)]}'
{"jenkins/jobs/javascript.yaml":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"9191fc5d6dd0989cc6118a551353637c46abd43c","unresolved":false,"context_lines":[{"line_number":49,"context_line":"      - gerrit-git-prep"},{"line_number":50,"context_line":"      - shell: |"},{"line_number":51,"context_line":"          npm install"},{"line_number":52,"context_line":"          npm publish"},{"line_number":53,"context_line":"      - assert-no-extra-files"},{"line_number":54,"context_line":"    publishers:"},{"line_number":55,"context_line":"      - console-log"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a4dcd0f_1829399e","line":52,"updated":"2015-08-06 17:16:37.000000000","message":"Ah, thanks.  So two problems here:\n1) This probably needs to actually run on the \u0027release\u0027 slave in order to have access to the credentials that npm publish will need.\n2) We can\u0027t run anything on the \u0027release\u0027 slave that might execute user supplied code.  Even though it\u0027s still code that has been merged into our repositories, we have a lot of repositories and we don\u0027t want our security to hinge on trusting all of them completely.\n\nThe solution to this in python (and also java) is to separate the build/publish steps so that the build step (which is potentially customizable) happens on a normal disposable node and the resulting tarball is SCP\u0027d to tarballs.o.o by jenkins.  Then the publish step happens as a second job on the release slave, and it runs only centrally managed (not user customizable) code that downloads that tarball then uploads it to pypi (or a maven repo in the case of java).","commit_id":"5349e57d12aad30ee22abd59d275ba35e5f158a3"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"f929f0a8273ca49add19070dc84c950afe440f51","unresolved":false,"context_lines":[{"line_number":49,"context_line":"      - gerrit-git-prep"},{"line_number":50,"context_line":"      - shell: |"},{"line_number":51,"context_line":"          npm install"},{"line_number":52,"context_line":"          npm publish"},{"line_number":53,"context_line":"      - assert-no-extra-files"},{"line_number":54,"context_line":"    publishers:"},{"line_number":55,"context_line":"      - console-log"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a50d1a3_b59c645e","line":52,"updated":"2015-07-30 19:52:35.000000000","message":"Do either of these commands execute any code from within the package or its dependencies itself?\n\nFor instance, \"python setup.py build\" provides hooks that can be used by the package to alter the behavior of the build process.","commit_id":"5349e57d12aad30ee22abd59d275ba35e5f158a3"},{"author":{"_account_id":9717,"name":"Michael Krotscheck","email":"krotscheck@gmail.com","username":"krotscheck"},"change_message_id":"e524992b48a165011e296ccddfa98cfb188286ee","unresolved":false,"context_lines":[{"line_number":49,"context_line":"      - gerrit-git-prep"},{"line_number":50,"context_line":"      - shell: |"},{"line_number":51,"context_line":"          npm install"},{"line_number":52,"context_line":"          npm publish"},{"line_number":53,"context_line":"      - assert-no-extra-files"},{"line_number":54,"context_line":"    publishers:"},{"line_number":55,"context_line":"      - console-log"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a50d1a3_e195fc3f","line":52,"in_reply_to":"3a50d1a3_4a6c2108","updated":"2015-08-02 21:13:53.000000000","message":"Here\u0027s a good example from the Ironic package (the postinstall script)\nhttp://git.openstack.org/cgit/openstack/ironic-webclient/tree/package.json#n6","commit_id":"5349e57d12aad30ee22abd59d275ba35e5f158a3"},{"author":{"_account_id":9717,"name":"Michael Krotscheck","email":"krotscheck@gmail.com","username":"krotscheck"},"change_message_id":"6f9afbcf2a0b25aad0778f617c24195a9337b969","unresolved":false,"context_lines":[{"line_number":49,"context_line":"      - gerrit-git-prep"},{"line_number":50,"context_line":"      - shell: |"},{"line_number":51,"context_line":"          npm install"},{"line_number":52,"context_line":"          npm publish"},{"line_number":53,"context_line":"      - assert-no-extra-files"},{"line_number":54,"context_line":"    