package-registry-manager 0.22.7 → 0.22.8

package/src/organization-scan.mjs

@@ -0,0 +1,259 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { inspectRepository } from "./discovery.mjs";
+import { githubServices } from "./github.mjs";
+import { probeRegistryState } from "./registry-state.mjs";
+import { RELEASE_FAILURE_PATTERNS } from "./publishing-policy.mjs";
+import { credentialPolicy } from "./credential-cycle.mjs";
+import { identityCommand } from "./repository-identity.mjs";
+
+/** Only files used by existing discovery; no full repository clones for scans. */
+export const SCAN_MATCHES = [
+  ...[
+    "package.json",
+    "Cargo.toml",
+    "pyproject.toml",
+    "setup.py",
+    "go.mod",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "composer.json",
+    "jsr.json",
+    "deno.json",
+    "*.csproj",
+    "*.fsproj",
+    "*.vbproj",
+    "*.gemspec",
+    "Dockerfile*",
+    "Containerfile*",
+    "docker-compose*.yml",
+    "docker-compose*.yaml",
+    "compose*.yml",
+    "compose*.yaml",
+  ].map((name) => `**/${name}`),
+  ".github/workflows/*.yml",
+  ".github/workflows/*.yaml",
+  ".package-registry-manager.json",
+];
+
+export function packageFindings(inspection) {
+  const slug = `${inspection.repository.github_owner}/${inspection.repository.github_repository}`;
+  return inspection.packages
+    .filter((item) => item.publishable)
+    .flatMap((item) => {
+      const common = {
+        repository: slug,
+        registry: item.registry,
+        package: item.name,
+        manifest: item.manifest,
+      };
+      const findings = [];
+      if (item.exists_on_registry === false) {
+        findings.push({ ...common, type: "unpublished" });
+      }
+      if (
+        item.exists_on_registry === true &&
+        (item.trusted_publishing === false ||
+          credentialPolicy(item.registry).mode === "token")
+      ) {
+        findings.push({
+          ...common,
+          type: "published-without-trusted-publishing",
+        });
+      }
+      const others = (item.configured_publishers ?? []).filter(
+        (publisher) =>
+          publisher.repository.toLowerCase() !== slug.toLowerCase(),
+      );
+      if (others.length) {
+        findings.push({
+          ...common,
+          type: "trusted-publisher-other-repository",
+          evidence: others,
+        });
+      }
+      return findings;
+    });
+}
+
+async function writeSnapshot(root, slug, files) {
+  for (const file of files) {
+    if (
+      typeof file.path !== "string" ||
+      file.path.includes("\\") ||
+      file.path.includes(":") ||
+      file.path
+        .split("/")
+        .some(
+          (part) => !part || part === "." || part === ".." || part === ".git",
+        )
+    ) {
+      throw new Error("unsafe repository file path");
+    }
+    if (typeof file.content !== "string") {
+      throw new Error("gh-manager returned no file content");
+    }
+    const target = path.join(root, file.path);
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, file.content);
+  }
+  await mkdir(path.join(root, ".git"), { recursive: true });
+  await writeFile(
+    path.join(root, ".git/config"),
+    `[remote "origin"]\n  url = https://github.com/${slug}.git\n`,
+  );
+}
+
+/** Keep snapshots alive only for the callback; cleanup also runs after errors. */
+export async function withAccountScan(options, callback) {
+  if (
+    Boolean(options.org) === Boolean(options.user) ||
+    !/^[\w.-]+$/.test(options.org ?? options.user)
+  ) {
+    throw new Error("choose exactly one valid --org or --user");
+  }
+  const github = options.github ?? githubServices(options);
+  const directory = await mkdtemp(path.join(os.tmpdir(), "prm-account-"));
+  try {
+    const repositories = await github.repos.list({
+      org: options.org,
+      user: options.user,
+    });
+    const scan = {
+      schema_version: 1,
+      account: options.org ?? options.user,
+      repositories: [],
+      findings: [],
+    };
+    for (const [index, repo] of repositories.entries()) {
+      const slug = repo.full_name;
