package-registry-manager 0.22.7 → 0.22.9

package/src/organization-scan.mjs

@@ -0,0 +1,259 @@
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { inspectRepository } from "./discovery.mjs";
+import { githubServices } from "./github.mjs";
+import { probeRegistryState } from "./registry-state.mjs";
+import { RELEASE_FAILURE_PATTERNS } from "./publishing-policy.mjs";
+import { credentialPolicy } from "./credential-cycle.mjs";
+import { identityCommand } from "./repository-identity.mjs";
+
+/** Only files used by existing discovery; no full repository clones for scans. */
+export const SCAN_MATCHES = [
+  ...[
+    "package.json",
+    "Cargo.toml",
+    "pyproject.toml",
+    "setup.py",
+    "go.mod",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "composer.json",
+    "jsr.json",
+    "deno.json",
+    "*.csproj",
+    "*.fsproj",
+    "*.vbproj",
+    "*.gemspec",
+    "Dockerfile*",
+    "Containerfile*",
+    "docker-compose*.yml",
+    "docker-compose*.yaml",
+    "compose*.yml",
+    "compose*.yaml",
+  ].map((name) => `**/${name}`),
+  ".github/workflows/*.yml",
+  ".github/workflows/*.yaml",
+  ".package-registry-manager.json",
+];
+
+export function packageFindings(inspection) {
+  const slug = `${inspection.repository.github_owner}/${inspection.repository.github_repository}`;
+  return inspection.packages
+    .filter((item) => item.publishable)
+    .flatMap((item) => {
+      const common = {
+        repository: slug,
+        registry: item.registry,
+        package: item.name,
+        manifest: item.manifest,
+      };
+      const findings = [];
+      if (item.exists_on_registry === false) {
+        findings.push({ ...common, type: "unpublished" });
+      }
+      if (
+        item.exists_on_registry === true &&
+        (item.trusted_publishing === false ||
+          credentialPolicy(item.registry).mode === "token")
+      ) {
+        findings.push({
+          ...common,
+          type: "published-without-trusted-publishing",
+        });
+      }
+      const others = (item.configured_publishers ?? []).filter(
+        (publisher) =>
+          publisher.repository.toLowerCase() !== slug.toLowerCase(),
+      );
+      if (others.length) {
+        findings.push({
+          ...common,
+          type: "trusted-publisher-other-repository",
+          evidence: others,
+        });
+      }
+      return findings;
+    });
+}
+
+async function writeSnapshot(root, slug, files) {
+  for (const file of files) {
+    if (
+      typeof file.path !== "string" ||
+      file.path.includes("\\") ||
+      file.path.includes(":") ||
+      file.path
+        .split("/")
+        .some(
+          (part) => !part || part === "." || part === ".." || part === ".git",
+        )
+    ) {
+      throw new Error("unsafe repository file path");
+    }
+    if (typeof file.content !== "string") {
+      throw new Error("gh-manager returned no file content");
+    }
+    const target = path.join(root, file.path);
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, file.content);
+  }
+  await mkdir(path.join(root, ".git"), { recursive: true });
+  await writeFile(
+    path.join(root, ".git/config"),
+    `[remote "origin"]\n  url = https://github.com/${slug}.git\n`,
+  );
+}
+
+/** Keep snapshots alive only for the callback; cleanup also runs after errors. */
+export async function withAccountScan(options, callback) {
+  if (
+    Boolean(options.org) === Boolean(options.user) ||
+    !/^[\w.-]+$/.test(options.org ?? options.user)
+  ) {
+    throw new Error("choose exactly one valid --org or --user");
+  }
+  const github = options.github ?? githubServices(options);
+  const directory = await mkdtemp(path.join(os.tmpdir(), "prm-account-"));
+  try {
+    const repositories = await github.repos.list({
+      org: options.org,
+      user: options.user,
+    });
+    const scan = {
+      schema_version: 1,
+      account: options.org ?? options.user,
+      repositories: [],
+      findings: [],
+    };
+    for (const [index, repo] of repositories.entries()) {
+      const slug = repo.full_name;
