Repository navigation
Conversation
Rewrites flb in TypeScript (commander) for the Registry Service /v1 API, still published as @fleetbase/cli with the flb binary. - Config in ~/.fleetbase/config.json (mode 600, atomic writes), reading the phase-0 keys (host, registry, tokens by host, defaultOrganization) and adding per-host token metadata and instance tokens. FLB_TOKEN for CI. - login (password or --token), logout, whoami, register, verify, token create|list|revoke. No token is printed without --show-token and output is redacted centrally. - init from fleetbase/starter-extension with package names, PHP namespace, route and an extension.json with compat ranges; bump keeps extension.json, package.json and composer.json on one version. - build: npm pack engine, Composer api archive, optional prebuilt dist via ember-core build-engine-release; .fleetbase/release.json. - publish creates the listing if needed, uploads, streams checks by polling the release; release list|status|submit|withdraw|yank. - search, info, instance code|register|status|updates|list|forget. - install|update|uninstall run php artisan registry:* locally or in a docker compose service and follow the job with registry:job. - doctor. - install-fleetbase moves to packages/installer (@fleetbase/installer); flb install-fleetbase prints the npx command. - Vitest unit tests and test/e2e/run.sh against the service, run in CI against fleetbase/registry@v2.
- flb listing list|show|update|categories: PATCH the catalog listing from flags or --file, and show what a first release still needs. - flb instance register --path|--docker mints a code and pipes it to php artisan registry:register --code-stdin on the instance, so the instance token stays in its encrypted settings. Without a target, or with --store-token, the CLI exchanges the code as before. - The artisan runner can write stdin; doctor reports registry:register. - The e2e uses flb listing instead of curl, and its stub artisan really exchanges the piped code with the service.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| export const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/; | ||
| export const NPM_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/; | ||
| export const COMPOSER_NAME = /^[a-z0-9]([_.-]?[a-z0-9]+)*\/[a-z0-9](([_.]|-{1,2})?[a-z0-9]+)*$/; |
|
|
||
| export const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/; | ||
| export const NPM_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/; | ||
| export const COMPOSER_NAME = /^[a-z0-9]([_.-]?[a-z0-9]+)*\/[a-z0-9](([_.]|-{1,2})?[a-z0-9]+)*$/; |
- Replace the SemVer regex (exponential backtracking on long numeric prerelease identifiers) with isSemver(), a strict check on semver.parse's canonical form; versions over 256 characters are rejected as npm does. - Escape backslashes as well as single quotes when the scaffold writes the extension name and description into JS and PHP string literals.
…egex CodeQL js/redos pointed at COMPOSER_NAME, not the SemVer regex. Rewrite Composer's vendor/package rule so each separator is required between alphanumeric runs. Same language (checked exhaustively against the old pattern for every string up to 8 characters over [a0_.-/]), linear time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLI v2 for the Fleetbase Extensions Registry (Phase 2, Workstream G).
flbis rewritten in TypeScript (commander) against the Registry Service/v1API. It is still published as@fleetbase/cliwith theflbbinary, now at2.0.0-beta.0.What changes
~/.fleetbase/config.json, written atomically with mode 600 in a 700 directory.host,registry,tokensby host,defaultOrganization) unchanged and keeps unknown keys.hosts(token metadata, nothing secret) andinstances.FLB_TOKENis supported for CI.--show-token..npmrcand noauth.json.token createrefuses to mint a token unless you pass--show-tokenor--save.login(password,--token,--token-stdin),logout,whoami,register,verify,token create|list|revokeinit,build,bump,publish,release list|status|submit|withdraw|yank,listing list|show|update|categoriessearch,infoinstance code|register|status|updates|list|forget,install|update|uninstalldoctorandconfignpm pack, writes the API archive in thepackage/layout Composer expects, and with--prebuilt --console <path>adds the prebuilt dist from ember-core'sbuild-engine-release(feat: runtime engines (mount prebuilt engine releases without a console rebuild) ember-core#99). It writes.fleetbase/release.json.GET /v1/publisher/releases/{id}.php artisan registry:*in an API checkout or a docker compose service, then follow the job withregistry:job.registry:register --code-stdin, so the instance token never leaves the instance.install-fleetbasemoves topackages/installer(@fleetbase/installer);flb install-fleetbasenow printsnpx @fleetbase/installer.fleetbase/registry@v2that runstest/e2e/run.sh;@fleetbase/installeris only published when its version is new.Depends on
feature/cli-job-register-commands-827e43(registry:jobandregistry:register). Without it,flb installcan't follow queued jobs (--syncstill works) andflb instance register --pathfails with a hint to pass--store-token.Testing
test/e2e/run.shpasses against a local Registry Service (v2,QUEUE_CONNECTION=sync). It covers:config.json.Not done yet
publishandrelease statusprintflb release status <id>until that website exists.