#!/usr/bin/env node
// Preview builds of pi's packages on pkg.earendil.com, served by the earendil-works/pkg worker.
// Used by .github/workflows/ci.yml (pack) and .github/workflows/preview-packages.yml (publish, delete-ref).
//
// pack Point internal dependencies at this commit's builds, then `npm pack` every public package.
// Runs in the regular CI job after the build.
// publish Upload the packed tarballs and move refs (main, pr-1234), or release a tag (v1.2.3) and move `latest`.
// Runs in the trusted workflow_run job and authenticates with the job's GitHub OIDC token
// (`permissions: id-token: write`). A release keeps the packages for good under the tag.
// delete-ref Remove a ref, e.g. pr-1234 when the PR closes.
import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
import { basename, join, resolve } from "node:path";
import { parseArgs } from "node:util";
import { execNpmSync } from "./npm-command.mjs";
import { getPublicWorkspacePackages } from "./release-packages.mjs";
const BASE_URL = "https://pkg.earendil.com";
const FULL_SHA = /^[0-9a-f]{40}$/;
// Release tags as CI builds them (v*.*.*); a suffix marks a pre-release (v1.2.3-rc.1).
const RELEASE_TAG = /^v\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/;
// Its daemon binaries are cross-compiled only by the release workflow; previews would ship without them.
const EXCLUDED = new Set(["@earendil-works/pi-env"]);
class UsageError extends Error {}
function assertSha(sha) {
if (typeof sha !== "string" || !FULL_SHA.test(sha)) {
throw new UsageError(`--sha must be a full commit SHA, got ${sha}`);
}
}
async function pack(argv) {
const { values } = parseArgs({
args: argv,
options: { sha: { type: "string" }, out: { type: "string", default: "preview-packages" } },
});
assertSha(values.sha);
const sha = values.sha;
const packages = getPublicWorkspacePackages().filter((pkg) => !EXCLUDED.has(pkg.name));
const names = new Set(packages.map((pkg) => pkg.name));
const outDir = resolve(values.out);
await mkdir(outDir, { recursive: true });
const packed = [];
for (const pkg of packages) {
const manifestPath = join(pkg.directory, "package.json");
const original = await readFile(manifestPath, "utf8");
const manifest = JSON.parse(original);
// Internal dependencies point at the same commit's builds, so one install resolves a consistent set.
for (const field of ["dependencies", "optionalDependencies"]) {
for (const name of Object.keys(manifest[field] ?? {})) {
if (names.has(name)) manifest[field][name] = `${BASE_URL}/${name}@${sha}`;
}
}
await writeFile(manifestPath, `${JSON.stringify(manifest, null, "\t")}\n`);
try {
const output = execNpmSync(["pack", "--json", "--ignore-scripts", "--pack-destination", outDir], {
cwd: pkg.directory,
encoding: "utf8",
stdio: ["inherit", "pipe", "inherit"],
maxBuffer: 64 * 1024 * 1024,
});
// npm 10/11 print an array, npm 12 prints an object keyed by package name.
const parsed = JSON.parse(output);
const info = Array.isArray(parsed) ? parsed[0] : Object.values(parsed)[0];
packed.push({ name: info.name, file: info.filename });
console.error(`packed ${info.name}@${info.version} -> ${info.filename}`);
} finally {
await writeFile(manifestPath, original);
}
}
await writeFile(join(outDir, "manifest.json"), `${JSON.stringify({ sha, packages: packed }, null, "\t")}\n`);
}
// The audience names the production worker, also when --base-url points elsewhere (tests).
async function getOidcToken() {
const url = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
const token = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
if (!url || !token) {
throw new UsageError("No GitHub OIDC token available; the job needs `permissions: id-token: write`");
}
const requestUrl = new URL(url);
requestUrl.searchParams.set("audience", BASE_URL);
const response = await fetch(requestUrl, { headers: { authorization: `Bearer ${token}` } });
if (!response.ok) throw new Error(`Requesting OIDC token failed: ${response.status}`);
const { value } = await response.json();
return value;
}
async function call(method, url, token, body) {
const response = await fetch(url, { method, headers: { authorization: `Bearer ${token}` }, body });
const text = await response.text();
if (!response.ok) throw new Error(`${method} ${url} failed: ${response.status} ${text}`);
return JSON.parse(text);
}
/** Reads `path` of this repository from the GitHub REST API with the job's token. */
function github(path) {
const api = process.env.GITHUB_API_URL ?? "https://api.github.com";
return call("GET", `${api}/repos/${process.env.GITHUB_REPOSITORY}/${path}`, process.env.GH_TOKEN);
}
/**
* Decides what a CI push run publishes: `main`, a release tag with `latest` (without it for a pre-release), or nothing
* for any other name. A tag push's branch is the tag's name, and a branch or tag can carry its own copy of CI, so a
* tag named `main` or `v1.2.3` on an unreviewed commit would pass a name check: the commit must also be on main, and a
* release tag must point at it.
*/
async function pushTarget({ branch, sha, conclusion }) {
if (branch === "main") {
await assertOnMain(sha);
return { refs: ["main"] };
}
if (!RELEASE_TAG.test(branch)) return undefined;
// CI packs before its tests run; a release is kept for good.
if (conclusion !== "success") throw new Error(`CI for ${branch} did not pass; not releasing it`);
await assertOnMain(sha);
const target = await tagCommit(branch);
if (target !== sha) throw new Error(`${branch} points at ${target}, not ${sha}`);
return { tag: branch, refs: branch.includes("-") ? [] : ["latest"] };
}
// main is resolved as the branch: in compare, a tag named `main` would win over a bare `main`.
async function assertOnMain(sha) {
const main = await github("git/ref/heads/main");
const { status } = await github(`compare/${main.object.sha}...${sha}`);
if (status !== "behind" && status !== "identical") throw new Error(`${sha} is not on main (${status})`);
}
// Annotated tags point at a tag object, which can point at another tag.
async function tagCommit(tag) {
let { object } = await github(`git/ref/tags/${tag}`);
while (object.type === "tag") ({ object } = await github(`git/tags/${object.sha}`));
return object.sha;
}
function renderSummary({ baseUrl, sha, release, refs, names }) {
const lines = ["### Preview packages", "", `Built from \`${sha.slice(0, 7)}\`.`, ""];
if (release) {
lines.push(`Release \`${release.tag}\` (kept for good):`, "", "```sh");
for (const { name } of release.packages) lines.push(`npm i ${baseUrl}/${name}@${release.tag}`);
lines.push("```", "");
}
if (refs.length > 0) {
lines.push(`Latest build of \`${refs[0]}\` (moves with newer builds):`, "", "```sh");
for (const name of names) lines.push(`npm i ${baseUrl}/${name}@${refs[0]}`);
lines.push("```", "");
}
lines.push("Pinned to this commit
", "", "```sh");
for (const name of names) lines.push(`npm i ${baseUrl}/${name}@${sha}`);
lines.push("```", "", "