package-registry-manager 0.25.0 → 0.26.0

package/src/discovery.mjs

@@ -1,3 +1,7 @@
+import { credentialRequirements } from "./credential-requirements.mjs";
+import { auditConfig, applyAuditConfig } from "./audit-config.mjs";
+import { cppDistribution } from "./cpp-distribution.mjs";
+import { markIdentityConflicts } from "./identity-conflicts.mjs";
 import { readFile, readdir, realpath } from "node:fs/promises";
 import path from "node:path";
 
@@ -6,6 +10,7 @@ import { packageWorkflows, auditWrappers } from "./package-coverage.mjs";
 import { REGISTRIES } from "./model.mjs";
 import { inspectManifestRepositories } from "./repository-identity.mjs";
 import {
+  RELEASE_EVIDENCE,
   TRUSTED_REGISTRIES,
   detectPublisher,
   tokenSecretWarning,
@@ -32,6 +37,9 @@ const IGNORED_DIRECTORIES = new Set([
 ]);
 
 const MANIFEST_NAMES = new Set([
+  "CMakeLists.txt",
+  "conanfile.py",
+  "vcpkg.json",
   "package.json",
   "Cargo.toml",
   "pyproject.toml",
@@ -63,6 +71,7 @@ export async function inspectRepository(repository, options = {}) {
   );
   const workflows = await readWorkflows(root);
   const ignore = await readIgnoreList(root);
+  const config = await auditConfig(root);
   const skipped = [];
   const skip = (manifest, reason) => {
     skipped.push({ manifest, reason });
@@ -77,7 +86,10 @@ export async function inspectRepository(repository, options = {}) {
     const directory = testDirectory(manifest);
     return (
       directory === null ||
-      (!["docs", "experiments", "case-studies"].includes(directory) &&
+      config.publish?.includes(manifest) ||
+      (!["docs", "experiments", "case-studies", "dev/log"].includes(
+        directory,
+      ) &&
         publishable &&
         referencedByWorkflow(workflows, manifest)) ||
       skip(manifest, testDirectoryReason(directory))
@@ -89,7 +101,7 @@ export async function inspectRepository(repository, options = {}) {
       .filter(([, manifest]) => !ignored(manifest))
       .map(async ([manifestPath, manifest]) => {
         try {
-          return await parseManifest(manifestPath, manifest);
+          return await parseManifest(manifestPath, manifest, root);
         } catch (error) {
           if (testDirectory(manifest) === null) {
             if (!options.onError) {
@@ -106,6 +118,7 @@ export async function inspectRepository(repository, options = {}) {
         }
       }),
   );
+  applyAuditConfig(parsed, config, workflows);
   const coordinates = await githubCoordinates(
     root,
     preferredManifests.filter((manifest) => {
@@ -117,6 +130,56 @@ export async function inspectRepository(repository, options = {}) {
   for (const registry of TRUSTED_REGISTRIES) {
     publishers.set(registry, await detectPublisher(root, workflows, registry));
   }
+  // Generated names share source metadata, but are independent registry identities.
+  for (const item of [...parsed].filter(Boolean)) {
+    if (item.registry !== "npm") {
+      continue;
+    }
+    const data = JSON.parse(await readManifest(path.join(root, item.manifest)));
+    const aliases = data.publishAliases ?? [];
+    if (
+      !Array.isArray(aliases) ||
+      aliases.some(
+        (name) =>
+          typeof name !== "string" ||
+          !/^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name),
+      ) ||
+      new Set([item.name, ...aliases]).size !== aliases.length + 1
+    ) {
+      throw new Error(
+        `${item.manifest}: publishAliases must contain distinct valid npm names`,
+      );
+    }
+    const generator =
+      Object.values(data.scripts ?? {}).flatMap((command) =>
+        [
+          ...String(command).matchAll(
