package-registry-manager 0.22.8 → 0.22.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.8",
+  "version": "0.22.9",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
-    "browser-commander": "0.27.0",
-    "command-stream": "^2.0.0",
+    "browser-commander": "^0.30.1",
+    "command-stream": "^2.0.2",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/flows.mjs

@@ -1,3 +1,4 @@
+import { RELEASE_RUN_FIELDS } from "./release-runs.mjs";
 import { credentialSteps } from "./credential-cycle.mjs";
 import { DEFAULT_TRUST_NPM, NPM_TFA_URL } from "./prerequisites.mjs";
 import {
@@ -186,9 +187,9 @@ function releaseRunSteps(context) {
   return [
     step(
       "inspect-release-run",
-      "Read the latest release run",
+      "Read the failed default-branch release run",
       "check",
-      "Look up the newest run of the release workflow; a run that npm rejected can be re-run once trust is attached.",
+      "Check push and workflow_dispatch runs on the default branch and prefer the newest failed publish or preflight job.",
       {
         command: command("gh", [
           "run",
@@ -196,10 +197,14 @@ function releaseRunSteps(context) {
           ...repo,
           "--workflow",
           context.workflow,
+          "--branch",
+          "{default_branch}",
+          "--event",
+          "push",
           "--limit",
-          "1",
+          "100",
           "--json",
-          "databaseId,conclusion,status,url",
+          RELEASE_RUN_FIELDS,
         ]),
         when: "trust-missing",
         cwd: ".",
@@ -209,7 +214,7 @@ function releaseRunSteps(context) {
       "read-release-failure",
       "Read why the release run failed",
       "check",
-      "Search the failed jobs' log for npm's E404 or invalid-publisher rejection.",
+      "Read the selected run's failed jobs for trusted-publishing or OIDC exchange rejection.",
       {
         command: command("gh", [
           "run",

