glab-setup-git-identity 0.6.0

package/scripts/publish-to-npm.mjs

@@ -0,0 +1,302 @@
+#!/usr/bin/env bun
+
+/**
+ * Publish to npm using OIDC trusted publishing
+ * Usage: node scripts/publish-to-npm.mjs [--should-pull] [--js-root <path>]
+ *   should_pull: Optional flag to pull latest changes before publishing (for release job)
+ *
+ * IMPORTANT: Update the PACKAGE_NAME constant below to match your package.json
+ *
+ * Configuration:
+ * - CLI: --js-root <path> to explicitly set JavaScript root
+ * - Environment: JS_ROOT=<path>
+ *
+ * Uses link-foundation libraries:
+ * - use-m: Dynamic package loading without package.json dependencies
+ * - command-stream: Modern shell command execution with streaming support
+ * - lino-arguments: Unified configuration from CLI args, env vars, and .lenv files
+ *
+ * Addresses issues documented in:
+ * - Issue #21: Supporting both single and multi-language repository structures
+ * - Reference: link-assistant/agent PR #112 (--legacy-peer-deps fix)
+ * - Reference: link-assistant/agent PR #114 (configurable package root)
+ */
+
+import { readFileSync, appendFileSync } from 'fs';
+
+import {
+  getJsRoot,
+  getPackageJsonPath,
+  needsCd,
+  parseJsRootConfig,
+} from './js-paths.mjs';
+
+// TODO: Update this to match your package name in package.json
+const PACKAGE_NAME = 'glab-setup-git-identity';
+
+// Load use-m dynamically
+const { use } = eval(
+  await (await fetch('https://unpkg.com/use-m/use.js')).text()
+);
+
+// Import link-foundation libraries
+const { $ } = await use('command-stream');
+const { makeConfig } = await use('lino-arguments');
+
+// Parse CLI arguments using lino-arguments
+const config = makeConfig({
+  yargs: ({ yargs, getenv }) =>
+    yargs
+      .option('should-pull', {
+        type: 'boolean',
+        default: getenv('SHOULD_PULL', false),
+        describe: 'Pull latest changes before publishing',
+      })
+      .option('js-root', {
+        type: 'string',
+        default: getenv('JS_ROOT', ''),
+        describe:
+          'JavaScript package root directory (auto-detected if not specified)',
+      }),
+});
+
+const { shouldPull, jsRoot: jsRootArg } = config;
+
+// Get JavaScript package root (auto-detect or use explicit config)
+const jsRootConfig = jsRootArg || parseJsRootConfig();
+const jsRoot = getJsRoot({ jsRoot: jsRootConfig, verbose: true });
+
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 10000; // 10 seconds
+
+// Store the original working directory to restore after cd commands
+// IMPORTANT: command-stream's cd is a virtual command that calls process.chdir()
+const originalCwd = process.cwd();
+
+// Patterns that indicate publish failure in changeset output
+// Reference: link-assistant/agent PR #116 - prevent false positives in CI/CD
+const FAILURE_PATTERNS = [
+  'packages failed to publish',
+  'error occurred while publishing',
+  'npm error code E',
+  'npm error 404',
+  'npm error 401',
+  'npm error 403',
+  'Access token expired',
+  'ENEEDAUTH',
+];
+
+/**
+ * Sleep for specified milliseconds
+ * @param {number} ms
+ */
+function sleep(ms) {
+  return new Promise((resolve) => globalThis.setTimeout(resolve, ms));
+}
+
+/**
+ * Check if the output contains any failure patterns
+ * Reference: link-assistant/agent PR #116
+ * @param {string} output - Combined stdout and stderr
+ * @returns {string|null} - The matched failure pattern or null if no failure detected
+ */
+function detectPublishFailure(output) {
+  const lowerOutput = output.toLowerCase();
+  for (const pattern of FAILURE_PATTERNS) {
+    if (lowerOutput.includes(pattern.toLowerCase())) {
+      return pattern;
+    }
+  }
+  return null;
+}
+
+/**
+ * Verify that a package version is published on npm
+ * Reference: link-assistant/agent PR #116
+ * @param {string} packageName
+ * @param {string} version
+ * @returns {Promise<boolean>}
+ */
+async function verifyPublished(packageName, version) {
