package-registry-manager 0.25.0 → 0.26.0

package/README.md

@@ -77,3 +77,8 @@ OIDC publication and verification that no workflow still uses the credentials.
 Saved crates.io API sessions run headlessly; sign-in opens a visible window only
 when user action is needed. Organization migration skips and reports scan errors
 while continuing for clean repositories.
+
+NuGet setup uses an explicit login profile, package owner and exact package IDs.
+Trusted publishing is preferred; existing provided fallback credentials are retained.
+See [audit and NuGet configuration](../docs/issue-73-requirements.md) for setup,
+identity decisions and the distinction between verified configuration and release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,8 +40,8 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/293e9a8ab9d6d91a08e95f4e09c2a0dcad9bc809",
-    "browser-commander": "^0.34.0",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/0b3ceb1590be7eb0340ae088730698b5ae9bebfc",
+    "browser-commander": "^0.34.1",
     "command-stream": "^2.6.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"

package/src/audit-config.mjs

@@ -0,0 +1,96 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** Explicit source decisions supplement static discovery without executing build files. */
+export async function auditConfig(root) {
+  const config = JSON.parse(
+    await readFile(
+      path.join(root, ".package-registry-manager.json"),
+      "utf8",
+    ).catch((error) => {
+      if (error.code === "ENOENT") {
+        return "{}";
+      }
+      throw error;
+    }),
+  );
+  if (
+    config.publish !== undefined &&
+    (!Array.isArray(config.publish) ||
+      config.publish.some(
+        (file) =>
+          typeof file !== "string" ||
+          path.posix.normalize(file) !== file ||
+          file.startsWith("/") ||
+          file.split("/").includes(".."),
+      ))
+  ) {
+    throw new Error(
+      "publish must list exact repository-relative manifest paths",
+    );
+  }
+  return config;
+}
+
+/** A reviewed mapping chooses one canonical artifact; references never publish a different tarball. */
+export function applyAuditConfig(items, config, workflows) {
+  for (const item of items.filter(Boolean)) {
+    const gradle = config.gradle?.find(
+      (entry) => entry.manifest === item.manifest,
+    );
+    if (gradle) {
+      if (
+        ![
+          gradle.group,
+          gradle.artifact,
+          gradle.version,
+          gradle.component,
+        ].every((value) => typeof value === "string" && /^[\w.-]+$/.test(value))
+      ) {
+        throw new Error(
+          "explicit Gradle publication requires resolved group, artifact, version and component",
+        );
+      }
+      Object.assign(item, {
+        registry: "maven-central",
+        name: `${gradle.group}:${gradle.artifact}`,
+        version: gradle.version,
+        publishable: true,
+        publication_component: gradle.component,
+      });
+      delete item.discovery_skip;
+    }
+    const shared = config.shared_artifacts?.find(
+      (entry) =>
+        `${entry.registry}:${entry.name}` === `${item.registry}:${item.name}`,
+    );
+    if (shared) {
+      item.shared_artifact = shared;
+    }
+    if (item.distribution) {
+      item.distribution = {
+        ...item.distribution,
+        ...config.distribution?.[item.manifest],
+        workflows: workflows
+          .filter((workflow) =>
+            item.registry === "conan"
+              ? /conan\s+upload/.test(workflow.contents)
+              : item.registry === "vcpkg"
+                ? /vcpkg.*(?:x-add-version|registry|publish)/.test(
+                    workflow.contents,
+                  )
+                : /cpack|cmake.*--install/.test(workflow.contents),
+          )
+          .map((workflow) => ({
+            workflow: workflow.name,
+            remote_variable: /CONAN_REMOTE_URL/.test(workflow.contents)
+              ? "CONAN_REMOTE_URL"
+              : undefined,
+            credential_names: ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"].filter(
+              (name) => workflow.contents.includes(name),
+            ),
+          })),
+      };
+    }
+  }
+}

