package-registry-manager 0.22.5 → 0.22.6

package/src/discovery.mjs

@@ -2,6 +2,7 @@ import { readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 
 import { CONTAINER_FILES, containerPackages } from "./containers.mjs";
+import { packageWorkflows, auditWrappers } from "./package-coverage.mjs";
 import { REGISTRIES } from "./model.mjs";
 import {
   TRUSTED_REGISTRIES,
@@ -39,6 +40,8 @@ const MANIFEST_NAMES = new Set([
   "build.gradle",
   "build.gradle.kts",
   "composer.json",
+  "jsr.json",
+  "deno.json",
 ]);
 
 /**
@@ -73,7 +76,9 @@ export async function inspectRepository(repository, options = {}) {
     const directory = testDirectory(manifest);
     return (
       directory === null ||
-      (publishable && referencedByWorkflow(workflows, manifest)) ||
+      (!["docs", "experiments", "case-studies"].includes(directory) &&
+        publishable &&
+        referencedByWorkflow(workflows, manifest)) ||
       skip(manifest, testDirectoryReason(directory))
     );
   };
@@ -103,14 +108,82 @@ export async function inspectRepository(repository, options = {}) {
   for (const registry of TRUSTED_REGISTRIES) {
     publishers.set(registry, await detectPublisher(root, workflows, registry));
   }
+  // Extension packages can publish to both marketplaces independently.
+  for (const item of [...parsed].filter(Boolean)) {
+    if (item.registry !== "npm") {
+      continue;
+    }
+    const data = JSON.parse(await readManifest(path.join(root, item.manifest)));
+    if (data.publisher && data.engines?.vscode) {
+      for (const registry of ["vscode-marketplace", "open-vsx"]) {
+        const publisher = await detectPublisher(root, workflows, registry);
+        if (publisher.workflow) {
+          publishers.set(registry, publisher);
+          parsed.push({
+            ...item,
+            registry,
+            name: `${data.publisher}.${item.name}`,
+          });
+        }
+      }
+    }
+  }
+  publishers.set(
+    "maven-central",
+    await detectPublisher(root, workflows, "maven-central"),
+  );
   const containerFiles = dockerfiles
     .map((item) => relativePath(root, item))
     .filter((item) => !ignored(item) && kept(item, true));
-  const packages = parsed
-    .filter(Boolean)
-    .filter((item) => kept(item.manifest, item.publishable))
-    .map((item) => withPublisher(item, workflows, publishers))
-    .concat(containerPackages(containerFiles, workflows, coordinates))
+  const counts = new Map();
+  for (const item of parsed.filter(Boolean)) {
+    if (!testDirectory(item.manifest)) {
+      counts.set(item.registry, (counts.get(item.registry) ?? 0) + 1);
+    }
+  }
+  const chrome = await detectPublisher(root, workflows, "chrome-web-store");
+  const chromePackages = chrome.workflow
+    ? [
+        withPublisher(
+          packageInfo(
+            "chrome-web-store",
+            coordinates.github_repository ?? "chrome-extension",
+            null,
+            `.github/workflows/${chrome.workflow}`,
+          ),
+          workflows,
+          new Map([["chrome-web-store", chrome]]),
+        ),
+      ]
+    : [];
+  const packages = (
+    await Promise.all(
+      parsed
+        .filter(Boolean)
+        .filter((item) => kept(item.manifest, item.publishable))
+        .map(async (item) => {
+          const scoped =
+            counts.get(item.registry) > 1 &&
+            TRUSTED_REGISTRIES.includes(item.registry)
+              ? new Map([
+                  [
+                    item.registry,
+                    await detectPublisher(
+                      root,
+                      packageWorkflows(workflows, item),
+                      item.registry,
+                    ),
+                  ],
+                ])
+              : publishers;
+          return withPublisher(item, workflows, scoped);
+        }),
+    )
+  )
+    .concat(
+      containerPackages(containerFiles, workflows, coordinates),
+      chromePackages,
+    )
     .sort((left, right) => {
       const registryOrder =
         REGISTRIES.indexOf(left.registry) - REGISTRIES.indexOf(right.registry);
@@ -122,6 +195,7 @@ export async function inspectRepository(repository, options = {}) {
       );
     });
 