+  const result = await $`npm view "${packageName}@${version}" version`.run({
+    capture: true,
+  });
+  return result.code === 0 && result.stdout.trim().includes(version);
+}
+
+/**
+ * Append to GitHub Actions output file
+ * @param {string} key
+ * @param {string} value
+ */
+function setOutput(key, value) {
+  const outputFile = process.env.GITHUB_OUTPUT;
+  if (outputFile) {
+    appendFileSync(outputFile, `${key}=${value}\n`);
+  }
+}
+
+/**
+ * Run changeset:publish command with output capture
+ * @returns {Promise<{result: object|null, error: Error|null}>}
+ */
+async function runChangesetPublish() {
+  try {
+    // Run changeset:publish from the js directory where package.json with this script exists
+    // IMPORTANT: Use .run({ capture: true }) to capture output for failure detection
+    // IMPORTANT: cd is a virtual command that calls process.chdir(), so we restore after
+    if (needsCd({ jsRoot })) {
+      const result = await $`cd ${jsRoot} && npm run changeset:publish`.run({
+        capture: true,
+      });
+      process.chdir(originalCwd);
+      return { result, error: null };
+    }
+    const result = await $`npm run changeset:publish`.run({ capture: true });
+    return { result, error: null };
+  } catch (error) {
+    // Restore cwd on error before retry
+    if (needsCd({ jsRoot })) {
+      process.chdir(originalCwd);
+    }
+    return { result: null, error };
+  }
+}
+
+/**
+ * Analyze publish result for failures using multi-layer detection
+ * Reference: link-assistant/agent PR #116
+ * @param {object|null} publishResult - The result from runChangesetPublish
+ * @param {Error|null} commandError - Error thrown by the command
+ * @returns {Error|null} - Error if failure detected, null otherwise
+ */
+function analyzePublishResult(publishResult, commandError) {
+  if (commandError) {
+    return commandError;
+  }
+
+  const combinedOutput = publishResult
+    ? `${publishResult.stdout || ''}\n${publishResult.stderr || ''}`
+    : '';
+
+  // Log the output for debugging
+  if (combinedOutput.trim()) {
+    console.log('Changeset output:', combinedOutput);
+  }
+
+  // Check for failure patterns in output (most reliable for changeset)
+  const failurePattern = detectPublishFailure(combinedOutput);
+  if (failurePattern) {
+    console.error(`Detected publish failure: "${failurePattern}"`);
+    return new Error(`Publish failed: detected "${failurePattern}" in output`);
+  }
+
+  // Check exit code (if available and non-zero)
+  if (publishResult && publishResult.code !== 0) {
+    console.error(`Changeset exited with code ${publishResult.code}`);
+    return new Error(`Publish failed with exit code ${publishResult.code}`);
+  }
+
+  return null;
+}
+
+/**
+ * Perform a single publish attempt with verification
+ * @param {string} currentVersion
+ * @returns {Promise<{success: boolean, error: Error|null}>}
+ */
+async function attemptPublish(currentVersion) {
+  const { result, error } = await runChangesetPublish();
+  const analysisError = analyzePublishResult(result, error);
+
+  if (analysisError) {
+    return { success: false, error: analysisError };
+  }
+
+  // Verify the package is actually on npm (ultimate verification)
+  console.log('Verifying package was published to npm...');
+  await sleep(2000); // Wait for npm registry to propagate
+  const isPublished = await verifyPublished(PACKAGE_NAME, currentVersion);
+
+  if (isPublished) {
+    return { success: true, error: null };
+  }
+
+  console.error('Verification failed: package not found on npm after publish');
+  return {
+    success: false,
+    error: new Error('Package not found on npm after publish attempt'),
+  };
+}
+
+async function main() {
+  try {
+    if (shouldPull) {
+      // Pull the latest changes we just pushed
+      await $`git pull origin main`;
+    }
+
+    // Get current version
+    const packageJsonPath = getPackageJsonPath({ jsRoot });
