diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 846e70a..ec1fdf6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -41,6 +41,7 @@ jobs: with: name: .repo.patch path: .repo.patch + overwrite: true - name: Fail build on mutation if: steps.self_mutation.outputs.self_mutation_happened run: |- @@ -55,6 +56,7 @@ jobs: with: name: build-artifact path: dist + overwrite: true self-mutation: needs: build runs-on: ubuntu-22.04 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ce6a291..b5de234 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,6 +13,7 @@ jobs: contents: write outputs: latest_commit: ${{ steps.git_remote.outputs.latest_commit }} + tag_exists: ${{ steps.check_tag_exists.outputs.exists }} env: CI: "true" steps: @@ -37,9 +38,17 @@ jobs: run: pnpm i --frozen-lockfile - name: release run: npx projen release + - name: Check if version has already been tagged + id: check_tag_exists + run: |- + TAG=$(cat dist/dist/releasetag.txt) + ([ ! -z "$TAG" ] && git ls-remote -q --exit-code --tags origin $TAG && (echo "exists=true" >> $GITHUB_OUTPUT)) || (echo "exists=false" >> $GITHUB_OUTPUT) + cat $GITHUB_OUTPUT - name: Check for new commits id: git_remote - run: echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT + run: |- + echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT + cat $GITHUB_OUTPUT - name: Backup artifact permissions if: ${{ steps.git_remote.outputs.latest_commit == github.sha }} run: cd dist && getfacl -R . > permissions-backup.acl @@ -50,13 +59,14 @@ jobs: with: name: build-artifact path: dist + overwrite: true release_github: name: Publish to GitHub Releases needs: release runs-on: ubuntu-22.04 permissions: contents: write - if: needs.release.outputs.latest_commit == github.sha + if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha steps: - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 with: @@ -85,9 +95,9 @@ jobs: needs: release runs-on: ubuntu-22.04 permissions: - contents: read id-token: write - if: needs.release.outputs.latest_commit == github.sha + contents: read + if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha steps: - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 with: @@ -116,6 +126,6 @@ jobs: env: NPM_DIST_TAG: latest NPM_REGISTRY: registry.npmjs.org - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} NPM_CONFIG_PROVENANCE: "true" + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} run: npx -p publib@latest publib-npm diff --git a/.projen/deps.json b/.projen/deps.json index 7ecdb90..4dd3eff 100644 --- a/.projen/deps.json +++ b/.projen/deps.json @@ -133,7 +133,7 @@ }, { "name": "projen", - "version": "^0.78.13", + "version": "^0.79.24", "type": "peer" } ], diff --git a/.projen/tasks.json b/.projen/tasks.json index ef0e1e7..a10ce98 100644 --- a/.projen/tasks.json +++ b/.projen/tasks.json @@ -211,7 +211,8 @@ "description": "Publish this package to npm", "env": { "NPM_DIST_TAG": "latest", - "NPM_REGISTRY": "registry.npmjs.org" + "NPM_REGISTRY": "registry.npmjs.org", + "NPM_CONFIG_PROVENANCE": "true" }, "requiredEnv": [ "NPM_TOKEN" diff --git a/.projenrc.ts b/.projenrc.ts index acb40ed..3a9bdde 100644 --- a/.projenrc.ts +++ b/.projenrc.ts @@ -86,7 +86,7 @@ const jestDevDeps = ['@swc/jest', '@swc/core', 'jest-junit', 'cdktf']; const bundledDeps = ([] as string[]).concat(projenDeps); const devDeps = ([] as string[]).concat(projenDevDeps, jestDevDeps); -const peerDeps = ([] as string[]).concat('projen@^0.78.13', 'constructs@^10.3.0'); +const peerDeps = ([] as string[]).concat('projen@^0.79.24', 