triflux 10.45.0 → 10.46.0

package/scripts/__tests__/release-governance.test.mjs

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -279,15 +280,15 @@ describe("release governance scripts", () => {
       releaseWorkflow,
       /TFX_MACHINE_PROFILE_PATH:\s*\$\{\{ runner\.temp \}\}\/triflux-release-ci-machine-profile\.env/,
     );
-    assert.match(releaseWorkflow, /publish\.mjs.*--skip-npm.*--allow-existing/);
-    assert.match(releaseWorkflow, /publish\.mjs.*--tag-only/);
+    assert.match(releaseWorkflow, /--skip-npm.*--allow-existing/);
+    assert.match(releaseWorkflow, /--tag-only/);
     assert.match(
       releaseWorkflow,
-      /gh workflow run npm-publish\.yml --ref \$\{\{ github\.ref_name \}\}/,
+      /gh workflow run npm-publish\.yml --ref "v\$RELEASE_VERSION"/,
     );
     assert.match(releaseWorkflow, /npm-publish\.yml/);
     assert.match(releaseWorkflow, /workflow_dispatch/);
-    assert.match(releaseWorkflow, /publish_ref="\$\{\{ github\.ref_name \}\}"/);
+    assert.match(releaseWorkflow, /publish_ref="v\$RELEASE_VERSION"/);
     assert.match(releaseWorkflow, /gh run list/);
     assert.doesNotMatch(
       releaseWorkflow,
@@ -299,26 +300,98 @@ describe("release governance scripts", () => {
       "utf8",
     );
     assert.match(npmPublishWorkflow, /npm view "\$name@\$version" version/);
-    assert.doesNotMatch(npmPublishWorkflow, /NODE_AUTH_TOKEN:\s*\$\{\{/);
+    assert.doesNotMatch(npmPublishWorkflow, /NPM_TOKEN|NODE_AUTH_TOKEN/);
+    assert.match(npmPublishWorkflow, /id-token:\s*write/);
+    assert.match(npmPublishWorkflow, /workflow_dispatch:\s+inputs:\s+npm_tag:/);
     assert.equal(
       (
         npmPublishWorkflow.match(
-          /NPM_TOKEN:\s*\$\{\{\s*secrets\.NPM_TOKEN\s*\}\}/g,
+          /npm publish --provenance --access public --tag "\$NPM_TAG"/g,
         ) || []
       ).length,
       3,
     );
-    assert.equal(
-      (npmPublishWorkflow.match(/export NODE_AUTH_TOKEN="\$NPM_TOKEN"/g) || [])
-        .length,
-      3,
-    );
     assert.equal(
       (npmPublishWorkflow.match(/already published; skipping/g) || []).length,
       3,
     );
   });
 
+  it("auto releases only successful main push CI from this repository", () => {
+    const workflow = readFileSync(
+      new URL("../../.github/workflows/release.yml", import.meta.url),
+      "utf8",
+    );
+    assert.match(
+      workflow,
+      /workflow_run:\s+workflows: \[ci\]\s+types: \[completed\]\s+branches: \[main\]/,
+    );
+    assert.match(workflow, /github\.event_name == 'workflow_dispatch'/);
+    assert.match(
+      workflow,
+      /github\.event\.workflow_run\.conclusion == 'success'/,
+    );
+    assert.match(workflow, /github\.event\.workflow_run\.event == 'push'/);
+    assert.match(
+      workflow,
+      /github\.event\.workflow_run\.head_repository\.full_name == github\.repository/,
+    );
+    assert.match(
+      workflow,
+      /concurrency:\s+group: release\s+cancel-in-progress: false/,
+    );
+    assert.match(workflow, /ref:.*workflow_run\.head_sha.*github\.sha/);
+    assert.doesNotMatch(workflow, /^concurrency:/m);
+    assert.match(workflow, /^ {2}resolve:/m);
+    assert.match(
+      workflow,
+      /^ {2}release:\n {4}needs: resolve\n {4}if: needs\.resolve\.outputs\.release == 'true'/m,
+    );
+    assert.match(workflow, /ref: \$\{\{ needs\.resolve\.outputs\.sha \}\}/);
+    for (const output of [
+      "release",
+      "version",
+      "channel",
+      "mode",
+      "npm_tag",
+      "sha",
+    ]) {
+      assert.ok(
+        workflow.includes(`${output}: \${{ steps.resolve.outputs.${output} }}`),