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+    const currentVersion = packageJson.version;
+    console.log(`Current version to publish: ${currentVersion}`);
+
+    // Check if this version is already published on npm
+    console.log(
+      `Checking if version ${currentVersion} is already published...`
+    );
+    const checkResult =
+      await $`npm view "${PACKAGE_NAME}@${currentVersion}" version`.run({
+        capture: true,
+      });
+
+    // command-stream returns { code: 0 } on success, { code: 1 } on failure (e.g., E404)
+    // Exit code 0 means version exists, non-zero means version not found
+    if (checkResult.code === 0) {
+      console.log(`Version ${currentVersion} is already published to npm`);
+      setOutput('published', 'true');
+      setOutput('published_version', currentVersion);
+      setOutput('already_published', 'true');
+      return;
+    }
+
+    // Version not found on npm (E404), proceed with publish
+    console.log(
+      `Version ${currentVersion} not found on npm, proceeding with publish...`
+    );
+
+    // Publish to npm using OIDC trusted publishing with retry logic
+    // Multi-layer failure detection based on link-assistant/agent PR #116
+    for (let i = 1; i <= MAX_RETRIES; i++) {
+      console.log(`Publish attempt ${i} of ${MAX_RETRIES}...`);
+      const { success, error } = await attemptPublish(currentVersion);
+
+      if (success) {
+        setOutput('published', 'true');
+        setOutput('published_version', currentVersion);
+        console.log(
+          `\u2705 Published ${PACKAGE_NAME}@${currentVersion} to npm`
+        );
+        return;
+      }
+
+      if (i < MAX_RETRIES) {
+        console.log(
+          `Publish failed: ${error.message}, waiting ${RETRY_DELAY / 1000}s before retry...`
+        );
+        await sleep(RETRY_DELAY);
+      }
+    }
+
+    console.error(`\u274C Failed to publish after ${MAX_RETRIES} attempts`);
+    process.exit(1);
+  } catch (error) {
+    // Restore cwd on error
+    process.chdir(originalCwd);
+    console.error('Error:', error.message);
+    process.exit(1);
+  }
+}
+
+main();

package/scripts/setup-npm.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env bun
+
+/**
+ * Update npm for OIDC trusted publishing
+ * npm trusted publishing requires npm >= 11.5.1
+ * Node.js 20.x ships with npm 10.x, so we need to update
+ *
+ * Uses link-foundation libraries:
+ * - use-m: Dynamic package loading without package.json dependencies
+ * - command-stream: Modern shell command execution with streaming support
+ */
+
+// Load use-m dynamically
+const { use } = eval(
+  await (await fetch('https://unpkg.com/use-m/use.js')).text()
+);
+
+// Import command-stream for shell command execution
+const { $ } = await use('command-stream');
+
+try {
+  // Get current npm version
+  const currentResult = await $`npm --version`.run({ capture: true });
+  const currentVersion = currentResult.stdout.trim();
+  console.log(`Current npm version: ${currentVersion}`);
+
+  // Update npm to latest
+  await $`npm install -g npm@latest`;
+
+  // Get updated npm version
+  const updatedResult = await $`npm --version`.run({ capture: true });
+  const updatedVersion = updatedResult.stdout.trim();
+  console.log(`Updated npm version: ${updatedVersion}`);
+} catch (error) {
+  console.error('Error updating npm:', error.message);
+  process.exit(1);
+}

package/scripts/validate-changeset.mjs

@@ -0,0 +1,265 @@
+#!/usr/bin/env bun
+
+/**
+ * Validate changeset for CI - ensures exactly one valid changeset is added by the PR
+ *
+ * Key behavior:
+ * - Only checks changeset files ADDED by the current PR (not pre-existing ones)
+ * - Uses git diff to compare PR head against base branch
+ * - Validates that the PR adds exactly one changeset with proper format
+ * - Falls back to checking all changesets for local development
+ *
+ * IMPORTANT: Update the package name below to match your package.json
