trustci 0.1.0 → 0.2.1

package/README.md

@@ -78,9 +78,34 @@ published artifact is plain Node-compatible JS.
 ```bash
 bun install
 bun test
+bun run typecheck
 bun run build   # -> dist/cli.js (npx entry point), via `bun build --target node`
 ```
 
+`bun install` also enables a husky `commit-msg` hook that runs
+[commitlint](https://commitlint.js.org/) with `@commitlint/config-conventional`,
+so every commit must be a [Conventional Commit](https://www.conventionalcommits.org/).
+
+## Releasing
+
+Releases are automated: every merge to `main` runs the CircleCI config
+`workflows/publish/npm-polyrepo-bun-semantic-release.yaml` from
+[hideokamoto/circleci-configurations](https://github.com/hideokamoto/circleci-configurations).
+[semantic-release](https://github.com/semantic-release/semantic-release) decides the
+next version from the commits since the latest `v*` tag, pushes the tag, publishes
+to npm via Trusted Publishing (OIDC), and creates the GitHub Release.
+
+| Commit | Release |
+| --- | --- |
+| `fix:` / `perf:` | patch |
+| `feat:` | minor |
+| `feat!:` / `fix!:` or a `BREAKING CHANGE:` footer | major |
+| `chore:` / `docs:` / `ci:` / `test:` / `refactor:` … | none |
+
+Do not bump `version` in `package.json`, create tags, or run `npm publish` manually.
+Release notes are published on
+[GitHub Releases](https://github.com/hideokamoto/trustci/releases).
+
 ## License
 
 MIT

package/dist/cli.js

@@ -19,6 +19,7 @@ var options = {
   project: { type: "string" },
   env: { type: "string" },
   file: { type: "string" },
+  "circle-token": { type: "string" },
   "org-id": { type: "string" },
   "project-id": { type: "string" },
   "pipeline-definition-id": { type: "string" },
@@ -105,12 +106,26 @@ function parseCliArgs(argv) {
       if (!vcsOrigin.includes("://")) {
         throw new ArgError(`--vcs-origin must include a protocol, e.g. https://github.com/org/repo (got "${vcsOrigin}").`);
       }
+      const circleToken = values["circle-token"];
+      const orgId = values["org-id"];
+      const projectId = values["project-id"];
+      const pipelineDefinitionId = values["pipeline-definition-id"];
+      if (!circleToken) {
+        if (!orgId)
+          throw new ArgError("--org-id is required for --provider circleci (or provide --circle-token for auto-resolution).");
+        if (!projectId)
+          throw new ArgError("--project-id is required for --provider circleci (or provide --circle-token for auto-resolution).");
+        if (!pipelineDefinitionId)
+          throw new ArgError("--pipeline-definition-id is required for --provider circleci (or provide --circle-token for auto-resolution).");
+      }
       providerOptions = {
         provider: "circleci",
-        orgId: require_(values["org-id"], "org-id", "circleci"),
-        projectId: require_(values["project-id"], "project-id", "circleci"),
-        pipelineDefinitionId: require_(values["pipeline-definition-id"], "pipeline-definition-id", "circleci"),
+        circleToken,
+        orgId,
+        projectId,
+        pipelineDefinitionId,
         vcsOrigin,
+        file: values.file,
         contextIds: values["context-id"] ?? [],
         ...common
       };
@@ -126,6 +141,63 @@ function parseCliArgs(argv) {
   };
 }
 
+// src/circleci.ts
+var BASE_URL = "https://circleci.com/api/v2";
+function vcsTypeFromUrl(url) {
+  const { hostname } = new URL(url);
+  if (hostname === "github.com" || hostname.endsWith(".github.com"))
+    return "github";
+  if (hostname === "gitlab.com" || hostname.endsWith(".gitlab.com"))
+    return "gitlab";
+  if (hostname === "bitbucket.org" || hostname.endsWith(".bitbucket.org"))
+    return "bitbucket";
+  throw new Error(`Cannot determine VCS type from URL: ${url}`);
+}
+function projectSlugFromVcsOrigin(url) {
+  const vcsType = vcsTypeFromUrl(url);
+  const { pathname } = new URL(url);
+  const parts = pathname.replace(/^\//, "").replace(/\.git$/, "").split("/");
+  if (parts.length < 2 || !parts[0] || !parts[1]) {
+    throw new Error(`Cannot extract org/repo from URL: ${url}`);
+  }
+  return `${vcsType}/${parts[0]}/${parts[1]}`;
+}
+async function circleGet(token, path) {
+  const response = await fetch(`${BASE_URL}${path}`, {
+    headers: { "Circle-Token": token, Accept: "application/json" }
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`CircleCI API error (${response.status}) for ${path}: ${body}`);
+  }
+  return response.json();
+}
+async function resolveOrgAndProjectId(token, vcsOrigin) {
+  const slug = projectSlugFromVcsOrigin(vcsOrigin);
+  const project = await circleGet(token, `/project/${slug}`);
+  return { orgId: project.organization_id, projectId: project.id };
+}
+async function resolvePipelineDefinitionId(token, projectId, file) {
+  const data = await circleGet(token, `/pipeline-definitions?project_id=${encodeURIComponent(projectId)}`);
+  if (data.items.length === 0) {
+    throw new Error(`No pipeline definitions found for project "${projectId}".`);
+  }
+  if (file) {
+    const match = data.items.find((d) => d.config_file_path === file || d.name === file);
+    if (!match) {
+      const available2 = data.items.map((d) => d.config_file_path ?? d.name ?? d.id).join(", ");
+      throw new Error(`No pipeline definition found matching "${file}". Available: ${available2}`);
+    }
+    return match.id;
+  }
+  const [only] = data.items;
+  if (data.items.length === 1 && only) {
+    return only.id;
+  }
+  const available = data.items.map((d) => d.config_file_path ?? d.name ?? d.id).join(", ");
+  throw new Error(`Multiple pipeline definitions found for project "${projectId}". Specify --file to select one: ${available}`);
+}
+
 // src/exec.ts
 import { spawnSync } from "node:child_process";
 function run(cmd, args) {
@@ -435,6 +507,12 @@ function discoverPackages(root) {
       all.push(pkg);
     }
   }
+  if (source === "none") {
+    const pkg = readPkg(path2.resolve(root));
+    if (pkg) {
+      return { source: "package.json (root)", patterns: [], all: [pkg] };
+    }
+  }
   return { source, patterns, all };
 }
 function filterPackages(all, only, exclude) {
@@ -461,8 +539,11 @@ Providers:
   github     --repo <owner/repo> --file <workflow> [--env <name>]
   gitlab     --project <group/project> --file <workflow> [--env <name>]
              (--repo is accepted as an alias for --project)
-  circleci   --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid>
-             --vcs-origin <url> [--context-id <uuid> ...]
+  circleci   --vcs-origin <url> --circle-token <token> [--file <config>]
+             [--org-id <uuid>] [--project-id <uuid>] [--pipeline-definition-id <uuid>]
+             [--context-id <uuid> ...]
+             UUIDs are auto-resolved via CircleCI API v2 when --circle-token is provided.
+             Explicit UUIDs override auto-resolution and work without a token.
 