+      );
+    }
+    assert.match(
+      workflow,
+      /if \[\[ "\$RELEASE_MODE" == "auto" \]\]; then\s+args\+=\(--allow-ancestor\)/,
+    );
+    assert.match(workflow, /fetch-depth: 0/);
+    assert.match(workflow, /fetch-tags: true/);
+    assert.match(workflow, /id: resolve/);
+    assert.match(workflow, /resolve-auto-release\.mjs/);
+    assert.match(
+      workflow,
+      /if \[\[ "\$RELEASE_MODE" == "auto" \]\]; then\s+args\+=\(--skip-tests\)/,
+    );
+    assert.match(workflow, /git rev-parse "\$publish_ref\^\{commit\}"/);
+    assert.match(workflow, /\.headBranch == \$publish_ref/);
+    assert.match(workflow, /\.headSha == \$sha/);
+    assert.match(workflow, /id: dispatch/);
+    assert.doesNotMatch(workflow, /started_at|createdAt|-120 seconds/);
+    assert.match(workflow, /BASH_REMATCH\[1\]/);
+    assert.match(workflow, /gh run view "\$run_id" --json status,conclusion/);
+    assert.match(workflow, /previous_ids/);
+    assert.match(workflow, /index\(\$id\)/);
+    assert.match(workflow, /gh workflow run npm-publish\.yml.*-f npm_tag=/);
+    assert.match(
+      workflow,
+      /NPM_TAG: \$\{\{ needs\.resolve\.outputs\.npm_tag \}\}/,
+    );
+    assert.match(
+      workflow,
+      /verify\.mjs.*--npm-wait-seconds 900 --npm-pending-ok/,
+    );
+  });
+
   it("verify reports explicit npm package/version failures", async () => {
     const root = makeRepo();
     try {
@@ -507,3 +580,154 @@ describe("release governance scripts", () => {
     }
   });
 });
+
+function workflowStep(file, name) {
+  const workflow = readFileSync(
+    new URL(`../../.github/workflows/${file}`, import.meta.url),
+    "utf8",
+  );
+  const step = workflow
+    .split(`      - name: ${name}\n`)[1]
+    ?.split(/\n {6}- name: /)[0];
+  assert.ok(step, `missing workflow step: ${name}`);
+  const script = step.split("        run: |\n")[1];
+  assert.ok(script, `missing shell script: ${name}`);
+  return script.replace(/^ {10}/gm, "");
+}
+
+it("waits for the dispatched run ID and excludes previous runs in the URL-less fallback", () => {
+  const root = mkdtempSync(join(tmpdir(), "tfx-dispatch-"));
+  const output = join(root, "output");
+  const calls = join(root, "calls");
+  const fakeCommands = `
+    gh() {
+      printf '%s\\n' "$*" >> "$GH_CALLS"
+      case "$1 $2" in
+        'api --paginate') printf '41\\n' ;;
+        'workflow run') printf '%s\\n' "$DISPATCH_REPLY" ;;
+        'run list') printf '%s\\n' '[{"databaseId":41,"headBranch":"v1.2.3","headSha":"head"},{"databaseId":42,"headBranch":"v1.2.3","headSha":"head"},{"databaseId":43,"headBranch":"v1.2.3","headSha":"other"}]' ;;
+        'run view')
+          [[ "$3" == 42 ]] || return 91
+          [[ "$4" == --log-failed ]] && return 0
+          printf '{"status":"completed","conclusion":"%s"}\\n' "$CONCLUSION" ;;
+        *) return 92 ;;
+      esac
+    }
+    git() { printf 'head\\n'; }
+    sleep() { return 93; }
+  `;
+  try {
+    for (const [reply, conclusion, status] of [
+      ["Created https://github.com/test/repo/actions/runs/42", "success", 0],
+      ["", "success", 0],
+      ["Created https://github.com/test/repo/actions/runs/42", "failure", 1],
+    ]) {
+      rmSync(output, { force: true });
+      rmSync(calls, { force: true });
+      const env = {
+        ...process.env,
+        GITHUB_OUTPUT: output,
+        GH_CALLS: calls,
+        GITHUB_REPOSITORY: "test/repo",
+        RELEASE_VERSION: "1.2.3",
+        NPM_TAG: "canary",
+        DISPATCH_REPLY: reply,
+        CONCLUSION: conclusion,
+      };
