pi-harness-runtime 1.1.435 → 1.1.436

package/scripts/release/adapters/node-workspace.ts

@@ -105,9 +105,7 @@ export const nodeWorkspaceAdapter: ReleaseAdapter = {
 
 		// Must have workspaces field
 		try {
-			const raw = JSON.parse(
-				readFileSync(rootPkg, "utf-8") as unknown as string,
-			);
+			const raw = JSON.parse(readFileSync(rootPkg, "utf-8"));
 			if (raw.workspaces) return 0.9;
 		} catch {
 			// ignore

package/scripts/release/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "types": ["node"],
+    "noEmit": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": ["./**/*.ts"]
+}

package/scripts/typecheck-packages.mjs

@@ -36,7 +36,8 @@ const BASELINES = new Map([
 	["voice-api", 16],
 	["worktree", 0],
 	["harness", 20],
-	["scripts", 15],
+	["scripts", 9],
+	["scripts/release", 0],
 	["root", 2],
 	["new-modules", 0],
 ]);
@@ -67,11 +68,16 @@ for (const name of readdirSync(packagesDir).sort()) {
 	const project = join(packagesDir, name, "tsconfig.json");
 	if (existsSync(project)) projects.push(relative(root, project));
 }
-for (const extra of ["harness", "scripts"]) {
+for (const extra of ["harness", "scripts/release"]) {
 	if (existsSync(join(root, extra, "tsconfig.json"))) {
 		projects.push(join(extra, "tsconfig.json"));
 	}
 }
+// The scripts of the repository are their own project, with a config
+// of their own at the root of the repository.
+if (existsSync(join(root, "tsconfig.scripts.json"))) {
+	projects.push("tsconfig.scripts.json");
+}
 // The root extension (index.ts) has no project of its own - it is the entry
 // point of the extension and was never type checked.
 if (existsSync(join(root, "tsconfig.root.json"))) {
@@ -92,9 +98,16 @@ function ownerOf(projectPath) {
 	const normalized = projectPath.split("\\").join("/");
 	if (normalized === "tsconfig.root.json") return "root";
 	if (normalized === "tsconfig.new-modules.json") return "new-modules";
+	if (normalized === "tsconfig.scripts.json") return "scripts";
 	if (normalized.startsWith("packages/")) {
 		return normalized.split("/")[1];
 	}
+	// A project in a folder of its own (the release sources in
+	// scripts/release) is a project of its own, and not the project of
+	// the folder that holds it.
+	if (normalized.endsWith("/tsconfig.json")) {
+		return normalized.slice(0, -"/tsconfig.json".length);
+	}
 	return normalized.split("/")[0];
 }
 

package/scripts/verify-package-contents.ts

@@ -36,6 +36,12 @@ import {
 	packageNameOf,
 	resolveRelativeImport,
 } from "./lib/runtime-imports.js";
+import {
+	readTermsFile,
+	redactTerms,
+	scanText,
+	termsFromEnv,
+} from "./check-sensitive-terms.mjs";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const verifyTarball = process.argv.includes("--pack");
@@ -48,7 +54,8 @@ interface Problem {
 		| "missing-tarball"
 		| "missing-package"
 		| "forbidden-path"
-		| "missing-plugin";
+		| "missing-plugin"
+		| "sensitive-content";
 	detail: string;
 }
 
@@ -221,6 +228,66 @@ function checkPackageLayout(): void {
 	}
 }
 
+/**
+ * The terms of the list, and where they came from.
+ *
+ * The list is the repository secret, or the local file. A run without a
+ * list scans nothing - and says so, because "no name was found" and
+ * "nothing was looked at" are not the same statement.
+ */
+function sensitiveTerms(): { terms: string[]; source: string } {
+	const fromEnv = termsFromEnv(process.env);
+	if (fromEnv.length > 0) return { terms: fromEnv, source: "the environment" };
+	const file = process.env.PI_SENSITIVE_TERMS_FILE;
+	if (file) {
+		const terms = readTermsFile(file);
+		if (terms.length > 0) return { terms, source: file };
+	}
+	return { terms: [], source: "none" };
+}
+
+/**
+ * The published files must not hold a client name.
+ *
+ * The other checks look at the paths of the published files. This one
+ * looks at what is inside them: a name in a comment, in a doc or in a
+ * string is published like any other byte, and npm keeps a published
+ * version for a long time - long enough that the removal of one becomes
+ * a support ticket.
+ *
+ * The report names the file and the line and never the term, and the
+ * path is printed with the terms hidden because a path is often the
+ * place the term is in.
+ */
+function checkSensitiveContent(files: string[]): void {
+	const { terms, source } = sensitiveTerms();
+	if (terms.length === 0) {
+		// Nothing was checked. The release workflow runs this check on
+		// its own, with the secret, and it fails closed.
+		console.log(
+			"[verify-package-contents] the sensitive content scan was skipped: no term list is configured",
+		);
+		return;
+	}
+	for (const file of files) {
+		let content: string;
+		try {
+			content = readFileSync(join(ROOT, file), "utf8");
+		} catch {
+			continue;
+		}
+		for (const found of scanText(content, file, terms)) {
+			problems.push({
+				kind: "sensitive-content",
+				detail: `${redactTerms(found.path, terms)}:${found.line} holds a term from the sensitive list`,
+			});
+		}
+	}
+	console.log(
+		`[verify-package-contents] the sensitive content scan looked at ${files.length} published file(s) with the list of ${source}`,
+	);
+}
+
 /**
  * The postinstall copies the plugin from the package root.
  *
@@ -596,6 +663,7 @@ if (publishedFiles.length === 0) {
 	});
 } else {
 	checkRelativeImports(publishedFiles);
+	checkSensitiveContent(publishedFiles);
 	if (verifyTarball) inspectTarball(publishedFiles);
 }
 

package/scripts/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "compilerOptions": {
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "types": ["node"]
-  },
-  "include": ["./**/*.ts"]
-}