+            /(?:^|\s)(?:node|bun)\s+(?:\.\/)?([^\s]+prepare[^\s]*\.mjs)/g,
+          ),
+        ].map((match) => match[1]),
+      )[0] ?? null;
+    if (aliases.length) {
+      item.generated_artifact = {
+        source_manifest: item.manifest,
+        source_name: item.name,
+        generator,
+        names: [item.name, ...aliases],
+      };
+    }
+    for (const name of aliases) {
+      parsed.push({
+        ...item,
+        name,
+        generated_alias: {
+          source_manifest: item.manifest,
+          source_name: item.name,
+          generator,
+          names: [item.name, ...aliases],
+        },
+      });
+    }
+  }
+  applyAuditConfig(parsed, config, workflows);
   // Extension packages can publish to both marketplaces independently.
   for (const item of [...parsed].filter(Boolean)) {
     if (item.registry !== "npm") {
@@ -137,10 +200,10 @@ export async function inspectRepository(repository, options = {}) {
       }
     }
   }
-  publishers.set(
-    "maven-central",
-    await detectPublisher(root, workflows, "maven-central"),
-  );
+  for (const registry of SCOPED_REGISTRIES) {
+    publishers.set(registry, await detectPublisher(root, workflows, registry));
+  }
+  canonicalComposer(parsed);
   const containerFiles = dockerfiles
     .map((item) => relativePath(root, item))
     .filter((item) => !ignored(item) && kept(item, true));
@@ -169,11 +232,16 @@ export async function inspectRepository(repository, options = {}) {
     await Promise.all(
       parsed
         .filter(Boolean)
-        .filter((item) => kept(item.manifest, item.publishable))
+        .filter((item) =>
+          item.discovery_skip
+            ? skip(item.manifest, item.discovery_skip)
+            : kept(item.manifest, item.publishable),
+        )
         .map(async (item) => {
           const scoped =
-            counts.get(item.registry) > 1 &&
-            TRUSTED_REGISTRIES.includes(item.registry)
+            (counts.get(item.registry) > 1 &&
+              TRUSTED_REGISTRIES.includes(item.registry)) ||
+            SCOPED_REGISTRIES.includes(item.registry)
               ? new Map([
                   [
                     item.registry,
@@ -185,10 +253,37 @@ export async function inspectRepository(repository, options = {}) {
                   ],
                 ])
               : publishers;
-          return withPublisher(item, workflows, scoped);
+          return withPublisher(
+            item,
+            workflows,
+            item.publisher_scope
+              ? new Map([
+                  [
+                    item.registry,
+                    await detectPublisher(
+                      root,
+                      packageWorkflows(workflows, {
+                        ...item,
+                        manifest: item.publisher_scope,
+                      }),
+                      item.registry,
+                    ),
+                  ],
+                ])
+              : scoped,
+          );
         }),
     )
   )
+    .filter(
+      (item) =>
+        !internalWorkload(item) ||
+        config.publish?.includes(item.manifest) ||
+        skip(
+          item.manifest,
+          `internal ${internalWorkload(item)} workload: no workflow publishes it and no source decision lists it under "publish"`,
+        ),
+    )
     .concat(
       containerPackages(containerFiles, workflows, coordinates),
       chromePackages,
@@ -223,6 +318,7 @@ export async function inspectRepository(repository, options = {}) {
       left.manifest.localeCompare(right.manifest),
     );
   }
+  markIdentityConflicts([inspection]);
   return inspectManifestRepositories(inspection);
 }
 