+      if (!/^[\w.-]+\/[\w.-]+$/.test(slug)) {
+        throw new Error("gh-manager returned an invalid repository name");
+      }
+      try {
+        const root = path.join(directory, String(index));
+        await writeSnapshot(
+          root,
+          slug,
+          await github.repos.files(slug, {
+            match: SCAN_MATCHES,
+            content: true,
+            ref: repo.default_branch,
+          }),
+        );
+        const discovered = await inspectRepository(root, {
+          includeSkipped: options.verbose,
+        });
+        const inspection = options.offline
+          ? discovered
+          : await (options.probe ?? probeRegistryState)(discovered, {
+              ...options,
+              runIdentity: async (program, args) =>
+                program === "gh"
+                  ? slug
+                  : identityCommand(program, args, {
+                      ...options,
+                      repository: root,
+                    }),
+              repository: root,
+            });
+        scan.repositories.push({
+          repository: slug,
+          default_branch: repo.default_branch,
+          inspection,
+        });
+        scan.findings.push(...packageFindings(inspection));
+      } catch (error) {
+        scan.repositories.push({ repository: slug, error: error.message });
+      }
+    }
+    if (!options.offline) {
+      let failures;
+      if (options.org) {
+        failures = await github.runs.failures({
+          org: options.org,
+          grep: RELEASE_FAILURE_PATTERNS,
+        });
+      } else {
+        failures = [];
+        for (const repo of repositories) {
+          const [latest] = await github.runs.list(repo.full_name, {
+            branch: repo.default_branch,
+            limit: 1,
+          });
+          if (latest?.conclusion === "failure") {
+            const matches = await github.runs.logs(latest.id, {
+              repo: repo.full_name,
+              grep: RELEASE_FAILURE_PATTERNS,
+            });
+            if (matches.length) {
+              failures.push({
+                repository: repo.full_name,
+                runUrl: latest.html_url,
+                matches,
+              });
+            }
+          }
+        }
+      }
+      scan.findings.push(
+        ...failures.map((evidence) => ({
+          repository: evidence.repository,
+          type: "release-failing",
+          evidence,
+        })),
+      );
+    }
+    return await callback(scan, github);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+
+export async function scanRepositories(options) {
+  return withAccountScan(options, (scan) => {
+    for (const item of scan.repositories) {
+      if (item.inspection) {
+        item.inspection.repository.root = `https://github.com/${item.repository}`;
+      }
+    }
+    return scan;
+  });
+}
+
+export function renderScan(scan) {
+  const rows = ["Repository\tRegistry\tPackage\tFinding"];
+  for (const item of scan.findings) {
+    rows.push(
+      `${item.repository}\t${item.registry ?? "-"}\t${item.package ?? "-"}\t${item.type.replaceAll("-", " ")}`,
+    );
+  }
+  for (const item of scan.repositories.filter((repo) => repo.error)) {
+    rows.push(`${item.repository}\t-\t-\tscan failed: ${item.error}`);
+  }
+  for (const repo of scan.repositories) {
+    for (const pkg of repo.inspection?.packages ?? []) {
+      if (
+        !pkg.publishable ||
+        scan.findings.some(
+          (finding) =>
+            finding.repository === repo.repository &&
+            finding.package === pkg.name &&
+            finding.registry === pkg.registry,
+        )
+      ) {
+        continue;
+      }
+      const status =
+        pkg.exists_on_registry === undefined
+          ? "registry state unknown"
+          : pkg.trusted_publishing === true
+            ? "published with trusted publishing"
+            : "published; trusted publishing unknown";
+      rows.push(`${repo.repository}\t${pkg.registry}\t${pkg.name}\t${status}`);
+    }
+  }
+  return `${rows.join("\n")}\n`;
+}

