trust-setup.sh leaks its mktemp directory when npm publish fails #140

• Repository: pingdotgg/ts-rust
• Target commit: 39f80fa6ff68f42d06e58a56b41d5cd30e3c387d
• File: npm/trust-setup.sh:29

Summary

npm/trust-setup.sh creates a placeholder package directory with mktemp -d, writes package.json, and removes the directory only after a successful npm publish. The script runs with set -e, so a failed publish (e.g. E403) aborts before the rm -rf line, and there is no trap; the temp directory with the partial package is left behind on every failed run.

Affected code

npm/trust-setup.sh:

   21  [[ $(printf '%s\n' 11.15.0 "$npm_version" | sort -V | head -1) == 11.15.0 ]] ||
   22    { echo "npm $npm_version: npm trust needs 11.15.0 or later (npm install -g npm@11)" >&2; exit 1; }
   23  echo "npm user: $(npm whoami)"
   24  
   25  for name in "${packages[@]}"; do
   26    if npm view "$name" version > /dev/null 2>&1; then
   27      echo "$name is on npm"
   28    else
   29      dir=$(mktemp -d)
   30      cat > "$dir/package.json" << EOF
   31  {
   32    "name": "$name",
   33    "version": "0.0.0-placeholder",
   34    "description": "A Rust port of the TypeScript 7 compiler. Placeholder: not released yet.",
   35    "license": "MIT",
   36    "repository": { "type": "git", "url": "git+https://github.com/$repo.git" }
   37  }
   38  EOF
   39      (cd "$dir" && npm publish --access public --tag placeholder)
   40      rm -rf "$dir"
   41      echo "$name: placeholder 0.0.0-placeholder published"

Expected behavior

The temporary directory created for a placeholder package is removed on every exit path, including when npm publish fails.

Actual behavior

In npm/trust-setup.sh, dir=$(mktemp -d) creates a temporary directory, the placeholder publish runs inside that directory, and rm -rf "$dir" is placed after the publish. With set -euo pipefail, a failed npm publish aborts the script before the cleanup command, so the temporary directory is not released.

How to reproduce

Run npm/trust-setup.sh with a failing publish (e.g. E403); the script exits 1 and the mktemp directory is still present.

Root cause

npm/trust-setup.sh creates a placeholder package directory with mktemp -d, writes package.json, and removes the directory only after a successful npm publish. The script runs with set -e, so a failed publish (e.g. E403) aborts before the rm -rf line, and there is no trap; the temp directory with the partial package is left behind on every failed run.

Suggested fix

Install a cleanup trap right after mktemp:

dir=$(mktemp -d)
trap 'rm -rf "$dir"' EXIT INT TERM

so a failed npm publish removes the placeholder directory. Add a test with a failing publish that asserts the temp dir no longer exists.