package/src/release-runs.mjs

@@ -0,0 +1,117 @@
+import { repositorySlug } from "./repository-identity.mjs";
+
+export const RELEASE_RUN_FIELDS =
+  "databaseId,conclusion,status,url,headSha,headBranch,event,createdAt";
+/** Registry rejection of the workflow's trusted-publishing identity. */
+export const PUBLISH_REJECTED =
+  /\bE404\b|404 Not Found|invalid[-_ ]publisher|(?:npm|crates\.io|PyPI) refused the OIDC (?:package |token )?exchange\s*\((?:400|401|403|404)\)|trusted publisher[^\n]*(?:does not match|mismatch)|(?:invalid|unregistered)[-_ ](?:publishing[-_ ])?publisher/i;
+const PUBLISH_JOB = /(?:^|[^a-z])(?:publish(?:ing)?|preflight)(?:[^a-z]|$)/i;
+
+/** Only failed publish/preflight jobs (or failed publishing steps) qualify. */
+export function failedPublishingJob(jobs) {
+  return jobs.some(
+    (job) =>
+      job.conclusion === "failure" &&
+      (PUBLISH_JOB.test(job.name ?? "") ||
+        job.steps?.some(
+          (step) =>
+            step.conclusion === "failure" && PUBLISH_JOB.test(step.name ?? ""),
+        )),
+  );
+}
+
+/** Keep PRs, tags and other branches out even if a tool ignores its filters. */
+export function eligibleReleaseRuns(runs, branch) {
+  const unique = new Map();
+  for (const run of runs) {
+    if (
+      run.headBranch === branch &&
+      ["push", "workflow_dispatch"].includes(run.event)
+    ) {
+      unique.set(run.databaseId, run);
+    }
+  }
+  return [...unique.values()].sort(
+    (left, right) =>
+      String(right.createdAt).localeCompare(String(left.createdAt)) ||
+      Number(right.databaseId) - Number(left.databaseId),
+  );
+}
+
+/** Cache one selection so inspection and repair retry the same release. */
+export async function selectReleaseRun(session) {
+  if (session.releaseSelection) {
+    return session.releaseSelection;
+  }
+  const slug = repositorySlug(session.plan.repository);
+  const capture = (args) =>
+    session.capture({ command: { program: "gh", args }, cwd: "." });
+  const result = await capture([
+    "api",
+    `repos/${slug}`,
+    "--jq",
+    ".default_branch",
+  ]);
+  const branch = String(result.stdout ?? "").trim();
+  if (
+    result.code !== 0 ||
+    !branch ||
+    branch.startsWith("-") ||
+    /[\s:]/.test(branch)
+  ) {
+    throw new Error(
+      "could not determine the release workflow's default branch",
+    );
+  }
+  const runs = [];
+  // Each event gets its own bounded history, so PR traffic cannot hide releases.
+  for (const event of ["push", "workflow_dispatch"]) {
+    const list = await capture([
+      "run",
+      "list",
+      "--repo",
+      slug,
+      "--workflow",
+      session.plan.trusted_publisher.workflow,
+      "--branch",
+      branch,
+      "--event",
+      event,
+      "--limit",
+      "100",
+      "--json",
+      RELEASE_RUN_FIELDS,
+    ]);
+    if (list.code !== 0) {
+      throw new Error("could not list the release workflow runs");
+    }
+    runs.push(...JSON.parse(String(list.stdout || "[]")));
+  }
+  const eligible = eligibleReleaseRuns(runs, branch);
+  for (const run of eligible.filter((item) => item.conclusion === "failure")) {
+    const details = await capture([
+      "run",
+      "view",
+      String(run.databaseId),
+      "--repo",
+      slug,
+      "--json",
+      "jobs",
+    ]);
+    if (details.code !== 0) {
+      throw new Error("could not read the failed release jobs");
+    }
+    if (
+      failedPublishingJob(JSON.parse(String(details.stdout || "{}")).jobs ?? [])
+    ) {
+      session.releaseSelection = { run, publishFailure: true, branch };
+      return session.releaseSelection;
+    }
+  }
+  session.releaseSelection = {
+    run: eligible[0],
+    publishFailure: false,
+    branch,
+  };
+  return session.releaseSelection;
+}

package/src/repository-repair.mjs

@@ -1,3 +1,4 @@
+import { selectReleaseRun } from "./release-runs.mjs";
 import { pageFetchScript } from "./crates-api.mjs";
 import {
   publisherIdentities,
@@ -306,31 +307,11 @@ export async function runRepositoryRepair(session, step) {
     throw new Error("verify repository repairs before retrying release jobs");
   }
   const expected = repositorySlug(session.plan.repository);
-  const result = await session.capture({
-    command: {
-      program: "gh",
-      args: [
-        "run",
-        "list",
-        "--repo",
-        expected,
-        "--workflow",
-        session.plan.trusted_publisher.workflow,
-        "--limit",
-        "1",
-        "--json",
-        "databaseId,conclusion,headSha",
-      ],
-    },
-    cwd: ".",
-  });
-  if (result.code !== 0) {
-    throw new Error("could not inspect release jobs after repository repair");
-  }
-  const [run] = JSON.parse(result.stdout || "[]");
-  if (run?.conclusion !== "failure") {
+  const { run, publishFailure, branch } = await selectReleaseRun(session);
+  if (!publishFailure) {
     return;
   }
+  console.log(`  Selected failed release run: ${run.url}`);
   const { verifyRemoteManifest } = await import("./manifest-proposal.mjs");
   const corrected =
     Boolean(run.headSha) &&
@@ -363,10 +344,17 @@ export async function runRepositoryRepair(session, step) {
           session.plan.trusted_publisher.workflow,
           "--repo",
           expected,
+          "--ref",
+          branch,
         ],
       };
+  if (corrected) {
+    session.values ??= {};
+    session.values.failed_run_id = String(run.databaseId);
+  }
   await session.command({
     ...step,
+    id: corrected ? "rerun-release" : "retry-repaired-release",
     kind: "command",
     command,
     cwd: ".",

