tegwick
f87f4e5e4d
Gitea's "project/package/release" terms are overloaded, so the catalog now uses the most explicit words: - org = coulomb (the Gitea organisation) - repo = whynot-design (the Gitea repository/product) — not an org, not a scope - npm scope @whynot and package @whynot/design are distinct from both Changes: - catalog schema: replace conflated `owner` with required `org` + `repo`; `owner` is now a derived `org/repo` slug property - npm-config delivery is data-driven: registry + scope live in delivery_config.npm and are validated; engine no longer hardcodes a registry - exec delivery writes `<scope>:registry=<url>` + scoped `:_authToken` for the configured Gitea registry (token still env-expanded, never written to disk) - pilot lane points at https://gitea.coulomb.social/api/packages/coulomb/npm/, scope @whynot, KV path coulomb/whynot-design/npm/publish - npm-publish-demo uses @whynot scope so dry-run resolves the Gitea registry - docs: terminology table; routing owner shown as coulomb/whynot-design - tests: org/repo required, npm-config validation, registry authkey mapping Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
92 lines
3.7 KiB
Bash
Executable file
92 lines
3.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Wire up a REAL `npm publish` through secrets-engine exec — in dry-run, so the
|
|
# tarball is built and the publish path is exercised end to end WITHOUT actually
|
|
# uploading to the registry.
|
|
#
|
|
# Chain: boot throwaway OpenBao -> apply lane -> provision a (fake) token ->
|
|
# `secrets-engine exec --catalog ... -- npm publish --dry-run`.
|
|
#
|
|
# Proves: npm in the child resolves its auth token from the temp .npmrc that
|
|
# secrets-engine injected; the parent shell never holds the token.
|
|
set -euo pipefail
|
|
|
|
REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO"
|
|
# shellcheck disable=SC1091
|
|
source .venv/bin/activate
|
|
|
|
BAO_BIN="$(command -v bao)"
|
|
WORK="$(mktemp -d)"
|
|
export BAO_ADDR="http://127.0.0.1:8271"
|
|
export BAO_TOKEN="se-npm-demo-root"
|
|
export SECRETS_ENGINE_HUB_URL="" # offline; uses local decision fixture
|
|
TOKENFILE="$WORK/whynot.token"
|
|
PKG="$WORK/pkg"
|
|
|
|
cleanup() {
|
|
set +e
|
|
[[ -n "${BAO_PID:-}" ]] && kill "$BAO_PID" 2>/dev/null
|
|
rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "### boot throwaway OpenBao"
|
|
"$BAO_BIN" server -dev -dev-root-token-id="$BAO_TOKEN" \
|
|
-dev-listen-address="127.0.0.1:8271" >"$WORK/bao.log" 2>&1 &
|
|
BAO_PID=$!
|
|
for _ in $(seq 1 30); do
|
|
"$BAO_BIN" status -address="$BAO_ADDR" >/dev/null 2>&1 && break; sleep 0.2
|
|
done
|
|
|
|
echo "### apply lane metadata + provision a (fake) npm token"
|
|
secrets-engine apply whynot-design-npm-publish --stage prod >/dev/null
|
|
printf 'npm_FAKEtokenFORdryRUNonly1234567890' > "$TOKENFILE"
|
|
chmod 600 "$TOKENFILE"
|
|
secrets-engine provision whynot-design-npm-publish --stage prod \
|
|
--field npm_token --from-file "$TOKENFILE" >/dev/null
|
|
echo " lane ready: $(secrets-engine route whynot-design-npm-publish --json | python3 -c 'import sys,json;print("ready="+str(json.load(sys.stdin)["ready"]))')"
|
|
|
|
echo "### create a scratch npm package"
|
|
mkdir -p "$PKG"
|
|
# Scratch package uses the @whynot scope so it maps to the coulomb Gitea npm
|
|
# registry that secrets-engine injects (same scope as the real @whynot/design).
|
|
cat > "$PKG/package.json" <<'EOF'
|
|
{
|
|
"name": "@whynot/se-pilot-scratch",
|
|
"version": "0.0.1",
|
|
"description": "Scratch package proving secrets-engine exec -> npm publish wiring (dry-run).",
|
|
"license": "MIT",
|
|
"publishConfig": { "access": "public" }
|
|
}
|
|
EOF
|
|
echo 'module.exports = () => "secrets-engine pilot";' > "$PKG/index.js"
|
|
|
|
echo "### run npm publish --dry-run THROUGH secrets-engine exec"
|
|
echo " (token injected into the npm child via a temp .npmrc; parent never sees it)"
|
|
cd "$PKG"
|
|
# A small wrapper proves the child resolved the auth token, then runs the real
|
|
# npm publish --dry-run. The token value itself is never printed.
|
|
cat > "$WORK/npm-wrapped.sh" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -e
|
|
# secrets-engine pointed npm at a temp userconfig holding the auth token.
|
|
# (npm itself hides _authToken from `npm config get`, so check the file npm uses.)
|
|
if [[ -n "${NPM_CONFIG_USERCONFIG:-}" ]] && grep -q '_authToken' "$NPM_CONFIG_USERCONFIG"; then
|
|
echo " [child] npm userconfig injected with an auth token: yes (value hidden)"
|
|
echo " [child] config file: $NPM_CONFIG_USERCONFIG"
|
|
else
|
|
echo " [child] npm has NO injected auth token"; exit 1
|
|
fi
|
|
exec npm publish --dry-run
|
|
EOF
|
|
chmod +x "$WORK/npm-wrapped.sh"
|
|
secrets-engine exec --catalog whynot-design-npm-publish -- "$WORK/npm-wrapped.sh"
|
|
|
|
echo
|
|
echo "### confirm parent shell never held the token"
|
|
echo " SE_NPM_TOKEN in parent: '${SE_NPM_TOKEN:-<unset>}'"
|
|
echo " NPM_CONFIG_USERCONFIG in parent: '${NPM_CONFIG_USERCONFIG:-<unset>}'"
|
|
echo
|
|
echo "### DONE — npm publish (dry-run) ran with the token injected by secrets-engine."
|
|
echo " For a REAL publish, provision a real npm automation token the same way"
|
|
echo " and drop --dry-run from the wrapped command."
|