@arjunkhera/atlas 0.4.17 → 0.4.19

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.17",
+  "version": "0.4.19",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/cli.mjs

@@ -38,7 +38,7 @@ import { changedCommand as testsChanged } from './lib/changed-tests.mjs';
 import { beforeCommand as testsBefore } from './lib/fails-before.mjs';
 import { afterCommand as testsAfter } from './lib/passes-after.mjs';
 import { upkeepCommand } from './lib/upkeep.mjs';
-import { gateCommand } from './lib/gate.mjs';
+import { gateCommand, mergeList } from './lib/gate.mjs';
 import { judgeCommand } from './lib/judge.mjs';
 
 export const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -290,6 +290,8 @@ function statusCommand(chosen) {
     line(`         ${row.why}`);
     if (row.copy) line(`         copy    sha256 ${row.copy.sha256.slice(0, 12)}…  check version ${row.copy.check_version ?? '?'}`);
     if (row.packaged) line(`         package sha256 ${row.packaged.sha256.slice(0, 12)}…  check version ${row.packaged.check_version}${row.packaged.released ? '' : '  (not released)'}`);
+    const list = mergeList(row.root);
+    if (list) line(`         ${list.line}`);
     line('');
   }
   line(`Decided by the release list in Atlas ${ATLAS_VERSION}, never by git history.`);
@@ -461,6 +463,9 @@ function checkCommand(chosen) {
   const report = scan({ root, repoId: chosen.repo ?? null });
   const decision = verdict(report, chosen['fail-on'] ?? 'error');
   process.stdout.write(toText(report));
+  // A report, never a reason for red: the list is an owner-only key.
+  const list = mergeList(root);
+  if (list && list.state !== 'listed') line(list.line);
   line(`${decision.green ? 'GREEN' : 'RED'}: ${decision.why}`);
   return decision.green ? 0 : 1;
 }

package/door/lib/fails-before.mjs

@@ -292,7 +292,9 @@ export function freshTree(top, tree, sha) {
 // commit has a fixed author, date and message, so it holds no history and names neither real commit.
 export function gitTree(tree) {
   const env = { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: tree, GIT_CONFIG_NOSYSTEM: '1', GIT_AUTHOR_NAME: 'atlas', GIT_AUTHOR_EMAIL: 'atlas@invalid', GIT_COMMITTER_NAME: 'atlas', GIT_COMMITTER_EMAIL: 'atlas@invalid', GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z', GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z' };
-  for (const args of [['init', '-q', '-b', 'main'], ['add', '-A'], ['commit', '-q', '--no-verify', '--no-gpg-sign', '-m', 'tree']]) {
+  // No auto gc or background maintenance: it can still write in .git while
+  // the run removes the tree (ENOTEMPTY on atlas#223).
+  for (const args of [['init', '-q', '-b', 'main'], ['config', 'gc.auto', '0'], ['config', 'maintenance.auto', 'false'], ['add', '-A'], ['commit', '-q', '--no-verify', '--no-gpg-sign', '-m', 'tree']]) {
     const r = spawnSync('git', args, { cwd: tree, env, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
     if (r.status !== 0) throw new Error(`git ${args[0]} in the run tree failed: ${String(r.stderr).trim().split('\n')[0]}`);
   }
@@ -322,7 +324,7 @@ export function runSide({ top, changed, plans, side, work = join(tmpdir(), 'atla
         }
       }
       gitTree(tree);
-      for (const dir of ['home', 'tmp', 'report']) { rmSync(join(work, dir), { recursive: true, force: true }); mkdirSync(join(work, dir), { recursive: true }); }
+      for (const dir of ['home', 'tmp', 'report']) { rmSync(join(work, dir), { recursive: true, force: true, maxRetries: 5, retryDelay: 200 }); mkdirSync(join(work, dir), { recursive: true }); }
       const command = commandOf(p.runner, p.path, report);
       if (python && p.runner === 'pytest' && spawnSync('python3', ['-B', '-c', 'import pytest'], { cwd: tree, env }).status !== 0) {
         out.files[p.path] = { command, cases: null, why: 'pytest is not installed', none: true };

package/door/lib/gate-check.mjs

@@ -26,7 +26,7 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync, appendFileSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { classify, changedPaths, compile, matcher } from './owner-only.mjs';
+import { classify, changedPaths, compile, matcher, fakeSecret } from './owner-only.mjs';
 import { listChanged } from './changed-tests.mjs';
 import { parseYaml, SECRET_PATTERNS } from '../../shape/check.mjs';
 import { brakeState, undoOf, tripText } from './brake.mjs';
@@ -101,7 +101,7 @@ export function secretRows(root, base, head, changes) {
     for (const added of addedLines(root, base, head, change.path)) {
       const found = patterns.find((pattern) => {
         const hit = pattern.regex.exec(added.text);
-        return hit && !(pattern.id === 'url-credential' && EXAMPLE_HOST.test(hit[0]));
+        return hit && !fakeSecret(pattern.id, hit[0]) && !(pattern.id === 'url-credential' && EXAMPLE_HOST.test(hit[0]));
       });
       if (found) rows.push({ kind: 'red', class: 'secret', path: change.path, line: added.line, cause: `secret pattern ${found.id}` });
     }