+  await auditWrappers(root, packages);
   const inspection = {
     schema_version: 1,
     repository: {
@@ -206,7 +280,7 @@ async function collectManifests(directory, manifests, dockerfiles) {
     } else if (
       entry.isFile() &&
       (MANIFEST_NAMES.has(entry.name) ||
-        /\.(?:csproj|fsproj|vbproj)$/.test(entry.name))
+        /\.(?:csproj|fsproj|vbproj|gemspec)$/.test(entry.name))
     ) {
       manifests.push(item);
     }
@@ -217,6 +291,13 @@ async function parseManifest(manifestPath, manifest) {
   const contents = await readManifest(manifestPath);
   const filename = path.basename(manifestPath);
   switch (filename) {
+    case "jsr.json":
+    case "deno.json": {
+      const value = JSON.parse(contents);
+      return value.name && value.version
+        ? packageInfo("jsr", value.name, value.version, manifest)
+        : null;
+    }
     case "package.json":
       return parseNpm(contents, manifest);
     case "Cargo.toml":
@@ -246,6 +327,15 @@ async function parseManifest(manifestPath, manifest) {
     case "composer.json":
       return parseComposer(contents, manifest);
     default:
+      if (filename.endsWith(".gemspec")) {
+        return packageInfo(
+          "rubygems",
+          capture(contents, /\.name\s*=\s*['"]([^'"]+)/) ??
+            "unknown-ruby-package",
+          capture(contents, /\.version\s*=\s*['"]([^'"]+)/),
+          manifest,
+        );
+      }
       if (/\.(?:csproj|fsproj|vbproj)$/.test(filename)) {
         return parseDotnet(contents, manifestPath, manifest);
       }

package/src/extra-flows.mjs

@@ -0,0 +1,88 @@
+import { credentialSteps } from "./credential-cycle.mjs";
+import { tokenSecretSteps } from "./tokens.mjs";
+
+/** Additional OIDC registries never fall back to a stored publishing token. */
+export function trustedFlow(item, context) {
+  const specs = {
+    rubygems: [
+      "gem",
+      ["build", item.manifest.split("/").at(-1)],
+      "https://rubygems.org/profile/oidc/pending_trusted_publishers",
+      "Register the GitHub Actions identity as a pending publisher, or add it in the existing gem settings.",
+    ],
+    nuget: [
+      "dotnet",
+      ["pack", "--configuration", "Release"],
+      "https://www.nuget.org/account/TrustedPublishing",
+      "Register a trusted publishing policy for this GitHub Actions identity. Use NuGet/login to exchange OIDC for a short-lived API key; never store that key.",
+    ],
+    jsr: [
+      "deno",
+      ["publish", "--dry-run"],
+      `https://jsr.io/${item.name}/settings`,
+      "Link this package to the GitHub repository; publish from the configured workflow through OIDC.",
+    ],
+  };
+  const [program, args, url, description] = specs[item.registry];
+  const steps = [
+    {
+      id: "validate-package",
+      title: `Validate ${item.registry} package`,
+      kind: "check",
+      description: "Build or validate locally without uploading.",
+      command: { program, args },
+    },
+    {
+      id: "configure-trusted-publisher",
+      title: `Configure ${item.registry} trusted publishing`,
+      kind: "browser",
+      description,
+      url,
+    },
+    {
+      id: "verify-oidc-release",
+      title: "Verify an OIDC release before removing tokens",
+      kind: "manual",
+      description: `Run ${context.workflow} and verify registry acceptance through OIDC; remove secret references from every workflow before deleting unused credentials.`,
+    },
+  ];
+  if (context.slug) {
+    steps.push(...tokenSecretSteps(item, context.slug));
+  }
+  return steps;
+}
+
+export function tokenFlow(item) {
+  const checks = {
+    "maven-central": { program: "mvn", args: ["--batch-mode", "verify"] },
+    "vscode-marketplace": {
+      program: "npx",
+      args: ["--no-install", "vsce", "package"],
+    },
+    "open-vsx": { program: "npx", args: ["--no-install", "vsce", "package"] },
+  };
+  const steps = checks[item.registry]
+    ? [
+        {
+          id: "validate-package",
+          title: "Validate package before credential changes",
+          kind: "check",
+          description: "Build without publishing.",
+          command: checks[item.registry],
+        },
+      ]
+    : [];
+  if (item.registry === "maven-central") {
+    steps.push({
+      id: "verify-namespace",
+      title: "Verify a Central namespace",
+      kind: "browser",
+      description:
+        "Sign in to the Central Portal and verify the namespace used by the package coordinates.",
+      url: "https://central.sonatype.com/publishing/namespaces",
+    });
+  }
+  return steps.concat(
+    credentialSteps(item.registry, item.token_secrets?.[0] ?? item.registry),
+  );
+}

