From 300f99e714591fed7721b137aecc3f40df0d9d6d Mon Sep 17 00:00:00 2001
From: Greg Magolan <gmagolan@gmail.com>
Date: Thu, 9 Nov 2023 18:39:47 -0800
Subject: [PATCH] fix: handle git+ssh deps past pnpm 8.6.10 (#1350)

---
 .aspect/workflows/config.yaml                 |  2 ++
 .github/workflows/ci.yaml                     | 14 +++++----
 .../npm_translate_lock_LTE4Nzc1MDcwNjU=       |  6 ++++
 e2e/npm_translate_lock_git+ssh/.bazelignore   |  1 +
 e2e/npm_translate_lock_git+ssh/.bazeliskrc    |  1 +
 e2e/npm_translate_lock_git+ssh/.bazelrc       |  2 ++
 e2e/npm_translate_lock_git+ssh/.bazelversion  |  1 +
 e2e/npm_translate_lock_git+ssh/.npmrc         |  4 +++
 e2e/npm_translate_lock_git+ssh/BUILD.bazel    | 11 +++++++
 e2e/npm_translate_lock_git+ssh/MODULE.bazel   | 23 ++++++++++++++
 e2e/npm_translate_lock_git+ssh/README.md      |  1 +
 e2e/npm_translate_lock_git+ssh/WORKSPACE      | 30 +++++++++++++++++++
 .../WORKSPACE.bzlmod                          |  2 ++
 e2e/npm_translate_lock_git+ssh/package.json   |  6 ++++
 e2e/npm_translate_lock_git+ssh/pnpm-lock.yaml | 18 +++++++++++
 .../pnpm-workspace.yaml                       |  2 ++
 e2e/vendored_tarfile/MODULE.bazel             |  2 +-
 npm/private/utils.bzl                         |  2 +-
 18 files changed, 121 insertions(+), 7 deletions(-)
 create mode 100755 e2e/npm_translate_lock_git+ssh/.aspect/rules/external_repository_action_cache/npm_translate_lock_LTE4Nzc1MDcwNjU=
 create mode 100644 e2e/npm_translate_lock_git+ssh/.bazelignore
 create mode 120000 e2e/npm_translate_lock_git+ssh/.bazeliskrc
 create mode 100644 e2e/npm_translate_lock_git+ssh/.bazelrc
 create mode 120000 e2e/npm_translate_lock_git+ssh/.bazelversion
 create mode 100644 e2e/npm_translate_lock_git+ssh/.npmrc
 create mode 100644 e2e/npm_translate_lock_git+ssh/BUILD.bazel
 create mode 100644 e2e/npm_translate_lock_git+ssh/MODULE.bazel
 create mode 100644 e2e/npm_translate_lock_git+ssh/README.md
 create mode 100644 e2e/npm_translate_lock_git+ssh/WORKSPACE
 create mode 100644 e2e/npm_translate_lock_git+ssh/WORKSPACE.bzlmod
 create mode 100644 e2e/npm_translate_lock_git+ssh/package.json
 create mode 100644 e2e/npm_translate_lock_git+ssh/pnpm-lock.yaml
 create mode 100644 e2e/npm_translate_lock_git+ssh/pnpm-workspace.yaml

diff --git a/.aspect/workflows/config.yaml b/.aspect/workflows/config.yaml
index bd91a5e9b..d08d871a0 100644
--- a/.aspect/workflows/config.yaml
+++ b/.aspect/workflows/config.yaml
@@ -57,6 +57,8 @@ workspaces:
                 without: true
     # Requires an auth token
     # - e2e/npm_translate_lock_auth:
+    # Requires an SSH token
+    # - e2e/npm_translate_lock_git+ssh:
     e2e/npm_translate_package_lock:
         icon: npm
         tasks:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 907e391d3..7a08da072 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -79,7 +79,7 @@ jobs:
         runs-on: ubuntu-latest
         env:
             ASPECT_NPM_AUTH_TOKEN: ${{ secrets.ASPECT_NPM_AUTH_TOKEN }}
-            SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+            ASPECT_GHTESTER_SSH_KEY: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
         steps:
             - id: root
               run: echo "folder=." >> $GITHUB_OUTPUT
@@ -88,7 +88,7 @@ jobs:
             - id: git_dep_metadata
               run: echo "folder=e2e/git_dep_metadata" >> $GITHUB_OUTPUT
               # Don't run e2e/git_dep_metadata if there is no ssh key secret which is the case on forks.
-              if: env.SSH_PRIVATE_KEY != ''
+              if: env.ASPECT_GHTESTER_SSH_KEY != ''
             - id: js_image_docker
               run: echo "folder=e2e/js_image_docker" >> $GITHUB_OUTPUT
             - id: js_image_oci
@@ -103,6 +103,10 @@ jobs:
               run: echo "folder=e2e/npm_translate_lock_auth" >> $GITHUB_OUTPUT
               # Don't run e2e/npm_translate_lock_auth if there is no auth token secret which is the case on forks.
               if: env.ASPECT_NPM_AUTH_TOKEN != ''
+            - id: npm_translate_lock_git_ssh
+              run: echo "folder=e2e/npm_translate_lock_git+ssh" >> $GITHUB_OUTPUT
+              # Don't run e2e/npm_translate_lock_git+ssh if there is no ssh key secret which is the case on forks.
+              if: env.ASPECT_GHTESTER_SSH_KEY != ''
             - id: npm_translate_lock
               run: echo "folder=e2e/npm_translate_lock" >> $GITHUB_OUTPUT
             - id: npm_translate_lock_empty
@@ -248,10 +252,10 @@ jobs:
             # which exercises fetching a git repository via ssh.
             - uses: webfactory/ssh-agent@v0.8.0
               env:
-                  SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-              if: env.SSH_PRIVATE_KEY != ''
+                  ASPECT_GHTESTER_SSH_KEY: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
+              if: env.ASPECT_GHTESTER_SSH_KEY != ''
               with:
-                  ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+                  ssh-private-key: ${{ secrets.ASPECT_GHTESTER_SSH_KEY }}
 
             - name: Mount bazel caches
               uses: actions/cache@v3
diff --git a/e2e/npm_translate_lock_git+ssh/.aspect/rules/external_repository_action_cache/npm_translate_lock_LTE4Nzc1MDcwNjU= b/e2e/npm_translate_lock_git+ssh/.aspect/rules/external_repository_action_cache/npm_translate_lock_LTE4Nzc1MDcwNjU=
new file mode 100755
index 000000000..d5125f06a
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/.aspect/rules/external_repository_action_cache/npm_translate_lock_LTE4Nzc1MDcwNjU=
@@ -0,0 +1,6 @@
+# @generated
+# Input hashes for repository rule npm_translate_lock(name = "npm", pnpm_lock = "//:pnpm-lock.yaml").
+# This file should be checked into version control along with the pnpm-lock.yaml file.