package/src/bootstrap-recovery.mjs

@@ -0,0 +1,163 @@
+import { probePackage } from "./registry-state.mjs";
+import {
+  publisherIdentities,
+  publisherMatches,
+  repositorySlug,
+} from "./repository-identity.mjs";
+
+/** Bootstrap is a repaired prerequisite, separate from OIDC rejection. */
+export function bootstrapNames(log) {
+  const names = [];
+  for (const match of log.matchAll(
+    /npm owner setup required for ([^:\n]+):/gi,
+  )) {
+    for (const name of match[1].split(/[,\s]+/).filter(Boolean)) {
+      if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name)) {
+        return [];
+      }
+      names.push(name);
+    }
+  }
+  return [...new Set(names)];
+}
+
+/** Fresh name and exact publisher checks are equivalent to the owner-setup preflight. */
+export async function verifyBootstrapRecovery(session) {
+  if (!session.bootstrapNames?.length) {
+    return;
+  }
+  for (const name of session.bootstrapNames) {
+    const state = await (session.options.probePackage ?? probePackage)(
+      { ...session.plan.package, name },
+      session.options,
+    );
+    if (state.exists !== true) {
+      throw new Error(`bootstrap preflight still unresolved for ${name}`);
+    }
+    const trust = session.plan.steps?.find(
+      (step) => step.id === "verify-trusted-publisher",
+    )?.command;
+    const args = trust
+      ? trust.args.map((argument) =>
+          argument === session.plan.package.name ? name : argument,
+        )
+      : ["-y", "npm@^11.15", "trust", "list", name, "--browser=false"];
+    const result = await session.capture({
+      command: { program: trust?.program ?? "npx", args },
+    });
+    if (
+      result.code !== 0 ||
+      !publisherIdentities(String(result.stdout)).some((publisher) =>
+        publisherMatches(publisher, session.plan.trusted_publisher),
+      )
+    ) {
+      throw new Error(`bootstrap publisher is not verified for ${name}`);
+    }
+  }
+  const slug = repositorySlug(session.plan.repository);
+  const result = await session.capture({
+    command: {
+      program: "gh",
+      args: [
+        "api",
+        `repos/${slug}/commits/${session.releaseSelection.branch}`,
+        "--jq",
+        ".sha",
+      ],
+    },
+    cwd: ".",
+  });
+  if (
+    result.code !== 0 ||
+    String(result.stdout).trim() !== session.releaseSelection.run.headSha
+  ) {
+    throw new Error(
+      "default branch changed; follow the new revision's release instead of rerunning the old SHA",
+    );
+  }
+}
+
+/** Retry only jobs whose own failed log contains the repaired prerequisite. */
+export async function recoverBootstrap(session) {
+  await verifyBootstrapRecovery(session);
+  const selection = session.releaseSelection;
+  const slug = repositorySlug(session.plan.repository);
+  const jobIds = [];
+  for (const job of selection.jobs ?? []) {
+    if (job.conclusion !== "failure") {
+      continue;
+    }
+    const log = await session.capture({
+      command: {
+        program: "gh",
+        args: [
+          "run",
+          "view",
+          String(selection.run.databaseId),
+          "--repo",
+          slug,
+          "--job",
+          String(job.databaseId),
+          "--log",
+        ],
+      },
+      cwd: ".",
+    });
+    if (log.code !== 0) {
+      throw new Error(
+        "causal failed-job logs are unavailable; no CI was restarted",
+      );
+    }
+    if (
+      bootstrapNames(String(log.stdout)).some((name) =>
+        session.bootstrapNames.includes(name),
+      )
+    ) {
+      jobIds.push(job.databaseId);
+    }
+  }
+  if (!jobIds.length) {
+    throw new Error(
+      "no causal bootstrap job could be verified; unrelated failed jobs were not retried",
+    );
+  }
+  const changes =
+    session.options.recoveryChanges?.get(
+      `${slug}:${session.plan.trusted_publisher.workflow}`,
+    ) ?? [];
+  if (!changes.length) {
+    throw new Error(
+      "no verified configuration change in this setup; CI was not restarted",
+    );
+  }
+  const { githubServices } = await import("./github.mjs");
+  const github = session.options.github ?? githubServices(session.options);
+  const result = await github.repair.verify({
+    repo: slug,
+    workflow: session.plan.trusted_publisher.workflow,
+    runId: selection.run.databaseId,
+    jobIds,
+    changes: changes.map(() => ({
+      kind: "setting",
+      changed: true,
+      verified: true,
+    })),
+    timeout: session.options.waitTimeoutMs ?? 600000,
+  });
+  console.log(JSON.stringify({ bootstrap_recovery: result }));
+  session.conditions.delete("release-dispatch");
+  session.values.run_id = String(result.runId);
+  if (result.status !== "success") {
+    throw new Error(
+      `repaired bootstrap CI remains ${result.status}; ${result.runUrl ?? selection.run.url}`,
+    );
+  }
+  const { verifyNpmRelease } = await import("./npm-release.mjs");
+  const packages = await verifyNpmRelease(session, result.runId);
+  session.outcome = {
+    status: "verified",
+    url: result.runUrl,
+    ci: result,
+    packages,
+  };
+}

