fg-devkit 1.9.1 → 1.12.0

package/scripts/audit-override-commit.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+/**
+ * Fix one vulnerability via `pnpm audit --fix override -i`, install, then auto-commit.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+const cwd = process.cwd()
+const packageJsonPath = path.join(cwd, 'package.json')
+const workspaceYamlPath = path.join(cwd, 'pnpm-workspace.yaml')
+
+function getOverridePackageName(overrideKey) {
+  const match = overrideKey.match(/^(@[^/]+\/[^@]+|[^@]+)@/)
+  return match ? match[1] : overrideKey
+}
+
+/** Read flat `overrides:` entries from pnpm-workspace.yaml (no YAML dependency). */
+function readWorkspaceOverrides(yamlPath) {
+  if (!fs.existsSync(yamlPath)) return {}
+  const overrides = {}
+  let inOverrides = false
+  for (const line of fs.readFileSync(yamlPath, 'utf8').split('\n')) {
+    if (/^overrides:\s*$/.test(line)) {
+      inOverrides = true
+      continue
+    }
+    if (!inOverrides) continue
+    if (/^\S/.test(line)) break
+    const match = line.match(/^  ([^:]+):\s*(.+?)\s*$/)
+    if (match) {
+      overrides[match[1].trim()] = match[2].trim()
+    }
+  }
+  return overrides
+}
+
+function readJson(jsonPath) {
+  return JSON.parse(fs.readFileSync(jsonPath, 'utf8'))
+}
+
+function collectOverrides() {
+  const overrides = {}
+
+  if (fs.existsSync(packageJsonPath)) {
+    const pkg = readJson(packageJsonPath)
+    Object.assign(overrides, pkg.overrides ?? {})
+    Object.assign(overrides, pkg.pnpm?.overrides ?? {})
+  }
+
+  Object.assign(overrides, readWorkspaceOverrides(workspaceYamlPath))
+  return overrides
+}
+
+function collectOverrideChanges(before, after) {
+  const changed = []
+  const keys = new Set([...Object.keys(before), ...Object.keys(after)])
+  for (const key of keys) {
+    const from = before[key]
+    const to = after[key]
+    if (to !== undefined && from !== to) {
+      changed.push({ key, name: getOverridePackageName(key), from, to })
+    }
+  }
+  return changed
+}
+
+function runPnpm(args) {
+  const result = spawnSync('pnpm', args, {
+    stdio: 'inherit',
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[audit-override-commit]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function runGit(args) {
+  const result = spawnSync('git', args, {
+    stdio: 'inherit',
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[audit-override-commit]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function stageExistingFiles(files) {
+  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(cwd, filePath)))
+  if (existingFiles.length === 0) return 0
+  return runGit(['add', '--', ...existingFiles])
+}
+
+function main() {
+  if (!fs.existsSync(packageJsonPath)) {
+    console.error(`[audit-override-commit] package.json not found at ${packageJsonPath}`)
+    process.exit(1)
+  }
+
+  let beforeOverrides
+  try {
+    beforeOverrides = collectOverrides()
+  } catch (err) {
+    console.error(`[audit-override-commit] Failed to read overrides before audit fix: ${err.message}`)
+    process.exit(1)
+  }
+
+  const auditArgs =
+    process.argv.length > 2 ? process.argv.slice(2) : ['audit', '--fix', 'override', '-i']
+
+  const auditExitCode = runPnpm(auditArgs)
+  if (auditExitCode !== 0) {
+    process.exit(auditExitCode)
+  }
+
+  let afterOverrides
+  try {
+    afterOverrides = collectOverrides()
+  } catch (err) {
+    console.error(`[audit-override-commit] Failed to read overrides after audit fix: ${err.message}`)
+    process.exit(1)
+  }
+
+  const changed = collectOverrideChanges(beforeOverrides, afterOverrides)
+  if (changed.length === 0) {
+    console.log('[audit-override-commit] No override changes detected.')
+    process.exit(0)
+  }
+  if (changed.length > 1) {
+    console.log('[audit-override-commit] Multiple override changes detected:')
+    for (const item of changed) {
+      const fromLabel = item.from ?? '(missing)'
+      console.log(`  - ${item.name}: ${fromLabel} -> ${item.to}`)
+    }
+    console.log('[audit-override-commit] Auto-commit supports exactly one override change. Commit manually.')
+    process.exit(1)
+  }
+
+  const installExitCode = runPnpm(['install'])
+  if (installExitCode !== 0) {
+    process.exit(installExitCode)
+  }
+
+  const [only] = changed
+  const stageExitCode = stageExistingFiles(['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'])
+  if (stageExitCode !== 0) {
+    process.exit(stageExitCode)
+  }
+
+  const commitMessage = `vuln(${only.name}): override ${only.to}`
+  console.log(`[audit-override-commit] Staged override for ${only.name} -> ${only.to}`)
+  console.log(`[audit-override-commit] Auto-committing: ${commitMessage}`)
+  process.exit(runGit(['commit', '-m', commitMessage]))
+}
+
+main()

