fg-devkit 1.21.0 → 1.21.1

package/README.md

@@ -72,8 +72,7 @@ pnpm exec fgd sync-dependency-check-suppressions-commit --all  # every entry in
 
 The command runs `pnpm audit` and keeps only the active (not expired) `<suppress>` entries from fg-devkit's shared
 `configs/dependency-check-suppressions.xml` whose GHSA id is reported in the repo, so each repo accepts exactly the
-risks it has. Jenkins `owaspDependencyCheck` reads `dependency-check-suppressions.xml` from the repo root when the
-file exists. Add another `<suppress>` element in the shared fg-devkit file for each additional accepted finding.
+risks it has. OWASP Dependency-Check reads the file when it is configured as a suppression file. Add another `<suppress>` element in the shared fg-devkit file for each additional accepted finding.
 The command overwrites the consumer copy; if nothing applies and the repo has no copy, no file is created.
 
 To sync standard consumer scripts to `fgd` commands:
@@ -176,7 +175,7 @@ pnpm exec fgd audit-override-commit --no-commit  # leave the changes in the work
 4. Prunes overrides that no longer change the audit.
 5. If findings that are still reported have active (not expired) `<suppress>` entries in fg-devkit's shared
    `configs/dependency-check-suppressions.xml`, writes the repo's `dependency-check-suppressions.xml` with only
-   those entries, so the Jenkins OWASP scan accepts exactly the risks this repo has. Findings with no patch and
+   those entries, so OWASP Dependency-Check accepts exactly the risks this repo has. Findings with no patch and
    no suppression are listed so you can add one.
 6. Installs and runs the repo's `lint-check`, `lint:ts`, `test`, `test:unit` and `build` scripts when present.
    Nothing is committed if a check fails.
@@ -217,9 +216,9 @@ export default {
 
 ## Piwik PRO custom dimensions
 
-Compare the local slot map with a Piwik PRO site, then create missing dimensions or rename existing ones. Run it from a consuming repo (`bokningsverktyget-ui`, `webbportalen-ui`, `feelgood-app`, and the same layout in other apps) or from the Electron maintainer UI under **Piwik**.
+Compare the local slot map with a Piwik PRO site, then create missing dimensions or rename existing ones. Run it from a consuming repo.
 
-The local map is `src/analytics/dimensions.ts` (`customDimensions` = event, `sessionDimensions` = session) or `src/util/piwikDimensions.ts` (`CustomDimensions` / `SessionCustomDimensions`). The site defaults to the first non-production entry in `src/config/env.ts`, such as preprod. Pass `--env production` to target production. In the Electron app, Piwik actions show one radio per distinct `piwikId`. Environments that share an id, such as localhost, development, and preprod, appear once as **preprod**.
+The local map is `src/analytics/dimensions.ts` (`customDimensions` = event, `sessionDimensions` = session) or `src/util/piwikDimensions.ts` (`CustomDimensions` / `SessionCustomDimensions`). The site defaults to the first non-production entry in `src/config/env.ts`, such as preprod. Pass `--env production` to target production.
 
 ```bash
 pnpm exec fgd piwik list
@@ -232,7 +231,7 @@ pnpm exec fgd piwik compare --from preprod --to production
 pnpm exec fgd piwik migrate --from preprod --to production --dry-run
 ```
 
-`sync` copies the local map up to the selected Piwik site: it creates missing dimensions, then renames existing ones. It does not edit the repo. `pull` copies tracking ids from that site down into the local map for keys with the same name. In the Electron app, **Sync** has From and To radios. **Local map** is the repo. A site as To writes up to Piwik. **Local map** as To writes down into the repo. Two sites migrate between environments.
+`sync` copies the local map up to the selected Piwik site: it creates missing dimensions, then renames existing ones. It does not edit the repo. `pull` copies tracking ids from that site down into the local map for keys with the same name.
 
