@arjunkhera/atlas 0.4.48 → 0.4.49

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.48",
+  "version": "0.4.49",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/lib/approve.mjs

@@ -337,9 +337,22 @@ export function auditCause(deps, repo, { run, sha, pr, main }) {
   return null;
 }
 
+// Why the audit on this Mac does not find only "owner-unsigned" for this
+// pull request at this merge, or null when it does (item aef880cb). It runs
+// the code of the installed Atlas on the owner's clone at `root`.
+async function macFindings(deps, { repo, root, sha, pr }) {
+  let found;
+  try { found = await (deps.audit ?? macAudit)({ repo, root: resolve(root ?? '.'), sha }); }
+  catch (error) { return `the audit on this Mac stopped: ${plainText(error?.message ?? error).slice(0, 200)}`; }
+  if (Array.isArray(found) && found.some((one) => one?.pin === 'unread')) return `the audit on this Mac could not read the head or the base of #${pr} in this clone. Run git fetch origin pull/${pr}/head, then the command again`;
+  const only = Array.isArray(found) && found.length === 1 && found[0]?.kind === AUDIT_TEST && found[0].sha === sha && Number(found[0].pr) === pr && found[0].key === `${AUDIT_TEST}:${sha}` && found[0].pin === undefined;
+  if (only) return null;
+  return `the audit on this Mac found ${Array.isArray(found) && found.length ? found.map((one) => plainText(one?.key ?? one?.kind)).join(', ') : 'nothing to accept'}, not only ${AUDIT_TEST} for #${pr}`;
+}
+
 // One open audit issue, read from GitHub: the pull request that made the
 // merge, its head, and the red audit run. `skip` says why it is not signed.
-export async function auditRow(deps, repo, issue, main, kinds = new Map()) {
+export async function auditRow(deps, repo, issue, main, kinds = new Map(), root = '.', named = new Set()) {
   const sha = AUDIT_ISSUE.exec(String(issue.title ?? ''))[1];
   const row = { issue: Number(issue.number), sha };
   const pull = (deps.gh('GET', `repos/${repo}/commits/${sha}/pulls`) ?? []).find((each) => each?.merged_at && each.merge_commit_sha === sha);
@@ -347,6 +360,8 @@ export async function auditRow(deps, repo, issue, main, kinds = new Map()) {
   const head = String(pull.head?.sha ?? '');
   if (!/^[0-9a-f]{40}$/.test(head)) return { ...row, pr: Number(pull.number), skip: 'GitHub gave no head' };
   Object.assign(row, { pr: Number(pull.number), head, title: plainText(pull.title).slice(0, 120), merged_at: String(pull.merged_at) });
+  // A run that names pull requests reads and audits only those rows.
+  if (named.size && !named.has(row.pr)) return { ...row, skip: 'not named' };
   const runs = (deps.gh('GET', `repos/${repo}/commits/${sha}/check-runs?per_page=100`)?.check_runs ?? [])
     .filter((run) => run?.name === AUDIT_CHECK)
     .sort((a, b) => String(b.started_at ?? '').localeCompare(String(a.started_at ?? '')));
@@ -364,6 +379,12 @@ export async function auditRow(deps, repo, issue, main, kinds = new Map()) {
   if (code.files.length) return { ...row, skip: `the merge changed ${code.files[0]}, so its audit ran its own code: read that diff and sign it with atlas approve audit-code ${row.pr}` };
   const parent = String(commit?.parents?.[0]?.sha ?? '');
   if (!/^[0-9a-f]{40}$/.test(parent)) return { ...row, skip: 'GitHub gave no parent of the merge commit' };
+  // Item aef880cb: the findings above came from the audit run on GitHub.
+  // The Atlas on this Mac audits the merge again with its own code, as
+  // atlas approve audit-code does. It must find this owner merge and
+  // nothing else.
+  const mac = await macFindings(deps, { repo, root, sha, pr: row.pr });
+  if (mac) return { ...row, skip: mac };
   // Item 65c6c907: a merge made before the first owner key takes the keys
   // at the tip of the default branch, within the limits of preKeyKeys.
   const owner = await ownerKeys(deps, repo, { parent, head, main });
@@ -400,7 +421,7 @@ export async function approveAudit({ prs = [], repo, root, key, provider, yes =
   line(`  ${issues.length} open audit issue(s) of an owner merge with no touch. Each one can take about 5 seconds.`);
   const rows = [];
   for (const issue of issues) {
-    const row = await auditRow(deps, name, issue, main, kinds);
+    const row = await auditRow(deps, name, issue, main, kinds, root, only);
     if (only.size && !only.has(row.pr)) continue;
     rows.push(row);
   }
@@ -545,12 +566,8 @@ export async function approveAuditCode({ prs = [], repo, root, key, provider, ye
   // The audit of that run ran the code of this merge, or never ran. So the
   // Atlas on this Mac audits the merge again with its own code (security
   // review S2): it must find this owner merge and nothing else.
-  let found;
-  try { found = await (deps.audit ?? macAudit)({ repo: name, root: resolve(root ?? '.'), sha }); }
-  catch (error) { throw new ApproveError(`the audit on this Mac stopped: ${plainText(error?.message ?? error).slice(0, 200)}. Nothing was signed.`); }
-  if (Array.isArray(found) && found.some((one) => one?.pin === 'unread')) throw new ApproveError(`the audit on this Mac could not read the head or the base of #${pr} in this clone. Run git fetch origin pull/${pr}/head, then the command again. Nothing was signed.`);
-  const only = Array.isArray(found) && found.length === 1 && found[0]?.kind === AUDIT_TEST && found[0].sha === sha && Number(found[0].pr) === pr && found[0].key === `${AUDIT_TEST}:${sha}` && found[0].pin === undefined;
-  if (!only) throw new ApproveError(`the audit on this Mac found ${Array.isArray(found) && found.length ? found.map((one) => plainText(one?.key ?? one?.kind)).join(', ') : 'nothing to accept'}, not only ${AUDIT_TEST} for #${pr}. Nothing was signed.`);
+  const mac = await macFindings(deps, { repo: name, root, sha, pr });
+  if (mac) throw new ApproveError(`${mac}. Nothing was signed.`);
   const owner = await ownerKeys(deps, name, { parent, head, main });
   if (!owner.keys.length) throw new ApproveError(`${SIGNERS_FILE} holds no owner key that counts for this merge: ${owner.why ?? 'no reason'}.`);
   line(`atlas approve audit-code: ${name} #${pr} ${plainText(pull.title).slice(0, 120)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.48",
+  "version": "0.4.49",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",