fetchcode 0.8.0__tar.gz → 0.8.1__tar.gz

{fetchcode-0.8.0 → fetchcode-0.8.1}/.github/workflows/pypi-release.yml

@@ -37,7 +37,7 @@ jobs:
         run: python -m build --sdist --wheel --outdir dist/
 
       - name: Upload built archives
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pypi_archives
           path: dist/*
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - name: Download built archives
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: pypi_archives
           path: dist
@@ -69,16 +69,17 @@ jobs:
     needs:
       - create-gh-release
     runs-on: ubuntu-24.04
+    environment: pypi-publish
+    permissions:
+      id-token: write
 
     steps:
       - name: Download built archives
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: pypi_archives
-          path: dist
+          path: dist/
 
       - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags')
+        if: startsWith(github.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}

{fetchcode-0.8.0 → fetchcode-0.8.1}/CHANGELOG.rst

@@ -1,6 +1,11 @@
 Changelog
 =========
 
+v0.8.1
+--------
+- Fix package versions for scoped npm packages (https://github.com/aboutcode-org/fetchcode/pull/194)
+- Publish to pypi using trusted publisher (https://github.com/aboutcode-org/fetchcode/pull/195)
+
 v0.8.0
 --------
 - Do not create GH release as draft

{fetchcode-0.8.0 → fetchcode-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fetchcode
-Version: 0.8.0
+Version: 0.8.1
 Summary: fetchcode is a library to reliably fetch code via HTTP, FTP and version control systems.
 Home-page: https://github.com/aboutcode-org/fetchcode
 Author: nexB. Inc. and others

{fetchcode-0.8.0 → fetchcode-0.8.1}/src/fetchcode/package_versions.py

@@ -171,7 +171,7 @@ def get_gem_versions_from_purl(purl):
 def get_npm_versions_from_purl(purl):
     """Fetch versions of npm packages from the npm registry API."""
     purl = PackageURL.from_string(purl)
-    url = f"https://registry.npmjs.org/{purl.name}"
+    url = get_npm_registry_url(purl)
     response = get_response(url=url, content_type="json")
     if not response:
         logger.error(f"Failed to fetch {url}")
@@ -545,3 +545,9 @@ def remove_debian_default_epoch(version):
     ''
     """
     return version and version.replace("0:", "")
+
+
+def get_npm_registry_url(purl):
+    """Return registry URL for npm Package-URL."""
+    pkg_name = f"{purl.namespace}/{purl.name}" if purl.namespace else purl.name
+    return f"https://registry.npmjs.org/{pkg_name}"

{fetchcode-0.8.0 → fetchcode-0.8.1}/src/fetchcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fetchcode
-Version: 0.8.0
+Version: 0.8.1
 Summary: fetchcode is a library to reliably fetch code via HTTP, FTP and version control systems.
 Home-page: https://github.com/aboutcode-org/fetchcode
 Author: nexB. Inc. and others

{fetchcode-0.8.0 → fetchcode-0.8.1}/tests/test_package_versions.py

@@ -20,7 +20,9 @@ from pathlib import Path
 from unittest import mock
 
 import yaml
+from packageurl import PackageURL
 
+from fetchcode.package_versions import get_npm_registry_url
 from fetchcode.package_versions import versions
 
 FETCHCODE_REGEN_TEST_FIXTURES = os.getenv("FETCHCODE_REGEN_TEST_FIXTURES", False)
@@ -87,6 +89,20 @@ def test_get_gem_versions_from_purl(mock_get_response):
     check_results_against_json(result, expected_file)
 
 
+def test_get_npm_registry_url():
+    purl1 = PackageURL.from_string("pkg:npm/%40angular/animation")
+    purl2 = PackageURL.from_string("pkg:npm/core")
+
+    result_url1 = get_npm_registry_url(purl1)
+    result_url2 = get_npm_registry_url(purl2)
+
+    expected_url1 = "https://registry.npmjs.org/@angular/animation"
+    expected_url2 = "https://registry.npmjs.org/core"
+
+    assert result_url1 == expected_url1
+    assert result_url2 == expected_url2
+
+
 @mock.patch("fetchcode.package_versions.get_response")
 def test_get_npm_versions_from_purl(mock_get_response):
     side_effect = [get_json_data(data_location / "npm_mock_data.json")]