package/scripts/bump-pnpm-toolchain.mjs

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+/**
+ * Maintainer: bump pnpm to the latest (or given) version in fg-devkit and sync toolchain everywhere.
+ *
+ * Steps in fg-devkit:
+ *   1. Resolve target pnpm version (CLI arg or `npm view pnpm version`)
+ *   2. Set package.json packageManager
+ *   3. Sync dependency policy toolchain, scaffold/vue, and Dockerfile.local
+ *   4. corepack prepare + pnpm install
+ *
+ * Steps per Vue consumer repo under projects-root (unless --skip-fleet):
+ *   1. sync-deps against this checkout's policy file (works before fg-devkit is published)
+ *   2. corepack prepare + pnpm install
+ *   3. check-deps against the same policy file
+ *
+ * Usage (from fg-devkit repository root):
+ *   pnpm exec fg-devkit bump-pnpm-toolchain [version] [projects-root] [options]
+ *
+ * Options:
+ *   --dry-run       Print planned steps without changing files or running install
+ *   --skip-fleet    Only update fg-devkit (policy, scaffold, local install)
+ *   --skip-install  Skip corepack prepare and pnpm install
+ *
+ * Examples:
+ *   pnpm exec fg-devkit bump-pnpm-toolchain
+ *   pnpm exec fg-devkit bump-pnpm-toolchain 12.0.0
+ *   pnpm exec fg-devkit bump-pnpm-toolchain --dry-run
+ *   pnpm exec fg-devkit bump-pnpm-toolchain --skip-fleet
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+import { formatPnpmPackageManager } from './dependency-policy-toolchain.mjs'
+import { collectFleetVueRepos } from './fleet-vue-repos.mjs'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+import { syncScaffoldVueDepsFromPolicy } from './sync-scaffold-vue-deps.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
+const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
+const policyPath = resolveDependencyPolicyPath(scriptDir, fgDevkitRoot, [])
+
+const cliArgs = process.argv.slice(2)
+const dryRun = cliArgs.includes('--dry-run')
+const skipFleet = cliArgs.includes('--skip-fleet')
+const skipInstall = cliArgs.includes('--skip-install')
+const positionalArgs = cliArgs.filter((a) => !a.startsWith('-'))
+
+function readJson(jsonPath) {
+  return JSON.parse(fs.readFileSync(jsonPath, 'utf8'))
+}
+
+function assertFgDevkitMaintainerContext() {
+  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
+    console.error('[bump-pnpm-toolchain] Run from the fg-devkit repository root.')
+    process.exit(1)
+  }
+  try {
+    const pkg = readJson(fgDevkitPkgPath)
+    if (pkg?.name !== 'fg-devkit') {
+      console.error('[bump-pnpm-toolchain] package.json name must be fg-devkit.')
+      process.exit(1)
+    }
+  } catch {
+    console.error('[bump-pnpm-toolchain] Could not read fg-devkit package.json.')
+    process.exit(1)
+  }
+}
+
+function resolveTargetVersion(versionArg) {
+  if (versionArg) {
+    return formatPnpmPackageManager(versionArg)
+  }
+  const lookup = spawnSync('npm', ['view', 'pnpm', 'version'], {
+    encoding: 'utf8',
+    env: process.env,
+  })
+  if (lookup.error) {
+    console.error('[bump-pnpm-toolchain]', lookup.error.message)
+    process.exit(1)
+  }
+  if ((lookup.status ?? 1) !== 0) {
+    console.error('[bump-pnpm-toolchain] Failed to resolve latest pnpm version via npm view.')
+    process.exit(lookup.status ?? 1)
+  }
+  const latest = lookup.stdout.trim()
+  if (!latest) {
+    console.error('[bump-pnpm-toolchain] npm view pnpm version returned empty output.')
+    process.exit(1)
+  }
+  return formatPnpmPackageManager(latest)
+}
+
+function runStep(label, fn) {
+  console.log(`\n[bump-pnpm-toolchain] ${label}`)
+  return fn()
+}
+
+function runCorepackPrepare(packageManager, cwd) {
+  const result = spawnSync('corepack', ['prepare', packageManager, '--activate'], {
+    cwd,
+    stdio: 'inherit',
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[bump-pnpm-toolchain]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function runPnpmInstall(cwd) {
+  const result = spawnSync('pnpm', ['install'], {
+    cwd,
+    stdio: 'inherit',
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[bump-pnpm-toolchain]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function runNodeScript(scriptName, args, cwd) {
+  const scriptPath = path.join(scriptDir, scriptName)
+  const result = spawnSync(process.execPath, [scriptPath, ...args], {
+    cwd,
+    stdio: 'inherit',
+    env: process.env,
+  })
+  if (result.error) {
+    console.error('[bump-pnpm-toolchain]', result.error.message)
+    return 1
+  }
+  return result.status ?? 1
+}
+
+function updateFgDevkitPackageManager(packageManager) {
+  const pkg = readJson(fgDevkitPkgPath)
+  if (pkg.packageManager === packageManager) {
+    console.log(`[bump-pnpm-toolchain] fg-devkit packageManager already ${packageManager}`)
