browser-commander 0.26.1 → 0.26.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.26.2
+
+### Patch Changes
+
+- e2ef59f: Verify crates.io trusted publishing before releases and mark repository fixture manifests as non-publishable. Document the account setup required for PyPI and crates.io.
+
 ## 0.26.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.26.1",
+  "version": "0.26.2",
   "description": "Universal browser automation library that supports Playwright, Puppeteer, and Selenium with a unified API",
   "main": "src/index.js",
   "bin": {

package/tests/unit/scripts/preflight-credentials.test.js

@@ -5,8 +5,8 @@
  * Run 37509328334 built, tested and versioned the Python package on main and
  * only then failed at "Publish to PyPI" with `invalid-publisher` (issue #128).
  * `scripts/preflight-credentials.sh` performs the credential half of each
- * publish up front -- the OIDC exchange PyPI and npm trusted publishing do, and
- * the crates.io token check -- and the `release-preflight` job in each
+ * publish up front -- the OIDC exchanges all three registries do -- and the
+ * `release-preflight` job in each
  * language workflow gates the publishing jobs on it. These tests pin the rules
  * the workflows depend on (principle 16 of the link-foundation pipeline
  * templates): every failure is reported, `unknown` is never a pass in release
@@ -28,6 +28,7 @@ import { after, before, beforeEach, describe, it } from 'node:test';
 import { BASH_AVAILABLE, readRepoText, repoPath } from '../../helpers/repo.js';
 
 const SCRIPT = repoPath('scripts/preflight-credentials.sh');
+const scriptOptions = { skip: !BASH_AVAILABLE, timeout: 30_000 };
 
 // Values a leak would make visible: none of them may reach the output.
 const REQUEST_TOKEN = 'gh-request-token-must-not-leak';
@@ -130,7 +131,8 @@ const OIDC_OK = [200, { value: OIDC_TOKEN }];
 const MINT = 'POST /pypi/_/oidc/mint-token';
 const EXCHANGE =
   'POST /npm/-/npm/v1/oidc/token/exchange/package/@link-foundation%2Fprobe';
-const ME = 'GET /crates/api/v1/me';
+const CRATES_MINT = 'POST /crates/api/v1/trusted_publishing/tokens';
+const CRATES_REVOKE = 'DELETE /crates/api/v1/trusted_publishing/tokens';
 const INVALID_PUBLISHER = [
   422,
   {
@@ -150,7 +152,12 @@ function probePypi(answer, overrides = {}) {
   return preflight({ PREFLIGHT_REGISTRIES: 'pypi', ...overrides });
 }
 
-describe('scripts/preflight-credentials.sh', { skip: !BASH_AVAILABLE }, () => {
+function probeCrates(answer, overrides = {}) {
+  stub.routes[CRATES_MINT] = answer;
+  return preflight({ PREFLIGHT_REGISTRIES: 'crates', ...overrides });
+}
+
+describe('scripts/preflight-credentials.sh', scriptOptions, () => {
   before(async () => {
     stub.server = createServer(respond);
     stub.server.listen(0, '127.0.0.1');
@@ -318,81 +325,102 @@ describe('scripts/preflight-credentials.sh', { skip: !BASH_AVAILABLE }, () => {
     });
   });
 
-  describe('crates.io token', () => {
-    it('passes a live API token that /api/v1/me refuses by design', async () => {
-      stub.routes[ME] = [
-        403,
-        {
-          errors: [
-            {
-              detail:
-                'this action can only be performed on the crates.io website',
-            },
-          ],
-        },
-      ];
+  describe('crates.io trusted publishing', () => {
+    it('exchanges OIDC and revokes the temporary token without using a Cargo secret', async () => {
+      stub.routes[CRATES_REVOKE] = [204, ''];
 
-      const { status, output } = await preflight({
-        PREFLIGHT_REGISTRIES: 'crates',
-        CARGO_REGISTRY_TOKEN: CARGO_SECRET,
-      });
+      const { status, output } = await probeCrates(
+        [200, { token: ISSUED_TOKEN }],
+        { CARGO_REGISTRY_TOKEN: CARGO_SECRET }
+      );
 
       assert.equal(status, 0, output);
-      assert.match(output, /PASS: crates.io authenticated the publish token/);
-      assert.equal(stub.requests[0].authorization, CARGO_SECRET);
-      assert.match(stub.requests[0].userAgent, /release-preflight/);
+      assert.match(
+        output,
+        /PASS: crates.io minted a short-lived publish token/
+      );
+      const [oidc, mint, revoke] = stub.requests;
+      assert.match(oidc.url, /&audience=127\.0\.0\.1:\d+\/crates$/);
+      assert.deepEqual(JSON.parse(mint.body), { jwt: OIDC_TOKEN });
+      assert.equal(mint.authorization, '');
+      assert.equal(revoke.route, CRATES_REVOKE);
+      assert.equal(revoke.authorization, `Bearer ${ISSUED_TOKEN}`);
+      assert.equal(stub.requests.length, 3);
       assertNoSecrets(output);
     });
 
