lockfile-hasher 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Wei Wang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# lockfile-hasher
+
+Generates a combined hash of all the lockfiles in a repo. Supports `package-lock.json`, `pnpm-lock.yaml`, and `yarn.lock` files.
+
+This can be used as a cache key for CI/CD pipelines in repositories that have multiple lock files.
+
+## Installation
+
+```
+npm install lockfile-hasher
+```
+
+## Usage
+
+```js
+import { generateCombinedLockFileHash } from 'lockfile-hasher';
+
+const combinedHash = generateCombinedLockfileHash(pathToRepositoryRoot);
+```

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+type LockFileName = 'package-lock.json' | 'pnpm-lock.yaml' | 'yarn.lock';
+/**
+ * Generate a combined hash of all lock files in a repo.
+ * @param {string} rootPath - Root path of the repository
+ * @param {LockFileName} lockFileName - Name of the lock file to search for.
+ *     Currently supports 'package-lock.json', 'pnpm-lock.yaml', and 'yarn.lock'
+ * @returns {Promise<string>} - Combined hash string
+ */
+export declare function generateCombinedLockFileHash(rootPath: string, lockFileName: LockFileName): Promise<string>;
+export {};

package/dist/index.js

@@ -0,0 +1,34 @@
+// hash-package-locks.js
+import crypto from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+/**
+ * Generate a combined hash of all lock files in a repo.
+ * @param {string} rootPath - Root path of the repository
+ * @param {LockFileName} lockFileName - Name of the lock file to search for.
+ *     Currently supports 'package-lock.json', 'pnpm-lock.yaml', and 'yarn.lock'
+ * @returns {Promise<string>} - Combined hash string
+ */
+export async function generateCombinedLockFileHash(rootPath, lockFileName) {
+    const pattern = path.join(rootPath, `**/${lockFileName}`);
+    const files = await glob(pattern, { ignore: '**/node_modules/**' });
+    const fileContents = await Promise.all(files.map((file) => readFile(file)));
+    // Generate hash for each file
+    const hashesMap = {};
+    files.forEach((file, i) => {
+        const relativePath = path.relative(rootPath, file);
+        const fileContent = fileContents[i];
+        const hash = crypto.createHash('sha256').update(fileContent).digest('hex');
+        hashesMap[relativePath] = hash;
+    });
+    // Sort the entries to ensure consistent hash
+    const sortedEntries = Object.entries(hashesMap).sort(([pathA], [pathB]) => {
+        return pathA.localeCompare(pathB);
+    });
+    // Create a string representation of all hashes
+    const combinedString = sortedEntries.map(([relPath, hash]) => `${relPath}:${hash}`).join('|');
+    // Generate a new hash from the combined string
+    return crypto.createHash('sha256').update(combinedString).digest('hex');
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAgB,EAChB,YAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,YAAY,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5E,8BAA8B;IAC9B,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,SAAS,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;QACxE,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,MAAM,cAAc,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE9F,+CAA+C;IAC/C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "lockfile-hasher",
+  "version": "1.0.0",
+  "description": "Generates a combined hash of all the lockfiles in a repository",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "packageManager": "pnpm@10.6.2",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "check-format": "biome check .",
+    "ci": "pnpm run test && pnpm run check-format",
+    "format": "biome check --write .",
+    "prepublishOnly": "pnpm run ci",
+    "test": "node --experimental-strip-types --test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/onlywei/lockfile-hasher.git"
+  },
+  "keywords": [
+    "gitlab"
+  ],
+  "author": "Wei Wang <wei@fastmail.com>",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/onlywei/lockfile-hasher/issues"
+  },
+  "homepage": "https://github.com/onlywei/lockfile-hasher#readme",
+  "devDependencies": {
+    "@biomejs/biome": "^1.9.4",
+    "@changesets/cli": "^2.28.0",
+    "@types/node": "^22.13.4",
+    "typescript": "^5.8.2"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@biomejs/biome"
+    ]
+  },
+  "dependencies": {
+    "glob": "^11.0.1"
+  }
+}