+      const dispatch = spawnSync(
+        "bash",
+        [
+          "-e",
+          "-o",
+          "pipefail",
+          "-c",
+          fakeCommands + workflowStep("release.yml", "Dispatch npm publish"),
+        ],
+        { env, encoding: "utf8" },
+      );
+      assert.equal(dispatch.status, 0, dispatch.stderr);
+      const outputs = Object.fromEntries(
+        readFileSync(output, "utf8")
+          .trim()
+          .split("\n")
+          .map((line) => [
+            line.slice(0, line.indexOf("=")),
+            line.slice(line.indexOf("=") + 1),
+          ]),
+      );
+      assert.deepEqual(JSON.parse(outputs.previous_ids), [41]);
+      assert.equal(outputs.run_id || "", reply ? "42" : "");
+      const wait = spawnSync(
+        "bash",
+        [
+          "-e",
+          "-o",
+          "pipefail",
+          "-c",
+          fakeCommands + workflowStep("release.yml", "Wait for npm publish"),
+        ],
+        {
+          env: {
+            ...env,
+            DISPATCH_RUN_ID: outputs.run_id || "",
+            PREVIOUS_RUN_IDS: outputs.previous_ids,
+          },
+          encoding: "utf8",
+        },
+      );
+      assert.equal(wait.status, status, wait.stderr);
+      const log = readFileSync(calls, "utf8");
+      assert.match(
+        log,
+        /workflow run npm-publish.yml --ref v1.2.3 -f npm_tag=canary/,
+      );
+      assert.match(log, /run view 42 --json status,conclusion/);
+      assert.doesNotMatch(log, /run view 41/);
+      assert.equal(log.includes("run list"), !reply);
+      assert.equal(log.includes("--log-failed"), conclusion === "failure");
+    }
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+it("resolves npm tags for dispatch and tag pushes and rejects unknown tags", () => {
+  const root = mkdtempSync(join(tmpdir(), "tfx-npm-tag-"));
+  const output = join(root, "env");
+  try {
+    for (const [input, version, expected] of [
+      ["", "1.2.3", "latest"],
+      ["", "1.2.3-rc.1", "canary"],
+      ["canary", "1.2.3", "canary"],
+      ["latest", "1.2.3-rc.1", "latest"],
+      ["invalid", "1.2.3", null],
+    ]) {
+      rmSync(output, { force: true });
+      const result = spawnSync(
+        "bash",
+        [
+          "-e",
+          "-o",
+          "pipefail",
+          "-c",
+          `node() { printf '%s\\n' "$TEST_VERSION"; }\n${workflowStep("npm-publish.yml", "Resolve npm tag")}`,
+        ],
+        {
+          env: {
+            ...process.env,
+            INPUT_NPM_TAG: input,
+            TEST_VERSION: version,
+            GITHUB_ENV: output,
+          },
+          encoding: "utf8",
+        },
+      );
+      assert.equal(result.status, expected ? 0 : 1, result.stderr);
+      if (expected)
+        assert.equal(readFileSync(output, "utf8"), `NPM_TAG=${expected}\n`);
+      else assert.match(result.stdout + result.stderr, /Invalid npm tag/);
+    }
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});

package/scripts/__tests__/release-publish-ancestor.test.mjs

@@ -0,0 +1,67 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import { publishRelease } from "../release/publish.mjs";
+
+function commandStub({ ancestor = true } = {}) {
+  const commands = [];
+  const execFileSyncFn = (command, args) => {
+    commands.push([command, ...args].join(" "));
+    if (command === "git" && args[0] === "rev-parse") {
+      return args[1] === "HEAD" ? "older\n" : "newer\n";
+    }
+    if (command === "git" && args[0] === "merge-base") {
+      if (!ancestor) throw new Error("not an ancestor");
+      return "";
+    }
+    return "";
