package-registry-manager 0.22.7 → 0.22.8

package/src/credential-setup.mjs

@@ -1,8 +1,14 @@
-import { spawn } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { verifyCredentialWorkflow } from "./credential-verification.mjs";
-import { needsRotation, rotateCredential } from "./credential-cycle.mjs";
+import { githubServices } from "./github.mjs";
+import {
+  cycleCredential,
+  secretName,
+  trackedTokenIds,
+  recordTokenId,
+  completeRotation,
+} from "./ci-credential-cycle.mjs";
+import { AUTH_FAILURE_PATTERNS } from "./publishing-policy.mjs";
 import {
   TOKEN_PROVIDERS,
   tokenFormScript,
@@ -10,42 +16,7 @@ import {
   revokedScript,
 } from "./credential-browser.mjs";
 
-/** Exact argv and stdin transport. Suppress all output from secret mutations. */
-export function secretCommand(args, input, cwd) {
-  return new Promise((resolve, reject) => {
-    const child = spawn("gh-manager", args, {
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
-    let output = "";
-    child.stdout.on("data", (chunk) => {
-      if (input === undefined) {
-        output += chunk;
-      }
-    });
-    child.stderr.on("data", () => {});
-    child.on("error", () =>
-      reject(
-        new Error(
-          "gh-manager with secret get-metadata/ensure support is required (gh-manager#6)",
-        ),
-      ),
-    );
-    child.stdin.on("error", () => {});
-    child.on("close", (code) =>
-      code === 0
-        ? resolve(output)
-        : reject(
-            new Error(
-              "gh-manager secret operation failed; verify installation, permissions and secret support (gh-manager#6)",
-            ),
-          ),
-    );
-    child.stdin.end(input ?? "");
-  });
-}
-
-/** Execute the token lifecycle without putting values in argv, diagnostics or files. */
+/** Provision only when GitHub CI reports a missing or broken credential. */
 export async function setupCredential(session) {
   const { plan, options } = session;
   const provider = TOKEN_PROVIDERS[plan.registry];
@@ -62,149 +33,226 @@ export async function setupCredential(session) {
     throw error;
   });
   const settings = JSON.parse(contents).tokens?.[plan.registry] ?? {};
-  if (!/^[\w.-]+\.ya?ml$/.test(settings.verification_workflow ?? "")) {
-    throw new Error(
-      "configure tokens.<registry>.verification_workflow for a reviewed dry-run login workflow before creating credentials",
-    );
-  }
   const { github_owner: owner, github_repository: repository } =
     plan.repository;
   if (!owner || !repository) {
     throw new Error("token setup requires GitHub repository coordinates");
   }
-  const secret =
-    settings.secret ?? plan.package.token_secrets?.[0] ?? provider.secret;
-  if (!/^[A-Z][A-Z0-9_]*$/.test(secret)) {
-    throw new Error("invalid registry secret name");
-  }
+  const slug = `${owner}/${repository}`;
+  const secret = secretName(
+    options.secretName ??
+      settings.secret ??
+      plan.package.token_secrets?.[0] ??
+      provider.secret,
+    plan.registry,
+    slug,
+  );
   if (settings.level && !["repo", "org"].includes(settings.level)) {
     throw new Error("token secret level must be repo or org");
   }
-  const scope =
-    settings.level === "repo"
-      ? ["--repo", `${owner}/${repository}`]
-      : ["--org", owner];
-  const visibility =
+  const github = options.github ?? githubServices(options);
+  const scope = { repo: slug };
+  const healthOptions = {
+    scope,
+    failurePatterns: AUTH_FAILURE_PATTERNS[plan.registry] ?? [],
+    inputs: settings.verification_workflow
+      ? { prm_nonce: `prm-${Date.now()}` }
+      : {},
+  };
+  const stateFile =
+    options.browserProfile &&
+    path.join(path.dirname(options.browserProfile), "credential-ids.json");
+  const key = `${slug}:${secret}`;
+  const targets =
     settings.level === "repo"
-      ? []
-      : ["--visibility", "selected", "--repos", `${owner}/${repository}`];
-  const workflow = await readFile(
-    path.join(
-      options.repository,
-      ".github/workflows",
-      settings.verification_workflow,
-    ),
-    "utf8",
-  );
-  if (
-    !workflow.includes("workflow_dispatch") ||
-    !workflow.includes("inputs.prm_nonce") ||
-    !workflow.includes("run-name:")
-  ) {
-    throw new Error(
-      "verification workflow requires workflow_dispatch input prm_nonce and run-name containing inputs.prm_nonce",
-    );
-  }
-  const days = settings.expiry_days ?? 30;
-  if (!Number.isInteger(days) || days < 1 || days > 90) {
-    throw new Error("token expiry_days must be between 1 and 90");
-  }
-  if (options.noBrowser) {
-    throw new Error(
-      "registry token creation requires the dedicated automated browser",
-    );
-  }
-  if (
-    options.browserOptions?.attach ||
-    options.browserOptions?.importScope === "full"
-  ) {
-    throw new Error(
-      "token setup requires a dedicated profile with domain-scoped sign-in import",
-    );
-  }
-  const run = options.secretCommand ?? secretCommand;
-  const previous = JSON.parse(
-    await run(
-      ["secret", "get-metadata", secret, ...scope, "--json"],
-      undefined,
-      options.repository,
-    ),
-  );
-  const verify = () =>
-    verifyCredentialWorkflow(session, settings.verification_workflow);
-  if (!needsRotation(previous)) {
-    try {
-      await verify();
-      return;
-    } catch {
-      previous.valid = false;
-    }
-  }
-  if (
-    !options.yes &&
-    !/^y(?:es)?$/i.test(
-      await session.prompt(
-        "Create and store a scoped credential, verify it, then revoke the replaced token? [y/N] ",
-      ),
-    )
-  ) {
-    throw new Error("credential creation declined");
-  }
-  if (session.automation) {
-    await session.automation.close();
-  }
-  session.automation = null;
-  const page = await session.automatedPage(
-    { ...options.browserOptions, importScope: "domains" },
-    true,
-  );
-  const expiry = new Date(Date.now() + days * 86_400_000).toISOString();
-  await rotateCredential(previous, {
+      ? [slug]
+      : (options.secretRepositories?.[`${plan.registry}:${secret}`] ?? [slug]);
+  let state = {};
+  let page;
+  let approved = false;
+  let repositorySecretPresent = false;
+  const result = await cycleCredential({
+    health: () => github.health.health(secret, healthOptions),
+    metadata: async () => {
+      let metadata = await github.secrets(scope).getMetadata(secret);
+      repositorySecretPresent = Boolean(metadata);
+      if (!metadata && settings.level !== "repo") {
+        try {
+          metadata = await github.secrets({ org: owner }).getMetadata(secret);
+        } catch (error) {
+          if (![403, 404, 422].includes(error.status)) {
+            throw error;
+          }
+        }
+      }
+      if (stateFile) {
+        state = JSON.parse(
+          await readFile(stateFile, "utf8").catch((error) => {
