package-registry-manager 0.24.0 → 0.25.0

package/src/registry-state.mjs

@@ -1,3 +1,4 @@
+import { cratesPermit, delay, retryDelay } from "./request-policy.mjs";
 import {
   compareRepositories,
   identityCommand,
@@ -118,6 +119,14 @@ export async function probeRegistryState(inspection, options = {}) {
         if (state.trusted !== undefined) {
           packageInfo.trusted_publishing = state.trusted;
         }
+        for (const key of [
+          "registry_http_status",
+          "publisher_settings_reason",
+        ]) {
+          if (state[key] !== undefined) {
+            packageInfo[key] = state[key];
+          }
+        }
         const evidence = { ...packageInfo, ...state };
         if (state.configured_publishers !== undefined) {
           packageInfo.configured_publishers = state.configured_publishers;
@@ -184,9 +193,16 @@ export async function probePackage(packageInfo, options = {}) {
   if (!url) {
     return {};
   }
-  const document = await getJson(url, options);
+  let httpStatus;
+  const document = await getJson(url, {
+    ...options,
+    onError: (error) => {
+      httpStatus = error.http_status;
+      options.onError?.(error);
+    },
+  });
   if (document === undefined) {
-    return {};
+    return httpStatus ? { registry_http_status: httpStatus } : {};
   }
   if (document === null) {
     return packageInfo.registry === "docker-hub"
@@ -212,11 +228,15 @@ export async function probePackage(packageInfo, options = {}) {
         (document.versions ?? []).find(
           (item) => item.num === document.crate?.max_version,
         ) ?? document.versions?.[0];
-      const settings = await getJson(
-        `${registryEndpoint("crates-io", env)}/trusted_publishing/github_configs?crate=${encodeURIComponent(packageInfo.name)}`,
-        options,
-      );
+      const settings = options.cratesPublisherSettings
+        ? await getJson(
+            `${registryEndpoint("crates-io", env)}/trusted_publishing/github_configs?crate=${encodeURIComponent(packageInfo.name)}`,
+            options,
+          )
+        : undefined;
       return {
+        publisher_settings_reason:
+          "publisher settings require an authenticated crates.io session; public provenance is independent",
         exists: true,
         trusted: Boolean(latest?.trustpub_data),
         provenance_repositories: publisherIdentities(latest?.trustpub_data).map(
@@ -257,25 +277,42 @@ async function pypiProvenance(document, options) {
  */
 export async function getJson(url, options = {}) {
   const fetcher = options.fetch ?? globalThis.fetch;
+  const crates = new URL(url).hostname === "crates.io";
+  const attempts = crates ? 4 : 1;
   try {
-    const response = await fetcher(url, {
-      headers: { accept: "application/json", "user-agent": USER_AGENT },
-      signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
-    });
-    if (options.verbose) {
-      console.error(`GET ${url} -> ${response.status}`);
-    }
-    if (response.status === 404) {
-      return null;
-    }
-    if (!response.ok) {
-      options.onError?.({
-        stage: "registry",
-        message: `registry lookup returned HTTP ${response.status}`,
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      // Test fetches do not contact the service. An injected limiter can exercise pacing.
+      if (crates) {
+        await (options.requestLimiter ?? cratesPermit)();
+      }
+      const response = await fetcher(url, {
+        headers: { accept: "application/json", "user-agent": USER_AGENT },
+        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
       });
-      return undefined;
+      if (options.verbose) {
+        console.error(
+          `GET ${url} -> ${response.status} (attempt ${attempt + 1})`,
+        );
+      }
+      if ([403, 429].includes(response.status) && attempt + 1 < attempts) {
+        const wait = retryDelay(response.headers?.get("retry-after"), attempt);
+        await response.body?.cancel();
+        await (options.sleep ?? delay)(wait);
+        continue;
+      }
+      if (response.status === 404) {
+        return null;
+      }
+      if (!response.ok) {
+        options.onError?.({
+          stage: "registry",
+          http_status: response.status,
+          message: `registry lookup returned HTTP ${response.status}`,
+        });
+        return undefined;
+      }
+      return await response.json();
     }
-    return await response.json();
   } catch (error) {
     options.onError?.({
       stage: "registry",
@@ -284,6 +321,6 @@ export async function getJson(url, options = {}) {
     if (options.verbose) {
       console.error(`GET ${url} failed: ${error.message}`);
     }
-    return undefined;
   }
+  return undefined;
 }

package/src/request-policy.mjs

@@ -0,0 +1,27 @@
+/** A queue shared by every client in this process. Request starts are >=1s apart. */
+export function createRequestLimiter({ now = Date.now, sleep = delay } = {}) {
+  let queue = Promise.resolve();
+  let next = 0;
+  return () => {
+    const permit = queue.then(async () => {
+      const wait = next - now();
+      if (wait > 0) {
+        await sleep(wait);
+      }
+      next = now() + 1000;
+    });
+    queue = permit.catch(() => {});
+    return permit;
+  };
+}
+export const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export const cratesPermit = createRequestLimiter();
+
+/** Retry-After supports delay seconds and HTTP dates. Never retry early. */
+export function retryDelay(value, attempt, now = Date.now()) {
+  const seconds = value !== null && value !== undefined ? Number(value) : NaN;
+  const until = Number.isFinite(seconds)
+    ? seconds * 1000
+    : Date.parse(value) - now;
+  return Math.max(1000 * 2 ** attempt, Number.isFinite(until) ? until : 0);
+}

package/src/setup.mjs

@@ -695,23 +695,30 @@ export class SetupSession {
       }
       return;
     }
-    await (await this.automatedPage()).goto(url);
+    await (await this.visiblePage()).goto(url);
   }
 
   /**
    * The automated page, launched once. The crates.io sign-in step offers
    * `--browser-import default|auto` itself, once it knows a sign-in is missing.
    */
-  async automatedPage(browser = this.options.browserOptions, quiet = false) {
+  async automatedPage(
+    browser = this.options.browserOptions,
+    quiet = false,
+    headless = false,
+  ) {
     quiet ||= this.options.quietBrowser;
     if (!this.automation) {
       const domains = this.options.domains ?? signInDomains(this.plan.registry);
-      this.automation = await connectAutomation({
+      this.automation = await (
+        this.options.connectAutomation ?? connectAutomation
+      )({
         browser: await launchBrowser(browser, domains, {
           deferred: this.plan.registry === "crates-io",
           verbose: quiet ? false : this.options.verbose,
           ...this.options.importDiscovery,
         }),
+        headless,
         profile: this.options.browserProfile,
         verbose: quiet ? false : this.options.verbose,
         domains,
@@ -720,6 +727,15 @@ export class SetupSession {
     return this.automation;
   }
 
+  /** Bring authentication and approval work into a visible browser. */
+  async visiblePage() {
+    if (this.automation?.headless) {
+      await this.automation.close();
+      this.automation = null;
+    }
+    return this.automatedPage();
+  }
+
   /** Relaunches the automated browser with other options, such as an import. */
   async reconnect(browser) {
     await this.automation?.close();

package/src/source-code.mjs

@@ -54,6 +54,8 @@ export function commandPosition(prefix) {
       segment,
     ) ||
     /(?:\$|shell)\s*`\s*$/.test(segment) ||
+    /^(?:export\s+)?\w+=`\s*$/.test(segment) ||
+    /\$\(\s*$/.test(segment) ||
     /(?:exec(?:Sync)?|spawn(?:Sync)?|run(?:_command)?|system|check_call|check_output|Popen)\s*\(\s*["'`]\s*$/.test(
       segment,
     )

package/src/tokens.mjs

@@ -81,11 +81,13 @@ export function reportTokenSecrets(output, packageInfo) {
   const { inUse, leftover } = auditRegistryTokens(output, packageInfo);
   for (const name of inUse) {
     console.log(
-      `  ${name} is still read by a workflow; switch that workflow to trusted publishing before deleting it.`,
+      `  ${name} is still read by a workflow; retained for authentication fallback.`,
     );
   }
   for (const name of leftover) {
-    console.log(`  ${name} is no longer needed with trusted publishing.`);
+    console.log(
+      `  ${name} is unused by workflows; retained unless cleanup is explicitly requested.`,
+    );
   }
   return leftover;
 }

package/src/webdriver-automation.mjs

@@ -36,7 +36,7 @@ export function bidiCookie(cookie) {
 
 /** Launches the selected installed Firefox variant and exposes the common page API. */
 export async function connectWebDriverAutomation(
-  { browser, profile, verbose, domains },
+  { browser, profile, verbose, domains, headless = false },
   dependencies = {},
 ) {
   // Validation happens before profile creation, including programmatic callers.
@@ -65,7 +65,7 @@ export async function connectWebDriverAutomation(
     browser: "firefox",
     executablePath,
     userDataDir: profile,
-    headless: false,
+    headless,
     bidi: true,
     verbose,
   });
@@ -101,6 +101,7 @@ export async function connectWebDriverAutomation(
     );
   }
   return {
+    headless,
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
     close: () => connection.close(),

