impel-cli 0.20.63-canary.1 → 0.20.63-canary.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63-canary.1",
+  "version": "0.20.63-canary.2",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/pack-release.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+function main() {
+  const destination = process.env.RUNNER_TEMP;
+  if (!destination) throw new Error("RUNNER_TEMP is required");
+  const { version } = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  execFileSync("pnpm", ["pack", "--pack-destination", destination], { stdio: "inherit" });
+  const tarball = path.join(destination, `impel-cli-${version}.tgz`);
+  if (!fs.existsSync(tarball)) throw new Error(`pnpm pack did not create ${tarball}`);
+  const prefix = path.join(destination, "impel-prefix");
+  execFileSync("npm", ["install", "--global", "--prefix", prefix, tarball], { stdio: "inherit" });
+  const executable = process.platform === "win32" ? path.join(prefix, "impel.cmd") : path.join(prefix, "bin", "impel");
+  const actual = execFileSync(executable, ["--version"], { encoding: "utf8" }).trim();
+  if (actual !== version) throw new Error(`packed CLI reports ${actual}, expected ${version}`);
+  console.log(`Verified packed impel-cli ${version}.`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`pack-release: ${error?.message || error}`);
+  process.exit(1);
+}

package/scripts/release-gate.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { compareSemver } from "./canary-version.mjs";
+import { evaluateCheckRuns } from "./required-checks.mjs";
+
+const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
+
+function appendSummary(text) {
+  if (!process.env.GITHUB_STEP_SUMMARY) throw new Error("GITHUB_STEP_SUMMARY is not set");
+  fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, text.endsWith("\n") ? text : `${text}\n`);
+}
+
+async function fetchJson(url, { token, allowMissing = false } = {}) {
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      "User-Agent": "UseImpel/impel-cli release gate",
+      "X-GitHub-Api-Version": "2022-11-28",
+    },
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (response.status === 404 && allowMissing) return {};
+  if (!response.ok) throw new Error(`request failed: HTTP ${response.status}`);
+  return response.json();
+}
+
+async function checkRunsForCommit(repository, sha, token) {
+  const runs = [];
+  for (let page = 1; ; page += 1) {
+    const body = await fetchJson(
+      `https://api.github.com/repos/${repository}/commits/${sha}/check-runs?per_page=100&page=${page}`,
+      { token },
+    );
+    runs.push(...body.check_runs.map(({ name, status, conclusion }) => ({ name, status, conclusion })));
+    if (body.check_runs.length < 100) return runs;
+  }
+}
+
+function manifest() {
+  return JSON.parse(fs.readFileSync("package.json", "utf8"));
+}
+
+export function verifyTag({ tag, version }) {
+  const expected = `v${version}`;
+  if (tag !== expected) throw new Error(`release tag ${tag} does not match ${expected}`);
+  return expected;
+}
+
+export function verifyMain({ sha, mainRef = "origin/main" }) {
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", sha, mainRef], { stdio: "ignore" });
+  } catch {
+    throw new Error(`tagged commit ${sha} is not on ${mainRef}; merge to main before tagging`);
+  }
+}
+
+export async function verifyChecks({ repository, sha, token }) {
+  const result = evaluateCheckRuns(await checkRunsForCommit(repository, sha, token));
+  const summary = result.summary;
+  appendSummary(summary);
+  if (result.state !== "success") {
+    throw new Error(`required checks on ${sha} are not all green: ${result.failures.join("; ") || result.pending.join(", ")}`);
+  }
+  return result;
+}
+
+export async function verifySuccessor({ version, channel = version.includes("-") ? "next" : "latest" }) {
+  const tags = await fetchJson(DIST_TAGS_URL, { allowMissing: true });
+  const current = tags[channel] ?? (channel === "next" ? tags.latest : undefined);
+  const message = current === undefined
+    ? `No existing \`${channel}\` dist-tag; ${version} is the channel bootstrap.`
+    : `${version} strictly succeeds \`${channel}\`=${current}. Current tags: ${JSON.stringify(tags)}`;
+  if (current !== undefined && compareSemver(version, current) <= 0) {
+    throw new Error(`version ${version} is not a strict semver successor of ${channel}=${current}`);
+  }
+  appendSummary(`## Release gate: dist-tag successor\n\n${message}\n`);
+  console.log(message);
+  return { channel, current, tags };
+}
+
+export function selectDistTag(version) {
+  const tag = version.includes("-") ? "next" : "latest";
+  if (!process.env.GITHUB_ENV) throw new Error("GITHUB_ENV is not set");
+  fs.appendFileSync(process.env.GITHUB_ENV, `NPM_DIST_TAG=${tag}\n`);
+  console.log(`Publishing ${version} under npm dist-tag ${tag}.`);
+  return tag;
+}
+
+async function main([command]) {
+  const pkg = manifest();
+  if (command === "verify-tag") {
+    verifyTag({ tag: process.env.RELEASE_TAG, version: pkg.version });
+    return;
+  }
+  if (command === "verify-main") {
+    const sha = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+    verifyMain({ sha });
+    console.log(`Tagged commit ${sha} is on origin/main.`);
+    return;
+  }
+  if (command === "verify-checks") {
+    const sha = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+    await verifyChecks({
+      repository: process.env.GITHUB_REPOSITORY,
+      sha,
+      token: process.env.GH_TOKEN,
+    });
+    console.log(`All required checks are green on ${sha}.`);
+    return;
+  }
+  if (command === "verify-successor") {
+    await verifySuccessor({ version: pkg.version });
+    return;
+  }
+  if (command === "select-dist-tag") {
+    selectDistTag(pkg.version);
+    return;
+  }
+  throw new Error("usage: node scripts/release-gate.mjs verify-tag|verify-main|verify-checks|verify-successor|select-dist-tag");
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2)).catch((error) => {
+    console.error(`release-gate: ${error?.message || error}`);
+    process.exit(1);
+  });
+}