package/src/organization-setup.mjs

@@ -0,0 +1,203 @@
+import { spawnSync } from "node:child_process";
+import { readFile, rm, stat } from "node:fs/promises";
+import path from "node:path";
+import { withAccountScan, renderScan } from "./organization-scan.mjs";
+import { buildPlans } from "./plan.mjs";
+import { probeEnvironment } from "./prerequisites.mjs";
+import { executePlans } from "./setup-batch.mjs";
+import { secretName } from "./ci-credential-cycle.mjs";
+import { TOKEN_PROVIDERS } from "./credential-browser.mjs";
+
+async function prepareRepository(item) {
+  const root = item.inspection.repository.root;
+  await rm(`${root}/.git`, { recursive: true, force: true });
+  const commands = [
+    ["init", "--quiet"],
+    ["remote", "add", "origin", `https://github.com/${item.repository}.git`],
+    ["fetch", "--quiet", "--depth=1", "origin", item.default_branch],
+    ["checkout", "--quiet", "--force", "--detach", "FETCH_HEAD"],
+  ];
+  for (const args of commands) {
+    const result = spawnSync("git", args, { cwd: root, stdio: "pipe" });
+    if (result.status !== 0) {
+      throw new Error(`cannot prepare ${item.repository} for setup`);
+    }
+  }
+}
+
+/** Plan from API snapshots; fetch worktrees only for repositories being changed. */
+export async function accountCommand(command, options, outputPlans) {
+  return withAccountScan(options, async (scan, github) => {
+    if (command === "inspect") {
+      for (const item of scan.repositories) {
+        if (item.inspection) {
+          item.inspection.repository.root = `https://github.com/${item.repository}`;
+        }
+      }
+      process.stdout.write(
+        options.format === "json"
+          ? `${JSON.stringify(scan, null, 2)}\n`
+          : renderScan(scan),
+      );
+      return scan;
+    }
+    const items = scan.repositories.filter((item) => item.inspection);
+    const errors = scan.repositories.filter((item) => item.error);
+    if (errors.length) {
+      console.error(renderScan({ repositories: errors, findings: [] }));
+    }
+    for (const item of items) {
+      const workflow = options.planOptions?.workflow;
+      if (workflow !== undefined) {
+        if (!/^[\w.-]+\.ya?ml$/.test(workflow)) {
+          throw new Error(
+            "--workflow must be a workflow file name in .github/workflows",
+          );
+        }
+        if (
+          !options.planOptions.addPublishJob &&
+          !(await stat(
+            path.join(
+              item.inspection.repository.root,
+              ".github/workflows",
+              workflow,
+            ),
+          ).then(
+            (metadata) => metadata.isFile(),
+            () => false,
+          ))
+        ) {
+          throw new Error(
+            `--workflow: ${item.repository} has no .github/workflows/${workflow}`,
+          );
+        }
+      }
+    }
+    const packages = items.flatMap((item) => item.inspection.packages);
+    const environment = await (options.probeEnvironment ?? probeEnvironment)({
+      offline: options.offline,
+      verbose: options.verbose,
+      npm: packages.some((item) => item.registry === "npm"),
+      python: packages.some((item) => item.registry === "pypi"),
+    });
+    let plans = items
+      .flatMap((item) => {
+        const relevant = scan.findings.filter(
+          (finding) => finding.repository === item.repository,
+        );
+        const inspection = {
+          ...item.inspection,
+          packages: item.inspection.packages.filter(
+            (pkg) =>
+              (!options.package || pkg.name === options.package) &&
+              (command === "plan" ||
+                relevant.some(
+                  (finding) => !finding.package || finding.package === pkg.name,
+                )),
+          ),
+        };
+        return buildPlans(inspection, options.registries ?? [], {
+          ...options.planOptions,
+          environment,
+        }).filter((plan) => plan.package.publishable);
+      })
+      .sort(
+        (a, b) => Number(b.registry === "npm") - Number(a.registry === "npm"),
+      );
+    const display = structuredClone(plans);
+    for (const plan of display) {
+      plan.repository.root = `https://github.com/${plan.repository.github_owner}/${plan.repository.github_repository}`;
+    }
+    outputPlans(display, options.format);
+    if (options.package && !plans.length) {
+      throw new Error(`package '${options.package}' was not found`);
+    }
+    if (command === "plan" || plans.length === 0) {
+      if (errors.length) {
+        throw new Error(
+          "some repositories could not be scanned; see scan errors",
+        );
+      }
+      if (!plans.length && options.format !== "json") {
+        console.log("No package findings require setup.");
+      }
+      return [];
+    }
+    if (options.execute) {
+      for (const item of items.filter((item) =>
+        plans.some(
+          (plan) => plan.repository.root === item.inspection.repository.root,
+        ),
+      )) {
+        try {
+          await (options.prepareRepository ?? prepareRepository)(item);
+        } catch (error) {
+          item.error = error.message;
+          console.error(`${item.repository}: ${item.error}`);
+          plans = plans.filter(
+            (plan) => plan.repository.root !== item.inspection.repository.root,
+          );
+        }
+      }
+      if (!plans.length) {
+        throw new Error(
+          "some repositories could not be prepared; see scan errors",
+        );
+      }
+    }
+    const secretRepositories = {};
+    for (const plan of plans) {
+      const provider = TOKEN_PROVIDERS[plan.registry];
+      if (provider) {
+        const config = JSON.parse(
+          await readFile(
+            path.join(plan.repository.root, ".package-registry-manager.json"),
+            "utf8",
+          ).catch((error) => {
+            if (error.code === "ENOENT") {
+              return "{}";
+            }
+            throw error;
+          }),
+        );
+        if (config.tokens?.[plan.registry]?.level === "repo") {
+          continue;
+        }
+        const slug = `${plan.repository.github_owner}/${plan.repository.github_repository}`;
+        const name = secretName(
+          options.secretName ??
+            config.tokens?.[plan.registry]?.secret ??
+            plan.package.token_secrets?.[0] ??
+            provider.secret,
+          plan.registry,
+          slug,
+        );
+        const targets = (secretRepositories[`${plan.registry}:${name}`] ??= []);
+        if (!targets.includes(slug)) {
+          targets.push(slug);
+        }
+      }
+    }
+    const outcomes = await (options.executePlans ?? executePlans)(
+      plans,
+      {
+        ...options,
+        github,
+        accountScan: true,
+        browser: options.openWith ? options.browser : "automated",
+        quietBrowser: true,
+        secretRepositories,
+        repository: items[0]?.inspection.repository.root,
+        workflow: options.planOptions?.workflow,
+        publisherEnvironment: options.planOptions?.publisherEnvironment,
+      },
+      true,
+    );
+    if (scan.repositories.some((item) => item.error)) {
+      throw new Error(
+        "some repositories could not be scanned; see scan errors",
+      );
+    }
+    return outcomes;
+  });
+}