package/src/cpp-distribution.mjs

@@ -0,0 +1,164 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** Read distribution metadata without executing a CMake file or Python recipe. */
+export async function cppDistribution(
+  contents,
+  filename,
+  manifest,
+  manifestPath,
+) {
+  let cmake = filename === "CMakeLists.txt" ? contents : "";
+  if (!cmake) {
+    try {
+      cmake = await readFile(
+        path.join(path.dirname(manifestPath), "CMakeLists.txt"),
+        "utf8",
+      );
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  const project =
+    /\bproject\s*\(\s*([\w.-]+)\s+VERSION\s+(\d+(?:\.\d+)+|\$\{(\w+)\})/i.exec(
+      cmake,
+    );
+  let name = project?.[1];
+  let version = project?.[3] ? null : project?.[2];
+  let versionSource = null;
+  if (project?.[3]) {
+    // `file(READ "${CMAKE_CURRENT_SOURCE_DIR}/VERSION" VAR)` is resolved by
+    // reading that one sibling file; nothing in the CMake file is executed.
+    const read = new RegExp(
+      `\\bfile\\s*\\(\\s*READ\\s+"?\\$\\{CMAKE_CURRENT_(?:SOURCE|LIST)_DIR\\}/([\\w.-]+)"?\\s+${project[3]}\\s*\\)`,
+      "i",
+    ).exec(cmake);
+    const literal = new RegExp(
+      `\\bset\\s*\\(\\s*${project[3]}\\s+"?(\\d+(?:\\.\\d+)+)"?\\s*\\)`,
+      "i",
+    ).exec(cmake);
+    if (read) {
+      try {
+        const value = (
+          await readFile(path.join(path.dirname(manifestPath), read[1]), "utf8")
+        ).trim();
+        if (/^\d+(?:\.\d+)+$/.test(value)) {
+          version = value;
+          versionSource = path.posix.join(
+            path.posix.dirname(manifest),
+            read[1],
+          );
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+      }
+    } else if (literal) {
+      version = literal[1];
+    }
+  }
+  const registry =
+    filename === "vcpkg.json"
+      ? "vcpkg"
+      : filename === "conanfile.py"
+        ? "conan"
+        : "cmake";
+  if (registry === "vcpkg") {
+    const data = JSON.parse(contents);
+    name = data.name;
+    version =
+      data.version ??
+      data["version-semver"] ??
+      data["version-string"] ??
+      data["version-date"];
+  } else if (registry === "conan") {
+    name = /^\s*name\s*=\s*["']([^"']+)/m.exec(contents)?.[1] ?? name;
+    version = /^\s*version\s*=\s*["']([^"']+)/m.exec(contents)?.[1] ?? version;
+  }
+  if (
+    !name ||
+    (registry === "cmake" &&
+      !/install\s*\(|CPack|configure_package_config_file/i.test(contents))
+  ) {
+    return {
+      manifest,
+      discovery_skip:
+        "CMake build definition has no distribution installation/configuration",
+      publishable: false,
+    };
+  }
+  return {
+    registry,
+    name,
+    version: version ?? null,
+    manifest,
+    publishable: true,
+    distribution: {
+      version_source:
+        versionSource ??
+        (project
+          ? path.posix.join(path.posix.dirname(manifest), "CMakeLists.txt")
+          : manifest),
+      provider_status: "unverified",
+      ...(registry === "conan"
+        ? {
+            remote_required: "CONAN_REMOTE_URL",
+            credential_names: ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"],
