tegwick
70371649af
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306
96 lines
3.9 KiB
Bash
Executable file
96 lines
3.9 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Wire up a REAL `npm publish` through secrets-engine exec — in dry-run, so the
|
|
# tarball is built and the publish path is exercised end to end WITHOUT actually
|
|
# uploading to the registry.
|
|
#
|
|
# Chain: boot throwaway OpenBao -> apply lane -> provision a (fake) token ->
|
|
# `secrets-engine exec --catalog ... -- npm publish --dry-run`.
|
|
#
|
|
# Proves: npm in the child resolves its auth token from the temp .npmrc that
|
|
# secrets-engine injected; the parent shell never holds the token.
|
|
set -euo pipefail
|
|
|
|
REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO"
|
|
# shellcheck disable=SC1091
|
|
source .venv/bin/activate
|
|
|
|
BAO_BIN="$(command -v bao)"
|
|
WORK="$(mktemp -d)"
|
|
export BAO_ADDR="http://127.0.0.1:8271"
|
|
export BAO_TOKEN="se-npm-demo-root"
|
|
export SECRETS_ENGINE_HUB_URL="" # offline; uses local decision fixture
|
|
export SECRETS_ENGINE_UNSAFE_DEMO="1" # required for live prod-lane demos
|
|
TOKENFILE="$WORK/whynot.token"
|
|
PKG="$WORK/pkg"
|
|
|
|
cleanup() {
|
|
set +e
|
|
[[ -n "${BAO_PID:-}" ]] && kill "$BAO_PID" 2>/dev/null
|
|
rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "### boot throwaway OpenBao"
|
|
"$BAO_BIN" server -dev -dev-root-token-id="$BAO_TOKEN" \
|
|
-dev-listen-address="127.0.0.1:8271" >"$WORK/bao.log" 2>&1 &
|
|
BAO_PID=$!
|
|
for _ in $(seq 1 30); do
|
|
"$BAO_BIN" status -address="$BAO_ADDR" >/dev/null 2>&1 && break; sleep 0.2
|
|
done
|
|
|
|
echo "### apply lane metadata + provision a (fake) npm token"
|
|
secrets-engine apply whynot-design-npm-publish --stage prod >/dev/null
|
|
printf 'npm_FAKEtokenFORdryRUNonly1234567890' > "$TOKENFILE"
|
|
chmod 600 "$TOKENFILE"
|
|
secrets-engine provision whynot-design-npm-publish --stage prod \
|
|
--field npm_token --from-file "$TOKENFILE" >/dev/null
|
|
echo " lane ready: $(secrets-engine route whynot-design-npm-publish --json | python3 -c 'import sys,json;print("ready="+str(json.load(sys.stdin)["ready"]))')"
|
|
|
|
echo "### create a scratch npm package"
|
|
mkdir -p "$PKG"
|
|
# Scratch package uses the @whynot scope so it maps to the coulomb Gitea npm
|
|
# registry that secrets-engine injects (same scope as the real @whynot/design).
|
|
cat > "$PKG/package.json" <<'EOF'
|
|
{
|
|
"name": "@whynot/se-pilot-scratch",
|
|
"version": "0.0.1",
|
|
"description": "Scratch package proving secrets-engine exec -> npm publish wiring (dry-run).",
|
|
"license": "MIT",
|
|
"publishConfig": { "access": "public" }
|
|
}
|
|
EOF
|
|
echo 'module.exports = () => "secrets-engine pilot";' > "$PKG/index.js"
|
|
|
|
echo "### run npm publish --dry-run THROUGH secrets-engine exec"
|
|
echo " (token injected into the npm child via a temp .npmrc; parent never sees it)"
|
|
cd "$PKG"
|
|
# A small wrapper proves the child resolved the auth token, then runs the real
|
|
# npm publish --dry-run. The token value itself is never printed.
|
|
cat > "$WORK/npm-wrapped.sh" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
# secrets-engine pointed npm at a temp userconfig holding the auth token.
|
|
# (npm itself hides _authToken from `npm config get`, so check the file npm uses.)
|
|
if [[ -n "${NPM_CONFIG_USERCONFIG:-}" ]] && grep -q '_authToken' "$NPM_CONFIG_USERCONFIG"; then
|
|
echo " [child] npm userconfig injected with an auth token: yes (value hidden)"
|
|
echo " [child] config file: $NPM_CONFIG_USERCONFIG"
|
|
else
|
|
echo " [child] npm has NO injected auth token"; exit 1
|
|
fi
|
|
exec npm publish --dry-run
|
|
EOF
|
|
chmod +x "$WORK/npm-wrapped.sh"
|
|
secrets-engine exec --catalog whynot-design-npm-publish -- "$WORK/npm-wrapped.sh"
|
|
|
|
echo
|
|
echo "### policy binding: which scope/token-env did the lane resolve to?"
|
|
secrets-engine policy publication whynot-design-npm-publish | sed 's/^/ /'
|
|
|
|
echo "### confirm parent shell never held the token"
|
|
echo " NPM_AUTH_TOKEN in parent: '${NPM_AUTH_TOKEN:-<unset>}'"
|
|
echo " NPM_CONFIG_USERCONFIG in parent: '${NPM_CONFIG_USERCONFIG:-<unset>}'"
|
|
echo
|
|
echo "### DONE — npm publish (dry-run) ran with the token injected by secrets-engine."
|
|
echo " For a REAL publish, provision a real npm automation token the same way"
|
|
echo " and drop --dry-run from the wrapped command."
|