+      if (!/^[\w.-]+\/[\w.-]+$/.test(slug)) {
+        throw new Error("gh-manager returned an invalid repository name");
+      }
+      try {
+        const root = path.join(directory, String(index));
+        await writeSnapshot(
+          root,
+          slug,
+          await github.repos.files(slug, {
+            match: SCAN_MATCHES,
+            content: true,
+            ref: repo.default_branch,
+          }),
+        );
+        const discovered = await inspectRepository(root, {
+          includeSkipped: options.verbose,
+        });
+        const inspection = options.offline
+          ? discovered
+          : await (options.probe ?? probeRegistryState)(discovered, {
+              ...options,
+              runIdentity: async (program, args) =>
+                program === "gh"
+                  ? slug
+                  : identityCommand(program, args, {
+                      ...options,
+                      repository: root,
+                    }),
+              repository: root,
+            });
+        scan.repositories.push({
+          repository: slug,
+          default_branch: repo.default_branch,
+          inspection,
+        });
+        scan.findings.push(...packageFindings(inspection));
+      } catch (error) {
+        scan.repositories.push({ repository: slug, error: error.message });
+      }
+    }
+    if (!options.offline) {
+      let failures;
+      if (options.org) {
+        failures = await github.runs.failures({
+          org: options.org,
+          grep: RELEASE_FAILURE_PATTERNS,
+        });
+      } else {
+        failures = [];
+        for (const repo of repositories) {
+          const [latest] = await github.runs.list(repo.full_name, {
+            branch: repo.default_branch,
+            limit: 1,
+          });
+          if (latest?.conclusion === "failure") {
+            const matches = await github.runs.logs(latest.id, {
+              repo: repo.full_name,
+              grep: RELEASE_FAILURE_PATTERNS,
+            });
+            if (matches.length) {
+              failures.push({
+                repository: repo.full_name,
+                runUrl: latest.html_url,
+                matches,
+              });
+            }
+          }
+        }
+      }
+      scan.findings.push(
+        ...failures.map((evidence) => ({
+          repository: evidence.repository,
+          type: "release-failing",
+          evidence,
+        })),
+      );
+    }
+    return await callback(scan, github);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+
+export async function scanRepositories(options) {
+  return withAccountScan(options, (scan) => {
+    for (const item of scan.repositories) {
+      if (item.inspection) {
+        item.inspection.repository.root = `https://github.com/${item.repository}`;
+      }
+    }
+    return scan;
+  });
+}
+
+export function renderScan(scan) {
+  const rows = ["Repository\tRegistry\tPackage\tFinding"];
+  for (const item of scan.findings) {
+    rows.push(
+      `${item.repository}\t${item.registry ?? "-"}\t${item.package ?? "-"}\t${item.type.replaceAll("-", " ")}`,
+    );
+  }
+  for (const item of scan.repositories.filter((repo) => repo.error)) {
+    rows.push(`${item.repository}\t-\t-\tscan failed: ${item.error}`);
+  }
+  for (const repo of scan.repositories) {
+    for (const pkg of repo.inspection?.packages ?? []) {
+      if (
+        !pkg.publishable ||
+        scan.findings.some(
+          (finding) =>
+            finding.repository === repo.repository &&
+            finding.package === pkg.name &&
+            finding.registry === pkg.registry,
+        )
+      ) {
+        continue;
+      }
+      const status =
+        pkg.exists_on_registry === undefined
+          ? "registry state unknown"
+          : pkg.trusted_publishing === true
+            ? "published with trusted publishing"
+            : "published; trusted publishing unknown";
+      rows.push(`${repo.repository}\t${pkg.registry}\t${pkg.name}\t${status}`);
+    }
+  }
+  return `${rows.join("\n")}\n`;
+}

