@biffo/cli 0.165.0 → 0.166.1

package/dist/index.js

@@ -1506,6 +1506,70 @@ var GitHubAdapter = class {
     }
     log.success("Branch protection configured on dev, staging, and main");
   }
+  /**
+   * Protect a single branch with caller-supplied required checks (#803).
+   *
+   * `configureBranchProtection` above exists for **deployable** repos and
+   * protects `dev`, `staging` and `main` with `DEFAULT_STATUS_CHECKS` — the
+   * core workflow's job names. Neither is right for a plugin repo:
+   *
+   * - A plugin repo is **non-deployable** and has `dev` only (AGENTS.md §2).
+   *   Reusing the deployable path would demand two branches it should not have,
+   *   and `waitForBranch` would hang on them for two minutes each before
+   *   failing.
+   * - Its checks are its own CI's job names (`Lint`, `Type Check`, `Test`, …),
+   *   not the core workflow's. Requiring a context that is never reported
+   *   blocks every PR for ever, on a branch whose CI is entirely green.
+   *
+   * `statusChecks` must be non-empty. Protection that requires nothing is worse
+   * than none: it reads as configured while gating on nothing, so callers that
+   * could not determine the contexts must not silently land here.
+   */
+  async protectSingleBranch(org, repo, branch, statusChecks, protectionIntervalMs = 3e3) {
+    if (statusChecks.length === 0) {
+      throw new Error(
+        `Refusing to protect ${org}/${repo}@${branch} with no required status checks \u2014 that reads as protected while gating on nothing. Determine the workflow's job contexts first.`
+      );
+    }
+    log.info(`Waiting for ${branch} branch to be ready...`);
+    await this.waitForBranch(org, repo, branch);
+    log.info(`Configuring branch protection on ${branch}...`);
+    const params = {
+      owner: org,
+      repo,
+      branch,
+      required_status_checks: { strict: true, contexts: statusChecks },
+      enforce_admins: false,
+      required_pull_request_reviews: {
+        required_approving_review_count: 0,
+        dismiss_stale_reviews: false
+      },
+      restrictions: null,
+      required_linear_history: true,
+      allow_force_pushes: false,
+      allow_deletions: false
+    };
+    const deadline = Date.now() + 3e4;
+    while (true) {
+      try {
+        await this.octokit.repos.updateBranchProtection(params);
+        break;
+      } catch (err) {
+        const status = err.status;
+        if (status === 403) {
+          log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
+          log.warn("  Add it later via GitHub once the plan allows it, or make the repo public.");
+          return;
+        }
+        if (status !== 404 || Date.now() >= deadline) throw err;
+        log.info("Branch protection endpoint not yet ready, retrying...");
+        await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
+      }
+    }
+    log.success(
+      `Branch protection configured on ${branch} (${statusChecks.length} required check(s))`
+    );
+  }
   async createEnvironments(config) {
     const { org, repo } = config.source_control.config;
     for (const env of config.environments) {
@@ -1565,6 +1629,34 @@ var GitHubAdapter = class {
       throw err;
     }
   }
+  /**
+   * How many self-hosted runners this repo can actually see (#803, biffo-runners#2).
+   *
+   * Setting `RUNNER_LABEL` points a repo's jobs at a self-hosted fleet. It does
+   * not grant the fleet's GitHub App access to that repo — and until someone
+   * does, the repo sees **zero** runners and every job queues for ever with no
+   * error at all. Measured on a freshly created plugin repo: 0 runners, while an
+   * established one in the same fleet saw 3.
+   *
+   * Queuing for ever and failing at the billing wall look completely different
+   * in the UI and are the same outcome under branch protection: nothing can
+   * merge. Callers use this to say so at create time rather than leaving it to
+   * be discovered on the first PR.
+   *
+   * Returns `null` when the count cannot be read (permissions, API error) —
+   * distinct from `0`, which is a real and actionable answer.
