package-registry-manager 0.25.0 → 0.26.0

package/src/nuget-ci.mjs

@@ -0,0 +1,238 @@
+import { githubServices } from "./github.mjs";
+import { repositorySlug } from "./repository-identity.mjs";
+import { AUTH_FAILURE_PATTERNS } from "./publishing-policy.mjs";
+import { fileURLToPath } from "node:url";
+
+/** Job names (or reusable-call segments) whose skip would hide the release. */
+export function requiredJobs(pkg = {}) {
+  return [
+    ...(pkg.workflow_jobs ?? []),
+    ...(pkg.workflow_callees ?? []).map((chain) => chain.split(" -> ").at(-1)),
+  ].filter(Boolean);
+}
+
+/**
+ * Failed or cancelled jobs always block. A skipped job blocks only when it is a
+ * required release job (or when the required set is unknown); PR-only reviews
+ * and unchanged-component jobs legitimately skip on a push to main.
+ */
+export function unmetJobs(jobs, required) {
+  const isRequired = (job) =>
+    !required.length ||
+    job.name.split(" / ").some((segment) => required.includes(segment.trim()));
+  const unmet = jobs.filter(
+    (job) =>
+      !["success", "skipped"].includes(job.conclusion) ||
+      (job.conclusion === "skipped" && isRequired(job)),
+  );
+  if (
+    required.length &&
+    !jobs.some((job) => isRequired(job) && job.conclusion === "success")
+  ) {
+    unmet.push({ name: required.join(", "), conclusion: "missing" });
+  }
+  return unmet;
+}
+
+/** Fresh main-revision CI, actual method and exact public consumers are separate gates. */
+export async function verifyNugetRelease(session) {
+  const github = session.options.github ?? githubServices(session.options);
+  const slug = repositorySlug(session.plan.repository);
+  const publisher = session.plan.trusted_publisher;
+  const repo = await github.rest.request(`/repos/${slug}`);
+  const revision = await github.rest.request(
+    `/repos/${slug}/commits/${encodeURIComponent(repo.default_branch)}`,
+  );
+  const histories = await Promise.all(
+    ["push", "workflow_dispatch"].map((event) =>
+      github.runs.list(slug, {
+        workflow: publisher.workflow,
+        branch: repo.default_branch,
+        event,
+        limit: 100,
+      }),
+    ),
+  );
+  const runs = histories
+    .flat()
+    .filter(
+      (run) =>
+        run.head_branch === repo.default_branch &&
+        ["push", "workflow_dispatch"].includes(run.event),
+    )
+    .sort((a, b) => b.id - a.id);
+  const current = runs.find((run) => run.head_sha === revision.sha);
+  const failed = runs.find((run) => run.conclusion === "failure");
+  const changes =
+    session.options.recoveryChanges?.get(`${slug}:${publisher.workflow}`) ?? [];
+  let result;
+  if (failed && changes.length && current?.conclusion !== "success") {
+    const jobs = await github.runs.jobs(slug, failed.id);
+    const causal = [];
+    const auth = new RegExp(AUTH_FAILURE_PATTERNS.nuget.join("|"), "i");
+    for (const job of jobs.filter((job) => job.conclusion === "failure")) {
+      const log = await github.runs.jobLog(slug, job.id);
+      if (
+        typeof log === "string" &&
+        auth.test(log) &&
+        /nuget|NuGet\/login/i.test(log)
+      ) {
+        causal.push(job.id);
+      }
+    }
+    if (!causal.length) {
+      throw new Error(
+        "NuGet settings are verified but no causal authentication failure was established; unrelated CI was not restarted",
+      );
+    }
+    if (failed.head_sha !== revision.sha && !current) {
+      throw new Error(
+        "NuGet code repair has no run at current main; merge the reviewed workflow and follow its push run",
+      );
+    }
