Skip to content

Commit a0867a1

Browse files
marco-ippolitomarco-ippolito
authored
feat: update security release date (#772)
* feat: finalize security release * fix: update doc * fix: renamed and removed folder moving part * fix: validate date format
1 parent ee681c6 commit a0867a1

File tree

5 files changed

+171
-62
lines changed

5 files changed

+171
-62
lines changed

‎components/git/security.js

+22-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import CLI from '../../lib/cli.js';
22
import SecurityReleaseSteward from '../../lib/prepare_security.js';
3+
import UpdateSecurityRelease from '../../lib/update_security_release.js';
34

45
export const command = 'security [options]';
56
export const describe = 'Manage an in-progress security release or start a new one.';
@@ -8,6 +9,10 @@ const securityOptions = {
89
start: {
910
describe: 'Start security release process',
1011
type: 'boolean'
12+
},
13+
'update-date': {
14+
describe: 'Updates the target date of the security release',
15+
type: 'string'
1116
}
1217
};
1318

@@ -17,17 +22,32 @@ export function builder(yargs) {
1722
yargsInstance = yargs;
1823
return yargs.options(securityOptions).example(
1924
'git node security --start',
20-
'Prepare a security release of Node.js');
25+
'Prepare a security release of Node.js')
26+
.example(
27+
'git node security --update-date=31/12/2023',
28+
'Updates the target date of the security release'
29+
);
2130
}
2231

2332
export function handler(argv) {
2433
if (argv.start) {
2534
return startSecurityRelease(argv);
2635
}
36+
if (argv['update-date']) {
37+
return updateReleaseDate(argv);
38+
}
2739
yargsInstance.showHelp();
2840
}
2941

30-
async function startSecurityRelease(argv) {
42+
async function updateReleaseDate(argv) {
43+
const releaseDate = argv['update-date'];
44+
const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
45+
const cli = new CLI(logStream);
46+
const update = new UpdateSecurityRelease(cli);
47+
return update.updateReleaseDate(releaseDate);
48+
}
49+
50+
async function startSecurityRelease() {
3151
const logStream = process.stdout.isTTY ? process.stdout : process.stderr;
3252
const cli = new CLI(logStream);
3353
const release = new SecurityReleaseSteward(cli);

‎docs/git-node.md

+10-2
Original file line numberDiff line numberDiff line change
@@ -455,8 +455,16 @@ $ ncu-config --global set h1_username $H1_TOKEN
455455

456456
This command creates the Next Security Issue in Node.js private repository
457457
following the [Security Release Process][] document.
458-
It will retrieve all the triaged HackerOne reports and add them to the list
459-
with the affected release line.
458+
It will retrieve all the triaged HackerOne reports and add creates the `vulnerabilities.json`.
459+
460+
### `git node security --update-date=target`
461+
462+
This command updates the `vulnerabilities.json` with target date of the security release.
463+
Example:
464+
465+
```sh
466+
git node security --update-date=16/12/2023
467+
```
460468

461469
## `git node status`
462470

‎lib/prepare_security.js

+20-58
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
import nv from '@pkgjs/nv';
2-
import auth from './auth.js';
3-
import Request from './request.js';
42
import fs from 'node:fs';
5-
import { runSync } from './run.js';
63
import path from 'node:path';
7-
8-
export const PLACEHOLDERS = {
9-
releaseDate: '%RELEASE_DATE%',
10-
vulnerabilitiesPRURL: '%VULNERABILITIES_PR_URL%',
11-
preReleasePrivate: '%PRE_RELEASE_PRIV%',
12-
postReleasePrivate: '%POS_RELEASE_PRIV%',
13-
affectedLines: '%AFFECTED_LINES%'
14-
};
4+
import auth from './auth.js';
5+
import Request from './request.js';
6+
import {
7+
NEXT_SECURITY_RELEASE_BRANCH,
8+
NEXT_SECURITY_RELEASE_FOLDER,
9+
NEXT_SECURITY_RELEASE_REPOSITORY,
10+
PLACEHOLDERS,
11+
checkoutOnSecurityReleaseBranch,
12+
commitAndPushVulnerabilitiesJSON
13+
} from './security-release/security-release.js';
1514