@@ -240,6 +336,47 @@ function releaseWorkflow(publishers) {
   return null;
 }
 
+/** Registries whose publication evidence is scoped to one manifest. */
+const SCOPED_REGISTRIES = ["maven-central", "packagist", "go-modules", "cmake"];
+
+/** Benchmark/fixture manifests are internal unless a workflow releases them. */
+function internalWorkload(item) {
+  if (item.workflow) {
+    return null;
+  }
+  const segment = item.manifest
+    .split("/")
+    .slice(0, -1)
+    .find((part) => /^(?:bench(?:mark)?(?:es|s)?|perf)$/i.test(part));
+  return segment ? "benchmark" : null;
+}
+
+/**
+ * Packagist reads only the repository-root composer.json, so a same-name
+ * descriptor in a subdirectory is a development copy of that distribution.
+ * The root keeps the copy's declared version and the copy's publishing job.
+ */
+function canonicalComposer(parsed) {
+  const composer = parsed.filter(
+    (item) => item?.registry === "packagist" && !item.discovery_skip,
+  );
+  const root = composer.find((item) => item.manifest === "composer.json");
+  if (!root) {
+    return;
+  }
+  for (const copy of composer.filter(
+    (item) => item !== root && item.name === root.name,
+  )) {
+    copy.discovery_skip = `Packagist reads only the repository-root composer.json; ${copy.manifest} is a development descriptor of ${root.name}`;
+    copy.publishable = false;
+    if (!root.version && copy.version) {
+      root.version = copy.version;
+      root.version_source = copy.manifest;
+    }
+    root.publisher_scope ??= copy.manifest;
+  }
+}
+
 function withPublisher(item, workflows, publishers) {
   const publisher = item.publishable ? publishers.get(item.registry) : null;
   if (!publisher) {
@@ -255,16 +392,32 @@ function withPublisher(item, workflows, publishers) {
   if (publisher.jobs.length > 0) {
     result.workflow_jobs = publisher.jobs;
   }
+  if (publisher.callees?.length) {
+    // Reusable workflows publish under the caller's identity; the callee
+    // jobs are kept so setup and recovery act on the actual publishing job.
+    result.workflow_callees = publisher.callees;
+  }
+  if (publisher.gate) {
+    result.authentication_gate = publisher.gate;
+  }
   if (publisher.environment) {
     result.environment = publisher.environment;
   }
   if (publisher.candidates.length > 1) {
     result.workflow_candidates = publisher.candidates;
   }
+  const credentials = credentialRequirements(item.registry, workflows);
+  if (credentials) {
+    result.credential_requirements = credentials;
+  }
   const secrets = tokenSecrets(workflows, item.registry);
   const warnings = [
     ...publisher.warnings,
-    ...(!publisher.workflow && publisher.candidates.length === 0
+    // Tags and registry hooks release Go modules, Packagist packages and
+    // CMake archives without a workflow, so only evidence is reported.
+    ...(!publisher.workflow &&
+    publisher.candidates.length === 0 &&
+    !RELEASE_EVIDENCE.has(item.registry)
       ? [
           `no workflow publishes ${item.name} to ${item.registry}; CI releases will not reach it`,
         ]
@@ -301,10 +454,14 @@ async function collectManifests(directory, manifests, dockerfiles) {
   }
 }
 
-async function parseManifest(manifestPath, manifest) {
+async function parseManifest(manifestPath, manifest, root) {
   const contents = await readManifest(manifestPath);
   const filename = path.basename(manifestPath);
   switch (filename) {
+    case "CMakeLists.txt":
+    case "conanfile.py":
+    case "vcpkg.json":
+      return cppDistribution(contents, filename, manifest, manifestPath);
     case "jsr.json":
     case "deno.json": {
       const value = JSON.parse(contents);
@@ -315,7 +472,10 @@ async function parseManifest(manifestPath, manifest) {
     case "package.json":
       return parseNpm(contents, manifest);
     case "Cargo.toml":
-      return parseCargo(contents, manifest);
+      return parseCargo(
+        await cargoContents(contents, manifestPath, root),
+        manifest,
+      );
     case "pyproject.toml":
       return parsePyproject(contents, manifest);
     case "setup.py":
@@ -326,13 +486,22 @@ async function parseManifest(manifestPath, manifest) {
         capture(contents, /\bversion\s*=\s*['"]([^'"]+)/),
         manifest,
       );
-    case "go.mod":
-      return packageInfo(
+    case "go.mod": {
+      const item = packageInfo(
         "go-modules",
         capture(contents, /^\s*module\s+(\S+)/m) ?? "unknown-go-module",
-        null,
+        await versionFile(manifestPath),
         manifest,
       );
+      if (item.version) {
+        item.version = `v${item.version.replace(/^v/, "")}`;
+        item.version_source = path.posix.join(
+          path.posix.dirname(manifest),
+          "VERSION",
+        );
+      }
+      return item;
+    }
     case "pom.xml":
       return parseMaven(contents, manifest);
     case "build.gradle":
@@ -373,6 +542,48 @@ function parseNpm(contents, manifest) {
   );
 }
 