+          }
+        : {}),
+    },
+    warnings: [
+      registry === "conan"
+        ? "Conan remote configuration and publication remain unverified; a local recipe does not establish registry presence"
+        : `${registry} distribution metadata does not establish a public registry publication`,
+    ],
+  };
+}
+
+/** Validation and explicit channel prerequisites; no upload is performed. */
+export function cppPlan(item) {
+  const commands = {
+    cmake: {
+      program: "cmake",
+      args: ["-S", ".", "-B", "build/prm-validation"],
+    },
+    conan: { program: "conan", args: ["inspect", ".", "--format=json"] },
+    vcpkg: {
+      program: "vcpkg",
+      args: ["install", "--dry-run", "--x-manifest-root=."],
+    },
+  };
+  return [
+    {
+      id: "validate-package",
+      title: `Validate ${item.registry} distribution`,
+      kind: "check",
+      command: commands[item.registry],
+      description:
+        "Validate the manifest locally before reviewing any publication settings.",
+    },
+    ...(item.registry === "conan"
+      ? [
+          {
+            id: "audit-distribution-channel",
+            title: "Read Conan remote and credential health",
+            kind: "api",
+            description:
+              "Read effective remote configuration and credential health through gh-manager. Unknown credentials and missing remotes remain explicit; do not upload or rotate credentials.",
+          },
+        ]
+      : []),
+    {
+      id: "review-distribution-channel",
+      title: "Resolve the distribution provider and CI configuration",
+      kind: "manual",
+      description:
+        item.registry === "conan"
+          ? "Read CONAN_REMOTE_URL and credential health for CONAN_LOGIN_USERNAME/CONAN_PASSWORD through gh-manager at the effective repository/environment scope. Choose the exact remote, validate conan create and consumer tests in reviewed CI, then configure narrowly scoped existing credentials. No public registry state or permission is established by a recipe."
+          : `Review ${item.registry === "vcpkg" ? "the chosen vcpkg registry repository, baseline, port and version database" : "CMake install/export, package config, CPack and GitHub Release workflow"}; validate installation and a consumer in CI. Provider lookup/setup is unsupported until the destination is explicitly configured; publication remains unverified.`,
+    },
+  ];
+}

package/src/credential-cycle.mjs

@@ -1,8 +1,13 @@
 /** Registry-specific policy; tokens are never a fallback for OIDC registries. */
 export function credentialPolicy(registry) {
-  if (
-    ["npm", "pypi", "crates-io", "rubygems", "nuget", "jsr"].includes(registry)
-  ) {
+  if (registry === "nuget") {
+    return {
+      mode: "oidc-with-token-fallback",
+      description:
+        "NuGet: NuGet/login OIDC first, retain provided fallback secrets; never create a persistent publishing key",
+    };
+  }
+  if (["npm", "pypi", "crates-io", "rubygems", "jsr"].includes(registry)) {
     return {
       mode: "trusted",
       description: `${registry}: trusted publishing; remove unused long-lived tokens after verification`,