+   */
+  async repoRunnerCount(org, repo) {
+    try {
+      const { data } = await this.octokit.actions.listSelfHostedRunnersForRepo({
+        owner: org,
+        repo
+      });
+      return data.total_count;
+    } catch {
+      return null;
+    }
+  }
   async setRepoVariable(org, repo, name, value) {
     log.info(`Setting variable: ${name}`);
     try {
@@ -6370,6 +6462,50 @@ import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
 
+// src/lib/workflow-check-contexts.ts
+function unquote(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') && trimmed.length > 1 || trimmed.startsWith("'") && trimmed.endsWith("'") && trimmed.length > 1) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function workflowCheckContexts(workflow) {
+  const lines = workflow.split("\n");
+  const jobsIndex = lines.findIndex((line) => /^jobs:\s*(#.*)?$/.test(line));
+  if (jobsIndex === -1) return [];
+  const contexts = [];
+  let currentJobId = null;
+  let currentJobIndent = 0;
+  let currentName = null;
+  const flush = () => {
+    if (currentJobId !== null) contexts.push(currentName ?? currentJobId);
+    currentJobId = null;
+    currentName = null;
+  };
+  for (const line of lines.slice(jobsIndex + 1)) {
+    if (line.trim() === "" || /^\s*#/.test(line)) continue;
+    if (!/^\s/.test(line)) break;
+    const jobMatch = /^(\s+)([A-Za-z0-9_-]+):\s*(#.*)?$/.exec(line);
+    if (jobMatch?.[1] !== void 0 && jobMatch[2] !== void 0) {
+      const indent = jobMatch[1].length;
+      if (currentJobId === null || indent === currentJobIndent) {
+        flush();
+        currentJobId = jobMatch[2];
+        currentJobIndent = indent;
+        continue;
+      }
+    }
+    if (currentJobId === null) continue;
+    const nameMatch = /^(\s+)name:\s*(.+?)\s*$/.exec(line);
+    if (nameMatch?.[1] !== void 0 && nameMatch[2] !== void 0 && nameMatch[1].length === currentJobIndent + 2 && currentName === null) {
+      currentName = unquote(nameMatch[2]);
+    }
+  }
+  flush();
+  return contexts;
+}
+
 // src/lib/plugin-locations.ts
 import { existsSync as existsSync21, readdirSync as readdirSync10 } from "fs";
 import { join as join21 } from "path";
@@ -6728,6 +6864,12 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
 ).option(
   "--standalone",
   "Scaffold a standalone plugin repo (ADR-0003 section 2) into ./biffo-plugin-<name>/ instead of into this checkout, keeping its own CI/CD workflows"
+).option(
+  "--org <org>",
+  "With --standalone, also create the GitHub repo under this org (or user), push, and protect dev"
+).option(
+  "--runner-label <label>",
+  "With --org, the RUNNER_LABEL the new repo\u2019s CI should run on (defaults to mirroring this checkout\u2019s)"
 ).option(
   "--skeleton <path>",
   "Path to the plugin skeleton (defaults to _skeletons/plugin-template)"
@@ -6740,12 +6882,18 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
         {
           firstParty: options.firstParty ?? false,
           standalone: options.standalone ?? false,
+          ...options.org ? { org: options.org } : {},
+          ...options.runnerLabel ? { runnerLabel: options.runnerLabel } : {},
           ...options.skeleton ? { skeletonRoot: resolve11(options.skeleton) } : {},
           dryRun: options.dryRun ?? false,
           commit: options.commit !== false,
           cwd
         },
-        { git: new GitAdapter() }
+        {
+          git: new GitAdapter(),
+          makeGitHub: (token) => new GitHubAdapter(token),
+          resolveToken: resolveGithubToken3
+        }
       );
     } catch (err) {
       log.error(err.message);
@@ -6858,8 +7006,98 @@ async function runStandaloneCreate(names, options, deps) {
     await deps.git.commit(destDir, `feat: scaffold ${names.slug} plugin`);
     log.success(`Initialised a git repo on dev with an initial commit`);
   }
+  if (options.org !== void 0 && options.org !== "") {
+    if (!options.commit) {
+      throw new Error(
+        "--org needs a commit to push. Drop --no-commit, or create the repo yourself using the steps printed by a --no-commit run."
