release

type CheckRotationsOptions ¶ added in v0.14.0

type CheckRotationsOptions struct {
	Now time.Time
	GH  GHRunner
	Env Environ
}

CheckRotationsOptions configures CheckSecretRotations. Now is the wall-clock time to compute due-state from; GH is the gh runner (overridable for tests). Env is the environment reader used to render issue bodies (GITHUB_SERVER_URL etc).

type CheckSecretRotationsResult ¶ added in v0.14.0

type CheckSecretRotationsResult struct {
	Opened  []string
	Skipped []string
}

CheckSecretRotationsResult records the per-run outcome the workflow log surfaces.

func CheckSecretRotations(repoRoot string, opts CheckRotationsOptions) (CheckSecretRotationsResult, error)

type DueResult ¶ added in v0.14.0

type DueResult struct {
	Status       DueState
	DaysUntilDue int
}

DueResult pairs the classification with a signed day count. DaysUntilDue is positive while the rotation is still in the future, zero on the due date, negative once past due. Callers format the value differently per status: "due in N days" / "due today" / "OVERDUE by N days" (negate).

func ComputeDueState(today, lastRotated time.Time, periodDays int) DueResult

type DueState ¶ added in v0.14.0

type DueState string

DueState classifies a rotation: not yet due, within the reminder window, or overdue.

const (
	DueOK      DueState = "ok"
	DueDue     DueState = "due"
	DueOverdue DueState = "overdue"
)

type Environ ¶ added in v0.14.0

type Environ interface {
	Getenv(key string) string
}

Environ abstracts os.Getenv for testability. The default (osEnviron) reads the process environment.

type FS ¶

type FS interface {
	// Stat returns the FileInfo for the named file, mirroring
	// os.Stat.
	Stat(name string) (os.FileInfo, error)
	// ReadFile reads the named file, mirroring os.ReadFile.
	ReadFile(name string) ([]byte, error)
	// WriteFile writes data to the named file, mirroring
	// os.WriteFile.
	WriteFile(name string, data []byte, perm fs.FileMode) error
	// ReadDir reads the named directory, mirroring os.ReadDir.
	ReadDir(name string) ([]os.DirEntry, error)
	// MkdirAll creates name and any parents, mirroring
	// os.MkdirAll.
	MkdirAll(path string, perm fs.FileMode) error
	// MkdirTemp creates a new temporary directory, mirroring
	// os.MkdirTemp.
	MkdirTemp(dir, pattern string) (string, error)
	// Rename renames (moves) oldpath to newpath, mirroring
	// os.Rename.
	Rename(oldpath, newpath string) error
	// RemoveAll removes path and any children, mirroring
	// os.RemoveAll.
	RemoveAll(path string) error
}

FS is the small filesystem surface the release toolkit uses. Production paths use osFS (delegating to the real syscalls); tests inject a fault-injecting fake to exercise IO error branches that real filesystems don't reliably trigger (mid-pipeline mkdir failure, rename target on a non-directory, disk-full WriteFile, etc.).

We intentionally keep this independent of stdlib's read-only `io/fs.FS`. The release toolkit needs Mkdir/Write/Rename alongside Read/Stat, and stdlib's interface only covers reads.

type FindEntryResult ¶ added in v0.14.0

type FindEntryResult struct {
	Path   string
	Titles []string
}

FindEntryResult is what FindEntry returns: the matched path and the sorted set of titles seen during the scan.

func FindEntry(rotationsDir, entryTitle string) (FindEntryResult, error)

type FrontMatterError ¶ added in v0.14.0

type FrontMatterError struct {
	Path string
	Msg  string
}

FrontMatterError describes a malformed per-secret file. Tests match on the wrapped error's message; the path prefix gives the maintainer a clear pointer to the bad file.

func (e *FrontMatterError) Error() string

type GHRunner ¶ added in v0.14.0

type GHRunner func(args []string) ([]byte, error)

GHRunner is the injection point for the `gh` CLI. Production uses ExecGH (shells out to the `gh` binary on PATH); tests pass a fake function that records invocations and returns canned output. Returns the stdout bytes; on a non-zero exit the error wraps the gh stderr so workflow logs can diagnose the failure.

type LoadedRotation ¶ added in v0.14.0

type LoadedRotation struct {
	Entry        RotationEntry
	FileBasename string
}

LoadedRotation pairs a parsed entry with the base filename it came from. The filename feeds the issue body's "rotation procedure" link.

func LoadRotations(rotationsDir string) ([]LoadedRotation, error)

type Manifest ¶

type Manifest struct {
	Path         string
	Kind         ManifestKind
	OptionalDeps bool
}

Manifest is one tracked file. OptionalDeps marks the npm root — only that file carries @mdsmith/* pins.

func TrackedManifests(root string) []Manifest

type ManifestKind ¶

type ManifestKind int

ManifestKind tells the rewrite/check helpers which syntax to expect: JSON for npm package manifests, TOML for pyproject.

const (
	// ManifestJSON marks JSON manifests (npm package.json files).
	ManifestJSON ManifestKind = iota
	// ManifestTOML marks TOML manifests (python pyproject.toml).
	ManifestTOML
)

type MapEnviron ¶ added in v0.14.0

type MapEnviron map[string]string

MapEnviron is an in-memory Environ for tests.

func (m MapEnviron) Getenv(key string) string

type RotationEntry ¶ added in v0.14.0

type RotationEntry struct {
	Title       string
	LastRotated string
	PeriodDays  int
	Provider    string
	IssuerURL   string
	UsedBy      string
	Scope       string
}

RotationEntry is the parsed per-secret front matter. Field names match the YAML keys exactly (camelCase per the existing docs).

func ValidateRotationEntry(fm map[string]any, path string) (RotationEntry, error)

type Runner ¶

type Runner interface {
	// RunCommand executes name+args in dir, with stdout/stderr
	// inherited from the calling process. Mirrors exec.Cmd.Run
	// semantics: a non-zero exit returns *exec.ExitError; other
	// failures (binary not found, IO) return their underlying
	// error.
	RunCommand(dir, name string, args ...string) error
}

Runner runs an external command. The release toolkit shells out to `python -m build` and `python -m wheel tags` for the PyPI publish path; tests inject a fake Runner to cover those branches without putting python on PATH.

type Toolkit ¶

type Toolkit struct {
	// contains filtered or unexported fields
}

Toolkit owns a configured FS and Runner and exposes the release helpers (Stamp, Check, BuildNpmPlatforms, BuildWheels) as methods. `New()` returns a Toolkit backed by the real OS for both; tests can use `NewWithFS(fakeFS)` or `NewWithDeps` to drive error paths that the OS does not expose.

func New() *Toolkit

func NewWithDeps(fsys FS, runner Runner) *Toolkit

func NewWithFS(fsys FS) *Toolkit

func (t *Toolkit) BuildNpmPlatforms(rootDir, artifactsDir, outDir string) error

func (t *Toolkit) BuildWheels(rootDir, artifactsDir, outDir string) error

func (t *Toolkit) Check(root string) error

func (t *Toolkit) Stamp(root, version string) error

func (t *Toolkit) TrackedManifests(root string) []Manifest