package/door/lib/gate.mjs

@@ -15,7 +15,7 @@
 // The plan is built by pure functions, so a test reads it without GitHub. The
 // gh calls sit in one place, behind `gh`, which a test replaces.
 import { execFileSync } from 'node:child_process';
-import { readFileSync, existsSync, mkdirSync, writeFileSync, rmSync, renameSync } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync, writeFileSync, rmSync, renameSync, readdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { childEnvironment } from '../../work/lib/child-env.mjs';
@@ -38,16 +38,40 @@ export function gateFacts(root) {
   return factsOf(readFileSync(path, 'utf8'));
 }
 
+// A repo with no list cannot merge through the door: ready reads the list,
+// and the door never makes one up (item 3d675dc7).
+export const NO_LIST = 'atlas.yaml lists no required_checks.';
+export const LIST_FIX = 'Fix: add required_checks to atlas.yaml, with the names of the CI jobs that run on every pull request. The key is owner-only, so the owner merges that pull request by hand.';
+
 function factsOf(text) {
   const facts = parseYaml(text) ?? {};
   const checks = facts.required_checks;
   if (!Array.isArray(checks) || checks.length === 0 || checks.some((name) => typeof name !== 'string' || !name.trim())) {
-    throw new GateError('atlas.yaml lists no required_checks. Nothing was changed.');
+    throw Object.assign(new GateError(`${NO_LIST} Nothing was changed.`), { noList: true });
   }
   if (facts.up_to_date !== undefined && typeof facts.up_to_date !== 'boolean') throw new GateError('atlas.yaml up_to_date must be true or false. Nothing was changed.');
   return { checks: [...checks], upToDate: facts.up_to_date === true };
 }
 
+// Can this repo merge through the door? The answer does not read the repo
+// kind: each kind merges on the same list. `atlas status` and `atlas check`
+// print it.
+//   listed   atlas.yaml names the checks
+//   missing  CI runs, but atlas.yaml names no checks
+//   no-ci    no workflow runs, so no list can exist yet
+export function mergeList(root) {
+  const path = join(root, 'atlas.yaml');
+  if (!existsSync(path)) return null;
+  let checks = null;
+  try { checks = factsOf(readFileSync(path, 'utf8')).checks; } catch (error) { if (!error.noList) return { state: 'missing', checks: [], line: `merge door: atlas.yaml cannot be read (${error.message}). ${LIST_FIX}` }; }
+  if (checks) return { state: 'listed', checks, line: `merge door: ${checks.length} required check(s) in atlas.yaml.` };
+  const flows = join(root, '.github', 'workflows');
+  const ci = existsSync(flows) && readdirSync(flows).some((name) => /\.ya?ml$/.test(name));
+  return ci
+    ? { state: 'missing', checks: [], line: `merge door: ${NO_LIST} ${LIST_FIX}` }
+    : { state: 'no-ci', checks: [], line: 'merge door: no list, because no CI workflow runs here. Merges stay with the owner.' };
+}
+
 // The two ruleset bodies, as the GitHub rulesets API takes them.
 export function rulesets({ checks, upToDate }, enforcement = 'active') {
   return [
@@ -237,14 +261,12 @@ export function refusal(run, { name, pr, sha, baseRef, homes, sides = () => [] }
   // the side branch's file, so it does not count.
   if (pulls.some((each) => each.base?.ref !== baseRef)) return `also of a pull request into ${pulls.find((each) => each.base?.ref !== baseRef).base?.ref ?? 'another branch'}`;
   // GitHub builds that list when it is read, from the open pull requests of
-  // the head branch. Once a side pull request closes, its gate run names only
-  // this one, and its title can be set to match. So the gate also refuses a
-  // head branch that ever had a pull request into another branch.
-  if (name === GATE_CHECK) {
-    const side = sides();
-    if (side === null) return 'no head branch to check for side pull requests';
-    if (side.length) return `the head branch also had #${side[0].number} into ${side[0].base?.ref ?? 'another branch'}`;
-  }
+  // the head branch. Once a side pull request closes, its run names only this
+  // one. So no run counts when the head branch ever had a pull request into
+  // another branch (atlas#212 for the gate; item 043f8c00 for every check).
+  const side = sides();
+  if (side === null) return 'no head branch to check for side pull requests';
+  if (side.length) return `the head branch also had #${side[0].number} into ${side[0].base?.ref ?? 'another branch'}`;
   return null;
 }
 
