compose-regexp - npm Package Compare versions

Comparing version 0.6.9 to 0.6.10

change-log.md

@@ -5,2 +5,8 @@ # Change Log
 
+## v0.6.10
+
+*2022-05-04*
+
+Another dummy release to test the npm postpublish script
+
 ## v0.6.9
@@ -7,0 +13,0 @@

package.json

 {
 	"name": "compose-regexp",
-	"version": "0.6.9",
+	"version": "0.6.10",
 	"description": "A set of functions to build and compose complex regular expressions",
@@ -16,3 +16,3 @@ "type": "module",
 	"scripts": {
-		"build": "gosub build-regexp && ospec && gosub rollup && gosub compress && gosub build-toc && ls -l dist/*.br",
+		"build": "gosub build-regexp && gosub rollup && gosub compress && gosub build-toc && ls -l dist/*.br",
 		"build-regexp": "node scripts/build-regexp.js",
@@ -23,5 +23,5 @@ "build-toc": "node scripts/build-toc.js",
 		"compress-uglify": "uglifyjs commonjs/compose-regexp.js -cm --preamble '/**@license MIT-compose-regexp.js-©Pierre-Yves Gérardy*/' > dist/compose-regexp.min.js",
-		"prepublishOnly": "git status --porcelain | node scripts/prepublish.js",
-		"release":"gosub build && gosub release-actually",
-		"release-actually": "NPM_PUBLISH=1 npm publish",
+		"prepublishOnly": "node --no-warnings scripts/prepublish.js",
+		"postpublish": "node ./scripts/postpublish.js && npm install && gosub test",
+		"release":"NPM_PUBLISH=1 npm publish",
 		"rollup": "rollup compose-regexp.js -o commonjs/compose-regexp.js -f umd -n composeRegexp --amd.id compose-regexp",
@@ -48,4 +48,4 @@ "test": "gosub build-regexp && ospec"
 	"devDependencies": {
-		"compose-regexp": "0.6.8",
-		"gosub": "1.0.0",
+		"compose-regexp": "0.6.9",
+		"gosub": "1.1.0",
 		"ospec": "^4.1.1",
@@ -52,0 +52,0 @@ "rollup": "^2.70.1",

scripts/prepublish.js

@@ -1,14 +0,45 @@
-import fs from 'fs'
+import { command, readFromCmd } from './utils.js'
+import pkg from '../package.json' assert { type: 'json' }
 
+const git = command('git')
+const readGit = readFromCmd('git')
+const readNpm = readFromCmd('npm')
+
+const {version} = pkg
+
 const messages = []
 
-const cleanGit = fs.readSync(process.stdin.fd, new Buffer.alloc(1)) === 0
 
-if (!cleanGit) messages.push("/!\\ The git working tree is not clean")
 if (!process.env.NPM_PUBLISH) messages.push("/!\\ Please use `npm run release`")
 
+
+try { await readNpm('run', 'test')} catch({stderr, stdout}) {
+    messages.push("/!\\ There was a problem with the test suite", stdout, stderr)
+}
+
+
+// `git status --porecelain` is empty when the tree is clean
+const {stdout: gitOutput} = await readGit('status', '--porcelain')
+if (gitOutput.trim() !== '') messages.push("/!\\ The git working tree is not clean")    
+
+
+const {stdout: branch} = await readGit('branch', '--show-current')
+if (branch !== "main\n") messages.push(`/!\\ We are on branch ${branch.trim()}, we release from main`)    
+
+
+const {stdout: remoteVersion} = await readNpm("view", "compose-regexp", "version")
+if(remoteVersion.trim() === version) messages.push("/!\\ You didn't bump the version number")
+
+try {await readNpm('run', 'build')} catch({stderr}) {
+    messages.push("/!\\ There was a problem building the lib", stderr)
+}
+
 if (messages.length !== 0) {
+    console.error('\n' + messages.join('\n\n') + '\n')
+    process.exit(1)
+}
 
-    console.error(messages.join('\n\n')+'\n')
-    process.exit(1)
-}
+const {stdout: changes} = await readGit('status', '--porcelain')
+if (changes !== '') {
+    await git('commit', '-am', `"build artefacts"`)
+}

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

152455

increased by2.21%

Number of package files

19

increased by11.76%

Lines of code

2735

increased by3.36%

Worsened metrics

Number of low supply chain risk alerts

6

increased by50%

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes