From a7fdbbd250e6993662896c3aaad3162337c42070 Mon Sep 17 00:00:00 2001 From: Christian Klotz Date: Mon, 2 Nov 2026 12:33:29 +0100 Subject: [PATCH] feat: check what a push run publishes in preview-packages.mjs Moves the push-run checks from scripts/preview-packages-push.sh into preview-packages.mjs, which reads the GitHub API with fetch: tests now feed raw API responses through the existing fake server, so a wrong field fails a test, and run in under 2s. The script also refuses a tag release whose CI did not pass, so that rule is tested too. The Find step fails on any passing push run whose artifact expired. --- .github/workflows/preview-packages.yml | 21 ++-- scripts/preview-packages-push.sh | 63 ------------ scripts/preview-packages-push.test.mjs | 96 ------------------- scripts/preview-packages.mjs | 65 +++++++++++-- scripts/preview-packages.test.mjs | 128 ++++++++++++++++++++----- 5 files changed, 173 insertions(+), 200 deletions(-) delete mode 100755 scripts/preview-packages-push.sh delete mode 100644 scripts/preview-packages-push.test.mjs diff --git a/.github/workflows/preview-packages.yml b/.github/workflows/preview-packages.yml index a586127a7..61cfb67ef 100644 --- a/.github/workflows/preview-packages.yml +++ b/.github/workflows/preview-packages.yml @@ -19,15 +19,11 @@ on: permissions: {} -env: - # The release tags preview-packages.mjs releases, as CI builds them (v*.*.*); a suffix marks a pre-release. - RELEASE_TAG: '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$' - jobs: publish: # Only CI runs for pushes to main, passing runs for release tags, and PRs from branches of this repo. A branch can # make its own copy of CI run on push; such runs are not reviewed and must not be published as push builds. A tag - # run's head_branch is the tag name, which a branch can also have: scripts/preview-packages-push.sh verifies it. + # run's head_branch is the tag name, which a branch can also have: preview-packages.mjs verifies push runs. if: >- github.event_name == 'workflow_run' && github.event.workflow_run.conclusion != 'cancelled' && github.event.workflow_run.head_repository.full_name == github.repository && @@ -53,13 +49,13 @@ jobs: GH_TOKEN: ${{ github.token }} RUN_ID: ${{ github.event.workflow_run.id }} EVENT: ${{ github.event.workflow_run.event }} - HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} + CONCLUSION: ${{ github.event.workflow_run.conclusion }} run: | count=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$RUN_ID/artifacts" \ --jq '[.artifacts[] | select(.name == "preview-packages")] | length') - # Tag runs are only published when CI passed, so it packed: the artifact expired (after 3 days). - if [ "$count" = 0 ] && [ "$EVENT" = push ] && [[ "$HEAD_BRANCH" =~ $RELEASE_TAG ]]; then - echo "::error::The CI artifact of $HEAD_BRANCH expired; re-run the tag's CI to release it" + # A passing push run packed, so its artifact expired (after 3 days); a release tag would go unreleased. + if [ "$count" = 0 ] && [ "$EVENT" = push ] && [ "$CONCLUSION" = success ]; then + echo "::error::The CI artifact expired; re-run CI to publish this commit" exit 1 fi if [ "$count" = 0 ]; then echo "::notice::CI produced no preview packages (it failed before packing)"; fi @@ -89,16 +85,15 @@ jobs: EVENT: ${{ github.event.workflow_run.event }} HEAD_SHA: ${{ github.event.workflow_run.head_sha }} HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} + CONCLUSION: ${{ github.event.workflow_run.conclusion }} PULL_REQUESTS: ${{ toJSON(github.event.workflow_run.pull_requests) }} RUN_ID: ${{ github.event.workflow_run.id }} DIR: ${{ runner.temp }}/preview-packages run: | args=(--dir "$DIR" --sha "$HEAD_SHA" --run "$RUN_ID" --event "$EVENT") if [ "$EVENT" = push ]; then - # Checks the run may publish: only commits on main, under main or a release tag (see the