+ */
+
+import { execSync } from 'child_process';
+import { readFileSync, readdirSync, existsSync } from 'fs';
+import { join } from 'path';
+
+// TODO: Update this to match your package name in package.json
+const PACKAGE_NAME = 'glab-setup-git-identity';
+const CHANGESET_DIR = '.changeset';
+
+/**
+ * Ensure a git commit is available locally, fetching if necessary
+ * @param {string} sha The commit SHA to check
+ */
+function ensureCommitAvailable(sha) {
+  try {
+    execSync(`git cat-file -e ${sha}`, { stdio: 'ignore' });
+  } catch {
+    console.log('Base commit not available locally, attempting fetch...');
+    try {
+      execSync(`git fetch origin ${sha}`, { stdio: 'inherit' });
+    } catch {
+      execSync(`git fetch origin`, { stdio: 'inherit' });
+    }
+  }
+}
+
+/**
+ * Parse git diff output and extract added changeset files
+ * @param {string} diffOutput Output from git diff --name-status
+ * @returns {string[]} Array of added changeset file names
+ */
+function parseAddedChangesets(diffOutput) {
+  const addedChangesets = [];
+  for (const line of diffOutput.trim().split('\n')) {
+    if (!line) {
+      continue;
+    }
+    const [status, filePath] = line.split('\t');
+    if (
+      status === 'A' &&
+      filePath.startsWith(`${CHANGESET_DIR}/`) &&
+      filePath.endsWith('.md') &&
+      !filePath.endsWith('README.md')
+    ) {
+      addedChangesets.push(filePath.replace(`${CHANGESET_DIR}/`, ''));
+    }
+  }
+  return addedChangesets;
+}
+
+/**
+ * Try to get changesets using explicit SHA comparison
+ * @param {string} baseSha Base commit SHA
+ * @param {string} headSha Head commit SHA
+ * @returns {string[] | null} Array of changeset files or null if failed
+ */
+function tryExplicitShaComparison(baseSha, headSha) {
+  console.log(`Comparing ${baseSha}...${headSha}`);
+  try {
+    ensureCommitAvailable(baseSha);
+    const diffOutput = execSync(
+      `git diff --name-status ${baseSha} ${headSha}`,
+      { encoding: 'utf-8' }
+    );
+    return parseAddedChangesets(diffOutput);
+  } catch (error) {
+    console.log(`Git diff with explicit SHAs failed: ${error.message}`);
+    return null;
+  }
+}
+
+/**
+ * Try to get changesets using base branch comparison
+ * @param {string} prBase Base branch name
+ * @returns {string[] | null} Array of changeset files or null if failed
+ */
+function tryBaseBranchComparison(prBase) {
+  console.log(`Comparing against base branch: ${prBase}`);
+  try {
+    try {
+      execSync(`git fetch origin ${prBase}`, { stdio: 'inherit' });
+    } catch {
+      // Ignore fetch errors, we might already have it
+    }
+    const diffOutput = execSync(
+      `git diff --name-status origin/${prBase}...HEAD`,
+      { encoding: 'utf-8' }
+    );
+    return parseAddedChangesets(diffOutput);
+  } catch (error) {
+    console.log(`Git diff with base ref failed: ${error.message}`);
+    return null;
+  }
+}
+
+/**
+ * Fallback: get all changesets in directory
+ * @returns {string[]} Array of all changeset file names
+ */
+function getAllChangesets() {
+  console.log(
+    'Warning: Could not determine PR diff, checking all changesets in directory'
+  );
+  if (!existsSync(CHANGESET_DIR)) {
+    return [];
+  }
+  return readdirSync(CHANGESET_DIR).filter(
+    (file) => file.endsWith('.md') && file !== 'README.md'
+  );
+}
+
+/**
+ * Get changeset files added in the current PR using git diff
+ * @returns {string[]} Array of added changeset file names
+ */
+function getAddedChangesetFiles() {
+  const baseSha = process.env.GITHUB_BASE_SHA || process.env.BASE_SHA;
+  const headSha = process.env.GITHUB_HEAD_SHA || process.env.HEAD_SHA;
+
+  // Try explicit SHAs first
+  if (baseSha && headSha) {
+    const result = tryExplicitShaComparison(baseSha, headSha);
+    if (result !== null) {
+      return result;
+    }
+  }
+
+  // Try base branch comparison
+  const prBase = process.env.GITHUB_BASE_REF;