package/src/credential-requirements.mjs

@@ -0,0 +1,105 @@
+/**
+ * Registries without public OIDC publishing: the exact credential set a
+ * workflow needs, which secrets it already references, and where values may
+ * live. Values are only ever held in memory or written to encrypted GitHub
+ * secrets; nothing here rotates, revokes or deletes an existing credential.
+ */
+export const CREDENTIAL_SETS = Object.freeze({
+  "maven-central": {
+    oidc: "unsupported",
+    oidc_note:
+      "Sonatype Central Portal has no OIDC trusted publishing; publish with a Central user-token pair and a GPG signing key.",
+    namespace: "verified Central Portal namespace matching the groupId",
+    roles: [
+      {
+        role: "central-username",
+        candidates: [
+          "CENTRAL_USERNAME",
+          "MAVEN_CENTRAL_USERNAME",
+          "OSSRH_USERNAME",
+          "SONATYPE_USERNAME",
+          "MAVEN_USERNAME",
+        ],
+        default: "CENTRAL_USERNAME",
+      },
+      {
+        role: "central-token",
+        candidates: [
+          "CENTRAL_TOKEN",
+          "MAVEN_CENTRAL_TOKEN",
+          "MAVEN_CENTRAL_PASSWORD",
+          "OSSRH_TOKEN",
+          "OSSRH_PASSWORD",
+          "SONATYPE_TOKEN",
+          "MAVEN_PASSWORD",
+        ],
+        default: "CENTRAL_TOKEN",
+      },
+      {
+        role: "gpg-private-key",
+        candidates: ["GPG_PRIVATE_KEY", "MAVEN_GPG_PRIVATE_KEY", "SIGNING_KEY"],
+        default: "GPG_PRIVATE_KEY",
+      },
+      {
+        role: "gpg-passphrase",
+        candidates: [
+          "GPG_PASSPHRASE",
+          "MAVEN_GPG_PASSPHRASE",
+          "SIGNING_PASSWORD",
+        ],
+        default: "GPG_PASSPHRASE",
+      },
+    ],
+  },
+  packagist: {
+    oidc: "unsupported",
+    oidc_note:
+      "Public packagist.org has no OIDC publishing (Private Packagist OIDC is a separate product); releases come from tags via the GitHub hook or the update-package API.",
+    roles: [
+      {
+        role: "packagist-username",
+        candidates: ["PACKAGIST_USERNAME"],
+        default: "PACKAGIST_USERNAME",
+        optional: true,
+      },
+      {
+        role: "packagist-api-token",
+        candidates: ["PACKAGIST_TOKEN", "PACKAGIST_API_TOKEN"],
+        default: "PACKAGIST_TOKEN",
+        optional: true,
+      },
+    ],
+  },
+});
+
+const SECRET = /\bsecrets\.([A-Za-z_][A-Za-z0-9_]*)\b/g;
+
+/** Structured requirements resolved against the secrets the workflows read. */
+export function credentialRequirements(registry, workflows = []) {
+  const set = CREDENTIAL_SETS[registry];
+  if (!set) {
+    return null;
+  }
+  const referenced = new Set(
+    workflows.flatMap((workflow) =>
+      [...workflow.contents.replace(/^\s*#.*$/gm, "").matchAll(SECRET)].map(
+        (match) => match[1],
+      ),
+    ),
+  );
+  return {
+    oidc: set.oidc,
+    oidc_note: set.oidc_note,
+    ...(set.namespace ? { namespace: set.namespace } : {}),
+    storage: "memory-or-encrypted-github-secret",
+    secrets: set.roles.map((role) => {
+      const found = role.candidates.find((name) => referenced.has(name));
+      return {
+        role: role.role,
+        secret: found ?? role.default,
+        referenced: Boolean(found),
+        ...(role.optional ? { optional: true } : {}),
+      };
+    }),
+  };
+}

package/src/default-browser.mjs

@@ -1,4 +1,4 @@
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 
 import { browserSources, catalogueName } from "./browser-catalogue.mjs";
 

package/src/default-scope.mjs

@@ -1,4 +1,4 @@
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 
 async function github(args) {
   try {