package/src/organization-setup.mjs

@@ -0,0 +1,203 @@
+import { spawnSync } from "node:child_process";
+import { readFile, rm, stat } from "node:fs/promises";
+import path from "node:path";
+import { withAccountScan, renderScan } from "./organization-scan.mjs";
+import { buildPlans } from "./plan.mjs";
+import { probeEnvironment } from "./prerequisites.mjs";
+import { executePlans } from "./setup-batch.mjs";
+import { secretName } from "./ci-credential-cycle.mjs";
+import { TOKEN_PROVIDERS } from "./credential-browser.mjs";
+
+async function prepareRepository(item) {
+  const root = item.inspection.repository.root;
+  await rm(`${root}/.git`, { recursive: true, force: true });
+  const commands = [
+    ["init", "--quiet"],
+    ["remote", "add", "origin", `https://github.com/${item.repository}.git`],
+    ["fetch", "--quiet", "--depth=1", "origin", item.default_branch],
+    ["checkout", "--quiet", "--force", "--detach", "FETCH_HEAD"],
+  ];
+  for (const args of commands) {
+    const result = spawnSync("git", args, { cwd: root, stdio: "pipe" });
+    if (result.status !== 0) {
+      throw new Error(`cannot prepare ${item.repository} for setup`);
+    }
+  }
+}
+
+/** Plan from API snapshots; fetch worktrees only for repositories being changed. */
+export async function accountCommand(command, options, outputPlans) {
+  return withAccountScan(options, async (scan, github) => {
+    if (command === "inspect") {
+      for (const item of scan.repositories) {
+        if (item.inspection) {
+          item.inspection.repository.root = `https://github.com/${item.repository}`;
+        }
+      }
+      process.stdout.write(
+        options.format === "json"
+          ? `${JSON.stringify(scan, null, 2)}\n`
+          : renderScan(scan),
+      );
+      return scan;
+    }
+    const items = scan.repositories.filter((item) => item.inspection);
+    const errors = scan.repositories.filter((item) => item.error);
+    if (errors.length) {
+      console.error(renderScan({ repositories: errors, findings: [] }));
+    }
+    for (const item of items) {
+      const workflow = options.planOptions?.workflow;
+      if (workflow !== undefined) {
+        if (!/^[\w.-]+\.ya?ml$/.test(workflow)) {
+          throw new Error(
+            "--workflow must be a workflow file name in .github/workflows",
+          );
+        }
+        if (
+          !options.planOptions.addPublishJob &&
+          !(await stat(
+            path.join(
+              item.inspection.repository.root,
+              ".github/workflows",
+              workflow,
+            ),
+          ).then(
+            (metadata) => metadata.isFile(),
+            () => false,
+          ))
+        ) {
+          throw new Error(
+            `--workflow: ${item.repository} has no .github/workflows/${workflow}`,
+          );
+        }
+      }
+    }
+    const packages = items.flatMap((item) => item.inspection.packages);
+    const environment = await (options.probeEnvironment ?? probeEnvironment)({
+      offline: options.offline,
+      verbose: options.verbose,
+      npm: packages.some((item) => item.registry === "npm"),
+      python: packages.some((item) => item.registry === "pypi"),
+    });
+    let plans = items
+      .flatMap((item) => {
+        const relevant = scan.findings.filter(
+          (finding) => finding.repository === item.repository,
+        );
+        const inspection = {
+          ...item.inspection,
+          packages: item.inspection.packages.filter(
+            (pkg) =>
+              (!options.package || pkg.name === options.package) &&
+              (command === "plan" ||
+                relevant.some(
+                  (finding) => !finding.package || finding.package === pkg.name,
+                )),
+          ),
+        };
+        return buildPlans(inspection, options.registries ?? [], {
+          ...options.planOptions,
+          environment,
+        }).filter((plan) => plan.package.publishable);
+      })
+      .sort(
+        (a, b) => Number(b.registry === "npm") - Number(a.registry === "npm"),
+      );
+    const display = structuredClone(plans);
+    for (const plan of display) {
+      plan.repository.root = `https://github.com/${plan.repository.github_owner}/${plan.repository.github_repository}`;
+    }
+    outputPlans(display, options.format);
+    if (options.package && !plans.length) {
+      throw new Error(`package '${options.package}' was not found`);
+    }
+    if (command === "plan" || plans.length === 0) {
+      if (errors.length) {
+        throw new Error(
+          "some repositories could not be scanned; see scan errors",
+        );
+      }
+      if (!plans.length && options.format !== "json") {
+        console.log("No package findings require setup.");
+      }
+      return [];
+    }
+    if (options.execute) {
+      for (const item of items.filter((item) =>
+        plans.some(
+          (plan) => plan.repository.root === item.inspection.repository.root,
+        ),
+      )) {
+        try {
+          await (options.prepareRepository ?? prepareRepository)(item);
+        } catch (error) {
+          item.error = error.message;
+          console.error(`${item.repository}: ${item.error}`);
+          plans = plans.filter(
+            (plan) => plan.repository.root !== item.inspection.repository.root,
+          );
+        }
+      }
+      if (!plans.length) {
+        throw new Error(
+          "some repositories could not be prepared; see scan errors",
+        );
+      }
+    }
+    const secretRepositories = {};
+    for (const plan of plans) {
+      const provider = TOKEN_PROVIDERS[plan.registry];
+      if (provider) {
+        const config = JSON.parse(
+          await readFile(
+            path.join(plan.repository.root, ".package-registry-manager.json"),
+            "utf8",
+          ).catch((error) => {
+            if (error.code === "ENOENT") {
+              return "{}";
+            }
+            throw error;
+          }),
+        );
+        if (config.tokens?.[plan.registry]?.level === "repo") {
+          continue;
+        }
+        const slug = `${plan.repository.github_owner}/${plan.repository.github_repository}`;
+        const name = secretName(
+          options.secretName ??
+            config.tokens?.[plan.registry]?.secret ??
+            plan.package.token_secrets?.[0] ??
+            provider.secret,
+          plan.registry,
+          slug,
+        );
+        const targets = (secretRepositories[`${plan.registry}:${name}`] ??= []);
+        if (!targets.includes(slug)) {
+          targets.push(slug);
+        }
+      }
+    }
+    const outcomes = await (options.executePlans ?? executePlans)(
+      plans,
+      {
+        ...options,
+        github,
+        accountScan: true,
+        browser: options.openWith ? options.browser : "automated",
+        quietBrowser: true,
+        secretRepositories,
+        repository: items[0]?.inspection.repository.root,
+        workflow: options.planOptions?.workflow,
+        publisherEnvironment: options.planOptions?.publisherEnvironment,
+      },
+      true,
+    );
+    if (scan.repositories.some((item) => item.error)) {
+      throw new Error(
+        "some repositories could not be scanned; see scan errors",
+      );
+    }
+    return outcomes;
+  });
+}

