@aspruyt/xfg 3.7.2 → 3.7.3

package/dist/repo-settings-diff.js

@@ -22,11 +22,11 @@ const PROPERTY_MAPPING = {
     mergeCommitMessage: "merge_commit_message",
     webCommitSignoffRequired: "web_commit_signoff_required",
     defaultBranch: "default_branch",
-    vulnerabilityAlerts: "_vulnerability_alerts",
-    automatedSecurityFixes: "_automated_security_fixes",
+    vulnerabilityAlerts: "vulnerability_alerts",
+    automatedSecurityFixes: "automated_security_fixes",
     secretScanning: "_secret_scanning",
     secretScanningPushProtection: "_secret_scanning_push_protection",
-    privateVulnerabilityReporting: "_private_vulnerability_reporting",
+    privateVulnerabilityReporting: "private_vulnerability_reporting",
 };
 /**
  * Gets the current value for a property from GitHub API response.

package/dist/repo-settings-processor.js

@@ -91,16 +91,22 @@ export class RepoSettingsProcessor {
     }
     async applyChanges(repoInfo, settings, options) {
         // Extract settings that need separate API calls
-        const { vulnerabilityAlerts, automatedSecurityFixes, ...mainSettings } = settings;
+        const { vulnerabilityAlerts, automatedSecurityFixes, privateVulnerabilityReporting, ...mainSettings } = settings;
         // Update main settings via PATCH /repos
         if (Object.keys(mainSettings).length > 0) {
             await this.strategy.updateSettings(repoInfo, mainSettings, options);
         }
         // Handle vulnerability alerts (separate endpoint)
+        // Must be done before automated security fixes
         if (vulnerabilityAlerts !== undefined) {
             await this.strategy.setVulnerabilityAlerts(repoInfo, vulnerabilityAlerts, options);
         }
+        // Handle private vulnerability reporting (separate endpoint)
+        if (privateVulnerabilityReporting !== undefined) {
+            await this.strategy.setPrivateVulnerabilityReporting(repoInfo, privateVulnerabilityReporting, options);
+        }
         // Handle automated security fixes (separate endpoint)
+        // Done last to ensure vulnerability alerts have been fully processed
         if (automatedSecurityFixes !== undefined) {
             await this.strategy.setAutomatedSecurityFixes(repoInfo, automatedSecurityFixes, options);
         }

package/dist/strategies/github-repo-settings-strategy.d.ts

@@ -15,6 +15,10 @@ export declare class GitHubRepoSettingsStrategy implements IRepoSettingsStrategy
     updateSettings(repoInfo: RepoInfo, settings: GitHubRepoSettings, options?: RepoSettingsStrategyOptions): Promise<void>;
     setVulnerabilityAlerts(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
     setAutomatedSecurityFixes(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
+    setPrivateVulnerabilityReporting(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
+    private getVulnerabilityAlerts;
+    private getAutomatedSecurityFixes;
+    private getPrivateVulnerabilityReporting;
     private validateGitHub;
     private ghApi;
 }

package/dist/strategies/github-repo-settings-strategy.js

@@ -76,7 +76,14 @@ export class GitHubRepoSettingsStrategy {
         const github = repoInfo;
         const endpoint = `/repos/${github.owner}/${github.repo}`;
         const result = await this.ghApi("GET", endpoint, undefined, options);
-        return JSON.parse(result);
+        const settings = JSON.parse(result);
+        // Fetch security settings from separate endpoints
+        settings.vulnerability_alerts = await this.getVulnerabilityAlerts(github, options);
+        // Pass vulnerability_alerts state - automated security fixes requires it enabled
+        settings.automated_security_fixes = await this.getAutomatedSecurityFixes(github, options, settings.vulnerability_alerts);
+        settings.private_vulnerability_reporting =
+            await this.getPrivateVulnerabilityReporting(github, options);
+        return settings;
     }
     async updateSettings(repoInfo, settings, options) {
         this.validateGitHub(repoInfo);
@@ -103,6 +110,54 @@ export class GitHubRepoSettingsStrategy {
         const method = enable ? "PUT" : "DELETE";
         await this.ghApi(method, endpoint, undefined, options);
     }
+    async setPrivateVulnerabilityReporting(repoInfo, enable, options) {
+        this.validateGitHub(repoInfo);
+        const github = repoInfo;
+        const endpoint = `/repos/${github.owner}/${github.repo}/private-vulnerability-reporting`;
+        const method = enable ? "PUT" : "DELETE";
+        await this.ghApi(method, endpoint, undefined, options);
+    }
+    async getVulnerabilityAlerts(github, options) {
+        const endpoint = `/repos/${github.owner}/${github.repo}/vulnerability-alerts`;
+        try {
+            await this.ghApi("GET", endpoint, undefined, options);
+            return true; // 204 = enabled
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (message.includes("HTTP 404")) {
+                return false; // 404 = disabled
+            }
+            throw error; // Re-throw other errors
+        }
+    }
+    async getAutomatedSecurityFixes(github, options, _vulnerabilityAlertsEnabled) {
+        // Note: GitHub returns JSON with {enabled: boolean} for this endpoint
+        const endpoint = `/repos/${github.owner}/${github.repo}/automated-security-fixes`;
+        try {
+            const result = await this.ghApi("GET", endpoint, undefined, options);
+            // Parse JSON response - GitHub returns {"enabled": true/false}
+            if (result) {
+                const data = JSON.parse(result);
+                return data.enabled === true;
+            }
+            // Empty response (204) means enabled
+            return true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (message.includes("HTTP 404")) {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async getPrivateVulnerabilityReporting(github, options) {
+        const endpoint = `/repos/${github.owner}/${github.repo}/private-vulnerability-reporting`;
+        const result = await this.ghApi("GET", endpoint, undefined, options);
+        const data = JSON.parse(result);
+        return data.enabled === true;
+    }
     validateGitHub(repoInfo) {
         if (!isGitHubRepo(repoInfo)) {
             throw new Error(`GitHub Repo Settings strategy requires GitHub repositories. Got: ${repoInfo.type}`);

package/dist/strategies/repo-settings-strategy.d.ts

@@ -39,6 +39,9 @@ export interface CurrentRepoSettings {
             status: string;
         };
     };
+    vulnerability_alerts?: boolean;
+    automated_security_fixes?: boolean;
+    private_vulnerability_reporting?: boolean;
 }
 export interface IRepoSettingsStrategy {
     /**
@@ -57,6 +60,10 @@ export interface IRepoSettingsStrategy {
      * Enables or disables automated security fixes.
      */
     setAutomatedSecurityFixes(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
+    /**
+     * Enables or disables private vulnerability reporting.
+     */
+    setPrivateVulnerabilityReporting(repoInfo: RepoInfo, enable: boolean, options?: RepoSettingsStrategyOptions): Promise<void>;
 }
 /**
  * Type guard to check if an object implements IRepoSettingsStrategy.

package/dist/strategies/repo-settings-strategy.js

@@ -9,5 +9,6 @@ export function isRepoSettingsStrategy(obj) {
     return (typeof strategy.getSettings === "function" &&
         typeof strategy.updateSettings === "function" &&
         typeof strategy.setVulnerabilityAlerts === "function" &&
-        typeof strategy.setAutomatedSecurityFixes === "function");
+        typeof strategy.setAutomatedSecurityFixes === "function" &&
+        typeof strategy.setPrivateVulnerabilityReporting === "function");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aspruyt/xfg",
-  "version": "3.7.2",
+  "version": "3.7.3",
   "description": "CLI tool for repository-as-code",
   "type": "module",
   "main": "dist/index.js",