fimo 0.6.0 → 0.7.0-experimental.2

package/scripts/publish-npm.mjs

@@ -1,180 +0,0 @@
-#!/usr/bin/env node
-// Publish the fimo CLI to npm on a channel.
-//
-// Usage:
-//   node scripts/publish-npm.mjs --channel experimental [--dry-run]
-//   node scripts/publish-npm.mjs --channel staging      [--dry-run]
-//   node scripts/publish-npm.mjs --channel latest       (CI only; --bootstrap for the first publish)
-//   node scripts/publish-npm.mjs --channel experimental --plan   (print the plan, touch nothing)
-//
-// What it does:
-//   1. Resolves the channel from the shared table (lib/channels.mjs).
-//   2. Guards: @latest refuses to publish outside CI unless --bootstrap.
-//   3. Builds in place (clean → build → build:bundle) with the workspace
-//      manifest UNTOUCHED, then `npm pack`s straight into a temp stage dir.
-//   4. Mutates ONLY the extracted stage copy: synthesized X.Y.Z-<tag>.<n>
-//      version, template fimo pin, channel release.json (allowlist-enforced —
-//      staging URLs for experimental/staging, prod for latest, never a tunnel).
-//   5. Runs `npm publish --tag <distTag>` from the stage (no --provenance —
-//      strapi/fimo is private).
-//   6. On real experimental publishes, records the exact version in repo-root
-//      .fimo/dev.json for local source-checkout deploys.
-//
-// The workspace is never mutated: no transient package.json version, no
-// release.json, no template rewrites — a crash or a long OTP prompt can't
-// leave the repo dirty (it used to sit mutated for the whole multi-minute
-// build + 2FA window).
-
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { resolveChannel } from './lib/channels.mjs';
-import { writeDevReleaseState } from './lib/dev-release-state.mjs';
-import {
-  computePublishVersion,
-  nextVersionFromChangesets,
-  parsePublishedVersions,
-  pinTemplateFimo,
-  stripTemplateLockfile,
-  writeReleaseJson,
-} from './lib/release-core.mjs';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const CLI_ROOT = resolve(HERE, '..');
-const PKG_PATH = resolve(CLI_ROOT, 'package.json');
-
-function parseArgs(argv) {
-  const args = { channel: null, dryRun: false, bootstrap: false, plan: false };
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === '--channel') {
-      args.channel = argv[++i];
-    } else if (arg === '--dry-run') {
-      args.dryRun = true;
-    } else if (arg === '--bootstrap') {
-      args.bootstrap = true;
-    } else if (arg === '--plan') {
-      args.plan = true;
-    }
-  }
-  return args;
-}
-
-function run(cmd, args, cwd) {
-  console.log(`[publish-npm] $ ${cmd} ${args.join(' ')}`);
-  const result = spawnSync(cmd, args, { cwd, stdio: 'inherit' });
-  if (result.status !== 0) {
-    console.error(`[publish-npm] ${cmd} ${args[0]} failed (exit ${result.status}).`);
-    process.exit(result.status ?? 1);
-  }
-}
-
-// All published versions of the package, or null when the registry can't be
-// reached (offline, first-ever publish) or the output shape is unrecognized —
-// callers fall back to the run-number/timestamp counter.
-function fetchPublishedVersions(name) {
-  const result = spawnSync('npm', ['view', name, 'versions', '--json'], { encoding: 'utf8' });
-  if (result.status !== 0) {
-    return null;
-  }
-  return parsePublishedVersions(result.stdout);
-}
-
-const { channel: channelName, dryRun, bootstrap, plan } = parseArgs(process.argv.slice(2));
-
-if (!channelName) {
-  console.error('[publish-npm] missing --channel <experimental|staging|latest>');
-  process.exit(1);
-}
-
-const channel = resolveChannel(channelName);
-const isCI = !!process.env.CI;
-
-// Prod guard (D11): @latest never originates on a laptop.
-if (channel.distTag === 'latest' && !isCI && !bootstrap) {
-  console.error(
-    '[publish-npm] refusing to publish @latest outside CI.\n' +
-      '  Latest ships from CI on the production branch. For the first-ever publish, pass --bootstrap.'