+async function cargoContents(contents, manifestPath, root) {
+  if (
+    !/version\s*\.\s*workspace\s*=\s*true|version\s*=\s*\{\s*workspace\s*=\s*true/.test(
+      contents,
+    )
+  ) {
+    return contents;
+  }
+  const section = tomlSection(contents, "package") ?? "";
+  const explicit = tomlString(section, "workspace");
+  let directory = explicit
+    ? path.resolve(path.dirname(manifestPath), explicit)
+    : path.dirname(manifestPath);
+  while (directory === root || directory.startsWith(`${root}${path.sep}`)) {
+    let workspace;
+    try {
+      workspace = await readManifest(path.join(directory, "Cargo.toml"));
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    if (workspace && tomlSection(workspace, "workspace") !== null) {
+      const version = tomlString(
+        tomlSection(workspace, "workspace.package") ?? "",
+        "version",
+      );
+      return version
+        ? contents.replace(
+            /version\s*\.\s*workspace\s*=\s*true|version\s*=\s*\{\s*workspace\s*=\s*true\s*\}/,
+            `version = "${version}"`,
+          )
+        : contents;
+    }
+    if (explicit || directory === root) {
+      break;
+    }
+    directory = path.dirname(directory);
+  }
+  return contents;
+}
+
 function parseCargo(contents, manifest) {
   const section = tomlSection(contents, "package");
   if (!section) {
@@ -414,16 +625,38 @@ function parsePyproject(contents, manifest) {
 }
 
 function parseDotnet(contents, manifestPath, manifest) {
+  if (xmlTag(contents, "IsPackable")?.toLowerCase() === "false") {
+    return {
+      manifest,
+      publishable: false,
+      discovery_skip: "MSBuild IsPackable is false",
+    };
+  }
   return packageInfo(
     "nuget",
     xmlTag(contents, "PackageId") ??
       xmlTag(contents, "AssemblyName") ??
       path.basename(manifestPath, path.extname(manifestPath)),
-    xmlTag(contents, "PackageVersion") ?? xmlTag(contents, "Version"),
+    dotnetVersion(contents),
     manifest,
   );
 }
 
+function dotnetVersion(contents) {
+  const literal = (tag) => {
+    const value = xmlTag(contents, tag);
+    return value && !value.includes("$(") ? value : null;
+  };
+  const explicit = literal("PackageVersion") ?? literal("Version");
+  if (explicit) {
+    return explicit;
+  }
+  // MSBuild derives Version from VersionPrefix and VersionSuffix.
+  const prefix = literal("VersionPrefix");
+  const suffix = literal("VersionSuffix");
+  return prefix ? (suffix ? `${prefix}-${suffix}` : prefix) : null;
+}
+
 function parseMaven(contents, manifest) {
   const artifact = xmlTag(contents, "artifactId") ?? "unknown-maven-artifact";
   const group = xmlTag(contents, "groupId");
@@ -436,16 +669,33 @@ function parseMaven(contents, manifest) {
 }
 
 function parseGradle(contents, manifest) {
-  const group = capture(contents, /^\s*group\s*=\s*['"]([^'"]+)/m);
+  const literal = (key) =>
+    capture(contents, new RegExp(`\\b${key}\\s*(?:=\\s*)?['"]([^'"]+)`));
+  const group = literal("groupId") ?? literal("group");
   const artifact =
-    capture(
-      contents,
-      /^\s*(?:archivesBaseName|rootProject\.name)\s*=\s*['"]([^'"]+)/m,
-    ) ?? "gradle-project";
+    literal("artifactId") ??
+    literal("archivesBaseName") ??
+    literal("rootProject\\.name");
+  const version = literal("version");
+  if (
+    !group ||
+    !artifact ||
+    !version ||
+    /[$}{]/.test(`${group}${artifact}${version}`) ||
+    !/maven-publish|MavenPublication/.test(contents) ||
+    !/from\s*\(?\s*components|artifact\s*\(/.test(contents)
+  ) {
+    return {
+      manifest,
+      publishable: false,
+      discovery_skip:
+        "Gradle application/build definition has no resolved Maven publication coordinates and component",
+    };
+  }
   return packageInfo(
     "maven-central",
-    group ? `${group}:${artifact}` : artifact,
-    capture(contents, /^\s*version\s*=\s*['"]([^'"]+)/m),
+    `${group}:${artifact}`,
+    version,
     manifest,
   );
 }
@@ -484,6 +734,21 @@ function packageInfo(
   return result;
 }
 