package/src/flows.mjs

@@ -1,3 +1,4 @@
+import { credentialSteps } from "./credential-cycle.mjs";
 import { DEFAULT_TRUST_NPM, NPM_TFA_URL } from "./prerequisites.mjs";
 import {
   npmName,
@@ -255,6 +256,13 @@ export function npmFlow(packageInfo, context) {
       },
     ),
     checkRegistryStep("npm", registryStateUrl(packageInfo)),
+    step(
+      "check-name-policy",
+      "Check npm name availability and policy",
+      "check",
+      "Check exact and punctuation variants before approval. Server-side blocks can still refuse publication.",
+      { when: "package-missing" },
+    ),
     step(
       "check-sign-in",
       "Check the npm session",
@@ -308,6 +316,25 @@ export function npmFlow(packageInfo, context) {
       "Compare the bin entries of the packed package.json with package.json and check that each installed bin prints its version for --version.",
       { when: "package-missing" },
     ),
+    step(
+      "publish-dry-run",
+      "Validate first publication without upload",
+      "check",
+      "Validate the reviewed tarball before asking for publication approval.",
+      {
+        command: command("npm", [
+          "publish",
+          "{tarball}",
+          "--dry-run",
+          "--ignore-scripts",
+          "--access",
+          "public",
+          "--provenance=false",
+        ]),
+        when: "package-missing",
+        cwd: packageCwd(context.directory),
+      },
+    ),
     // Sign in right before publishing, so the sign-in, publish, and trust
     // approvals happen together and npm can skip repeated 2FA prompts.
     step(
@@ -416,7 +443,6 @@ export function npmFlow(packageInfo, context) {
         "Confirm that npm lists the GitHub Actions trusted publisher.",
         { command: trustList, when: "trust-missing" },
       ),
-      ...tokenSecretSteps(packageInfo, context.slug),
       step(
         "rerun-release",
         "Re-run the failed release jobs",
@@ -439,6 +465,7 @@ export function npmFlow(packageInfo, context) {
     if (context.verifyRelease) {
       steps.push(...verifyReleaseSteps(context, registryStateUrl(packageInfo)));
     }
+    steps.push(...tokenSecretSteps(packageInfo, context.slug));
   }
   steps.push(
     step(
@@ -707,13 +734,6 @@ export function dockerHubFlow(packageInfo, context) {
         when: "package-missing",
       },
     ),
-    step(
-      "create-access-token",
-      "Create a Read & Write access token",
-      "browser",
-      `Create a token with Read & Write access and a short expiry. Personal access tokens cannot be limited to one repository; an organization access token can be restricted to ${packageInfo.name}. Keep the token only for the next step.`,
-      { url: "https://app.docker.com/settings/personal-access-tokens/create" },
-    ),
     step(
       "check-github-cli",
       "Check the GitHub CLI session",
@@ -755,17 +775,7 @@ export function dockerHubFlow(packageInfo, context) {
         cwd: ".",
       },
     ),
-    step(
-      "set-token-secret",
-      "Set DOCKERHUB_TOKEN",
-      "command",
-      "gh reads the token from the terminal without echoing it; the tool never sees it.",
-      {
-        command: command("gh", ["secret", "set", "DOCKERHUB_TOKEN", ...repo]),
-        cwd: ".",
-        confirm: true,
-      },
-    ),
+    ...credentialSteps("docker-hub", "DOCKERHUB_TOKEN"),
   ];
 }
 

