Merge branch 'npm:latest' into latest

.eslintrc.js

@@ -11,6 +11,7 @@ const localConfigs = readdir(__dirname)
 module.exports = {
   root: true,
   ignorePatterns: [
+    'tap-testdir*/',
     'docs/**',
     'smoke-tests/**',
     'mock-globals/**',

.gitattributes

@@ -1,2 +1,27 @@
-/node_modules/**    linguist-generated=false
-/package-lock.json  linguist-generated=false
+# normalize all line endings by default
+* text=auto
+
+# our shell/bin scripts always need to be LF
+/bin/* text eol=lf
+/workspaces/arborist/bin/index.js text eol=lf
+/configure text eol=lf
+
+# our cmd scripts always need to be CRLF
+/bin/**/*.cmd text eol=crlf
+
+# ignore all line endings in node_modules since we dont control that
+/node_modules/** -text
+
+# the files we write should be LF so they can be generated cross platform
+/node_modules/.gitignore text eol=lf
+/workspaces/arborist/test/fixtures/.gitignore text eol=lf
+/DEPENDENCIES.md text eol=lf
+/AUTHORS text eol=lf
+
+# fixture tarballs should be treated as binary
+/workspaces/*/test/fixtures/**/*.tgz binary
+
+# these hint to GitHub to show these files as not generated so they default to
+# showing the full diff in pull requests
+/node_modules/** linguist-generated=false
+/package-lock.json linguist-generated=false

.github/ISSUE_TEMPLATE/bug_8.yml → .github/ISSUE_TEMPLATE/bug_10.yml

@@ -1,7 +1,7 @@
-name: 🐞 Bug v8
-description: File a bug/issue against v8.x
+name: 🐞 Bug v10
+description: File a bug/issue against v10.x
 title: "[BUG] <title>"
-labels: [Bug, Needs Triage, Release 8.x]
+labels: [Bug, Needs Triage, Release 10.x]
 body:
 - type: checkboxes
   attributes:
@@ -45,8 +45,8 @@ body:
     label: Environment
     description: |
       examples:
-        - **`npm -v`**: **npm**: 7.6.3
-        - **`node -v`**: **Node.js**: 13.14.0
+        - **`npm -v`**: **npm**: 10.0.0
+        - **`node -v`**: **Node.js**: 18.0.0
         - **OS Name**: Ubuntu 20.04
         - **System Model Name**: Macbook Pro
         - **`npm config ls`**: `; "user" config from ...`

.github/actions/create-check/action.yml

@@ -0,0 +1,52 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: 'Create Check'
+inputs:
+  name:
+    required: true
+  token:
+    required: true
+  sha:
+    required: true
+  check-name:
+    default: ''
+outputs:
+  check-id:
+    value: ${{ steps.create-check.outputs.check_id }}
+runs:
+  using: "composite"
+  steps:
+    - name: Get Workflow Job
+      uses: actions/github-script@v6
+      id: workflow
+      env:
+        JOB_NAME: "${{ inputs.name }}"
+        SHA: "${{ inputs.sha }}"
+      with:
+        result-encoding: string
+        script: |
+          const { repo: { owner, repo}, runId, serverUrl } = context          
+          const { JOB_NAME, SHA } = process.env
+
+          const job = await github.rest.actions.listJobsForWorkflowRun({
+            owner,
+            repo,
+            run_id: runId,
+            per_page: 100
+          }).then(r => r.data.jobs.find(j => j.name.endsWith(JOB_NAME)))
+
+          return [
+            `This check is assosciated with ${serverUrl}/${owner}/${repo}/commit/${SHA}.`,
+            'Run logs:',
+            job?.html_url || `could not be found for a job ending with: "${JOB_NAME}"`,
+          ].join(' ')
+    - name: Create Check
+      uses: LouisBrunner/checks-action@v1.6.0
+      id: create-check
+      with:
+        token: ${{ inputs.token }}
+        sha: ${{ inputs.sha }}
+        status: in_progress
+        name: ${{ inputs.check-name || inputs.name }}
+        output: |
+          {"summary":"${{ steps.workflow.outputs.result }}"}

.github/actions/install-latest-npm/action.yml

@@ -0,0 +1,58 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: 'Install Latest npm'
+description: 'Install the latest version of npm compatible with the Node version'
+inputs:
+  node:
+    description: 'Current Node version'
+    required: true
+runs:
+  using: "composite"
+  steps:
+    # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
+    - name: Update Windows npm
+      if: |
+        runner.os == 'Windows' && (
+          startsWith(inputs.node, 'v10.') ||
+          startsWith(inputs.node, 'v12.') ||
+          startsWith(inputs.node, 'v14.')
+        )
+      shell: cmd
+      run: |
+        curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+        tar xf npm-7.5.4.tgz
+        cd package
+        node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
+        cd ..
+        rmdir /s /q package
+    - name: Install Latest npm
+      shell: bash
+      env:
+        NODE_VERSION: ${{ inputs.node }}
+      working-directory: ${{ runner.temp }}
+      run: |
+        MATCH=""
+        SPECS=("latest" "next-10" "next-9" "next-8" "next-7" "next-6")
+
+        echo "node@$NODE_VERSION"
+
+        for SPEC in ${SPECS[@]}; do
+          ENGINES=$(npm view npm@$SPEC --json | jq -r '.engines.node')
+          echo "Checking if node@$NODE_VERSION satisfies npm@$SPEC ($ENGINES)"
+
+          if npx semver -r "$ENGINES" "$NODE_VERSION" > /dev/null; then
+            MATCH=$SPEC
+            echo "Found compatible version: npm@$MATCH"
+            break
+          fi  
+        done
+
+        if [ -z $MATCH ]; then
+          echo "Could not find a compatible version of npm for node@$NODE_VERSION"
+          exit 1
+        fi
+
+        npm i --prefer-online --no-fund --no-audit -g npm@$MATCH
+    - name: npm Version
+      shell: bash
+      run: npm -v

