package-registry-manager 0.22.5 → 0.22.7

package/src/discovery.mjs

@@ -2,7 +2,9 @@ import { readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 
 import { CONTAINER_FILES, containerPackages } from "./containers.mjs";
+import { packageWorkflows, auditWrappers } from "./package-coverage.mjs";
 import { REGISTRIES } from "./model.mjs";
+import { inspectManifestRepositories } from "./repository-identity.mjs";
 import {
   TRUSTED_REGISTRIES,
   detectPublisher,
@@ -39,6 +41,8 @@ const MANIFEST_NAMES = new Set([
   "build.gradle",
   "build.gradle.kts",
   "composer.json",
+  "jsr.json",
+  "deno.json",
 ]);
 
 /**
@@ -73,7 +77,9 @@ export async function inspectRepository(repository, options = {}) {
     const directory = testDirectory(manifest);
     return (
       directory === null ||
-      (publishable && referencedByWorkflow(workflows, manifest)) ||
+      (!["docs", "experiments", "case-studies"].includes(directory) &&
+        publishable &&
+        referencedByWorkflow(workflows, manifest)) ||
       skip(manifest, testDirectoryReason(directory))
     );
   };
@@ -103,14 +109,82 @@ export async function inspectRepository(repository, options = {}) {
   for (const registry of TRUSTED_REGISTRIES) {
     publishers.set(registry, await detectPublisher(root, workflows, registry));
   }
+  // Extension packages can publish to both marketplaces independently.
+  for (const item of [...parsed].filter(Boolean)) {
+    if (item.registry !== "npm") {
+      continue;
+    }
+    const data = JSON.parse(await readManifest(path.join(root, item.manifest)));
+    if (data.publisher && data.engines?.vscode) {
+      for (const registry of ["vscode-marketplace", "open-vsx"]) {
+        const publisher = await detectPublisher(root, workflows, registry);
+        if (publisher.workflow) {
+          publishers.set(registry, publisher);
+          parsed.push({
+            ...item,
+            registry,
+            name: `${data.publisher}.${item.name}`,
+          });
+        }
+      }
+    }
+  }
+  publishers.set(
+    "maven-central",
+    await detectPublisher(root, workflows, "maven-central"),
+  );
   const containerFiles = dockerfiles
     .map((item) => relativePath(root, item))
     .filter((item) => !ignored(item) && kept(item, true));
-  const packages = parsed
-    .filter(Boolean)
-    .filter((item) => kept(item.manifest, item.publishable))
-    .map((item) => withPublisher(item, workflows, publishers))
-    .concat(containerPackages(containerFiles, workflows, coordinates))
+  const counts = new Map();
+  for (const item of parsed.filter(Boolean)) {
+    if (!testDirectory(item.manifest)) {
+      counts.set(item.registry, (counts.get(item.registry) ?? 0) + 1);
+    }
+  }
+  const chrome = await detectPublisher(root, workflows, "chrome-web-store");
+  const chromePackages = chrome.workflow
+    ? [
+        withPublisher(
+          packageInfo(
+            "chrome-web-store",
+            coordinates.github_repository ?? "chrome-extension",
+            null,
+            `.github/workflows/${chrome.workflow}`,
+          ),
+          workflows,
+          new Map([["chrome-web-store", chrome]]),
+        ),
+      ]
+    : [];
+  const packages = (
+    await Promise.all(
+      parsed
+        .filter(Boolean)
+        .filter((item) => kept(item.manifest, item.publishable))
+        .map(async (item) => {
+          const scoped =
+            counts.get(item.registry) > 1 &&
+            TRUSTED_REGISTRIES.includes(item.registry)
+              ? new Map([
+                  [
+                    item.registry,
+                    await detectPublisher(
+                      root,
+                      packageWorkflows(workflows, item),
+                      item.registry,
+                    ),
+                  ],
+                ])
+              : publishers;
+          return withPublisher(item, workflows, scoped);
+        }),
+    )
+  )
+    .concat(
+      containerPackages(containerFiles, workflows, coordinates),
+      chromePackages,
+    )
     .sort((left, right) => {
       const registryOrder =
         REGISTRIES.indexOf(left.registry) - REGISTRIES.indexOf(right.registry);
@@ -122,6 +196,7 @@ export async function inspectRepository(repository, options = {}) {
       );
     });
 
+  await auditWrappers(root, packages);
   const inspection = {
     schema_version: 1,
     repository: {
@@ -140,7 +215,7 @@ export async function inspectRepository(repository, options = {}) {
       left.manifest.localeCompare(right.manifest),
     );
   }
-  return inspection;
+  return inspectManifestRepositories(inspection);
 }
 