package/scripts/release-metadata.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import { execFileSync } from "node:child_process";
+
+function main() {
+  if (!process.env.GITHUB_OUTPUT) throw new Error("GITHUB_OUTPUT is not set");
+  const { version } = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const sourceCommit = execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+  fs.appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\nsource_commit=${sourceCommit}\n`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`release-metadata: ${error?.message || error}`);
+  process.exit(1);
+}

package/scripts/required-checks.mjs

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 // The CI check names a publishable commit must carry (canary release cycle, U4).
 //
-// `publish-npm.yml`'s release gate inlines this list and must stay
-// byte-identical (R19), so the canary publisher reads it from here and
-// `test/publish-canary-workflow.test.js` asserts the two copies are equal:
-// a renamed CI job that is not renamed in both places fails the suite, not a
-// release. Every push to `dev` and `main` runs these via `ci.yml`, so they
-// must exist on a publishable SHA; names must match the job names exactly.
+// Both release workflows consume this list through checked-in gate scripts.
+// A renamed CI job that is not renamed here fails the suite, not a release.
+// Every push to `dev` and `main` runs these via `ci.yml`, so they must exist on
+// a publishable SHA; names must match the job names exactly.
 //
 // Usage:
 //   node scripts/required-checks.mjs <check-runs.ndjson>
@@ -81,7 +79,7 @@ export function evaluateCheckRuns(runs, { required = REQUIRED_CHECKS, conditiona
   }
 
   const state = failures.length > 0 ? "failure" : pending.length > 0 ? "pending" : "success";
-  const summary = ["## Canary gate: checks on the pushed commit", ""];
+  const summary = ["## Release gate: checks on the commit", ""];
   summary.push("| Check | Result |", "| --- | --- |");
   for (const name of [...required, ...conditional]) summary.push(`| ${name} | ${describe(name)} |`);
   if (absentConditional.length > 0) {

