Add publish types script

[Ethan-Arrowood]

This PR adds an automation script for publishing the undici-types package.

I think I'd like to now make us maintainers run this, and instead make it a GitHub action that runs when a new version commit is pushed to main branch. I think I can use deployment reviews (https://docs.github.com/en/actions/managing-workflow-runs/reviewing-deployments) so that a maintainer just has to approve the publish

Instead I think a prepublish script will suffice.

[codecov-commenter]

Codecov Report

Patch coverage: 83.33% and project coverage change: -0.04% ⚠️

Comparison is base (e39a632) 85.54% compared to head (1268635) 85.51%.
Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2273      +/-   ##
==========================================
- Coverage   85.54%   85.51%   -0.04%     
==========================================
  Files          76       76              
  Lines        6858     6861       +3     
==========================================
  Hits         5867     5867              
- Misses        991      994       +3     

Files Changed	Coverage Δ
lib/client.js	93.03% <66.66%> (-0.09%)	⬇️
index-fetch.js	100.00% <100.00%> (ø)

... and 3 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Ethan-Arrowood]

After some tinkering, here is the flow I've landed on for now:

• Undici maintainer prepares to update Undici like normal
  • git checkout main, git pull, npm install, npm test (at least this is what I do)
• Maintainer updates the version npm version <major|minor|patch>
  • this has the side effect of updating package.json#version and creating a git tag
• Maintainer commits the version bump git commit -am '<version>'
• Maintainer runs npm publish
  • 2FA should be enforced and user is prompted to pass OTP
  • Maintainer can also run npm publish --otp=000000 and not be prompted this time
• After undici is published, the postpublish script runs.
  • It updates types/package.json#version to whatever was just used for undici
  • Then it cd types && npm publish reprompting the maintainer to pass an OTP
    • Unfortunately I cannot find a way for npm to reuse the OTP from the previous publish.
• undici-types should be published with the same version alongside undici
  • if anything erroneous happens during the publish process, a maintainer can manually fix things and manually publish undici-types

---

I have one more flow idea that is to add a publish.js script that forces the maintainer to pass in a --otp option so that there is no double-prompting. It then passes that otp to both publish operations simultaneously.

Publish script

const fs = require('node:fs')
const path = require('node:path')
const childProcess = require('node:child_process')
const util = require('node:util')

const { values: { otp } } = util.parseArgs({
  options: {
    otp: {
      type: 'string',
      default: process.env.npm_config_otp
    }
  },
})

if (!otp) {
  console.log('`undici` and `undici-types` require 2FA to be published. Pass a one-time password using `npm publish --otp=000000`.')
  process.exit(1);
}

const packageJSONPath = path.join(__dirname, '..', 'package.json')
const packageJSONRaw = fs.readFileSync(packageJSONPath, 'utf-8')
const packageJSON = JSON.parse(packageJSONRaw)
const version = packageJSON.version

const packageTypesJSONPath = path.join(__dirname, '..', 'types', 'package.json')
const packageTypesJSONRaw = fs.readFileSync(packageTypesJSONPath, 'utf-8')
const packageTypesJSON = JSON.parse(packageTypesJSONRaw)
packageTypesJSON.version = version

fs.writeFileSync(packageTypesJSONPath, JSON.stringify(packageTypesJSON, null, 2))

childProcess.execSync('git add types/package.json', { cwd: path.join(__dirname, '..') })
childProcess.execSync(`git commit -n -m 'undici-type@${version}'`, { cwd: path.join(__dirname, '..') })

await Promise.all([
  childProcess.exec(`npm publish --otp=${otp}`, { cwd: path.join(__dirname, '..') }),
  childProcess.exec(`npm publish --otp=${otp}`, { cwd: path.join(__dirname, '..', 'types') }),
]);

Edit: this actually won't work. There is no way to override npm publish. I could theoretically add a prepublish script that essentially says Run 'npm run publish --otp' instead of 'npm publish' and then have it exit with code 1 so that npm's regular publish never runs.

---

I think we start here and if maintainers with publish capabilities care to comment on the UX I can make modifications

[Ethan-Arrowood]

Is this list still accurate? https://github.com/nodejs/undici/#releasers @mcollina @ronag

If so - what do y'all prefer for publish experience? I want to make this work with as little disruption/change as possible. But I don't want us to start publishing undici versions with publishing the undici-types version

[ronag]

As far as publishing goes I just do:

npm version patch
npm publish
git push --follow-tags

I would expect it to keep working like that?

[Ethan-Arrowood]

@ronag when you publish - do you get prompted for an OTP? That's been the part that's difficult for me to automate

[ronag]

@ronag when you publish - do you get prompted for an OTP? That's been the part that's difficult for me to automate

Yes, I get the prompt. I can enter the code twice while publishing?

[Ethan-Arrowood]

Yes it'll just reprompt you after it publishes Undici.

[Ethan-Arrowood]

When this PR is approved I will do one more tagged release to test things out. Then after we merge I'd like to bump the patch version so we get everything synced up.

[Ethan-Arrowood]

Okay I'm happy with this. Had to add a README for undici-types though if folks want to take a quick look at that.

I did a publish test and it worked like a charm. When the network behaves, the publish is actually quite quick so you can enter the same OTP twice (when prompted).

Furthermore, both publishes contain the correct files and types are working as expected. I manually tested this with a test project as well as visually inspecting the code on npm site in the test versions.

[Ethan-Arrowood]

🎉 [email protected] & [email protected]