publishers:"},{"line_number":55,"context_line":"      - console-log"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a50d1a3_4a6c2108","line":52,"in_reply_to":"3a50d1a3_b59c645e","updated":"2015-08-01 00:04:28.000000000","message":"Yes! So, these two shell commands hook into the npm build lifecycle, which is documented here: https://docs.npmjs.com/misc/scripts - a project may customize its own dependency management by using \u0027preinstall\u0027 or \u0027postinstall\u0027 scripts, and modify its release lifecycle by using \u0027prepublish\u0027 and \u0027postpublish\u0027 commands. The publish command itself, however, cannot be overridden.\n\nThe same goes for test, etc etc. The docs list it all. A simple use case might be \"uglify ./src/**/*.js\". A more complex example might use a tool like grunt or gulp to chain multiple actions: \"prepublish\": \"gulp package\"","commit_id":"5349e57d12aad30ee22abd59d275ba35e5f158a3"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"53c3fd5ccf8ebfbbbfb40076cd181c78cf8a7f21","unresolved":false,"context_lines":[{"line_number":147,"context_line":"    node: release"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"    builders:"},{"line_number":150,"context_line":"      - revoke-sudo"},{"line_number":151,"context_line":"      - gerrit-git-prep"},{"line_number":152,"context_line":"      - shell: |"},{"line_number":153,"context_line":"          /usr/local/jenkins/slave_scripts/npm-tarball-upload.sh {name} {tarball-site}"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1a4dcd0f_8726b714","line":150,"updated":"2015-08-10 23:24:30.000000000","message":"Don\u0027t need revoke-sudo here (it\u0027s a static slave, so we wouldn\u0027t make that kind of system change to it in a job; also I don\u0027t think it has sudo to start with).","commit_id":"ab7a3ad94732d4af9a27f285f0c4bfcd6ca99a2a"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"53c3fd5ccf8ebfbbbfb40076cd181c78cf8a7f21","unresolved":false,"context_lines":[{"line_number":148,"context_line":""},{"line_number":149,"context_line":"    builders:"},{"line_number":150,"context_line":"      - revoke-sudo"},{"line_number":151,"context_line":"      - gerrit-git-prep"},{"line_number":152,"context_line":"      - shell: |"},{"line_number":153,"context_line":"          /usr/local/jenkins/slave_scripts/npm-tarball-upload.sh {name} {tarball-site}"},{"line_number":154,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1a4dcd0f_a72173fe","line":151,"updated":"2015-08-10 23:24:30.000000000","message":"Also don\u0027t actually need to do a git checkout, so we can save some time here and remove this.","commit_id":"ab7a3ad94732d4af9a27f285f0c4bfcd6ca99a2a"}],"jenkins/scripts/npm-tarball-upload.sh":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"53c3fd5ccf8ebfbbbfb40076cd181c78cf8a7f21","unresolved":false,"context_lines":[{"line_number":24,"context_line":"FILENAME\u003d\"$PROJECT-$TAG.tgz\""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"rm -rf *tgz"},{"line_number":27,"context_line":"curl --fail -o $FILENAME https://$TARBALL_SITE/$PROJECT/$FILENAME"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"# Make sure we actually got a gzipped file"},{"line_number":30,"context_line":"file -b $FILENAME | grep gzip"}],"source_content_type":"text/x-sh","patch_set":5,"id":"1a4dcd0f_e70e9b8b","line":27,"updated":"2015-08-10 23:24:30.000000000","message":"Actually, it\u0027s \u0027http\u0027 only.  Long story.","commit_id":"ab7a3ad94732d4af9a27f285f0c4bfcd6ca99a2a"},{"author":{"_account_id":7069,"name":"Joshua Hesketh","email":"josh@nitrotech.org","username":"jhesketh"},"change_message_id":"36b22f5fcaa863095dba782b7554c46fa3ee17fa","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"# Perform an NPM publish of the provided package, without executing any"},{"line_number":33,"context_line":"# lifecycle scripts."},{"line_number":34,"context_line":"npm publish --ignore-scripts $filename"}],"source_content_type":"text/x-sh","patch_set":13,"id":"fa1b9901_a7a9a926","line":34,"updated":"2015-08-24 02:22:10.000000000","message":"should this be $FILENAME?","commit_id":"57ead77519e2d9b80ec5e75af17ed68085772409"}]}