 Permissions (at least one required):
   --allow-publish           allow npm publish
@@ -477,11 +558,14 @@ Options:
   -v, --version             show the trustci version
 
 Workspaces are detected from pnpm-workspace.yaml, package.json "workspaces",
-or lerna.json. Private packages ("private": true) are always excluded.
+or lerna.json. If no workspace config is found, the root package.json is used
+as a single-package fallback. Private packages ("private": true) are always excluded.
 
 Examples:
   trustci --dry-run --provider github --repo me/repo --file release.yml --allow-publish
   trustci --provider gitlab --project me/repo --file .gitlab-ci.yml --allow-publish -y
+  trustci --provider circleci --vcs-origin https://github.com/me/repo \\
+    --circle-token $CIRCLECI_TOKEN --allow-publish
   trustci --provider circleci --org-id <uuid> --project-id <uuid> \\
     --pipeline-definition-id <uuid> --vcs-origin https://github.com/me/repo --allow-publish
   trustci list
@@ -626,7 +710,29 @@ async function main() {
       return 1;
     }
   }
-  return parsed.kind === "list" ? runList(parsed.pkg, parsed.dryRun) : runTrust(parsed);
+  if (parsed.kind === "list")
+    return runList(parsed.pkg, parsed.dryRun);
+  if (parsed.options.provider === "circleci" && !parsed.dryRun) {
+    const opts = parsed.options;
+    if (opts.circleToken) {
+      try {
+        if (!opts.orgId || !opts.projectId) {
+          console.error("Resolving org-id and project-id via CircleCI API...");
+          const resolved = await resolveOrgAndProjectId(opts.circleToken, opts.vcsOrigin);
+          opts.orgId ??= resolved.orgId;
+          opts.projectId ??= resolved.projectId;
+        }
+        if (!opts.pipelineDefinitionId) {
+          console.error("Resolving pipeline-definition-id via CircleCI API...");
+          opts.pipelineDefinitionId = await resolvePipelineDefinitionId(opts.circleToken, opts.projectId, opts.file);
+        }
+      } catch (err) {
+        console.error(`error: ${err.message}`);
+        return 1;
+      }
+    }
+  }
+  return runTrust(parsed);
 }
 main().then((code) => {
   process2.exitCode = code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustci",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Bulk-register npm Trusted Publishers (npm trust) across all public packages in a monorepo. Supports GitHub, GitLab and CircleCI.",
   "type": "module",
   "bin": {
@@ -16,7 +16,9 @@
   "scripts": {
     "build": "bun build src/cli.ts --target node --outfile dist/cli.js",
     "test": "bun test",
-    "prepublishOnly": "bun run build"
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run build",
+    "prepare": "husky"
   },
   "keywords": [
     "npm",
@@ -30,9 +32,24 @@
     "gitlab",
     "circleci"
   ],
+  "author": {
+    "name": "Hidetaka Okamoto",
+    "url": "https://github.com/hideokamoto"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hideokamoto/trustci.git"
+  },
+  "homepage": "https://github.com/hideokamoto/trustci#readme",
+  "bugs": {
+    "url": "https://github.com/hideokamoto/trustci/issues"
+  },
   "license": "MIT",
   "devDependencies": {
+    "@commitlint/cli": "^21.2.3",
+    "@commitlint/config-conventional": "^21.2.3",
     "@types/bun": "latest",
+    "husky": "^9.1.7",
     "typescript": "^5"
   }
 }