyhyZXBvRGlyLCBvcHRpb25zLnRhZ1ByZWZpeCk7XG4gICAgZXhlY1N5bmMoYGdpdCBjaGVja291dCAke2xhdGVzdFRhZ31gLCB7IGN3ZDogcmVwb0RpciB9KTtcblxuICAgIHJldHVybiBuZXcgUmVwb3NpdG9yeShyZXBvRGlyKTtcblxuICB9XG5cbiAgcHJpdmF0ZSByZWFkb25seSBpc0pzaWk6IGJvb2xlYW47XG4gIHByaXZhdGUgcmVhZG9ubHkgbWFuaWZlc3Q6IGFueTtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKHB1YmxpYyByZWFkb25seSByZXBvRGlyOiBzdHJpbmcpIHtcbiAgICBjb25zdCBtYW5pZmVzdFBhdGggPSBwYXRoLmpvaW4ocmVwb0RpciwgJ3BhY2thZ2UuanNvbicpO1xuXG4gICAgdGhpcy5tYW5pZmVzdCA9IEpTT04ucGFyc2UoZnMucmVhZEZpbGVTeW5jKG1hbmlmZXN0UGF0aCwgeyBlbmNvZGluZzogJ3V0Zi04JyB9KSk7XG5cbiAgICBjb25zdCBpc1Byb2plbiA9IGZzLmV4aXN0c1N5bmMocGF0aC5qb2luKHJlcG9EaXIsICcucHJvamVuJykpO1xuICAgIGNvbnN0IGlzWWFybiA9IGZzLmV4aXN0c1N5bmMocGF0aC5qb2luKHJlcG9EaXIsICd5YXJuLmxvY2snKSk7XG5cbiAgICBpZiAoIWlzUHJvamVuKSB7XG4gICAgICAvLyB0aGlzIG1ha2VzIHBhY2tpbmcgbXVjaCBzaW1wbGVyIHNpbmNlIHByb2plbiBzdGFuZHJhcmRpemVzIGl0LlxuICAgICAgLy8gZm9yIG5vdyBpdCB3aWxsIHN1ZmZpY2UsIHJlLWV2YWx1YXRlIGlmIGEgdXNlLWNhc2UgYXJyaXNlcy5cbiAgICAgIHRocm93IG5ldyBFcnJvcignT25seSBwcm9qZW4gbWFuYWdlZCByZXBvc2l0b3JpZXMgYXJlIHN1cHBvcnRlZCBhdCB0aGlzIHRpbWUnKTtcbiAgICB9XG5cbiAgICBpZiAoIWlzWWFybikge1xuICAgICAgLy8gdGhlIHByb2plbiB2ZXJzaW9uIHdlIHVzZSBoYXMgdG8gbWF0Y2ggdGhlIG9uZSBpbiB0aGUgcmVwbyBzaW5jZSBvdGhlcndpc2VcbiAgICAgIC8vIHN5bnRoZXNpcyBtYXkgcmVzdWx0IGluIGEgZGlmZi4gc28gd2UgdXNlIGFuZCBlbmZvcmNlIGEgeWFybi5sb2NrIGZpbGVcbiAgICAgIC8vIHRvIG1ha2UgaXQgc2ltcGxlciBhbmQgbm90IGhhdmUgdG8gd29ycnkgYWJvdXQgb3RoZXIgcGFja2FnZSBtYW5hZ2Vycy5cbiAgICAgIC8vIGZvciBub3cgaXQgd2lsbCBzdWZmaWNlLCByZS1ldmFsdWF0ZSBpZiBhIHVzZS1jYXNlIGFycmlzZXMuXG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ09ubHkgeWFybiBtYW5hZ2VkIHJlcG9zaXRvcmllcyBhcmUgc3VwcG9ydGVkIGF0IHRoaXMgdGltZScpO1xuICAgIH1cblxuICAgIHRoaXMuaXNKc2lpID0gISF0aGlzLm1hbmlmZXN0LmpzaWk7XG4gIH1cblxuICAvKipcbiAgICogUGFjayB0aGUgcmVwb3NpdG9yeSB0byBwcm9kdWNlIHRoZSBhcnRpZmFjdHMuXG4gICAqL1xuICBwdWJsaWMgcGFjayhjb21tYW5kOiBzdHJpbmcpOiBBcnRpZmFjdFtdIHtcblxuICAgIGNvbnN0IGluc3RhbGxDb21tYW5kID0gJ3lhcm4gaW5zdGFsbCAtLWZyb3plbi1sb2NrZmlsZSc7XG4gICAgY29uc29sZS5sb2coYEluc3RhbGxpbmcgfCAke2luc3RhbGxDb21tYW5kfWApO1xuICAgIHRoaXMuX3NoZWxsKGluc3RhbGxDb21tYW5kKTtcblxuICAgIGNvbnN0IGRpc3QgPSB0aGlzLmlzSnNpaSA/IHRoaXMubWFuaWZlc3QuanNpaS5vdXRkaXIgPz8gJ2Rpc3QnIDogJ2Rpc3QnO1xuICAgIGNvbnN0IG91dGRpciA9IHBhdGguam9pbih0aGlzLnJlcG9EaXIsIGRpc3QpO1xuXG4gICAgY29uc29sZS5sb2coYFBhY2tpbmcgfCAke2NvbW1hbmR9YCk7XG5cbiAgICAvLyBjcmFweTogaHR0cHM6Ly9naXRodWIuY29tL3Byb2plbi9wcm9qZW4vcHVsbC8xNjMxXG4gICAgdGhpcy5fc2hlbGwodGhpcy5pc0pzaWkgPyBgdW5zZXQgQ0kgJiYgJHtjb21tYW5kfWAgOiBjb21tYW5kKTtcblxuICAgIGNvbnN0IGFydGlmYWN0czogQXJ0aWZhY3RbXSA9IFtdO1xuICAgIGZvciAoY29uc3QgbGFuZyBvZiBmcy5yZWFkZGlyU3luYyhvdXRkaXIpKSB7XG4gICAgICBjb25zdCBsYW5nRGlyID0gcGF0aC5qb2luKG91dGRpciwgbGFuZyk7XG4gICAgICBpZiAoIWZzLmxzdGF0U3luYyhsYW5nRGlyKS5pc0RpcmVjdG9yeSgpKSB7XG4gICAgICAgIC8vIGRpc3QgZm9sZGVyIG1heSBjb250YWluIGZpbGVzIHN1Y2ggYXMgY2hhbmdlbG9nLm1kXG4gICAgICAgIC8vIHNvIHdlIGlnbm9yZSB0aGVzZVxuICAgICAgICBjb250aW51ZTtcbiAgICAgIH1cbiAgICAgIGFydGlmYWN0cy5wdXNoKHsgbGFuZywgZGlyZWN0b3J5OiBwYXRoLmpvaW4ob3V0ZGlyLCBsYW5nKSB9KTtcbiAgICB9XG5cbiAgICByZXR1cm4gYXJ0aWZhY3RzO1xuXG4gIH1cblxuICBwcml2YXRlIF9zaGVsbChjb21tYW5kOiBzdHJpbmcpIHtcbiAgICBleGVjU3luYyhjb21tYW5kLCB7IGN3ZDogdGhpcy5yZXBvRGlyLCBzdGRpbzogWydpZ25vcmUnLCAnaW5oZXJpdCcsICdpbmhlcml0J10gfSk7XG4gIH1cblxufVxuXG5mdW5jdGlvbiBmaW5kTGF0ZXN0VGFnKHJlcG9EaXI6IHN0cmluZywgcHJlZml4Pzogc3RyaW5nKSB7XG4gIGNvbnN0IHRhZ3MgPSBleGVjU3luYyhgZ2l0IHRhZyAtbCAtLXNvcnQ9LWNyZWF0b3JkYXRlIFwiJHtwcmVmaXggPz8gJyd9KlwiYCwgeyBjd2Q6IHJlcG9EaXIgfSkudG9TdHJpbmcoKTtcbiAgcmV0dXJuIHRhZ3Muc3BsaXQob3MuRU9MKVswXS50cmltKCk7XG59XG4iXX0=

package/lib/package-integrity/handler/repository.ts

@@ -0,0 +1,185 @@
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as AWS from 'aws-sdk';
+
+/**
+ * Properties for `Repository`.
+ */
+export interface RepositoryProps {
+  /**
+   * Local directory where the repository was cloned to.
+   */
+  readonly repoDir: string;
+}
+
+/**
+ * Artifact produced by this repository.
+ */
+export interface Artifact {
+  /**
+   * Language of the artifact.
+   */
+  readonly lang: string;
+
+  /**
+   * Directory containing the artifact.
+   */
+  readonly directory: string;
+}
+
+/**
+ * Options for `Repository.fromGitHub`
+ */
+export interface RepositoryFromGitHubOptions {
+
+  /**
+   * Repository slug (e.g cdk8s-team/cdk8s-core)
+   */
+  readonly slug: string;
+
+  /**
+   * Repository tag.
+   *
+   * @default - latest tag based on creation date.
+   */
+  readonly tag?: string;
+
+  /**
+    * Prefix for detecting the latest tag of the repo. Only applies if `tag` isn't specified.
