package-registry-manager 0.25.0 → 0.25.1

package/README.md

@@ -77,3 +77,8 @@ OIDC publication and verification that no workflow still uses the credentials.
 Saved crates.io API sessions run headlessly; sign-in opens a visible window only
 when user action is needed. Organization migration skips and reports scan errors
 while continuing for clean repositories.
+
+NuGet setup uses an explicit login profile, package owner and exact package IDs.
+Trusted publishing is preferred; existing provided fallback credentials are retained.
+See [audit and NuGet configuration](../docs/issue-73-requirements.md) for setup,
+identity decisions and the distinction between verified configuration and release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,7 +40,7 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/293e9a8ab9d6d91a08e95f4e09c2a0dcad9bc809",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/0b3ceb1590be7eb0340ae088730698b5ae9bebfc",
     "browser-commander": "^0.34.0",
     "command-stream": "^2.6.0",
     "playwright": "^1.63.0",

package/src/audit-config.mjs

@@ -0,0 +1,96 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** Explicit source decisions supplement static discovery without executing build files. */
+export async function auditConfig(root) {
+  const config = JSON.parse(
+    await readFile(
+      path.join(root, ".package-registry-manager.json"),
+      "utf8",
+    ).catch((error) => {
+      if (error.code === "ENOENT") {
+        return "{}";
+      }
+      throw error;
+    }),
+  );
+  if (
+    config.publish !== undefined &&
+    (!Array.isArray(config.publish) ||
+      config.publish.some(
+        (file) =>
+          typeof file !== "string" ||
+          path.posix.normalize(file) !== file ||
+          file.startsWith("/") ||
+          file.split("/").includes(".."),
+      ))
+  ) {
+    throw new Error(
+      "publish must list exact repository-relative manifest paths",
+    );
+  }
+  return config;
+}
+
+/** A reviewed mapping chooses one canonical artifact; references never publish a different tarball. */
+export function applyAuditConfig(items, config, workflows) {
+  for (const item of items.filter(Boolean)) {
+    const gradle = config.gradle?.find(
+      (entry) => entry.manifest === item.manifest,
+    );
+    if (gradle) {
+      if (
+        ![
+          gradle.group,
+          gradle.artifact,
+          gradle.version,
+          gradle.component,
+        ].every((value) => typeof value === "string" && /^[\w.-]+$/.test(value))
+      ) {
+        throw new Error(
+          "explicit Gradle publication requires resolved group, artifact, version and component",
+        );
+      }
+      Object.assign(item, {
+        registry: "maven-central",
+        name: `${gradle.group}:${gradle.artifact}`,
+        version: gradle.version,
+        publishable: true,
+        publication_component: gradle.component,
+      });
+      delete item.discovery_skip;
+    }
+    const shared = config.shared_artifacts?.find(
+      (entry) =>
+        `${entry.registry}:${entry.name}` === `${item.registry}:${item.name}`,
+    );
+    if (shared) {
+      item.shared_artifact = shared;
+    }
+    if (item.distribution) {
+      item.distribution = {
+        ...item.distribution,
+        ...config.distribution?.[item.manifest],
+        workflows: workflows
+          .filter((workflow) =>
+            item.registry === "conan"
+              ? /conan\s+upload/.test(workflow.contents)
+              : item.registry === "vcpkg"
+                ? /vcpkg.*(?:x-add-version|registry|publish)/.test(
+                    workflow.contents,
+                  )
+                : /cpack|cmake.*--install/.test(workflow.contents),
+          )
+          .map((workflow) => ({
+            workflow: workflow.name,
+            remote_variable: /CONAN_REMOTE_URL/.test(workflow.contents)
+              ? "CONAN_REMOTE_URL"
+              : undefined,
+            credential_names: ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"].filter(
+              (name) => workflow.contents.includes(name),
+            ),
+          })),
+      };
+    }
+  }
+}

