@biffo/cli 0.185.3 → 0.185.5

package/dist/index.js

@@ -824,6 +824,29 @@ function classifyUpgradeBranches(refs, currentBranch) {
 // src/adapters/git/index.ts
 var GitAdapter = class {
   /** True if `cwd` is inside a git working tree. */
+  /**
+   * The committer identity git would resolve here, or `null` per unresolved value
+   * (#737).
+   *
+   * `git config --get` exits 1 when a key is unset, which `execa` throws on — so a
+   * missing value is caught and reported as `null` rather than as an error. That
+   * distinction is the whole point: an unset identity is a condition the caller
+   * must act on, not a failure of this lookup.
+   *
+   * No `cwd` resolves against the process's own configuration, which is what the
+   * scaffold's throwaway temp dir inherits.
+   */
+  async configuredIdentity(cwd) {
+    const read2 = async (key) => {
+      try {
+        const { stdout } = await execa2("git", ["config", "--get", key], cwd ? { cwd } : {});
+        return stdout.trim() || null;
+      } catch {
+        return null;
+      }
+    };
+    return { name: await read2("user.name"), email: await read2("user.email") };
+  }
   async isGitRepo(cwd) {
     try {
       await execa2("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
@@ -5652,6 +5675,7 @@ async function runSiblingCreate(github, aws, coreAws, git, config, session, opti
   const totalSteps = 8;
   const { org, repo } = githubRepo(config);
   const pathPrefix = resolvePathPrefix(config);
+  assertGitIdentity(await git.configuredIdentity());
   if (!session.completedSteps.includes("verify_credentials")) {
     log.step(1, totalSteps, "Verifying AWS credentials...");
     await aws.verifyCredentials();
@@ -5944,6 +5968,18 @@ function readExistingSiblingOrigins(filePath) {
     throw err;
   }
 }
+function assertGitIdentity(identity) {
+  const missing = [identity.name ? null : "user.name", identity.email ? null : "user.email"].filter(
+    (v) => v !== null
+  );
+  if (missing.length === 0) return;
+  throw new Error(
+    `git has no ${missing.join(" or ")} configured, so the scaffold commit would fail after the GitHub repository had already been created. Set it first:
+` + missing.map(
+      (k) => `  git config --global ${k} "${k === "user.name" ? "Your Name" : "you@example.com"}"`
+    ).join("\n")
+  );
+}
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
   const cdnVarsPath = join20(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
@@ -8567,9 +8603,9 @@ function deriveRequiredContexts(observed) {
   const required = Math.ceil(window.length * CONTEXT_CONSISTENCY_THRESHOLD);
   return [...seenOn.entries()].filter(([, shas]) => shas.size >= required).map(([name]) => name).sort();
 }
-function protectionParamsFor(contexts) {
+function protectionParamsFor(contexts, options = {}) {
   return {
-    required_status_checks: { strict: true, contexts: [...contexts].sort() },
+    required_status_checks: { strict: options.strict ?? true, contexts: [...contexts].sort() },
     enforce_admins: false,
     required_pull_request_reviews: {
       required_approving_review_count: 0,
@@ -8702,6 +8738,7 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   });
   const findings = [];
   const audited = [];
+  const observedStrict = /* @__PURE__ */ new Map();
   for (const branch of BRANCHES) {
     try {
       await octokit.repos.getBranch({ owner, repo, branch });
@@ -8713,6 +8750,7 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
     try {
       const { data } = await octokit.repos.getBranchProtection({ owner, repo, branch });
       findings.push(...auditBranch(branch, data));
+      observedStrict.set(branch, data.required_status_checks?.strict ?? false);
     } catch (err) {
       if (err.status === 404) {
         findings.push(...auditBranch(branch, null));
@@ -8745,12 +8783,22 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 `);
     console.log(formatPlans(plans));
     let applied = 0;
+    let preserved = 0;
     for (const plan of plans.filter((p) => p.action === "apply")) {
+      const existing = observedStrict.get(plan.branch);
+      const strict = existing ?? true;
+      if (existing === false) {
+        preserved += 1;
+        console.log(
+          `  ${plan.branch}: keeping strict=false \u2014 already set on this branch, so it is a
+      decision rather than a gap. Change it deliberately with \`gh api\`, not here.`
+        );
+      }
       await octokit.repos.updateBranchProtection({
         owner,
         repo,
         branch: plan.branch,
-        ...protectionParamsFor(plan.contexts)
+        ...protectionParamsFor(plan.contexts, { strict })
       });
       applied += 1;
     }
@@ -8760,8 +8808,10 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
       );
       process.exit(1);
     }
-    console.log(`
-\u2713 protection applied to ${applied} branch(es). Re-run without --fix to verify.`);
+    console.log(
+      `
+\u2713 protection applied to ${applied} branch(es)` + (preserved > 0 ? `, ${preserved} keeping an existing strict=false` : "") + ". Re-run without --fix to verify."
+    );
     return;
   }
   if (findings.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.185.3",
+  "version": "0.185.5",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",