+.npmrc=664934919
+pnpm-lock.yaml=-43506523
+package.json=-1742353198
diff --git a/e2e/npm_translate_lock_git+ssh/.bazelignore b/e2e/npm_translate_lock_git+ssh/.bazelignore
new file mode 100644
index 000000000..40b878db5
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/.bazelignore
@@ -0,0 +1 @@
+node_modules/
\ No newline at end of file
diff --git a/e2e/npm_translate_lock_git+ssh/.bazeliskrc b/e2e/npm_translate_lock_git+ssh/.bazeliskrc
new file mode 120000
index 000000000..0fbe20ff6
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/.bazeliskrc
@@ -0,0 +1 @@
+../../.bazeliskrc
\ No newline at end of file
diff --git a/e2e/npm_translate_lock_git+ssh/.bazelrc b/e2e/npm_translate_lock_git+ssh/.bazelrc
new file mode 100644
index 000000000..5128b1b4c
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/.bazelrc
@@ -0,0 +1,2 @@
+# import common bazelrc shared with e2e workspaces
+import %workspace%/../../.bazelrc.common
diff --git a/e2e/npm_translate_lock_git+ssh/.bazelversion b/e2e/npm_translate_lock_git+ssh/.bazelversion
new file mode 120000
index 000000000..96cf94962
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/.bazelversion
@@ -0,0 +1 @@
+../../.bazelversion
\ No newline at end of file
diff --git a/e2e/npm_translate_lock_git+ssh/.npmrc b/e2e/npm_translate_lock_git+ssh/.npmrc
new file mode 100644
index 000000000..5de6efae1
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/.npmrc
@@ -0,0 +1,4 @@
+# Disabling pnpm [hoisting](https://pnpm.io/npmrc#hoist) by setting `hoist=false` is recommended on
+# projects using rules_js so that pnpm outside of Bazel lays out a node_modules tree similar to what
+# rules_js lays out under Bazel (without a hidden node_modules/.pnpm/node_modules)
+hoist=false
diff --git a/e2e/npm_translate_lock_git+ssh/BUILD.bazel b/e2e/npm_translate_lock_git+ssh/BUILD.bazel
new file mode 100644
index 000000000..7691ba4fd
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/BUILD.bazel
@@ -0,0 +1,11 @@
+load("@bazel_skylib//rules:build_test.bzl", "build_test")
+load("@npm//:defs.bzl", "npm_link_all_packages")
+
+npm_link_all_packages(name = "node_modules")
+
+build_test(
+    name = "test",
+    targets = [
+        ":node_modules",
+    ],
+)
diff --git a/e2e/npm_translate_lock_git+ssh/MODULE.bazel b/e2e/npm_translate_lock_git+ssh/MODULE.bazel
new file mode 100644
index 000000000..b0245edb5
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/MODULE.bazel
@@ -0,0 +1,23 @@
+module(
+    name = "e2e_npm_translate_lock_git_ssh",
+    version = "0.0.0",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "bazel_skylib", version = "1.4.1")
+bazel_dep(name = "aspect_rules_js", version = "0.0.0")
+local_path_override(
+    module_name = "aspect_rules_js",
+    path = "../..",
+)
+
+npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
+npm.npm_translate_lock(
+    name = "npm",
+    data = ["//:package.json"],
+    npmrc = "//:.npmrc",
+    pnpm_lock = "//:pnpm-lock.yaml",
+    update_pnpm_lock = True,
+    verify_node_modules_ignored = "//:.bazelignore",
+)
+use_repo(npm, "npm")
diff --git a/e2e/npm_translate_lock_git+ssh/README.md b/e2e/npm_translate_lock_git+ssh/README.md
new file mode 100644
index 000000000..c2cc2b300
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/README.md
@@ -0,0 +1 @@
+# Integration test to cover git+ssh npm dependencies
diff --git a/e2e/npm_translate_lock_git+ssh/WORKSPACE b/e2e/npm_translate_lock_git+ssh/WORKSPACE
new file mode 100644
index 000000000..8e31b6545
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/WORKSPACE
@@ -0,0 +1,30 @@
+local_repository(
+    name = "aspect_rules_js",
+    path = "../..",
+)
+
+load("@aspect_rules_js//js:repositories.bzl", "rules_js_dependencies")
+
+rules_js_dependencies()
+
+load("@rules_nodejs//nodejs:repositories.bzl", "DEFAULT_NODE_VERSION", "nodejs_register_toolchains")
+
+nodejs_register_toolchains(
+    name = "nodejs",
+    node_version = DEFAULT_NODE_VERSION,
+)
+
+load("@aspect_rules_js//npm:repositories.bzl", "npm_translate_lock")
+
+npm_translate_lock(
+    name = "npm",
+    data = ["//:package.json"],
+    npmrc = "//:.npmrc",
+    pnpm_lock = "//:pnpm-lock.yaml",
+    update_pnpm_lock = True,
+    verify_node_modules_ignored = "//:.bazelignore",
+)
+
+load("@npm//:repositories.bzl", "npm_repositories")
+
+npm_repositories()
diff --git a/e2e/npm_translate_lock_git+ssh/WORKSPACE.bzlmod b/e2e/npm_translate_lock_git+ssh/WORKSPACE.bzlmod
new file mode 100644
index 000000000..3a956c2b7
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/WORKSPACE.bzlmod
@@ -0,0 +1,2 @@
+# The presence of this file causes WORKSPACE to be ignored when bzlmod is enabled.