+  };
+  return { commands, execFileSyncFn };
+}
+
+function publishOptions(execFileSyncFn, allowAncestor) {
+  return {
+    rootDir: process.cwd(),
+    dryRun: false,
+    publishNpm: false,
+    pushBranch: false,
+    createGithubRelease: false,
+    execFileSyncFn,
+    allowAncestor,
+  };
+}
+
+describe("tag-only ancestor guard", () => {
+  it("allows a release commit that is an ancestor of the current branch", async () => {
+    const { commands, execFileSyncFn } = commandStub();
+    await publishRelease(publishOptions(execFileSyncFn, true));
+
+    assert.ok(
+      commands.some((command) =>
+        command.startsWith("git merge-base --is-ancestor HEAD origin/"),
+      ),
+    );
+    assert.ok(commands.some((command) => /^git push origin v\d/.test(command)));
+  });
+
+  it("rejects a release commit outside the current branch ancestry", async () => {
+    const { commands, execFileSyncFn } = commandStub({ ancestor: false });
+    await assert.rejects(
+      publishRelease(publishOptions(execFileSyncFn, true)),
+      /Refusing tag-only publish/,
+    );
+    assert.ok(!commands.some((command) => command.startsWith("git push")));
+  });
+
+  it("keeps the exact HEAD comparison without --allow-ancestor", async () => {
+    const { commands, execFileSyncFn } = commandStub();
+    await assert.rejects(
+      publishRelease(publishOptions(execFileSyncFn, false)),
+      /Refusing tag-only publish/,
+    );
+    assert.ok(
+      !commands.some((command) => command.startsWith("git merge-base")),
+    );
+    assert.ok(!commands.some((command) => command.startsWith("git push")));
+  });
+});

package/scripts/__tests__/release-verify-wait.test.mjs

@@ -0,0 +1,169 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { it } from "node:test";
+
+import { writeJson } from "../release/lib.mjs";
+import { verifyRelease } from "../release/verify.mjs";
+
+function makeRepo() {
+  const root = mkdtempSync(join(tmpdir(), "tfx-verify-wait-"));
+  writeJson(join(root, "package.json"), { version: "1.2.3" });
+  writeJson(join(root, "scripts/release/version-manifest.json"), {
+    canonicalFile: "package.json",
+    canonicalPath: ["version"],
+    targets: [{ file: "package.json", paths: [["version"]] }],
+  });
+  return root;
+}
+
+it("waits for all three npm packages to show the release version", async () => {
+  const root = makeRepo();
+  let now = 0;
+  const sleeps = [];
+  const calls = new Map();
+  try {
+    const result = await verifyRelease({
+      rootDir: root,
+      version: "1.2.3",
+      dryRun: false,
+      npmWaitSeconds: 40,
+      npmPendingOk: true,
+      nowFn: () => now,
+      sleepFn: async (ms) => {
+        sleeps.push(ms);
+        now += ms;
+      },
+      execFileSyncFn: (command, args) => {
+        if (command === "gh") return '{"tagName":"v1.2.3"}';
+        assert.equal(command, "npm");
+        const count = (calls.get(args[1]) || 0) + 1;
+        calls.set(args[1], count);
+        return count === 1 ? "1.2.2\n" : "1.2.3\n";
+      },
+    });
+    assert.equal(result.ok, true);
+    assert.equal(
+      result.checks.some((check) => check.status === "pending"),
+      false,
+    );
+    assert.deepEqual(sleeps, [20_000]);
+    assert.deepEqual([...calls.values()], [2, 2, 2]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+it("passes with pending npm checks and emits one Actions warning at the deadline", async () => {
+  const root = makeRepo();
+  let now = 0;
+  const calls = new Map();
+  const warnings = [];
+  const originalActions = process.env.GITHUB_ACTIONS;