package/src/publishing-policy.mjs

@@ -0,0 +1,46 @@
+/** Registry knowledge belongs to this consumer, never to gh-manager. */
+export const AUTH_FAILURE_PATTERNS = Object.freeze({
+  npm: [
+    "\\bENEEDAUTH\\b",
+    "\\bE401\\b",
+    "\\bE403\\b",
+    "invalid-publisher",
+    "E404.*PUT|PUT.*E404",
+    "Access token expired or revoked",
+  ],
+  "crates-io": [
+    "No Trusted Publishing config found",
+    "invalid-publisher",
+    "token.*(?:invalid|expired|revoked)",
+    "authentication failed",
+  ],
+  pypi: [
+    "invalid-publisher",
+    "invalid.*(?:token|authentication)",
+    "403.*Forbidden",
+  ],
+  rubygems: ["API key.*(?:invalid|expired)", "invalid-publisher"],
+  nuget: ["API key.*(?:invalid|expired)", "invalid-publisher"],
+  jsr: ["invalid-publisher", "publishing.*(?:unauthorized|permission)"],
+  "docker-hub": [
+    "unauthorized: authentication required",
+    "denied: requested access",
+    "incorrect username or password",
+  ],
+  "maven-central": [
+    "401.*Unauthorized",
+    "403.*Forbidden",
+    "Invalid user token",
+  ],
+  "vscode-marketplace": ["Invalid.*(?:PAT|token)", "TF400813", "VSCE_PAT"],
+  "open-vsx": ["Invalid access token", "token.*(?:expired|invalid)"],
+  "chrome-web-store": [
+    "invalid_grant",
+    "invalid_client",
+    "invalid.*refresh.token",
+  ],
+});
+
+export const RELEASE_FAILURE_PATTERNS = Object.freeze([
+  ...new Set(Object.values(AUTH_FAILURE_PATTERNS).flat()),
+]);

package/src/registry-state.mjs

@@ -23,6 +23,15 @@ const ENDPOINTS = {
     "PACKAGE_REGISTRY_MANAGER_DOCKER_HUB_API",
     "https://hub.docker.com/v2",
   ],
+  nuget: [
+    "PACKAGE_REGISTRY_MANAGER_NUGET_API",
+    "https://api.nuget.org/v3-flatcontainer",
+  ],
+  rubygems: [
+    "PACKAGE_REGISTRY_MANAGER_RUBYGEMS_API",
+    "https://rubygems.org/api/v1",
+  ],
+  jsr: ["PACKAGE_REGISTRY_MANAGER_JSR_API", "https://jsr.io"],
 };
 
 /** Returns the registry API base URL, honoring test overrides. */
@@ -54,6 +63,19 @@ export function registryStateUrl(packageInfo, env = process.env) {
       return `${base}/crates/${encodeURIComponent(name)}`;
     case "pypi":
       return `${base}/pypi/${encodeURIComponent(name)}/json`;
+    case "nuget":
+      return `${base}/${encodeURIComponent(name.toLowerCase())}/index.json`;
+    case "rubygems":
+      return `${base}/gems/${encodeURIComponent(name)}.json`;
+    case "jsr":
+      return `${base}/${name
+        .split("/")
+        .map((part) =>
+          part.startsWith("@")
+            ? `@${encodeURIComponent(part.slice(1))}`
+            : encodeURIComponent(part),
+        )
+        .join("/")}/meta.json`;
     default: {
       const [namespace, repository] = name.split("/");
       return `${base}/namespaces/${encodeURIComponent(namespace)}/repositories/${encodeURIComponent(repository)}`;

