builder-support - npm Package Compare versions

Comparing version 0.3.2 to 0.4.0

HISTORY.md

 History
 =======
 
+## 0.4.0
+
+* Add support for `../ARCHETYPE-dev` fallback directory if `./dev` directory
+  does not exists.
+* **Breaking Change**: Do not generate `./dev` directory on a new project if it
+  does not exist. Either a `../ARCHETYPE-dev` or `./dev` directory must already
+  exist before running `builder-support gen-dev`.
+
 ## 0.3.0
@@ -5,0 +13,0 @@

lib/dev.js

@@ -67,7 +67,3 @@ "use strict";
 module.exports = function (callback) {
-  var devPath = path.resolve("dev/package.json");
-
   async.auto({
-    ensureDevDirectory: fs.ensureDir.bind(fs, path.resolve("dev")),
-
     readProdPackage: function (cb) {
@@ -77,8 +73,30 @@ fs.readJson(path.resolve("package.json"), cb);
 
-    readDevPackage: function (cb) {
-      fs.readJson(devPath, allowNotFound(cb));
-    },
+    findDevPath: ["readProdPackage", function (cb, results) {
+      var pkg = results.readProdPackage;
+      var localDevPath = path.resolve("dev");
+      var externalDevPath = path.resolve("../" + pkg.name + "-dev");
 
+      fs.stat(localDevPath, function (localErr) {
+        if (localErr && localErr.code === "ENOENT") {
+          return fs.stat(externalDevPath, function (externalErr) {
+            if (externalErr) {
+              return cb(new Error("Could not find dev directories in: " + [
+                localDevPath,
+                externalDevPath
+              ].join(", ")));
+            }
+            cb(null, externalDevPath);
+          });
+        }
+        cb(localErr, localDevPath);
+      });
+    }],
+
+    readDevPackage: ["findDevPath", function (cb, results) {
+      var pkgPath = path.join(results.findDevPath, "package.json");
+      fs.readJson(pkgPath, allowNotFound(cb));
+    }],
+
     updateDevPackage: [
-      "ensureDevDirectory",
+      "findDevPath",
       "readDevPackage",
@@ -95,15 +113,18 @@ "readProdPackage",
 
-    writeDevPackage: ["updateDevPackage", function (cb, results) {
-      fs.writeFile(devPath, JSON.stringify(results.updateDevPackage, null, 2) + "\n", cb);
+    writeDevPackage: ["findDevPath", "updateDevPackage", function (cb, results) {
+      var pkgPath = path.join(results.findDevPath, "package.json");
+      fs.writeFile(pkgPath, JSON.stringify(results.updateDevPackage, null, 2) + "\n", cb);
     }],
 
     // Copy all remaining files straight up.
-    copyFiles: ["ensureDevDirectory", async.map.bind(async, FILES, function (fileName, cb) {
-      fs.copy(
-        path.resolve(fileName),
-        path.resolve(path.join("dev", fileName)),
-        allowNotFound(cb)
-      );
-    })]
+    copyFiles: ["findDevPath", function (cb, results) {
+      async.map(FILES, function (fileName, mapCb) {
+        fs.copy(
+          path.resolve(fileName),
+          path.resolve(path.join(results.findDevPath, fileName)),
+          allowNotFound(mapCb)
+        );
+      }, cb);
+    }]
   }, callback);
 };

package.json

 {
   "name": "builder-support",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Builder support libraries",
@@ -5,0 +5,0 @@ "repository": {

README.md

@@ -30,14 +30,18 @@ [![Travis Status][trav_img]][trav_site]
   `description` fields.
-* `dev/package.json` - Dependencies for development tasks only.
+* A development sub-directory or independent repository containing dependencies
+  for development tasks only.
+    * `dev/package.json`
+    * `../ARCHETYPE-dev/package.json`
 
 Assuming those exist, then the tool:
 
-* Modifies `dev/package.json` as follows:
+* Modifies `ARCHETYPE-dev/package.json` as follows:
     * Copies the root `package.json`
     * Removes `package.json:devDependencies`
-    * Replaces `package.json:dependencies` with `dev/package.json:dependencies`
-    * Updates things like the `name` field to represent `dev`
+    * Replaces `package.json:dependencies` with
+      `ARCHETYPE-dev/package.json:dependencies`
+    * Updates things like the `name` field to represent `ARCHETYPE-dev`
 
-* Copies `README.md` to `dev/README.md`
-* Copies `.gitignore` to `dev/.gitignore`
+* Copies `README.md` to `ARCHETYPE-dev/README.md`
+* Copies `.gitignore` to `ARCHETYPE-dev/.gitignore`
 