+      );
+    }
+    await createAndPushStandaloneRepo(options.org, names, destDir, options, deps);
+    return;
+  }
   printStandaloneNextSteps(names, minorOf(manifest.version));
 }
+async function createAndPushStandaloneRepo(org, names, destDir, options, deps) {
+  if (deps.makeGitHub === void 0 || deps.resolveToken === void 0) {
+    throw new Error("No GitHub adapter available \u2014 cannot create a repository.");
+  }
+  const token = await deps.resolveToken();
+  const github = deps.makeGitHub(token);
+  const cloneUrl = await github.createEmptyRepo(org, names.dist, `${names.slug} \u2014 a Biffo plugin`);
+  await propagateRunnerLabel(org, names.dist, options, deps, github);
+  await deps.git.addRemote(destDir, "origin", cloneUrl);
+  await deps.git.push(destDir, "dev", { token });
+  log.success(`Pushed dev to ${org}/${names.dist}`);
+  await github.setDefaultBranch(org, names.dist, "dev");
+  const ciPath = join23(destDir, ".github", "workflows", "ci.yml");
+  const contexts = existsSync23(ciPath) ? workflowCheckContexts(readFileSync17(ciPath, "utf8")) : [];
+  if (contexts.length === 0) {
+    log.warn(
+      `Could not determine required status checks from ${ciPath} \u2014 skipping branch protection. Configure it manually on dev once you know the CI job names.`
+    );
+  } else {
+    await github.protectSingleBranch(org, names.dist, "dev", contexts);
+  }
+  printStandaloneRemoteNextSteps(names, org);
+}
+async function propagateRunnerLabel(org, repo, options, deps, github) {
+  try {
+    let label = options.runnerLabel?.trim();
+    if (!label) {
+      const source = await currentRepoSlug(options.cwd, deps);
+      if (source) {
+        label = (await github.getRepoVariable(source.org, source.repo, "RUNNER_LABEL"))?.trim();
+      }
+    }
+    if (!label) {
+      log.warn(
+        `No RUNNER_LABEL set on ${org}/${repo} \u2014 its CI will use GitHub-hosted runners. If this account routes CI to a self-hosted fleet, every job will fail before it starts, and the branch protection just configured will block every PR on checks that never report. Fix with: gh variable set RUNNER_LABEL --repo ${org}/${repo}`
+      );
+      return;
+    }
+    await github.setRepoVariable(org, repo, "RUNNER_LABEL", label);
+    log.success(`RUNNER_LABEL=${label} set on ${org}/${repo}`);
+    const runners = await github.repoRunnerCount(org, repo);
+    if (runners === 0) {
+      log.warn(
+        `${org}/${repo} points at the '${label}' runner fleet but can see 0 runners. Jobs will queue indefinitely with no error until the fleet's GitHub App is granted access to this repo (biffo-runners#2) \u2014 and the branch protection just applied will block every PR until then.`
+      );
+    }
+  } catch (err) {
+    log.warn(
+      `Could not set RUNNER_LABEL on ${org}/${repo}: ${err.message}. Set it manually if this account uses self-hosted runners.`
+    );
+  }
+}
+async function currentRepoSlug(cwd, deps) {
+  try {
+    const url = await deps.git.getRemoteUrl(cwd, "origin");
+    const match = /[:/]([^/:]+)\/([^/]+?)(?:\.git)?$/.exec(url.trim());
+    if (match?.[1] === void 0 || match[2] === void 0) return null;
+    return { org: match[1], repo: match[2] };
+  } catch {
+    return null;
+  }
+}
+function printStandaloneRemoteNextSteps(names, org) {
+  console.log(chalk13.bold("\n  Standalone plugin repo created!\n"));
+  console.log(`  https://github.com/${org}/${names.dist}  (dev, protected)
+`);
+  console.log("  Next:");
+  console.log(chalk13.dim(`    1. cd ${names.dist} && edit biffo.plugin.json`));
+  console.log(
+    chalk13.dim("    2. Add it to the registry so it appears in the plugin store \u2014 either set")
+  );
+  console.log(
+    chalk13.dim(
+      "       REGISTRY_PUBLISH_TOKEN on the repo, or add it to the registry\u2019s sources.json"
+    )
+  );
+  console.log(
+    chalk13.dim(`    3. Consumers install it with: biffo plugin install ${names.slug}@<minor>
+`)
+  );
+}
 function minorOf(version) {
   const match = /^(\d+)\.(\d+)/.exec(version);
   return match ? `${match[1]}.${match[2]}` : version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.165.0",
+  "version": "0.166.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",