+    * This is useful for repositories that produce multiple packages, and hence multiple tags
+    * for example: https://github.com/cdk8s-team/cdk8s-plus/tags.
+    */
+  readonly tagPrefix?: string;
+
+  /**
+   * ARN of an AWS secrets manager secret containing a GitHub token.
+   * Required for private repositories. Recommended for public ones, to avoid throtlling issues.
+   *
+   * @default - the repository is cloned without credentials.
+   */
+  readonly githubTokenSecretArn?: string;
+
+}
+
+/**
+ * Options for `Repository.fromDir`
+ */
+export interface RepositoryFromDirOptions {
+
+  /**
+   * The directory of the repo.
+   */
+  readonly repoDir: string;
+
+}
+
+/**
+ * Repository containing a node project.
+ */
+export class Repository {
+
+  /**
+   * Create a repository from a local directory.
+   */
+  public static async fromDir(options: RepositoryFromDirOptions): Promise<Repository> {
+    return new Repository(options.repoDir);
+  }
+
+  /**
+   * Create a repository from a GitHub repository.
+   */
+  public static async fromGitHub(options: RepositoryFromGitHubOptions): Promise<Repository> {
+
+    const workdir = fs.mkdtempSync(path.join(os.tmpdir(), 'work'));
+    const sm = new AWS.SecretsManager();
+
+    let token = undefined;
+    if (options.githubTokenSecretArn) {
+      const secret = await sm.getSecretValue({ SecretId: options.githubTokenSecretArn }).promise();
+      token = secret.SecretString;
+    }
+    const repoDir = fs.mkdtempSync(path.join(workdir, 'repo'));
+
+    console.log(`Cloning ${options.slug} into ${repoDir}`);
+    execSync(`git clone https://${token ? `${token}@` : ''}github.com/${options.slug}.git ${repoDir}`);
+
+    const latestTag = findLatestTag(repoDir, options.tagPrefix);
+    execSync(`git checkout ${latestTag}`, { cwd: repoDir });
+
+    return new Repository(repoDir);
+
+  }
+
+  private readonly isJsii: boolean;
+  private readonly manifest: any;
+
+  private constructor(public readonly repoDir: string) {
+    const manifestPath = path.join(repoDir, 'package.json');
+
+    this.manifest = JSON.parse(fs.readFileSync(manifestPath, { encoding: 'utf-8' }));
+
+    const isProjen = fs.existsSync(path.join(repoDir, '.projen'));
+    const isYarn = fs.existsSync(path.join(repoDir, 'yarn.lock'));
+
+    if (!isProjen) {
+      // this makes packing much simpler since projen standrardizes it.
+      // for now it will suffice, re-evaluate if a use-case arrises.
+      throw new Error('Only projen managed repositories are supported at this time');
+    }
+
+    if (!isYarn) {
+      // the projen version we use has to match the one in the repo since otherwise
+      // synthesis may result in a diff. so we use and enforce a yarn.lock file
+      // to make it simpler and not have to worry about other package managers.
+      // for now it will suffice, re-evaluate if a use-case arrises.
+      throw new Error('Only yarn managed repositories are supported at this time');
+    }
+
+    this.isJsii = !!this.manifest.jsii;
+  }
+
+  /**
+   * Pack the repository to produce the artifacts.
+   */
+  public pack(command: string): Artifact[] {
+
+    const installCommand = 'yarn install --frozen-lockfile';
+    console.log(`Installing | ${installCommand}`);
+    this._shell(installCommand);
+
+    const dist = this.isJsii ? this.manifest.jsii.outdir ?? 'dist' : 'dist';
+    const outdir = path.join(this.repoDir, dist);
+
+    console.log(`Packing | ${command}`);
+
+    // crapy: https://github.com/projen/projen/pull/1631
+    this._shell(this.isJsii ? `unset CI && ${command}` : command);
+
+    const artifacts: Artifact[] = [];
+    for (const lang of fs.readdirSync(outdir)) {
+      const langDir = path.join(outdir, lang);
+      if (!fs.lstatSync(langDir).isDirectory()) {
+        // dist folder may contain files such as changelog.md
+        // so we ignore these
+        continue;
+      }
+      artifacts.push({ lang, directory: path.join(outdir, lang) });
+    }
+
+    return artifacts;
+
+  }
+
+  private _shell(command: string) {
+    execSync(command, { cwd: this.repoDir, stdio: ['ignore', 'inherit', 'inherit'] });
+  }
+
+}
+
+function findLatestTag(repoDir: string, prefix?: string) {
+  const tags = execSync(`git tag -l --sort=-creatordate "${prefix ?? ''}*"`, { cwd: repoDir }).toString();
+  return tags.split(os.EOL)[0].trim();
+}