@@ -49,3 +53,3 @@ This supports a workflow as follows:
 $ vim package.json            # Bump version
-$ builder-support gen-dev     # Generate `dev/package.json|README.md|.gitignore`
+$ builder-support gen-dev     # Generate `ARCHETYPE-dev` files
 $ npm run builder:check       # Last check!
@@ -57,6 +61,17 @@ $ git add .
 $ npm publish                 # Publish main project
-$ cd dev && npm publish       # Publish dev project
+
+# Publish dev project in same repo
+$ cd dev && npm publish
+
+# (OR) Publish dev project in different, parallel repo
+$ cd ../ARCHETYPE-dev
+$ git commit -m "Version bump"
+$ git tag -a "vNUMBER" -m "Version NUMBER"
+$ git push && git push --tags
+$ npm publish                 # Publish dev project
 ```
 
-If you are _bootstrapping_ a new archetype, a new file at `dev/package.json` will be generated for you automatically.
+If you are _bootstrapping_ a new archetype you will need to ensure either that
+a `ARCHETYPE/dev` or `../ARCHETYPE-dev` directory exists. The rest of the files
+when then be properly generated into the dev project.
 
@@ -63,0 +78,0 @@ And you should be good to run `builder-support gen-dev` in the project root.

test/server/spec/lib/dev.spec.js

@@ -41,3 +41,4 @@ "use strict";
         ".gitignore": "",
-        "README.md": ""
+        "README.md": "",
+        "dev": {}
       });
@@ -55,2 +56,23 @@
 
+    it("fails on missing ./dev + ../ARCHETYPE-dev", function (done) {
+      mock({
+        "package.json": JSON.stringify({
+          name: "foo",
+          description: "foo desc",
+          dependencies: {}
+        }),
+        ".gitignore": "",
+        "README.md": ""
+      });
+
+      genDev(function (err) {
+        expect(err)
+          .to.be.ok.and
+          .to.have.property("message").and
+            .to.contain("Could not find dev directories");
+
+        done();
+      });
+    });
+
     it("fails on malformed package.json", function (done) {
@@ -84,3 +106,4 @@ mock({
         ".gitignore": "IGNORE",
-        "README.md": "READ"
+        "README.md": "READ",
+        "dev": {}
       });
@@ -151,2 +174,79 @@
 
+  describe("../ARCHETYPE-dev/package.json", function () {
+
+    it("creates missing ../ARCHETYPE-dev/package.json", function (done) {
+      mock({
+        "package.json": JSON.stringify({
+          name: "foo",
+          description: "foo desc",
+          dependencies: {}
+        }),
+        ".gitignore": "IGNORE",
+        "README.md": "READ",
+        "../foo-dev": {}
+      });
+
+      genDev(function (err) {
+        if (err) { return done(err); }
+
+        // NOTE: Sync methods are OK here because mocked and in-memory.
+        var devPkg = fs.readJsonSync("../foo-dev/package.json");
+        expect(devPkg).to.have.property("name", "foo-dev");
+        expect(devPkg).to.have.property("description", "foo desc (Development)");
+        expect(devPkg).to.have.property("dependencies").to.eql({});
+        expect(devPkg).to.have.property("devDependencies").to.eql({});
+
+        expect(fs.readFileSync(".gitignore").toString()).to.equal("IGNORE");
+        expect(fs.existsSync(".npmrc")).to.equal(false);
+        expect(fs.readFileSync("README.md").toString()).to.equal("READ");
+
+        done();
+      });
+    });
+
+    it("updates existing ../ARCHETYPE-dev/package.json", function (done) {
+      mock({
+        "package.json": JSON.stringify({
+          name: "foo",
+          description: "foo desc",
+          dependencies: {},
+          peerDependencies: {}
+        }),
+        ".gitignore": "IGNORE",
+        ".npmrc": "NPM",
+        "README.md": "READ",
+        "../foo-dev/package.json": JSON.stringify({
+          dependencies: {
+            "foo": "^1.0.0"
+          },
+          "peerDependencies": {
+            "bar": "^2.0.0"
+          }
+        })
+      });
+
+      genDev(function (err) {
+        if (err) { return done(err); }
+
+        // NOTE: Sync methods are OK here because mocked and in-memory.
+        var devPkg = fs.readJsonSync("../foo-dev/package.json");
+        expect(devPkg).to.have.property("name", "foo-dev");
+        expect(devPkg).to.have.property("description", "foo desc (Development)");
+        expect(devPkg).to.have.property("dependencies").to.eql({
+          "foo": "^1.0.0"
+        });
+        expect(devPkg).to.have.property("peerDependencies").to.eql({
+          "bar": "^2.0.0"
+        });
+        expect(devPkg).to.have.property("devDependencies").to.eql({});
+
+        expect(fs.readFileSync(".gitignore").toString()).to.equal("IGNORE");
+        expect(fs.readFileSync(".npmrc").toString()).to.equal("NPM");
+        expect(fs.readFileSync("README.md").toString()).to.equal("READ");
+
+        done();
+      });
+    });
+  });
+
   describe("file copying", function () {
@@ -159,3 +259,4 @@ it("allows just package.json", function (done) {
           dependencies: {}
-        })
+        }),
+        "dev": {}
       });
@@ -162,0 +263,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

20131

31.03%

Lines of code

389

38.43%

Number of lines in readme file

83

22.06%

Number of medium supply chain risk alerts

0

-100%

No dependency changes