script). - push_args=$(bash scripts/preview-packages-push.sh) - if [ -z "$push_args" ]; then exit 0; fi - while IFS= read -r arg; do args+=("$arg"); done <<< "$push_args" + # The script decides what a push run publishes (main or a release tag) and checks the commit is on main. + args+=(--branch "$HEAD_BRANCH" --conclusion "$CONCLUSION") else # The branch's PR into main; a branch can also have PRs into other branches. It may have closed or received # new commits since CI ran, so the ref moves only while the PR is open with this commit as its head. diff --git a/scripts/preview-packages-push.sh b/scripts/preview-packages-push.sh deleted file mode 100755 index 5cd6bb708..000000000 --- a/scripts/preview-packages-push.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/usr/bin/env bash -# Decides what a CI push run publishes to pkg.earendil.com, for .github/workflows/preview-packages.yml. Prints the -# `preview-packages.mjs publish` arguments, one per line: `--ref main` for main, `--tag ` and `--ref latest` for a -# release tag (`--tag` only for a pre-release), nothing for any other name. Fails when the run must not publish. -# -# A tag push's head_branch is the tag's name, and a branch or tag can carry its own copy of CI. So a tag named `main` -# or `v1.2.3` on an unreviewed commit would pass a name check: every push run must also be for a commit on main, and a -# release tag must point at that commit. -# -# Environment: GITHUB_REPOSITORY, HEAD_SHA and HEAD_BRANCH of the CI run, RELEASE_TAG (the release tag pattern), -# GH_TOKEN for `gh api`. - -set -euo pipefail - -repo="repos/$GITHUB_REPOSITORY" - -# main is resolved as the branch: in compare, a tag named `main` would win over a bare `main`. -require_on_main() { - local main status - main=$(gh api "$repo/git/ref/heads/main" --jq .object.sha) - status=$(gh api "$repo/compare/$main...$HEAD_SHA" --jq .status) - if [ "$status" != behind ] && [ "$status" != identical ]; then - echo "::error::$HEAD_SHA is not on main; compare status: $status" >&2 - exit 1 - fi -} - -# The commit a tag points at. Annotated tags point at a tag object, which can point at another tag. -tag_commit() { - local ref type target - ref=$(gh api "$repo/git/ref/tags/$1" --jq '"\(.object.type) \(.object.sha)"') - read -r type target <<< "$ref" - for _ in 1 2 3 4 5; do - [ "$type" = tag ] || break - ref=$(gh api "$repo/git/tags/$target" --jq '"\(.object.type) \(.object.sha)"') - read -r type target <<< "$ref" - done - if [ "$type" != commit ]; then - echo "::error::$1 does not resolve to a commit" >&2 - exit 1 - fi - echo "$target" -} - -if [ "$HEAD_BRANCH" = main ]; then - require_on_main - printf '%s\n' --ref main - exit 0 -fi - -if ! [[ "$HEAD_BRANCH" =~ $RELEASE_TAG ]]; then - echo "::notice::$HEAD_BRANCH is not a release tag; nothing to publish" >&2 - exit 0 -fi -require_on_main -target=$(tag_commit "$HEAD_BRANCH") -if [ "$target" != "$HEAD_SHA" ]; then - echo "::error::$HEAD_BRANCH points at $target, not $HEAD_SHA" >&2 - exit 1 -fi -printf '%s\n' --tag "$HEAD_BRANCH" -# A pre-release is kept under its tag, but `latest` stays on the newest release. -if [[ "$HEAD_BRANCH" != *-* ]]; then printf '%s\n' --ref latest; fi diff --git a/scripts/preview-packages-push.test.mjs b/scripts/preview-packages-push.test.mjs deleted file mode 100644 index 2e2a730b8..000000000 --- a/scripts/preview-packages-push.test.mjs +++ /dev/null @@ -1,96 +0,0 @@ -import assert from "node:assert/strict"; -import { execFile } from "node:child_process"; -import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; -import { tmpdir } from "node:os"; -import { dirname, join } from "node:path"; -import test from "node:test"; -import { fileURLToPath } from "node:url"; -import { promisify } from "node:util"; - -const run = promisify(execFile); -const scripts = dirname(fileURLToPath(import.meta.url)); -const script = join(scripts, "preview-packages-push.sh"); -// The pattern the workflow passes, read from it so the test checks the real one. -const workflow = readFileSync(join(scripts, "../.github/workflows/preview-packages.yml"), "utf8"); -const RELEASE_TAG = /^\s*RELEASE_TAG: '(.+)'$/m.exec(workflow)[1]; -const sha = "a".repeat(40); -const mainSha = "m".repeat(40); -const repo = "repos/earendil-works/pi"; - -/** - * Runs the script for a CI push run against a fake `gh` that answers `gh api ` with `responses[path]`, already - * filtered as by --jq, and fails like a 404 for any other path. - */ -async function decide(t, branch, responses) { - const bin = mkdtempSync(join(tmpdir(), "pi-preview-packages-push-test-")); - t.after(() => rmSync(bin, { recursive: true, force: true })); - writeFileSync(join(bin, "responses.json"), JSON.stringify(responses)); - const fake = `#!/usr/bin/env node -const responses = JSON.parse(require("node:fs").readFileSync(${JSON.stringify(join(bin, "responses.json"))}, "utf8")); -const path = process.argv[3]; -if (!(path in responses)) { console.error("gh: Not Found (HTTP 404)"); process.exit(1); } -console.log(responses[path]); -`; - writeFileSync(join(bin, "gh"), fake); - chmodSync(join(bin, "gh"), 0o755); - const env = { - PATH: `${bin}:${process.env.PATH}`, - GITHUB_REPOSITORY: "earendil-works/pi", - HEAD_SHA: sha, - HEAD_BRANCH: branch, - RELEASE_TAG, - }; - try { - const { stdout } = await run("bash", [script], { env }); - return { args: stdout.split("\n").filter(Boolean) }; - } catch (error) { - return { failed: error.stderr.trim() }; - } -} - -/** GitHub's answers for a commit on main: compare against main's SHA says how the commit relates to it. */ -function onMain(status = "behind") { - return { [`${repo}/git/ref/heads/main`]: mainSha, [`${repo}/compare/${mainSha}...${sha}`]: status }; -} - -test("publishes main and release tags of commits on main", async (t) => { - const lightweight = { ...onMain(), [`${repo}/git/ref/tags/v1.2.3`]: `commit ${sha}` }; - assert.deepEqual(await decide(t, "main", onMain("identical")), { args: ["--ref", "main"] }); - assert.deepEqual(await decide(t, "v1.2.3", lightweight), { args: ["--tag", "v1.2.3", "--ref", "latest"] }); - - // An annotated tag can point at another annotated tag before the commit. - const nested = { - ...onMain(), - [`${repo}/git/ref/tags/v1.2.3`]: "tag t1", - [`${repo}/git/tags/t1`]: "tag t2", - [`${repo}/git/tags/t2`]: `commit ${sha}`, - }; - assert.deepEqual(await decide(t, "v1.2.3", nested), { args: ["--tag", "v1.2.3", "--ref", "latest"] }); - - // A pre-release is released, but `latest` stays on the newest release. - const prerelease = { ...onMain(), [`${repo}/git/ref/tags/v1.2.3-rc.1`]: `commit ${sha}` }; - assert.deepEqual(await decide(t, "v1.2.3-rc.1", prerelease), { args: ["--tag", "v1.2.3-rc.1"] }); -}); - -test("publishes nothing for names that are no release tag", async (t) => { - for (const branch of ["vfoo", "v1.2", "release-1.2.3"]) { - assert.deepEqual([branch, await decide(t, branch, onMain())], [branch, { args: [] }]); - } -}); - -test("refuses commits off main, tags of other commits and failed checks", async (t) => { - const tagged = { [`${repo}/git/ref/tags/v1.2.3`]: `commit ${sha}` }; - const cases = [ - // A tag named main on an unreviewed commit: a bare `main` in compare would resolve to the tag. - ["tag named main", "main", { ...onMain("diverged"), [`${repo}/compare/main...