package/src/publishing-policy.mjs

@@ -0,0 +1,46 @@
+/** Registry knowledge belongs to this consumer, never to gh-manager. */
+export const AUTH_FAILURE_PATTERNS = Object.freeze({
+  npm: [
+    "\\bENEEDAUTH\\b",
+    "\\bE401\\b",
+    "\\bE403\\b",
+    "invalid-publisher",
+    "E404.*PUT|PUT.*E404",
+    "Access token expired or revoked",
+  ],
+  "crates-io": [
+    "No Trusted Publishing config found",
+    "invalid-publisher",
+    "token.*(?:invalid|expired|revoked)",
+    "authentication failed",
+  ],
+  pypi: [
+    "invalid-publisher",
+    "invalid.*(?:token|authentication)",
+    "403.*Forbidden",
+  ],
+  rubygems: ["API key.*(?:invalid|expired)", "invalid-publisher"],
+  nuget: ["API key.*(?:invalid|expired)", "invalid-publisher"],
+  jsr: ["invalid-publisher", "publishing.*(?:unauthorized|permission)"],
+  "docker-hub": [
+    "unauthorized: authentication required",
+    "denied: requested access",
+    "incorrect username or password",
+  ],
+  "maven-central": [
+    "401.*Unauthorized",
+    "403.*Forbidden",
+    "Invalid user token",
+  ],
+  "vscode-marketplace": ["Invalid.*(?:PAT|token)", "TF400813", "VSCE_PAT"],
+  "open-vsx": ["Invalid access token", "token.*(?:expired|invalid)"],
+  "chrome-web-store": [
+    "invalid_grant",
+    "invalid_client",
+    "invalid.*refresh.token",
+  ],
+});
+
+export const RELEASE_FAILURE_PATTERNS = Object.freeze([
+  ...new Set(Object.values(AUTH_FAILURE_PATTERNS).flat()),
+]);

package/src/registry-state.mjs

@@ -23,6 +23,15 @@ const ENDPOINTS = {
     "PACKAGE_REGISTRY_MANAGER_DOCKER_HUB_API",
     "https://hub.docker.com/v2",
   ],
+  nuget: [
+    "PACKAGE_REGISTRY_MANAGER_NUGET_API",
+    "https://api.nuget.org/v3-flatcontainer",
+  ],
+  rubygems: [
+    "PACKAGE_REGISTRY_MANAGER_RUBYGEMS_API",
+    "https://rubygems.org/api/v1",
+  ],
+  jsr: ["PACKAGE_REGISTRY_MANAGER_JSR_API", "https://jsr.io"],
 };
 
 /** Returns the registry API base URL, honoring test overrides. */
@@ -54,6 +63,19 @@ export function registryStateUrl(packageInfo, env = process.env) {
       return `${base}/crates/${encodeURIComponent(name)}`;
     case "pypi":
       return `${base}/pypi/${encodeURIComponent(name)}/json`;
+    case "nuget":
+      return `${base}/${encodeURIComponent(name.toLowerCase())}/index.json`;
+    case "rubygems":
+      return `${base}/gems/${encodeURIComponent(name)}.json`;
+    case "jsr":
+      return `${base}/${name
+        .split("/")
+        .map((part) =>
+          part.startsWith("@")
+            ? `@${encodeURIComponent(part.slice(1))}`
+            : encodeURIComponent(part),
+        )
+        .join("/")}/meta.json`;
     default: {
       const [namespace, repository] = name.split("/");
       return `${base}/namespaces/${encodeURIComponent(namespace)}/repositories/${encodeURIComponent(repository)}`;