+    result = await github.repair.verify({
+      repo: slug,
+      workflow: publisher.workflow,
+      runId: failed.id,
+      jobIds: causal,
+      requiredPermissions: (session.plan.package.workflow_jobs ?? []).map(
+        (job) => ({ job, permission: "id-token", level: "write" }),
+      ),
+      changes: [
+        { kind: "setting", changed: true, verified: true },
+        ...(failed.head_sha !== revision.sha
+          ? [{ kind: "workflow", changed: true, verified: true }]
+          : []),
+      ],
+      ...(failed.head_sha !== revision.sha
+        ? {
+            revision: { ref: repo.default_branch, sha: revision.sha },
+            newRunId: current.id,
+          }
+        : {}),
+      timeout: session.options.waitTimeoutMs ?? 600000,
+    });
+    console.log(JSON.stringify({ nuget_ci: result }));
+    if (result.status !== "success") {
+      throw new Error(
+        `NuGet repaired CI remains ${result.status}; ${result.runUrl ?? failed.html_url}`,
+      );
+    }
+  }
+  const id = result?.runId ?? current?.id;
+  if (!id) {
+    throw new Error(
+      "NuGet current-main release has not executed; PR checks and settings readback do not verify publication",
+    );
+  }
+  const deadline = Date.now() + (session.options.waitTimeoutMs ?? 600000);
+  let run;
+  for (;;) {
+    run = await github.runs.get(slug, id);
+    if (run.status === "completed") {
+      break;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(
+        `NuGet current-main pipeline remains pending: ${run.html_url}`,
+      );
+    }
+    await new Promise((resolve) =>
+      setTimeout(resolve, session.options.pollIntervalMs ?? 5000),
+    );
+  }
+  const jobs = await github.runs.jobs(slug, id);
+  if (
+    run.head_sha !== revision.sha ||
+    run.status !== "completed" ||
+    run.conclusion !== "success" ||
+    !jobs.length ||
+    unmetJobs(jobs, requiredJobs(session.plan.package)).length
+  ) {
+    throw new Error(
+      `NuGet current-main pipeline has incomplete gates: ${run.html_url}`,
+    );
+  }
+  const methods = [];
+  for (const job of jobs) {
+    const source = await github.runs.jobLog(slug, job.id);
+    if (typeof source !== "string") {
+      continue;
+    }
+    for (const line of source.split("\n")) {
+      const start = line.indexOf('{"selected_method"');
+      if (start < 0) {
+        continue;
+      }
+      try {
+        const evidence = JSON.parse(line.slice(start));
+        if (
+          ["trusted-publishing", "token-fallback"].includes(
+            evidence.selected_method,
+          ) &&
+          evidence.publication === "accepted" &&
+          evidence.package_id?.toLowerCase() ===
+            session.plan.package.name.toLowerCase() &&
+          /^[0-9][0-9a-z.+-]*$/i.test(evidence.version ?? "")
+        ) {
+          methods.push({ job: job.name, ...evidence });
+        }
+      } catch {
+        /* Invalid or unavailable logs cannot establish a method. */
+      }
+    }
+  }
+  if (!methods.length) {
+    throw new Error(
+      "NuGet authentication method and actual upload are unverified; use the reviewed publication controller in current-main CI",
+    );
+  }
+  const fresh = await github.rest.request(
+    `/repos/${slug}/commits/${encodeURIComponent(repo.default_branch)}`,
+  );
+  if (fresh.sha !== run.head_sha) {
+    throw new Error(
+      "main advanced during NuGet verification; follow its new run before claiming completion",
+    );
+  }
+  const versions = [...new Set(methods.map((method) => method.version))];
+  if (versions.length !== 1) {
