@apex-actions/cli 0.67.0

package/dist/cli/migrate/main.js

@@ -0,0 +1,275 @@
+import { basename, resolve } from 'node:path';
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { scanOrganization } from '../../src/application/scan-migration.js';
+import { EngineBinaryCompat, LocalWorkflowSource } from '../../src/infrastructure/engine-binary.js';
+import { GitHubApi, NoTokenError } from '../../src/infrastructure/github-api.js';
+import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
+import { parseRepository } from '../../src/domain/runs.js';
+import { setterCommand } from '../../src/domain/secrets.js';
+import { comparisonLine, diffHeadline } from '../../src/domain/outcomediff.js';
+import { plural, proofLine, useLocation, verdictHeadline, } from '../../src/domain/migration.js';
+const collect = (value, previous) => [...previous, value];
+const statusColour = (verdict) => {
+    switch (verdict.status) {
+        case 'unsupported':
+            return chalk.red(verdict.status);
+        case 'partial':
+        case 'unknown':
+            return chalk.yellow(verdict.status);
+        default:
+            return chalk.green(verdict.status);
+    }
+};
+/**
+ * Print one group of verdicts.
+ *
+ * Every line carries what proves it. A verdict with no fixture says so in the
+ * same breath as the verdict — that is the whole point of reading the answers
+ * out of the conformance corpus rather than writing them here.
+ */
+const printVerdicts = (title, verdicts, limit) => {
+    if (verdicts.length === 0)
+        return;
+    console.log(chalk.bold(`\n${title}`));
+    for (const v of verdicts) {
+        console.log(`  ${statusColour(v)}  ${v.feature}  ${chalk.dim(`(${plural(v.uses.length, 'use')})`)}`);
+        console.log(chalk.dim(`    ${proofLine(v)}`));
+        // An unknown verdict's note only restates the line above it.
+        if (v.status !== 'unknown' && v.notes !== undefined && v.notes !== '')
+            console.log(chalk.dim(`    ${v.notes}`));
+        for (const use of v.uses.slice(0, limit))
+            console.log(chalk.dim(`    · ${useLocation(use)}`));
+        if (v.uses.length > limit)
+            console.log(chalk.dim(`    · … and ${v.uses.length - limit} more`));
+    }
+};
+const checklistLine = (entry) => {
+    const where = entry.repos === undefined ? (entry.scope ?? '') : entry.repos.join(', ');
+    return `  ${entry.name.padEnd(32)} ${entry.kind.padEnd(9)} ${chalk.dim(where)}`;
+};
+const printChecklist = (scan) => {
+    const { entries, configuredNamesRead } = scan.checklist;
+    if (entries.length === 0) {
+        console.log(chalk.dim('\nNo secrets or variables are referenced or configured.'));
+        return;
+    }
+    console.log(chalk.bold('\nRe-entry checklist'));
+    console.log(chalk.dim('Names only. No value leaves GitHub — not into this report, not into a log, not onto disk.'));
+    const group = (action, heading, withCommand = false) => {
+        const of = entries.filter((e) => e.action === action);
+        if (of.length === 0)
+            return;
+        console.log(`\n  ${heading}`);
+        for (const entry of of) {
+            console.log(checklistLine(entry));
+            // The second half of the checklist: not just what to set, but the command
+            // that sets it (TASK-0160). A secret's command reads the value from stdin,
+            // so nothing here ever suggests putting one on a command line.
+            if (withCommand)
+                console.log(chalk.dim(`    $ ${setterCommand(entry.kind, entry.name, entry.repos ?? [])}`));
+        }
+    };
+    group('re-enter', chalk.bold('Set these in Apex before the first run:'), true);
+    group('automatic', chalk.bold('Provided by the platform per job — nothing to re-enter:'));
+    group('unaccounted', chalk.bold('Read by a workflow, and not configured on GitHub — find out where these come from:'));
+    group('not-needed', chalk.bold('Configured on GitHub and read by none of these workflows:'));
+    if (!configuredNamesRead) {
+        console.log(chalk.yellow('\n  The names configured on GitHub were not read, so this list is what the workflows reference and nothing else.'));
+    }
+};
+const printScan = (scan, limit) => {
+    const { report } = scan;
+    const headline = verdictHeadline(scan.verdict);
+    console.log(chalk.bold(`${scan.organization} — ${headline}`));
+    console.log(chalk.dim(`${plural(report.summary.files, 'workflow file')} across ${plural(scan.repositories.length, 'repository', 'repositories')}` +
+        `, ${report.summary.unreadable} unreadable · ${report.corpus.title}`));
+    console.log(chalk.dim(`${report.summary.supported} supported · ${report.summary.partial} partial · ` +
+        `${report.summary.unsupported} unsupported · ${report.summary.unknown} unknown · ${report.summary.unproven} unproven`));
+    for (const file of report.files.filter((f) => !f.assessed)) {
+        console.log(chalk.red(`\n${file.path} could not be read, so nothing here covers it`));
+        for (const d of file.diagnostics ?? []) {
+            console.log(chalk.dim(`  ${d.line === undefined ? '' : `${d.line}: `}${d.severity}: ${d.message}`));
+        }
+    }
+    printVerdicts('Will not run — unsupported, and used here', report.blockers, limit);
+    printVerdicts('Runs, with a limit', report.caveats, limit);
+    printVerdicts('Cannot be proved either way — no row of the matrix claims it', report.unknown, limit);
+    printVerdicts('Claimed, with no fixture behind the claim', report.unproven, limit);
+    printVerdicts('Runs as-is', report.supported, limit);
+    if (report.not_used.length > 0) {
+        console.log(chalk.bold('\nLimits these workflows never reach'));
+        console.log(chalk.dim('Listed so the silence is legible: a caveat nobody hits is not a migration blocker.'));
+        for (const row of report.not_used)
+            console.log(chalk.dim(`  ${row.status.padEnd(12)} ${row.feature}`));
+    }
+    printChecklist(scan);
+    if (scan.archived.length > 0) {
+        console.log(chalk.dim(`\nSkipped ${plural(scan.archived.length, 'archived repository', 'archived repositories')}: ${scan.archived.join(', ')}`));
+    }
+    if (scan.withoutWorkflows.length > 0) {
+        console.log(chalk.dim(`${plural(scan.withoutWorkflows.length, 'repository', 'repositories')} with no workflow files: ${scan.withoutWorkflows.join(', ')}`));
+    }
+};
+/**
+ * Build the ports.
+ *
+ * `--path` scans a checkout on this machine and needs no token, which is the
+ * first thing somebody evaluating a migration wants: an answer about a
+ * repository they already have, without handing anybody credentials.
+ */
+const deps = (options) => {
+    const checker = new EngineBinaryCompat();
+    if (options.path !== undefined)
+        return { workflows: new LocalWorkflowSource(options.path), checker };
+    try {
+        const api = new GitHubApi();
+        return { workflows: api, checker, names: api };
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof NoTokenError ? err.message : String(err)));
+        process.exitCode = 2;
+        return undefined;
+    }
+};
+const handler = async (org, options) => {
+    if (org === undefined && options.path === undefined) {
+        console.error(chalk.red('name an organization, or pass --path to scan a checkout on this machine'));
+        process.exitCode = 2;
+        return;
+    }
+    const built = deps(options);
+    if (built === undefined)
+        return;
+    // A local scan has no organization. The directory's name is what the person
+    // running it calls the thing, so it is what the report is labelled with.
+    const label = org ?? basename(resolve(options.path ?? '.'));
+    const outcome = await scanOrganization(built, label, {
+        repos: options.repo.length > 0 ? options.repo : undefined,
+        includeNames: options.secrets,
+    });
+    switch (outcome.kind) {
+        case 'no-repositories':
+            console.error(chalk.yellow(`no repositories to scan for ${outcome.organization}`));
+            process.exitCode = 2;
+            return;
+        case 'no-workflows':
+            console.error(chalk.yellow(`no .github/workflows/*.yml in ${plural(outcome.repositories.length, 'repository', 'repositories')}`));
+            process.exitCode = 2;
+            return;
+        case 'engine-missing':
+            console.error(chalk.red(outcome.detail));
+            process.exitCode = 2;
+            return;
+        case 'refused':
+            console.error(chalk.red(outcome.message));
+            process.exitCode = 2;
+            return;
+        case 'scan':
+            if (options.json === true) {
+                console.log(JSON.stringify(outcome.scan, null, 2));
+            }
+            else {
+                printScan(outcome.scan, options.uses);
+            }
+            process.exitCode = outcome.ok ? 0 : 1;
+    }
+};
+const ScanCommand = new Command('scan')
+    .description("Report what an organization's workflows do on Apex Actions, and what each verdict is proved by")
+    .argument('[org]', 'GitHub organization to scan')
+    .option('--repo <owner/repo>', 'limit to this repository (repeatable)', collect, [])
+    .option('--path <dir>', 'scan a checkout on this machine instead of the GitHub API')
+    .option('--no-secrets', 'skip the secret and variable name import')
+    .option('--uses <n>', 'how many places to list per feature', (v) => Number.parseInt(v, 10), 3)
+    .option('--json', 'print the scan as JSON')
+    .action(handler);
+/**
+ * Coexistence: run both platforms on one repository, one workflow at a time.
