Drop support for node earlier than 20 and fix a bunch of OSS supply chain vulnerabilities

.github/workflows/publish.yml

@@ -5,13 +5,13 @@ on:
   release:
     types: [published]
 
-jobs:
+permissions:
+  contents: read
 
-  publish:
-    name: Publish to NPM
+jobs:
+  prePublishPackageTest:
+    name: Prepublish package test
     runs-on: ubuntu-latest
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -20,9 +20,7 @@ jobs:
         uses: actions/cache@v4
         id: cacheNpm
         with:
-          path: |
-            ~/.npm
-            node_modules
+          path: ~/.npm
           key: npm-v22-${{ runner.os }}-refs/heads/main-${{ hashFiles('package.json') }}
 
       - name: Install Node.js and npm
@@ -31,24 +29,55 @@ jobs:
           node-version: 22.x
           registry-url: https://registry.npmjs.org
 
-      # Normally we have a guarantee that deps are already there, still it may not be the case when:
-      # - `main` build for same commit failed (and we still pushed tag manually)
-      # - We've pushed tag manually before `main` build finalized
       - name: Install dependencies
-        if: steps.cacheNpm.outputs.cache-hit != 'true'
-        run: |
-          npm update --no-save
-          npm update --save-dev --no-save
+        run: npm install
 
       # Store the name of the release
       # See https://stackoverflow.com/questions/58177786/get-the-current-pushed-tag-in-github-actions
       - run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
 
       - run: npm version $RELEASE_VERSION --no-git-tag-version
 
+      - name: Unit tests
+        run: npm test
+
+      - name: Verify package contents
+        run: npm pack --dry-run
+
+      - name: Build publish tarball
+        run: echo "PACKAGE_TGZ=$(npm pack --silent)" >> $GITHUB_ENV
+
+      - name: Packed install smoke test
+        run: node ./scripts/ci/pack-smoke.js
+        env:
+          PACKAGE_TGZ: ${{ env.PACKAGE_TGZ }}
+
+      - name: Upload tested tarball
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-package
+          path: ${{ env.PACKAGE_TGZ }}
+          if-no-files-found: error
+
+  npmPublish:
+    name: Publish to NPM
+    needs: prePublishPackageTest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download tested tarball
+        uses: actions/download-artifact@v4
+        with:
+          name: npm-package
+
+      - name: Install Node.js and npm
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+          registry-url: https://registry.npmjs.org
+
       - name: Publish new version
         # Note: Setting NODE_AUTH_TOKEN as job|workspace wide env var won't work
         #       as it appears actions/setup-node sets own value
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --access public --tag=latest
+        run: npm publish ./*.tgz --access public --tag=latest

.github/workflows/tests.yml

@@ -1,39 +1,116 @@
-name: Tests
+name: Validate
 
 on:
-  push:
   pull_request:
+    branches: [main]
+  push:
+    branches: [main]
 
 env:
   FORCE_COLOR: 1
 
 jobs:
-  linuxNode16:
-    name: '[Linux] [Node 16] Tests'
+  linuxNode22:
+    name: '[Linux] Node 22: Lint, Formatting, Unit & packaging tests'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 30
+
+      - name: Retrieve last main commit (for `git diff` purposes)
+        run: |
+          git checkout -b pr
+          git fetch --prune --depth=30 origin +refs/heads/main:refs/remotes/origin/main
+          git checkout main
+          git checkout pr
 
       - name: Retrieve dependencies from cache
         id: cacheNpm
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
-          path: |
-            ~/.npm
-            node_modules
-          key: npm-v16-${{ runner.os }}-${{ github.ref }}-${{ hashFiles('package.json') }}
-          restore-keys: npm-v16-${{ runner.os }}-${{ github.ref }}-
+          path: ~/.npm
+          key: npm-v22-${{ runner.os }}-${{ github.ref }}-${{ hashFiles('package.json') }}
+          restore-keys: |
+            npm-v22-${{ runner.os }}-${{ github.ref }}-
+            npm-v22-${{ runner.os }}-refs/heads/main-
 
       - name: Install Node.js and npm
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: 22.x
 
