From 37d12730abde3cce8f4e5148a16420ead9252b96 Mon Sep 17 00:00:00 2001
From: Marco Ippolito <marcoippolito54@gmail.com>
Date: Sun, 9 Apr 2023 20:23:04 +0200
Subject: [PATCH] tools: automate cjs-module-lexer dependency update

PR-URL: https://github.com/nodejs/node/pull/47446
Refs: https://github.com/nodejs/security-wg/issues/828
Reviewed-By: Debadree Chatterjee <debadree333@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 .github/workflows/tools.yml                   |  8 +++
 tools/dep_updaters/update-cjs-module-lexer.sh | 63 +++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100755 tools/dep_updaters/update-cjs-module-lexer.sh

diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 7be4065ba9a87f..e3af7ab3a15009 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -172,6 +172,14 @@ jobs:
             label: crypto, notable-change
             run: |
               node ./tools/dep_updaters/update-root-certs.mjs -v -f "$GITHUB_ENV"
+          - id: cjs-module-lexer
+            subsystem: deps
+            label: dependencies
+            run: |
+              ./tools/dep_updaters/update-cjs-module-lexer.sh > temp-output
+              cat temp-output
+              tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
+              rm temp-output
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c  # v3.3.0
         with:
diff --git a/tools/dep_updaters/update-cjs-module-lexer.sh b/tools/dep_updaters/update-cjs-module-lexer.sh
new file mode 100755
index 00000000000000..6bb3a5f4ad2d5f
--- /dev/null
+++ b/tools/dep_updaters/update-cjs-module-lexer.sh
@@ -0,0 +1,63 @@
+#!/bin/sh
+set -e
+# Shell script to update cjs-module-lexer in the source tree to a specific version
+
+BASE_DIR=$(cd "$(dirname "$0")/../.." && pwd)
+
+DEPS_DIR="$BASE_DIR/deps"
+[ -z "$NODE" ] && NODE="$BASE_DIR/out/Release/node"
+[ -x "$NODE" ] || NODE=$(command -v node)
+
+NPM="$DEPS_DIR/npm/bin/npm-cli.js"
+
+NEW_VERSION="$("$NODE" --input-type=module <<'EOF'
+const res = await fetch('https://api.github.com/repos/nodejs/cjs-module-lexer/tags');
+if (!res.ok) throw new Error(`FetchError: ${res.status} ${res.statusText}`, { cause: res });
+const tags = await res.json();
+const { name } = tags.at(0)
+console.log(name);
+EOF
+)"
+
+CURRENT_VERSION=$("$NODE" -p "require('./deps/cjs-module-lexer/package.json').version")
+
+echo "Comparing $NEW_VERSION with $CURRENT_VERSION"
+
+if [ "$NEW_VERSION" = "$CURRENT_VERSION" ]; then
+  echo "Skipped because ada is on the latest version."
+  exit 0
+fi
+
+echo "Making temporary workspace"
+
+WORKSPACE=$(mktemp -d 2> /dev/null || mktemp -d -t 'tmp')
+
+cleanup () {
+  EXIT_CODE=$?
+  [ -d "$WORKSPACE" ] && rm -rf "$WORKSPACE"
+  exit $EXIT_CODE
+}
+
+trap cleanup INT TERM EXIT
+
+cd "$WORKSPACE"
+
+"$NODE" "$NPM" init --yes
+
+"$NODE" "$NPM" install --global-style --no-bin-links --ignore-scripts cjs-module-lexer
+
+rm -rf "$DEPS_DIR/cjs-module-lexer"
+
+mv node_modules/cjs-module-lexer "$DEPS_DIR/cjs-module-lexer"
+
+echo "All done!"
+echo ""
+echo "Please git add cjs-module-lexer, commit the new version:"
+echo ""
+echo "$ git add -A deps/cjs-module-lexer"
+echo "$ git commit -m \"deps: update cjs-module-lexer to $NEW_VERSION\""
+echo ""
+
+# The last line of the script should always print the new version,
+# as we need to add it to $GITHUB_ENV variable.
+echo "NEW_VERSION=$NEW_VERSION"