+    return false
+  }
+  pkg.packageManager = packageManager
+  fs.writeFileSync(fgDevkitPkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
+  console.log(`[bump-pnpm-toolchain] Set fg-devkit packageManager -> ${packageManager}`)
+  return true
+}
+
+function syncFleetRepo(repoDir, repoName, packageManager) {
+  if (dryRun) {
+    console.log(`[bump-pnpm-toolchain] DRY RUN ${repoName}: sync-deps ${policyPath}`)
+    console.log(`[bump-pnpm-toolchain] DRY RUN ${repoName}: corepack prepare ${packageManager}`)
+    console.log(`[bump-pnpm-toolchain] DRY RUN ${repoName}: pnpm install`)
+    console.log(`[bump-pnpm-toolchain] DRY RUN ${repoName}: check-deps ${policyPath}`)
+    return 0
+  }
+
+  const syncCode = runNodeScript('sync-dependency-policy.mjs', [policyPath], repoDir)
+  if (syncCode !== 0) {
+    console.error(`[bump-pnpm-toolchain] FAIL ${repoName}: sync-deps exited with code ${syncCode}`)
+    return syncCode
+  }
+
+  if (!skipInstall) {
+    const corepackCode = runCorepackPrepare(packageManager, repoDir)
+    if (corepackCode !== 0) {
+      console.error(`[bump-pnpm-toolchain] FAIL ${repoName}: corepack prepare exited with code ${corepackCode}`)
+      return corepackCode
+    }
+
+    const installCode = runPnpmInstall(repoDir)
+    if (installCode !== 0) {
+      console.error(`[bump-pnpm-toolchain] FAIL ${repoName}: pnpm install exited with code ${installCode}`)
+      return installCode
+    }
+  }
+
+  const checkCode = runNodeScript('check-dependency-policy.mjs', [policyPath], repoDir)
+  if (checkCode !== 0) {
+    console.error(`[bump-pnpm-toolchain] FAIL ${repoName}: check-deps exited with code ${checkCode}`)
+    return checkCode
+  }
+
+  console.log(`[bump-pnpm-toolchain] OK ${repoName}`)
+  return 0
+}
+
+function main() {
+  assertFgDevkitMaintainerContext()
+
+  const versionArg = positionalArgs.find((a) => /^(pnpm@)?\d/.test(a))
+  const projectsRootArg = positionalArgs.find((a) => a !== versionArg)
+  const projectsRoot = projectsRootArg
+    ? path.resolve(process.cwd(), projectsRootArg)
+    : path.resolve(fgDevkitRoot, '..')
+
+  const packageManager = resolveTargetVersion(versionArg)
+
+  console.log(`[bump-pnpm-toolchain] target=${packageManager}`)
+  console.log(`[bump-pnpm-toolchain] policy=${policyPath}`)
+  if (!skipFleet) {
+    console.log(`[bump-pnpm-toolchain] projectsRoot=${projectsRoot}`)
+  }
+
+  if (dryRun) {
+    console.log('[bump-pnpm-toolchain] DRY RUN fg-devkit: update packageManager')
+    console.log('[bump-pnpm-toolchain] DRY RUN fg-devkit: sync-scaffold-vue-deps')
+    if (!skipInstall) {
+      console.log(`[bump-pnpm-toolchain] DRY RUN fg-devkit: corepack prepare ${packageManager}`)
+      console.log('[bump-pnpm-toolchain] DRY RUN fg-devkit: pnpm install')
+    }
+  } else {
+    runStep('Update fg-devkit package.json', () => {
+      updateFgDevkitPackageManager(packageManager)
+    })
+
+    runStep('Sync policy, scaffold, and Dockerfile', () => {
+      syncScaffoldVueDepsFromPolicy({ fgDevkitRoot, policyPath })
+    })
+
+    if (!skipInstall) {
+      const corepackCode = runStep('Activate pnpm via corepack (fg-devkit)', () =>
+        runCorepackPrepare(packageManager, fgDevkitRoot),
+      )
+      if (corepackCode !== 0) {
+        process.exit(corepackCode)
+      }
+
+      const installCode = runStep('pnpm install (fg-devkit)', () => runPnpmInstall(fgDevkitRoot))
+      if (installCode !== 0) {
+        process.exit(installCode)
+      }
+    }
+  }
+
+  if (skipFleet) {
+    console.log('\n[bump-pnpm-toolchain] Done (--skip-fleet). Commit fg-devkit changes and release when ready.')
+    process.exit(0)
+  }
+
+  if (!fs.existsSync(projectsRoot)) {
+    console.error(`[bump-pnpm-toolchain] projects root not found: ${projectsRoot}`)
+    process.exit(1)
+  }
+
+  const repos = collectFleetVueRepos(projectsRoot)
+  if (repos.length === 0) {
+    console.log(`[bump-pnpm-toolchain] No Vue repositories with fg-devkit under ${projectsRoot}`)
+    process.exit(0)
+  }
+
+  console.log(`\n[bump-pnpm-toolchain] Fleet repositories=${repos.length}`)
+
+  let failures = 0
+  for (const repoDir of repos) {
+    const repoName = path.basename(repoDir)
+    console.log(`\n[bump-pnpm-toolchain] Fleet: ${repoName}`)
+    const code = syncFleetRepo(repoDir, repoName, packageManager)
+    if (code !== 0) {
+      failures += 1
+    }
+  }
+
+  console.log(`\n[bump-pnpm-toolchain] Done: fleet ok=${repos.length - failures}, failed=${failures}`)
+  if (failures > 0) {
+    process.exit(1)
+  }
+
+  if (!dryRun) {
+    console.log(
+      '[bump-pnpm-toolchain] Commit changes in fg-devkit and each updated consumer repo, then release fg-devkit.',
+    )
+  }
+}
+
+main()

