ryansonshine/semantic-release-codeartifact

A semantic-release plugin for publishing packages to AWS CodeArtifact

Semantic Release CodeArtifact

A semantic-release plugin for publishing packages to AWS CodeArtifact.

Automate your entire package release workflow including: determining the next version number, generating release notes, and publishing packages to CodeArtifact using this plugin with semantic-release.

Table of Contents

• Install
• Usage
• Demo
• Requirements
  • IAM Policy for Publishing
• Configuration
  • AWS Environment variables
  • Plugin environment variables
  • Options
• Lifecycle Hooks
• Recipes
  • CI Configurations
• Additional Usage
  • JavaScript - npm
    • Plugin Configuration with npm
  • Python - pip
  • Java - Maven
  • Java - Gradle
• Contributors ✨

Install

npm install -D semantic-release semantic-release-codeartifact

Usage

The plugin can be configured in the semantic-release configuration file:

{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    ["semantic-release-codeartifact", {
      "tool": "npm",
      "domain": "<YOUR_DOMAIN>",
      "repository": "<YOUR_REPOSITORY>"
    }],
    "@semantic-release/npm",
    "@semantic-release/github"
  ]
}

See Additional Usage for details on using other tools with this plugin.

Demo

Check out this example repo to see it in action.

Requirements

In order to use semantic-release you need:

• To host your code in a Git repository
• Use a Continuous Integration service that allows you to securely set up credentials
• A Git CLI version that meets semantic-release's version requirement installed in your Continuous Integration environment
• A Node.js version that meets semantic-release's version requirement installed in your Continuous Integration environment

In order to use semantic-release-codeartifact you need:

• An AWS Account
• An AWS CodeArtifact repository
• A role your CI environment can assume with sufficient IAM permissions to publish packages with CodeArtifact

IAM Policy for Publishing

The IAM role used by your CI environment will need the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codeartifact:GetAuthorizationToken",
        "codeartifact:GetRepositoryEndpoint",
        "codeartifact:PublishPackageVersion"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "sts:GetServiceBearerToken",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "sts:AWSServiceName": "codeartifact.amazonaws.com"
        }
      }
    }
  ]
}

Configuration

AWS Environment variables

The AWS configuration is required for the AWS SDK which is used for getting an auth token for CodeArtifact.

Variable	Description
AWS_REGION	Required. The AWS region to be used with the AWS SDK
AWS_ACCESS_KEY_ID	Required. Your AWS Access Key
AWS_SECRET_ACCESS_KEY	Required. Your AWS Secret Access Key
AWS_SESSION_TOKEN	Session token if you have/need it

Note: Proxy configurations are supported and will be used if HTTP_PROXY or HTTPS_PROXY is found on the environment using aws-sdk-v3-proxy.

Plugin environment variables

The following environment variables can be set to configure the plugin. Options specified by plugin config will take precedence over these environment variables.

Variable	Description
SR_CA_TOOL	Tool to connect with the CodeArtifact repository
SR_CA_DOMAIN	Your CodeArtifact domain name
SR_CA_REPOSITORY	Your CodeArtifact repository name
SR_CA_DOMAIN_OWNER	The AWS Account ID that owns your CodeArtifact domain
SR_CA_DURATION_SEC	The time, in seconds, that login information for CodeArtifact is valid

Options

Option	Description	Default
tool	Required. Tool to connect with the CodeArtifact repository	SR_CA_TOOL environment variable.
domain	Required. Your CodeArtifact domain name	SR_CA_DOMAIN environment variable.
repository	Required. Your CodeArtifact repository name	SR_CA_REPOSITORY environment variable.
domainOwner	The AWS Account ID that owns your CodeArtifact domain	SR_CA_DOMAIN_OWNER environment variable.
durationSections	The time, in seconds, that login information for CodeArtifact is valid	7200 (2 hours)
skipPluginCheck	Skips the check for required plugins, this can be used if you are using your own custom plugins for your specified tool	false

Lifecycle Hooks

Step	Description
verifyConditions	Verify the presence and the validity of the authentication (set via configuration), and provide authentication values to the semantic-release plugin related to the CodeArtifact tool being used

Recipes

CI Configurations

• GitHub Actions
• GitLab (coming soon - PRs welcome)
• CircleCI (coming soon - PRs welcome)

Additional Usage

CodeArtifact supports multiple tools including npm (JavaScript), Maven and Gradle (Java), and pip (Python). Each contain different dependencies and are listed below.

JavaScript - npm

Required dependencies:

• @semantic-release/npm

npm install --save-dev semantic-release semantic-release-codeartifact

Plugin Configuration with npm

semantic-release includes the other plugins listed below:

{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    ["semantic-release-codeartifact", {
      "tool": "npm",
      "domain": "<YOUR_DOMAIN>",
      "repository": "<YOUR_REPOSITORY>"
    }],
    "@semantic-release/npm",
    "@semantic-release/github"
  ]
}

Note: semantic-release-codeartifact must be listed before @semantic-release/npm

Python - pip

Support for pip coming soon

Java - Maven

Support for Maven coming soon

Java - Gradle

Support for Gradle coming soon

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Ryan Sonshine 💻

Jared McAteer 🐛

This project follows the all-contributors specification. Contributions of any kind welcome!

semantic-release-codeartifact's Issues

Update tags and description in package.json

Add unit tests

These should have been done beforehand, but alas, here we are.

Add support for namespace option

Feature Request

Is your feature request related to a problem? Please describe.

Our code artifact is only configured for certain prefixes. (ie: @foo/package). AWS Codeartifact calls them namespaces.

When running the aws configuration command from the cli, it does handle this with the --namespace option.