1615
export default class SecurityReleaseSteward {
16+
repository = NEXT_SECURITY_RELEASE_REPOSITORY;
1717
constructor(cli) {
1818
this.cli = cli;
1919
}
@@ -28,9 +28,10 @@ export default class SecurityReleaseSteward {
2828
const req = new Request(credentials);
2929
const release = new PrepareSecurityRelease(req);
3030
const releaseDate = await release.promptReleaseDate(cli);
31-
let securityReleasePRUrl = PLACEHOLDERS.vulnerabilitiesPRURL;
3231

3332
const createVulnerabilitiesJSON = await release.promptVulnerabilitiesJSON(cli);
33+
34+
let securityReleasePRUrl;
3435
if (createVulnerabilitiesJSON) {
3536
securityReleasePRUrl = await this.createVulnerabilitiesJSON(req, release, { cli });
3637
}
@@ -47,7 +48,7 @@ export default class SecurityReleaseSteward {
4748

4849
async createVulnerabilitiesJSON(req, release, { cli }) {
4950
// checkout on the next-security-release branch
50-
release.checkoutOnSecurityReleaseBranch(cli);
51+
checkoutOnSecurityReleaseBranch(cli, this.repository);
5152

5253
// choose the reports to include in the security release
5354
const reports = await release.chooseReports(cli);
@@ -62,13 +63,14 @@ export default class SecurityReleaseSteward {
6263
cli.info(`To push the vulnerabilities.json file run:
6364
- git add ${filePath}
6465
- git commit -m "chore: create vulnerabilities.json for next security release"
65-
- git push -u origin next-security-release
66+
- git push -u origin ${NEXT_SECURITY_RELEASE_BRANCH}
6667
- open a PR on ${release.repository.owner}/${release.repository.repo}`);
6768
return;
6869
};
6970

7071
// commit and push the vulnerabilities.json file
71-
release.commitAndPushVulnerabilitiesJSON(filePath, cli);
72+
const commitMessage = 'chore: create vulnerabilities.json for next security release';
73+
commitAndPushVulnerabilitiesJSON(filePath, commitMessage, { cli, repository: this.repository });
7274

7375
const createPr = await release.promptCreatePR(cli);
7476

@@ -80,13 +82,8 @@ export default class SecurityReleaseSteward {
8082
}
8183

8284
class PrepareSecurityRelease {
83-
repository = {
84-
owner: 'nodejs-private',
85-
repo: 'security-release'
86-
};
87-
85+
repository = NEXT_SECURITY_RELEASE_REPOSITORY;
8886
title = 'Next Security Release';
89-
nextSecurityReleaseBranch = 'next-security-release';
9087

9188
constructor(req, repository) {
9289
this.req = req;
@@ -101,30 +98,6 @@ class PrepareSecurityRelease {
10198
{ defaultAnswer: true });
10299
}
103100

104-
checkRemote(cli) {
105-
const remote = runSync('git', ['ls-remote', '--get-url', 'origin']).trim();
106-
const { owner, repo } = this.repository;
107-
const securityReleaseOrigin = [
108-
`https://github.com/${owner}/${repo}.git`,
109-
`[email protected]:${owner}/${repo}.git`
110-
];
111-
112-
if (!securityReleaseOrigin.includes(remote)) {
113-
cli.error(`Wrong repository! It should be ${securityReleaseOrigin}`);
114-
process.exit(1);
115-
}
116-
}
117-
118-
commitAndPushVulnerabilitiesJSON(filePath, cli) {
119-
this.checkRemote(cli);
120-
121-
runSync('git', ['add', filePath]);
122-
const commitMessage = 'chore: create vulnerabilities.json for next security release';
123-
runSync('git', ['commit', '-m', commitMessage]);
124-
runSync('git', ['push', '-u', 'origin', 'next-security-release']);
125-
cli.ok(`Pushed commit: ${commitMessage} to ${this.nextSecurityReleaseBranch}`);
126-
}
127-
128101
getSecurityIssueTemplate() {
129102
return fs.readFileSync(
130103
new URL(
@@ -160,7 +133,7 @@ class PrepareSecurityRelease {
160133
{ defaultAnswer: true });
161134
}
162135

