@aspruyt/xfg 3.7.1 → 3.7.3

package/dist/repo-settings-diff.js

@@ -22,11 +22,11 @@ const PROPERTY_MAPPING = {
     mergeCommitMessage: "merge_commit_message",
     webCommitSignoffRequired: "web_commit_signoff_required",
     defaultBranch: "default_branch",
-    vulnerabilityAlerts: "_vulnerability_alerts",
-    automatedSecurityFixes: "_automated_security_fixes",
+    vulnerabilityAlerts: "vulnerability_alerts",
+    automatedSecurityFixes: "automated_security_fixes",
     secretScanning: "_secret_scanning",
     secretScanningPushProtection: "_secret_scanning_push_protection",
-    privateVulnerabilityReporting: "_private_vulnerability_reporting",
+    privateVulnerabilityReporting: "private_vulnerability_reporting",
 };
 /**
  * Gets the current value for a property from GitHub API response.

package/dist/repo-settings-processor.d.ts

@@ -24,7 +24,13 @@ export interface RepoSettingsProcessorResult {
 }
 export declare class RepoSettingsProcessor implements IRepoSettingsProcessor {
     private readonly strategy;
+    private readonly tokenManager;
     constructor(strategy?: IRepoSettingsStrategy);
     process(repoConfig: RepoConfig, repoInfo: RepoInfo, options: RepoSettingsProcessorOptions): Promise<RepoSettingsProcessorResult>;
     private applyChanges;
+    /**
+     * Resolves a GitHub App installation token for the given repo.
+     * Returns undefined if no token manager or token resolution fails.
+     */
+    private getInstallationToken;
 }

package/dist/repo-settings-processor.js

@@ -2,10 +2,19 @@ import { isGitHubRepo, getRepoDisplayName } from "./repo-detector.js";
 import { GitHubRepoSettingsStrategy } from "./strategies/github-repo-settings-strategy.js";
 import { diffRepoSettings, hasChanges } from "./repo-settings-diff.js";
 import { formatRepoSettingsPlan, } from "./repo-settings-plan-formatter.js";
+import { hasGitHubAppCredentials } from "./strategies/index.js";
+import { GitHubAppTokenManager } from "./github-app-token-manager.js";
 export class RepoSettingsProcessor {
     strategy;
+    tokenManager;
     constructor(strategy) {
         this.strategy = strategy ?? new GitHubRepoSettingsStrategy();
+        if (hasGitHubAppCredentials()) {
+            this.tokenManager = new GitHubAppTokenManager(process.env.XFG_GITHUB_APP_ID, process.env.XFG_GITHUB_APP_PRIVATE_KEY);
+        }
+        else {
+            this.tokenManager = null;
+        }
     }
     async process(repoConfig, repoInfo, options) {
         const repoName = getRepoDisplayName(repoInfo);
@@ -31,7 +40,9 @@ export class RepoSettingsProcessor {
             };
         }
         try {
-            const strategyOptions = { token, host: githubRepo.host };
+            // Resolve App token if available, fall back to provided token
+            const effectiveToken = token ?? (await this.getInstallationToken(githubRepo));
+            const strategyOptions = { token: effectiveToken, host: githubRepo.host };
             // Fetch current settings
             const currentSettings = await this.strategy.getSettings(githubRepo, strategyOptions);
             // Compute diff
@@ -80,18 +91,40 @@ export class RepoSettingsProcessor {
     }
     async applyChanges(repoInfo, settings, options) {
         // Extract settings that need separate API calls
-        const { vulnerabilityAlerts, automatedSecurityFixes, ...mainSettings } = settings;
+        const { vulnerabilityAlerts, automatedSecurityFixes, privateVulnerabilityReporting, ...mainSettings } = settings;
         // Update main settings via PATCH /repos
         if (Object.keys(mainSettings).length > 0) {
             await this.strategy.updateSettings(repoInfo, mainSettings, options);
         }
         // Handle vulnerability alerts (separate endpoint)
+        // Must be done before automated security fixes
         if (vulnerabilityAlerts !== undefined) {
             await this.strategy.setVulnerabilityAlerts(repoInfo, vulnerabilityAlerts, options);
         }
+        // Handle private vulnerability reporting (separate endpoint)
+        if (privateVulnerabilityReporting !== undefined) {
+            await this.strategy.setPrivateVulnerabilityReporting(repoInfo, privateVulnerabilityReporting, options);
+        }
         // Handle automated security fixes (separate endpoint)
+        // Done last to ensure vulnerability alerts have been fully processed
         if (automatedSecurityFixes !== undefined) {
             await this.strategy.setAutomatedSecurityFixes(repoInfo, automatedSecurityFixes, options);
         }
     }
+    /**
+     * Resolves a GitHub App installation token for the given repo.
+     * Returns undefined if no token manager or token resolution fails.
+     */
+    async getInstallationToken(repoInfo) {
+        if (!this.tokenManager) {
+            return undefined;
+        }
+        try {
+            const token = await this.tokenManager.getTokenForRepo(repoInfo);
+            return token ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
 }

