putitoutthere 0.2.9 → 0.2.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +1 -0
- package/MIGRATIONS.md +67 -0
- package/README.md +26 -0
- package/dist/error-codes.d.ts +7 -0
- package/dist/error-codes.d.ts.map +1 -1
- package/dist/error-codes.js +8 -0
- package/dist/error-codes.js.map +1 -1
- package/dist/handlers/npm.d.ts.map +1 -1
- package/dist/handlers/npm.js +24 -5
- package/dist/handlers/npm.js.map +1 -1
- package/dist/preflight.d.ts +51 -10
- package/dist/preflight.d.ts.map +1 -1
- package/dist/preflight.js +104 -10
- package/dist/preflight.js.map +1 -1
- package/dist/publish.d.ts.map +1 -1
- package/dist/publish.js +6 -1
- package/dist/publish.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -12,6 +12,7 @@ are prefixed `**BREAKING**` and link to the matching section in
|
|
|
12
12
|
|
|
13
13
|
### Added
|
|
14
14
|
|
|
15
|
+
- **Preflight check: every cascaded `kind = "npm"` package must declare a non-empty `repository` field in `package.json`.** `putitoutthere` invokes `npm publish --provenance` on the OIDC trusted-publisher path, and the npm CLI hard-requires this field so the registry can verify the artifact was built from the repo the trusted publisher declares. A missing or empty field previously surfaced as a confusing tail-end npm error after the runner had spun up, OIDC had been negotiated, and the artifact had been built — wasting a full release run on a precondition checkable in milliseconds. The new `requireProvenanceMetadata` runs alongside `requireAuth` in `src/publish.ts`, before any side effects, and reports every failing package in one error rather than failing on the first. Surfaces a new stable error code, `PIOT_NPM_MISSING_REPOSITORY`. Both the canonical object form (`{ type, url, directory? }`) and the legacy single-string form are accepted; only an empty `url` (or no `url` at all) fails. The npm handler's inline backstop is also tightened to match the same predicate (previously `!pkg.repository` slipped `{}`, `{ type: 'git' }`, and whitespace strings through). Documented in [README → `kind = "npm"`](./README.md#kind--npm). See [MIGRATIONS.md](./MIGRATIONS.md#npm-package-json-must-declare-repository). #280.
|
|
15
16
|
- **Reusable workflow `.github/workflows/build.yml` (`workflow_call`).** PR-time build verification: runs the same plan + build matrix that `release.yml` runs, calling a shared internal `_matrix.yml` reusable workflow so action pins, per-target build steps, and runner selection cannot drift between the two paths. `build.yml` declares only `permissions: contents: read` and contains no publish job, no `id-token: write`, no OIDC trusted-publisher exchange, and no registry auth — the bytes required to publish do not exist on this code path. Two optional inputs forwarded to `_matrix.yml`: `node_version` (default `24`), `python_version` (default `3.12`). Concurrency is keyed on `github.ref` with `cancel-in-progress: true` so PR pushes supersede stale runs (release.yml's repository-keyed group with `cancel-in-progress: false` is unchanged). An `actionlint`-job grep assertion rejects any future patch that adds `id-token: write` to `build.yml` or `_matrix.yml`. See [README → Build check](./README.md#1b-optional-drop-in-githubworkflowsbuild-checkyml) and [MIGRATIONS.md](./MIGRATIONS.md#new-buildyml-reusable-workflow-for-pr-time-build-verification).
|
|
16
17
|
- **`PIOT_PUBLISH_EMPTY_PLAN` error code.** Surfaced when `publish` is invoked with an empty matrix. Joins `PIOT_AUTH_NO_TOKEN` in the stable error-code vocabulary; foreign agents debugging a failed publish can fingerprint on the code without parsing prose.
|
|
17
18
|
- **`kind = "npm"` `build` accepts an array of entries with consumer-defined platform-package name templates.** For packages that ship both a napi-rs Node addon and a CLI binary from the same npm package (the `@swc/core` shape), declare `build = [{ mode = "napi", name = "@scope/lib-{triple}" }, { mode = "bundled-cli", name = "@scope/cli-{triple}" }]`. Each entry contributes its own per-platform package family; the main package's `optionalDependencies` spans both. Entries can be bare mode strings (`"napi"`, defaults to `{name}-{triple}` template) or `{ mode, name }` objects. Variables surfaced in `name` templates: `{name}`, `{scope}`, `{base}`, `{triple}`, `{mode}`. `{version}` is intentionally not surfaced. Single-mode string form (`build = "napi"`) preserved byte-for-byte — same artifact-name layout, same platform-package names, no migration pressure on existing consumers. See [README → Recipes → Multi-mode npm family](./README.md#multi-mode-npm-family) and [MIGRATIONS.md](./MIGRATIONS.md#npm-build-accepts-array-of-entries).
