@wipcomputer/wip-release - npm Package Compare versions

Comparing version 1.9.78 to 1.9.79

test-dist-tags.mjs

+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import { fetchNpmDistTags, fetchNpmPackageVersion } from './core.mjs';
+
+function fakeGet(statusCode, body) {
+  return (_url, _options, callback) => {
+    const req = new EventEmitter();
+    req.setTimeout = () => {};
+    req.destroy = (err) => req.emit('error', err);
+
+    const res = new EventEmitter();
+    res.statusCode = statusCode;
+    res.setEncoding = () => {};
+
+    queueMicrotask(() => {
+      callback(res);
+      if (body) res.emit('data', body);
+      res.emit('end');
+    });
+
+    return req;
+  };
+}
+
+const tags = await fetchNpmDistTags('wip-codex-remote-control', {
+  registry: 'https://registry.example.test',
+  get: fakeGet(200, JSON.stringify({
+    'dist-tags': {
+      latest: '0.0.2-alpha.2',
+      alpha: '0.0.4-alpha.1',
+      beta: '0.0.3-beta.1',
+    },
+  })),
+});
+
+assert.deepEqual(tags, {
+  latest: '0.0.2-alpha.2',
+  alpha: '0.0.4-alpha.1',
+  beta: '0.0.3-beta.1',
+});
+
+await assert.rejects(
+  fetchNpmDistTags('missing-package', {
+    registry: 'https://registry.example.test',
+    get: fakeGet(404, JSON.stringify({ error: 'not found' })),
+  }),
+  /npm package not found: missing-package/,
+);
+
+const manifest = await fetchNpmPackageVersion('@wipcomputer/wip-release', '1.9.79', {
+  registry: 'https://registry.example.test',
+  get: fakeGet(200, JSON.stringify({
+    name: '@wipcomputer/wip-release',
+    version: '1.9.79',
+  })),
+});
+
+assert.equal(manifest.name, '@wipcomputer/wip-release');
+assert.equal(manifest.version, '1.9.79');
+
+await assert.rejects(
+  fetchNpmPackageVersion('@wipcomputer/wip-release', '9.9.9', {
+    registry: 'https://registry.example.test',
+    get: fakeGet(404, JSON.stringify({ error: 'not found' })),
+  }),
+  /npm package version not found: @wipcomputer\/wip-release@9.9.9/,
+);
+
+console.log('wip-release registry fetch: dist-tags and package-version checks work');

test-prerelease-subtool-staging.mjs

+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+const source = readFileSync(new URL('./core.mjs', import.meta.url), 'utf8');
+
+const helperDefinition = source.indexOf('function stageSubToolPackageFiles(repoPath)');
+assert(helperDefinition >= 0, 'sub-tool staging helper must exist');
+
+const stableCommitPath = source.indexOf('function gitCommitAndTag(repoPath, newVersion, notes)');
+const prereleaseCommitPath = source.indexOf("const msg = `v${newVersion}: ${track} prerelease`;");
+assert(stableCommitPath >= 0, 'stable release commit path must exist');
+assert(prereleaseCommitPath >= 0, 'prerelease commit path must exist');
+
+const stableHelperCall = source.indexOf('stageSubToolPackageFiles(repoPath);', stableCommitPath);
+const prereleaseHelperCall = source.indexOf('stageSubToolPackageFiles(repoPath);', prereleaseCommitPath);
+const prereleaseCommitCall = source.indexOf("execFileSync('git', ['commit'", prereleaseCommitPath);
+
+assert(stableHelperCall >= 0, 'stable release commit path must stage sub-tool package files');
+assert(prereleaseHelperCall >= 0, 'prerelease commit path must stage sub-tool package files');
+assert(prereleaseCommitCall >= 0, 'prerelease commit call must exist');
+assert(
+  prereleaseHelperCall < prereleaseCommitCall,
+  'prerelease path must stage sub-tool package files before committing',
+);
+
+console.log('wip-release prerelease: sub-tool package files are staged before commit');

test-subtool-version-reuse-guard.mjs

+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+const source = readFileSync(new URL('./core.mjs', import.meta.url), 'utf8');
+
+const guardDefinition = source.indexOf('async function checkChangedSubToolVersionPublishability(repoPath)');
+assert(guardDefinition >= 0, 'changed sub-tool npm version guard must exist');
+
+const stablePublishPath = source.indexOf('publishNpm(repoPath);');
+const stableGuardCall = source.lastIndexOf('await checkChangedSubToolVersionPublishability(repoPath);', stablePublishPath);
+
+assert(stablePublishPath >= 0, 'stable root npm publish call must exist');
+assert(stableGuardCall >= 0, 'stable release must check changed sub-tool npm versions before root publish');
+assert(stableGuardCall < stablePublishPath, 'stable release guard must run before root publish');
+
+const prereleasePublishPath = source.indexOf('publishNpmWithTag(repoPath, track);');
+const prereleaseGuardCall = source.lastIndexOf('await checkChangedSubToolVersionPublishability(repoPath);', prereleasePublishPath);
+
+assert(prereleasePublishPath >= 0, 'prerelease root npm publish call must exist');
+assert(prereleaseGuardCall >= 0, 'prerelease must check changed sub-tool npm versions before root publish');
+assert(prereleaseGuardCall < prereleasePublishPath, 'prerelease guard must run before root publish');
+
+console.log('wip-release sub-tools: published version reuse is guarded before root publish');

package.json

 {
   "name": "@wipcomputer/wip-release",
-  "version": "1.9.78",
+  "version": "1.9.79",
   "type": "module",
@@ -5,0 +5,0 @@ "description": "One-command release pipeline. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

175893

6.73%

Number of package files

14

27.27%

Lines of code

3522

7.31%

Worsened metrics

Number of low supply chain risk alerts

10

66.67%

No dependency changes