vouchington-tooling 0.19.0 → 0.19.2

package/README.md

@@ -96,9 +96,10 @@ Name mode takes one or more `--name <artifact>` flags (mutually exclusive with `
 the run's artifacts once, and extracts every requested name that is present into `<dir>/<name>`.
 Names are matched literally, in request order, with repeats downloaded once; empty names, `.`, `..`,
 and names containing `/`, `\`, or a line break are rejected before anything is listed. Requested
-names absent from the run are skipped with a single bounded `::warning::` (the absent count, the
-first three names, then `and N more`) and never one line per name. `availability=available` means at
-least one requested artifact was downloaded; `availability=unavailable` (exit 0) means none was
+names absent from the run are expected (callers pass a superset such as retry-attempt variants) and
+are skipped with a single bounded `::notice::` (the absent count, the first three names, then
+`and N more`) and never one line per name. `availability=available` means at least one requested
+artifact was downloaded; `availability=unavailable` (exit 0) means none was
 present. A present artifact whose download fails is a hard failure: the helper stops at the first
 one, prints `download failed artifact=<name> exit=<n>`, exits non-zero (a downloader exit of 3 is
 reported as 1 so it cannot be mistaken for absence), and writes no `availability` output.
@@ -327,7 +328,10 @@ or derive a configuration or documentation package spec from that manifest inste
 
 `dependency-license-policy` keeps legal policy in the consumer. `collectPnpmLicenseReport` creates
 an isolated, script-free temporary workspace and store, expands pnpm's supported architectures to
-every `os`, `cpu`, and `libc` selector represented in the lockfile, and validates the JSON report.
+every `os`, `cpu`, and `libc` selector represented in the lockfile, drops every `engines` constraint
+from the audit copy of the lockfile, and validates the JSON report. Dropping `engines` keeps
+`pnpm fetch` from skipping optional packages that exclude the running Node.js; pnpm 12's `fetch`
+ignores `force`, so their licenses would otherwise report as Unknown.
 Pass explicit denied SPDX IDs and prefixes, exact aliases, and justified allowlist scopes to
 `evaluatePnpmLicenseReport`. Unknown, malformed, and custom SPDX references fail closed. Allowlist
 scopes are either intentionally global or an exact package-name set; the library returns structured

package/dist/dependency-license-policy/collect.mjs

@@ -26,7 +26,10 @@ export function collectPnpmLicenseReport(repoRoot, options = {}) {
     const auditWorkspace = prepareWorkspace(repoRoot, readFile(lockfilePath, 'utf8'), readFile(workspacePath, 'utf8'));
     try {
         const storeConfig = `--config.store-dir=${join(auditWorkspace.cwd, '.pnpm-store')}`;
-        const fetchResult = execute('pnpm', [storeConfig, '--config.force=true', 'fetch', '--ignore-scripts'], { cwd: auditWorkspace.cwd, encoding: 'utf8' });
+        const fetchResult = execute('pnpm', [storeConfig, 'fetch', '--ignore-scripts'], {
+            cwd: auditWorkspace.cwd,
+            encoding: 'utf8',
+        });
         assertCommandSucceeded('pnpm fetch', fetchResult);
         const result = execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], {
             cwd: auditWorkspace.cwd,

package/dist/dependency-license-policy/workspace.d.mts

@@ -2,8 +2,21 @@ export interface PnpmLicenseAuditWorkspace {
     readonly cleanup: () => void;
     readonly cwd: string;
 }
-export declare function renderPnpmLicenseAuditWorkspace(lockfileSource: string, workspaceSource: string, paths: {
+/** The rendered `pnpm-lock.yaml` and `pnpm-workspace.yaml` of a license audit workspace. */
+export interface PnpmLicenseAuditFiles {
+    readonly lockfile: string;
+    readonly workspace: string;
+}
+/**
+ * Renders the audit copies of `pnpm-lock.yaml` and `pnpm-workspace.yaml` so `pnpm fetch` downloads
+ * every package in the lockfile, including optional ones that don't match the host.
+ *
+ * The workspace supports every `os`, `cpu`, and `libc` in the lockfile. The lockfile drops every
+ * `engines` constraint because pnpm 12's `fetch` ignores `force` and skips an optional package whose
+ * `engines` exclude the running Node.js, which would leave that package's license Unknown.
+ */
+export declare function renderPnpmLicenseAuditFiles(lockfileSource: string, workspaceSource: string, paths: {
     lockfile: string;
     workspace: string;
-}): string;
+}): PnpmLicenseAuditFiles;
 export declare function preparePnpmLicenseAuditWorkspace(repoRoot: string, lockfileSource: string, workspaceSource: string): PnpmLicenseAuditWorkspace;

