@biffo/cli 0.146.2 → 0.147.0

package/dist/index.js

@@ -7736,6 +7736,72 @@ import { Command as Command23 } from "commander";
 import { Octokit as Octokit2 } from "@octokit/rest";
 import { execa as execa5 } from "execa";
 
+// src/lib/branch-protection-apply.ts
+var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
+var RECENT_COMMIT_WINDOW = 6;
+function deriveRequiredContexts(observed) {
+  const shasNewestFirst = [];
+  for (const { headSha } of observed) {
+    if (!shasNewestFirst.includes(headSha)) shasNewestFirst.push(headSha);
+  }
+  const window = shasNewestFirst.slice(0, RECENT_COMMIT_WINDOW);
+  if (window.length === 0) return [];
+  const seenOn = /* @__PURE__ */ new Map();
+  for (const { name, headSha } of observed) {
+    if (!window.includes(headSha)) continue;
+    const set = seenOn.get(name) ?? /* @__PURE__ */ new Set();
+    set.add(headSha);
+    seenOn.set(name, set);
+  }
+  const required = Math.ceil(window.length * CONTEXT_CONSISTENCY_THRESHOLD);
+  return [...seenOn.entries()].filter(([, shas]) => shas.size >= required).map(([name]) => name).sort();
+}
+function protectionParamsFor(contexts) {
+  return {
+    required_status_checks: { strict: true, contexts: [...contexts].sort() },
+    enforce_admins: false,
+    required_pull_request_reviews: {
+      required_approving_review_count: 0,
+      dismiss_stale_reviews: false
+    },
+    restrictions: null,
+    required_linear_history: true,
+    allow_force_pushes: false,
+    allow_deletions: false
+  };
+}
+function planProtection(branch, exists, observed) {
+  if (!exists) {
+    return {
+      branch,
+      action: "skip",
+      reason: "branch does not exist",
+      contexts: []
+    };
+  }
+  const contexts = deriveRequiredContexts(observed);
+  if (contexts.length === 0) {
+    return {
+      branch,
+      action: "skip",
+      reason: "no check has reported consistently enough to require \u2014 applying protection with an empty context list would make the branch look protected while admitting any PR",
+      contexts: []
+    };
+  }
+  return {
+    branch,
+    action: "apply",
+    reason: `requiring ${contexts.length} context(s) observed on recent commits`,
+    contexts
+  };
+}
+function formatPlans(plans) {
+  return plans.map(
+    (p) => p.action === "apply" ? `  ${p.branch}: apply \u2014 ${p.reason}
+${p.contexts.map((c) => `      \u2022 ${c}`).join("\n")}` : `  ${p.branch}: skip \u2014 ${p.reason}`
+  ).join("\n");
+}
+
 // src/lib/branch-protection-audit.ts
 function auditBranch(branch, protection) {
   if (protection === null) {
@@ -7805,7 +7871,16 @@ async function resolveRepo(explicit) {
   }
   return { owner: m[1], repo: m[2] };
 }
-async function runBranchProtectionCheck(explicitRepo) {
+async function observedChecks(octokit, owner, repo, branch) {
+  const { data } = await octokit.actions.listWorkflowRunsForRepo({
+    owner,
+    repo,
+    branch,
+    per_page: 60
+  });
+  return data.workflow_runs.filter((r) => r.status === "completed").map((r) => ({ name: r.name ?? "", headSha: r.head_sha })).filter((c) => c.name !== "");
+}
+async function runBranchProtectionCheck(explicitRepo, options = {}) {
   const { owner, repo } = await resolveRepo(explicitRepo);
   const octokit = new Octokit2({
     auth: tokenFromEnv(),
@@ -7851,12 +7926,39 @@ async function runBranchProtectionCheck(explicitRepo) {
     );
     process.exit(1);
   }
+  if (findings.length > 0 && options.fix) {
+    const defaultBranch = (await octokit.repos.get({ owner, repo })).data.default_branch;
+    const observed = await observedChecks(octokit, owner, repo, defaultBranch);
+    const plans = audited.map((branch) => planProtection(branch, true, observed));
+    console.log(`Backfilling protection on ${owner}/${repo}:
+`);
+    console.log(formatPlans(plans));
+    let applied = 0;
+    for (const plan of plans.filter((p) => p.action === "apply")) {
+      await octokit.repos.updateBranchProtection({
+        owner,
+        repo,
+        branch: plan.branch,
+        ...protectionParamsFor(plan.contexts)
+      });
+      applied += 1;
+    }
+    if (applied === 0) {
+      console.error(
+        "\n\u2717 nothing applied \u2014 no branch had a check reporting consistently enough to require.\n  Protection with an empty context list is worse than none: a PR reads CLEAN before\n  any run registers. Get CI reporting on this repo first."
+      );
+      process.exit(1);
+    }
+    console.log(`
+\u2713 protection applied to ${applied} branch(es). Re-run without --fix to verify.`);
+    return;
+  }
   if (findings.length > 0) {
     console.error(`\u2717 branch-protection guard: ${owner}/${repo}
 `);
     console.error(formatFindings(findings));
     console.error(
-      "\n  Protection is applied once at scaffold time and skipped silently on a 403 (#715).\n  Fix with the repo settings API, matching the policy \u2014 not the exact required\n  checks, which legitimately differ per repo."
+      "\n  Protection is applied once at scaffold time and skipped silently on a 403 (#715),\n  and standalone plugin repos are created outside the CLI so it never runs at all\n  (#714). Re-run with --fix to backfill it from the checks this repo actually reports."
     );
     process.exit(1);
   }
@@ -8269,8 +8371,11 @@ checkCommand.command("plugin-terraform").description("Verify every template-owne
 });
 checkCommand.command("branch-protection").description(
   "Verify dev/staging/main are actually protected \u2014 scaffolding skips this on a 403 (#715)"
-).option("--repo <owner/name>", "Repo to audit; defaults to this checkout's origin remote").action(async (opts) => {
-  await runBranchProtectionCheck(opts.repo);
+).option("--repo <owner/name>", "Repo to audit; defaults to this checkout's origin remote").option(
+  "--fix",
+  "Backfill protection from the checks this repo actually reports (#714, #715). Refuses to apply an empty required-check list, which would look protected and admit anything."
+).action(async (opts) => {
+  await runBranchProtectionCheck(opts.repo, { fix: opts.fix });
 });
 function rawArgsAfter(subcommand) {
   const at = process.argv.indexOf(subcommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.146.2",
+  "version": "0.147.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",