|
package/MIGRATIONS.md
CHANGED
|
@@ -21,6 +21,73 @@ Each section covers five things, in order:
|
|
|
21
21
|
|
|
22
22
|
## Unreleased
|
|
23
23
|
|
|
24
|
+
### npm package.json must declare `repository`
|
|
25
|
+
|
|
26
|
+
**Summary.** Every cascaded `kind = "npm"` package's `package.json`
|
|
27
|
+
must now carry a non-empty `repository` field. The new preflight
|
|
28
|
+
check (`requireProvenanceMetadata` in `src/preflight.ts`) runs in
|
|
29
|
+
`src/publish.ts` immediately after `requireAuth` and rejects the
|
|
30
|
+
run with `PIOT_NPM_MISSING_REPOSITORY` before any runner work.
|
|
31
|
+
Why: `putitoutthere` invokes `npm publish --provenance` on the OIDC
|
|
32
|
+
trusted-publisher path; the npm CLI hard-requires this field so the
|
|
33
|
+
registry can verify the artifact was built from the repo the trusted
|
|
34
|
+
publisher declares. A missing or empty field previously surfaced
|
|
35
|
+
only after the runner had spun up, OIDC had been negotiated, and
|
|
36
|
+
the artifact had been built — wasting a full release run on a
|
|
37
|
+
precondition checkable in milliseconds. Hit in the wild on
|
|
38
|
+
`coaxer@0.1.1`'s first npm release; tracked in #280.
|
|
39
|
+
|
|
40
|
+
The npm handler's inline backstop (`assertRepositoryField` in
|
|
41
|
+
`src/handlers/npm.ts`) is also tightened. Previously it used
|
|
42
|
+
`if (!pkg.repository)` — falsy-only — which let three real shapes
|
|
43
|
+
slip through: an object without `url` (`{ type: 'git' }`), an
|
|
44
|
+
empty object (`{}`), and a whitespace-only string (`' '`). All
|
|
45
|
+
three are now rejected; the error message also carries the stable
|
|
46
|
+
`PIOT_NPM_MISSING_REPOSITORY` code and the path of the offending
|
|
47
|
+
file, matching the preflight error.
|
|
48
|
+
|
|
49
|
+
**Required changes.** Add a `repository` block to every
|
|
50
|
+
`package.json` declared as `kind = "npm"` in
|
|
51
|
+
`putitoutthere.toml`. Canonical shape:
|
|
52
|
+
|
|
53
|
+
| Before | After |
|
|
54
|
+
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
55
|
+
| `{ "name": "@scope/lib", "version": "0.1.0" }` | `{ "name": "@scope/lib", "version": "0.1.0", "repository": { "type": "git", "url": "git+https://github.com/<owner>/<repo>.git", "directory": "<path/to/package>" } }` |
|
|
56
|
+
|
|
57
|
+
`directory` is needed for monorepo packages so npm can locate the
|
|
58
|
+
source within the repo. Both the object form and the legacy single-
|
|
59
|
+
string form (`"repository": "git+https://github.com/<owner>/<repo>.git"`)
|
|
60
|
+
are accepted; only a missing field, an empty string, or an object
|
|
61
|
+
without a non-empty `url` fails the check.
|
|
62
|
+
|
|
63
|
+
No `release.yml` or `putitoutthere.toml` changes are required.
|
|
64
|
+
|
|
65
|
+
**Deprecations removed.** None.
|
|
66
|
+
|
|
67
|
+
**Behavior changes without code changes.** `putitoutthere publish`
|
|
68
|
+
now fails fast at preflight with
|
|
69
|
+
`[PIOT_NPM_MISSING_REPOSITORY] npm publish requires a non-empty
|
|
70
|
+
\`repository\` field in package.json` for any cascaded npm package
|
|
71
|
+
whose `package.json` lacks the field. Previously the same shape
|
|
72
|
+
ran through plan + build + auth-negotiation + artifact-staging
|
|
73
|
+
and failed inside `npm publish` with `npm publish --provenance
|
|
74
|
+
requires a \`repository\` field in package.json`. Well-formed
|
|
75
|
+
packages are unaffected.
|
|
76
|
+
|
|
77
|
+
The error message names every failing package and its
|
|
78
|
+
`package.json` path so consumers fix all of them in one round-trip
|
|
79
|
+
rather than discovering them one at a time across multiple release
|
|
80
|
+
attempts.
|
|
81
|
+
|
|
82
|
+
**Verification.** Drop the `repository` field from one of your
|
|
83
|
+
`package.json` files locally and run `pnpm test:integration` (or
|
|
84
|
+
the engine against a local fixture); the failure should arrive at
|
|
85
|
+
preflight with `PIOT_NPM_MISSING_REPOSITORY` in the message, no
|
|
86
|
+
platform packages should be published, and no git tag should be
|
|
87
|
+
created. Restore the field; the next run completes normally.