package/scripts/check-dependency-policy.mjs

@@ -6,6 +6,7 @@
  * - For each dependency listed in the policy, checks the consumer’s declared version matches.
  * - For managedAnywhere packages, allows either dependencies or devDependencies but requires one consistent version.
  * - Optionally checks policy-defined pnpm overrides against the consumer’s package.json.
+ * - When the policy defines toolchain.packageManager, requires the consumer to use the same value.
  * - Enforces pinned semver for any other dependencies/devDependencies/optionalDependencies and consumer pnpm.overrides.
  *
  * Policy path: first CLI argument, or default policy under fg-devkit/configs/ (see resolve-dependency-policy-path.mjs).
@@ -17,6 +18,10 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { collectPinViolations, isPinnedDependencyVersion } from './dependency-policy-pins.mjs'
+import {
+  collectToolchainPolicyViolations,
+  resolveExpectedPackageManager,
+} from './dependency-policy-toolchain.mjs'
 import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
 
 const cwd = process.cwd()
@@ -81,6 +86,17 @@ for (const [section, dependencies] of Object.entries(policy.managedDependencies
 }
 
 mismatches.push(...collectPinViolations('[policy] managedAnywhere.', policy.managedAnywhere ?? {}))
+mismatches.push(...collectToolchainPolicyViolations(policy))
+
+const expectedPackageManager = resolveExpectedPackageManager(policy, path.resolve(scriptDir, '..'))
+if (expectedPackageManager !== undefined) {
+  const actualPackageManager = pkg.packageManager
+  if (actualPackageManager !== expectedPackageManager) {
+    mismatches.push(
+      `packageManager: expected ${expectedPackageManager}, got ${actualPackageManager ?? '(missing)'}`,
+    )
+  }
+}
 