-    it('fails a release on a token crates.io does not recognise', async () => {
-      stub.routes[ME] = [
-        403,
-        { errors: [{ detail: 'authentication failed' }] },
-      ];
-
-      const { status, output } = await preflight({
-        PREFLIGHT_REGISTRIES: 'crates',
-        CARGO_TOKEN: CARGO_SECRET,
-      });
+    it('fails a release when no trusted publisher matches, even with a legacy secret', async () => {
+      const { status, output } = await probeCrates(
+        [403, { errors: [{ detail: 'no matching publisher' }] }],
+        { CARGO_TOKEN: CARGO_SECRET }
+      );
 
       assert.equal(status, 1, output);
       assert.match(
         output,
-        /::error::release-preflight: crates.io rejected the publish token \(403, authentication failed\)/
+        /::error::release-preflight: crates.io refused the OIDC token exchange \(403\)/
       );
+      assert.match(output, /rust\.yml/);
+      assert.match(output, /docs\/PUBLISHING\.md/);
+      assert.equal(stub.requests.length, 2);
       assertNoSecrets(output);
     });
 
-    it('fails when no token is configured', async () => {
+    it('fails when the job has no OIDC permission, with no secret fallback', async () => {
       const { status, output } = await preflight({
         PREFLIGHT_REGISTRIES: 'crates',
+        ACTIONS_ID_TOKEN_REQUEST_URL: '',
+        ACTIONS_ID_TOKEN_REQUEST_TOKEN: '',
+        CARGO_REGISTRY_TOKEN: CARGO_SECRET,
       });
 
       assert.equal(status, 1, output);
-      assert.match(output, /crates.io has no publish credential/);
+      assert.match(
+        output,
+        /crates.io: no OIDC token available: .*id-token: write/
+      );
+      assert.equal(stub.requests.length, 0);
     });
 
-    it('checks crate ownership when the token resolves to a login', async () => {
-      writeFileSync(
-        path.join(workDir, 'Cargo.toml'),
-        '[package]\nname = "probe-crate"\n\n[dependencies]\nname = "decoy"\n'
-      );
-      stub.routes[ME] = [200, { user: { login: 'Releaser' } }];
-      const owners = 'GET /crates/api/v1/crates/probe-crate/owners';
-      const env = {
-        PREFLIGHT_REGISTRIES: 'crates',
-        CARGO_REGISTRY_TOKEN: CARGO_SECRET,
-      };
+    it('keeps missing publishers advisory on pull requests', async () => {
+      const { status, output } = await probeCrates([403, {}], {
+        PREFLIGHT_MODE: 'report',
+      });
+      assert.equal(status, 0, output);
+      assert.match(output, /::warning::release-preflight: crates.io refused/);
+      assert.doesNotMatch(output, /::error::/);
+    });
 
-      stub.routes[owners] = [200, { users: [{ login: 'releaser' }] }];
-      const owner = await preflight(env);
-      assert.equal(owner.status, 0, owner.output);
-      assert.match(owner.output, /PASS: Releaser is an owner of probe-crate/);
+    it('treats missing tokens and unavailable registries as unknown', async () => {
+      for (const answer of [
+        [200, {}],
+        [429, {}],
+        [503, {}],
+      ]) {
+        const { status, output } = await probeCrates(answer);
+        assert.equal(status, 1, output);
+        assert.match(output, /0 verified, 0 failed, 1 unknown/);
+        assert.equal(stub.requests.at(-1).route, CRATES_MINT);
+        assertNoSecrets(output);
+      }
+      const port = await closedPort();
+      const { status, output } = await preflight({
+        PREFLIGHT_REGISTRIES: 'crates',
+        CRATES_API: `http://127.0.0.1:${port}`,
+      });
+      assert.equal(status, 1, output);
+      assert.match(output, /UNKNOWN: crates.io was unreachable/);
+    });
 