|
|
88
|
+
|
|
89
|
+
---
|
|
90
|
+
|
|
24
91
|
### pypi/maturin version bump at build
|
|
25
92
|
|
|
26
93
|
**Summary.** `pypi` packages built with `build = "maturin"` now ship
|
package/README.md
CHANGED
|
@@ -183,6 +183,32 @@ version = 1 # required; only 1 is valid today
|
|
|
183
183
|
| `build` | string \| array | `"napi"` \| `"bundled-cli"` (single mode), or an array of entries (each: a bare mode string or `{ mode, name }` with a [name template](#multi-mode-npm-family)). Omitted = vanilla. See [Recipes → Bundled-CLI npm family](#bundled-cli-npm-family). |
|
|
184
184
|
| `targets` | (string \| object)[] | Required when `build` is set. |
|
|
185
185
|
|
|
186
|
+
> [!IMPORTANT]
|
|
187
|
+
> **`package.json` MUST declare a non-empty `repository` field.** `putitoutthere`
|
|
188
|
+
> publishes npm packages with `npm publish --provenance` on the OIDC
|
|
189
|
+
> trusted-publisher path; the npm CLI hard-requires `repository` so the
|
|
190
|
+
> registry can verify the artifact was built from the repo the trusted
|
|
191
|
+
> publisher declares. Preflight rejects the run with
|
|
192
|
+
> `PIOT_NPM_MISSING_REPOSITORY` when the field is missing or empty.
|
|
193
|
+
>
|
|
194
|
+
> Canonical shape (use this in every npm `package.json` you publish through
|
|
195
|
+
> `putitoutthere`):
|
|
196
|
+
>
|
|
197
|
+
> ```json
|
|
198
|
+
> {
|
|
199
|
+
> "repository": {
|
|
200
|
+
> "type": "git",
|
|
201
|
+
> "url": "git+https://github.com/<owner>/<repo>.git",
|
|
202
|
+
> "directory": "<path/to/package>"
|
|
203
|
+
> }
|
|
204
|
+
> }
|
|
205
|
+
> ```
|
|
206
|
+
>
|
|
207
|
+
> `directory` is needed for monorepo packages so npm can locate the source
|
|
208
|
+
> within the repo. The legacy single-string form
|
|
209
|
+
> (`"repository": "git+https://github.com/<owner>/<repo>.git"`) is also
|
|
210
|
+
> accepted.
|
|
211
|
+
|
|
186
212
|
### Example: polyglot Rust library
|
|
187
213
|
|
|
188
214
|
One Rust crate feeds three artifacts:
|
package/dist/error-codes.d.ts
CHANGED
|
@@ -29,6 +29,13 @@ export declare const ErrorCodes: {
|
|
|
29
29
|
* prevent this from being reached; if it fires, the gate was
|
|
30
30
|
* bypassed or the engine is inconsistent. */
|
|
31
31
|
readonly PUBLISH_EMPTY_PLAN: "PIOT_PUBLISH_EMPTY_PLAN";
|
|
32
|
+
/** An npm package's `package.json` is missing a non-empty
|
|
33
|
+
* `repository` field. `npm publish --provenance` (the OIDC
|
|
34
|
+
* trusted-publisher path) requires it so the registry can verify
|
|
35
|
+
* the artifact was built from the repo the trusted publisher
|
|
36
|
+
* declares. Failing at preflight prevents wasting a build run on
|
|
37
|
+
* a precondition checkable in milliseconds. #280. */
|
|
38
|
+
readonly NPM_MISSING_REPOSITORY: "PIOT_NPM_MISSING_REPOSITORY";
|
|
32
39
|
};
|
|
33
40
|
export type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];
|
|
34
41
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;
|
|
1
|
+
{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,UAAU;IACrB;;;8CAG0C;;IAE1C;;;;;;kDAM8C;;IAE9C;;;;;0DAKsD;;CAE9C,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EAI/C,CAAC"}
|
package/dist/error-codes.js
CHANGED
|
@@ -29,6 +29,13 @@ export const ErrorCodes = {
|
|
|
29
29
|
* prevent this from being reached; if it fires, the gate was
|
|
30
30
|
* bypassed or the engine is inconsistent. */
|
|
31
31
|
PUBLISH_EMPTY_PLAN: 'PIOT_PUBLISH_EMPTY_PLAN',
|
|
32
|
+
/** An npm package's `package.json` is missing a non-empty
|
|
33
|
+
* `repository` field. `npm publish --provenance` (the OIDC
|
|