 `compare` checks two sites from `src/config/env.ts` against each other. Event and session dimensions match on `tracking_id`, so a different slot on the other site is still in sync. `migrate` copies names, descriptions, and missing dimensions from `--from` onto `--to`, one create at a time. It stops if Piwik assigns a different `tracking_id`. Dimensions that exist only on the target stay there.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",

package/scaffold/vue/package.json

@@ -32,7 +32,7 @@
     "@intlify/unplugin-vue-i18n": "11.2.5",
     "@tanstack/vue-query-devtools": "6.3.1",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.21.0",
+    "fg-devkit": "1.21.1",
     "@vitejs/plugin-vue": "6.0.9",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",

package/scripts/audit-override-commit.mjs

@@ -12,7 +12,7 @@
  *   4. Prune overrides that no longer change the audit (prune-overrides --fix).
  *   5. If findings that are still reported have active <suppress> entries in fg-devkit's
  *      shared dependency-check-suppressions.xml, write the repo's copy with only those
- *      entries, so the Jenkins OWASP scan accepts exactly the risks this repo has.
+ *      entries, so OWASP Dependency-Check accepts exactly the risks this repo has.
  *   6. Install and run the repo's checks (lint-check, lint:ts, test, test:unit, build).
  *   7. Commit the refresh, the override changes and the suppressions file separately.
  *

package/scripts/bump-node-toolchain.mjs

@@ -33,10 +33,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-import {
-  DEFAULT_NODE_TOOLCHAIN_EXCLUDE,
-  collectFleetProjectRepos,
-} from './fleet-project-repos.mjs'
+import { collectFleetProjectRepos, toolchainExclude } from './fleet-project-repos.mjs'
 import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
 import {
   formatNodeNvmrc,
@@ -213,7 +210,7 @@ async function main() {
     process.exit(1)
   }
 
-  const allRepos = collectFleetProjectRepos(projectsRoot, { exclude: DEFAULT_NODE_TOOLCHAIN_EXCLUDE })
+  const allRepos = collectFleetProjectRepos(projectsRoot, { exclude: toolchainExclude(projectsRoot) })
   if (allRepos.length === 0) {
     console.log(`[bump-node-toolchain] No project repositories under ${projectsRoot}`)
     process.exit(0)

package/scripts/fleet-project-repos.mjs

@@ -80,11 +80,31 @@ export function collectFleetGitRepos(projectsRoot) {
   return repos.sort((a, b) => a.localeCompare(b))
 }
 
-/** Repos that intentionally maintain multiple Node versions or non-pnpm tooling. */
-export const DEFAULT_NODE_TOOLCHAIN_EXCLUDE = new Set(['jenkins-dockerfile', 'vulnerability-test'])
+/** Local config file in the projects root (not part of fg-devkit). */
+export const FLEET_CONFIG_FILE = '.fg-devkit-fleet.json'
 
-/** Repos excluded from fleet-wide pnpm toolchain bumps (non-pnpm or special tooling). */
-export const DEFAULT_PNPM_TOOLCHAIN_EXCLUDE = new Set(['jenkins-dockerfile', 'vulnerability-test'])
+/**
+ * Repos excluded from fleet-wide Node and pnpm toolchain bumps (for example repos that
+ * maintain several Node versions or do not use pnpm). Read from `toolchainExclude` in
+ * `<projectsRoot>/.fg-devkit-fleet.json` and the comma-separated `FGD_TOOLCHAIN_EXCLUDE`
+ * environment variable.
+ *
+ * @param {string} projectsRoot
+ * @returns {Set<string>}
+ */
+export function toolchainExclude(projectsRoot) {
+  const names = new Set()
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(projectsRoot, FLEET_CONFIG_FILE), 'utf8'))
+    for (const name of config?.toolchainExclude ?? []) names.add(String(name))
+  } catch {
+    // No local config: nothing excluded.
+  }
+  for (const name of (process.env.FGD_TOOLCHAIN_EXCLUDE ?? '').split(',')) {
+    if (name.trim()) names.add(name.trim())
+  }
+  return names
+}
 