package/scripts/notify-canary.mjs

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const TARGET = "https://api.github.com/repos/UseImpel/impel-apps/dispatches";
-
-async function main([version]) {
-  const token = process.env.IMPEL_APPS_DISPATCH_TOKEN;
-  const commit = process.env.GITHUB_SHA;
-  if (!version || !commit) throw new Error("canary version and GITHUB_SHA are required");
-  if (!token) {
-    const message = `IMPEL_APPS_DISPATCH_TOKEN is not configured; impel-apps will pick up impel-cli@${version} on its next canary rebuild.`;
-    console.warn(message);
-    if (process.env.GITHUB_STEP_SUMMARY) {
-      fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${message}\n`);
-    }
-    return;
-  }
-  const response = await fetch(TARGET, {
-    method: "POST",
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      "User-Agent": "UseImpel/impel-cli canary publisher",
-      "X-GitHub-Api-Version": "2022-11-28",
-    },
-    body: JSON.stringify({
-      event_type: "impel-cli-canary",
-      client_payload: { version, source_commit: commit, dist_tag: "canary" },
-    }),
-    signal: AbortSignal.timeout(30_000),
-  });
-  if (!response.ok) throw new Error(`impel-apps dispatch failed: HTTP ${response.status}`);
-  console.log(`Dispatched impel-cli canary ${version} (${commit}) to UseImpel/impel-apps.`);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main(process.argv.slice(2)).catch((error) => {
-    console.error(`notify-canary: ${error?.message || error}`);
-    process.exit(1);
-  });
-}

package/scripts/wait-for-required-checks.mjs

@@ -1,76 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { evaluateCheckRuns } from "./required-checks.mjs";
-
-const POLL_INTERVAL_MS = 30_000;
-const TIMEOUT_MS = 60 * 60 * 1_000;
-
-const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
-
-async function fetchCheckRuns(repository, sha, token) {
-  const runs = [];
-  for (let page = 1; ; page += 1) {
-    const response = await fetch(
-      `https://api.github.com/repos/${repository}/commits/${sha}/check-runs?per_page=100&page=${page}`,
-      {
-        headers: {
-          Accept: "application/vnd.github+json",
-          Authorization: `Bearer ${token}`,
-          "User-Agent": "UseImpel/impel-cli canary publisher",
-          "X-GitHub-Api-Version": "2022-11-28",
-        },
-        signal: AbortSignal.timeout(30_000),
-      },
-    );
-    if (!response.ok) throw new Error(`Checks API request failed: HTTP ${response.status}`);
-    const body = await response.json();
-    for (const { name, status, conclusion } of body.check_runs) {
-      runs.push({ name, status, conclusion });
-    }
-    if (body.check_runs.length < 100) return runs;
-  }
-}
-
-function writeSummary(summary) {
-  if (!process.env.GITHUB_STEP_SUMMARY) throw new Error("GITHUB_STEP_SUMMARY is not set");
-  fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary);
-}
-
-async function main() {
-  const { GITHUB_REPOSITORY: repository, GITHUB_SHA: sha, GH_TOKEN: token } = process.env;
-  if (!repository || !sha || !token) throw new Error("GITHUB_REPOSITORY, GITHUB_SHA, and GH_TOKEN are required");
-  const deadline = Date.now() + TIMEOUT_MS;
-  let lastSummary = "";
-  while (Date.now() < deadline) {
-    try {
-      const result = evaluateCheckRuns(await fetchCheckRuns(repository, sha, token));
-      lastSummary = result.summary;
-      if (result.state === "success") {
-        writeSummary(result.summary);
-        console.log(`All required checks are green on ${sha}.`);
-        return;
-      }
-      if (result.state === "failure") {
-        writeSummary(result.summary);
-        throw new Error(`A required check on ${sha} completed without success; nothing is published for this commit.`);
-      }
-      console.log(`Required checks are still pending on ${sha}; retrying in 30 seconds.`);
-    } catch (error) {
-      if (/completed without success/u.test(error?.message || "")) throw error;
-      console.warn(`Checks API request failed (${error?.message || error}); retrying in 30 seconds.`);
-    }
-    await delay(POLL_INTERVAL_MS);
-  }
-  if (lastSummary) writeSummary(lastSummary);
-  throw new Error(`Canary gate timed out after 60 minutes waiting for required checks on ${sha}.`);
-}
-
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  main().catch((error) => {
-    console.error(`wait-for-required-checks: ${error?.message || error}`);
-    process.exit(1);
-  });
-}