34
|
+
* trusted-publisher path) requires it so the registry can verify
|
|
35
|
+
* the artifact was built from the repo the trusted publisher
|
|
36
|
+
* declares. Failing at preflight prevents wasting a build run on
|
|
37
|
+
* a precondition checkable in milliseconds. #280. */
|
|
38
|
+
NPM_MISSING_REPOSITORY: 'PIOT_NPM_MISSING_REPOSITORY',
|
|
32
39
|
};
|
|
33
40
|
/**
|
|
34
41
|
* Iterable form of the codes. Walked by tests for uniqueness/format
|
|
@@ -37,5 +44,6 @@ export const ErrorCodes = {
|
|
|
37
44
|
export const ALL_ERROR_CODES = [
|
|
38
45
|
ErrorCodes.AUTH_NO_TOKEN,
|
|
39
46
|
ErrorCodes.PUBLISH_EMPTY_PLAN,
|
|
47
|
+
ErrorCodes.NPM_MISSING_REPOSITORY,
|
|
40
48
|
];
|
|
41
49
|
//# sourceMappingURL=error-codes.js.map
|
package/dist/error-codes.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;
|
|
1
|
+
{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../src/error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB;;;8CAG0C;IAC1C,aAAa,EAAE,oBAAoB;IACnC;;;;;;kDAM8C;IAC9C,kBAAkB,EAAE,yBAAyB;IAC7C;;;;;0DAKsD;IACtD,sBAAsB,EAAE,6BAA6B;CAC7C,CAAC;AAIX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB;IACnD,UAAU,CAAC,aAAa;IACxB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,sBAAsB;CAClC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAA6B,KAAK,OAAO,EAAwC,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAA6B,KAAK,OAAO,EAAwC,MAAM,aAAa,CAAC;AAgN5G;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBvE;AAYD,eAAO,MAAM,GAAG,EAAE,OAKjB,CAAC"}
|
package/dist/handlers/npm.js
CHANGED
|
@@ -13,6 +13,7 @@ import { join } from 'node:path';
|
|
|
13
13
|
import { normalizeTarget } from '../types.js';
|
|
14
14
|
import { looksLikePublishOverRace, normalizeBuild, publishPlatforms, } from './npm-platform.js';
|
|
15
15
|
import { buildSubprocessEnv, nonEmpty } from '../env.js';
|
|
16
|
+
import { ErrorCodes } from '../error-codes.js';
|
|
16
17
|
import { USER_AGENT } from '../version.js';
|
|
17
18
|
function npmNameFor(pkg) {
|
|
18
19
|
return pkg.npm ?? pkg.name;
|
|
@@ -88,9 +89,12 @@ async function publishImpl(pkg, version, ctx) {
|
|
|
88
89
|
}
|
|
89
90
|
const hasOidc = Boolean(nonEmpty(ctx.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) ??
|
|
90
91
|
nonEmpty(process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN));
|
|
91
|
-
// npm provenance requires a `repository` field in
|
|
92
|
-
// that matches the git remote.
|
|
93
|
-
//
|
|
92
|
+
// npm provenance requires a non-empty `repository` field in
|
|
93
|
+
// package.json that matches the git remote. The primary check is
|
|
94
|
+
// `requireProvenanceMetadata` in src/preflight.ts (#280), which
|
|
95
|
+
// runs before any runner work. This inline assertion is a
|
|
96
|
+
// defensive backstop for direct handler calls that bypass the
|
|
97
|
+
// publish pipeline.
|
|
94
98
|
if (hasOidc) {
|
|
95
99
|
assertRepositoryField(pkg.path);
|
|
96
100
|
}
|
|
@@ -150,8 +154,23 @@ function assertRepositoryField(path) {
|
|
|
150
154
|
const pkgJsonPath = join(path, 'package.json');
|
|
151
155
|
const raw = readFileSync(pkgJsonPath, 'utf8');
|
|
152
156
|
const pkg = JSON.parse(raw);
|
|
153
|
-
|
|
154
|
-
|
|
157
|
+
const repository = pkg.repository;
|
|
158
|
+
// Accept either the canonical object form (`{ type, url, … }`) or
|
|
159
|
+
// the legacy single-string form. Both shapes must carry a non-empty
|
|
160
|
+
// URL after trimming. `!pkg.repository` would pass `{}` and
|
|
161
|
+
// `{ type: 'git' }` since both are truthy — that's the bug #280
|
|
162
|
+
// is closing.
