ace-git-github 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: baa6f879ef34125b1099214ec6387d091ebbca80116f51c7ea4ea37fc9fc08a9
-  data.tar.gz: b7f37f202295ba924168e9b3e2f639c221bf93c63a8d2f6112a2fc243cdb8888
+  metadata.gz: 7712428a17c056a1d6ae36c9bad2c4ef2d90d083b03eed913ea16d83d9b99c6d
+  data.tar.gz: 76aa065c65412840d64a1cc3fc75c8c7b1e0649a7c9bcce8947b477a3e476c7b
 SHA512:
-  metadata.gz: 1f49e0c270b7235b7db93ecbeebef80a78ca5a9791959fae5f13b3d6e06c29576583c8f6a270654ffb7815f0703e5be5aaf41cae1c2e123dc80167d4fcf4e1ce
-  data.tar.gz: 770eec189bf46c9502bc405fbf0e5b1258c154e3a49a1467df4479f71c2118d29a2910c9830e2d78c5fbeb81e3239fd1c824aefa78f4b8cad8a9e99a7fca3513
+  metadata.gz: 702969a6a3841f315d52008046ce20323e18667ff035750be93f7305e5187ef529e879ec635daec64957a82b4b6d7a53ed7ce6b1bb7610f23b583d21af2439d3
+  data.tar.gz: 17331c5365f2fb16ec22464903c4342ad7e66a7d0342003844aca46c0b11c7826cd59a793a6351a945a35772489ee8a3481745cbff9014ee6a52171bae23cfe2

data/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-10-23
+
+### Added
+
+- Formal reviewer-owned, exact-head provider approval and read-only approval verification through the forge-neutral review flow; comments do not substitute for approval.
+
+
+### Fixed
+
+- Prove PAT/App user/App installation actors through authenticated GraphQL viewer instead of REST /user; classify unverifiable viewers and integration access refusals truthfully before approval.
+
 ## [0.4.0] - 2026-10-03
 
 ### Added

data/lib/ace/git/github/provider.rb

@@ -3,6 +3,7 @@
 require "digest"
 require "open3"
 require "json"
+require "ace/git/providers/formal_approval"
 require "uri"
 
 module Ace
@@ -510,6 +511,14 @@ end
           raise Ace::Git::ProviderMalformedOutputError, "Malformed GitHub repository file content: #{e.message}"
         end
 
+        def approve_pull_request(number:, expected_head:, body:, correlation:)
+          formal_approval.approve(number: number, expected_head: expected_head, body: body, correlation: correlation)
+        end
+
+        def pull_request_approval(number:, expected_head:, review_id:)
+          formal_approval.read(number: number, expected_head: expected_head, review_id: review_id)
+        end
+
         def create_pull_request_comment(number:, expected_head:, body:, correlation:)
           pr = verify_expected_head!(pull_request(number: number), expected_head)
           require_open_pr!(pr)
@@ -894,6 +903,41 @@ end
           )
         end
 
+        def formal_approval
+          request = lambda do |method, path, payload|
+            if path == :actor
+              formal_review_actor
+            else
+              gh_api(path, method: method, payload: payload)
+            end
+          end
+          Ace::Git::Providers::FormalApproval.new(provider: self, request: request,
+            list: ->(path) { gh_api_pages(path) })
+        end
+
+        # GitHub documents installation-token GraphQL viewer queries. Use the
+        # same configured credential for PAT/App user/App installation identities;
+        # REST /user is not an installation-token actor endpoint.
+        def formal_review_actor
+          result = gh_api("graphql", method: :post, global: true,
+            payload: {"query" => "query { viewer { login databaseId } }"})
+          viewer = result.is_a?(Hash) && result.dig("data", "viewer")
+          errors = result.is_a?(Hash) && result["errors"]
+          unless (!errors || errors == []) && viewer.is_a?(Hash) &&
+              viewer["databaseId"].is_a?(Integer) && viewer["databaseId"].positive? &&
+              viewer["login"].is_a?(String) && !viewer["login"].empty?
+            raise Ace::Git::ProviderUnsupportedCapabilityError,
+              "Configured GitHub credential cannot provide a verified GraphQL viewer actor; no approval performed"
+          end
+          {"id" => viewer["databaseId"], "login" => viewer["login"]}
+        rescue Ace::Git::ProviderAuthenticationError => error
+          if error.message.match?(/resource not accessible by integration/i)
+            raise Ace::Git::ProviderUnsupportedCapabilityError,
+              "Configured GitHub integration credential cannot verify its GraphQL viewer actor; no approval performed"
+          end
+          raise
+        end
+
         def gh_api_pages(suffix)
           data = gh_api(suffix, paginate: true)
           pages = data.is_a?(Array) ? data : nil
@@ -903,13 +947,13 @@ end
           pages.flatten(1)
         end
 
-        def gh_api(suffix, method: :get, body: nil, paginate: false)
+        def gh_api(suffix, method: :get, body: nil, paginate: false, payload: nil, global: false)
           target = Ace::Git::Atoms::ServerUrl.normalize(server.url)
           host, repository = target.split("/", 2)
           unless repository&.match?(%r{\A[^/]+/[^/]+\z})
             raise Ace::Git::ConfigError, "Invalid selected GitHub repository #{server.url}"
           end
-          args = ["repos/#{repository}/#{suffix}", "--hostname", host]
+          args = [global ? suffix : "repos/#{repository}/#{suffix}", "--hostname", host]
           args += ["--paginate", "--slurp"] if paginate
           stdin = nil
           if %i[post patch].include?(method)
@@ -917,7 +961,7 @@ end
             # command argument: argv leaks into process listings and
             # timeout errors, and huge review bodies exceed arg limits.
             args += ["-X", method.to_s.upcase, "--input", "-"]
-            stdin = JSON.generate(body: body)
+            stdin = JSON.generate(payload || {body: body})
           end
           result = CliExecutor.execute("api", args, timeout: timeout, runner: runner, stdin: stdin)
           classify_failure(result[:stderr], context: "api #{suffix}") unless result[:success]
@@ -1168,7 +1212,7 @@ end
           message = stderr.to_s
           if message.match?(PrFetcher::PR_NOT_FOUND_PATTERN)
             raise Ace::Git::ProviderObjectNotFoundError, "Object not found: #{context}: #{message}"
-          elsif message.match?(PrFetcher::AUTH_ERROR_PATTERN)
+          elsif message.match?(PrFetcher::AUTH_ERROR_PATTERN) || message.match?(/HTTP 40[13]|resource not accessible by integration/i)
             raise Ace::Git::ProviderAuthenticationError, "Not authenticated with GitHub: #{message}"
           elsif message.match?(/match[- ]head[- ]commit|head commit/i)
             raise Ace::Git::ProviderExpectedHeadConflictError,

data/lib/ace/git/github/version.rb

@@ -3,7 +3,7 @@
 module Ace
   module Git
     module Github
-      VERSION = "0.4.0"
+      VERSION = "0.5.0"
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-git-github
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-03 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-git
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.26'
+        version: '0.31'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.26'
+        version: '0.31'
 description: 'Implements the shared ace-git provider contract for GitHub: all `gh`
   CLI invocation, output parsing, authentication verification, and classified failure
   handling live behind one normalized evidence boundary.'