Describe the solution you'd like
Add another option called namespace (to match the codeartifact name), which will setup the .npmrc with the correct prefix. The entry in the .npmrc will just need to be prefixed with the namespace. @namespace:.

Describe alternatives you've considered
Just not using the plugin and manually running the aws codeartifact manually in the pipeline.

Are you willing to resolve this issue by submitting a Pull Request?

Sure, I'll throw something together.

Add badges to README.md

Add integration tests

yarn installation fail because of peer-dependencies problem with aws-sdk-v3-proxy

Current Behavior

yarn add --dev semantic-release-codeartifact

semantic-release-codeartifact@npm:2.0.3 doesn't provide @aws-sdk/node-http-handler (p163cd), requested by aws-sdk-v3-proxy
➤ YN0002: │ semantic-release-codeartifact@npm:2.0.3 doesn't provide @aws-sdk/protocol-http (pe111e), requested by aws-sdk-v3-proxy
➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements for details, where is the six-letter p-prefixed code

Expected Behavior

the package should be installed

Steps to Reproduce the Problem

1. install yarn 2 or more (https://yarnpkg.com/getting-started/install)
2. try install semantic-release-codeartifact (yarn add --dev semantic-release-codeartifact)

Environment

• Version:2.0.3
• Platform: Mac/Linux
• Node.js Version: lts (v16.13.2)

Fix

• npm install --save @aws-sdk/node-http-handler
• npm install --save @aws-sdk/protocol-http

Add support for HTTP_PROXY

AWS SDK should utilize HTTP_PROXY if present on process.env

Add option for skipping plugin check

When using a specific tool (ie: npm) we currently check if the @semantic-release/npm plugin is included in the configuration. If it's not; we throw an error and abort.

If users would like to use a plugin of their own for handling the related tool, we should give them an option to skip the plugin checks.

Support AWS authentication by login session

Feature Request

Is your feature request related to a problem? Please describe.
Currently, this plugin requires AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY from the IAM user that we have to create and give this user access to Codeartifact but in my company, they use aws Codeartifact login command to authenticate by session only,

Describe the solution you'd like
can we have a flag withSession for example to choose which way I need to authenticate in this case, if this flag is false then AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY will be mandatory if the flag is true then the authentication will be by login session

• Yes, I have the time, and I know how to start.
• Yes, I have the time, but I don't know how to start. I would need guidance.
• No, I don't have the time, although I believe I could do it if I had the time...
• No, I don't have the time and I wouldn't even know how to start.

.npmrc url cannot contain environment variables

Current Behavior

If you have a .npmrc url with an environment variable (in our case the account id) the release will fail when trying to verify the config

[2:02:22 PM] [semantic-release] › ✖  ENPMRCCONFIGMISMATCH Mismatch on CodeArtifact repository and npmrc registry
The registry set in the .npmrc of your project root does not match the CodeArtifact endpoint.

The .npmrc registry is 'https://my-private-${AWS_ACCOUNT_ID}.d.codeartifact.us-east-1.amazonaws.com/npm/my-private/.'
The CodeArtifact endpoint is 'https://my-private-***.d.codeartifact.us-east-1.amazonaws.com/npm/my-private/'.

AggregateError: 
    SemanticReleaseError: Mismatch on CodeArtifact repository and npmrc registry
        at Object.getError (/home/runner/work/design-system/design-system/node_modules/semantic-release-codeartifact/lib/src/get-error.js:11:12)
        at /home/runner/work/design-system/design-system/node_modules/semantic-release-codeartifact/lib/src/verify-npm.js:52:41
        at Generator.next (<anonymous>)
        at fulfilled (/home/runner/work/design-system/design-system/node_modules/semantic-release-codeartifact/lib/src/verify-npm.js:5:58)
    at /home/runner/work/design-system/design-system/node_modules/semantic-release/lib/plugins/pipeline.js:54:11
    at async Object.pluginsConf.<computed> [as verifyConditions] (/home/runner/work/design-system/design-system/node_modules/semantic-release/lib/plugins/index.js:80:11)
    at async run (/home/runner/work/design-system/design-system/node_modules/semantic-release/index.js:103:3)
    at async module.exports (/home/runner/work/design-system/design-system/node_modules/semantic-release/index.js:268:22)
    at async module.exports (/home/runner/work/design-system/design-system/node_modules/semantic-release/cli.js:[55](https://github.com/morpheus-med/design-system/runs/6371374317?check_suite_focus=true#step:9:55):5)

Expected Behavior

Should not fail here

Steps to Reproduce the Problem

1. Edit the .npmrc fixture to contain an environment variable in the unittests

    jared@SleepyGary:~/projects/semantic-release-codeartifact$ git diff
    diff --git a/test/fixtures/files/.npmrc b/test/fixtures/files/.npmrc
    index a95360a..57d7c96 100644
    --- a/test/fixtures/files/.npmrc
    +++ b/test/fixtures/files/.npmrc
    @@ -1,2 +1,2 @@
    -registry=https://my-domain-000000000.d.codeartifact.us-east-1.amazonaws.com/npm/my-repo/
    -//my-domain-000000000.d.codeartifact.us-east-1.amazonaws.com/npm/my-repo/:always-auth=true
    +registry=https://my-domain-${AWS_ACCOUNT_ID}.d.codeartifact.us-east-1.amazonaws.com/npm/my-repo/
    +//my-domain-${AWS_ACCOUNT_ID}.d.codeartifact.us-east-1.amazonaws.com/npm/my-repo/:always-auth=true
   

2. run AWS_ACCOUNT_ID=000000000 npm test

It's obviously because this is more or less a straight string equality check and I'm not sure what the proper fix should be.

Environment

• Version: 0.0.0-development
• Platform: Linux
• Node.js Version: v16.14.2

Update error messages to link to sections in README