|
|
163
|
+
let ok = false;
|
|
164
|
+
if (typeof repository === 'string') {
|
|
165
|
+
ok = repository.trim().length > 0;
|
|
166
|
+
}
|
|
167
|
+
else if (repository !== null && typeof repository === 'object') {
|
|
168
|
+
const url = repository.url;
|
|
169
|
+
ok = typeof url === 'string' && url.trim().length > 0;
|
|
170
|
+
}
|
|
171
|
+
if (!ok) {
|
|
172
|
+
throw new Error(`[${ErrorCodes.NPM_MISSING_REPOSITORY}] npm publish --provenance requires a non-empty \`repository\` field in ${pkgJsonPath}. ` +
|
|
173
|
+
'See https://github.com/thekevinscott/putitoutthere#kind--npm.');
|
|
155
174
|
}
|
|
156
175
|
}
|
|
157
176
|
/** Heuristic match on npm's auth-related stderr shapes. */
|
package/dist/handlers/npm.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAgE,MAAM,aAAa,CAAC;AAC5G,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,YAAY;YACnB,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC3D,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF
|
|
1
|
+
{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/handlers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAgE,MAAM,aAAa,CAAC;AAC5G,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAmB3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,6DAA6D;QAC7D,4DAA4D;QAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAS;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,4DAA4D;QAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,iEAAiE;IACjE,uDAAuD;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe,EAAE,GAAQ;IAC/D,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,WAAW,GAAgB;YAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,YAAY;YACnB,iEAAiE;YACjE,kEAAkE;YAClE,6DAA6D;YAC7D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SAC3D,CAAC;QACF,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CACvD,CAAC;IAEF,4DAA4D;IAC5D,iEAAiE;IACjE,gEAAgE;IAChE,0DAA0D;IAC1D,8DAA8D;IAC9D,oBAAoB;IACpB,IAAI,OAAO,EAAE,CAAC;QACZ,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;IACtC,MAAM,IAAI,GAAa,CAAC,SAAS,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,gEAAgE;YAChE,2CAA2C;YAC3C,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,GAAG,EAAE,iCAAiC,IAAI,MAAM,OAAO,EAAE;aAC1D,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,kCAAkC;QAClC,IAAI,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb;oBACE,yBAAyB,IAAI,6CAA6C;oBAC1E,6DAA6D;oBAC7D,+GAA+G;iBAChH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,iCAAiC,UAAU,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,gEAAgE;IAChE,cAAc;IACd,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,GAAG,GAAI,UAAgC,CAAC,GAAG,CAAC;QAClD,EAAE,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,sBAAsB,2EAA2E,WAAW,IAAI;YAC7H,+DAA+D,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,qFAAqF,CAAC,IAAI,CAC/F,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,IAAI,CAAC;QACH,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAC/E;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CACF,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,gEAAgE;QAChE,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,gBAAgB;IAC9B,OAAO,EAAE,WAAW;CACrB,CAAC"}
|
package/dist/preflight.d.ts
CHANGED
|
@@ -1,17 +1,24 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pre-flight
|
|
3
|
-
* every cascaded package has usable credentials.
|
|
2
|
+
* Pre-flight checks. Run before any publish side effect.
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
* OIDC
|
|
8
|
-
*
|
|
4
|
+
* Auth (`requireAuth` / `checkAuth`) — every cascaded package has a
|
|
5
|
+
* viable credentials path. Per plan.md §16.3: each handler accepts
|
|
6
|
+
* OIDC (detected by `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific
|
|
7
|
+
* long-lived env var.
|
|
9
8
|
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
9
|
+
* npm provenance metadata (`requireProvenanceMetadata` /
|
|
10
|
+
* `checkProvenanceMetadata`) — every npm package's `package.json`
|
|
11
|
+
* carries a non-empty `repository` field. `npm publish --provenance`
|
|
12
|
+
* (the OIDC trusted-publisher path) hard-requires this; failing
|
|
13
|
+
* here, before runner work, beats failing deep inside the npm CLI
|
|
14
|
+
* after artifact upload + OIDC negotiation. #280.
|
|
13
15
|
*
|
|
14
|
-
*
|
|
16
|
+
* Each function reports; callers decide whether to throw. The
|
|
17
|
+
* `require*` variants are the publish path; the `check*` variants
|
|
18
|
+
* exist so future diagnostic surfaces can render tables instead of
|
|
19
|
+
* aborting.
|
|
20
|
+
*
|
|
21
|
+
* Issue #14, #280.
|
|
15
22
|
*/
|
|
16
23
|
import type { Package } from './config.js';
|
|
17
24
|
import type { Kind } from './types.js';
|
|
@@ -30,4 +37,38 @@ export interface AuthStatus {
|
|
|
30
37
|
}
|
|
31
38
|
export declare function checkAuth(packages: readonly Package[]): AuthStatus;
|
|
32
39
|
export declare function requireAuth(packages: readonly Package[]): void;
|
|
40
|
+
export interface ProvenanceFinding {
|
|
41
|
+
package: string;
|
|
42
|
+
/** Pkg-relative `package.json` path examined. */
|
|
43
|
+
packageJsonPath: string;
|
|
44
|
+
/** Why the field is unusable: missing entirely, or empty/no-url. */
|
|
45
|
+
reason: 'missing' | 'empty';
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Scan every npm package's `package.json` for a non-empty `repository`
|
|
49
|
+
* field. Returns the list of findings; an empty list means every npm
|
|
50
|
+
* package is well-formed.