+    throw new Error("NuGet actual released version is ambiguous");
+  }
+  const released = { ...session.plan.package, version: versions[0] };
+  if (session.options.verifyNugetPublic) {
+    await session.options.verifyNugetPublic(released);
+  } else {
+    const checked = await session.capture({
+      command: {
+        program: "python3",
+        args: [
+          fileURLToPath(new URL("./nuget-publish.py", import.meta.url)),
+          "--verify-public",
+          session.plan.package.name,
+          released.version,
+        ],
+      },
+      cwd: ".",
+    });
+    if (checked.code !== 0) {
+      throw new Error(
+        "exact NuGet public download and consumer restore/build remain unverified",
+      );
+    }
+  }
+  session.outcome = {
+    status: "verified",
+    url: run.html_url,
+    ci: {
+      run_id: id,
+      attempt: run.run_attempt,
+      sha: run.head_sha,
+      jobs,
+      authentication: methods,
+    },
+    public_version: released.version,
+    consumer: "passed",
+  };
+  console.log(JSON.stringify(session.outcome));
+}

package/src/nuget-migration.mjs

@@ -0,0 +1,275 @@
+import { nugetWorkflowSteps } from "./nuget-workflow.mjs";
+
+export const NUGET_PREREQUISITE_EDIT =
+  "Split the NuGet publish step so one step runs only `dotnet nuget push <artifact glob> --api-key ... --source https://api.nuget.org/v3/index.json` (optionally behind a `should_publish` guard, `${A:-$B}` key selection, a key-presence check and `published=` outputs); pack, tests and any other command must stay in earlier steps.";
+
+function prerequisite(reason) {
+  const error = new Error(
+    `${reason}. Prerequisite edit: ${NUGET_PREREQUISITE_EDIT}`,
+  );
+  error.code = "nuget-prerequisite-edit";
+  error.prerequisite = NUGET_PREREQUISITE_EDIT;
+  return error;
+}
+
+/**
+ * Recognize the guarded multiline push used by links-notation style workflows.
+ * Every line must be the guard, key selection, presence check, notices,
+ * `published=` outputs or one nuget.org push; anything else is not migrated.
+ */
+export function guardedNugetPush(step) {
+  const start = step.findIndex((line) =>
+    /^\s*-?\s*run:\s*\|[-+]?\s*$/.test(line),
+  );
+  if (start < 0) {
+    return null;
+  }
+  const level = step[start].search(/\S/);
+  const body = [];
+  for (const line of step.slice(start + 1)) {
+    if (line.trim() && line.search(/\S/) <= level) {
+      break;
+    }
+    body.push(line.trim());
+  }
+  const joined = body.join("\n").replace(/\\\n\s*/g, " ");
+  const lines = joined
+    .split("\n")
+    .filter((line) => line && !line.startsWith("#"));
+  let guard = null;
+  let push = null;
+  let block = null;
+  for (const line of lines) {
+    const opened =
+      /^if \[ "\$\{\{\s*([\w.-]+)\s*\}\}" != "true" \]; then$/.exec(line);
+    if (opened && !block && !guard) {
+      guard = opened[1];
+      block = "guard";
+      continue;
+    }
+    if (/^if \[ -z "\$\w+" \]; then$/.test(line) && !block) {
+      block = "missing";
+      continue;
+    }
+    if (line === "fi" && block) {
+      block = null;
+      continue;
+    }
+    if (block === "guard" && /^exit 0$/.test(line)) {
+      continue;
+    }
+    if (block === "missing" && /^exit 1$/.test(line)) {
+      continue;
+    }
+    if (
+      /^set -[euxo pipefail]+$/.test(line) ||
+      /^\w+="\$\{\w+:-\$\w+\}"$/.test(line) ||
+      /^echo "[^"`$]*(?:\$\{\{[^}]*\}\}[^"`$]*)*"(?: >> "\$GITHUB_OUTPUT")?$/.test(
+        line,
+      )
+    ) {
+      continue;
+    }
+    const command =
+      /^dotnet nuget push (?:"([^"]+)"|'([^']+)'|(\S+))(.*)$/.exec(line);