package/src/bootstrap-recovery.mjs

@@ -0,0 +1,163 @@
+import { probePackage } from "./registry-state.mjs";
+import {
+  publisherIdentities,
+  publisherMatches,
+  repositorySlug,
+} from "./repository-identity.mjs";
+
+/** Bootstrap is a repaired prerequisite, separate from OIDC rejection. */
+export function bootstrapNames(log) {
+  const names = [];
+  for (const match of log.matchAll(
+    /npm owner setup required for ([^:\n]+):/gi,
+  )) {
+    for (const name of match[1].split(/[,\s]+/).filter(Boolean)) {
+      if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name)) {
+        return [];
+      }
+      names.push(name);
+    }
+  }
+  return [...new Set(names)];
+}
+
+/** Fresh name and exact publisher checks are equivalent to the owner-setup preflight. */
+export async function verifyBootstrapRecovery(session) {
+  if (!session.bootstrapNames?.length) {
+    return;
+  }
+  for (const name of session.bootstrapNames) {
+    const state = await (session.options.probePackage ?? probePackage)(
+      { ...session.plan.package, name },
+      session.options,
+    );
+    if (state.exists !== true) {
+      throw new Error(`bootstrap preflight still unresolved for ${name}`);
+    }
+    const trust = session.plan.steps?.find(
+      (step) => step.id === "verify-trusted-publisher",
+    )?.command;
+    const args = trust
+      ? trust.args.map((argument) =>
+          argument === session.plan.package.name ? name : argument,
+        )
+      : ["-y", "npm@^11.15", "trust", "list", name, "--browser=false"];
+    const result = await session.capture({
+      command: { program: trust?.program ?? "npx", args },
+    });
+    if (
+      result.code !== 0 ||
+      !publisherIdentities(String(result.stdout)).some((publisher) =>
+        publisherMatches(publisher, session.plan.trusted_publisher),
+      )
+    ) {
+      throw new Error(`bootstrap publisher is not verified for ${name}`);
+    }
+  }
+  const slug = repositorySlug(session.plan.repository);
+  const result = await session.capture({
+    command: {
+      program: "gh",
+      args: [
+        "api",
+        `repos/${slug}/commits/${session.releaseSelection.branch}`,
+        "--jq",
+        ".sha",
+      ],
+    },
+    cwd: ".",
+  });
+  if (
+    result.code !== 0 ||
+    String(result.stdout).trim() !== session.releaseSelection.run.headSha
+  ) {
+    throw new Error(
+      "default branch changed; follow the new revision's release instead of rerunning the old SHA",
+    );
+  }
+}
+
+/** Retry only jobs whose own failed log contains the repaired prerequisite. */
+export async function recoverBootstrap(session) {
+  await verifyBootstrapRecovery(session);
+  const selection = session.releaseSelection;
+  const slug = repositorySlug(session.plan.repository);
+  const jobIds = [];
+  for (const job of selection.jobs ?? []) {
+    if (job.conclusion !== "failure") {
+      continue;
+    }
+    const log = await session.capture({
+      command: {
+        program: "gh",
+        args: [
+          "run",
+          "view",
+          String(selection.run.databaseId),
+          "--repo",
+          slug,
+          "--job",
+          String(job.databaseId),
+          "--log",
+        ],
+      },
+      cwd: ".",
+    });
+    if (log.code !== 0) {
+      throw new Error(
+        "causal failed-job logs are unavailable; no CI was restarted",
+      );
+    }
+    if (
+      bootstrapNames(String(log.stdout)).some((name) =>
+        session.bootstrapNames.includes(name),
+      )
+    ) {
+      jobIds.push(job.databaseId);
+    }
+  }
+  if (!jobIds.length) {
+    throw new Error(
+      "no causal bootstrap job could be verified; unrelated failed jobs were not retried",
+    );
+  }
+  const changes =
+    session.options.recoveryChanges?.get(
+      `${slug}:${session.plan.trusted_publisher.workflow}`,
+    ) ?? [];
+  if (!changes.length) {
+    throw new Error(
+      "no verified configuration change in this setup; CI was not restarted",
+    );
+  }
+  const { githubServices } = await import("./github.mjs");
+  const github = session.options.github ?? githubServices(session.options);
+  const result = await github.repair.verify({
+    repo: slug,
+    workflow: session.plan.trusted_publisher.workflow,
+    runId: selection.run.databaseId,
+    jobIds,
+    changes: changes.map(() => ({
+      kind: "setting",
+      changed: true,
+      verified: true,
+    })),
+    timeout: session.options.waitTimeoutMs ?? 600000,
+  });
+  console.log(JSON.stringify({ bootstrap_recovery: result }));
+  session.conditions.delete("release-dispatch");
+  session.values.run_id = String(result.runId);
+  if (result.status !== "success") {
+    throw new Error(
+      `repaired bootstrap CI remains ${result.status}; ${result.runUrl ?? selection.run.url}`,
+    );
+  }
+  const { verifyNpmRelease } = await import("./npm-release.mjs");
+  const packages = await verifyNpmRelease(session, result.runId);
+  session.outcome = {
+    status: "verified",
+    url: result.runUrl,
+    ci: result,
+    packages,
+  };
+}