|
|
51
|
+
*
|
|
52
|
+
* `repository` is accepted in either the canonical object form
|
|
53
|
+
* (`{ type, url, directory? }`) or the legacy single-string form
|
|
54
|
+
* (`"git+https://…"`). The string form must be non-empty after
|
|
55
|
+
* trimming; the object form must carry a non-empty `url`.
|
|
56
|
+
*
|
|
57
|
+
* Non-npm packages and a malformed `package.json` (parse error) are
|
|
58
|
+
* skipped — other parts of the pipeline already cover those failure
|
|
59
|
+
* modes; this check is scoped to the `repository` field alone.
|
|
60
|
+
*/
|
|
61
|
+
export declare function checkProvenanceMetadata(packages: readonly Package[]): ProvenanceFinding[];
|
|
62
|
+
/**
|
|
63
|
+
* Throw with an actionable error when any npm package's `package.json`
|
|
64
|
+
* lacks a non-empty `repository` field. Reports every failing package
|
|
65
|
+
* in one error rather than failing on the first, so consumers fix
|
|
66
|
+
* them all in one round-trip.
|
|
67
|
+
*
|
|
68
|
+
* Always runs (not OIDC-gated): the README demands the field for
|
|
69
|
+
* every npm publish, and `npm publish --provenance` is putitoutthere's
|
|
70
|
+
* blessed publish mode. Even on the token path, missing `repository`
|
|
71
|
+
* is a misconfiguration — fail fast.
|
|
72
|
+
*/
|
|
73
|
+
export declare function requireProvenanceMetadata(packages: readonly Package[]): void;
|
|
33
74
|
//# sourceMappingURL=preflight.d.ts.map
|
package/dist/preflight.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAqBvC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAClC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAgBlE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAiB9D;AAcD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAC3B,iBAAiB,EAAE,CA0BrB;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CA8B5E"}
|
package/dist/preflight.js
CHANGED
|
@@ -1,18 +1,28 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pre-flight
|
|
3
|
-
* every cascaded package has usable credentials.
|
|
2
|
+
* Pre-flight checks. Run before any publish side effect.
|
|
4
3
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
* OIDC
|
|
8
|
-
*
|
|
4
|
+
* Auth (`requireAuth` / `checkAuth`) — every cascaded package has a
|
|
5
|
+
* viable credentials path. Per plan.md §16.3: each handler accepts
|
|
6
|
+
* OIDC (detected by `ACTIONS_ID_TOKEN_REQUEST_TOKEN`) or a specific
|
|
7
|
+
* long-lived env var.
|
|
9
8
|
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
9
|
+
* npm provenance metadata (`requireProvenanceMetadata` /
|
|
10
|
+
* `checkProvenanceMetadata`) — every npm package's `package.json`
|
|
11
|
+
* carries a non-empty `repository` field. `npm publish --provenance`
|
|
12
|
+
* (the OIDC trusted-publisher path) hard-requires this; failing
|
|
13
|
+
* here, before runner work, beats failing deep inside the npm CLI
|
|
14
|
+
* after artifact upload + OIDC negotiation. #280.
|
|
13
15
|
*
|
|
14
|
-
*
|
|
16
|
+
* Each function reports; callers decide whether to throw. The
|
|
17
|
+
* `require*` variants are the publish path; the `check*` variants
|
|
18
|
+
* exist so future diagnostic surfaces can render tables instead of
|
|
19
|
+
* aborting.
|
|
20
|
+
*
|
|
21
|
+
* Issue #14, #280.
|
|
15
22
|
*/
|
|
23
|
+
import { readFileSync } from 'node:fs';
|
|
24
|
+
import { join } from 'node:path';
|
|
25
|
+
import { ErrorCodes } from './error-codes.js';
|
|
16
26
|
// Per-kind accepted env var names, primary first. `checkAuth` scans left
|
|
17
27
|
// to right and reports the first that has a non-empty value. npm takes
|
|
18
28
|
// two names because ecosystems have split on the convention:
|
|
@@ -67,4 +77,88 @@ export function requireAuth(packages) {
|
|
|
67
77
|
function nonEmpty(v) {
|
|
68
78
|
return typeof v === 'string' && v.trim().length > 0;
|
|
69
79
|
}
|
|
80
|
+
/* ----------------------- npm provenance metadata ----------------------- */
|
|
81
|
+
// Anchor for the README section that documents the field requirement.
|
|
82
|
+
// Surfaced verbatim in the thrown error so users have something
|
|
83
|
+
// actionable to follow rather than a code-search target.
|
|
84
|
+
const REPOSITORY_DOC_POINTER = 'https://github.com/thekevinscott/putitoutthere#kind--npm';
|
|
85
|
+
/**
|
|
86
|
+
* Scan every npm package's `package.json` for a non-empty `repository`
|
|
87
|
+
* field. Returns the list of findings; an empty list means every npm
|
|
88
|
+
* package is well-formed.