 /**
@@ -206,7 +281,7 @@ async function collectManifests(directory, manifests, dockerfiles) {
     } else if (
       entry.isFile() &&
       (MANIFEST_NAMES.has(entry.name) ||
-        /\.(?:csproj|fsproj|vbproj)$/.test(entry.name))
+        /\.(?:csproj|fsproj|vbproj|gemspec)$/.test(entry.name))
     ) {
       manifests.push(item);
     }
@@ -217,6 +292,13 @@ async function parseManifest(manifestPath, manifest) {
   const contents = await readManifest(manifestPath);
   const filename = path.basename(manifestPath);
   switch (filename) {
+    case "jsr.json":
+    case "deno.json": {
+      const value = JSON.parse(contents);
+      return value.name && value.version
+        ? packageInfo("jsr", value.name, value.version, manifest)
+        : null;
+    }
     case "package.json":
       return parseNpm(contents, manifest);
     case "Cargo.toml":
@@ -246,6 +328,15 @@ async function parseManifest(manifestPath, manifest) {
     case "composer.json":
       return parseComposer(contents, manifest);
     default:
+      if (filename.endsWith(".gemspec")) {
+        return packageInfo(
+          "rubygems",
+          capture(contents, /\.name\s*=\s*['"]([^'"]+)/) ??
+            "unknown-ruby-package",
+          capture(contents, /\.version\s*=\s*['"]([^'"]+)/),
+          manifest,
+        );
+      }
       if (/\.(?:csproj|fsproj|vbproj)$/.test(filename)) {
         return parseDotnet(contents, manifestPath, manifest);
       }

package/src/extra-flows.mjs

@@ -0,0 +1,88 @@
+import { credentialSteps } from "./credential-cycle.mjs";
+import { tokenSecretSteps } from "./tokens.mjs";
+
+/** Additional OIDC registries never fall back to a stored publishing token. */
+export function trustedFlow(item, context) {
+  const specs = {
+    rubygems: [
+      "gem",
+      ["build", item.manifest.split("/").at(-1)],
+      "https://rubygems.org/profile/oidc/pending_trusted_publishers",
+      "Register the GitHub Actions identity as a pending publisher, or add it in the existing gem settings.",
+    ],
+    nuget: [
+      "dotnet",
+      ["pack", "--configuration", "Release"],
+      "https://www.nuget.org/account/TrustedPublishing",
+      "Register a trusted publishing policy for this GitHub Actions identity. Use NuGet/login to exchange OIDC for a short-lived API key; never store that key.",
+    ],
+    jsr: [
+      "deno",
+      ["publish", "--dry-run"],
+      `https://jsr.io/${item.name}/settings`,
+      "Link this package to the GitHub repository; publish from the configured workflow through OIDC.",
+    ],
+  };
+  const [program, args, url, description] = specs[item.registry];
+  const steps = [
+    {
+      id: "validate-package",
+      title: `Validate ${item.registry} package`,
+      kind: "check",
+      description: "Build or validate locally without uploading.",
+      command: { program, args },
+    },
+    {
+      id: "configure-trusted-publisher",
+      title: `Configure ${item.registry} trusted publishing`,
+      kind: "browser",
+      description,
+      url,
+    },
+    {
+      id: "verify-oidc-release",
+      title: "Verify an OIDC release before removing tokens",
+      kind: "manual",
+      description: `Run ${context.workflow} and verify registry acceptance through OIDC; remove secret references from every workflow before deleting unused credentials.`,
+    },
+  ];
+  if (context.slug) {
+    steps.push(...tokenSecretSteps(item, context.slug));
+  }
+  return steps;
+}
+
+export function tokenFlow(item) {
+  const checks = {
+    "maven-central": { program: "mvn", args: ["--batch-mode", "verify"] },
+    "vscode-marketplace": {
+      program: "npx",
+      args: ["--no-install", "vsce", "package"],
+    },
+    "open-vsx": { program: "npx", args: ["--no-install", "vsce", "package"] },
+  };
+  const steps = checks[item.registry]
+    ? [
+        {
+          id: "validate-package",
+          title: "Validate package before credential changes",
+          kind: "check",
+          description: "Build without publishing.",
+          command: checks[item.registry],
+        },
+      ]
+    : [];
+  if (item.registry === "maven-central") {
+    steps.push({
+      id: "verify-namespace",
+      title: "Verify a Central namespace",
+      kind: "browser",
+      description:
+        "Sign in to the Central Portal and verify the namespace used by the package coordinates.",
+      url: "https://central.sonatype.com/publishing/namespaces",
+    });
+  }
+  return steps.concat(
+    credentialSteps(item.registry, item.token_secrets?.[0] ?? item.registry),
+  );
+}

