imccyu
d9dcf5a484
The root manifest carries the dsh family version. bump writes it with the members, because the workspace constraint requires them to match, and that constraint now accepts a prerelease segment: without both, release:dsh 0.0.2 left the root behind and 0.0.1-rc.1 could satisfy neither check. The Landlock workflow no longer passes --access public, which overrode the restricted publishConfig this repository just adopted for those packages. Vendored change detection reads build inputs when a package publishes build output, and vendor/cordis publishes the src its export map already pointed at: its lib/ is untracked, so a real source edit read as 'nothing changed' and the next publish would fail on a version whose bytes moved. The next version also takes the last published version as its baseline, so a re-sync that restores a lower upstream version cannot recompute a version already on the registry, and bump confirms the registry carries what the newest tag names. Tag prefixes are constructed rather than recovered from a full tag, which a hyphenated version defeated. Pack runs group per ref so concurrent pull requests stop displacing each other, the publish job carries the global group, and the unused id-token permission is gone. Every release script sits behind an entry guard, which is what lets the pure judgements carry tests: tag naming, publish order and cycle reporting, version arithmetic, payload policy, and the change judgement. The Agent Note moves to implemented and states what shipped: one probe command, the registry confirmation that now exists, and byte reproducibility recorded as assumed rather than measured.
102 lines
3.9 KiB
TypeScript
102 lines
3.9 KiB
TypeScript
/**
|
|
* Publish one packed release family from the tarballs the pack step produced.
|
|
*
|
|
* Publication is decided per package against the registry, never from a list of
|
|
* "what this release includes": a version the registry lacks is published, a
|
|
* version whose published tarball has the same integrity is skipped, and a
|
|
* version whose published tarball differs fails the run — that last case means
|
|
* the content changed without a version bump
|
|
* ([rationale](../../.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md)).
|
|
*
|
|
* Skipping on identical integrity is what makes re-running the publish step over
|
|
* the same artifact safe.
|
|
*/
|
|
|
|
import { createHash } from 'node:crypto'
|
|
import { readFileSync } from 'node:fs'
|
|
import { join, resolve } from 'node:path'
|
|
import { parseArgs } from 'node:util'
|
|
import { releaseFamily } from './families.ts'
|
|
import { attempt, isEntry, run } from './process.ts'
|
|
import { packedIdentity, readPublishOrder } from './tarball.ts'
|
|
|
|
/** npm access level for every package this repository publishes. */
|
|
const ACCESS = 'restricted'
|
|
|
|
/** What the registry knows about one version. */
|
|
type RegistryState =
|
|
| { readonly kind: 'absent' }
|
|
| { readonly kind: 'present'; readonly integrity: string }
|
|
|
|
/**
|
|
* The subresource integrity string npm records for a tarball.
|
|
* @param tarball - absolute tarball path.
|
|
* @returns A `sha512-<base64>` string.
|
|
*/
|
|
function integrityOf(tarball: string): string {
|
|
return `sha512-${createHash('sha512').update(readFileSync(tarball)).digest('base64')}`
|
|
}
|
|
|
|
/**
|
|
* Ask the registry whether a version exists, and with what integrity.
|
|
* @param name - package name.
|
|
* @param version - package version.
|
|
* @returns The registry state for that version.
|
|
*/
|
|
function registryState(name: string, version: string): RegistryState {
|
|
const result = attempt('npm', ['view', `${name}@${version}`, 'dist.integrity', '--json'])
|
|
if (result.status !== 0) {
|
|
const output = `${result.stdout}${result.stderr}`
|
|
if (output.includes('E404') || output.includes('404 Not Found')) return { kind: 'absent' }
|
|
throw new Error(`npm view ${name}@${version} failed:\n${output}`)
|
|
}
|
|
const parsed: unknown = JSON.parse(result.stdout)
|
|
if (typeof parsed !== 'string' || parsed === '') {
|
|
throw new Error(`registry reported no dist.integrity for ${name}@${version}`)
|
|
}
|
|
return { kind: 'present', integrity: parsed }
|
|
}
|
|
|
|
/** Publish the family named by `--family` from the directory named by `--from`. */
|
|
function main(): void {
|
|
const { values } = parseArgs({
|
|
options: { family: { type: 'string' }, from: { type: 'string' } },
|
|
allowPositionals: false,
|
|
})
|
|
if (values.family === undefined || values.from === undefined) {
|
|
throw new Error('usage: publish.ts --family <dsh|vendor> --from <packed directory>')
|
|
}
|
|
|
|
const family = releaseFamily(values.family)
|
|
const directory = resolve(process.cwd(), values.from)
|
|
|
|
let published = 0
|
|
let skipped = 0
|
|
for (const filename of readPublishOrder(directory)) {
|
|
const tarball = join(directory, filename)
|
|
const { name, version } = packedIdentity(tarball)
|
|
const state = registryState(name, version)
|
|
if (state.kind === 'present') {
|
|
const local = integrityOf(tarball)
|
|
if (state.integrity !== local) {
|
|
throw new Error(
|
|
`${name}@${version} is already published with different content`
|
|
+ `\n registry: ${state.integrity}\n packed: ${local}`
|
|
+ '\nBump the version, or investigate why the build is not reproducible.',
|
|
)
|
|
}
|
|
console.log(`release publish: ${name}@${version} already published, skipping`)
|
|
skipped += 1
|
|
continue
|
|
}
|
|
// A prerelease version never takes the latest dist-tag.
|
|
const tagArgs = version.includes('-') ? ['--tag', 'next'] : []
|
|
run('npm', ['publish', tarball, '--access', ACCESS, ...tagArgs])
|
|
published += 1
|
|
}
|
|
|
|
console.log(`release publish: family ${family.id}, ${String(published)} published, ${String(skipped)} already present`)
|
|
}
|
|
|
|
if (isEntry(import.meta.url)) main()
|