|
|
89
|
+
*
|
|
90
|
+
* `repository` is accepted in either the canonical object form
|
|
91
|
+
* (`{ type, url, directory? }`) or the legacy single-string form
|
|
92
|
+
* (`"git+https://…"`). The string form must be non-empty after
|
|
93
|
+
* trimming; the object form must carry a non-empty `url`.
|
|
94
|
+
*
|
|
95
|
+
* Non-npm packages and a malformed `package.json` (parse error) are
|
|
96
|
+
* skipped — other parts of the pipeline already cover those failure
|
|
97
|
+
* modes; this check is scoped to the `repository` field alone.
|
|
98
|
+
*/
|
|
99
|
+
export function checkProvenanceMetadata(packages) {
|
|
100
|
+
const findings = [];
|
|
101
|
+
for (const p of packages) {
|
|
102
|
+
if (p.kind !== 'npm')
|
|
103
|
+
continue;
|
|
104
|
+
const pkgJsonPath = join(p.path, 'package.json');
|
|
105
|
+
let raw;
|
|
106
|
+
try {
|
|
107
|
+
raw = readFileSync(pkgJsonPath, 'utf8');
|
|
108
|
+
}
|
|
109
|
+
catch {
|
|
110
|
+
findings.push({ package: p.name, packageJsonPath: pkgJsonPath, reason: 'missing' });
|
|
111
|
+
continue;
|
|
112
|
+
}
|
|
113
|
+
let parsed;
|
|
114
|
+
try {
|
|
115
|
+
parsed = JSON.parse(raw);
|
|
116
|
+
}
|
|
117
|
+
catch {
|
|
118
|
+
// A malformed package.json is a different failure surface;
|
|
119
|
+
// leave it to the publish step to bubble up. This check only
|
|
120
|
+
// owns the `repository` field.
|
|
121
|
+
continue;
|
|
122
|
+
}
|
|
123
|
+
if (!hasNonEmptyRepository(parsed.repository)) {
|
|
124
|
+
findings.push({ package: p.name, packageJsonPath: pkgJsonPath, reason: 'empty' });
|
|
125
|
+
}
|
|
126
|
+
}
|
|
127
|
+
return findings;
|
|
128
|
+
}
|
|
129
|
+
function hasNonEmptyRepository(value) {
|
|
130
|
+
if (typeof value === 'string')
|
|
131
|
+
return value.trim().length > 0;
|
|
132
|
+
if (value !== null && typeof value === 'object') {
|
|
133
|
+
const url = value.url;
|
|
134
|
+
return typeof url === 'string' && url.trim().length > 0;
|
|
135
|
+
}
|
|
136
|
+
return false;
|
|
137
|
+
}
|
|
138
|
+
/**
|
|
139
|
+
* Throw with an actionable error when any npm package's `package.json`
|
|
140
|
+
* lacks a non-empty `repository` field. Reports every failing package
|
|
141
|
+
* in one error rather than failing on the first, so consumers fix
|
|
142
|
+
* them all in one round-trip.
|
|
143
|
+
*
|
|
144
|
+
* Always runs (not OIDC-gated): the README demands the field for
|
|
145
|
+
* every npm publish, and `npm publish --provenance` is putitoutthere's
|
|
146
|
+
* blessed publish mode. Even on the token path, missing `repository`
|
|
147
|
+
* is a misconfiguration — fail fast.