package/src/model.mjs

@@ -8,9 +8,24 @@ export const REGISTRIES = Object.freeze([
   "packagist",
   "docker-hub",
   "ghcr",
+  "rubygems",
+  "jsr",
+  "vscode-marketplace",
+  "open-vsx",
+  "chrome-web-store",
 ]);
 
 const REGISTRY_ALIASES = new Map([
+  ["ruby", "rubygems"],
+  ["rubygems", "rubygems"],
+  ["gem", "rubygems"],
+  ["jsr", "jsr"],
+  ["vscode", "vscode-marketplace"],
+  ["vsce", "vscode-marketplace"],
+  ["vscode-marketplace", "vscode-marketplace"],
+  ["ovsx", "open-vsx"],
+  ["open-vsx", "open-vsx"],
+  ["chrome-web-store", "chrome-web-store"],
   ["npm", "npm"],
   ["cargo", "crates-io"],
   ["crate", "crates-io"],

package/src/npm-policy.mjs

@@ -0,0 +1,69 @@
+import { npmName, registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+
+/** Bounded punctuation variants, including npm's punctuation-free moniker. */
+export function nameVariants(name) {
+  const slash = name.lastIndexOf("/");
+  const scope = slash < 0 ? "" : name.slice(0, slash + 1);
+  const leaf = name.slice(slash + 1);
+  const pieces = leaf.split(/[._-]+/).filter(Boolean);
+  let variants = [pieces[0]];
+  for (const piece of pieces.slice(1)) {
+    variants = variants
+      .flatMap((prefix) =>
+        ["", "-", ".", "_"].map((separator) => prefix + separator + piece),
+      )
+      .slice(0, 64);
+  }
+  return [...new Set(variants.map((variant) => scope + variant))].filter(
+    (variant) => variant !== name,
+  );
+}
+
+/** npm dry-run cannot validate unpublished server-side block/similarity rules. */
+export async function checkNamePolicy(name, options = {}) {
+  if (
+    name.length > 214 ||
+    !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name) ||
+    ["node_modules", "favicon.ico"].includes(name)
+  ) {
+    throw new Error(
+      `npm name '${name}' is invalid; choose a lowercase descriptive name or @owner/name`,
+    );
+  }
+  const base = registryEndpoint("npm", options.env ?? process.env);
+  for (const variant of [name, ...nameVariants(name)]) {
+    const response = await (options.fetch ?? globalThis.fetch)(
+      `${base}/${npmName(variant)}?_=${Date.now()}`,
+      {
+        headers: {
+          accept: "application/json",
+          "cache-control": "no-cache, no-store",
+          "user-agent": USER_AGENT,
+        },
+        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+      },
+    );
+    if (response.status === 404) {
+      continue;
+    }
+    if (!response.ok) {
+      throw new Error(
+        `npm name policy lookup failed (${response.status}); no approval requested`,
+      );
+    }
+    if (variant !== name) {
+      throw new Error(
+        `npm name '${name}' is similar to existing '${variant}'; use @owner/${name} or a longer descriptive name`,
+      );
+    }
+    return;
+  }
+}
+
+/** Report npm policy refusal once, without entering authentication retry logic. */
+export function policyRefusal(output) {
+  return (
+    /\bE403\b|403 Forbidden/i.test(output) &&
+    /too similar|forbidden|blocked|not allowed/i.test(output)
+  );
+}