+    if (command && !push && !block) {
+      push = command;
+      continue;
+    }
+    throw prerequisite(
+      `NuGet publish script contains an unreviewed command: ${line}`,
+    );
+  }
+  if (!push || block) {
+    throw prerequisite(
+      "NuGet multiline step has no single recognizable artifact push",
+    );
+  }
+  return {
+    guard,
+    glob: push[1] ?? push[2] ?? push[3],
+    options: push[4],
+    start,
+    level,
+  };
+}
+
+/** Preserve validation, build, artifact and step conditions when replacing a direct push. */
+export function convertNugetStep(step, packages, index) {
+  if (packages.length !== 1) {
+    throw new Error(
+      "NuGet migration requires a package-specific publishing step; ambiguous multi-package globs need explicit review",
+    );
+  }
+  const guarded = guardedNugetPush(step);
+  if (guarded) {
+    return convertGuarded(step, packages, index, guarded);
+  }
+  const run = step.find((line) => /^\s*-?\s*run:/.test(line));
+  const push =
+    /^\s*-?\s*run:\s*dotnet\s+nuget\s+push\s+(?:"([^"\n]+)"|'([^'\n]+)'|([^\s]+))\s*(.*)$/.exec(
+      run ?? "",
+    );
+  if (!push || /[;\n`]|\$\(/.test(push.slice(1).join(""))) {
+    throw prerequisite(
+      "NuGet script or multiline push requires a reviewed artifact-only publishing command; validation/build commands cannot be retried",
+    );
+  }
+  const glob = push[1] ?? push[2] ?? push[3];
+  if (!/^[\w./*${}-]+$/.test(glob) || glob.includes("${{")) {
+    throw new Error(
+      "NuGet artifact glob must resolve from job-local environment variables",
+    );
+  }
+  if (
+    /--source\s+(?!["']?https:\/\/api\.nuget\.org\/v3\/index\.json(?:["']?\s|$))/.test(
+      push[4],
+    )
+  ) {
+    throw new Error(
+      "NuGet policy migration requires the explicit nuget.org destination",
+    );
+  }
+  const custom = [...step.join("\n").matchAll(/secrets\.([\w]+)/g)].map(
+    (match) => match[1],
+  );
+  const output = nugetWorkflowSteps(
+    {
+      ...packages[0],
+      token_secrets: [...custom, ...(packages[0].token_secrets ?? [])],
+    },
+    { build: false, artifactGlob: glob },
+  );
+  const prefix = " ".repeat(step[0].search(/\S/));
+  const lines = output
+    .map((line) => prefix + line.slice(6))
+    .map((line) =>
+      line.replaceAll("prm_nuget_login", `prm_nuget_login_${index}`),
+    );
+  const condition = step.find((line) => /^\s*if:/.test(line));
+  const directory = step.find((line) => /^\s*working-directory:/.test(line));
+  const publish = lines.findIndex((line) =>
+    /- name: Publish validated NuGet/.test(line),
+  );
+  if (condition) {
+    const expression = condition
+      .trim()
+      .slice(3)
+      .trim()
+      .replace(/^\$\{\{\s*|\s*\}\}$/g, "");
+    const loginIf = lines.findIndex((line) => /if: vars.NUGET_USER/.test(line));
+    lines[loginIf] += ` && (${expression})`;
+    lines.splice(publish + 1, 0, `${prefix}  if: ${expression}`);
+  }
+  if (directory) {
+    lines.splice(
+      lines.findIndex((line) => /- name: Publish validated NuGet/.test(line)) +
+        1,
+      0,
+      `${prefix}  ${directory.trim()}`,
+    );
+  }
+  const envIndex = step.findIndex((line) => /^\s*env:/.test(line));
+  if (envIndex >= 0) {
+    if (!/^\s*env:\s*$/.test(step[envIndex])) {
+      throw new Error(
+        "NuGet migration requires a resolved step environment mapping",
+      );
+    }
+    const level = step[envIndex].search(/\S/);
+    const entries = [];
+    for (const line of step.slice(envIndex + 1)) {
+      if (line.trim() && line.search(/\S/) <= level) {
