Maxim adaeda2dc6 fix(release): enforce GHA-safe output keys and tighten publish guards ...

Round-2 review fixes for the GITHUB_OUTPUT helper and the release scripts
that emit through it.

emitGithubOutputs (scripts/release/lib/github-output.ts):
- Replace the key newline/CR check with a full GitHub-Actions-safe charset
  check: /^[A-Za-z_][A-Za-z0-9_-]*$/. A key containing "=" or whitespace
  would silently corrupt the key=value line; rejecting up-front is
  strictly safer. Value validation (single-line) is unchanged — "=" in
  values is legal because GitHub splits on the first "=".
- Update the docblock accordingly.

prerelease.ts:
- Remove the dead `?? getCurrentVersion(scope)` fallback. The empty-list
  guard above makes packages[0] guaranteed, and the fallback would have
  masked a package.json missing its version field by emitting a version
  divergent from what the loop publishes. Fail loudly with an explicit
  exit instead.
- Drop the now-unused getCurrentVersion import.
- Add a comment above the dry-run emitGithubOutputs call explaining that
  emitting in dry-run is safe — the publish workflow gates publish + the
  verify guard on inputs.dry-run != true, so the dry-run emission only
  serves local/e2e contract verification.

publish-release.ts:
- Hoist getPackagesForScope + empty-list guard above the prerelease-suffix
  and registry checks. A misconfigured scope now fails with the clear
  "no packages found" error instead of a misleading "not greater than
  published" one. Loop is unchanged.

github-output.test.ts:
- Loosen the key-newline assertion from the JSON.stringify-coupled
  /bad\\nkey/ to the stable /alphanumeric/ phrase from the new message.
- Add tests: "=" in key throws, space in key throws, empty key throws,
  and "=" in value is accepted and written verbatim (note=a=b).
- Move vi.restoreAllMocks() to the top of afterEach so spies cannot leak
  into env restore + rmSync cleanup.

Call sites audited:
- emitGithubOutputs: only ever called with {version, scope} (prerelease,
  publish-release) — all valid under the new charset.
- publishVersion derivation: only used inside prerelease.ts main().
- getCurrentVersion: still imported by publish-release.ts, bump-prerelease.ts,
  prepare-release.ts; only the prerelease.ts import was removed.
- getPackagesForScope hoist in publish-release.ts: `packages` was only
  read inside the publish loop below; nothing earlier depended on it.

2026-06-10 22:58:03 +02:00

2.7 KiB

Raw Permalink Blame History

View Raw