-      stub.routes[owners] = [200, { users: [{ login: 'someone-else' }] }];
-      const stranger = await preflight(env);
-      assert.equal(stranger.status, 1, stranger.output);
-      assert.match(stranger.output, /is not an owner of probe-crate/);
+    it('reports failed revocation without exposing the token', async () => {
+      stub.routes[CRATES_REVOKE] = [403, { token: ISSUED_TOKEN }];
+      const { status, output } = await probeCrates([
+        200,
+        { token: ISSUED_TOKEN },
+      ]);
+      assert.equal(status, 1, output);
+      assert.match(output, /could not revoke the preflight token/);
+      assertNoSecrets(output);
     });
   });
 
@@ -400,7 +428,7 @@ describe('scripts/preflight-credentials.sh', { skip: !BASH_AVAILABLE }, () => {
     it('reports every failure rather than stopping at the first', async () => {
       stub.routes[MINT] = INVALID_PUBLISHER;
       stub.routes[EXCHANGE] = [403, { message: 'forbidden' }];
-      stub.routes[ME] = [401, { errors: [{ detail: 'bad token' }] }];
+      stub.routes[CRATES_MINT] = [401, { errors: [{ detail: 'bad token' }] }];
       const summary = path.join(workDir, 'summary.md');
       writeFileSync(summary, '');
 
@@ -479,7 +507,7 @@ const PREFLIGHT_WORKFLOWS = [
   {
     file: 'rust.yml',
     registry: 'crates',
-    oidc: false,
+    oidc: true,
     publishers: ['auto-release', 'manual-release'],
   },
 ];

package/tests/unit/scripts/trusted-publishing.test.js

@@ -0,0 +1,78 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { parse } from 'yaml';
+
+import { readRepoText } from '../../helpers/repo.js';
+
+describe('trusted publishing configuration', () => {
+  const rust = parse(readRepoText('.github/workflows/rust.yml'));
+
+  for (const jobId of ['auto-release', 'manual-release']) {
+    it(`${jobId} uses a fresh OIDC token only when publishing`, () => {
+      const job = rust.jobs[jobId];
+      assert.equal(job.permissions['id-token'], 'write');
+      const auth = job.steps.find((step) => step.id === 'crates_auth');
+      const publish = job.steps.find((step) => step.id === 'publish-crate');
+      assert.ok(auth, 'missing crates.io authentication step');
+      assert.match(
+        auth.uses,
+        /^rust-lang\/crates-io-auth-action@[a-f0-9]{40}$/
+      );
+      assert.equal(auth.if, publish.if);
+      assert.equal(
+        publish.env.CARGO_REGISTRY_TOKEN,
+        '${{ steps.crates_auth.outputs.token }}'
+      );
+      assert.ok(job.steps.indexOf(auth) < job.steps.indexOf(publish));
+      assert.ok(
+        job.steps.indexOf(auth) >
+          job.steps.findIndex((step) => step.name === 'Build release')
+      );
+    });
+  }
+
+  it('never reads the long-lived Cargo secret in the Rust workflow', () => {
+    assert.doesNotMatch(
+      readRepoText('.github/workflows/rust.yml'),
+      /secrets\.CARGO_TOKEN/
+    );
+  });
+
+  it('keeps the registered PyPI identity identical across preflight and releases', () => {
+    const python = parse(readRepoText('.github/workflows/python.yml'));
+    for (const jobId of [
+      'release-preflight',
+      'auto-release',
+      'manual-release',
+    ]) {
+      assert.equal(python.jobs[jobId].permissions['id-token'], 'write');
+      assert.equal(python.jobs[jobId].environment, undefined);
+    }
+  });
+
+  it('marks the template snapshot as private without hiding the real npm package', () => {
+    assert.equal(
+      JSON.parse(
+        readRepoText(
+          'docs/case-studies/issue-55/template-snapshots/js/package.json'
+        )
+      ).private,
+      true
+    );
+    assert.notEqual(JSON.parse(readRepoText('js/package.json')).private, true);
+  });
+
+  it('disables publishing for the cookie equivalence experiment only', () => {
+    const fixture = readRepoText(
+      'experiments/issue-128/cookie-fixture-equivalence/Cargo.toml'
+    );
+    const packageTable = fixture
+      .split(/^\[package\]\s*$/m)[1]
+      ?.split(/^\[/m)[0];
+    assert.match(packageTable ?? '', /^publish\s*=\s*false\s*$/m);
+    assert.doesNotMatch(
+      readRepoText('rust/Cargo.toml'),
+      /^publish\s*=\s*false\s*$/m
+    );
+  });
+});