 // Intersection: only packages that exist in both policy and consumer are compared.
 for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {

package/scripts/dependency-policy-toolchain.mjs

@@ -0,0 +1,101 @@
+/**
+ * Shared helpers for fleet-wide pnpm / Corepack toolchain policy.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+const PNPM_PACKAGE_MANAGER_PATTERN = /^pnpm@\d+\.\d+\.\d+(-[\w.]+)?$/i
+
+/** @param {unknown} value */
+export function isValidPnpmPackageManager(value) {
+  return typeof value === 'string' && PNPM_PACKAGE_MANAGER_PATTERN.test(value)
+}
+
+/**
+ * @param {string} fgDevkitRoot
+ * @returns {string | undefined}
+ */
+export function readFgDevkitPackageManager(fgDevkitRoot) {
+  const pkgPath = path.join(fgDevkitRoot, 'package.json')
+  if (!fs.existsSync(pkgPath)) {
+    return undefined
+  }
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+  return typeof pkg.packageManager === 'string' ? pkg.packageManager : undefined
+}
+
+/**
+ * @param {Record<string, unknown>} policy
+ * @param {string} fgDevkitRoot
+ * @returns {{ policy: Record<string, unknown>; changed: boolean }}
+ */
+export function syncPolicyToolchainFromFgDevkit(policy, fgDevkitRoot) {
+  const fromFgDevkit = readFgDevkitPackageManager(fgDevkitRoot)
+  if (!fromFgDevkit || !isValidPnpmPackageManager(fromFgDevkit)) {
+    return { policy, changed: false }
+  }
+  const next = { ...policy, toolchain: { ...(policy.toolchain ?? {}) } }
+  if (next.toolchain.packageManager === fromFgDevkit) {
+    return { policy: next, changed: false }
+  }
+  next.toolchain.packageManager = fromFgDevkit
+  return { policy: next, changed: true }
+}
+
+/**
+ * Expected `packageManager` for consumers: policy.toolchain first, then fg-devkit package.json.
+ *
+ * @param {Record<string, unknown>} policy
+ * @param {string} [fgDevkitRoot]
+ * @returns {string | undefined}
+ */
+export function resolveExpectedPackageManager(policy, fgDevkitRoot) {
+  const fromPolicy = policy?.toolchain?.packageManager
+  if (typeof fromPolicy === 'string') {
+    return fromPolicy
+  }
+  if (fgDevkitRoot) {
+    return readFgDevkitPackageManager(fgDevkitRoot)
+  }
+  return undefined
+}
+
+/**
+ * @param {Record<string, unknown>} policy
+ * @param {string} [labelPrefix]
+ * @returns {string[]}
+ */
+export function collectToolchainPolicyViolations(policy, labelPrefix = '[policy] toolchain.') {
+  const packageManager = policy?.toolchain?.packageManager
+  if (packageManager === undefined) {
+    return []
+  }
+  if (!isValidPnpmPackageManager(packageManager)) {
+    return [
+      `${labelPrefix}packageManager: must be pnpm@x.y.z, got ${JSON.stringify(packageManager)}`,
+    ]
+  }
+  return []
+}
+
+/**
+ * @param {string} version Bare semver (e.g. 11.7.0) or packageManager string (pnpm@11.7.0).
+ * @returns {string}
+ */
+export function formatPnpmPackageManager(version) {
+  const bare = version.trim().replace(/^pnpm@/i, '')
+  if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(bare)) {
+    throw new Error(`Invalid pnpm version: ${JSON.stringify(version)}`)
+  }
+  return `pnpm@${bare}`
+}
+
+/**
+ * @param {string} packageManager e.g. pnpm@11.7.0
+ * @returns {string | undefined}
+ */
+export function extractPnpmVersion(packageManager) {
+  const match = packageManager.match(/^pnpm@(.+)$/i)
+  return match ? match[1] : undefined
+}