package-registry-manager 0.22.4 → 0.22.6

package/src/credential-setup.mjs

@@ -0,0 +1,210 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { verifyCredentialWorkflow } from "./credential-verification.mjs";
+import { needsRotation, rotateCredential } from "./credential-cycle.mjs";
+import {
+  TOKEN_PROVIDERS,
+  tokenFormScript,
+  READ_TOKEN,
+  revokedScript,
+} from "./credential-browser.mjs";
+
+/** Exact argv and stdin transport. Suppress all output from secret mutations. */
+export function secretCommand(args, input, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("gh-manager", args, {
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    let output = "";
+    child.stdout.on("data", (chunk) => {
+      if (input === undefined) {
+        output += chunk;
+      }
+    });
+    child.stderr.on("data", () => {});
+    child.on("error", () =>
+      reject(
+        new Error(
+          "gh-manager with secret get-metadata/ensure support is required (gh-manager#6)",
+        ),
+      ),
+    );
+    child.stdin.on("error", () => {});
+    child.on("close", (code) =>
+      code === 0
+        ? resolve(output)
+        : reject(
+            new Error(
+              "gh-manager secret operation failed; verify installation, permissions and secret support (gh-manager#6)",
+            ),
+          ),
+    );
+    child.stdin.end(input ?? "");
+  });
+}
+
+/** Execute the token lifecycle without putting values in argv, diagnostics or files. */
+export async function setupCredential(session) {
+  const { plan, options } = session;
+  const provider = TOKEN_PROVIDERS[plan.registry];
+  if (!provider) {
+    throw new Error(`no token provider for ${plan.registry}`);
+  }
+  const contents = await readFile(
+    path.join(options.repository, ".package-registry-manager.json"),
+    "utf8",
+  ).catch((error) => {
+    if (error.code === "ENOENT") {
+      return "{}";
+    }
+    throw error;
+  });
+  const settings = JSON.parse(contents).tokens?.[plan.registry] ?? {};
+  if (!/^[\w.-]+\.ya?ml$/.test(settings.verification_workflow ?? "")) {
+    throw new Error(
+      "configure tokens.<registry>.verification_workflow for a reviewed dry-run login workflow before creating credentials",
+    );
+  }
+  const { github_owner: owner, github_repository: repository } =
+    plan.repository;
+  if (!owner || !repository) {
+    throw new Error("token setup requires GitHub repository coordinates");
+  }
+  const secret =
+    settings.secret ?? plan.package.token_secrets?.[0] ?? provider.secret;
+  if (!/^[A-Z][A-Z0-9_]*$/.test(secret)) {
+    throw new Error("invalid registry secret name");
+  }
+  if (settings.level && !["repo", "org"].includes(settings.level)) {
+    throw new Error("token secret level must be repo or org");
+  }
+  const scope =
+    settings.level === "repo"
+      ? ["--repo", `${owner}/${repository}`]
+      : ["--org", owner];
+  const visibility =
+    settings.level === "repo"
+      ? []
+      : ["--visibility", "selected", "--repos", `${owner}/${repository}`];
+  const workflow = await readFile(
+    path.join(
+      options.repository,
+      ".github/workflows",
+      settings.verification_workflow,
+    ),
+    "utf8",
+  );
+  if (
+    !workflow.includes("workflow_dispatch") ||
+    !workflow.includes("inputs.prm_nonce") ||