+ *
+ * The order is the safe one and the command enforces nothing else: turn
+ * coexistence **on** first — from that moment Apex plans nothing here — then add
+ * workflows as you gain confidence in them. Doing it the other way round leaves
+ * a window in which everything runs on both, which is how a publishing workflow
+ * nearly pushed the same images twice (control-plane ADR-0046).
+ */
+const CoexistCommand = new Command('coexist')
+    .description('Run Apex beside GitHub Actions on one repository, opting workflows in one at a time')
+    .argument('<repository>', 'owner/repo')
+    .option('--on', 'turn coexistence on: Apex plans only opted-in workflows here')
+    .option('--off', 'turn it off: Apex is this repository’s CI and runs everything not disabled')
+    .option('--add <workflow...>', 'opt a workflow in, by path or file name')
+    .option('--remove <workflow...>', 'opt a workflow back out')
+    .option('--diff <sha>', 'compare both platforms’ outcomes for one commit')
+    .action(async (repository, opts) => {
+    const parsed = parseRepository(repository);
+    if (parsed === undefined) {
+        console.error(chalk.red(`repository must be owner/repo, got ${repository}`));
+        process.exitCode = 2;
+        return;
+    }
+    if (opts.on === true && opts.off === true) {
+        console.error(chalk.red('--on and --off contradict each other'));
+        process.exitCode = 2;
+        return;
+    }
+    const nothing = opts.on !== true &&
+        opts.off !== true &&
+        opts.diff === undefined &&
+        (opts.add ?? []).length === 0 &&
+        (opts.remove ?? []).length === 0;
+    if (nothing) {
+        console.error(chalk.red('nothing to do: pass --on, --off, --add or --remove'));
+        process.exitCode = 2;
+        return;
+    }
+    let api;
+    try {
+        api = new HttpControlPlane();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof NotConfiguredError ? err.message : String(err)));
+        process.exitCode = 2;
+        return;
+    }
+    try {
+        // On before adding, off after removing: neither order can open a window
+        // in which a workflow runs on both platforms unintentionally.
+        if (opts.on === true) {
+            await api.setCoexistence(parsed.owner, parsed.repo, true);
+            console.log(`${chalk.green('✔')} ${repository} is coexisting — Apex plans only what is opted in`);
+        }
+        for (const w of opts.add ?? []) {
+            await api.setWorkflowOptIn(parsed.owner, parsed.repo, w, true);
+            console.log(`${chalk.green('✔')} opted in ${w}`);
+        }
+        for (const w of opts.remove ?? []) {
+            await api.setWorkflowOptIn(parsed.owner, parsed.repo, w, false);
+            console.log(`${chalk.green('✔')} opted out ${w}`);
+        }
+        if (opts.off === true) {
+            await api.setCoexistence(parsed.owner, parsed.repo, false);
+            console.log(`${chalk.green('✔')} ${repository} is no longer coexisting — Apex runs everything not disabled`);
+        }
+        if (opts.diff !== undefined) {
+            const d = await api.coexistenceDiff(parsed.owner, parsed.repo, opts.diff);
+            console.log(chalk.bold(`\n${repository} @ ${d.sha.slice(0, 12)}`));
+            console.log(diffHeadline(d.summary));
+            for (const c of d.comparisons) {
+                // The two that mean something get a marker; the rest are dim,
+                // because "we could not compare this" must not read as a result.