package/src/release-runs.mjs

@@ -0,0 +1,117 @@
+import { repositorySlug } from "./repository-identity.mjs";
+
+export const RELEASE_RUN_FIELDS =
+  "databaseId,conclusion,status,url,headSha,headBranch,event,createdAt";
+/** Registry rejection of the workflow's trusted-publishing identity. */
+export const PUBLISH_REJECTED =
+  /\bE404\b|404 Not Found|invalid[-_ ]publisher|(?:npm|crates\.io|PyPI) refused the OIDC (?:package |token )?exchange\s*\((?:400|401|403|404)\)|trusted publisher[^\n]*(?:does not match|mismatch)|(?:invalid|unregistered)[-_ ](?:publishing[-_ ])?publisher/i;
+const PUBLISH_JOB = /(?:^|[^a-z])(?:publish(?:ing)?|preflight)(?:[^a-z]|$)/i;
+
+/** Only failed publish/preflight jobs (or failed publishing steps) qualify. */
+export function failedPublishingJob(jobs) {
+  return jobs.some(
+    (job) =>
+      job.conclusion === "failure" &&
+      (PUBLISH_JOB.test(job.name ?? "") ||
+        job.steps?.some(
+          (step) =>
+            step.conclusion === "failure" && PUBLISH_JOB.test(step.name ?? ""),
+        )),
+  );
+}
+
+/** Keep PRs, tags and other branches out even if a tool ignores its filters. */
+export function eligibleReleaseRuns(runs, branch) {
+  const unique = new Map();
+  for (const run of runs) {
+    if (
+      run.headBranch === branch &&
+      ["push", "workflow_dispatch"].includes(run.event)
+    ) {
+      unique.set(run.databaseId, run);
+    }
+  }
+  return [...unique.values()].sort(
+    (left, right) =>
+      String(right.createdAt).localeCompare(String(left.createdAt)) ||
+      Number(right.databaseId) - Number(left.databaseId),
+  );
+}
+
+/** Cache one selection so inspection and repair retry the same release. */
+export async function selectReleaseRun(session) {
+  if (session.releaseSelection) {
+    return session.releaseSelection;
+  }
+  const slug = repositorySlug(session.plan.repository);
+  const capture = (args) =>
+    session.capture({ command: { program: "gh", args }, cwd: "." });
+  const result = await capture([
+    "api",
+    `repos/${slug}`,
+    "--jq",
+    ".default_branch",
+  ]);
+  const branch = String(result.stdout ?? "").trim();
+  if (
+    result.code !== 0 ||
+    !branch ||
+    branch.startsWith("-") ||
+    /[\s:]/.test(branch)
+  ) {
+    throw new Error(
+      "could not determine the release workflow's default branch",
+    );
+  }
+  const runs = [];
+  // Each event gets its own bounded history, so PR traffic cannot hide releases.
+  for (const event of ["push", "workflow_dispatch"]) {
+    const list = await capture([
+      "run",
+      "list",
+      "--repo",
+      slug,
+      "--workflow",
+      session.plan.trusted_publisher.workflow,
+      "--branch",
+      branch,
+      "--event",
+      event,
+      "--limit",
+      "100",
+      "--json",
+      RELEASE_RUN_FIELDS,
+    ]);
+    if (list.code !== 0) {
+      throw new Error("could not list the release workflow runs");
+    }
+    runs.push(...JSON.parse(String(list.stdout || "[]")));
+  }
+  const eligible = eligibleReleaseRuns(runs, branch);
+  for (const run of eligible.filter((item) => item.conclusion === "failure")) {
+    const details = await capture([
+      "run",
+      "view",
+      String(run.databaseId),
+      "--repo",
+      slug,
+      "--json",
+      "jobs",
+    ]);
+    if (details.code !== 0) {
+      throw new Error("could not read the failed release jobs");
+    }
+    if (
+      failedPublishingJob(JSON.parse(String(details.stdout || "{}")).jobs ?? [])
+    ) {
+      session.releaseSelection = { run, publishFailure: true, branch };
+      return session.releaseSelection;
+    }
+  }
+  session.releaseSelection = {
+    run: eligible[0],
+    publishFailure: false,
+    branch,
+  };
+  return session.releaseSelection;
+}