+    !workflow.includes("run-name:")
+  ) {
+    throw new Error(
+      "verification workflow requires workflow_dispatch input prm_nonce and run-name containing inputs.prm_nonce",
+    );
+  }
+  const days = settings.expiry_days ?? 30;
+  if (!Number.isInteger(days) || days < 1 || days > 90) {
+    throw new Error("token expiry_days must be between 1 and 90");
+  }
+  if (options.noBrowser) {
+    throw new Error(
+      "registry token creation requires the dedicated automated browser",
+    );
+  }
+  if (
+    options.browserOptions?.attach ||
+    options.browserOptions?.importScope === "full"
+  ) {
+    throw new Error(
+      "token setup requires a dedicated profile with domain-scoped sign-in import",
+    );
+  }
+  const run = options.secretCommand ?? secretCommand;
+  const previous = JSON.parse(
+    await run(
+      ["secret", "get-metadata", secret, ...scope, "--json"],
+      undefined,
+      options.repository,
+    ),
+  );
+  const verify = () =>
+    verifyCredentialWorkflow(session, settings.verification_workflow);
+  if (!needsRotation(previous)) {
+    try {
+      await verify();
+      return;
+    } catch {
+      previous.valid = false;
+    }
+  }
+  if (
+    !options.yes &&
+    !/^y(?:es)?$/i.test(
+      await session.prompt(
+        "Create and store a scoped credential, verify it, then revoke the replaced token? [y/N] ",
+      ),
+    )
+  ) {
+    throw new Error("credential creation declined");
+  }
+  if (session.automation) {
+    await session.automation.close();
+  }
+  session.automation = null;
+  const page = await session.automatedPage(
+    { ...options.browserOptions, importScope: "domains" },
+    true,
+  );
+  const expiry = new Date(Date.now() + days * 86_400_000).toISOString();
+  await rotateCredential(previous, {
+    create: async () => {
+      await page.goto(provider.url);
+      await session.prompt(
+        `Sign in, then press Enter to fill the narrow publishing scope (${provider.scope})...`,
+      );
+      await page.evaluate(
+        tokenFormScript(provider, `prm-${repository}`, expiry),
+      );
+      await session.prompt(
+        `Review the scope and expiry, create the token in this browser, then press Enter (never paste its value)...`,
+      );
+      const credential = await page.evaluate(READ_TOKEN);
+      if (!credential.expires_at) {
+        throw new Error(
+          "registry did not provide a verifiable expiry; no secret was stored",
+        );
+      }
+      return credential;
+    },
+    store: (credential) =>
+      run(
+        [
+          "secret",
+          "ensure",
+          secret,
+          ...scope,
+          ...visibility,
+          "--expires-at",
+          credential.expires_at,
+          "--token-id",
+          credential.id,
+          "--registry",
+          plan.registry,
+        ],
+        credential.value,
+        options.repository,
+      ),
+    verify,
+    revoke: async (id) => {
+      await page.goto(provider.url.replace(/\/create$/, ""));
+      await session.prompt(
+        `Revoke registry token ${id} in this browser, then press Enter...`,
+      );
+    },
+    revoked: async (id) => page.evaluate(revokedScript(id)),
+  });
+  console.log("  Credential verified; replaced token revocation verified.");
+}

