bake-gem-github 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbf4137a4b137fec26486a02e3941687f2c5fc9ded9ab95eb95619657892e1ae
-  data.tar.gz: c4e2cf0281e703e2d2264e5b8f08420ba7afeb5f7819e075a196e9334f24a300
+  metadata.gz: 46cf12965bbeacaeb560e4ea719f9976543dca995fc1fde8a472ecb534327cd2
+  data.tar.gz: 0c8f8748fd2ef7c93bd3e6dd4ea185165db0e24209c8b33a176b0a58d00b9b41
 SHA512:
-  metadata.gz: 2996e3c56f916e0d367c6fc75e3b7d9a478d8a08ee4d6d9bd775412978965c8c83d0b2608655d5d0c23776ce29af835cfa8dea4ec23ffb9e1afb3d0cefb74069
-  data.tar.gz: 4b78a2dd8d672b8831b8408e59494832ef45afee93489e9f27dc4aa7aae593f541350133886fa2f7957e2befee20abd4faa92b9df0b110620db78cdd1c1b2b01
+  metadata.gz: 0db75dbe12482f9f9c601d6f2f8e473832186de8a1609e17f94b9c4876f90234e6273a4cf0d4a4a003ad9457591bd1d00f6aacb7de0bc5cddf621e61c76c5307
+  data.tar.gz: b0d57a706b49d95cccb9023efb014399c1039bc1a38528643e8aa7046516fe4341c2fdc9ac10d097a4429d23ecf7d19d6b5abdca5b3e048e3791eb80f9cda09d

data/context/getting-started.md

@@ -69,10 +69,14 @@ reviewers:
 
 Replace `your-org/managers` with your organization and team slug, for example `socketry/managers`. Individual user logins are also supported. Reviewers need at least read access to the repository. Setup resolves their GitHub IDs without changing repository access or team membership.
 
+Reviewer teams must have **Visible** visibility in GitHub team settings. Plan and apply reject **Secret** teams before changing any settings, because GitHub can silently discard them from the environment reviewer list. Setup does not change team visibility.
+
 GitHub accepts one to six users or teams, and **one approval from any listed reviewer or team member is sufficient**. It does not support a minimum environment approval count. The default two PR approvals are independent of this publishing approval.
 
 Create the environment and restrict its deployment branch as described above before running plan or apply with reviewers configured. The plan previews the current and desired environment settings. Apply replaces its reviewer list while preserving its wait timer, self-review prevention, administrator bypass setting, and deployment branch restrictions. Custom deployment protection rules are managed separately and are not modified. Reapplying an identical reviewer list leaves the environment unchanged.
 
+After updating the environment, apply reads its settings back and fails if the reviewer identities or preserved protections differ from the requested configuration. Reviewer order does not matter. Earlier updates may already have completed; inspect the environment in GitHub and rerun `gem:github:setup:plan` before retrying apply.
+
 Omitting `reviewers` leaves environment settings unmanaged, including any existing reviewer requirement. An empty list is rejected. To remove an existing requirement, change the environment settings explicitly in GitHub.
 
 The RubyGems Trusted Publisher must explicitly require the `rubygems` environment; leaving that field blank would allow this trusted publisher to authenticate jobs without the environment approval. Keep administrator bypass enabled if administrators should be able to explicitly authorize publication without a reviewer. Environment approvals are available for public repositories on GitHub Free.

data/lib/bake/gem/github/project.rb

@@ -157,6 +157,7 @@ module Bake
 				
 				# Return a read-only comparison of managed settings and current repository settings.
 				# @returns [Hash] Desired rules, existing rules, environments, optional environment changes, and expected Trusted Publisher settings. This does not verify RubyGems ownership or publisher configuration.
+				# @raises [RuntimeError] If a reviewer team is secret or belongs to another organization.
 				def doctor
 					{
 						desired_rules: Setup.rules(@config),
@@ -174,8 +175,9 @@ module Bake
 				
 				# Apply the named rulesets and configured reviewers for an existing environment. Invoke after reviewing doctor output.
 				# Preserves the environment's wait timer, self-review prevention, administrator bypass, and branch restrictions.
+				# Reads back updated environment settings to verify GitHub retained them.
 				# @returns [Hash] The desired ruleset payloads after successful application.
-				# @raises [RuntimeError] If more than one existing ruleset has a managed name.
+				# @raises [RuntimeError] If a reviewer team is unsuitable, managed rulesets are ambiguous, or environment verification fails. Earlier updates may already have completed.
 				# @raises [Bake::Gem::CommandExecutionError] If an API operation fails; earlier updates may already have completed.
 				def apply
 					changes = environment_changes
@@ -193,6 +195,9 @@ module Bake
 					
 					if changes && changes.fetch(:current) != changes.fetch(:desired)
 						write_api("repos/#{@repository}/#{environment_path}", changes.fetch(:desired), method: "PUT")
+						unless environment_settings == changes.fetch(:desired)
+							raise "GitHub did not retain the requested settings for environment #{changes.fetch(:name)}. Check its reviewers and protection rules in GitHub, then rerun gem:github:setup:plan."
+						end
 					end
 					
 					return rules
@@ -209,19 +214,26 @@ module Bake
 					return nil unless @config.key?("reviewers")
 					Setup.validate_reviewers(@config["reviewers"])
 					