|
|
148
|
+
*/
|
|
149
|
+
export function requireProvenanceMetadata(packages) {
|
|
150
|
+
const findings = checkProvenanceMetadata(packages);
|
|
151
|
+
if (findings.length === 0)
|
|
152
|
+
return;
|
|
153
|
+
const lines = [
|
|
154
|
+
`[${ErrorCodes.NPM_MISSING_REPOSITORY}] npm publish requires a non-empty \`repository\` field in package.json.`,
|
|
155
|
+
'',
|
|
156
|
+
'Failing packages:',
|
|
157
|
+
];
|
|
158
|
+
for (const f of findings) {
|
|
159
|
+
lines.push(` - ${f.package}: ${f.packageJsonPath} (${f.reason})`);
|
|
160
|
+
}
|
|
161
|
+
lines.push('', 'Why: `npm publish --provenance` (used by putitoutthere on the OIDC trusted-publisher', 'path) hard-requires this field so npm can verify the package was built from the repo', 'the trusted publisher declares.', '', 'Fix: add a `repository` block to each failing package.json. Canonical shape:', '', ' {', ' "repository": {', ' "type": "git",', ' "url": "git+https://github.com/<owner>/<repo>.git",', ' "directory": "<path/to/package>"', ' }', ' }', '', `See ${REPOSITORY_DOC_POINTER}.`);
|
|
162
|
+
throw new Error(lines.join('\n'));
|
|
163
|
+
}
|
|
70
164
|
//# sourceMappingURL=preflight.js.map
|
package/dist/preflight.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,yEAAyE;AACzE,uEAAuE;AACvE,6DAA6D;AAC7D,oEAAoE;AACpE,kEAAkE;AAClE,yDAAyD;AACzD,uEAAuE;AACvE,uCAAuC;AACvC,MAAM,SAAS,GAAoC;IACjD,MAAM,EAAE,CAAC,sBAAsB,CAAC;IAChC,IAAI,EAAE,CAAC,gBAAgB,CAAC;IACxB,GAAG,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;CACtC,CAAC;AAEF,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,uEAAuE;AACvE,UAAU;AACV,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAiBhF,MAAM,UAAU,SAAS,CAAC,QAA4B;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAiB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAW,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,WAAW,IAAI,iBAAiB,QAAQ,GAAG,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb;QACE,+BAA+B;QAC/B,GAAG,KAAK;QACR,EAAE;QACF,mFAAmF;QACnF,OAAO,YAAY,GAAG;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,6EAA6E;AAE7E,sEAAsE;AACtE,gEAAgE;AAChE,yDAAyD;AACzD,MAAM,sBAAsB,GAC1B,0DAA0D,CAAC;AAU7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA4B;IAE5B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,6DAA6D;YAC7D,+BAA+B;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA4B;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,KAAK,GAAa;QACtB,IAAI,UAAU,CAAC,sBAAsB,0EAA0E;QAC/G,EAAE;QACF,mBAAmB;KACpB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,sFAAsF,EACtF,sFAAsF,EACtF,iCAAiC,EACjC,EAAE,EACF,8EAA8E,EAC9E,EAAE,EACF,KAAK,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2DAA2D,EAC3D,wCAAwC,EACxC,OAAO,EACP,KAAK,EACL,EAAE,EACF,OAAO,sBAAsB,GAAG,CACjC,CAAC;IACF,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC"}
|
package/dist/publish.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,OAAO,EAA6B,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyI1E"}
|
package/dist/publish.js
CHANGED
|
@@ -24,7 +24,7 @@ import { handlerFor as defaultHandlerFor } from './handlers/index.js';
|
|
|
24
24
|
import { createLogger } from './log.js';
|
|
25
25
|
import { plan } from './plan.js';
|
|
26
26
|
import { formatTag } from './tag-template.js';
|
|
27
|
-
import { requireAuth } from './preflight.js';
|
|
27
|
+
import { requireAuth, requireProvenanceMetadata } from './preflight.js';
|
|
28
28
|
import { withRetry } from './retry.js';
|
|
29
29
|
import { readHandlerMeta } from './types.js';
|
|
30
30
|
import { dumpFailure } from './verbose.js';
|
|
@@ -66,6 +66,11 @@ export async function publish(opts) {
|
|
|
66
66
|
// auth path (OIDC env or env-var token) before any side effects.
|
|
67
67
|
const selectedPackages = [...perPackage.keys()].map((name) => mustGet(config.packages, name));
|
|
68
68
|
requireAuth(selectedPackages);
|
|
69
|
+
// 2b. Pre-flight npm provenance metadata: every selected npm package's
|
|
70
|
+
// package.json must carry a non-empty `repository` field. Without
|
|
71
|
+
// it, `npm publish --provenance` fails deep inside the npm CLI
|
|
72
|
+
// after the runner has spun up — checkable in milliseconds. #280.
|
|
73
|
+
requireProvenanceMetadata(selectedPackages);
|
|
69
74
|
// 3. Artifact completeness.
|
|
70
75
|
const completeness = checkCompleteness(matrix, artifactsRoot(cwd));
|
|
71
76
|
const incomplete = [...completeness.entries()].filter(([, r]) => !r.ok);
|
package/dist/publish.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAkB,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAc3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,CAAC,kBAAkB,+CAA+C;YAChF,8DAA8D;YAC9D,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE9B,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,4BAA4B;IAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAQ;YACf,GAAG;YACH,GAAG;YACH,GAAG,EAAE,OAAO,CAAC,GAA6B;YAC1C,SAAS,EAAE;gBACT,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,iCAAiC;aACnD;YACD,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC;YACjC,8DAA8D;YAC9D,8DAA8D;YAC9D,iDAAiD;YACjD,mBAAmB,EAAE,MAAM,CAAC,QAAQ;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACtB,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7D,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,yEAAyE;oBACzE,GAAG,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,yDAAyD;gBACzD,8DAA8D;gBAC9D,iCAAiC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,WAAW,CACT,KAAK,EACL;gBACE,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,QAAQ,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/B,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAE3E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CACrB,IAA0B,EAC1B,SAA6B;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAA4B,EAAE,QAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CACN,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACnC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC"}
|