+        break;
+      }
+      if (/^\s*PRM_\w+:/.test(line)) {
+        throw new Error(
+          "NuGet migration cannot overwrite a publication controller environment",
+        );
+      }
+      entries.push(line);
+    }
+    const env = lines.findIndex((line) => /^\s*env:\s*$/.test(line));
+    lines.splice(env + 1, 0, ...entries);
+  }
+  return lines;
+}
+
+/** Guard -> OIDC login -> controller push of the same artifacts -> original outputs. */
+function convertGuarded(step, packages, index, guarded) {
+  if (
+    /--source\s+(?!["']?https:\/\/api\.nuget\.org\/v3\/index\.json)/.test(
+      guarded.options,
+    )
+  ) {
+    throw prerequisite(
+      "NuGet policy migration requires the explicit nuget.org destination",
+    );
+  }
+  if (!/^[\w./*-]+$/.test(guarded.glob)) {
+    throw prerequisite("NuGet artifact glob must be a literal job-local path");
+  }
+  const prefix = " ".repeat(step[0].search(/\S/));
+  const header = step.slice(0, guarded.start);
+  const name =
+    /-\s*name:\s*(.+)$/.exec(step[0])?.[1] ?? "Publish NuGet package";
+  const id = header
+    .map((line) => /^\s*id:\s*(\S+)/.exec(line)?.[1])
+    .find(Boolean);
+  const condition = header
+    .map((line) => /^\s*if:\s*(.+)$/.exec(line)?.[1])
+    .find(Boolean)
+    ?.replace(/^\$\{\{\s*|\s*\}\}$/g, "");
+  const secrets = [...step.join("\n").matchAll(/secrets\.(\w+)/g)].map(
+    (m) => m[1],
+  );
+  const gates = [condition, guarded.guard && `${guarded.guard} == 'true'`]
+    .filter(Boolean)
+    .map((part) => `(${part})`)
+    .join(" && ");
+  const publishId = `prm_nuget_publish_${index}`;
+  const lines = nugetWorkflowSteps(
+    {
+      ...packages[0],
+      token_secrets: [...secrets, ...(packages[0].token_secrets ?? [])],
+    },
+    { build: false, artifactGlob: guarded.glob },
+  )
+    .map((line) => prefix + line.slice(6))
+    .map((line) =>
+      line.replaceAll("prm_nuget_login", `prm_nuget_login_${index}`),
+    );
+  const loginIf = lines.findIndex((line) => /if: vars.NUGET_USER/.test(line));
+  if (gates) {
+    lines[loginIf] += ` && ${gates}`;
+  }
+  const publish = lines.findIndex((line) =>
+    /- name: Publish validated NuGet/.test(line),
+  );
+  lines.splice(
+    publish + 1,
+    0,
+    `${prefix}  id: ${publishId}`,
+    ...(gates ? [`${prefix}  if: ${gates}`] : []),
+  );
+  const record = [
+    `${prefix}- name: ${name}`,
+    ...(id ? [`${prefix}  id: ${id}`] : []),
+    `${prefix}  if: \${{ !cancelled()${condition ? ` && (${condition})` : ""} }}`,
+    `${prefix}  env:`,
+    `${prefix}    PRM_SHOULD_PUBLISH: ${guarded.guard ? `\${{ ${guarded.guard} }}` : "'true'"}`,
+    `${prefix}    PRM_PUBLISH_OUTCOME: \${{ steps.${publishId}.outcome }}`,
+    `${prefix}  run: |`,
+    `${prefix}    if [ "$PRM_SHOULD_PUBLISH" != "true" ]; then`,
+    `${prefix}      echo "published=skipped" >> "$GITHUB_OUTPUT"`,
+    `${prefix}      exit 0`,
+    `${prefix}    fi`,
+    `${prefix}    if [ "$PRM_PUBLISH_OUTCOME" = "success" ]; then`,
+    `${prefix}      echo "published=true" >> "$GITHUB_OUTPUT"`,
+    `${prefix}    else`,
+    `${prefix}      echo "published=failed" >> "$GITHUB_OUTPUT"`,
+    `${prefix}      exit 1`,
+    `${prefix}    fi`,
+  ];
+  return [...lines, ...record];
+}

package/src/nuget-page.mjs

@@ -0,0 +1,100 @@
+/* global document */
+/** Runs in the official NuGet Gallery page; never reads API keys or cookies. */
+export default function nugetPage(expected, create = false) {
+  const username =
+    document.querySelector("#account-dropdown b span")?.textContent.trim() ??
