From 31b40114a73deee8ba9e3329cf3f524580a8f328 Mon Sep 17 00:00:00 2001 From: SatoshiQaziMuhammed Date: Thu, 17 Sep 2026 16:44:00 +0400 Subject: [PATCH] Say where this repository actually is (#7) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Say where this repository actually is On 2026-04-21 a commit pointed repository, homepage and bugs at our Gitea instance — "migrate git dependencies to Gitea mirror". Nothing else moved. origin is still GitHub, the published @pezkuwi/phishing still says GitHub, and git.pezkuwichain.io/pezkuwichain/phishing answers 500, so everyone who installs the package has been given a dead homepage and a dead bug tracker. It also broke the Master build on 2026-09-13, when the toolchain began reading the field. @pezkuwi/dev, which is ours, does this: const repoPath = pkg.repository.url .split('https://github.com/')[1] .split('.git')[0]; A URL from any other host makes [1] undefined and the build dies with "Cannot read properties of undefined (reading 'split')" — a message that names neither the field nor the file. Three runs failed that way and master has had no green build since. The metadata now says what is true today. This is not a decision about where the project should live: it is an alignment with where the code already is and with what we already publish. That migration is still worth finishing, and this is the sequencing it needs. Moving the repository to Gitea for real means fixing @pezkuwi/dev first, so a toolchain built for a state that hosts its own git stops assuming github.com. scripts/checkRepoMeta.mjs is the tripwire: it fails the metadata here rather than letting it surface as an unreadable stack trace or ship as a dead link. The check runs in the Lists workflow, which has no toolchain to install and so still runs when the build does not. Nails: restoring the April commit turns three cases red, migrating only half the repository turns two red, and leaving homepage behind on the old host turns one red. Co-Authored-By: Claude Opus 5 (1M context) * Hold the new check to the repository's own lint rules The file I added failed all seven of them and lint had been green: the licence header every file here carries, import order, an optional chain, object keys in ascending order and an argument on its own line. Verified with eslint run the way CI runs it, without --fix. Co-Authored-By: Claude Opus 5 (1M context) --------- Co-authored-by: Claude Opus 5 (1M context) --- .github/workflows/lists.yml | 6 ++ package.json | 6 +- packages/phishing/package.json | 6 +- scripts/checkRepoMeta.mjs | 108 +++++++++++++++++++++++++++++++++ 4 files changed, 120 insertions(+), 6 deletions(-) create mode 100644 scripts/checkRepoMeta.mjs diff --git a/.github/workflows/lists.yml b/.github/workflows/lists.yml index da0a2dd1e..892007044 100644 --- a/.github/workflows/lists.yml +++ b/.github/workflows/lists.yml @@ -28,6 +28,12 @@ jobs: run: node --test scripts/lists.test.mjs - name: The committed lists run: node scripts/checkLists.mjs + # What the repository says about itself: the build toolchain reads + # repository.url and dies on a host it cannot parse, and a wrong homepage + # ships to everyone who installs the package. This lives here rather than + # in the build job because it must run even when the build cannot. + - name: The repository's own metadata + run: node scripts/checkRepoMeta.mjs # What phishing.pezkuwichain.io runs before it serves a new master: against a scratch # repository and web root, with these lists. - name: The host's publish checks diff --git a/package.json b/package.json index f3ed8f0d7..daeb871ab 100644 --- a/package.json +++ b/package.json @@ -1,16 +1,16 @@ { "author": "Dijital Kurdistan Tech Inst ", - "bugs": "https://git.pezkuwichain.io/pezkuwichain/phishing/issues", + "bugs": "https://github.com/pezkuwichain/phishing/issues", "engines": { "node": ">=18.14" }, - "homepage": "https://git.pezkuwichain.io/pezkuwichain/phishing#readme", + "homepage": "https://github.com/pezkuwichain/phishing#readme", "license": "Apache-2.0", "packageManager": "yarn@4.6.0", "private": true, "repository": { "type": "git", - "url": "https://git.pezkuwichain.io/pezkuwichain/phishing.git" + "url": "https://github.com/pezkuwichain/phishing.git" }, "sideEffects": false, "type": "module", diff --git a/packages/phishing/package.json b/packages/phishing/package.json index 871dd2cf7..1d66ec5ed 100644 --- a/packages/phishing/package.json +++ b/packages/phishing/package.json @@ -1,17 +1,17 @@ { "author": "Dijital Kurdistan Tech Inst ", - "bugs": "https://git.pezkuwichain.io/pezkuwichain/phishing/issues", + "bugs": "https://github.com/pezkuwichain/phishing/issues", "description": "Simple