@@ -268,7 +290,7 @@ export function jobRefusal(job, check, run) {
 function pinnedRuns(gh, repo, { pr, sha, baseRef, head, checks }) {
   const homes = homesAt(gh, repo, baseRef, checks);
   // Every pull request, open or closed, from the head branch into another
-  // branch. Read once, and only when a gate run needs it.
+  // branch. Read once, when the first run needs it.
   let sideList;
   const sides = () => {
     if (sideList !== undefined) return sideList;
@@ -319,7 +341,14 @@ export function readyCommand({ repo, pr, answer }, line, gh = ghApi) {
   if (answer && typeof pull?.head?.sha === 'string') answer.sha = pull.head.sha;
   if (pull?.state !== 'open') { line(`atlas gate ready: pull request #${pr} is ${pull?.merged ? 'merged' : pull?.state ?? 'not found'}. NOT READY.`); return 1; }
   const sha = pull.head.sha;
-  const checks = checksAt(gh, repo, pull.base.ref);
+  let checks;
+  try { checks = checksAt(gh, repo, pull.base.ref); } catch (error) {
+    if (!error.noList) throw error;
+    line(`atlas gate ready: #${pr} at ${sha.slice(0, 7)}: atlas.yaml lists no required_checks on ${pull.base.ref}.`);
+    line(`  ${LIST_FIX}`);
+    line('NOT READY: do not merge. Until the list exists, merges in this repo stay with the owner.');
+    return 1;
+  }
   const { kept, refused } = pinnedRuns(gh, repo, { pr, sha, baseRef: pull.base.ref, head: pull.head, checks });
   const rows = checkStates(checks, kept);
   line(`atlas gate ready: #${pr} at ${sha.slice(0, 7)}, ${checks.length} required check(s) from atlas.yaml on ${pull.base.ref}.`);

package/door/lib/owner-only.mjs

@@ -498,6 +498,38 @@ const newest = (paths) => paths.reduce((best, path) => (best === null || newer(p
 
 // `rules` names the commit whose list holds; the default is the base. The
 // gate replay passes today's main branch, to ask what today's list would do.
+// Item b6e264a9, from the 30-day replay: the loose pattern "named-value"
+// (token = ..., secret: ...) matched test code in most of its hits, such as
+// a fake environment value. It does not count in a test file or under
+// archive/. The patterns of a known shape still count there.
+export const LOOSE_PATTERN = 'named-value';
+// A spec/ folder is not on the list: a schema repo keeps product text there.
+export const TEST_PATH = /(^|\/)(test|tests|__tests__)\/|\.(test|spec)\.[^/]+$|(^|\/)test_[^/]*\.py$|_test\.(py|go)$|^archive\//;
+// A value that says it is fake, such as "sk-fake-model-key-...", is no key.
+export const FAKE_VALUE = /fake|dummy|placeholder|example/i;
+// The part of a hit that holds the value: the user and password of a URL
+// credential, the text after ":" or "=" of a named value, else the whole
+// token. The word test reads only that part, so a host such as
+// db.examplecorp.io or a word after the value does not hide a real secret
+// (verifier, atlas#221).
+export function secretValue(id, text) {
+  if (id === 'url-credential') return text.slice(text.indexOf('://') + 3, text.lastIndexOf('@'));
+  if (id === LOOSE_PATTERN) return (/[:=]\s*(.*)$/s.exec(text)?.[1] ?? text).replace(/["',;})\]].*$/s, '');
+  return text;
+}
+export const fakeSecret = (id, text) => FAKE_VALUE.test(secretValue(id, text));
+// The first secret pattern that one added line of this path shows, or null.
+export function secretIn(patterns, path, lines) {
+  for (const pattern of patterns) {
+    if (pattern.id === LOOSE_PATTERN && TEST_PATH.test(path)) continue;
+    for (const line of lines) {
+      const hit = pattern.regex.exec(line);
+      if (hit && !fakeSecret(pattern.id, hit[0])) return { pattern, hit };
+    }
+  }
+  return null;
+}
+
 export function classify({ root, base, head, rules: rulesRef = null, classes = loadClasses() }) {
   const { rules, product, tree } = rulesAt({ root, ref: rulesRef ?? base, classes });
   const baseTree = rulesRef ? treeAt(root, base) : tree;
@@ -544,7 +576,7 @@ export function classify({ root, base, head, rules: rulesRef = null, classes = l
       if (kitRelease && sign.version_key) continue;
       if (sign.type === 'path' || sign.type === 'any_change') hits.push([sign.class, cause]);
       else if (sign.type === 'secret') {
-        const found = secrets.find((pattern) => changesOf().added.some((line) => pattern.regex.test(line)));
+        const found = secretIn(secrets, path, changesOf().added)?.pattern;
         if (found) hits.push([sign.class, `${cause} (${found.id})`]);
       } else if (sign.type === 'added_line') {
         const regex = compile(sign.pattern);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.17",
+  "version": "0.4.19",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/skills/lead/SKILL.md

@@ -117,6 +117,11 @@ set. A test keeps the two lists equal.
 A person merges every file that `atlas tooling` writes.
 A person merges every file that `atlas tests write` writes.
 
+When a repo joins Atlas, its first pull request lists `required_checks` in
+`atlas.yaml`: the CI jobs that run on every pull request. The owner merges
+that pull request by hand. With no list, the merge check says NOT READY,
+and merges stay with the owner.
+
 ## 7. The first reply of a cloud session
 
 A cloud session can start from an old setup and run an old Atlas. So in a