${sha}`]: "identical" }], - ["release tag off main", "v1.2.3", { ...onMain("ahead"), ...tagged }], - ["tag of another commit", "v1.2.3", { ...onMain(), [`${repo}/git/ref/tags/v1.2.3`]: `commit ${"b".repeat(40)}` }], - ["missing tag", "v1.2.3", onMain()], - ["main not found", "main", {}], - ["compare failed", "v1.2.3", { [`${repo}/git/ref/heads/main`]: mainSha, ...tagged }], - ]; - for (const [label, branch, responses] of cases) { - const result = await decide(t, branch, responses); - assert.ok(result.failed, `${label}: expected a refusal, got ${JSON.stringify(result)}`); - } -}); diff --git a/scripts/preview-packages.mjs b/scripts/preview-packages.mjs index a7c9e7d29..f588195ab 100644 --- a/scripts/preview-packages.mjs +++ b/scripts/preview-packages.mjs @@ -4,8 +4,8 @@ // // pack Point internal dependencies at this commit's builds, then `npm pack` every public package. // Runs in the regular CI job after the build. -// publish Upload the packed tarballs, release a tag (v1.2.3) and move refs (main, latest, pr-1234). Runs in the -// trusted workflow_run job and authenticates with the job's GitHub OIDC token +// publish Upload the packed tarballs and move refs (main, pr-1234), or release a tag (v1.2.3) and move `latest`. +// Runs in the trusted workflow_run job and authenticates with the job's GitHub OIDC token // (`permissions: id-token: write`). A release keeps the packages for good under the tag. // delete-ref Remove a ref, e.g. pr-1234 when the PR closes. @@ -17,6 +17,8 @@ import { getPublicWorkspacePackages } from "./release-packages.mjs"; const BASE_URL = "https://pkg.earendil.com"; const FULL_SHA = /^[0-9a-f]{40}$/; +// Release tags as CI builds them (v*.*.*); a suffix marks a pre-release (v1.2.3-rc.1). +const RELEASE_TAG = /^v\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/; // Its daemon binaries are cross-compiled only by the release workflow; previews would ship without them. const EXCLUDED = new Set(["@earendil-works/pi-env"]); @@ -93,6 +95,46 @@ async function call(method, url, token, body) { return JSON.parse(text); } +/** Reads `path` of this repository from the GitHub REST API with the job's token. */ +function github(path) { + const api = process.env.GITHUB_API_URL ?? "https://api.github.com"; + return call("GET", `${api}/repos/${process.env.GITHUB_REPOSITORY}/${path}`, process.env.GH_TOKEN); +} + +/** + * Decides what a CI push run publishes: `main`, a release tag with `latest` (without it for a pre-release), or nothing + * for any other name. A tag push's branch is the tag's name, and a branch or tag can carry its own copy of CI, so a + * tag named `main` or `v1.2.3` on an unreviewed commit would pass a name check: the commit must also be on main, and a + * release tag must point at it. + */ +async function pushTarget({ branch, sha, conclusion }) { + if (branch === "main") { + await assertOnMain(sha); + return { refs: ["main"] }; + } + if (!RELEASE_TAG.test(branch)) return undefined; + // CI packs before its tests run; a release is kept for good. + if (conclusion !== "success") throw new Error(`CI for ${branch} did not pass; not releasing it`); + await assertOnMain(sha); + const target = await tagCommit(branch); + if (target !== sha) throw new Error(`${branch} points at ${target}, not ${sha}`); + return { tag: branch, refs: branch.includes("-") ? [] : ["latest"] }; +} + +// main is resolved as the branch: in compare, a tag named `main` would win over a bare `main`. +async function assertOnMain(sha) { + const main = await github("git/ref/heads/main"); + const { status } = await github(`compare/${main.object.sha}...${sha}`); + if (status !== "behind" && status !== "identical") throw new Error(`${sha} is not on main (${status})`); +} + +// Annotated tags point at a tag object, which can point at another tag. +async function tagCommit(tag) { + let { object } = await github(`git/ref/tags/${tag}`); + while (object.type === "tag") ({ object } = await github(`git/tags/${object.sha}`)); + return object.sha; +} + function renderSummary({ baseUrl, sha, release, refs, names }) { const lines = ["### Preview packages", "", `Built from \`${sha.slice(0, 7)}\`.