+            if (error.code === "ENOENT") {
+              return "{}";
+            }
+            throw error;
+          }),
+        );
+      }
+      const ids = trackedTokenIds(state, targets, secret);
+      const currentId =
+        settings.token_id ?? state[key]?.at(-1) ?? metadata?.token_id;
+      const retained = Object.entries(state).some(
+        ([entry, values]) =>
+          !targets.some((repo) => entry === `${repo}:${secret}`) &&
+          values.includes(currentId),
+      );
+      return metadata || ids.length
+        ? {
+            ...metadata,
+            present: Boolean(metadata),
+            token_id: retained ? undefined : currentId,
+            token_ids: ids,
+          }
+        : null;
+    },
     create: async () => {
-      await page.goto(provider.url);
-      await session.prompt(
-        `Sign in, then press Enter to fill the narrow publishing scope (${provider.scope})...`,
+      if (
+        options.noBrowser ||
+        options.browserOptions?.attach ||
+        options.browserOptions?.importScope === "full"
+      ) {
+        throw new Error(
+          "token setup requires a dedicated profile with domain-scoped sign-in import",
+        );
+      }
+      const days = settings.expiry_days ?? 30;
+      if (!Number.isInteger(days) || days < 1 || days > 90) {
+        throw new Error("token expiry_days must be between 1 and 90");
+      }
+      if (
+        !approved &&
+        !options.yes &&
+        !/^y(?:es)?$/i.test(
+          await session.prompt(
+            "Create and store a scoped credential, verify it, then revoke the replaced token? [y/N] ",
+          ),
+        )
+      ) {
+        throw new Error("credential creation declined");
+      }
+      approved = true;
+      page ??= await session.automatedPage(
+        {
+          ...options.browserOptions,
+          import: options.browserOptions?.import ?? {
+            browser: "auto",
+            profile: null,
+          },
+          importScope: "domains",
+        },
+        true,
       );
+      await page.goto(provider.url);
       await page.evaluate(
-        tokenFormScript(provider, `prm-${repository}`, expiry),
+        tokenFormScript(
+          provider,
+          `prm-${repository}-${secret}`,
+          new Date(Date.now() + days * 86_400_000).toISOString(),
+        ),
       );
       await session.prompt(
-        `Review the scope and expiry, create the token in this browser, then press Enter (never paste its value)...`,
+        `Review the publishing scope (${provider.scope}) and expiry, create the token in this browser, then press Enter (never paste its value)...`,
       );
-      const credential = await page.evaluate(READ_TOKEN);
-      if (!credential.expires_at) {
-        throw new Error(
-          "registry did not provide a verifiable expiry; no secret was stored",
-        );
+      return page.evaluate(READ_TOKEN);
+    },
+    ensure: async (credential, health) => {
+      const repos = targets;
+      let stored = await github
+        .secrets(settings.level === "repo" ? scope : { org: owner })
+        .ensure(secret, {
+          ...(settings.level === "repo"
+            ? {}
+            : { repos, visibility: "selected" }),
+          health,
+          rotateBeforeMs: 0,
+          failurePatterns: healthOptions.failurePatterns,
+          acquire: async () => ({
+            value: credential.value,
+            expiresAt: credential.expires_at,
+          }),
+        });
+      if (stored.path === "organization") {
+        for (const repo of repos) {
+          const override =
+            repo === slug
+              ? repositorySecretPresent
+              : await github.secrets({ repo }).getMetadata(secret);
+          if (!override) {
+            continue;
+          }
+          const replacement = await github.secrets({ repo }).ensure(secret, {
+            health,
+            rotateBeforeMs: 0,
+            acquire: async () => ({
+              value: credential.value,
+              expiresAt: credential.expires_at,
+            }),
+          });
+          if (replacement.valueChanged === false) {
+            throw new Error(
+              "gh-manager did not replace the repository credential override",
+            );
+          }
+          if (repo === slug) {
+            stored = {
+              ...replacement,
+              path: "repository",
+              fallbackReason:
+                "An existing repository secret overrides the organization secret; replaced the repository credential too.",
+            };
+          }
+        }
       }
-      return credential;
+      if (stored.valueChanged === false) {
+        throw new Error("gh-manager did not store the replacement credential");
+      }
+      if (stateFile) {
+        recordTokenId(state, targets, secret, credential.id);
+        await mkdir(path.dirname(stateFile), { recursive: true });
+        await writeFile(stateFile, JSON.stringify(state), { mode: 0o600 });
+      }
+      return stored;
+    },
+    test: async (stored) => {
+      const repos = stored ? targets : [slug];
+      const results = await Promise.all(
+        repos.map((repo) =>
+          github.health.test(secret, { ...healthOptions, scope: { repo } }),
+        ),
+      );
+      return {
+        status: results.some((item) => item.status === "auth-failing")
+          ? "auth-failing"
+          : results.every((item) => item.status === "ok")
+            ? "ok"
+            : "unknown",
+      };
     },
-    store: (credential) =>
-      run(
-        [
-          "secret",
-          "ensure",
-          secret,
-          ...scope,
-          ...visibility,
-          "--expires-at",
-          credential.expires_at,
-          "--token-id",
-          credential.id,
-          "--registry",
-          plan.registry,
-        ],
-        credential.value,
-        options.repository,
-      ),
-    verify,
     revoke: async (id) => {
       await page.goto(provider.url.replace(/\/create$/, ""));
       await session.prompt(
         `Revoke registry token ${id} in this browser, then press Enter...`,
       );
     },
-    revoked: async (id) => page.evaluate(revokedScript(id)),
+    revoked: (id) => page.evaluate(revokedScript(id)),
   });
-  console.log("  Credential verified; replaced token revocation verified.");
+  if (stateFile && result.changed) {
+    completeRotation(state, targets, secret, result.token_id);
+    await writeFile(stateFile, JSON.stringify(state), { mode: 0o600 });
+  }
+  session.outcome = {
+    status: result.changed ? "configured" : "complete",
+    secret,
+    ...(result.path ? { secret_scope: result.path } : {}),
+    ...(result.fallbackReason
+      ? { fallback_reason: result.fallbackReason }
+      : {}),
+  };
 }