+					current = environment_settings
+					reviewers = @config.fetch("reviewers").map{|name| resolve_reviewer(name)}.uniq.sort_by{|reviewer| reviewer.values_at(:type, :id)}
+					
+					return {name: @config.fetch("environment"), current: current, desired: current.merge(reviewers: reviewers)}
+				end
+				
+				# Read the environment settings, comparing reviewer identities independently of their order.
+				def environment_settings
 					environment = api(environment_path)
 					protections = environment.fetch("protection_rules").to_h{|rule| [rule.fetch("type"), rule]}
 					reviews = protections.fetch("required_reviewers", {})
-					current = {
+					reviewers = reviews.fetch("reviewers", []).map{|entry| {type: entry.fetch("type"), id: entry.fetch("reviewer").fetch("id")}}
+					
+					return {
 						wait_timer: protections.fetch("wait_timer", {}).fetch("wait_timer", 0),
 						prevent_self_review: reviews.fetch("prevent_self_review", false),
 						can_admins_bypass: environment.fetch("can_admins_bypass"),
 						deployment_branch_policy: environment.fetch("deployment_branch_policy"),
-						reviewers: reviews.fetch("reviewers", []).map{|entry| {type: entry.fetch("type"), id: entry.fetch("reviewer").fetch("id")}},
+						reviewers: reviewers.uniq.sort_by{|reviewer| reviewer.values_at(:type, :id)},
 					}
-					reviewers = @config.fetch("reviewers").map{|name| resolve_reviewer(name)}
-					
-					return {name: @config.fetch("environment"), current: current, desired: current.merge(reviewers: reviewers)}
 				end
 				
 				def resolve_reviewer(name)
@@ -235,6 +247,9 @@ module Bake
 						type = "User"
 					end
 					response = JSON.parse(readlines("gh", "api", path, chdir: @root).join)
+					if type == "Team" && response.fetch("privacy") == "secret"
+						raise "Reviewer team #{name} is Secret. Change its visibility to Visible in GitHub team settings before running setup."
+					end
 					
 					return {type: type, id: response.fetch("id")}
 				end

data/lib/bake/gem/github/version.rb

@@ -9,7 +9,7 @@ module Bake
 	module Gem
 		# GitHub pull request and release orchestration for bake-gem.
 		module GitHub
-			VERSION = "0.3.1"
+			VERSION = "0.4.0"
 		end
 	end
 end

data/readme.md

@@ -24,6 +24,10 @@ Please see the [project documentation](https://socketry.github.io/bake-gem-githu
 
 Please see the [project releases](https://socketry.github.io/bake-gem-github/releases/index) for all releases.
 
+### v0.4.0
+
+  - Reject Secret environment reviewer teams before applying release settings, and verify that GitHub retained the requested reviewers and existing protections after updating the environment.
+
 ### v0.3.1
 
   - Publish validated release PRs from pushes to the default branch, retaining the exact merged commit and environment approval without requiring `pull_request_target`.

data/releases.md

@@ -1,5 +1,9 @@
 # Releases
 
+## v0.4.0
+
+  - Reject Secret environment reviewer teams before applying release settings, and verify that GitHub retained the requested reviewers and existing protections after updating the environment.
+
 ## v0.3.1
 
   - Publish validated release PRs from pushes to the default branch, retaining the exact merged commit and environment approval without requiring `pull_request_target`.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem-github
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Samuel Williams

metadata.gz.sig

@@ -1,2 +1,4 @@
-
��iH��
��^�*�CK���$��_9#��G�~/�5�t�$
-㋏R5�  ����k��������3�C<j�g>b�i�"������Pkh�m}T2�;r���PV}|(gC�o�l���F�X䔅�SI�WY;���0�UԦ�h!*#�Z�@���5���*�=��&��Ϸ�S�@���Ȧ�vZ"��}�r�[��VG�[��1��V���h����
�\eB����6%w;*��7S����x�#D���6���ﻳ:@y|��ky��@�dV��&�G.z
.H��
+C�R�EDJ�X6C�����C0�5��5!�G�NXyA2hxv4�
+g|˒�ph%=�h݉�͒
+��=P�C���x��HP@9��#�C*����CT��
+06^��P��cg�l[�8nqGX^�Grdf �斉�C�v��0��?��wM=��>����H�[�b ����(g:&���-�6囀R�w���so#�yp(;