package/src/flows.mjs

@@ -1,3 +1,4 @@
+import { credentialSteps } from "./credential-cycle.mjs";
 import { DEFAULT_TRUST_NPM, NPM_TFA_URL } from "./prerequisites.mjs";
 import {
   npmName,
@@ -255,6 +256,13 @@ export function npmFlow(packageInfo, context) {
       },
     ),
     checkRegistryStep("npm", registryStateUrl(packageInfo)),
+    step(
+      "check-name-policy",
+      "Check npm name availability and policy",
+      "check",
+      "Check exact and punctuation variants before approval. Server-side blocks can still refuse publication.",
+      { when: "package-missing" },
+    ),
     step(
       "check-sign-in",
       "Check the npm session",
@@ -308,6 +316,25 @@ export function npmFlow(packageInfo, context) {
       "Compare the bin entries of the packed package.json with package.json and check that each installed bin prints its version for --version.",
       { when: "package-missing" },
     ),
+    step(
+      "publish-dry-run",
+      "Validate first publication without upload",
+      "check",
+      "Validate the reviewed tarball before asking for publication approval.",
+      {
+        command: command("npm", [
+          "publish",
+          "{tarball}",
+          "--dry-run",
+          "--ignore-scripts",
+          "--access",
+          "public",
+          "--provenance=false",
+        ]),
+        when: "package-missing",
+        cwd: packageCwd(context.directory),
+      },
+    ),
     // Sign in right before publishing, so the sign-in, publish, and trust
     // approvals happen together and npm can skip repeated 2FA prompts.
     step(
@@ -416,7 +443,6 @@ export function npmFlow(packageInfo, context) {
         "Confirm that npm lists the GitHub Actions trusted publisher.",
         { command: trustList, when: "trust-missing" },
       ),
-      ...tokenSecretSteps(packageInfo, context.slug),
       step(
         "rerun-release",
         "Re-run the failed release jobs",
@@ -439,6 +465,7 @@ export function npmFlow(packageInfo, context) {
     if (context.verifyRelease) {
       steps.push(...verifyReleaseSteps(context, registryStateUrl(packageInfo)));
     }
+    steps.push(...tokenSecretSteps(packageInfo, context.slug));
   }
   steps.push(
     step(
@@ -707,13 +734,6 @@ export function dockerHubFlow(packageInfo, context) {
         when: "package-missing",
       },
     ),
-    step(
-      "create-access-token",
-      "Create a Read & Write access token",
-      "browser",
-      `Create a token with Read & Write access and a short expiry. Personal access tokens cannot be limited to one repository; an organization access token can be restricted to ${packageInfo.name}. Keep the token only for the next step.`,
-      { url: "https://app.docker.com/settings/personal-access-tokens/create" },
-    ),
     step(
       "check-github-cli",
       "Check the GitHub CLI session",
@@ -755,17 +775,7 @@ export function dockerHubFlow(packageInfo, context) {
         cwd: ".",
       },
     ),
-    step(
-      "set-token-secret",
-      "Set DOCKERHUB_TOKEN",
-      "command",
-      "gh reads the token from the terminal without echoing it; the tool never sees it.",
-      {
-        command: command("gh", ["secret", "set", "DOCKERHUB_TOKEN", ...repo]),
-        cwd: ".",
-        confirm: true,
-      },
-    ),
+    ...credentialSteps("docker-hub", "DOCKERHUB_TOKEN"),
   ];
 }
 

