ci: require --tag flag for release and validate it

`--tag` now must be explicitly specified rather than defaulting to `latest`. It is also validated to be one of the expected set of tags. There is a new `--tagCheck false` flag that will skip this in order to handle one-off custom tags if necessary in the future.

Apparently NPM requires that all releases have tags (defaulting to `latest` if not explicitly specified), so there is no way to choose **not** to push a new tag. That means that you can't push `10.0.x` and then push `9.0.x` without either using `v9-lts` or clobbering `latest`. The `--tag` requirement should hopefully enforce this restriction to avoid a potential release footgun.

Author: dgp1130

scripts/publish.ts

@@ -15,6 +15,7 @@ import build from './build';
 
 export interface PublishArgs {
   tag?: string;
+  tagCheck?: boolean;
   branchCheck?: boolean;
   versionCheck?: boolean;
   registry?: string;
@@ -41,6 +42,24 @@ function _exec(command: string, args: string[], opts: { cwd?: string }, logger:
   }
 }
 
+/** Returns whether or not the given tag is valid to be used. */
+function _tagCheck(tag: string) {
+  if (tag === 'latest') {
+    return; // Valid
+  }
+  if (tag === 'next') {
+    return; // Valid
+  }
+  if (/v\d+-lts/.test(tag)) {
+    return; // Valid
+  }
+
+  throw new Error(tags.oneLine`
+    --tag should be "latest", "next", or "vX-lts". Use \`--no-tagCheck false\`
+    to skip this check if necessary.
+  `);
+}
+
 
 function _branchCheck(args: PublishArgs, logger: logging.Logger) {
   logger.info('Checking branch...');
@@ -90,6 +109,18 @@ function _versionCheck(args: PublishArgs, logger: logging.Logger) {
 }
 
 export default async function (args: PublishArgs, logger: logging.Logger) {
+  const { tag } = args;
+  if (!tag) {
+    // NPM requires that all releases have a tag associated, defaulting to
+    // `latest`, so there is no way to allow a publish without a tag.
+    // https://github.com/npm/npm/issues/10625#issuecomment-162106553
+    throw new Error('--tag is required.');
+  }
+
+  if (args.tagCheck ?? true) {
+    _tagCheck(tag);
+  }
+
   if (args.branchCheck ?? true) {
     _branchCheck(args, logger);
   }
@@ -98,6 +129,9 @@ export default async function (args: PublishArgs, logger: logging.Logger) {
     _versionCheck(args, logger);
   }
 
+  // If no registry is provided, the wombat proxy should be used.
+  const registry = args.registry ?? wombat;
+
   logger.info('Building...');
   await build({}, logger.createChild('build'));
 
@@ -113,13 +147,7 @@ export default async function (args: PublishArgs, logger: logging.Logger) {
       .then(() => {
         logger.info(name);
 
-        const publishArgs = ['publish'];
-        if (args.tag) {
-          publishArgs.push('--tag', args.tag);
-        }
-
-        // If no registry is provided, the wombat proxy should be used.
-        publishArgs.push('--registry', args.registry ?? wombat);
+        const publishArgs = [ 'publish', '--tag', tag, '--registry', registry ];
 
         return _exec('npm', publishArgs, {
           cwd: pkg.dist,

tests/legacy-cli/e2e/setup/010-local-publish.ts

@@ -16,6 +16,8 @@ export default async function() {
   const pre = prerelease(packages['@angular/cli'].version);
   if (pre && pre.length > 0) {
     publishArgs.push('--tag', 'next');
+  } else {
+    publishArgs.push('--tag', 'latest');
   }
 
   await npm(...publishArgs);