@hubspot/npm-scripts
Advanced tools
+1
-1
| { | ||
| "name": "@hubspot/npm-scripts", | ||
| "version": "0.0.5-experimental.3", | ||
| "version": "0.0.5-experimental.4", | ||
| "description": "Scripts for working with npm packages in the HubSpot ecosystem", | ||
@@ -5,0 +5,0 @@ "author": "", |
+20
-15
@@ -10,3 +10,3 @@ import { exec as _exec } from 'node:child_process'; | ||
| import { DEFAULT_MAIN_BRANCH, VSCODE_VERSION_INCREMENT_OPTIONS, } from './constants/release.js'; | ||
| import { getCurrentGitBranch } from './utils/git.js'; | ||
| import { commitChanges, createBranch, getCurrentGitBranch, pushBranch, } from './utils/git.js'; | ||
| import { confirm } from './utils/prompting.js'; | ||
@@ -36,2 +36,3 @@ const exec = promisify(_exec); | ||
| } | ||
| let vsceCmd = 'vsce'; | ||
| try { | ||
@@ -43,2 +44,8 @@ await exec('vsce --version'); | ||
| await exec('yarn global add @vscode/vsce'); | ||
| try { | ||
| await exec('vsce --version'); | ||
| } | ||
| catch { | ||
| vsceCmd = 'npx @vscode/vsce'; | ||
| } | ||
| } | ||
@@ -63,3 +70,2 @@ const newVersion = semver.inc(localVersion, versionIncrement); | ||
| message: 'Have you tested the pre-release package locally?', | ||
| default: false, | ||
| }); | ||
@@ -78,3 +84,3 @@ if (!userHasTested) { | ||
| logger.log('\nPackaging pre-release...'); | ||
| await exec('mkdir -p releases && vsce package --pre-release -o releases/'); | ||
| await exec(`mkdir -p releases && ${vsceCmd} package --pre-release -o releases/`); | ||
| logger.success('Pre-release package created.'); | ||
@@ -89,3 +95,2 @@ logger.log('\nTo test the package locally:'); | ||
| message: 'Continue when you have finished testing the pre-release.', | ||
| default: false, | ||
| }); | ||
@@ -101,7 +106,6 @@ if (!readyToContinue) { | ||
| logger.log('\nPackaging regular release...'); | ||
| await exec('mkdir -p releases && vsce package -o releases/'); | ||
| await exec(`mkdir -p releases && ${vsceCmd} package -o releases/`); | ||
| logger.success('Regular release package created.'); | ||
| const confirmRegularRelease = await confirm({ | ||
| message: 'Test the regular release .vsix and confirm it works. Ready to proceed?', | ||
| default: false, | ||
| }); | ||
@@ -113,8 +117,8 @@ if (!confirmRegularRelease) { | ||
| } | ||
| const releaseBranch = `release/v${newVersion}`; | ||
| const tempBranch = `v${newVersion}-publish`; | ||
| if (isDryRun) { | ||
| logger.log('\nDry run complete. Would have:'); | ||
| logger.log(` 1. Created branch ${releaseBranch}`); | ||
| logger.log(` 1. Created branch ${tempBranch}`); | ||
| logger.log(` 2. Committed package.json version bump`); | ||
| logger.log(` 3. Pushed ${releaseBranch} to origin`); | ||
| logger.log(` 3. Pushed ${tempBranch} to origin`); | ||
| logger.log(` 4. Created draft PR against ${mainBranch}`); | ||
@@ -125,9 +129,10 @@ logger.log(` 5. Created draft GH release v${newVersion}`); | ||
| } | ||
| logger.log(`\nCreating release branch ${releaseBranch}...`); | ||
| await exec(`git checkout -b ${releaseBranch}`); | ||
| if (branch === mainBranch && !isDryRun) { | ||
| logger.log(`\nCreating release branch ${tempBranch}...`); | ||
| await createBranch(tempBranch); | ||
| } | ||
| logger.log('Committing changes...'); | ||
| await exec('git add package.json'); | ||
| await exec(`git commit -m "Bump version to ${newVersion}"`); | ||
| logger.log(`Pushing ${releaseBranch}...`); | ||
| await exec(`git push -u origin ${releaseBranch}`); | ||
| await commitChanges(`Bump version to ${newVersion}`); | ||
| logger.log(`Pushing ${tempBranch}...`); | ||
| await pushBranch(tempBranch); | ||
| logger.log('\nCreating draft pull request...'); | ||
@@ -134,0 +139,0 @@ const { stdout: prUrl } = await exec(`gh pr create --draft --base ${mainBranch} --title "Release v${newVersion}" --body "## Release v${newVersion}"`); |
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 1 instance in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 1 instance in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
95439
0.15%2050
0.24%