`, ""]; if (release) { @@ -118,15 +160,16 @@ async function publish(argv) { options: { dir: { type: "string", default: "preview-packages" }, sha: { type: "string" }, - tag: { type: "string" }, ref: { type: "string", multiple: true, default: [] }, + branch: { type: "string" }, + conclusion: { type: "string" }, run: { type: "string" }, event: { type: "string" }, "base-url": { type: "string", default: BASE_URL }, }, }); assertSha(values.sha); - const { sha, tag, ref: refs, event } = values; + const { sha, event } = values; const run = Number(values.run); if (!/^\d+$/.test(values.run ?? "") || !Number.isSafeInteger(run)) { throw new UsageError(`--run must be the CI run ID, got ${values.run}`); @@ -134,8 +177,16 @@ async function publish(argv) { if (event !== "push" && event !== "pull_request") { throw new UsageError(`--event must be push or pull_request, got ${event}`); } + if (event === "push" && !values.branch) throw new UsageError("Push runs need --branch"); const baseUrl = values["base-url"]; const dir = resolve(values.dir); + // Push runs are checked before anything is uploaded; pull request runs move the refs the workflow passes. + const target = event === "push" ? await pushTarget(values) : { refs: values.ref }; + if (!target) { + console.error(`::notice::${values.branch} is neither main nor a release tag; nothing to publish`); + return; + } + const { tag, refs } = target; // The artifact comes from an untrusted PR build: only read tarballs from it. The SHA, run, event, and refs // come from the trusted workflow_run event; the worker authorizes package names against its config. @@ -188,8 +239,10 @@ async function deleteRef(argv) { const USAGE = `Usage: node scripts/preview-packages.mjs pack --sha [--out dir] - node scripts/preview-packages.mjs publish --sha --run --event - [--dir dir] [--tag name] [--ref name]... + node scripts/preview-packages.mjs publish --sha --run --event push --branch + --conclusion [--dir dir] + node scripts/preview-packages.mjs publish --sha --run --event pull_request + [--dir dir] [--ref name]... node scripts/preview-packages.mjs delete-ref --ref `; const [command, ...argv] = process.argv.slice(2); diff --git a/scripts/preview-packages.test.mjs b/scripts/preview-packages.test.mjs index f09a9761a..a5ebbce98 100644 --- a/scripts/preview-packages.test.mjs +++ b/scripts/preview-packages.test.mjs @@ -12,6 +12,8 @@ const run = promisify(execFile); const script = join(dirname(fileURLToPath(import.meta.url)), "preview-packages.mjs"); const sha = "a".repeat(40); const newerSha = "b".repeat(40); +const mainSha = "c".repeat(40); +const REPO_API = "/repos/earendil-works/pi/"; function temporaryDirectory(t) { const directory = mkdtempSync(join(tmpdir(), "pi-preview-packages-test-")); @@ -24,12 +26,23 @@ function writePackage(repo, directory, manifest) { writeFileSync(join(repo, "packages", directory, "package.json"), `${JSON.stringify(manifest, null, "\t")}\n`); } +/** GitHub's answers for a commit on main: compare against main's SHA says how the commit relates to main. */ +function onMain(status = "behind") { + return { "git/ref/heads/main": { object: { sha: mainSha } }, [`compare/${mainSha}...${sha}`]: { status } }; +} + +/** GitHub's answers for a release tag of the commit on main. */ +function released(tag) { + return { ...onMain(), [`git/ref/tags/${tag}`]: { object: { type: "commit", sha } } }; +} + /** - * Stands in for the pkg.earendil.com worker and GitHub's OIDC token endpoint, recording requests. `refsSha` is what the - * worker reports each ref resolves to after the update; `uploadBody` overrides the upload response; `releaseStatus` - * the release's status. + * Stands in for the pkg.earendil.com worker, GitHub's OIDC token endpoint and GitHub's REST API, recording requests. + * `refsSha` is what the worker reports each ref resolves to after the