package/dist/dependency-license-policy/workspace.mjs

@@ -1,20 +1,20 @@
 import { copyFileSync, existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { isMap, parseDocument, stringify as stringifyYaml } from 'yaml';
 const PLATFORM_KEYS = ['os', 'cpu', 'libc'];
-function parseYamlObject(source, path) {
-    let parsed;
-    try {
-        parsed = parseYaml(source);
-    }
-    catch (error) {
+function parseYamlDocument(source, path) {
+    const document = parseDocument(source);
+    const [error] = document.errors;
+    if (error)
         throw new Error(`failed to parse ${path}: ${String(error)}`, { cause: error });
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    return document;
+}
+function assertYamlObject(value, path) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
         throw new Error(`expected ${path} to contain a YAML object`);
     }
-    return parsed;
+    return value;
 }
 function getStringList(value, path) {
     if (typeof value === 'string')
@@ -24,13 +24,7 @@ function getStringList(value, path) {
     }
     return value;
 }
-export function renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource, paths) {
-    const lockfile = parseYamlObject(lockfileSource, paths.lockfile);
-    const workspace = parseYamlObject(workspaceSource, paths.workspace);
-    const packages = lockfile.packages;
-    if (typeof packages !== 'object' || packages === null || Array.isArray(packages)) {
-        throw new Error(`expected ${paths.lockfile} to contain a packages object`);
-    }
+function collectSupportedArchitectures(packages, lockfilePath) {
     const supportedArchitectures = {
         cpu: ['current'],
         libc: ['current'],
@@ -44,27 +38,52 @@ export function renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource,
             const value = snapshot[key];
             if (value === undefined)
                 continue;
-            for (const platform of getStringList(value, `${paths.lockfile} packages.*.${key}`)) {
+            for (const platform of getStringList(value, `${lockfilePath} packages.*.${key}`)) {
                 values.add(platform);
             }
         }
         supportedArchitectures[key].push(...[...values].filter((value) => value !== 'current').sort());
     }
-    return stringifyYaml({ ...workspace, packages: [], supportedArchitectures });
+    return supportedArchitectures;
+}
+/**
+ * Renders the audit copies of `pnpm-lock.yaml` and `pnpm-workspace.yaml` so `pnpm fetch` downloads
+ * every package in the lockfile, including optional ones that don't match the host.
+ *
+ * The workspace supports every `os`, `cpu`, and `libc` in the lockfile. The lockfile drops every
+ * `engines` constraint because pnpm 12's `fetch` ignores `force` and skips an optional package whose
+ * `engines` exclude the running Node.js, which would leave that package's license Unknown.
+ */
+export function renderPnpmLicenseAuditFiles(lockfileSource, workspaceSource, paths) {
+    const lockfileDocument = parseYamlDocument(lockfileSource, paths.lockfile);
+    const lockfile = assertYamlObject(lockfileDocument.toJS(), paths.lockfile);
+    const workspace = assertYamlObject(parseYamlDocument(workspaceSource, paths.workspace).toJS(), paths.workspace);
+    const packageNodes = lockfileDocument.get('packages');
+    if (!isMap(packageNodes)) {
+        throw new Error(`expected ${paths.lockfile} to contain a packages object`);
+    }
+    const supportedArchitectures = collectSupportedArchitectures(lockfile.packages, paths.lockfile);
+    for (const { value } of packageNodes.items)
+        if (isMap(value))
+            value.delete('engines');
+    return {
+        lockfile: lockfileDocument.toString({ lineWidth: 0 }),
+        workspace: stringifyYaml({ ...workspace, packages: [], supportedArchitectures }),
+    };
 }
 export function preparePnpmLicenseAuditWorkspace(repoRoot, lockfileSource, workspaceSource) {
     const auditRoot = mkdtempSync(join(tmpdir(), 'dependency-license-audit-'));
     try {
-        for (const filename of ['package.json', 'pnpm-lock.yaml']) {
-            copyFileSync(join(repoRoot, filename), join(auditRoot, filename));
-        }
+        copyFileSync(join(repoRoot, 'package.json'), join(auditRoot, 'package.json'));
         const npmrc = join(repoRoot, '.npmrc');
         if (existsSync(npmrc))
             copyFileSync(npmrc, join(auditRoot, '.npmrc'));
-        writeFileSync(join(auditRoot, 'pnpm-workspace.yaml'), renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource, {
+        const files = renderPnpmLicenseAuditFiles(lockfileSource, workspaceSource, {
             lockfile: join(repoRoot, 'pnpm-lock.yaml'),
             workspace: join(repoRoot, 'pnpm-workspace.yaml'),
-        }), 'utf8');
+        });
+        writeFileSync(join(auditRoot, 'pnpm-lock.yaml'), files.lockfile, 'utf8');
+        writeFileSync(join(auditRoot, 'pnpm-workspace.yaml'), files.workspace, 'utf8');
     }
     catch (error) {
         rmSync(auditRoot, { force: true, recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {

package/scripts/gha/download-optional-run-artifacts.sh

@@ -126,14 +126,14 @@ download_pattern() {
   done
 }
 
-warn_absent() {
+notice_absent() {
   local requested="$1" count=$(($# - 1)) list='' name
   shift
   for name in "${@:1:3}"; do
     list="${list:+$list, }$name"
   done
   [ "$count" -le 3 ] || list="$list and $((count - 3)) more"
-  echo "::warning::Optional same-run artifacts absent: $count of $requested requested (${list//\%/%25})" >&2
+  echo "::notice::Optional same-run artifacts absent: $count of $requested requested (${list//\%/%25})" >&2
 }
 
 download_names() {
@@ -152,7 +152,7 @@ download_names() {
     if contains "$name" "${listed[@]}"; then present+=("$name"); else absent+=("$name"); fi
   done
   echo "[optional-run-artifacts] selection selector=name requested=${#names[@]} present=${#present[@]} absent=${#absent[@]}" >&2
-  [ "${#absent[@]}" -eq 0 ] || warn_absent "${#names[@]}" "${absent[@]}"
+  [ "${#absent[@]}" -eq 0 ] || notice_absent "${#names[@]}" "${absent[@]}"
   [ "${#present[@]}" -gt 0 ] || return 3
   for name in "${present[@]}"; do
     echo "[optional-run-artifacts] attempt selector=name artifact=$name" >&2