package/src/credential-verification.mjs

@@ -0,0 +1,96 @@
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+
+/** Correlate dispatch by a unique run-name input, never by the latest unrelated run. */
+export async function verifyCredentialWorkflow(session, workflow) {
+  const { github_owner: owner, github_repository: repository } =
+    session.plan.repository;
+  const repo = `${owner}/${repository}`;
+  const capture = async (args) => {
+    const result = await session.capture({
+      id: "verify-registry-login",
+      command: { program: "gh", args },
+      cwd: ".",
+    });
+    if (result.code !== 0) {
+      throw new Error(
+        "credential verification command failed; old token remains active",
+      );
+    }
+    return String(result.stdout);
+  };
+  const metadata = JSON.parse(
+    await capture(["repo", "view", repo, "--json", "defaultBranchRef"]),
+  );
+  const ref = metadata.defaultBranchRef?.name;
+  if (!ref) {
+    throw new Error("cannot determine verification workflow branch");
+  }
+  const nonce = session.options.verificationNonce ?? randomUUID();
+  await capture([
+    "workflow",
+    "run",
+    workflow,
+    "--repo",
+    repo,
+    "--ref",
+    ref,
+    "-f",
+    `prm_nonce=${nonce}`,
+  ]);
+  const deadline =
+    Date.now() + (session.options.verificationTimeoutMs ?? 300_000);
+  let runId;
+  while (Date.now() < deadline) {
+    if (!runId) {
+      const runs = JSON.parse(
+        await capture([
+          "run",
+          "list",
+          "--repo",
+          repo,
+          "--workflow",
+          workflow,
+          "--event",
+          "workflow_dispatch",
+          "--limit",
+          "50",
+          "--json",
+          "databaseId,displayTitle",
+        ]),
+      );
+      const matching = runs.filter((run) => run.displayTitle?.includes(nonce));
+      if (matching.length > 1) {
+        throw new Error(
+          "ambiguous credential verification runs; old token remains active",
+        );
+      }
+      runId = matching[0]?.databaseId;
+    }
+    if (runId) {
+      const run = JSON.parse(
+        await capture([
+          "run",
+          "view",
+          String(runId),
+          "--repo",
+          repo,
+          "--json",
+          "status,conclusion",
+        ]),
+      );
+      if (run.status === "completed") {
+        if (run.conclusion !== "success") {
+          throw new Error(
+            "registry rejected credential verification; old token remains active",
+          );
+        }
+        return;
+      }
+    }
+    await (session.options.verificationDelay ?? delay)(2000);
+  }
+  throw new Error(
+    "credential verification timed out; old token remains active",
+  );
+}

package/src/discovery.mjs

@@ -2,6 +2,7 @@ import { readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 
 import { CONTAINER_FILES, containerPackages } from "./containers.mjs";
+import { packageWorkflows, auditWrappers } from "./package-coverage.mjs";
 import { REGISTRIES } from "./model.mjs";
 import {
   TRUSTED_REGISTRIES,
@@ -39,6 +40,8 @@ const MANIFEST_NAMES = new Set([
   "build.gradle",
   "build.gradle.kts",
   "composer.json",
+  "jsr.json",
+  "deno.json",
 ]);
 