package/src/package-coverage.mjs

@@ -0,0 +1,106 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import {
+  executableLines,
+  parseWorkflow,
+  scriptReferences,
+} from "./publishers.mjs";
+
+/** Keep executable steps for this manifest, preserving the job's OIDC identity. */
+export function packageWorkflows(workflows, packageInfo) {
+  const directory = path.posix.dirname(packageInfo.manifest);
+  const working = (lines) =>
+    lines
+      .map(
+        (line) => /^\s*working-directory\s*:\s*['"]?([\w./-]+)/.exec(line)?.[1],
+      )
+      .filter(Boolean)
+      .at(-1);
+  return workflows.map((workflow) => {
+    const parsed = parseWorkflow(workflow.contents);
+    const jobs = parsed.jobs.flatMap((job) => {
+      const start = job.lines.findIndex((line) => /^\s*steps\s*:/.test(line));
+      if (start < 0) {
+        const called = job.lines.some((line) =>
+          /^\s*uses\s*:\s*["']?\.\/\.github\/workflows\//.test(line),
+        );
+        const cwd = working(job.lines) ?? working(parsed.header) ?? ".";
+        return called &&
+          cwd.replace(/^\.\//, "").replace(/\/$/, "") === directory
+          ? [`  ${job.name}:\n${job.lines.join("\n")}`]
+          : [];
+      }
+      const prefix = job.lines.slice(0, start + 1);
+      const blocks = [];
+      for (const line of job.lines.slice(start + 1)) {
+        if (/^\s*-\s+[\w-]+\s*:/.test(line)) {
+          blocks.push([]);
+        }
+        if (blocks.length) {
+          blocks.at(-1).push(line);
+        }
+      }
+      const fallback = working(prefix) ?? working(parsed.header) ?? ".";
+      const matching = blocks.filter((block) => {
+        const commands = executableLines(block);
+        if (!commands.length) {
+          return false;
+        }
+        const text = commands.join("\n");
+        if (/--workspaces|--recursive|\bpublish\s+--all\b/.test(text)) {
+          return true;
+        }
+        if (
+          text.includes(`--workspace=${packageInfo.name}`) ||
+          text.includes(`--workspace ${packageInfo.name}`)
+        ) {
+          return true;
+        }
+        const cd = /\bcd\s+['"]?([\w./-]+)/.exec(text)?.[1];
+        const scripts = scriptReferences(commands);
+        const inferred = scripts.find(
+          (script) => directory !== "." && script.startsWith(`${directory}/`),
+        )
+          ? directory
+          : undefined;
+        const cwd =
+          (working(block) ?? cd ?? inferred ?? fallback)
+            .replace(/^\.\//, "")
+            .replace(/\/$/, "") || ".";
+        return cwd === directory;
+      });
+      return matching.length
+        ? [
+            `  ${job.name}:\n${prefix.join("\n")}\n${matching.flat().join("\n")}`,
+          ]
+        : [];
+    });
+    return {
+      ...workflow,
+      contents: `${parsed.header.join("\n")}\njobs:\n${jobs.join("\n")}`,
+    };
+  });
+}
+
+/** Warn when a second npm manifest re-exports a sibling but stops tracking it. */
+export async function auditWrappers(root, packages) {
+  const npm = packages.filter((item) => item.registry === "npm");
+  for (const wrapper of npm) {
+    const data = JSON.parse(
+      (await readFile(path.join(root, wrapper.manifest), "utf8")).replace(
+        /^\uFEFF/,
+        "",
+      ),
+    );
+    for (const target of npm.filter(
+      (target) => target !== wrapper && data.dependencies?.[target.name],
+    )) {
+      if (wrapper.version !== target.version) {
+        wrapper.warnings = [
+          ...(wrapper.warnings ?? []),
+          `wrapper ${wrapper.name}@${wrapper.version} differs from ${target.name}@${target.version}; update both manifests and the wrapper dependency for every release`,
+        ];
+      }
+    }
+  }
+}