 /**
  * @param {string} dir
@@ -108,7 +128,7 @@ export function isPnpmPackageJsonDir(dir, pkg) {
 export function collectFleetPnpmRepos(projectsRoot, options = {}) {
   const exclude = new Set([
     ...DEFAULT_FLEET_REPO_EXCLUDE,
-    ...DEFAULT_PNPM_TOOLCHAIN_EXCLUDE,
+    ...toolchainExclude(projectsRoot),
     ...(options.exclude ?? []),
   ])
   const { skipScaffoldVue = true } = options

package/scripts/node-toolchain-sync.mjs

@@ -13,7 +13,7 @@ import {
 } from './dependency-policy-toolchain.mjs'
 
 const DOCKER_FROM_NODE_PATTERN = /FROM node:(v)?(\d+(?:\.\d+)?)(-[a-z0-9-]+)?/gi
-const JENKINS_NODE_IMAGE_PATTERN = /(feelgoodsvenska\/jenkins-build:)node\d+/g
+const JENKINS_NODE_IMAGE_PATTERN = /([\w.-]+\/jenkins-build:)node\d+/g
 const GITHUB_NODE_VERSION_PATTERN = /node-version:\s*['"]?\d+(?:\.\d+)?['"]?/g
 
 /**
@@ -323,7 +323,7 @@ export function collectNodeToolchainViolations(repoRoot, policy, fgDevkitRoot) {
   const expectedJenkins = jenkinsImage ?? deriveJenkinsImageTag(nvmrc)
   if (fs.existsSync(jenkinsfilePath)) {
     const jenkinsfile = fs.readFileSync(jenkinsfilePath, 'utf8')
-    const matches = [...jenkinsfile.matchAll(/feelgoodsvenska\/jenkins-build:(node\d+)/g)]
+    const matches = [...jenkinsfile.matchAll(/[\w.-]+\/jenkins-build:(node\d+)/g)]
     for (const match of matches) {
       if (match[1] !== expectedJenkins) {
         violations.push(`Jenkinsfile: expected jenkins-build:${expectedJenkins}, got jenkins-build:${match[1]}`)

package/scripts/piwik-dimensions.test.mjs

@@ -381,20 +381,3 @@ test('pull plans tracking id updates from Piwik into the local map', () => {
     'export const customDimensions = { active: 46, step: 30 } as const\n',
   )
 })
-
-test('parses the real consumer dimension files when they are checked out beside fg-devkit', () => {
-  const files = [
-    ['../../bokningsverktyget-ui/src/analytics/dimensions.ts', 'event', 'rowsBooked', 7],
-    ['../../webbportalen-ui/src/analytics/dimensions.ts', 'session', 'organizationName', 26],
-    ['../../feelgood-app/src/util/piwikDimensions.ts', 'event', 'eventTimestamp', 78],
-  ]
-  for (const [relative, scope, key, slot] of files) {
-    const file = path.join(scriptDir, relative)
-    if (!fs.existsSync(file)) continue
-    const dimensions = parseDimensionSource(fs.readFileSync(file, 'utf8'), relative)
-    const found = dimensions.find((item) => item.key === key)
-    assert.ok(found, `${key} missing in ${relative}`)
-    assert.equal(found.scope, scope)
-    assert.equal(found.slot, slot)
-  }
-})

package/scripts/sync-dependency-check-suppressions-commit.mjs

@@ -3,7 +3,7 @@
  * Write dependency-check-suppressions.xml into the consumer repo and auto-commit.
  *
  * Only the active <suppress> entries from fg-devkit's shared file that match a finding
- * `pnpm audit` still reports in this repo are written, so the Jenkins OWASP scan accepts
+ * `pnpm audit` still reports in this repo are written, so OWASP Dependency-Check accepts
  * exactly the risks this repo has. Pass --all to copy the whole shared file instead.
  *
  * Usage: