package-registry-manager 0.21.0

package/src/skips.mjs

@@ -0,0 +1,117 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** The optional per-repository settings file read during inspection. */
+export const CONFIG_FILE = ".package-registry-manager.json";
+
+/** Directories that hold tests and examples rather than released packages. */
+export const TEST_DIRECTORIES = Object.freeze([
+  "tests",
+  "test",
+  "fixtures",
+  "__fixtures__",
+  "__tests__",
+  "examples",
+]);
+
+/**
+ * Reads the ignore list from `.package-registry-manager.json`, whose
+ * `ignore` array holds glob patterns (`*`, `**`, `?`) relative to the root.
+ */
+export async function readIgnoreList(root) {
+  let contents;
+  try {
+    contents = await readFile(path.join(root, CONFIG_FILE), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  let config;
+  try {
+    config = JSON.parse(contents);
+  } catch (error) {
+    throw new Error(`invalid JSON in ${CONFIG_FILE}: ${error.message}`, {
+      cause: error,
+    });
+  }
+  const ignore = config?.ignore ?? [];
+  if (
+    !Array.isArray(ignore) ||
+    !ignore.every((item) => typeof item === "string")
+  ) {
+    throw new Error(`${CONFIG_FILE}: "ignore" must be an array of strings`);
+  }
+  return ignore;
+}
+
+/** Returns the first ignore pattern that matches a path or one of its parents. */
+export function ignoredBy(ignore, manifest) {
+  const segments = manifest.split("/");
+  const prefixes = segments.map((_, index) =>
+    segments.slice(0, index + 1).join("/"),
+  );
+  return (
+    ignore.find((pattern) => {
+      const expression = globExpression(pattern);
+      return prefixes.some((prefix) => expression.test(prefix));
+    }) ?? null
+  );
+}
+
+/** Returns the test or example directory that holds a path, if any. */
+export function testDirectory(manifest) {
+  return (
+    manifest
+      .split("/")
+      .slice(0, -1)
+      .find((segment) => TEST_DIRECTORIES.includes(segment)) ?? null
+  );
+}
+
+/** Reports whether any workflow mentions the directory that holds a file. */
+export function referencedByWorkflow(workflows, manifest) {
+  const directory = path.posix.dirname(manifest);
+  return workflows.some((workflow) =>
+    workflow.contents
+      .split(/\r?\n/)
+      .some((line) => !/^\s*#/.test(line) && line.includes(directory)),
+  );
+}
+
+/** Explains why a manifest in a test or example directory was skipped. */
+export function testDirectoryReason(directory) {
+  return `under ${directory}/, a test or example directory, and no workflow publishes it`;
+}
+
+/** Explains why a manifest matched by the ignore list was skipped. */
+export function ignoreReason(pattern) {
+  return `ignored by "${pattern}" in ${CONFIG_FILE}`;
+}
+
+function globExpression(pattern) {
+  const normalized = pattern
+    .trim()
+    .replace(/^\.?\/+/, "")
+    .replace(/\/+$/, "");
+  let source = "";
+  for (let index = 0; index < normalized.length; index += 1) {
+    const character = normalized[index];
+    if (character === "*" && normalized[index + 1] === "*") {
+      source += ".*";
+      index += 1;
+      if (normalized[index + 1] === "/") {
+        source = `${source.slice(0, -2)}(?:.*/)?`;
+        index += 1;
+      }
+    } else if (character === "*") {
+      source += "[^/]*";
+    } else if (character === "?") {
+      source += "[^/]";
+    } else {
+      source += character.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${source}$`);
+}

package/src/tokens.mjs

@@ -0,0 +1,215 @@
+// Long-lived registry tokens: the repository secrets that trusted publishing
+// replaces, and the one-time crates.io first-publish token, whose revocation
+// is verified against the crates.io API before setup ends.
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import { registryTokenSecrets } from "./publishers.mjs";
+import { registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+
+/** Where the crates.io first-publish token is revoked. */
+export const CRATES_TOKENS_URL = "https://crates.io/settings/tokens";
+
+/**
+ * Steps that list the repository's secrets and delete the long-lived
+ * registry tokens trusted publishing makes unnecessary, one confirmation each.
+ */
+export function tokenSecretSteps(packageInfo, slug) {
+  const names = registryTokenSecrets(packageInfo.registry);
+  return [
+    {
+      id: "audit-token-secrets",
+      title: "Look for leftover long-lived token secrets",
+      kind: "check",
+      description: `Trusted publishing makes long-lived tokens such as ${names.join(", ")} unnecessary. Organization secrets are not listed here; an organization owner removes them with gh secret delete --org.`,
+      command: {
+        program: "gh",
+        args: ["secret", "list", "--repo", slug, "--json", "name"],
+      },
+      cwd: ".",
+    },
+    {
+      id: "delete-token-secret",
+      title: "Delete the leftover token secrets",
+      kind: "command",
+      description:
+        "Remove each long-lived token secret that no workflow reads any more.",
+      command: {
+        program: "gh",
+        args: ["secret", "delete", "{token_secret}", "--repo", slug],
+      },
+      when: "token-secret-present",
+      cwd: ".",
+      confirm: true,
+    },
+  ];
+}
+
+/**
+ * Splits the registry token secrets in `gh secret list --json name` output
+ * into the ones a workflow still reads, which must be replaced by trusted
+ * publishing first, and leftovers that can be deleted.
+ */
+export function auditRegistryTokens(output, packageInfo) {
+  const listed = new Set(
+    JSON.parse(String(output || "[]")).map((item) => item.name),
+  );
+  const present = registryTokenSecrets(packageInfo.registry).filter((name) =>
+    listed.has(name),
+  );
+  const read = new Set(packageInfo.token_secrets ?? []);
+  return {
+    inUse: present.filter((name) => read.has(name)),
+    leftover: present.filter((name) => !read.has(name)),
+  };
+}
+
+/**
+ * Prints which registry token secrets remain and returns the leftovers, the
+ * ones no workflow reads any more and that can be deleted.
+ */
+export function reportTokenSecrets(output, packageInfo) {
+  const { inUse, leftover } = auditRegistryTokens(output, packageInfo);
+  for (const name of inUse) {
+    console.log(
+      `  ${name} is still read by a workflow; switch that workflow to trusted publishing before deleting it.`,
+    );
+  }
+  for (const name of leftover) {
+    console.log(`  ${name} is no longer needed with trusted publishing.`);
+  }
+  return leftover;
+}
+
+/** Returns cargo's home directory, as cargo resolves it. */
+export function cargoHome(env = process.env, home = os.homedir()) {
+  return env.CARGO_HOME || path.join(home, ".cargo");
+}
+
+/**
+ * Reads the crates.io token `cargo login` stored, or `undefined` when cargo
+ * keeps it elsewhere (a credential provider) or holds none.
+ */
+export async function readCargoToken(directory = cargoHome()) {
+  for (const name of ["credentials.toml", "credentials"]) {
+    const contents = await readFile(path.join(directory, name), "utf8").catch(
+      () => "",
+    );
+    const token = registryToken(contents);
+    if (token) {
+      return token;
+    }
+  }
+  return undefined;
+}
+
+/** Extracts `token` from the `[registry]` table of cargo's credentials. */
+export function registryToken(contents) {
+  let table = "";
+  for (const line of contents.split(/\r?\n/)) {
+    const header = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      table = header[1].trim();
+      continue;
+    }
+    const value = /^\s*token\s*=\s*(?:"([^"]*)"|'([^']*)')/.exec(line);
+    if (table === "registry" && value) {
+      return value[1] ?? value[2];
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Classifies the crates.io answer to a token on an endpoint only the website
+ * session may use: `revoked` when crates.io no longer knows the token,
+ * `active` when it still authenticates, `undefined` when unclear.
+ */
+export function tokenState(status, body) {
+  const detail = (body?.errors ?? [])
+    .map((error) => String(error?.detail ?? ""))
+    .join(" ");
+  if (
+    (status === 401 || status === 403) &&
+    /authentication failed|does not match the format/i.test(detail)
+  ) {
+    return "revoked";
+  }
+  if (
+    (status >= 200 && status < 300) ||
+    /only be performed on the crates\.io website/i.test(detail)
+  ) {
+    return "active";
+  }
+  return undefined;
+}
+
+/**
+ * Asks crates.io whether a token still authenticates. The token is sent only
+ * to the crates.io API and never printed.
+ */
+export async function checkCratesToken(base, token, options = {}) {
+  const fetcher = options.fetch ?? globalThis.fetch;
+  const url = `${base}/me/tokens`;
+  try {
+    const response = await fetcher(url, {
+      headers: {
+        accept: "application/json",
+        authorization: token,
+        "user-agent": USER_AGENT,
+      },
+      signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+    });
+    if (options.verbose) {
+      console.error(`GET ${url} -> ${response.status}`);
+    }
+    const body = await response.json().catch(() => undefined);
+    return tokenState(response.status, body);
+  } catch (error) {
+    if (options.verbose) {
+      console.error(`GET ${url} failed: ${error.message}`);
+    }
+    return undefined;
+  }
+}
+
+/**
+ * Confirms that crates.io rejects the first-publish token `cargo login`
+ * stored, asking the maintainer to revoke it and re-checking up to
+ * `attempts` times. `ask` waits for the maintainer.
+ */
+export async function verifyTokenRevoked(ask, options = {}) {
+  const token = await readCargoToken(cargoHome(options.env ?? process.env));
+  if (!token) {
+    console.error(
+      `warning: cargo holds no readable crates.io token, so its revocation cannot be verified; check ${CRATES_TOKENS_URL}`,
+    );
+    return;
+  }
+  const base = registryEndpoint("crates-io", options.env ?? process.env);
+  const attempts = options.attempts ?? 3;
+  for (let attempt = 1; ; attempt += 1) {
+    const state = await checkCratesToken(base, token, options);
+    if (state === "revoked") {
+      console.log(
+        "  crates.io rejects the first-publish token: it is revoked.",
+      );
+      return;
+    }
+    if (state === undefined) {
+      console.error(
+        `warning: crates.io gave no clear answer about the first-publish token; check that it is revoked at ${CRATES_TOKENS_URL}`,
+      );
+      return;
+    }
+    if (attempt >= attempts) {
+      throw new Error(
+        `the first-publish token still authenticates on crates.io; revoke it at ${CRATES_TOKENS_URL}`,
+      );
+    }
+    await ask(
+      `crates.io still accepts the first-publish token. Revoke it at ${CRATES_TOKENS_URL}, then press Enter...`,
+    );
+  }
+}

package/src/workflows.mjs

@@ -0,0 +1,46 @@
+import { readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+
+// Container registries; npm, crates.io, and PyPI use the job-aware detection
+// in publishers.mjs.
+const PUBLISH_PATTERNS = new Map([
+  ["docker-hub", /\bDOCKER_?HUB_|\bdocker\.io\/|hub\.docker\.com/i],
+  ["ghcr", /\bghcr\.io\b/],
+]);
+
+/** Reads GitHub Actions workflow files sorted by filename. */
+export async function readWorkflows(root) {
+  const directory = path.join(root, ".github/workflows");
+  let entries;
+  try {
+    entries = await readdir(directory, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const names = entries
+    .filter((entry) => entry.isFile() && /\.ya?ml$/.test(entry.name))
+    .map((entry) => entry.name)
+    .sort((left, right) => left.localeCompare(right));
+  return Promise.all(
+    names.map(async (name) => ({
+      name,
+      contents: await readFile(path.join(directory, name), "utf8"),
+    })),
+  );
+}
+
+/** Returns the first workflow that publishes to the registry, if any. */
+export function publishingWorkflow(workflows, registry) {
+  const pattern = PUBLISH_PATTERNS.get(registry);
+  return pattern
+    ? (workflows.find((workflow) => pattern.test(workflow.contents)) ?? null)
+    : null;
+}
+
+/** Reports whether a workflow grants `packages: write` to its token. */
+export function grantsPackagesWrite(contents) {
+  return (
+    /^\s*packages\s*:\s*['"]?write\b/m.test(contents) ||
+    /^\s*permissions\s*:\s*['"]?write-all\b/m.test(contents)
+  );
+}