tegwick
5b48033bce
Token scope is now bound to package maturity, gated on netkingdom's own maturity: - maturity-build -> gitea-wide, maturity-test -> org-wide, maturity-prod -> repo-scoped (scope narrows as stakes rise; broad tokens only for low-stakes build artifacts) - the graduated table is DORMANT until netkingdom reaches production grade; until then every lane clamps to repo-scope, injected as NPM_AUTH_TOKEN (fail-safe) - token env-var name signals blast radius: NPM_AUTH_TOKEN (repo default), NPM_AUTH_COULOMB_TOKEN (org), NPM_AUTH_GITEA_TOKEN (gitea), NPM_AUTH_WHYNOT_TOKEN (npm scope, defined but unused), NPM_AUTH_WHYNOTDESIGN (explicit repo) netkingdom is at maturity-build today, so whynot-design resolves to repo-scope / NPM_AUTH_TOKEN. Flip netkingdom_maturity to maturity-prod to activate graduation. - policies/netkingdom-publication-scope.yaml: the policy data + gate - publication_policy.py: load + resolve (clamp/active, env naming, override) - exec delivery injects under the resolved env-var name (was fixed SE_NPM_TOKEN) - catalog lane carries delivery_config.npm.maturity - new CLI: `secrets-engine policy publication <lane>` - docs/publication-scope-policy.md; tests for clamp, graduation, naming, override Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
95 lines
3.8 KiB
Bash
Executable file
95 lines
3.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Wire up a REAL `npm publish` through secrets-engine exec — in dry-run, so the
|
|
# tarball is built and the publish path is exercised end to end WITHOUT actually
|
|
# uploading to the registry.
|
|
#
|
|
# Chain: boot throwaway OpenBao -> apply lane -> provision a (fake) token ->
|
|
# `secrets-engine exec --catalog ... -- npm publish --dry-run`.
|
|
#
|
|
# Proves: npm in the child resolves its auth token from the temp .npmrc that
|
|
# secrets-engine injected; the parent shell never holds the token.
|
|
set -euo pipefail
|
|
|
|
REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO"
|
|
# shellcheck disable=SC1091
|
|
source .venv/bin/activate
|
|
|
|
BAO_BIN="$(command -v bao)"
|
|
WORK="$(mktemp -d)"
|
|
export BAO_ADDR="http://127.0.0.1:8271"
|
|
export BAO_TOKEN="se-npm-demo-root"
|
|
export SECRETS_ENGINE_HUB_URL="" # offline; uses local decision fixture
|
|
TOKENFILE="$WORK/whynot.token"
|
|
PKG="$WORK/pkg"
|
|
|
|
cleanup() {
|
|
set +e
|
|
[[ -n "${BAO_PID:-}" ]] && kill "$BAO_PID" 2>/dev/null
|
|
rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "### boot throwaway OpenBao"
|
|
"$BAO_BIN" server -dev -dev-root-token-id="$BAO_TOKEN" \
|
|
-dev-listen-address="127.0.0.1:8271" >"$WORK/bao.log" 2>&1 &
|
|
BAO_PID=$!
|
|
for _ in $(seq 1 30); do
|
|
"$BAO_BIN" status -address="$BAO_ADDR" >/dev/null 2>&1 && break; sleep 0.2
|
|
done
|
|
|
|
echo "### apply lane metadata + provision a (fake) npm token"
|
|
secrets-engine apply whynot-design-npm-publish --stage prod >/dev/null
|
|
printf 'npm_FAKEtokenFORdryRUNonly1234567890' > "$TOKENFILE"
|
|
chmod 600 "$TOKENFILE"
|
|
secrets-engine provision whynot-design-npm-publish --stage prod \
|
|
--field npm_token --from-file "$TOKENFILE" >/dev/null
|
|
echo " lane ready: $(secrets-engine route whynot-design-npm-publish --json | python3 -c 'import sys,json;print("ready="+str(json.load(sys.stdin)["ready"]))')"
|
|
|
|
echo "### create a scratch npm package"
|
|
mkdir -p "$PKG"
|
|
# Scratch package uses the @whynot scope so it maps to the coulomb Gitea npm
|
|
# registry that secrets-engine injects (same scope as the real @whynot/design).
|
|
cat > "$PKG/package.json" <<'EOF'
|
|
{
|
|
"name": "@whynot/se-pilot-scratch",
|
|
"version": "0.0.1",
|
|
"description": "Scratch package proving secrets-engine exec -> npm publish wiring (dry-run).",
|
|
"license": "MIT",
|
|
"publishConfig": { "access": "public" }
|
|
}
|
|
EOF
|
|
echo 'module.exports = () => "secrets-engine pilot";' > "$PKG/index.js"
|
|
|
|
echo "### run npm publish --dry-run THROUGH secrets-engine exec"
|
|
echo " (token injected into the npm child via a temp .npmrc; parent never sees it)"
|
|
cd "$PKG"
|
|
# A small wrapper proves the child resolved the auth token, then runs the real
|
|
# npm publish --dry-run. The token value itself is never printed.
|
|
cat > "$WORK/npm-wrapped.sh" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
# secrets-engine pointed npm at a temp userconfig holding the auth token.
|
|
# (npm itself hides _authToken from `npm config get`, so check the file npm uses.)
|
|
if [[ -n "${NPM_CONFIG_USERCONFIG:-}" ]] && grep -q '_authToken' "$NPM_CONFIG_USERCONFIG"; then
|
|
echo " [child] npm userconfig injected with an auth token: yes (value hidden)"
|
|
echo " [child] config file: $NPM_CONFIG_USERCONFIG"
|
|
else
|
|
echo " [child] npm has NO injected auth token"; exit 1
|
|
fi
|
|
exec npm publish --dry-run
|
|
EOF
|
|
chmod +x "$WORK/npm-wrapped.sh"
|
|
secrets-engine exec --catalog whynot-design-npm-publish -- "$WORK/npm-wrapped.sh"
|
|
|
|
echo
|
|
echo "### policy binding: which scope/token-env did the lane resolve to?"
|
|
secrets-engine policy publication whynot-design-npm-publish | sed 's/^/ /'
|
|
|
|
echo "### confirm parent shell never held the token"
|
|
echo " NPM_AUTH_TOKEN in parent: '${NPM_AUTH_TOKEN:-<unset>}'"
|
|
echo " NPM_CONFIG_USERCONFIG in parent: '${NPM_CONFIG_USERCONFIG:-<unset>}'"
|
|
echo
|
|
echo "### DONE — npm publish (dry-run) ran with the token injected by secrets-engine."
|
|
echo " For a REAL publish, provision a real npm automation token the same way"
|
|
echo " and drop --dry-run from the wrapped command."
|