 /**
@@ -73,7 +76,9 @@ export async function inspectRepository(repository, options = {}) {
     const directory = testDirectory(manifest);
     return (
       directory === null ||
-      (publishable && referencedByWorkflow(workflows, manifest)) ||
+      (!["docs", "experiments", "case-studies"].includes(directory) &&
+        publishable &&
+        referencedByWorkflow(workflows, manifest)) ||
       skip(manifest, testDirectoryReason(directory))
     );
   };
@@ -103,14 +108,82 @@ export async function inspectRepository(repository, options = {}) {
   for (const registry of TRUSTED_REGISTRIES) {
     publishers.set(registry, await detectPublisher(root, workflows, registry));
   }
+  // Extension packages can publish to both marketplaces independently.
+  for (const item of [...parsed].filter(Boolean)) {
+    if (item.registry !== "npm") {
+      continue;
+    }
+    const data = JSON.parse(await readManifest(path.join(root, item.manifest)));
+    if (data.publisher && data.engines?.vscode) {
+      for (const registry of ["vscode-marketplace", "open-vsx"]) {
+        const publisher = await detectPublisher(root, workflows, registry);
+        if (publisher.workflow) {
+          publishers.set(registry, publisher);
+          parsed.push({
+            ...item,
+            registry,
+            name: `${data.publisher}.${item.name}`,
+          });
+        }
+      }
+    }
+  }
+  publishers.set(
+    "maven-central",
+    await detectPublisher(root, workflows, "maven-central"),
+  );
   const containerFiles = dockerfiles
     .map((item) => relativePath(root, item))
     .filter((item) => !ignored(item) && kept(item, true));
-  const packages = parsed
-    .filter(Boolean)
-    .filter((item) => kept(item.manifest, item.publishable))
-    .map((item) => withPublisher(item, workflows, publishers))
-    .concat(containerPackages(containerFiles, workflows, coordinates))
+  const counts = new Map();
+  for (const item of parsed.filter(Boolean)) {
+    if (!testDirectory(item.manifest)) {
+      counts.set(item.registry, (counts.get(item.registry) ?? 0) + 1);
+    }
+  }
+  const chrome = await detectPublisher(root, workflows, "chrome-web-store");
+  const chromePackages = chrome.workflow
+    ? [
+        withPublisher(
+          packageInfo(
+            "chrome-web-store",
+            coordinates.github_repository ?? "chrome-extension",
+            null,
+            `.github/workflows/${chrome.workflow}`,
+          ),
+          workflows,
+          new Map([["chrome-web-store", chrome]]),
+        ),
+      ]
+    : [];
+  const packages = (
+    await Promise.all(
+      parsed
+        .filter(Boolean)
+        .filter((item) => kept(item.manifest, item.publishable))
+        .map(async (item) => {
+          const scoped =
+            counts.get(item.registry) > 1 &&
+            TRUSTED_REGISTRIES.includes(item.registry)
+              ? new Map([
+                  [
+                    item.registry,
+                    await detectPublisher(
+                      root,
+                      packageWorkflows(workflows, item),
+                      item.registry,
+                    ),
+                  ],
+                ])
+              : publishers;
+          return withPublisher(item, workflows, scoped);
+        }),
+    )
+  )
+    .concat(
+      containerPackages(containerFiles, workflows, coordinates),
+      chromePackages,
+    )
     .sort((left, right) => {
       const registryOrder =
         REGISTRIES.indexOf(left.registry) - REGISTRIES.indexOf(right.registry);
@@ -122,6 +195,7 @@ export async function inspectRepository(repository, options = {}) {
       );
     });
 
+  await auditWrappers(root, packages);
   const inspection = {
     schema_version: 1,
     repository: {
@@ -178,6 +252,11 @@ function withPublisher(item, workflows, publishers) {
   const secrets = tokenSecrets(workflows, item.registry);
   const warnings = [
     ...publisher.warnings,
+    ...(!publisher.workflow && publisher.candidates.length === 0
+      ? [
+          `no workflow publishes ${item.name} to ${item.registry}; CI releases will not reach it`,
+        ]
+      : []),
     ...secrets.map((secret) => tokenSecretWarning(item.registry, secret)),
   ];
   if (warnings.length > 0) {
@@ -201,7 +280,7 @@ async function collectManifests(directory, manifests, dockerfiles) {
     } else if (
       entry.isFile() &&
       (MANIFEST_NAMES.has(entry.name) ||
-        /\.(?:csproj|fsproj|vbproj)$/.test(entry.name))
+        /\.(?:csproj|fsproj|vbproj|gemspec)$/.test(entry.name))
     ) {
       manifests.push(item);
     }
@@ -212,6 +291,13 @@ async function parseManifest(manifestPath, manifest) {
   const contents = await readManifest(manifestPath);
   const filename = path.basename(manifestPath);
   switch (filename) {
+    case "jsr.json":
+    case "deno.json": {
+      const value = JSON.parse(contents);
+      return value.name && value.version
+        ? packageInfo("jsr", value.name, value.version, manifest)
+        : null;
+    }
     case "package.json":
       return parseNpm(contents, manifest);
     case "Cargo.toml":
@@ -241,6 +327,15 @@ async function parseManifest(manifestPath, manifest) {
     case "composer.json":
       return parseComposer(contents, manifest);
     default:
+      if (filename.endsWith(".gemspec")) {
+        return packageInfo(
+          "rubygems",
+          capture(contents, /\.name\s*=\s*['"]([^'"]+)/) ??
+            "unknown-ruby-package",
+          capture(contents, /\.version\s*=\s*['"]([^'"]+)/),
+          manifest,
+        );
+      }
       if (/\.(?:csproj|fsproj|vbproj)$/.test(filename)) {
         return parseDotnet(contents, manifestPath, manifest);
       }
@@ -291,7 +386,17 @@ function parsePyproject(contents, manifest) {
   if (!name) {
     return null;
   }
-  return packageInfo("pypi", name, tomlString(section, "version"), manifest);
+  const item = packageInfo(
+    "pypi",
+    name,
+    tomlString(section, "version"),
+    manifest,
+  );
+  const required = tomlString(section, "requires-python");
+  if (required) {
+    item.requires_python = required;
+  }
+  return item;
 }
 