package/src/plan.mjs

@@ -6,6 +6,9 @@ import {
   npmFlow,
   pypiFlow,
 } from "./flows.mjs";
+import { credentialPolicy } from "./credential-cycle.mjs";
+import { trustedFlow, tokenFlow } from "./extra-flows.mjs";
+import { bootstrapRef } from "./bootstrap-reference.mjs";
 import { pagesSteps } from "./pages.mjs";
 import { planPrerequisites } from "./prerequisites.mjs";
 import { TRUSTED_REGISTRIES } from "./publishers.mjs";
@@ -17,6 +20,9 @@ const FLOWS = new Map([
   ["pypi", pypiFlow],
   ["docker-hub", dockerHubFlow],
   ["ghcr", ghcrFlow],
+  ["rubygems", trustedFlow],
+  ["nuget", trustedFlow],
+  ["jsr", trustedFlow],
 ]);
 
 /**
@@ -65,6 +71,9 @@ function buildPlan(inspection, packageInfo, options) {
     case "pypi":
     case "docker-hub":
     case "ghcr":
+    case "rubygems":
+    case "nuget":
+    case "jsr":
       return flowPlan(inspection, packageInfo, options);
     case "go-modules":
       steps = [
@@ -84,37 +93,17 @@ function buildPlan(inspection, packageInfo, options) {
         },
       ];
       break;
-    case "nuget":
-      steps = [
-        check(
-          "pack-package",
-          "Build the NuGet package",
-          "Create the package locally without pushing it.",
-          command("dotnet", ["pack", "--configuration", "Release"]),
-        ),
-        browser(
-          "configure-trusted-publishing",
-          "Configure NuGet trusted publishing",
-          "Sign in and add a GitHub Actions federated credential for this package.",
-          "https://www.nuget.org/account/TrustedPublishing",
-        ),
-      ];
-      break;
     case "maven-central":
-      steps = [
-        check(
-          "verify-build",
-          "Verify the Maven build",
-          "Run the build lifecycle without deploying an artifact.",
-          command("mvn", ["--batch-mode", "verify"]),
-        ),
-        browser(
-          "verify-namespace",
-          "Verify a Central namespace",
-          "Sign in to the Central Portal and verify the namespace used by the package coordinates.",
-          "https://central.sonatype.com/publishing/namespaces",
-        ),
-      ];
+    case "vscode-marketplace":
+    case "open-vsx":
+    case "chrome-web-store":
+      if (!packageInfo.workflow && !options.workflow) {
+        return {
+          ...basePlan(inspection, packageInfo, []),
+          skipped_reason: `no workflow publishes ${packageInfo.name} to ${packageInfo.registry}; pass --workflow <file> for an explicit setup target`,
+        };
+      }
+      steps = tokenFlow(packageInfo);
       break;
     case "packagist":
       steps = [
@@ -143,6 +132,7 @@ function basePlan(inspection, packageInfo, steps) {
   return {
     schema_version: 1,
     registry: packageInfo.registry,
+    credential_policy: credentialPolicy(packageInfo.registry),
     package: structuredClone(packageInfo),
     repository: structuredClone(inspection.repository),
     steps,
@@ -204,6 +194,14 @@ function flowPlan(inspection, packageInfo, options) {
   } else if (mode === "attach") {
     steps = steps.filter((item) => !BOOTSTRAP_CONDITIONS.has(item.when));
   }
+  if (options.ref) {
+    const ref = bootstrapRef(options.ref);
+    const fetch = steps.find((step) => step.id === "fetch-default-branch");
+    if (fetch) {
+      fetch.command.args = ["fetch", "origin", ref];
+      fetch.title = `Fetch bootstrap ref ${ref}`;
+    }
+  }
   // Pages readiness belongs to the repository, so it is checked in every mode.
   const pages = inspection.repository.pages_workflow;
   if (slug && pages) {