update; `uploadBody` overrides the upload + * response; `releaseStatus` the release's status. `github` maps paths below the repository to API responses; any other + * API path is a 404. */ -async function startServer(t, { refsSha = sha, uploadBody, releaseStatus = 201 } = {}) { +async function startServer(t, { refsSha = sha, uploadBody, releaseStatus = 201, github = {} } = {}) { const requests = []; const server = createServer(async (req, res) => { let body = ""; @@ -37,6 +50,11 @@ async function startServer(t, { refsSha = sha, uploadBody, releaseStatus = 201 } requests.push({ method: req.method, url: req.url, authorization: req.headers.authorization, body }); const url = new URL(req.url, "http://localhost"); if (url.pathname === "/token") return res.end(JSON.stringify({ value: `oidc-for-${url.searchParams.get("audience")}` })); + if (url.pathname.startsWith(REPO_API)) { + const response = github[url.pathname.slice(REPO_API.length)]; + res.statusCode = response ? 200 : 404; + return res.end(JSON.stringify(response ?? { message: "Not Found" })); + } if (req.method === "PUT") { const name = decodeURIComponent(url.pathname.split("/").slice(4).join("/")); return res.end(uploadBody ?? JSON.stringify({ name, sha, existing: false })); @@ -66,10 +84,28 @@ function publish(server, dir, args = ["--event", "pull_request", "--ref", "pr-1" const { GITHUB_STEP_SUMMARY: _, ...env } = process.env; const common = ["publish", "--sha", sha, "--run", "7", "--dir", dir]; return run(process.execPath, [script, ...common, ...args, "--base-url", server.url], { - env: { ...env, ACTIONS_ID_TOKEN_REQUEST_URL: `${server.url}/token`, ACTIONS_ID_TOKEN_REQUEST_TOKEN: "runner" }, + env: { + ...env, + ACTIONS_ID_TOKEN_REQUEST_URL: `${server.url}/token`, + ACTIONS_ID_TOKEN_REQUEST_TOKEN: "runner", + GITHUB_API_URL: server.url, + GITHUB_REPOSITORY: "earendil-works/pi", + GH_TOKEN: "job-token", + }, }); } +/** The arguments of a CI push run of `branch`. */ +function pushRun(branch, conclusion = "success") { + return ["--event", "push", "--branch", branch, "--conclusion", conclusion]; +} + +/** The POST requests to pkg.earendil.com, as [path, body]. */ +function posts(server) { + const requests = server.requests.filter((request) => request.method === "POST"); + return requests.map((request) => [request.url, JSON.parse(request.body)]); +} + test("pack points internal dependencies at the commit's builds and restores package.json", async (t) => { const repo = temporaryDirectory(t); writePackage(repo, "a", { name: "@scope/a", version: "1.0.0", dependencies: { "@scope/b": "1.0.0", other: "2.0.0" } }); @@ -133,42 +169,90 @@ test("publish fails on a successful response that is not JSON", async (t) => { assert.equal(server.requests.filter((request) => request.method === "POST").length, 0); }); -const RELEASE_ARGS = ["--event", "push", "--tag", "v1.2.3", "--ref", "latest"]; +test("publish decides what a push run publishes", async (t) => { + const release = (tag) => ["/_/releases", { sha, tag }]; + const latest = ["/_/refs", { sha, refs: ["latest"], run: 7 }]; + const nested = { + ...onMain(), + "git/ref/tags/v1.2.3": { object: { type: "tag", sha: "t1" } }, + "git/tags/t1": { object: { type: "tag", sha: "t2" } }, + "git/tags/t2": { object: { type: "commit", sha } }, + }; + const cases = [ + ["main", onMain("identical"), [["/_/refs", { sha, refs: ["main"], run: 7 }]]], + ["v1.2.3", released("v1.2.3"), [release("v1.2.3"), latest]], + // An annotated tag can point at another annotated tag before the commit. + ["v1.2.3", nested, [release("v1.2.3"), latest]], + // A pre-release is kept under its tag, but `latest` stays on the newest release. + ["v1.2.3-beta.1", released("v1.2.3-beta.1"), [release("v1.2.3-beta.1")]], + ]; + for (const [branch, github, expected] of cases) { + const server = await startServer(t, { github }); + const dir = join(temporaryDirectory(t), "artifact"); + writeArtifact(dir); + await publish(server, dir, pushRun(branch)); + assert.deepEqual([branch, posts(server)], [branch, expected]); + } +}); -test("publish releases a tag before moving refs and prints its install commands", async (t) => { - const server = await startServer(t); +test("publish uploads nothing for push runs of other names", async (t) => { + for (const branch of ["vfoo", "v1.2", "v1.2.3.4", "release-v1.2.3", "v1.2.3-"]) { + const server = await startServer(t, { github: released(branch) }); + const dir = join(temporaryDirectory(t), "artifact"); + writeArtifact(dir); + const { stderr } = await publish(server, dir, pushRun(branch)); + assert.match(stderr, /nothing to publish/); + assert.deepEqual([branch, server.requests], [branch, []]); + } +}); + +test("publish refuses push runs off main, of other commits or with failing CI", async (t) => { + const otherCommit = { ...onMain(), "git/ref/tags/v1.2.3": { object: { type: "commit", sha: newerSha } } }; + const cases = [ + // A tag named main on an unreviewed commit: a bare `main` in compare would resolve to the tag. + ["tag named main", "main", "success", { ...onMain("diverged"), [`compare/main...${sha}`]: { status: "identical" } }], + ["release tag off main", "v1.2.3", "success", { ...released("v1.2.3"), ...onMain("ahead") }], + ["tag of another commit", "v1.2.3", "success", otherCommit], + ["missing tag", "v1.2.3", "success", onMain()], + ["failing CI", "v1.2.3", "failure", released("v1.2.3")], + ]; + for (const [label, branch, conclusion, github] of cases) { + const server = await startServer(t, { github }); + const dir = join(temporaryDirectory(t), "artifact"); + writeArtifact(dir); + await assert.rejects(publish(server, dir, pushRun(branch, conclusion)), undefined, label); + const uploads = server.requests.filter((request) => request.method === "PUT"); + assert.deepEqual([label, uploads], [label, []]); + } +}); + +const RELEASE_RUN = pushRun("v1.2.3"); + +test("publish prints the release's install commands", async (t) => { + const server = await startServer(t, { github: released("v1.2.3") }); const dir = join(temporaryDirectory(t), "artifact"); writeArtifact(dir); - const { stdout } = await publish(server, dir, RELEASE_ARGS); - - const posts = server.requests.filter((request) => request.method === "POST"); - assert.deepEqual( - posts.map((request) => [request.url, JSON.parse(request.body)]), - [ - ["/_/releases", { sha, tag: "v1.2.3" }], - ["/_/refs", { sha, refs: ["latest"], run: 7 }], - ], - ); + const { stdout } = await publish(server, dir, RELEASE_RUN); assert.match(stdout, new RegExp(`npm i ${server.url}/@scope/a@v1\\.2\\.3`)); assert.match(stdout, new RegExp(`npm i ${server.url}/@scope/a@latest`)); }); test("publish moves no refs when the release fails", async (t) => { - const server = await startServer(t, { releaseStatus: 409 }); + const server = await startServer(t, { releaseStatus: 409, github: released("v1.2.3") }); const dir = join(temporaryDirectory(t), "artifact"); writeArtifact(dir); - await assert.rejects(publish(server, dir, RELEASE_ARGS), /409/); + await assert.rejects(publish(server, dir, RELEASE_RUN), /409/); assert.equal(server.requests.filter((request) => request.url === "/_/refs").length, 0); }); test("publish still prints the release when a newer release owns latest", async (t) => { - const server = await startServer(t, { refsSha: newerSha }); + const server = await startServer(t, { refsSha: newerSha, github: released("v1.2.3") }); const dir = join(temporaryDirectory(t), "artifact"); writeArtifact(dir); - const { stdout } = await publish(server, dir, RELEASE_ARGS); + const { stdout } = await publish(server, dir, RELEASE_RUN); assert.match(stdout, /@scope\/a@v1\.2\.3/); assert.doesNotMatch(stdout, /@latest/); });