package/src/cpp-distribution.mjs

@@ -0,0 +1,127 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** Read distribution metadata without executing a CMake file or Python recipe. */
+export async function cppDistribution(
+  contents,
+  filename,
+  manifest,
+  manifestPath,
+) {
+  let cmake = filename === "CMakeLists.txt" ? contents : "";
+  if (!cmake) {
+    try {
+      cmake = await readFile(
+        path.join(path.dirname(manifestPath), "CMakeLists.txt"),
+        "utf8",
+      );
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  const project =
+    /\bproject\s*\(\s*([\w.-]+)\s+VERSION\s+(\d+(?:\.\d+)+)/i.exec(cmake);
+  let name = project?.[1];
+  let version = project?.[2];
+  const registry =
+    filename === "vcpkg.json"
+      ? "vcpkg"
+      : filename === "conanfile.py"
+        ? "conan"
+        : "cmake";
+  if (registry === "vcpkg") {
+    const data = JSON.parse(contents);
+    name = data.name;
+    version =
+      data.version ??
+      data["version-semver"] ??
+      data["version-string"] ??
+      data["version-date"];
+  } else if (registry === "conan") {
+    name = /^\s*name\s*=\s*["']([^"']+)/m.exec(contents)?.[1] ?? name;
+    version = /^\s*version\s*=\s*["']([^"']+)/m.exec(contents)?.[1] ?? version;
+  }
+  if (
+    !name ||
+    (registry === "cmake" &&
+      !/install\s*\(|CPack|configure_package_config_file/i.test(contents))
+  ) {
+    return {
+      manifest,
+      discovery_skip:
+        "CMake build definition has no distribution installation/configuration",
+      publishable: false,
+    };
+  }
+  return {
+    registry,
+    name,
+    version: version ?? null,
+    manifest,
+    publishable: true,
+    distribution: {
+      version_source: project
+        ? path.posix.join(path.posix.dirname(manifest), "CMakeLists.txt")
+        : manifest,
+      provider_status: "unverified",
+      ...(registry === "conan"
+        ? {
+            remote_required: "CONAN_REMOTE_URL",
+            credential_names: ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"],
+          }
+        : {}),
+    },
+    warnings: [
+      registry === "conan"
+        ? "Conan remote configuration and publication remain unverified; a local recipe does not establish registry presence"
+        : `${registry} distribution metadata does not establish a public registry publication`,
+    ],
+  };
+}
+
+/** Validation and explicit channel prerequisites; no upload is performed. */
+export function cppPlan(item) {
+  const commands = {
+    cmake: {
+      program: "cmake",
+      args: ["-S", ".", "-B", "build/prm-validation"],
+    },
+    conan: { program: "conan", args: ["inspect", ".", "--format=json"] },
+    vcpkg: {
+      program: "vcpkg",
+      args: ["install", "--dry-run", "--x-manifest-root=."],
+    },
+  };
+  return [
+    {
+      id: "validate-package",
+      title: `Validate ${item.registry} distribution`,
+      kind: "check",
+      command: commands[item.registry],
+      description:
+        "Validate the manifest locally before reviewing any publication settings.",
+    },
+    ...(item.registry === "conan"
+      ? [
+          {
+            id: "audit-distribution-channel",
+            title: "Read Conan remote and credential health",
+            kind: "api",
+            description:
+              "Read effective remote configuration and credential health through gh-manager. Unknown credentials and missing remotes remain explicit; do not upload or rotate credentials.",
+          },
+        ]
+      : []),
+    {
+      id: "review-distribution-channel",
+      title: "Resolve the distribution provider and CI configuration",
+      kind: "manual",
+      description:
+        item.registry === "conan"
+          ? "Read CONAN_REMOTE_URL and credential health for CONAN_LOGIN_USERNAME/CONAN_PASSWORD through gh-manager at the effective repository/environment scope. Choose the exact remote, validate conan create and consumer tests in reviewed CI, then configure narrowly scoped existing credentials. No public registry state or permission is established by a recipe."
+          : `Review ${item.registry === "vcpkg" ? "the chosen vcpkg registry repository, baseline, port and version database" : "CMake install/export, package config, CPack and GitHub Release workflow"}; validate installation and a consumer in CI. Provider lookup/setup is unsupported until the destination is explicitly configured; publication remains unverified.`,
+    },
+  ];
+}

package/src/credential-cycle.mjs

@@ -1,8 +1,13 @@
 /** Registry-specific policy; tokens are never a fallback for OIDC registries. */
 export function credentialPolicy(registry) {
-  if (
-    ["npm", "pypi", "crates-io", "rubygems", "nuget", "jsr"].includes(registry)
-  ) {
+  if (registry === "nuget") {
+    return {
+      mode: "oidc-with-token-fallback",
+      description:
+        "NuGet: NuGet/login OIDC first, retain provided fallback secrets; never create a persistent publishing key",
+    };
+  }
+  if (["npm", "pypi", "crates-io", "rubygems", "jsr"].includes(registry)) {
     return {
       mode: "trusted",
       description: `${registry}: trusted publishing; remove unused long-lived tokens after verification`,

package/src/default-browser.mjs

@@ -1,4 +1,4 @@
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 
 import { browserSources, catalogueName } from "./browser-catalogue.mjs";
 

package/src/default-scope.mjs

@@ -1,4 +1,4 @@
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 
 async function github(args) {
   try {