fix: handle git+ssh deps past pnpm 8.6.10 (#1350)

.aspect/workflows/config.yaml

@@ -57,6 +57,8 @@ workspaces:
                 without: true
     # Requires an auth token
     # - e2e/npm_translate_lock_auth:
+    # Requires an SSH token
+    # - e2e/npm_translate_lock_git+ssh:
     e2e/npm_translate_package_lock:
         icon: npm
         tasks:

.github/workflows/ci.yaml

@@ -79,7 +79,7 @@ jobs:
         runs-on: ubuntu-latest
         env:
             ASPECT_NPM_AUTH_TOKEN: ${{ secrets.ASPECT_NPM_AUTH_TOKEN }}
-            SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+            ASPECT_GHTESTER_SSH_KEY: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
         steps:
             - id: root
               run: echo "folder=." >> $GITHUB_OUTPUT
@@ -88,7 +88,7 @@ jobs:
             - id: git_dep_metadata
               run: echo "folder=e2e/git_dep_metadata" >> $GITHUB_OUTPUT
               # Don't run e2e/git_dep_metadata if there is no ssh key secret which is the case on forks.
-              if: env.SSH_PRIVATE_KEY != ''
+              if: env.ASPECT_GHTESTER_SSH_KEY != ''
             - id: js_image_docker
               run: echo "folder=e2e/js_image_docker" >> $GITHUB_OUTPUT
             - id: js_image_oci
@@ -103,6 +103,10 @@ jobs:
               run: echo "folder=e2e/npm_translate_lock_auth" >> $GITHUB_OUTPUT
               # Don't run e2e/npm_translate_lock_auth if there is no auth token secret which is the case on forks.
               if: env.ASPECT_NPM_AUTH_TOKEN != ''
+            - id: npm_translate_lock_git_ssh
+              run: echo "folder=e2e/npm_translate_lock_git+ssh" >> $GITHUB_OUTPUT
+              # Don't run e2e/npm_translate_lock_git+ssh if there is no ssh key secret which is the case on forks.
+              if: env.ASPECT_GHTESTER_SSH_KEY != ''
             - id: npm_translate_lock
               run: echo "folder=e2e/npm_translate_lock" >> $GITHUB_OUTPUT
             - id: npm_translate_lock_empty
@@ -248,10 +252,10 @@ jobs:
             # which exercises fetching a git repository via ssh.
             - uses: webfactory/ssh-agent@v0.8.0
               env:
-                  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-              if: env.SSH_PRIVATE_KEY != ''
+                  ASPECT_GHTESTER_SSH_KEY: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
+              if: env.ASPECT_GHTESTER_SSH_KEY != ''
               with:
-                  ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+                  ssh-private-key: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
 
             - name: Mount bazel caches
               uses: actions/cache@v3

e2e/npm_translate_lock_git+ssh/.aspect/rules/external_repository_action_cache/npm_translate_lock_LTE4Nzc1MDcwNjU=

@@ -0,0 +1,6 @@
+# @generated
+# Input hashes for repository rule npm_translate_lock(name = "npm", pnpm_lock = "//:pnpm-lock.yaml").
+# This file should be checked into version control along with the pnpm-lock.yaml file.
+.npmrc=664934919
+pnpm-lock.yaml=-43506523
+package.json=-1742353198

e2e/npm_translate_lock_git+ssh/.bazelignore

@@ -0,0 +1 @@
+node_modules/

e2e/npm_translate_lock_git+ssh/.bazeliskrc

@@ -0,0 +1 @@
+../../.bazeliskrc

e2e/npm_translate_lock_git+ssh/.bazelrc

@@ -0,0 +1,2 @@
+# import common bazelrc shared with e2e workspaces
+import %workspace%/../../.bazelrc.common

e2e/npm_translate_lock_git+ssh/.bazelversion

@@ -0,0 +1 @@
+../../.bazelversion

e2e/npm_translate_lock_git+ssh/.npmrc

@@ -0,0 +1,4 @@
+# Disabling pnpm [hoisting](https://pnpm.io/npmrc#hoist) by setting `hoist=false` is recommended on
+# projects using rules_js so that pnpm outside of Bazel lays out a node_modules tree similar to what
+# rules_js lays out under Bazel (without a hidden node_modules/.pnpm/node_modules)
+hoist=false