package/dist/strategies/github-repo-settings-strategy.d.ts

@@ -15,6 +15,10 @@ export declare class GitHubRepoSettingsStrategy implements IRepoSettingsStrategy
     updateSettings(repoInfo: RepoInfo, settings: GitHubRepoSettings, options?: RepoSettingsStrategyOptions): Promise<void>;
     setVulnerabilityAlerts(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
     setAutomatedSecurityFixes(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
+    setPrivateVulnerabilityReporting(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
+    private getVulnerabilityAlerts;
+    private getAutomatedSecurityFixes;
+    private getPrivateVulnerabilityReporting;
     private validateGitHub;
     private ghApi;
 }

package/dist/strategies/github-repo-settings-strategy.js

@@ -76,7 +76,14 @@ export class GitHubRepoSettingsStrategy {
         const github = repoInfo;
         const endpoint = `/repos/${github.owner}/${github.repo}`;
         const result = await this.ghApi("GET", endpoint, undefined, options);
-        return JSON.parse(result);
+        const settings = JSON.parse(result);
+        // Fetch security settings from separate endpoints
+        settings.vulnerability_alerts = await this.getVulnerabilityAlerts(github, options);
+        // Pass vulnerability_alerts state - automated security fixes requires it enabled
+        settings.automated_security_fixes = await this.getAutomatedSecurityFixes(github, options, settings.vulnerability_alerts);
+        settings.private_vulnerability_reporting =
+            await this.getPrivateVulnerabilityReporting(github, options);
+        return settings;
     }
     async updateSettings(repoInfo, settings, options) {
         this.validateGitHub(repoInfo);
@@ -103,6 +110,54 @@ export class GitHubRepoSettingsStrategy {
         const method = enable ? "PUT" : "DELETE";
         await this.ghApi(method, endpoint, undefined, options);
     }
+    async setPrivateVulnerabilityReporting(repoInfo, enable, options) {
+        this.validateGitHub(repoInfo);
+        const github = repoInfo;
+        const endpoint = `/repos/${github.owner}/${github.repo}/private-vulnerability-reporting`;
+        const method = enable ? "PUT" : "DELETE";
+        await this.ghApi(method, endpoint, undefined, options);
+    }
+    async getVulnerabilityAlerts(github, options) {
+        const endpoint = `/repos/${github.owner}/${github.repo}/vulnerability-alerts`;
+        try {
+            await this.ghApi("GET", endpoint, undefined, options);
+            return true; // 204 = enabled
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (message.includes("HTTP 404")) {
+                return false; // 404 = disabled
+            }
+            throw error; // Re-throw other errors
+        }
+    }
+    async getAutomatedSecurityFixes(github, options, _vulnerabilityAlertsEnabled) {
+        // Note: GitHub returns JSON with {enabled: boolean} for this endpoint
+        const endpoint = `/repos/${github.owner}/${github.repo}/automated-security-fixes`;
+        try {
+            const result = await this.ghApi("GET", endpoint, undefined, options);
+            // Parse JSON response - GitHub returns {"enabled": true/false}
+            if (result) {
+                const data = JSON.parse(result);
+                return data.enabled === true;
+            }
+            // Empty response (204) means enabled
+            return true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (message.includes("HTTP 404")) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async getPrivateVulnerabilityReporting(github, options) {
+        const endpoint = `/repos/${github.owner}/${github.repo}/private-vulnerability-reporting`;
+        const result = await this.ghApi("GET", endpoint, undefined, options);
+        const data = JSON.parse(result);
+        return data.enabled === true;
+    }
     validateGitHub(repoInfo) {
         if (!isGitHubRepo(repoInfo)) {
             throw new Error(`GitHub Repo Settings strategy requires GitHub repositories. Got: ${repoInfo.type}`);

package/dist/strategies/repo-settings-strategy.d.ts

@@ -39,6 +39,9 @@ export interface CurrentRepoSettings {
             status: string;
         };
     };
+    vulnerability_alerts?: boolean;
+    automated_security_fixes?: boolean;
+    private_vulnerability_reporting?: boolean;
 }
 export interface IRepoSettingsStrategy {
     /**
@@ -57,6 +60,10 @@ export interface IRepoSettingsStrategy {
      * Enables or disables automated security fixes.
      */
     setAutomatedSecurityFixes(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
+    /**
+     * Enables or disables private vulnerability reporting.
+     */
+    setPrivateVulnerabilityReporting(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
 }
 /**
  * Type guard to check if an object implements IRepoSettingsStrategy.

package/dist/strategies/repo-settings-strategy.js

@@ -9,5 +9,6 @@ export function isRepoSettingsStrategy(obj) {
     return (typeof strategy.getSettings === "function" &&
         typeof strategy.updateSettings === "function" &&
         typeof strategy.setVulnerabilityAlerts === "function" &&
-        typeof strategy.setAutomatedSecurityFixes === "function");
+        typeof strategy.setAutomatedSecurityFixes === "function" &&
+        typeof strategy.setPrivateVulnerabilityReporting === "function");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aspruyt/xfg",
-  "version": "3.7.1",
+  "version": "3.7.3",
   "description": "CLI tool for repository-as-code",
   "type": "module",
   "main": "dist/index.js",