package/src/setup.mjs

@@ -33,6 +33,7 @@ import { packageDirectory } from "./plan.mjs";
 import { twoFactorMode } from "./prerequisites.mjs";
 import { getJson, probePackage } from "./registry-state.mjs";
 import { launchBrowser, signInDomains } from "./sign-in-import.mjs";
+import { PUBLISH_REJECTED, selectReleaseRun } from "./release-runs.mjs";
 import { runRepositoryRepair } from "./repository-repair.mjs";
 import {
   publisherIdentities,
@@ -54,8 +55,6 @@ const QUIET_CHECKS = new Set(["check-sign-in", "check-pages"]);
 const LISTED_PUBLISHER = /^\s*(?:id|type|file):\s*\S|"(?:id|type|file)"\s*:/m;
 /** What `npm trust github` prints once the registry stored the publisher. */
 const TRUST_CREATED = /Trust configuration created successfully/i;
-/** npm's answer when a workflow publishes without an attached trusted publisher. */
-const PUBLISH_REJECTED = /\bE404\b|404 Not Found|invalid-publisher/i;
 /** Where `--browser` opens URLs that need no automation. */
 export const BROWSER_MODES = ["default", "automated"];
 
@@ -245,6 +244,9 @@ export class SetupSession {
   }
 
   async check(step) {
+    if (step.id === "inspect-release-run") {
+      return this.inspectReleaseRun();
+    }
     const result = INTERACTIVE_CHECKS.has(step.id)
       ? await this.runProcess(step, false)
       : await this.capture(step);
@@ -273,14 +275,12 @@ export class SetupSession {
       case "check-2fa":
       case "verify-2fa":
         return this.checkTwoFactor(step, result);
-      case "inspect-release-run":
-        return this.inspectReleaseRun(result);
       case "read-release-failure":
         if (result.code !== 0) {
           console.error("warning: could not read the failed release log");
         } else if (PUBLISH_REJECTED.test(output)) {
           console.log(
-            "  It failed at publish: npm rejected the workflow (E404/invalid-publisher) because no trusted publisher is attached yet. After attaching trust, its failed jobs can be re-run.",
+            "  It failed at publish: the registry rejected the workflow's trusted publishing identity (OIDC/E404/invalid-publisher). After attaching trust, its failed jobs can be re-run.",
           );
           this.conditions.add("release-failed-publish");
         } else {
@@ -380,19 +380,24 @@ export class SetupSession {
     return pagesSettingsUrl(`${github_owner}/${github_repository}`);
   }
 
-  inspectReleaseRun(result) {
-    if (result.code !== 0) {
-      console.error("warning: could not list the release workflow runs");
+  async inspectReleaseRun() {
+    let selection;
+    try {
+      selection = await selectReleaseRun(this);
+    } catch (error) {
+      console.error(`warning: ${error.message}`);
       return;
     }
-    const [run] = JSON.parse(String(result.stdout || "[]"));
+    const { run, publishFailure } = selection;
     if (!run) {
       console.log("  The release workflow has not run yet.");
       return;
     }
     const outcome = run.conclusion || run.status;
-    console.log(`  The latest release run ${outcome}: ${run.url}`);
-    if (run.conclusion === "failure") {
+    console.log(
+      `  The ${publishFailure ? "selected failed" : "latest"} release run ${outcome}: ${run.url}`,
+    );
+    if (publishFailure) {
       this.values.failed_run_id = String(run.databaseId);
       this.conditions.add("release-failed");
     }
@@ -488,6 +493,11 @@ export class SetupSession {
       this.values.worktree = path.join(this.temporary, "worktree");
       this.values.pack_destination = this.temporary;
     }
+    if (step.id === "rerun-release" && this.releaseSelection?.run) {
+      console.log(
+        `  Re-running failed release jobs: ${this.releaseSelection.run.url}`,
+      );
+    }
     // Pack output is captured so npm's warnings can be reviewed.
     const result =
       step.id === "pack"