package/src/manifest-proposal.mjs

@@ -0,0 +1,201 @@
+import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { exec } from "command-stream";
+import {
+  githubSlug,
+  manifestUrls,
+  repositorySlug,
+} from "./repository-identity.mjs";
+
+function runner(options) {
+  return (
+    options.run ??
+    (async (program, args, cwd = options.repository) => {
+      const result = await exec(program, args, {
+        cwd,
+        env: process.env,
+        capture: true,
+        mirror: false,
+        stdin: "ignore",
+      });
+      if (result.code !== 0) {
+        throw new Error(
+          `${program} failed while preparing the manifest repository proposal`,
+        );
+      }
+      return String(result.stdout ?? "").trim();
+    })
+  );
+}
+
+function safeManifest(manifest) {
+  if (
+    !manifest ||
+    manifest
+      .split("/")
+      .some((part) => !part || part === "." || part === "..") ||
+    path.isAbsolute(manifest) ||
+    manifest.includes("\\")
+  ) {
+    throw new Error("unsafe manifest path for repository repair");
+  }
+}
+
+/** Change only stale repository values; preserve npm's repository.directory. */
+export function manifestRepositoryProposal(contents, manifest, slug) {
+  if (!githubSlug(slug)) {
+    throw new Error("invalid canonical repository");
+  }
+  const urls = manifestUrls(contents, manifest);
+  const stale = urls.filter(
+    (url) =>
+      githubSlug(url) && githubSlug(url).toLowerCase() !== slug.toLowerCase(),
+  );
+  if (!stale.length) {
+    return contents;
+  }
+  const url = `https://github.com/${slug}`;
+  if (manifest.endsWith("package.json")) {
+    const document = JSON.parse(contents.replace(/^\uFEFF/, ""));
+    if (typeof document.repository === "string") {
+      document.repository = url;
+    } else {
+      document.repository.url = `git+${url}.git`;
+    }
+    return `${JSON.stringify(document, null, 2)}\n`;
+  }
+  let proposal = contents;
+  for (const old of stale) {
+    proposal = proposal.replaceAll(old, old.replace(githubSlug(old), slug));
+  }
+  return proposal;
+}
+
+/** Check remote metadata before retrying; the original run may use an old SHA. */
+export async function verifyRemoteManifest(plan, options, reference) {
+  safeManifest(plan.package.manifest);
+  const run = runner(options);
+  const slug = repositorySlug(plan.repository);
+  const ref =
+    reference ??
+    (await run("gh", ["api", `repos/${slug}`, "--jq", ".default_branch"]));
+  if (!ref || ref.startsWith("-") || /[\s:]/.test(ref)) {
+    throw new Error("invalid remote manifest reference");
+  }
+  await run("git", ["fetch", "origin", ref]);
+  const contents = await run("git", [
+    "show",
+    `FETCH_HEAD:${plan.package.manifest}`,
+  ]);
+  return (
+    manifestRepositoryProposal(contents, plan.package.manifest, slug) ===
+    contents
+  );
+}
+
+/** Offer a reviewed branch and draft PR from the current remote default branch. */
+export async function offerManifestRepository(plan, options) {
+  const run = runner(options);
+  const slug = repositorySlug(plan.repository);
+  const manifest = plan.package.manifest;
+  safeManifest(manifest);
+  const remote = githubSlug(await run("git", ["remote", "get-url", "origin"]));
+  if (!remote) {
+    throw new Error(
+      "origin must be a GitHub repository for the manifest proposal",
+    );
+  }
+  const canonical = await run("gh", [
+    "api",
+    `repos/${remote}`,
+    "--jq",
+    ".full_name",
+  ]);
+  if (canonical.toLowerCase() !== slug.toLowerCase()) {
+    throw new Error("origin must resolve to the repository being repaired");
+  }
+  const base = await run("gh", [
+    "api",
+    `repos/${slug}`,
+    "--jq",
+    ".default_branch",
+  ]);
+  if (!base || base.startsWith("-") || /[\s:]/.test(base)) {
+    throw new Error("invalid default branch");
+  }
+  await run("git", ["fetch", "origin", base]);
+  const contents = await run("git", ["show", `FETCH_HEAD:${manifest}`]);
+  const proposal = manifestRepositoryProposal(contents, manifest, slug);
+  if (proposal === contents) {
+    return undefined;
+  }
+  console.log(`Proposed ${manifest}:\n${proposal}`);
+  if (
+    !options.yes &&
+    !/^y(?:es)?$/i.test(
+      await options.prompt(
+        "Create a branch and draft pull request with this repository URL fix? [y/N] ",
+      ),
+    )
+  ) {
+    return { status: "blocked" };
+  }
+  const branch = `prm/repository-url-${Date.now()}`;
+  const temporary = await mkdtemp(path.join(os.tmpdir(), "prm-manifest-"));
+  const checkout = path.join(temporary, "checkout");
+  let created = false;
+  try {
+    await run("git", ["worktree", "add", "-b", branch, checkout, "FETCH_HEAD"]);
+    created = true;
+    const target = path.join(checkout, manifest);
+    const root = await realpath(checkout);
+    const physical = await realpath(target);
+    if (
+      !physical.startsWith(`${root}${path.sep}`) ||
+      physical !== path.join(root, manifest)
+    ) {
+      throw new Error(
+        "manifest must stay inside the proposal worktree without symlinks",
+      );
+    }
+    const current = await readFile(target, "utf8");
+    const updated = manifestRepositoryProposal(current, manifest, slug);
+    await writeFile(target, updated);
+    await run("git", ["add", "--", manifest], checkout);
+    await run(
+      "git",
+      ["commit", "-m", "Fix manifest repository URL after repository transfer"],
+      checkout,
+    );
+    await run("git", ["push", "origin", `HEAD:refs/heads/${branch}`], checkout);
+    const url = await run(
+      "gh",
+      [
+        "pr",
+        "create",
+        "--repo",
+        slug,
+        "--base",
+        base,
+        "--head",
+        branch,
+        "--draft",
+        "--title",
+        "Fix manifest repository URL after repository transfer",
+        "--body",
+        `Update ${manifest} to name ${slug}. Review and merge this change, then re-run package-registry-manager setup to verify the repository metadata and retry the release.`,
+      ],
+      checkout,
+    );
+    console.log(
+      `Review and merge ${url}, then re-run setup. Release retries are paused.`,
+    );
+    return { status: "manifest-pr", url };
+  } finally {
+    if (created) {
+      await run("git", ["worktree", "remove", "--force", checkout]);
+    }
+    await rm(temporary, { recursive: true, force: true });
+  }
+}