163-
buildIssue(releaseDate, securityReleasePRUrl) {
136+
buildIssue(releaseDate, securityReleasePRUrl = PLACEHOLDERS.vulnerabilitiesPRURL) {
164137
const template = this.getSecurityIssueTemplate();
165138
const content = template.replace(PLACEHOLDERS.releaseDate, releaseDate)
166139
.replace(PLACEHOLDERS.vulnerabilitiesPRURL, securityReleasePRUrl);
@@ -224,24 +197,13 @@ class PrepareSecurityRelease {
224197
return summaries?.[0].attributes?.content;
225198
}
226199

227-
checkoutOnSecurityReleaseBranch(cli) {
228-
this.checkRemote(cli);
229-
const currentBranch = runSync('git', ['branch', '--show-current']).trim();
230-
cli.info(`Current branch: ${currentBranch} `);
231-
232-
if (currentBranch !== this.nextSecurityReleaseBranch) {
233-
runSync('git', ['checkout', '-B', this.nextSecurityReleaseBranch]);
234-
cli.ok(`Checkout on branch: ${this.nextSecurityReleaseBranch} `);
235-
};
236-
}
237-
238200
async createVulnerabilitiesJSON(reports, { cli }) {
239201
cli.separator('Creating vulnerabilities.json...');
240202
const file = JSON.stringify({
241203
reports
242204
}, null, 2);
243205

244-
const folderPath = path.join(process.cwd(), 'security-release', 'next-security-release');
206+
const folderPath = path.join(process.cwd(), NEXT_SECURITY_RELEASE_FOLDER);
245207
try {
246208
await fs.accessSync(folderPath);
247209
} catch (error) {

‎lib/security-release/security-release.js

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
import { runSync } from '../run.js';
2+
3+
export const NEXT_SECURITY_RELEASE_BRANCH = 'next-security-release';
4+
export const NEXT_SECURITY_RELEASE_FOLDER = 'security-release/next-security-release';
5+
6+
export const NEXT_SECURITY_RELEASE_REPOSITORY = {
7+
owner: 'nodejs-private',
8+
repo: 'security-release'
9+
};
10+
11+
export const PLACEHOLDERS = {
12+
releaseDate: '%RELEASE_DATE%',
13+
vulnerabilitiesPRURL: '%VULNERABILITIES_PR_URL%',
14+
preReleasePrivate: '%PRE_RELEASE_PRIV%',
15+
postReleasePrivate: '%POS_RELEASE_PRIV%',
16+
affectedLines: '%AFFECTED_LINES%'
17+
};
18+
19+
export function checkRemote(cli, repository) {
20+
const remote = runSync('git', ['ls-remote', '--get-url', 'origin']).trim();
21+
const { owner, repo } = repository;
22+
const securityReleaseOrigin = [
23+
`https://github.com/${owner}/${repo}.git`,
24+
`[email protected]:${owner}/${repo}.git`
25+
];
26+
27+
if (!securityReleaseOrigin.includes(remote)) {
28+
cli.error(`Wrong repository! It should be ${securityReleaseOrigin}`);
29+
process.exit(1);
30+
}
31+
}
32+
33+
export function checkoutOnSecurityReleaseBranch(cli, repository) {
34+
checkRemote(cli, repository);
35+
const currentBranch = runSync('git', ['branch', '--show-current']).trim();
36+
cli.info(`Current branch: ${currentBranch} `);
37+
38+
if (currentBranch !== NEXT_SECURITY_RELEASE_BRANCH) {
39+
runSync('git', ['checkout', '-B', NEXT_SECURITY_RELEASE_BRANCH]);
40+
cli.ok(`Checkout on branch: ${NEXT_SECURITY_RELEASE_BRANCH} `);
41+
};
42+
}
43+
44+
export function commitAndPushVulnerabilitiesJSON(filePath, commitMessage, { cli, repository }) {
45+
checkRemote(cli, repository);
46+
47+
if (Array.isArray(filePath)) {
48+
for (const path of filePath) {
49+
runSync('git', ['add', path]);
50+
}
51+
} else {
52+
runSync('git', ['add', filePath]);
53+
}
54+
55+
runSync('git', ['commit', '-m', commitMessage]);
56+
runSync('git', ['push', '-u', 'origin', NEXT_SECURITY_RELEASE_BRANCH]);
57+
cli.ok(`Pushed commit: ${commitMessage} to ${NEXT_SECURITY_RELEASE_BRANCH}`);
58+
}