'constructs@^10.3.0'); const renovatebotOptions: RenovatebotOptions = { overrideConfig: { diff --git a/API.md b/API.md index 521a3f9..8f75fed 100644 --- a/API.md +++ b/API.md @@ -2320,6 +2320,7 @@ const cdktfTypeScriptAppOptions: CdktfTypeScriptAppOptions = { ... } | maxNodeVersion | string | Minimum node.js version to require via `engines` (inclusive). | | minNodeVersion | string | Minimum Node.js version to require via package.json `engines` (inclusive). | | npmAccess | projen.javascript.NpmAccess | Access level of the npm package. | +| npmProvenance | boolean | Should provenance statements be generated when the package is published. | | npmRegistry | string | The host name of the npm registry to publish to. | | npmRegistryUrl | string | The base URL of the npm package registry. | | npmTokenSecret | string | GitHub secret which contains the NPM token to use when publishing packages. | @@ -3173,6 +3174,27 @@ Access level of the npm package. --- +##### `npmProvenance`Optional + +```typescript +public readonly npmProvenance: boolean; +``` + +- *Type:* boolean +- *Default:* true for public packages, false otherwise + +Should provenance statements be generated when the package is published. + +A supported package manager is required to publish a package with npm provenance statements and +you will need to use a supported CI/CD provider. + +Note that the projen `Release` and `Publisher` components are using `publib` to publish packages, +which is using npm internally and supports provenance statements independently of the package manager used. + +> [https://docs.npmjs.com/generating-provenance-statements](https://docs.npmjs.com/generating-provenance-statements) + +--- + ##### ~~`npmRegistry`~~Optional - *Deprecated:* use `npmRegistryUrl` instead diff --git a/package.json b/package.json index 8ff2921..783a089 100644 --- a/package.json +++ b/package.json @@ -58,7 +58,7 @@ "jsii-pacmak": "^1.93.0", "jsii-rosetta": "~5.3.0", "prettier": "^3.0.2", - "projen": "0.78.13", + "projen": "0.79.24", "standard-version": "^9", "ts-jest": "^29.1.1", "ts-node": "github:TypeStrong/ts-node#semver:v11.0.0-beta.1", @@ -66,7 +66,7 @@ }, "peerDependencies": { "constructs": "^10.3.0", - "projen": "^0.78.13" + "projen": "^0.79.24" }, "dependencies": { "uuid": "^9.0.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ae3f400..c05b611 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1,5 +1,9 @@ lockfileVersion: '6.0' +settings: + autoInstallPeers: true + excludeLinksFromLockfile: false + dependencies: uuid: specifier: ^9.0.0 @@ -76,8 +80,8 @@ devDependencies: specifier: ^3.0.2 version: 3.1.1 projen: - specifier: 0.78.13 - version: 0.78.13(constructs@10.3.0) + specifier: 0.79.24 + version: 0.79.24(constructs@10.3.0) standard-version: specifier: ^9 version: 9.5.0 @@ -504,10 +508,6 @@ packages: engines: {node: '>=6.9.0'} dev: true - /@iarna/toml@2.2.5: - resolution: {integrity: sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==} - dev: true - /@istanbuljs/load-nyc-config@1.1.0: resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==} engines: {node: '>=8'} @@ -844,35 +844,6 @@ packages: fastq: 1.15.0 dev: true - /@oozcitak/dom@1.15.10: - resolution: {integrity: sha512-0JT29/LaxVgRcGKvHmSrUTEvZ8BXvZhGl2LASRUgHqDTC1M5g1pLmVv56IYNyt3bG2CUjDkc67wnyZC14pbQrQ==} - engines: {node: '>=8.0'} - dependencies: - '@oozcitak/infra': 1.0.8 - '@oozcitak/url': 1.0.4 - '@oozcitak/util': 8.3.8 - dev: true - - /@oozcitak/infra@1.0.8: - resolution: {integrity: sha512-JRAUc9VR6IGHOL7OGF+yrvs0LO8SlqGnPAMqyzOuFZPSZSXI7Xf2O9+awQPSMXgIWGtgUf/dA6Hs6X6ySEaWTg==} - engines: {node: '>=6.0'} - dependencies: - '@oozcitak/util': 8.3.8 - dev: true - - /@oozcitak/url@1.0.4: - resolution: {integrity: sha512-kDcD8y+y3FCSOvnBI6HJgl00viO/nGbQoCINmQ0h98OhnGITrWR3bOGfwYCthgcrV8AnTJz8MzslTQbC3SOAmw==} - engines: {node: '>=8.0'} - dependencies: - '@oozcitak/infra': 1.0.8 - '@oozcitak/util': 8.3.8 - dev: true - - /@oozcitak/util@8.3.8: - resolution: {integrity: sha512-T8TbSnGsxo6TDBJx/Sgv/BlVJL3tshxZP7Aq5R1mSnM5OcHY2dQaxLMu2+E8u3gN0MLOzdjurqN4ZRVuzQycOQ==} - engines: {node: '>=8.0'} - dev: true - /@pkgr/utils@2.4.2: resolution: {integrity: sha512-POgTXhjrTfbTV63DiFXav4lBHiICLKKwDeaKn9Nphwj7WH6m0hMMCaJkMyRWjgtPFyRKRVoMXXjczsTQRDEhYw==} engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0} @@ -1470,10 +1441,6 @@ packages: is-string: 1.0.7 dev: true - /array-timsort@1.0.3: - resolution: {integrity: sha512-/+3GRL7dDAGEfM6TseQk/U+mi18TU2Ms9I3UlLdUMhz2hbvGNTKdj9xniwXfUqgYhHxRx0+8UnKkvlNwVU+cWQ==} - dev: true - /array-union@2.1.0: resolution: {integrity: sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==} engines: {node: '>=8'} @@ -1851,17 +1818,6 @@ packages: resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==} dev: true - /comment-json@4.2.2: - resolution: {integrity: sha512-H8T+kl3nZesZu41zO2oNXIJWojNeK3mHxCLrsBNu6feksBXsgb+PtYz5daP5P86A0F3sz3840KVYehr04enISQ==} - engines: {node: '>= 6'} - dependencies: - array-timsort: 1.0.3 - core-util-is: 1.0.3 - esprima: 4.0.1 - has-own-prop: 2.0.0 - repeat-string: 1.6.1 - dev: true - /commonmark@0.30.0: resolution: {integrity: sha512-j1yoUo4gxPND1JWV9xj5ELih0yMv1iCWDG6eEQIPLSWLxzCXiFoyS7kvB+WwU+tZMf4snwJMMtaubV0laFpiBA==} hasBin: true @@ -2313,7 +2269,7 @@ packages: dependencies: semver: 7.5.4 shelljs: 0.8.5 - typescript: 5.4.0-dev.20240110 + typescript: 5.4.0-dev.20240218 dev: true /electron-to-chromium@1.4.610: @@ -2734,10 +2690,6 @@ packages: micromatch: 4.0.5 dev: true - /fast-json-patch@3.1.1: - resolution: {integrity: sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==} - dev: true - /fast-json-stable-stringify@2.1.0: resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==} dev: true @@ -3092,11 +3044,6 @@ packages: engines: {node: '>=8'} dev: true - /has-own-prop@2.0.0: - resolution: {integrity: sha512-Pq0h+hvsVm6dDEa8x82GnLSYHOzNDt7f0ddFa3FqcQlgzEiptPqL+XrOJNavjOzSYiYWIrgeVYYgGlLmnxwilQ==} - engines: {node: '>=8'} - dev: true - /has-property-descriptors@1.0.1: resolution: {integrity: sha512-VsX8eaIewvas0xnvinAe9bw4WfIeODpGYikiWYLH+dma0Jw6KHYqWiWfhQlgOVK8D6PvjubK5Uc4P0iIhIcNVg==} dependencies: @@ -3203,11 +3150,6 @@ packages: resolution: {integrity: sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==} dev: true - /ini@2.0.0: - resolution: {integrity: sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==} - engines: {node: '>=10'} - dev: true - /internal-slot@1.0.6: resolution: {integrity: sha512-Xj6dv+PsbtwyPpEflsejS+oIZxmMlV44zAhG479uYu89MsjcYOhCFnNyKrkJrihbsiasQyY0afoCl/9BLR65bg==} engines: {node: '>= 0.4'} @@ -4762,27 +4704,14 @@ packages: resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==} dev: true - /projen@0.78.13(constructs@10.3.0): - resolution: {integrity: sha512-ihL1lcfmi7M0EA7qgdXGja2SLLc6vtsQ1Wd2RqqxOuFnchw9/kZubdrxy38J8iI36AEwb0Qucb1uLTuwFhl7Qw==} + /projen@0.79.24(constructs@10.3.0): + resolution: {integrity: sha512-feRBel2kl/dRsXTUFwYDnhZjQ7ZEdTAgxsAXIgJX4tEZllw4VzsbFX6P6/qxIUg+swPxYcJOU48bPA2IpuJWuQ==} engines: {node: '>= 16.0.0'} hasBin: true peerDependencies: constructs: ^10.0.0 dependencies: - '@iarna/toml': 2.2.5 - case: 1.6.3 - chalk: 4.1.2 - comment-json: 4.2.2 constructs: 10.3.0 - conventional-changelog-config-spec: 2.1.0 - fast-json-patch: 3.1.1 - glob: 8.1.0 - ini: 2.0.0 - semver: 7.5.4 - shx: 0.3.4 - xmlbuilder2: 3.1.1 - yaml: 2.3.4 - yargs: 17.7.2 dev: true bundledDependencies: - '@iarna/toml' @@ -4921,11 +4850,6 @@ packages: set-function-name: 2.0.1 dev: true - /repeat-string@1.6.1: - resolution: {integrity: sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==} - engines: {node: '>=0.10'} - dev: true - /require-directory@2.1.1: resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==} engines: {node: '>=0.10.0'} @@ -5091,15 +5015,6 @@ packages: rechoir: 0.6.2 dev: true - /shx@0.3.4: - resolution: {integrity: sha512-N6A9MLVqjxZYcVn8hLmtneQWIJtp8IKzMP4eMnx+nqkvXoqinUPCbUFLp2UcWTEIUONhlk0ewxr/jaVGlc+J+g==} - engines: {node: '>=6'} - hasBin: true - dependencies: - minimist: 1.2.8 - shelljs: 0.8.5 - dev: true - /side-channel@1.0.4: resolution: {integrity: sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==} dependencies: @@ -5626,8 +5541,8 @@ packages: hasBin: true dev: true - /typescript@5.4.0-dev.20240110: - resolution: {integrity: sha512-OEtXRprxdta9A5qLObqsgCrFjAWxGuTj8T4W+GBWqDhxIT//BevP5MROHX8Zi18RlvTZSu5G76xJaQT1CK1YpQ==} + /typescript@5.4.0-dev.20240218: + resolution: {integrity: sha512-8/ZdxUXugwsy/C1JBJBbYY/JJbt0ug4kkJQLmUfzwr4h39bRYXP/K9naP6u9nAPFWUPPEj7YWk+gDz8qg8HcsQ==} engines: {node: '>=14.17'} hasBin: true dev: true @@ -5787,16 +5702,6 @@ packages: resolution: {integrity: sha512-huCv9IH9Tcf95zuYCsQraZtWnJvBtLVE0QHMOs8bWyZAFZNDcYjsPq1nEx8jKA9y+Beo9v+7OBPRisQTjinQMw==} dev: true - /xmlbuilder2@3.1.1: - resolution: {integrity: sha512-WCSfbfZnQDdLQLiMdGUQpMxxckeQ4oZNMNhLVkcekTu7xhD4tuUDyAPoY8CwXvBYE6LwBHd6QW2WZXlOWr1vCw==} - engines: {node: '>=12.0'} - dependencies: - '@oozcitak/dom': 1.15.10 - '@oozcitak/infra': 1.0.8 - '@oozcitak/util': 8.3.8 - js-yaml: 3.14.1 - dev: true - /xmlbuilder@15.1.1: resolution: {integrity: sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg==} engines: {node: '>=8.0'} @@ -5823,6 +5728,7 @@ packages: /yaml@2.3.4: resolution: {integrity: sha512-8aAvwVUSHpfEqTQ4w/KMlf3HcRdt50E5ODIQJBw1fQ5RL34xabzxtUlzTXVqc4rkZsPbvrXKWnABCD7kWSmocA==} engines: {node: '>= 14'} + dev: false /yargs-parser@20.2.9: resolution: {integrity: sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==} @@ -5878,7 +5784,3 @@ packages: compress-commons: 4.1.2 readable-stream: 3.6.2 dev: true - -settings: - autoInstallPeers: true - excludeLinksFromLockfile: false diff --git a/src/patch/JsiiProjectPatch.ts b/src/patch/JsiiProjectPatch.ts index 11e89ed..ce411c3 100644 --- a/src/patch/JsiiProjectPatch.ts +++ b/src/patch/JsiiProjectPatch.ts @@ -108,7 +108,7 @@ export class JsiiProjectPatch extends JsiiProject { releaseWorkflow?.patch( // Add id-token permission for provenance https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions - JsonPatch.add('/jobs/release_npm/permissions/id-token', 'write') + JsonPatch.add('/jobs/release_npm/steps/8/env/NPM_CONFIG_PROVENANCE', 'true') ); releaseWorkflow?.addOverride('on.push.paths-ignore', [ @@ -371,10 +371,10 @@ export class JsiiProjectPatch extends JsiiProject { // path: [1, 'uses'], // element: options.actions.actionsDownloadArtifact, // }, - { - path: [8, 'env', 'NPM_CONFIG_PROVENANCE'], - element: { value: 'true' }, - }, + // { + // path: [8, 'env', 'NPM_CONFIG_PROVENANCE'], + // element: { value: 'true' }, + // }, ]) .createTransformations();