+                const mark = c.verdict === 'agree' ? chalk.green('✔') : c.verdict === 'differ' ? chalk.yellow('≠') : chalk.dim('·');
+                const line = `  ${mark} ${c.path}  ${comparisonLine(c)}`;
+                console.log(c.verdict === 'agree' || c.verdict === 'differ' ? line : chalk.dim(line));
+            }
+        }
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exitCode = 1;
+    }
+});
+export default new Command('migrate')
+    .description('Plan a migration from GitHub Actions: what runs, what does not, and what has to be re-entered')
+    .addCommand(ScanCommand)
+    .addCommand(CoexistCommand);

package/dist/cli/notify/main.js

@@ -0,0 +1,257 @@
+import { createInterface } from 'node:readline/promises';
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { listRules, proveRule, readDeliveries, removeRule, saveRule } from '../../src/application/manage-notifications.js';
+import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
+import { DESTINATION_KINDS, destinationLine, filterLine, invalidTriggers, lastAttemptLine, listOption, sendOutcomeLine, subscriptionLine, } from '../../src/domain/notify.js';
+import { parseRepository } from '../../src/domain/runs.js';
+const api = () => {
+    try {
+        return new HttpControlPlane();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof NotConfiguredError ? err.message : String(err)));
+        process.exitCode = 2;
+        return undefined;
+    }
+};
+const repository = (slug) => {
+    const parsed = parseRepository(slug);
+    if (parsed)
+        return parsed;
+    console.error(chalk.red(`expected owner/repo, got ${JSON.stringify(slug)}`));
+    process.exitCode = 2;
+    return undefined;
+};
+const STATUS_COLOUR = {
+    sent: chalk.green,
+    failed: chalk.red,
+    refused: chalk.yellow,
+};
+const printRule = (rule) => {
+    const state = rule.enabled ? chalk.green('enabled') : chalk.dim('disabled');
+    console.log(`  ${chalk.bold(rule.name.padEnd(18))} ${chalk.dim(destinationLine(rule).padEnd(46))} ${state}`);
+    console.log(chalk.dim(`    on         ${subscriptionLine(rule)}`));
+    console.log(chalk.dim(`    workflows  ${filterLine(rule.workflows)}`));
+    console.log(chalk.dim(`    branches   ${filterLine(rule.branches)}`));
+    const colour = rule.lastStatus === undefined ? chalk.dim : STATUS_COLOUR[rule.lastStatus];
+    console.log(`    ${chalk.dim('last      ')} ${colour(lastAttemptLine(rule))}`);
+};
+const printDelivery = (d) => {
+    const colour = STATUS_COLOUR[d.status];
+    const status = `${d.status}${d.httpStatus === undefined ? '' : ` ${String(d.httpStatus)}`}`;
+    console.log(`  ${chalk.dim(d.createdAt)}  ${d.ruleName.padEnd(18)} ${d.trigger.padEnd(10)} ${colour(status.padEnd(12))} ${d.attempts > 1 ? chalk.dim(`${String(d.attempts)} attempts`) : ''}`);
+    // Somebody else's server's words, so they are printed as data and never
+    // interpreted (control-plane ADR-0029).
+    if (d.detail !== undefined && d.detail !== '')
+        console.log(chalk.dim(`      ${d.detail}`));
+};
+/**
+ * Read the destination without putting it in the shell's history.
+ *
+ * A webhook URL is a credential, and `--to https://hooks.slack.com/…` on a
+ * command line ends up in `.zsh_history` and in every `ps` on the box.
+ */
+const promptForUrl = async () => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await rl.question('destination URL (not echoed to your shell history): ');
+        return answer.trim();
+    }
+    finally {
+        rl.close();
+    }
+};
+const listCommand = new Command('list')
+    .description('The rules for one repository, and how each one last fared')
+    .argument('<repository>', 'owner/repo')
+    .option('--json', 'machine-readable output')
+    .action(async (slug, opts) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await listRules(client, target);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        return;
+    }
+    console.log(chalk.bold(`${target.owner}/${target.repo} · ${String(outcome.value.length)} ${outcome.value.length === 1 ? 'rule' : 'rules'}`));
+    if (outcome.value.length === 0) {
+        console.log(chalk.yellow('\n  Nothing is notified about this repository.'));
+        return;
+    }
+    console.log('');
+    for (const rule of outcome.value) {
+        printRule(rule);
+        console.log('');
+    }
+    console.log(chalk.dim('  A destination URL is a credential and is never shown; the #fingerprint identifies it.'));
+});
+const addCommand = new Command('add')
+    .description('Create or replace one rule')
+    .argument('<repository>', 'owner/repo')
+    .argument('<name>', 'the rule name, e.g. ci-alerts')
+    .option('--kind <kind>', `destination type: ${DESTINATION_KINDS.join(', ')}`, 'slack')
+    // Optional so the URL can be prompted for instead of landing in shell
+    // history — and, on an update, so it can be left exactly as it is.