e2e/npm_translate_lock_git+ssh/BUILD.bazel

@@ -0,0 +1,11 @@
+load("@bazel_skylib//rules:build_test.bzl", "build_test")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+npm_link_all_packages(name = "node_modules")
+
+build_test(
+    name = "test",
+    targets = [
+        ":node_modules",
+    ],
+)

e2e/npm_translate_lock_git+ssh/MODULE.bazel

@@ -0,0 +1,23 @@
+module(
+    name = "e2e_npm_translate_lock_git_ssh",
+    version = "0.0.0",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "bazel_skylib", version = "1.4.1")
+bazel_dep(name = "aspect_rules_js", version = "0.0.0")
+local_path_override(
+    module_name = "aspect_rules_js",
+    path = "../..",
+)
+
+npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
+npm.npm_translate_lock(
+    name = "npm",
+    data = ["//:package.json"],
+    npmrc = "//:.npmrc",
+    pnpm_lock = "//:pnpm-lock.yaml",
+    update_pnpm_lock = True,
+    verify_node_modules_ignored = "//:.bazelignore",
+)
+use_repo(npm, "npm")

e2e/npm_translate_lock_git+ssh/README.md

@@ -0,0 +1 @@
+# Integration test to cover git+ssh npm dependencies

e2e/npm_translate_lock_git+ssh/WORKSPACE

@@ -0,0 +1,30 @@
+local_repository(
+    name = "aspect_rules_js",
+    path = "../..",
+)
+
+load("@aspect_rules_js//js:repositories.bzl", "rules_js_dependencies")
+
+rules_js_dependencies()
+
+load("@rules_nodejs//nodejs:repositories.bzl", "DEFAULT_NODE_VERSION", "nodejs_register_toolchains")
+
+nodejs_register_toolchains(
+    name = "nodejs",
+    node_version = DEFAULT_NODE_VERSION,
+)
+
+load("@aspect_rules_js//npm:repositories.bzl", "npm_translate_lock")
+
+npm_translate_lock(
+    name = "npm",
+    data = ["//:package.json"],
+    npmrc = "//:.npmrc",
+    pnpm_lock = "//:pnpm-lock.yaml",
+    update_pnpm_lock = True,
+    verify_node_modules_ignored = "//:.bazelignore",
+)
+
+load("@npm//:repositories.bzl", "npm_repositories")
+
+npm_repositories()

e2e/npm_translate_lock_git+ssh/WORKSPACE.bzlmod

@@ -0,0 +1,2 @@
+# The presence of this file causes WORKSPACE to be ignored when bzlmod is enabled.
+# See https://docs.google.com/document/d/1JtXIVnXyFZ4bmbiBCr5gsTH4-opZAFf5DMMb-54kES0/edit#heading=h.y054fjub9max

e2e/npm_translate_lock_git+ssh/package.json

@@ -0,0 +1,6 @@
+{
+    "private": true,
+    "dependencies": {
+        "@aspect-test/test-private-npm-package": "git+ssh://git@github.com:aspect-build/test-private-npm-package#a09b6c1084c15c0dcd230a7017aefee66e6bb9db"
+    }
+}

e2e/npm_translate_lock_git+ssh/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+packages:
+    - '.'

e2e/vendored_tarfile/MODULE.bazel

@@ -1,5 +1,5 @@
 module(
-    name = "e2e_npm_translate_lock_auth",
+    name = "e2e_vendored_tarfile",
     version = "0.0.0",
     compatibility_level = 1,
 )

npm/private/utils.bzl

@@ -269,7 +269,7 @@ def _npm_registry_download_url(package, version, registries, default_registry):
     )
 
 def _is_git_repository_url(url):
-    return url.startswith("git+ssh://") or url.startswith("git+https://")
+    return url.startswith("git+ssh://") or url.startswith("git+https://") or url.startswith("git@")
 
 def _to_registry_url(url):
     return "{}://{}".format(DEFAULT_REGISTRY_PROTOCOL, url) if url.find("//") == -1 else url