 function parseDotnet(contents, manifestPath, manifest) {

package/src/extra-flows.mjs

@@ -0,0 +1,88 @@
+import { credentialSteps } from "./credential-cycle.mjs";
+import { tokenSecretSteps } from "./tokens.mjs";
+
+/** Additional OIDC registries never fall back to a stored publishing token. */
+export function trustedFlow(item, context) {
+  const specs = {
+    rubygems: [
+      "gem",
+      ["build", item.manifest.split("/").at(-1)],
+      "https://rubygems.org/profile/oidc/pending_trusted_publishers",
+      "Register the GitHub Actions identity as a pending publisher, or add it in the existing gem settings.",
+    ],
+    nuget: [
+      "dotnet",
+      ["pack", "--configuration", "Release"],
+      "https://www.nuget.org/account/TrustedPublishing",
+      "Register a trusted publishing policy for this GitHub Actions identity. Use NuGet/login to exchange OIDC for a short-lived API key; never store that key.",
+    ],
+    jsr: [
+      "deno",
+      ["publish", "--dry-run"],
+      `https://jsr.io/${item.name}/settings`,
+      "Link this package to the GitHub repository; publish from the configured workflow through OIDC.",
+    ],
+  };
+  const [program, args, url, description] = specs[item.registry];
+  const steps = [
+    {
+      id: "validate-package",
+      title: `Validate ${item.registry} package`,
+      kind: "check",
+      description: "Build or validate locally without uploading.",
+      command: { program, args },
+    },
+    {
+      id: "configure-trusted-publisher",
+      title: `Configure ${item.registry} trusted publishing`,
+      kind: "browser",
+      description,
+      url,
+    },
+    {
+      id: "verify-oidc-release",
+      title: "Verify an OIDC release before removing tokens",
+      kind: "manual",
+      description: `Run ${context.workflow} and verify registry acceptance through OIDC; remove secret references from every workflow before deleting unused credentials.`,
+    },
+  ];
+  if (context.slug) {
+    steps.push(...tokenSecretSteps(item, context.slug));
+  }
+  return steps;
+}
+
+export function tokenFlow(item) {
+  const checks = {
+    "maven-central": { program: "mvn", args: ["--batch-mode", "verify"] },
+    "vscode-marketplace": {
+      program: "npx",
+      args: ["--no-install", "vsce", "package"],
+    },
+    "open-vsx": { program: "npx", args: ["--no-install", "vsce", "package"] },
+  };
+  const steps = checks[item.registry]
+    ? [
+        {
+          id: "validate-package",
+          title: "Validate package before credential changes",
+          kind: "check",
+          description: "Build without publishing.",
+          command: checks[item.registry],
+        },
+      ]
+    : [];
+  if (item.registry === "maven-central") {
+    steps.push({
+      id: "verify-namespace",
+      title: "Verify a Central namespace",
+      kind: "browser",
+      description:
+        "Sign in to the Central Portal and verify the namespace used by the package coordinates.",
+      url: "https://central.sonatype.com/publishing/namespaces",
+    });
+  }
+  return steps.concat(
+    credentialSteps(item.registry, item.token_secrets?.[0] ?? item.registry),
+  );
+}

