Adding npm release service catalog scripts to utils

[dperaza4dustbit]

Release Service Catalog repo prefers no inline task logic and if any logic needed inline it should be python not bash. They actually OK with having most of the logic in our own utils in thin wrappers. Adding all npm release logic to our utils image and pinning that image in RSC tasks.

Summary by Sourcery

Add npm release support scripts and cosign tooling to the shared utils image for use by Release Service Catalog tasks.

New Features:

• Introduce shared npm release helper script for validating tarball member sizes.
• Add npm-specific scripts for provenance fetching, release notes population, pulp uploads, and OCI auth selection to the utils image.

Enhancements:

• Extend the utils container image with curl, findutils, and a pinned cosign binary for Chains provenance verification and attestation signing.

Build:

• Update utils Containerfile to install additional tooling and pin the cosign version and checksum for reproducible releases.

[sourcery-ai]

Reviewer's Guide

Adds npm release-related tooling and cosign to the shared utils image so Release Service Catalog tasks can use thin wrappers instead of inline bash, including a common helper for validating tarball member sizes and new npm-related scripts.

Flow diagram for assert_tar_member_size helper

flowchart TD
  A[assert_tar_member_size archive member max_bytes] --> B[create_tmp_file mktemp]
  B --> C[extract_member_with_tar_and_head]
  C --> D[measure_size_with_wc]
  D --> E{size_missing_or_zero}
  E -->|yes| F[return 1]
  E -->|no| G{size_gt_max_bytes}
  G -->|yes| H[print_error_and_return_1]
  G -->|no| I[return 0]

Loading

File-Level Changes

Change	Details	Files
Extend utils container dependencies and add pinned cosign binary for provenance verification and signing.	Install curl and findutils alongside existing base tools in the utils image. Introduce ARGs for COSIGN_VERSION and COSIGN_SHA256 to control cosign binary version and integrity. Download, verify via SHA256, install, and run cosign in the image build to ensure a working pinned version.	utils/Containerfile
Introduce shared bash helper for npm pulp release scripts to validate tarball member sizes safely.	Add npm-common.sh with assert_tar_member_size function taking archive, member, and max size. Use mktemp and head -c to limit buffered data and avoid loading large members into memory. Temporarily disable pipefail around tar	head to avoid SIGPIPE failures and restore it afterwards. Return non-zero on missing/empty member or when size exceeds the provided max, with a clear error message on oversize.
Add npm release-related script entrypoints to the utils image for use by Release Service Catalog tasks.	Create npm-fetch-chains-provenance script placeholder for Chains provenance fetching in npm releases. Create npm-populate-release-notes script placeholder for release notes generation or enrichment. Create npm-pulp-upload script placeholder for uploading npm content to Pulp. Create select-oci-auth script placeholder for selecting appropriate OCI authentication method.	utils/scripts/npm-fetch-chains-provenance utils/scripts/npm-populate-release-notes utils/scripts/npm-pulp-upload utils/scripts/select-oci-auth

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• In assert_tar_member_size, toggling pipefail on/off without restoring the previous state can surprise callers that rely on a specific set -o pipefail setting; consider capturing the prior state and restoring it at the end of the function.
• The curl invocation in the Containerfile does not use --fail or --show-error, so HTTP errors may be silently treated as success; adding these flags would make the cosign download step more robust.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `assert_tar_member_size`, toggling `pipefail` on/off without restoring the previous state can surprise callers that rely on a specific `set -o pipefail` setting; consider capturing the prior state and restoring it at the end of the function.
- The `curl` invocation in the `Containerfile` does not use `--fail` or `--show-error`, so HTTP errors may be silently treated as success; adding these flags would make the cosign download step more robust.

## Individual Comments

### Comment 1
<location path="utils/scripts/npm-common.sh" line_range="8-19" />
<code_context>
+  local max_bytes="${3}"
+  local tmp size
+  tmp="$(mktemp)"
+  # head closes early on truncate; ignore SIGPIPE from tar under pipefail.
+  set +o pipefail
+  tar -xOf "${archive}" "${member}" 2>/dev/null \
+    | head -c "$((max_bytes + 1))" > "${tmp}" || true
+  set -o pipefail
+  size="$(wc -c < "${tmp}" | tr -d ' ')"
+  rm -f "${tmp}"
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Toggling `pipefail` inside the helper can unintentionally change the calling script’s shell options.

Because the function unconditionally disables and then re-enables `pipefail`, it can permanently enable `pipefail` for callers that had it off, altering later behavior. Please either snapshot the current shell options and restore them exactly on exit, or rewrite the pipeline to avoid changing `pipefail` (for example by explicitly handling SIGPIPE/exit codes on the `tar`/`head` pipeline).

```suggestion
assert_tar_member_size() {
  local archive="${1}"
  local member="${2}"
  local max_bytes="${3}"
  local tmp size had_pipefail=0

  # Snapshot current pipefail setting so we can restore it exactly.
  if set -o | grep -q 'pipefail'; then
    had_pipefail=1
  fi

  tmp="$(mktemp)"
  # head closes early on truncate; ignore SIGPIPE from tar under pipefail.
  set +o pipefail
  tar -xOf "${archive}" "${member}" 2>/dev/null \
    | head -c "$((max_bytes + 1))" > "${tmp}" || true
  if ((had_pipefail)); then
    set -o pipefail
  else
    set +o pipefail
  fi

  size="$(wc -c < "${tmp}" | tr -d ' ')"
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}