Merge branch 'main' into ballot-summary-web

Author: aduh95

.github/workflows/ci.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8  # v4.0.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: lts/*
 
@@ -29,7 +29,7 @@ jobs:
         run: echo "dir=$(corepack yarn config get cacheFolder)" >> $GITHUB_OUTPUT
         shell: bash
 
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9  # v4.0.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         with:
           path: ${{steps.yarn-cache-dir-path.outputs.dir}}
           key: ${{runner.os}}-yarn-${{hashFiles('**/yarn.lock')}}

.github/workflows/publish.yml

@@ -5,20 +5,22 @@ on:
     branches: [main]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 env:
   YARN_ENABLE_GLOBAL_CACHE: false
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       release_tag: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f  # v4.1.3
+      - uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445  # v4.2.0
         id: release
         with:
           config-file: release-please-config.json
@@ -27,10 +29,13 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8  # v4.0.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: lts/*
 
@@ -39,7 +44,7 @@ jobs:
         run: echo "dir=$(corepack yarn config get cacheFolder)" >> $GITHUB_OUTPUT
         shell: bash
 
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9  # v4.0.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         with:
           path: ${{steps.yarn-cache-dir-path.outputs.dir}}
           key: ${{runner.os}}-yarn-${{hashFiles('**/yarn.lock')}}
@@ -55,6 +60,6 @@ jobs:
         run: |
           corepack yarn install --immutable
           corepack yarn build
-          corepack yarn workspaces foreach --all --no-private npm publish --access public
+          corepack yarn workspaces foreach --all --no-private npm publish --provenance --access public
         env:
           YARN_NPM_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

eslint.config.js

@@ -1,9 +1,16 @@
 import js from "@eslint/js";
 import tsPlugin from "typescript-eslint";
+import stylistic from "@stylistic/eslint-plugin";
 
 export default [
   js.configs.recommended,
   ...tsPlugin.configs.recommended,
+  stylistic.configs.customize({
+    braceStyle: "1tbs",
+    quotes: "double",
+    quoteProps: "as-needed",
+    semi: true,
+  }),
   {
     files: ["**/*.ts"],
     languageOptions: {
@@ -15,6 +22,7 @@ export default [
     },
     plugins: {
       "@typescript-eslint": tsPlugin.plugin,
+      "@stylistic": stylistic,
     },
   },
   { ignores: ["node_modules/", "**/dist/"] },

package.json

@@ -1,27 +1,38 @@
 {
   "name": "caritat",
   "private": true,
-  "packageManager": "yarn@4.3.1+sha224.934d21773e22af4b69a7032a2d3b4cb38c1f7c019624777cc9916b23",
+  "packageManager": "yarn@4.9.2+sha224.b8e0b161ae590950fbda696e6f3ca071362768e5280c5fbfdadf064b",
   "version": "1.6.0",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/nodejs/caritat.git"
   },
   "devDependencies": {
-    "@types/eslint": "^8",
+    "@stylistic/eslint-plugin": "^4.4.1",
+    "@types/eslint": "^9",
     "@types/js-yaml": "^4.0.5",
     "@types/node": "^20.0.0",
     "eslint": "^9.2.0",
-    "typescript": "^5.1.3",
-    "typescript-eslint": "^7.8.0"
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.34.0"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "yarn",
+      "version": "4.9.2"
+    },
+    "runtime": {
+      "name": "nodejs",
+      "version": ">=22.6.0"
+    }
   },
   "imports": {
     "#ts-loader": "./packages/ts-loader/loader.js"
   },
   "scripts": {
     "test:lint": "eslint .",
-    "test:types": "tsc --noEmit",
+    "test:types": "tsc --build --emitDeclarationOnly",
     "test:unit": "node --experimental-global-webcrypto --loader '#ts-loader' test/index.ts",
     "test": "yarn test:lint && yarn test:types && yarn test:unit",
     "build": "tsc --build",

packages/cli/src/bin/countBallotsFromGit.ts

@@ -22,10 +22,10 @@ const parsedArgs = await parseArgs().options({
 
 const { repo: repoURL, branch, path: subPath } = parsedArgs;
 
-const privateKey =
-  parsedArgs.key === "-"
+const privateKey
+  = parsedArgs.key === "-"
     ? await readStdIn(false)
-    : parsedArgs.key && (await fs.readFile(parsedArgs.key as string));
+    : parsedArgs.key && (await fs.readFile(parsedArgs.key));
 
 const { result, privateKeyAsArmoredString } = await countFromGit({
   ...(await getEnv(parsedArgs)),

packages/cli/src/bin/countBallotsFromGitHub.ts

@@ -19,9 +19,9 @@ const parsedArgs = await parseArgs()
 
     protocol: {
       describe:
-        "the protocol to use to pull the remote repository, either SSH or " +
-        "HTTP (defaults to SSH if a public SSH key is found for the current " +
-        "user, otherwise default to HTTP)",
+        "the protocol to use to pull the remote repository, either SSH or "
+        + "HTTP (defaults to SSH if a public SSH key is found for the current "
+        + "user, otherwise default to HTTP)",
       string: true,
     },
     login: {
@@ -50,8 +50,8 @@ const parsedArgs = await parseArgs()
     ["key-part"]: {
       ...cliArgs["key-part"],
       describe:
-        cliArgs["key-part"].describe +
-        " If not provided, it will be extracted from the PR comments.",
+        cliArgs["key-part"].describe
+        + " If not provided, it will be extracted from the PR comments.",
     },
   })
   .command(
@@ -63,16 +63,16 @@ const parsedArgs = await parseArgs()
         type: "string",
         describe: "URL to the GitHub pull request",
       });
-    }
+    },
   ).argv;
 