package/src/github.mjs

@@ -0,0 +1,42 @@
+import {
+  createRestClient,
+  resolveToken,
+  createRepoManager,
+  createRunManager,
+  createSecretHealth,
+  createSecretManager,
+} from "@link-foundation/gh-manager";
+
+/** GitHub-only operations, supplied by the installed gh-manager library. */
+export function githubServices(options = {}) {
+  const { token } = resolveToken(options);
+  if (!token && !options.rest) {
+    throw new Error(
+      "sign in to GitHub with gh auth login before scanning or setting secrets",
+    );
+  }
+  const rest = options.rest ?? createRestClient({ token });
+  const log = {
+    debug: (message) => {
+      if (options.verbose) {
+        console.error(message);
+      }
+    },
+  };
+  const context = { rest, log };
+  return {
+    repos: createRepoManager(context),
+    runs: createRunManager(context),
+    health: createSecretHealth(context),
+    secrets: (scope) => {
+      if (typeof scope.repo === "string") {
+        const [owner, name, extra] = scope.repo.split("/");
+        if (!owner || !name || extra !== undefined) {
+          throw new Error("invalid repository secret scope");
+        }
+        scope = { ...scope, repo: { owner, name } };
+      }
+      return createSecretManager({ ...context, scope });
+    },
+  };
+}

package/src/index.mjs

@@ -2,5 +2,7 @@ export { npmPrefillScript, openInUserBrowser } from "./browser.mjs";
 export { inspectRepository } from "./discovery.mjs";
 export { REGISTRIES, parseRegistry } from "./model.mjs";
 export { buildPlans, packageDirectory } from "./plan.mjs";
+export { scanRepositories } from "./organization-scan.mjs";
+export { cycleCredential, secretName } from "./ci-credential-cycle.mjs";
 export { ensureProfileIgnored } from "./profile.mjs";
 export { defaultBrowserProfile, executePlan, executePlans } from "./setup.mjs";