+  if (prBase) {
+    const result = tryBaseBranchComparison(prBase);
+    if (result !== null) {
+      return result;
+    }
+  }
+
+  // Fallback to checking all changesets
+  return getAllChangesets();
+}
+
+/**
+ * Validate a single changeset file
+ * @param {string} filePath Full path to the changeset file
+ * @returns {{valid: boolean, type?: string, description?: string, error?: string}}
+ */
+function validateChangesetFile(filePath) {
+  try {
+    const content = readFileSync(filePath, 'utf-8');
+
+    // Check if changeset has a valid type (major, minor, or patch)
+    const versionTypeRegex = new RegExp(
+      `^['"]${PACKAGE_NAME.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}['"]:\\s+(major|minor|patch)`,
+      'm'
+    );
+    const versionTypeMatch = content.match(versionTypeRegex);
+
+    if (!versionTypeMatch) {
+      return {
+        valid: false,
+        error: `Changeset must specify a version type: major, minor, or patch\nExpected format:\n---\n'${PACKAGE_NAME}': patch\n---\n\nYour description here`,
+      };
+    }
+
+    // Extract description (everything after the closing ---) and check it's not empty
+    const parts = content.split('---');
+    if (parts.length < 3) {
+      return {
+        valid: false,
+        error:
+          "Changeset must include a description of the changes (after the closing '---')",
+      };
+    }
+
+    const description = parts.slice(2).join('---').trim();
+    if (!description) {
+      return {
+        valid: false,
+        error: 'Changeset must include a non-empty description of the changes',
+      };
+    }
+
+    return {
+      valid: true,
+      type: versionTypeMatch[1],
+      description,
+    };
+  } catch (error) {
+    return {
+      valid: false,
+      error: `Failed to read changeset file: ${error.message}`,
+    };
+  }
+}
+
+try {
+  console.log('Validating changesets added by this PR...');
+
+  // Get changeset files added in this PR
+  const addedChangesetFiles = getAddedChangesetFiles();
+  const changesetCount = addedChangesetFiles.length;
+
+  console.log(`Found ${changesetCount} changeset file(s) added by this PR`);
+  if (changesetCount > 0) {
+    console.log('Added changesets:');
+    addedChangesetFiles.forEach((file) => console.log(`  - ${file}`));
+  }
+
+  // Ensure exactly one changeset file was added
+  if (changesetCount === 0) {
+    console.error(
+      "::error::No changeset found in this PR. Please add a changeset by running 'npm run changeset' and commit the result."
+    );
+    process.exit(1);
+  } else if (changesetCount > 1) {
+    console.error(
+      `::error::Multiple changesets found in this PR (${changesetCount}). Each PR should add exactly ONE changeset.`
+    );
+    console.error('::error::Found changeset files added by this PR:');
+    addedChangesetFiles.forEach((file) => console.error(`  ${file}`));
+    console.error(
+      '\n::error::Please combine these into a single changeset or remove the extras.'
+    );
+    process.exit(1);
+  }
+
+  // Validate the single changeset file
+  const changesetFile = join(CHANGESET_DIR, addedChangesetFiles[0]);
+  console.log(`Validating changeset: ${changesetFile}`);
+
+  const validation = validateChangesetFile(changesetFile);
+
+  if (!validation.valid) {
+    console.error(`::error::${validation.error}`);
+    console.error(`\nFile content of ${changesetFile}:`);
+    try {
+      console.error(readFileSync(changesetFile, 'utf-8'));
+    } catch {
+      console.error('(could not read file)');
+    }
+    process.exit(1);
+  }
+
+  console.log('Changeset validation passed');
+  console.log(`   Type: ${validation.type}`);
+  console.log(`   Description: ${validation.description}`);
+} catch (error) {
+  console.error('Error during changeset validation:', error.message);
+  if (process.env.DEBUG) {
+    console.error('Stack trace:', error.stack);
+  }
+  process.exit(1);
+}