phishing scripts from a central source", "engines": { "node": ">=18" }, - "homepage": "https://git.pezkuwichain.io/pezkuwichain/phishing/tree/master/packages/phishing#readme", + "homepage": "https://github.com/pezkuwichain/phishing/tree/master/packages/phishing#readme", "license": "Apache-2.0", "name": "@pezkuwi/phishing", "repository": { "directory": "packages/phishing", "type": "git", - "url": "https://git.pezkuwichain.io/pezkuwichain/phishing.git" + "url": "https://github.com/pezkuwichain/phishing.git" }, "sideEffects": [ "./packageDetect.js", diff --git a/scripts/checkRepoMeta.mjs b/scripts/checkRepoMeta.mjs new file mode 100644 index 000000000..984fc721b --- /dev/null +++ b/scripts/checkRepoMeta.mjs @@ -0,0 +1,108 @@ +// Copyright 2020-2026 @pezkuwi/phishing authors & contributors +// SPDX-License-Identifier: Apache-2.0 + +// What this repository says about itself must be true, and must be something the +// build toolchain can read. +// +// On 2026-04-21 a commit pointed repository/homepage/bugs at our Gitea instance +// ("migrate git dependencies to Gitea mirror"). Nothing else moved: origin is +// still GitHub, the published package still says GitHub, and +// git.pezkuwichain.io/pezkuwichain/phishing answers 500 — so every installer of +// @pezkuwi/phishing got dead links for its homepage and its bug tracker. +// +// It also broke `yarn build` from 2026-09-13, when the toolchain started reading +// the field. @pezkuwi/dev does this, and it is ours: +// +// const repoPath = pkg.repository.url +// .split('https://github.com/')[1] +// .split('.git')[0]; +// +// A URL from any other host makes [1] undefined and the build dies with +// "Cannot read properties of undefined (reading 'split')" — a message that names +// neither the field nor the file. +// +// So this check is also the tripwire for the migration that was started and left +// half-done: moving this repository to Gitea for real means fixing @pezkuwi/dev +// first, so that a toolchain built for a state that hosts its own git stops +// assuming github.com. Until that happens, this check turns the metadata red +// here rather than letting it fail as an unreadable stack trace, or ship as a +// dead link. +// +// node scripts/checkRepoMeta.mjs + +import { execFileSync } from 'node:child_process'; +import { existsSync, readdirSync, readFileSync } from 'node:fs'; + +const errors = []; + +function check (name, ok, detail) { + console.log((ok ? 'ok ' : 'FAIL ') + name + (ok ? '' : ` — got: ${JSON.stringify(detail)}`)); + + if (!ok) { + errors.push(name); + } +} + +// Exactly the expression @pezkuwi/dev uses, so this fails where the build fails. +function toolchainCanRead (url) { + try { + const path = String(url).split('https://github.com/')[1].split('.git')[0]; + + return !!path && path.includes('/'); + } catch { + return false; + } +} + +const files = ['package.json']; + +for (const dir of readdirSync('packages', { withFileTypes: true })) { + if (dir.isDirectory() && existsSync(`packages/${dir.name}/package.json`)) { + files.push(`packages/${dir.name}/package.json`); + } +} + +check('every package describes itself', files.length > 1, files); + +const hosts = new Set(); + +for (const file of files) { + const pkg = JSON.parse(readFileSync(file, 'utf8')); + const url = pkg.repository?.url; + + check(`${file}: has a repository url`, !!url, pkg.repository); + check(`${file}: the build toolchain can read that url`, toolchainCanRead(url), url); + check(`${file}: homepage and bugs live on the same host as the repository`, + !!url && !!pkg.homepage && !!pkg.bugs && + new URL(pkg.homepage).host === new URL(url).host && + new URL(String(pkg.bugs)).host === new URL(url).host, + { bugs: pkg.bugs, homepage: pkg.homepage, url }); + + if (url) { + hosts.add(new URL(url).host); + } +} + +check('the whole repository agrees on one host', hosts.size === 1, [...hosts]); + +// And that host is where the code actually is. Without this the metadata can be +// internally consistent and still point somewhere the code has never been. +let origin = ''; + +try { + origin = execFileSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf8' }).trim(); +} catch { + origin = ''; +} + +if (origin) { + check('the metadata names the remote the code is actually pushed to', + hosts.has(new URL(origin.replace(/^git@([^:]+):/, 'https://$1/')).host), + { hosts: [...hosts], origin } + ); +} else { + console.log('ok (no origin remote here — nothing to compare against)'); +} + +console.log(errors.length ? `FAILED: ${errors.length}` : 'all repository metadata checks passed'); +process.exit(errors.length ? 1 : 0);