.github/workflows/audit.yml

@@ -25,11 +25,15 @@ jobs:
           git config --global user.name "npm CLI robot"
       - name: Setup Node
         uses: actions/setup-node@v3
+        id: node
         with:
-          node-version: 18.x
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
           cache: npm
+      - name: Check Git Status
+        run: node scripts/git-dirty.js
       - name: Reset Deps
-        run: node . run resetdeps -- --package-lock
+        run: node scripts/resetdeps.js --package-lock
       - name: Run Production Audit
         run: node . audit --omit=dev
       - name: Run Full Audit

.github/workflows/benchmark.yml

@@ -6,6 +6,7 @@ on:
       - '*'
     paths:
       - lib/**
+      - workspaces/**/lib/**
   issue_comment:
     types:
       - created
@@ -17,63 +18,70 @@ jobs:
     steps:
       - name: Incoming Pull Request
         if: |
-          github.event_name == 'pull_request' || (
+          (
+            github.event_name == 'pull_request' &&
+            github.event.pull_request.head.repo.full_name == 'npm/cli' 
+          ) || (
             github.event_name == 'issue_comment' &&
             github.event.issue.pull_request &&
             github.event.issue.state == 'open' &&
             startsWith(github.event.comment.body, '@npm-cli-bot benchmark this')
           )
-        env:
-          # gh cli uses these env vars for owner/repo/token
-          GH_REPO: "npm/benchmarks"
-          GITHUB_TOKEN: ${{ secrets.BENCHMARK_DISPATCH_TOKEN }}
-        run: |
-          EVENT_NAME="${{ github.event_name }}"
-          OWNER="${{ github.event.repository.owner.login }}"
-          REPO="${{ github.event.repository.name }}"
-          PR=""
-
-          if [[ "$EVENT_NAME" == "pull_request" ]]; then
-            if [[ "$GITHUB_TOKEN" == "" ]]; then
-              echo "No auth - from fork pull request, exiting"
-              exit 0
-            fi
-            PR="${{ github.event.pull_request.number }}"
-          else
-            PR="${{ github.event.issue.number }}"
-            SENDER="${{ github.event.comment.user.login }}"
-            ROLE=$(gh api repos/${OWNER}/${REPO}/collaborators/${SENDER}/permission -q '.permission')
-
-            if [[ "$ROLE" != "admin" ]]; then
-              echo "${SENDER} is ${ROLE}, not an admin, exiting"
-              exit 0
-            fi
-
-            # add emoji to comment if user is an admin to signal
-            # benchmark is running
-            COMMENT_NODE_ID="${{ github.event.comment.node_id }}"
-            QUERY='mutation ($inputData:AddReactionInput!) {
-              addReaction (input:$inputData) {
-                reaction { content }
-              }
-            }'
-            echo '{
-              "query": "'${QUERY}'",
-              "variables": {
-                "inputData": {
-                  "subjectId": "'"${COMMENT_NODE_ID}"'",
-                  "content": "ROCKET"
-                }
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.BENCHMARK_DISPATCH_TOKEN }}
+          script: |
+            const {
+              payload,
+              eventName,
+              repo: { owner, repo },
+              issue: { number },
+            } = context
+          
+            if (eventName === 'issue_comment') {
+              const res = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner,
+                repo,
+                username: payload.comment.user.login,
+              })
+              if (res.data.permission !== 'admin') {
+                core.info(`Commenter is not an admin, exiting`)
+                return
               }
-            }' | gh api graphql --input -
-          fi
-
-          EVENT="${EVENT_NAME} ${OWNER}/${REPO}#${PR}"
-          echo '{
-            "event_type": "'"$EVENT"'",
-            "client_payload": {
-              "pr_id": "'"$PR"'",
-              "repo": "'"$REPO"'",
-              "owner": "'"$OWNER"'"
+          
+              // add emoji to comment if user is an admin to signal benchmark is running
+              await github.rest.reactions.createForIssueComment({
+                owner,
+                repo,
+                comment_id: payload.comment.node_id,
+                content: 'rocket',
+              })
             }
-          }' | gh api repos/{owner}/{repo}/dispatches --input -
+          
+            const pullRequest = payload.pull_request || await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: number,
+            }).then(r => r.data)
+
+            core.info(`Pull request: ${pullRequest.number}`)
+            core.info(`Base ref: ${pullRequest.base.ref}`)
+          
+            const matchesRelease = pullRequest.base.ref.match(/^release\/v(\d+)$/)
+            const targetSpec = matchesRelease ? matchesRelease[1] : 'latest'
+            core.info(`Target spec: ${targetSpec}`)
+
+            const eventType = `"${eventName} ${owner}/${repo}#${pullRequest.number}"`
+            core.info(`Event type: ${eventType}`)
+          
+            await github.rest.repos.createDispatchEvent({
+              owner: 'npm',
+              repo: 'benchmarks',
+              event_type: eventType,
+              client_payload: {
+                owner,
+                repo,
+                pr_id: number,
+                target_spec: targetSpec,
+              },
+            })