+    .option('--to <url>', 'the destination URL; omit to be prompted, or to keep the one already stored')
+    .option('--on <triggers>', 'comma-separated: broke, recovered, failed, succeeded (default: broke,recovered)', (v, acc) => [...acc, v], [])
+    .option('--workflow <glob>', 'only these workflow paths (repeatable); omit for all', (v, acc) => [...acc, v], [])
+    .option('--branch <glob>', 'only these branches (repeatable); omit for all', (v, acc) => [...acc, v], [])
+    .option('--disable', 'store the rule but send nothing through it')
+    .option('--json', 'machine-readable output')
+    .action(async (slug, name, opts) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const triggers = listOption(opts.on);
+    const bad = invalidTriggers(triggers);
+    if (bad.length > 0) {
+        console.error(chalk.red(`--on accepts broke, recovered, failed or succeeded; got ${bad.join(', ')}`));
+        process.exitCode = 2;
+        return;
+    }
+    const client = api();
+    if (!client)
+        return;
+    // An existing rule may keep its destination; a new one must be given
+    // something, and being asked beats a confusing 422 from the API.
+    const existing = await listRules(client, target);
+    const known = existing.kind === 'ok' && existing.value.some((r) => r.name === name);
+    let url = opts.to;
+    if (url === undefined && !known)
+        url = await promptForUrl();
+    const outcome = await saveRule(client, target, name, {
+        kind: opts.kind,
+        ...(url === undefined || url === '' ? {} : { url }),
+        ...(opts.disable === true ? { enabled: false } : {}),
+        ...(triggers.length > 0 ? { on: triggers } : {}),
+        ...(listOption(opts.workflow).length > 0 ? { workflows: listOption(opts.workflow) } : {}),
+        ...(listOption(opts.branch).length > 0 ? { branches: listOption(opts.branch) } : {}),
+    });
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        return;
+    }
+    console.log(`${chalk.green('✔')} ${target.owner}/${target.repo} · ${outcome.value.name}`);
+    printRule(outcome.value);
+    console.log(chalk.dim(`\n  Prove it with: apex notify test ${target.owner}/${target.repo} ${outcome.value.name}`));
+});
+const removeCommand = new Command('rm')
+    .description('Remove one rule, and the record of its deliveries')
+    .argument('<repository>', 'owner/repo')
+    .argument('<name>', 'the rule name')
+    .action(async (slug, name) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await removeRule(client, target, name);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (outcome.value)
+        console.log(`${chalk.green('✔')} removed ${name}`);
+    else {
+        console.error(chalk.yellow(`no rule named ${name}`));
+        process.exitCode = 1;
+    }
+});
+const testCommand = new Command('test')
+    .description('Send a message to one destination now, and report what it said')
+    .argument('<repository>', 'owner/repo')
+    .argument('<name>', 'the rule name')
+    .option('--json', 'machine-readable output')
+    .action(async (slug, name, opts) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await proveRule(client, target, name);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        if (!outcome.value.ok)
+            process.exitCode = 1;
+        return;
+    }
+    const result = outcome.value;
+    if (result.ok) {
+        console.log(`${chalk.green('✔')} ${name} accepted the message${result.status === undefined ? '' : ` (HTTP ${String(result.status)})`}`);
+        return;
+    }
+    // A refusal is our decision, a rejection is theirs, and no answer at all
+    // is neither; the difference is what somebody does next, so it is said
+    // out loud.
+    console.error(`${chalk.red('✘')} ${name}: ${sendOutcomeLine(result)}`);
+    if (result.detail !== undefined && result.detail !== '')
+        console.error(chalk.dim(`  ${result.detail}`));
+    process.exitCode = 1;
+});
+const logCommand = new Command('log')
+    .description('The last attempts to reach this repository’s destinations')
+    .argument('<repository>', 'owner/repo')
+    .option('--limit <n>', 'how many attempts to show (default 20)', '20')
+    .option('--json', 'machine-readable output')
+    .action(async (slug, opts) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const limit = Number(opts.limit);
+    if (!Number.isFinite(limit) || limit < 1) {
+        console.error(chalk.red(`--limit must be a positive number, got ${opts.limit}`));
+        process.exitCode = 2;
+        return;
+    }
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await readDeliveries(client, target, Math.min(limit, 100));
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        return;
+    }
+    console.log(chalk.bold(`${target.owner}/${target.repo} · last ${String(outcome.value.length)} attempts`));
+    if (outcome.value.length === 0) {
+        console.log(chalk.yellow('\n  Nothing has been sent yet.'));
+        return;
+    }
+    console.log('');
+    for (const d of outcome.value)
+        printDelivery(d);
+});
+export default new Command('notify')
+    .description('Notification routing: where a repository’s outcome changes are sent')
+    .addCommand(listCommand)
+    .addCommand(addCommand)
+    .addCommand(removeCommand)
+    .addCommand(testCommand)
+    .addCommand(logCommand);

package/dist/cli/oidc/main.js

@@ -0,0 +1,103 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { oidcDiscovery, oidcSubject, setOidcSubject } from '../../src/application/manage-environments.js';
+import { splitRepository } from '../../src/application/manage-caches.js';
+import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
+const api = () => {
+    try {
+        return new HttpControlPlane();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof NotConfiguredError ? err.message : String(err)));
+        process.exitCode = 2;
+        return undefined;
+    }
+};
+const repository = (slug) => {
+    const parsed = splitRepository(slug);
+    if (parsed)
+        return parsed;
+    console.error(chalk.red(`expected owner/repo, got ${JSON.stringify(slug)}`));
+    process.exitCode = 2;
+    return undefined;
+};
+const discoveryCommand = new Command('discovery')
+    .description('The OIDC discovery document, as a cloud provider fetches it')
+    .option('--json', 'machine-readable output')
+    .action(async (opts) => {
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await oidcDiscovery(client);
+    switch (outcome.kind) {
+        case 'refused':
+            console.error(chalk.red(outcome.detail));
+            process.exitCode = 1;
+            return;
+        case 'not-an-issuer':
+            console.error(chalk.red('this deployment is not an OIDC issuer'));
+            process.exitCode = 1;
+            return;
+        case 'found':
+            if (opts.json === true) {
+                console.log(JSON.stringify(outcome.document, null, 2));
+                return;
+            }
+            // The two lines a trust policy is written against. `issuer` must match
+            // it exactly, trailing slash and all.
+            console.log(`${chalk.bold('issuer')}   ${String(outcome.document['issuer'] ?? '')}`);
+            console.log(`${chalk.bold('jwks_uri')} ${String(outcome.document['jwks_uri'] ?? '')}`);
+    }
+});
+const printSubject = (keys) => {
+    if (keys.length === 0) {
+        console.log("GitHub's default subject:");
+        console.log('  a job with an environment  repo:<owner>/<name>:environment:<env>');
+        console.log('  a pull request             repo:<owner>/<name>:pull_request');
+        console.log('  anything else              repo:<owner>/<name>:ref:<ref>');
+        return;
+    }
+    console.log(`custom subject: ${keys.map((k) => `${k}:<${k}>`).join(':')}`);
+};
+const subjectCommand = new Command('subject')
+    .description("A repository's OIDC subject claim (repository admin)")
+    .argument('<repository>', 'owner/repo')
+    .action(async (slug) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await oidcSubject(client, target.owner, target.repo);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.detail));
+        process.exitCode = 1;
+        return;
+    }
+    printSubject(outcome.includeClaimKeys);
+});
+subjectCommand.addCommand(new Command('set')
+    .description('Fold claims into the subject, or reset to the default with no --claim')
+    .argument('<repository>', 'owner/repo')
+    .option('--claim <key...>', 'claim keys, in the order they appear in the subject')
+    .action(async (slug, opts) => {
+    const target = repository(slug);
+    if (!target)
+        return;
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await setOidcSubject(client, target.owner, target.repo, opts.claim ?? []);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.detail));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(`${chalk.green('✔')} subject updated`);
+    printSubject(outcome.includeClaimKeys);
+    // A trust policy matches on `sub`. Changing it here breaks every policy
+    // written against the old one, and it will break at deploy time.
+    console.log(chalk.dim('Update any cloud trust policy that matches on sub before the next deployment.'));
+}));
+export default new Command('oidc').description('OIDC: what this issuer publishes, and what a token says it is').addCommand(discoveryCommand).addCommand(subjectCommand);