+    null;
+  const model = globalThis.ko?.dataFor(document.body);
+  if (!model?.Policies) {
+    return { username, policies: [], ready: false };
+  }
+  const read = (object, name) =>
+    typeof object?.[name] === "function" ? object[name]() : object?.[name];
+  const policies = model
+    .Policies()
+    .filter((policy) => read(policy, "PublisherName") === "GitHubActions")
+    .map((policy) => ({
+      id: read(policy, "Key"),
+      package_owner: read(policy, "Owner"),
+      organization: read(policy.gitHub, "RepositoryOwner"),
+      repository: read(policy.gitHub, "Repository"),
+      owner_id: String(read(policy.gitHub, "RepositoryOwnerId") ?? ""),
+      repository_id: String(read(policy.gitHub, "RepositoryId") ?? ""),
+      workflow: read(policy.gitHub, "WorkflowFile"),
+      environment: read(policy.gitHub, "Environment") ?? "",
+      package_ids: read(policy, "PolicySubjects") ?? [],
+      operations: read(policy, "PolicyScopes") ?? [],
+      activation: !read(policy, "IsOwnerValid")
+        ? "inactive"
+        : read(policy.gitHub, "IsPermanentlyEnabled")
+          ? "active"
+          : read(policy.gitHub, "EnabledDaysLeft") > 0
+            ? "temporarily-active"
+            : "inactive",
+    }));
+  const result = {
+    username,
+    policies,
+    ready: true,
+    pending: Boolean(read(model.NewPolicy(), "PendingCreateOrEdit")),
+    error: read(model, "Error") ?? null,
+  };
+  if (!create) {
+    return result;
+  }
+  if (username?.toLowerCase() !== expected.username.toLowerCase()) {
+    return { ...result, error: "wrong authenticated NuGet profile" };
+  }
+  // Never create another policy for a repository/workflow without explicit review.
+  if (
+    policies.some((policy) =>
+      ["organization", "repository", "workflow", "environment"].every(
+        (field) =>
+          String(policy[field] ?? "").toLowerCase() ===
+          String(expected[field] ?? "").toLowerCase(),
+      ),
+    )
+  ) {
+    return {
+      ...result,
+      error:
+        "existing repository policy requires review; duplicate creation refused",
+    };
+  }
+  const draft = model.NewPolicy();
+  const owners = read(draft, "PackageOwners") ?? [];
+  const owner = owners.find(
+    (item) => item.Owner.toLowerCase() === expected.package_owner.toLowerCase(),
+  );
+  if (
+    !owner ||
+    expected.operations.length !== 1 ||
+    !(expected.operations[0] === "package:push"
+      ? owner.CanPushNew
+      : owner.CanPushExisting)
+  ) {
+    return {
+      ...result,
+      error: "exact package owner or required operation is unavailable",
+    };
+  }
+  draft.PackageOwner(owner);
+  draft.SelectedProvider("GitHubActions");
+  draft.PendingPolicyName(
+    `prm-${expected.organization}-${expected.repository}-${expected.workflow}`,
+  );
+  draft.gitHub.PendingRepositoryOwner(expected.organization);
+  draft.gitHub.PendingRepository(expected.repository);
+  draft.gitHub.PendingWorkflowFile(expected.workflow);
+  draft.gitHub.PendingEnvironment(expected.environment ?? "");
+  draft.PushScopeChecked(true);
+  draft.PushScope(expected.operations[0]);
+  draft.UnlistScopeChecked(false);
+  draft.StageScopeChecked(false);
+  draft.ScopeSubjectsInput(expected.package_ids.join("\n"));
+  if (!draft.Valid()) {
+    return { ...result, error: "NuGet rejected the exact policy fields" };
+  }
+  draft.CreateOrEdit();
+  return { ...result, submitted: true };
+}