       - name: Install dependencies
-        if: steps.cacheNpm.outputs.cache-hit != 'true'
-        run: |
-          npm update --no-save
-          npm update --save-dev --no-save
+        run: npm install
+
+      - name: Validate formatting
+        run: npm run prettier-check:updated
+
+      - name: Validate lint rules
+        run: npm run lint:updated
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Verify package contents
+        run: npm pack --dry-run
+
+      - name: Packed install smoke test
+        run: node ./scripts/ci/pack-smoke.js
+
+  windowsNode22:
+    name: '[Windows] Node 22: Unit tests'
+    runs-on: windows-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Retrieve dependencies from cache
+        id: cacheNpm
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: npm-v20-${{ runner.os }}-${{ github.ref }}-${{ hashFiles('package.json') }}
+          restore-keys: |
+            npm-v20-${{ runner.os }}-${{ github.ref }}-
+            npm-v20-${{ runner.os }}-refs/heads/main-
+
+      - name: Install Node.js and npm
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Unit tests
+        run: npm test
+
+  linuxNode20:
+    name: '[Linux] Node 20: Unit tests'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Retrieve dependencies from cache
+        id: cacheNpm
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: npm-v20-${{ runner.os }}-${{ github.ref }}-${{ hashFiles('package.json') }}
+          restore-keys: |
+            npm-v20-${{ runner.os }}-${{ github.ref }}-
+            npm-v20-${{ runner.os }}-refs/heads/main-
+
+      - name: Install Node.js and npm
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+
+      - name: Install dependencies
+        run: npm install
+
       - name: Unit tests
         run: npm test

.gitignore

@@ -6,4 +6,4 @@ npm-debug.log
 package-lock.json
 yarn.lock
 node_modules
-.serverless
+.serverless

.npmignore

@@ -2,5 +2,7 @@
 /.editorconfig
 /.prettierignore
 /prettier.config.js
-/scripts/pkg
+/dist
+/.serverless
+/scripts
 /test

README.md

@@ -1,5 +1,16 @@
 This repository contains the code for Serverless Framework Compose.
 
+Compose requires Node.js 20 or later.
+
+There is no standalone binary version, the package is only available via NPM.
+
+```bash
+npm install -g @osls/compose
+osls-compose --help
+```
+
+Available commands: `osls-compose`, `oslsc`.
+
 Check out the [Serverless Framework Compose documentation](https://github.com/oss-serverless/serverless/blob/main/docs/guides/compose.md).
 
 <p align="center"><a href="https://github.com/oss-serverless/serverless/blob/main/docs/guides/compose.md"><img src="https://assets.website-files.com/6178ec21bdb27bb4cd52c72d/625d76707477fa1efbb3559d_blog%20header.png" width="600px"></a></p>

bin/serverless-compose

@@ -1,12 +1,33 @@
 #!/usr/bin/env node
 
-// Used to measure length of the whole command
-EvalError.$composeCommandStartTime = process.hrtime();
+'use strict';
 
-const { runComponents } = require('../src')
+// `EvalError` is used to not pollute global namespace but still have the value accessible globally
+const isMainModule = !EvalError.$composeCommandStartTime;
+if (isMainModule) EvalError.$composeCommandStartTime = process.hrtime();
 
+const isSupportedNodeVersion = require('../src/cli/is-supported-node-version');
+const minimumSupportedVersionMajor = 20;
+const minimumSupportedVersionMinor = 0;
 
-// Run
-;(async () => {
-  return runComponents()
-})();
+if (!isSupportedNodeVersion(process.version)) {
+  const composeVersion = require('../package.json').version;
+  process.stderr.write(
+    `Error: Serverless Framework Compose v${composeVersion} does not support ` +
+      `Node.js ${process.version}. Please upgrade Node.js to the latest ` +
+      `LTS release. Minimum supported version: ` +
+      `v${minimumSupportedVersionMajor}.${minimumSupportedVersionMinor}.0.\n`
+  );
+  process.exit(1);
+}
+
+const crashAsync = (error) => {
+  process.nextTick(() => {
+    throw error;
+  });
+};
+
+const { runComponents } = require('../src');
+
+// Compose is npm-only, so there is no standalone or local-fallback bootstrap path here.
+runComponents().catch(crashAsync);

components/framework/index.js

@@ -237,13 +237,6 @@ class ServerlessFramework {
       args.push('--region', this.inputs.region);
     }
 
-    // Patch required for standalone distribution of Serverless
-    // Needed because of the behavior of `pkg` when invoking itself via subprocess
-    // https://github.com/vercel/pkg/issues/897
-    if (command === 'serverless' && process.pkg) {
-      args = [process.pkg.entrypoint, ...args];
-    }
-
     this.context.logVerbose(`Running "${command} ${args.join(' ')}"`);
     return new Promise((resolve, reject) => {
       const child = spawn(command, args, {