+  const originalLog = console.log;
+  process.env.GITHUB_ACTIONS = "true";
+  console.log = (message) => warnings.push(message);
+  try {
+    const result = await verifyRelease({
+      rootDir: root,
+      version: "1.2.3",
+      dryRun: false,
+      npmWaitSeconds: 20,
+      npmPendingOk: true,
+      nowFn: () => now,
+      sleepFn: async (ms) => {
+        now += ms;
+      },
+      execFileSyncFn: (command, args) => {
+        if (command === "gh") return '{"tagName":"v1.2.3"}';
+        const count = (calls.get(args[1]) || 0) + 1;
+        calls.set(args[1], count);
+        if (args[1].startsWith("@triflux/core")) return "1.2.3\n";
+        if (args[1].startsWith("@triflux/remote") && count === 2) {
+          throw new Error("registry timeout");
+        }
+        return args[1].startsWith("@triflux/remote") ? "1.2.2\n" : "1.2.1\n";
+      },
+    });
+    assert.equal(result.ok, true);
+    assert.deepEqual([...calls.values()], [2, 2, 2]);
+    assert.deepEqual(
+      result.checks
+        .filter((check) => check.status === "pending")
+        .map((check) => check.name),
+      ["npm-view @triflux/remote", "npm-view triflux"],
+    );
+    assert.match(
+      result.checks.find((check) => check.name === "npm-view @triflux/remote")
+        .detail,
+      /last seen 1\.2\.2; npm publish-time scan may still be processing/,
+    );
+    assert.match(
+      result.checks.find((check) => check.name === "npm-view triflux").detail,
+      /last seen 1\.2\.1; npm publish-time scan may still be processing/,
+    );
+    assert.equal(
+      result.checks.find((check) => check.name === "github-release").ok,
+      true,
+    );
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0], /^::warning::npm registry pending/);
+  } finally {
+    console.log = originalLog;
+    if (originalActions === undefined) delete process.env.GITHUB_ACTIONS;
+    else process.env.GITHUB_ACTIONS = originalActions;
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+it("fails at one shared deadline and reports last seen versions after lookup errors", async () => {
+  const root = makeRepo();
+  let now = 0;
+  const sleeps = [];
+  const calls = new Map();
+  try {
+    const result = await verifyRelease({
+      rootDir: root,
+      version: "1.2.3",
+      dryRun: false,
+      npmWaitSeconds: 20,
+      nowFn: () => now,
+      sleepFn: async (ms) => {
+        sleeps.push(ms);
+        now += ms;
+      },
+      execFileSyncFn: (command, args) => {
+        if (command === "gh") return '{"tagName":"v1.2.3"}';
+        assert.equal(command, "npm");
+        const count = (calls.get(args[1]) || 0) + 1;
+        calls.set(args[1], count);
+        if (args[1].startsWith("@triflux/remote") && count === 2) {
+          throw new Error("registry timeout");
+        }
+        return args[1].startsWith("triflux") ? "1.2.3\n" : "1.2.2\n";
+      },
+    });
+    assert.equal(result.ok, false);
+    assert.deepEqual(sleeps, [20_000]);
+    assert.deepEqual([...calls.values()], [2, 2, 2]);
+    assert.match(
+      result.checks.find((check) => check.name === "npm-view @triflux/core")
+        .detail,
+      /got 1\.2\.2/,
+    );
+    assert.match(
+      result.checks.find((check) => check.name === "npm-view @triflux/remote")
+        .detail,
+      /last seen 1\.2\.2/,
+    );
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+it("rejects invalid npm wait durations", async () => {
+  for (const npmWaitSeconds of [-1, Number.POSITIVE_INFINITY, "oops"]) {
+    await assert.rejects(verifyRelease({ npmWaitSeconds }), /npm-wait-seconds/);
+  }
+});