-  );
-  process.exit(1);
-}
-
-const pkg = JSON.parse(readFileSync(PKG_PATH, 'utf8'));
-// Prerelease channels base off the version the pending changesets will
-// produce at the next production release, so a staging build advertises the
-// version prod will actually ship.
-const baseVersion = channel.prerelease
-  ? nextVersionFromChangesets(pkg.version, resolve(CLI_ROOT, '../../.changeset'))
-  : pkg.version;
-const runId = process.env.GITHUB_RUN_NUMBER;
-let existingVersions;
-if (channel.prerelease) {
-  existingVersions = fetchPublishedVersions(pkg.name) ?? undefined;
-  if (!existingVersions) {
-    console.warn('[publish-npm] could not fetch published versions from npm — using run/timestamp counter.');
-  }
-}
-const publishVersion = computePublishVersion(baseVersion, channel, { runId, existingVersions });
-
-console.log(`[publish-npm] channel:   ${channelName}  (dist-tag: ${channel.distTag})`);
-console.log(
-  `[publish-npm] version:   ${publishVersion}${publishVersion !== baseVersion ? ` (from ${baseVersion})` : ''}`
-);
-console.log(`[publish-npm] apiUrl:    ${channel.apiUrl}`);
-console.log(`[publish-npm] webUrl:    ${channel.webUrl}`);
-
-if (plan) {
-  console.log('[publish-npm] --plan: nothing written, nothing published.');
-  process.exit(0);
-}
-
-const stageRoot = mkdtempSync(join(tmpdir(), 'fimo-publish-'));
-try {
-  // 1. Build in place — the build output doesn't depend on the version, so
-  //    the workspace manifest stays untouched.
-  run('pnpm', ['run', 'prepublishOnly'], CLI_ROOT);
-
-  // 2. Pack the workspace tarball (honors the `files` whitelist) directly
-  //    into the stage dir; --ignore-scripts because we just built.
-  run('npm', ['pack', '--ignore-scripts', '--pack-destination', stageRoot], CLI_ROOT);
-  const tarball = readdirSync(stageRoot).find((name) => name.endsWith('.tgz'));
-  if (!tarball) {
-    console.error(`[publish-npm] npm pack produced no tarball in ${stageRoot}.`);
-    process.exit(1);
-  }
-  run('tar', ['-xzf', join(stageRoot, tarball), '-C', stageRoot], stageRoot);
-  const stage = join(stageRoot, 'package');
-
-  // 3. Mutate ONLY the stage copy: synthesized version, template pin,
-  //    channel release.json.
-  const stagePkg = JSON.parse(readFileSync(join(stage, 'package.json'), 'utf8'));
-  writeFileSync(join(stage, 'package.json'), JSON.stringify({ ...stagePkg, version: publishVersion }, null, 2) + '\n');
-  pinTemplateFimo(stage, publishVersion);
-  stripTemplateLockfile(stage);
-  writeReleaseJson(stage, channel);
-
-  // 4. Publish from the stage. No --provenance: sigstore provenance requires
-  //    a PUBLIC source repo, and strapi/fimo is private (npm returns 422
-  //    otherwise). Trusted Publishing (OIDC auth) works regardless of repo
-  //    visibility — it's only the attestation that's public-only.
-  const publishArgs = ['publish', '--access', 'public', '--tag', channel.distTag, '--ignore-scripts'];
-  if (dryRun) {
-    publishArgs.push('--dry-run');
-  }
-  run('npm', publishArgs, stage);
-
-  if (!dryRun && channel.distTag === 'experimental') {
-    const devStatePath = writeDevReleaseState(CLI_ROOT, {
-      version: publishVersion,
-      channel: channel.distTag,
-    });
-    console.log(`[publish-npm] wrote ${devStatePath}`);
-  }
-} finally {
-  rmSync(stageRoot, { recursive: true, force: true });
-}
-
-console.log(`[publish-npm] done${dryRun ? ' (dry-run — nothing published)' : ''}.`);