-const privateKey =
-  parsedArgs.key === "-"
+const privateKey
+  = parsedArgs.key === "-"
     ? await readStdIn(false)
     : parsedArgs.key && (await fs.readFile(parsedArgs.key));
 
 const prUrlInfo = /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)$/.exec(
-  parsedArgs["pr-url"] as string
+  parsedArgs["pr-url"] as string,
 );
 
 if (prUrlInfo == null) {
@@ -81,7 +81,7 @@ if (prUrlInfo == null) {
 
 const [, owner, repo, prNumber] = prUrlInfo;
 console.warn(
-  `Looking into GitHub pull request ${owner}/${repo}#${prNumber}...`
+  `Looking into GitHub pull request ${owner}/${repo}#${prNumber}...`,
 );
 
 const query = `query PR($prid: Int!, $owner: String!, $repo: String!) {
@@ -126,8 +126,8 @@ const { data } = JSON.parse(
       "-f",
       `query=${query}`,
     ],
-    { captureStdout: true }
-  )
+    { captureStdout: true },
+  ),
 );
 
 const { pullRequest } = data.repository;
@@ -154,31 +154,31 @@ const files = await runChildProcessAsync(
     "--jq",
     ".files.[] | .filename",
   ],
-  { captureStdout: true }
+  { captureStdout: true },
 );
 
 const voteFileCanonicalName = "vote.yml";
 const subPath = files
   .split("\n")
   .find(
-    (path) =>
-      path === voteFileCanonicalName ||
-      path.endsWith(`/${voteFileCanonicalName}`)
+    path =>
+      path === voteFileCanonicalName
+      || path.endsWith(`/${voteFileCanonicalName}`),
   )
   ?.slice(0, -voteFileCanonicalName.length);
 
 const handle = parsedArgs.login || data.viewer.login;
 
-const protocol =
-  parsedArgs.protocol ?? (data.viewer.publicKeys.totalCount ? "ssh" : "http");
+const protocol
+  = parsedArgs.protocol ?? (data.viewer.publicKeys.totalCount ? "ssh" : "http");
 
 function getHTTPRepoURL(repoURL: string, login: string) {
   const url = new URL(repoURL + ".git");
   url.username = login;
   return url.toString();
 }
-const repoURL =
-  protocol === "ssh"
+const repoURL
+  = protocol === "ssh"
     ? data.repository.sshUrl
     : getHTTPRepoURL(data.repository.url, handle);
 
@@ -191,14 +191,14 @@ console.warn("All relevant information has been retrieved:", {
 });
 
 async function getKeyPartsFromComments() {
-  const shamirKeyPartComment =
-    /\n-----BEGIN SHAMIR KEY PART-----\n([a-zA-Z0-9+/\s]+={0,2})\n-----END SHAMIR KEY PART-----\n/;
+  const shamirKeyPartComment
+    = /\n-----BEGIN SHAMIR KEY PART-----\n([a-zA-Z0-9+/\s]+={0,2})\n-----END SHAMIR KEY PART-----\n/;
   const { comments } = JSON.parse(
     await runChildProcessAsync(
       parsedArgs["gh-binary"] as string,
       ["pr", "view", parsedArgs["pr-url"], "--json", "comments"],
-      { captureStdout: true }
-    )
+      { captureStdout: true },
+    ),
   );
 
   const results = [];
@@ -237,12 +237,12 @@ if (parsedArgs["post-comment"]) {
   ]);
 } else {
   console.log(
-    "To publish the results, you should use `--post-comment --commit-json-summary` CLI flags."
+    "To publish the results, you should use `--post-comment --commit-json-summary` CLI flags.",
   );
   console.log(
     "Participation:",
     Math.round(summary.participation * 100_00) / 1_00,
-    "%"
+    "%",
   );
   console.log("Raw results:", summary.result);
 }

packages/cli/src/bin/decryptBallot.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import fs from "fs";
- 
+
 import parseArgs from "../utils/parseArgs.js";
 import decryptData from "@node-core/caritat-crypto/decrypt";
 
@@ -25,7 +25,7 @@ const parsedArgs = await parseArgs().options({
 const { data: filePath, key: privateKeyPath } = parsedArgs;
 
 const { encryptedSecret, data } = JSON.parse(
-  fs.readFileSync(filePath, "utf8").replace(/^\uFEFF/, "")
+  fs.readFileSync(filePath, "utf8").replace(/^\uFEFF/, ""),
 );
 
 console.log(
@@ -34,8 +34,8 @@ console.log(
       await decryptData(
         Buffer.from(data, "base64"),
         Buffer.from(encryptedSecret, "base64"),
-        fs.readFileSync(privateKeyPath)
-      )
-    )
-  ).toString("utf8")
+        fs.readFileSync(privateKeyPath),
+      ),
+    ),
+  ).toString("utf8"),
 );