package/src/setup-batch.mjs

@@ -37,8 +37,27 @@ export async function executePlans(plans, options, summary = true) {
   if (plans.length === 0) {
     throw new Error("no publishable package manifests were found");
   }
+  const ready = [];
+  let blocked;
   for (const plan of plans) {
-    validatePlan(plan, options.execute);
+    try {
+      validatePlan(plan, options.execute);
+      ready.push(plan);
+    } catch (error) {
+      if (!options.accountScan) {
+        throw error;
+      }
+      blocked ??= error;
+      console.error(
+        `${plan.repository.github_owner}/${plan.repository.github_repository}: ${plan.registry}: ${plan.package.name}: blocked: ${error.message}`,
+      );
+    }
+  }
+  if (blocked) {
+    if (ready.length) {
+      await executePlans(ready, options, summary);
+    }
+    throw blocked;
   }
   for (const plan of plans) {
     if (plan.mode === "complete") {
@@ -68,6 +87,32 @@ export async function executePlans(plans, options, summary = true) {
     plan.steps.some((step) => step.id === "add-publishing-workflow"),
   );
   if (missing.length) {
+    if (options.accountScan) {
+      const outcomes = [];
+      for (const root of new Set(missing.map((plan) => plan.repository.root))) {
+        const group = missing.filter((plan) => plan.repository.root === root);
+        const result = await (options.offerWorkflow ?? offerWorkflow)(group, {
+          ...options,
+          repository: root,
+          inspection: undefined,
+          prompt: options.prompt ?? prompt,
+        });
+        outcomes.push(
+          ...group.map((plan) => ({
+            registry: plan.registry,
+            package: plan.package.name,
+            repository: `${plan.repository.github_owner}/${plan.repository.github_repository}`,
+            ...result,
+          })),
+        );
+      }
+      const ready = plans.filter((plan) => !missing.includes(plan));
+      if (ready.length) {
+        outcomes.push(...(await executePlans(ready, options, false)));
+      }
+      printSummary(outcomes, summary);
+      return outcomes;
+    }
     const result = await offerWorkflow(missing, {
       ...options,
       prompt: options.prompt ?? prompt,
@@ -99,6 +144,9 @@ export async function executePlans(plans, options, summary = true) {
     for (const plan of plans) {
       const session = new SetupSession(plan, {
         ...options,
+        repository: options.accountScan
+          ? plan.repository.root
+          : options.repository,
         automation,
         domains,
       });
@@ -107,6 +155,7 @@ export async function executePlans(plans, options, summary = true) {
         outcomes.push({
           registry: plan.registry,
           package: plan.package.name,
+          repository: `${plan.repository.github_owner}/${plan.repository.github_repository}`,
           status: plan.steps.length === 0 ? "complete" : "configured",
           ...session.outcome,
         });
@@ -119,7 +168,7 @@ export async function executePlans(plans, options, summary = true) {
           package: plan.package.name,
           status: "failed",
         });
-        failure = error;
+        failure ??= error;
       } finally {
         const steps = await session.cleanup({
           deferAuth: plans.length > 1,
@@ -130,7 +179,7 @@ export async function executePlans(plans, options, summary = true) {
           deferred.set(`${plan.registry}:${step.id}`, { session, step });
         }
       }
-      if (failure) {
+      if (failure && !options.accountScan) {
         break;
       }
     }
@@ -168,7 +217,7 @@ function printSummary(outcomes, enabled) {
     console.log("\nSetup summary:");
     for (const item of outcomes) {
       console.log(
-        `- ${item.registry}: ${item.package}: ${item.status}${item.url ? ` (${item.url})` : ""}`,
+        `- ${item.repository ? `${item.repository}: ` : ""}${item.registry}: ${item.package}: ${item.status}${item.secret_scope ? `; ${item.secret_scope} secret` : ""}${item.fallback_reason ? `; ${item.fallback_reason}` : ""}${item.url ? ` (${item.url})` : ""}`,
       );
     }
   }

package/src/setup.mjs

@@ -681,6 +681,7 @@ export class SetupSession {
    * `--browser-import default|auto` itself, once it knows a sign-in is missing.
    */
   async automatedPage(browser = this.options.browserOptions, quiet = false) {
+    quiet ||= this.options.quietBrowser;
     if (!this.automation) {
       const domains = this.options.domains ?? signInDomains(this.plan.registry);
       this.automation = await connectAutomation({