+/** A plain sibling VERSION file, as release tooling for Go/C++ often keeps. */
+export async function versionFile(manifestPath) {
+  try {
+    const value = (
+      await readManifest(path.join(path.dirname(manifestPath), "VERSION"))
+    ).trim();
+    return /^v?\d+(?:\.\d+){1,3}(?:[-+][\w.-]+)?$/.test(value) ? value : null;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
 // Editors on Windows may save a byte order mark; npm and Cargo accept it.
 async function readManifest(manifest) {
   return (await readFile(manifest, "utf8")).replace(/^\uFEFF/, "");

package/src/distribution-channel.mjs

@@ -0,0 +1,87 @@
+import { githubServices } from "./github.mjs";
+import { repositorySlug } from "./repository-identity.mjs";
+
+/** GitHub configuration is evidence about a channel, never public registry presence. */
+export async function auditDistributionChannel(session) {
+  const distribution = session.plan.package.distribution ?? {};
+  const scope = {
+    repo: repositorySlug(session.plan.repository),
+    ...(distribution.environment
+      ? { environment: distribution.environment }
+      : {}),
+  };
+  const github = session.options.github ?? githubServices(session.options);
+  const configured = distribution.remote
+    ? { verified: true, value: distribution.remote }
+    : await github.variables(scope).effective("CONAN_REMOTE_URL");
+  let remote = { status: configured.verified ? "missing" : "unknown" };
+  if (configured.value) {
+    try {
+      const url = new URL(configured.value);
+      remote = {
+        status:
+          configured.verified &&
+          ["https:", "http:"].includes(url.protocol) &&
+          !url.username &&
+          !url.password &&
+          !url.search &&
+          !url.hash
+            ? "configured"
+            : "invalid-or-secret-bearing",
+      };
+    } catch {
+      remote = { status: "invalid" };
+    }
+  }
+  const credentials = [];
+  for (const name of ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"]) {
+    try {
+      const result = await github.health.health(name, {
+        scope: { repo: scope.repo },
+        failurePatterns: ["conan.*(?:unauthorized|forbidden|authentication)"],
+      });
+      credentials.push({
+        name,
+        status: result.status,
+        evidence: (result.evidence ?? []).map(
+          ({ reason, status, workflow, job, step, runId, runUrl }) => ({
+            reason,
+            status,
+            workflow,
+            job,
+            step,
+            runId,
+            runUrl,
+          }),
+        ),
+        ...(scope.environment
+          ? {
+              limitation:
+                "health is repository workflow evidence; effective environment credentials require the selected CI job",
+            }
+          : {}),
+      });
+    } catch {
+      credentials.push({
+        name,
+        status: "unknown",
+        reason: "credential-health-unreadable",
+      });
+    }
+  }
+  const result = {
+    provider: "conan",
+    scope,
+    remote,
+    credentials,
+    publication: "unverified",
+    ci_validation: [
+      "conan create . --build=missing",
+      "run the recipe test_package consumer with the reviewed profiles",
+      "verify the exact reference on the chosen remote after reviewed CI publication",
+    ],
+  };
+  session.outcome = { status: "unverified", distribution: result };
+  console.log(JSON.stringify(result));
+  return result;
+}

package/src/exec.mjs

@@ -0,0 +1,20 @@
+import { execa } from "command-stream/execa";
+
+/** Capture an exact argument vector, including Windows PATHEXT launchers. */
+export async function exec(program, args, options = {}) {
+  const output = options.mirror ? ["pipe", "inherit"] : "pipe";
+  const result = await execa(program, args, {
+    cwd: options.cwd,
+    env: options.env,
+    stdin: options.stdin ?? "ignore",
+    stdout: output,
+    stderr: output,
+    reject: false,
+    stripFinalNewline: false,
+  });
+  return {
+    code: result.exitCode ?? 1,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+  };
+}