+# See https://docs.google.com/document/d/1JtXIVnXyFZ4bmbiBCr5gsTH4-opZAFf5DMMb-54kES0/edit#heading=h.y054fjub9max
diff --git a/e2e/npm_translate_lock_git+ssh/package.json b/e2e/npm_translate_lock_git+ssh/package.json
new file mode 100644
index 000000000..1a4a08412
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/package.json
@@ -0,0 +1,6 @@
+{
+    "private": true,
+    "dependencies": {
+        "@aspect-test/test-private-npm-package": "git+ssh://git@github.com:aspect-build/test-private-npm-package#a09b6c1084c15c0dcd230a7017aefee66e6bb9db"
+    }
+}
diff --git a/e2e/npm_translate_lock_git+ssh/pnpm-lock.yaml b/e2e/npm_translate_lock_git+ssh/pnpm-lock.yaml
new file mode 100644
index 000000000..66bff4ae9
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/pnpm-lock.yaml
@@ -0,0 +1,18 @@
+lockfileVersion: '6.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+dependencies:
+  '@aspect-test/test-private-npm-package':
+    specifier: git+ssh://git@github.com:aspect-build/test-private-npm-package#a09b6c1084c15c0dcd230a7017aefee66e6bb9db
+    version: git@github.com+aspect-build/test-private-npm-package/a09b6c1084c15c0dcd230a7017aefee66e6bb9db
+
+packages:
+
+  git@github.com+aspect-build/test-private-npm-package/a09b6c1084c15c0dcd230a7017aefee66e6bb9db:
+    resolution: {commit: a09b6c1084c15c0dcd230a7017aefee66e6bb9db, repo: git@github.com:aspect-build/test-private-npm-package.git, type: git}
+    name: '@aspect-test/test-private-npm-package'
+    version: 1.0.0
+    dev: false
diff --git a/e2e/npm_translate_lock_git+ssh/pnpm-workspace.yaml b/e2e/npm_translate_lock_git+ssh/pnpm-workspace.yaml
new file mode 100644
index 000000000..2cce0eb74
--- /dev/null
+++ b/e2e/npm_translate_lock_git+ssh/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+packages:
+    - '.'
diff --git a/e2e/vendored_tarfile/MODULE.bazel b/e2e/vendored_tarfile/MODULE.bazel
index 89961d506..100df1f0d 100644
--- a/e2e/vendored_tarfile/MODULE.bazel
+++ b/e2e/vendored_tarfile/MODULE.bazel
@@ -1,5 +1,5 @@
 module(
-    name = "e2e_npm_translate_lock_auth",
+    name = "e2e_vendored_tarfile",
     version = "0.0.0",
     compatibility_level = 1,
 )
diff --git a/npm/private/utils.bzl b/npm/private/utils.bzl
index fa23747d7..1c0c8e00c 100644
--- a/npm/private/utils.bzl
+++ b/npm/private/utils.bzl
@@ -269,7 +269,7 @@ def _npm_registry_download_url(package, version, registries, default_registry):
     )
 
 def _is_git_repository_url(url):
-    return url.startswith("git+ssh://") or url.startswith("git+https://")
+    return url.startswith("git+ssh://") or url.startswith("git+https://") or url.startswith("git@")
 
 def _to_registry_url(url):
     return "{}://{}".format(DEFAULT_REGISTRY_PROTOCOL, url) if url.find("//") == -1 else url