package/src/model.mjs

@@ -8,9 +8,24 @@ export const REGISTRIES = Object.freeze([
   "packagist",
   "docker-hub",
   "ghcr",
+  "rubygems",
+  "jsr",
+  "vscode-marketplace",
+  "open-vsx",
+  "chrome-web-store",
 ]);
 
 const REGISTRY_ALIASES = new Map([
+  ["ruby", "rubygems"],
+  ["rubygems", "rubygems"],
+  ["gem", "rubygems"],
+  ["jsr", "jsr"],
+  ["vscode", "vscode-marketplace"],
+  ["vsce", "vscode-marketplace"],
+  ["vscode-marketplace", "vscode-marketplace"],
+  ["ovsx", "open-vsx"],
+  ["open-vsx", "open-vsx"],
+  ["chrome-web-store", "chrome-web-store"],
   ["npm", "npm"],
   ["cargo", "crates-io"],
   ["crate", "crates-io"],

package/src/npm-policy.mjs

@@ -0,0 +1,69 @@
+import { npmName, registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+
+/** Bounded punctuation variants, including npm's punctuation-free moniker. */
+export function nameVariants(name) {
+  const slash = name.lastIndexOf("/");
+  const scope = slash < 0 ? "" : name.slice(0, slash + 1);
+  const leaf = name.slice(slash + 1);
+  const pieces = leaf.split(/[._-]+/).filter(Boolean);
+  let variants = [pieces[0]];
+  for (const piece of pieces.slice(1)) {
+    variants = variants
+      .flatMap((prefix) =>
+        ["", "-", ".", "_"].map((separator) => prefix + separator + piece),
+      )
+      .slice(0, 64);
+  }
+  return [...new Set(variants.map((variant) => scope + variant))].filter(
+    (variant) => variant !== name,
+  );
+}
+
+/** npm dry-run cannot validate unpublished server-side block/similarity rules. */
+export async function checkNamePolicy(name, options = {}) {
+  if (
+    name.length > 214 ||
+    !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name) ||
+    ["node_modules", "favicon.ico"].includes(name)
+  ) {
+    throw new Error(
+      `npm name '${name}' is invalid; choose a lowercase descriptive name or @owner/name`,
+    );
+  }
+  const base = registryEndpoint("npm", options.env ?? process.env);
+  for (const variant of [name, ...nameVariants(name)]) {
+    const response = await (options.fetch ?? globalThis.fetch)(
+      `${base}/${npmName(variant)}?_=${Date.now()}`,
+      {
+        headers: {
+          accept: "application/json",
+          "cache-control": "no-cache, no-store",
+          "user-agent": USER_AGENT,
+        },
+        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+      },
+    );
+    if (response.status === 404) {
+      continue;
+    }
+    if (!response.ok) {
+      throw new Error(
+        `npm name policy lookup failed (${response.status}); no approval requested`,
+      );
+    }
+    if (variant !== name) {
+      throw new Error(
+        `npm name '${name}' is similar to existing '${variant}'; use @owner/${name} or a longer descriptive name`,
+      );
+    }
+    return;
+  }
+}
+
+/** Report npm policy refusal once, without entering authentication retry logic. */
+export function policyRefusal(output) {
+  return (
+    /\bE403\b|403 Forbidden/i.test(output) &&
+    /too similar|forbidden|blocked|not allowed/i.test(output)
+  );
+}