package/src/flows.mjs

@@ -1,3 +1,4 @@
+import { credentialSteps } from "./credential-cycle.mjs";
 import { DEFAULT_TRUST_NPM, NPM_TFA_URL } from "./prerequisites.mjs";
 import {
   npmName,
@@ -255,6 +256,13 @@ export function npmFlow(packageInfo, context) {
       },
     ),
     checkRegistryStep("npm", registryStateUrl(packageInfo)),
+    step(
+      "check-name-policy",
+      "Check npm name availability and policy",
+      "check",
+      "Check exact and punctuation variants before approval. Server-side blocks can still refuse publication.",
+      { when: "package-missing" },
+    ),
     step(
       "check-sign-in",
       "Check the npm session",
@@ -308,6 +316,25 @@ export function npmFlow(packageInfo, context) {
       "Compare the bin entries of the packed package.json with package.json and check that each installed bin prints its version for --version.",
       { when: "package-missing" },
     ),
+    step(
+      "publish-dry-run",
+      "Validate first publication without upload",
+      "check",
+      "Validate the reviewed tarball before asking for publication approval.",
+      {
+        command: command("npm", [
+          "publish",
+          "{tarball}",
+          "--dry-run",
+          "--ignore-scripts",
+          "--access",
+          "public",
+          "--provenance=false",
+        ]),
+        when: "package-missing",
+        cwd: packageCwd(context.directory),
+      },
+    ),
     // Sign in right before publishing, so the sign-in, publish, and trust
     // approvals happen together and npm can skip repeated 2FA prompts.
     step(
@@ -416,7 +443,6 @@ export function npmFlow(packageInfo, context) {
         "Confirm that npm lists the GitHub Actions trusted publisher.",
         { command: trustList, when: "trust-missing" },
       ),
-      ...tokenSecretSteps(packageInfo, context.slug),
       step(
         "rerun-release",
         "Re-run the failed release jobs",
@@ -439,6 +465,7 @@ export function npmFlow(packageInfo, context) {
     if (context.verifyRelease) {
       steps.push(...verifyReleaseSteps(context, registryStateUrl(packageInfo)));
     }
+    steps.push(...tokenSecretSteps(packageInfo, context.slug));
   }
   steps.push(
     step(
@@ -707,13 +734,6 @@ export function dockerHubFlow(packageInfo, context) {
         when: "package-missing",
       },
     ),
-    step(
-      "create-access-token",
-      "Create a Read & Write access token",
-      "browser",
-      `Create a token with Read & Write access and a short expiry. Personal access tokens cannot be limited to one repository; an organization access token can be restricted to ${packageInfo.name}. Keep the token only for the next step.`,
-      { url: "https://app.docker.com/settings/personal-access-tokens/create" },
-    ),
     step(
       "check-github-cli",
       "Check the GitHub CLI session",
@@ -755,17 +775,7 @@ export function dockerHubFlow(packageInfo, context) {
         cwd: ".",
       },
     ),
-    step(
-      "set-token-secret",
-      "Set DOCKERHUB_TOKEN",
-      "command",
-      "gh reads the token from the terminal without echoing it; the tool never sees it.",
-      {
-        command: command("gh", ["secret", "set", "DOCKERHUB_TOKEN", ...repo]),
-        cwd: ".",
-        confirm: true,
-      },
-    ),
+    ...credentialSteps("docker-hub", "DOCKERHUB_TOKEN"),
   ];
 }
 

package/src/index.mjs

@@ -3,4 +3,4 @@ export { inspectRepository } from "./discovery.mjs";
 export { REGISTRIES, parseRegistry } from "./model.mjs";
 export { buildPlans, packageDirectory } from "./plan.mjs";
 export { ensureProfileIgnored } from "./profile.mjs";
-export { defaultBrowserProfile, executePlan } from "./setup.mjs";
+export { defaultBrowserProfile, executePlan, executePlans } from "./setup.mjs";