Merge pull request #33 from script-development/armorer/m1-moderate-remediation

fs-packages M1 moderate remediation (Armorer)

Author: jasperboerhof

.github/workflows/publish.yml

@@ -43,6 +43,36 @@ jobs:
           name: build-output
           path: packages
       - run: npm ci --ignore-scripts
+      - name: Validate dist artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          REQUIRED=("dist/index.mjs" "dist/index.cjs" "dist/index.d.mts" "dist/index.d.cts")
+          FAILED=0
+          for pkg_dir in packages/*/; do
+            pkg_name=$(node -p "require('./${pkg_dir}package.json').name")
+            pack_json=$(cd "$pkg_dir" && npm pack --dry-run --json 2>/dev/null)
+            for required in "${REQUIRED[@]}"; do
+              size=$(node -e "
+          const files = JSON.parse(process.argv[1])[0].files;
+          const f = files.find(e => e.path === process.argv[2]);
+          if (!f) { console.log('MISSING'); process.exit(0); }
+          console.log(f.size);
+          " "$pack_json" "$required")
+              if [ "$size" = "MISSING" ]; then
+                echo "::error::${pkg_name} is missing ${required} in published tarball"
+                FAILED=1
+              elif [ "$size" = "0" ]; then
+                echo "::error::${pkg_name} ${required} is 0 bytes"
+                FAILED=1
+              fi
+            done
+          done
+          if [ "$FAILED" = "1" ]; then
+            echo "Pre-publish dist validation failed. Refusing to publish empty or incomplete tarballs."
+            exit 1
+          fi
+          echo "All packages validated: required dist/ artifacts present and non-empty."
       - run: npx changeset publish
         env:
           NPM_CONFIG_PROVENANCE: "true"

packages/adapter-store/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/adapter-store"
   },
   "files": [

packages/dialog/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/dialog"
   },
   "files": [

packages/helpers/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/helpers"
   },
   "files": [

packages/http/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/http"
   },
   "files": [

packages/loading/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/loading"
   },
   "files": [

packages/router/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/router"
   },
   "files": [
@@ -43,11 +43,11 @@
   "devDependencies": {
     "@vue/test-utils": "^2.4.6",
     "happy-dom": "^20.9.0",
-    "vue": "^3.5.0",
+    "vue": "^3.5.32",
     "vue-router": "^5.0.4"
   },
   "peerDependencies": {
-    "vue": "^3.5.0",
+    "vue": "^3.5.32",
     "vue-router": "^5.0.4"
   }
 }

packages/storage/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/storage"
   },
   "files": [

packages/theme/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/theme"
   },
   "files": [

packages/toast/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/script-development/fs-packages.git",
+    "url": "git+https://github.com/script-development/fs-packages.git",
     "directory": "packages/toast"
   },
   "files": [