package/src/workflow-fallback.mjs

@@ -0,0 +1,125 @@
+/** OIDC runs first. A separate retry receives credentials only after that attempt fails. */
+export function fallbackSteps(
+  step,
+  registry,
+  names,
+  level,
+  index,
+  removeCredentials,
+) {
+  const prefix = " ".repeat(level + 2);
+  const originalId = step
+    .map((line) => /^\s*(?:-\s*)?id:\s*([\w-]+)/.exec(line)?.[1])
+    .find(Boolean);
+  const id = originalId ?? `prm_oidc_${index + 1}`;
+  let oidc = removeCredentials(
+    step,
+    new Set([...names, ...(registry === "pypi" ? ["password", "user"] : [])]),
+  );
+  oidc = oidc.filter((line) => !/^\s*continue-on-error:/.test(line));
+  if (!originalId) {
+    oidc.push(`${prefix}id: ${id}`);
+  }
+  oidc.push(`${prefix}continue-on-error: true`);
+  const title = oidc.findIndex((line) => /^\s*(?:-\s*)?name:/.test(line));
+  if (title >= 0) {
+    oidc[title] = appendTitle(oidc[title], "OIDC");
+  } else {
+    oidc.push(`${prefix}name: Publish through OIDC`);
+  }
+  // Normalize a dash-prefixed id/condition so removing it keeps a valid step.
+  const normalized = [...step];
+  if (/^\s*-\s+(?:if|id|continue-on-error):/.test(normalized[0])) {
+    normalized[0] = normalized[0].replace(/- /, "  ");
+    const next = normalized.findIndex(
+      (line, index) => index > 0 && line.search(/\S/) === level + 2,
+    );
+    if (next >= 0) {
+      normalized[next] =
+        `${" ".repeat(level)}- ${normalized[next].trimStart()}`;
+    }
+  }
+  const fallback = normalized.filter(
+    (line) => !/^\s*(?:if|id|continue-on-error):/.test(line),
+  );
+  // Remove a multiline condition together with its continuation lines.
+  const condition = step.findIndex((line) => /^\s*if:/.test(line));
+  if (condition >= 0 && /if:\s*[>|]/.test(step[condition])) {
+    for (
+      let i = condition + 1;
+      i < step.length && step[i].search(/\S/) > level + 2;
+      i++
+    ) {
+      const at = fallback.indexOf(step[i]);
+      if (at >= 0) {
+        fallback.splice(at, 1);
+      }
+    }
+  }
+  const fallbackTitle = fallback.findIndex((line) =>
+    /^\s*(?:-\s*)?name:/.test(line),
+  );
+  if (fallbackTitle >= 0) {
+    fallback[fallbackTitle] = appendTitle(
+      fallback[fallbackTitle],
+      "token fallback",
+    );
+  } else {
+    fallback.push(`${prefix}name: Publish with token fallback`);
+  }
+  fallback.push(
+    `${prefix}if: steps.${id}.outcome == 'failure'`,
+    `${prefix}id: ${id}_fallback`,
+  );
+  if (registry === "pypi") {
+    const cleaned = removeCredentials(fallback, new Set(["password", "user"]));
+    const withIndex = cleaned.findIndex((line) => /^\s*with:\s*$/.test(line));
+    const password = `${prefix}  password: \${{ secrets.PYPI_API_TOKEN || secrets.PYPI_TOKEN }}`;
+    if (withIndex < 0) {
+      cleaned.push(`${prefix}with:`, password);
+    } else {
+      cleaned.splice(withIndex + 1, 0, password);
+    }
+    return [oidc, ["", ...cleaned]];
+  }
+  const env = (lines, value) => {
+    const updated = removeCredentials(
+      lines,
+      new Set([...names, "NODE_AUTH_TOKEN", "NPM_CONFIG_PROVENANCE"]),
+    );
+    const at = updated.findIndex((line) => /^\s*env:\s*$/.test(line));
+    const entries = [...new Set(["NODE_AUTH_TOKEN", ...names])].map(
+      (name) => `${prefix}  ${name}: ${value}`,
+    );
+    entries.push(`${prefix}  NPM_CONFIG_PROVENANCE: 'true'`);
+    if (at < 0) {
+      updated.push(`${prefix}env:`, ...entries);
+    } else {
+      updated.splice(at + 1, 0, ...entries);
+    }
+    return updated;
+  };
+  oidc = env(oidc, "''");
+  return [
+    oidc,
+    [
+      "",
+      ...env(
+        fallback,
+        "${{ secrets.NPM_TOKEN || secrets.NODE_AUTH_TOKEN || secrets.NPM_AUTH_TOKEN }}",
+      ),
+    ],
+  ];
+}
+
+function appendTitle(line, suffix) {
+  const value = line.slice(line.indexOf("name:") + "name:".length).trimStart();
+  const key = line.slice(0, line.length - value.length);
+  const quote = value[0];
+  return (
+    key +
+    ((quote === "'" || quote === '"') && value.endsWith(quote)
+      ? `${value.slice(0, -1)} (${suffix})${quote}`
+      : `${value} (${suffix})`)
+  );
+}