‎lib/update_security_release.js

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
import {
2+
NEXT_SECURITY_RELEASE_FOLDER,
3+
NEXT_SECURITY_RELEASE_REPOSITORY,
4+
checkoutOnSecurityReleaseBranch,
5+
commitAndPushVulnerabilitiesJSON
6+
} from './security-release/security-release.js';
7+
import fs from 'node:fs';
8+
import path from 'node:path';
9+
10+
export default class UpdateSecurityRelease {
11+
repository = NEXT_SECURITY_RELEASE_REPOSITORY;
12+
constructor(cli) {
13+
this.cli = cli;
14+
}
15+
16+
async updateReleaseDate(releaseDate) {
17+
const { cli } = this;
18+
19+
try {
20+
const [day, month, year] = releaseDate.split('/');
21+
const value = new Date(`${month}/${day}/${year}`).valueOf();
22+
if (Number.isNaN(value) || value < 0) {
23+
throw new Error('Invalid date format');
24+
}
25+
} catch (error) {
26+
cli.error('Invalid date format. Please use the format dd/mm/yyyy.');
27+
process.exit(1);
28+
}
29+
30+
// checkout on the next-security-release branch
31+
checkoutOnSecurityReleaseBranch(cli, this.repository);
32+
33+
// update the release date in the vulnerabilities.json file
34+
const updatedVulnerabilitiesFiles = await this.updateVulnerabilitiesJSON(releaseDate, { cli });
35+
36+
const commitMessage = `chore: update the release date to ${releaseDate}`;
37+
commitAndPushVulnerabilitiesJSON(updatedVulnerabilitiesFiles,
38+
commitMessage, { cli, repository: this.repository });
39+
cli.ok('Done!');
40+
}
41+
42+
async updateVulnerabilitiesJSON(releaseDate) {
43+
const vulnerabilitiesJSONPath = path.join(process.cwd(),
44+
NEXT_SECURITY_RELEASE_FOLDER, 'vulnerabilities.json');
45+
46+
const exists = fs.existsSync(vulnerabilitiesJSONPath);
47+
48+
if (!exists) {
49+
this.cli.error(`The file vulnerabilities.json does not exist at ${vulnerabilitiesJSONPath}`);
50+
process.exit(1);
51+
}
52+
53+
const content = JSON.parse(fs.readFileSync(vulnerabilitiesJSONPath, 'utf8'));
54+
content.releaseDate = releaseDate;
55+
56+
fs.writeFileSync(vulnerabilitiesJSONPath, JSON.stringify(content, null, 2));
57+
58+
this.cli.ok(`Updated the release date in vulnerabilities.json: ${releaseDate}`);
59+
return [vulnerabilitiesJSONPath];
60+
}
61+
}

0 commit comments

Comments
 (0)