@biffo/cli 0.198.2 → 0.198.4

package/dist/index.js

@@ -1070,6 +1070,15 @@ var GitAdapter = class {
   async createBranch(cwd, branch) {
     await execa2("git", ["switch", "-c", branch], { cwd });
   }
+  /**
+   * Switch to an existing branch. Fails if it does not exist, and — deliberately
+   * — if the switch would discard uncommitted work: this is the undo half of
+   * `createBranch` (#984), so it must never be able to destroy the tree it is
+   * putting back.
+   */
+  async switchBranch(cwd, branch) {
+    await execa2("git", ["switch", branch], { cwd });
+  }
   /**
    * Push the current HEAD to `branch` on the remote. When `token` is given and
    * the remote is HTTPS, it's embedded in the push URL for auth (SSH/file
@@ -1158,6 +1167,53 @@ function injectToken(repoUrl, token) {
 // src/adapters/source-control/github/index.ts
 import { execSync } from "child_process";
 import { Octokit } from "@octokit/rest";
+
+// src/lib/branch-protection-outcome.ts
+var pending = [];
+function recordBranchProtectionOutcome(outcome) {
+  pending.push(outcome);
+  return outcome;
+}
+function isUnprotected(outcome) {
+  return outcome.status !== "applied" || outcome.unprotectedBranches.length > 0;
+}
+function formatBranchProtectionSummary(outcomes) {
+  if (outcomes.length === 0) return [];
+  const unprotected = outcomes.filter(isUnprotected);
+  if (unprotected.length === 0) {
+    return [
+      `Branch protection applied to ${outcomes.map((o) => `${o.org}/${o.repo}`).sort().join(", ")}`
+    ];
+  }
+  const lines = [
+    `Branch protection was NOT fully applied \u2014 ${unprotected.length} of ${outcomes.length} repositor${outcomes.length === 1 ? "y" : "ies"} created by this run ${unprotected.length === 1 ? "is" : "are"} unprotected:`
+  ];
+  for (const outcome of unprotected) {
+    const left = outcome.unprotectedBranches.join(", ") || "unknown";
+    const why = outcome.status === "skipped-403" ? "GitHub returned 403 \u2014 the org's plan does not allow branch protection on this repo" : outcome.status === "failed" ? "branch protection failed" : "branch protection incomplete";
+    lines.push(`  ${outcome.org}/${outcome.repo} \u2014 unprotected: ${left} (${why})`);
+    if (outcome.reason) lines.push(`      ${outcome.reason}`);
+  }
+  lines.push(
+    "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now.",
+    "  Fix it with:  biffo check branch-protection --fix   (after upgrading the plan, or making the repo public)"
+  );
+  return lines;
+}
+function reportBranchProtectionSummary() {
+  const outcomes = pending.splice(0, pending.length);
+  const lines = formatBranchProtectionSummary(outcomes);
+  if (lines.length === 0) return outcomes;
+  if (outcomes.some(isUnprotected)) {
+    log.error(lines[0]);
+    for (const line of lines.slice(1)) log.error(line);
+  } else {
+    log.success(lines[0]);
+  }
+  return outcomes;
+}
+
+// src/adapters/source-control/github/index.ts
 var DEFAULT_STATUS_CHECKS = [
   "JS (lint, types, test, audit)",
   "Python (lint, types, test, security)",
@@ -1557,49 +1613,96 @@ var GitHubAdapter = class {
     await this.octokit.repos.update({ owner: org, repo, default_branch: branch });
     log.info(`Default branch set to ${branch}`);
   }
+  /**
+   * Protect `dev`, `staging` and `main`, and **say what actually happened**.
+   *
+   * This used to return `Promise<void>`, which made the 403 path (GitHub
+   * refusing branch protection on a private org repo whose plan does not
+   * include it) indistinguishable from success at every call site: the method
+   * logged two warnings and returned, and the scaffold went on to report a
+   * repo created. Nothing durable recorded that protection had been skipped,
+   * so the only trace was a log line in the middle of a long provisioning
+   * transcript. Three repos — including a live core platform — ran completely
+   * unprotected for three weeks on the strength of that (#715, #737 item 2).
+   *
+   * The returned outcome is also pushed onto the run-scoped collector in
+   * `lib/branch-protection-outcome.ts`, so callers that do nothing with the
+   * return value still get named in the end-of-run summary.
+   */
   async configureBranchProtection(config, protectionIntervalMs = 3e3, statusChecks = DEFAULT_STATUS_CHECKS) {
     const { org, repo } = config.source_control.config;
     const branches = ["dev", "staging", "main"];
-    for (const branch of branches) {
-      log.info(`Waiting for ${branch} branch to be ready...`);
-      await this.waitForBranch(org, repo, branch);
-      log.info(`Configuring branch protection on ${branch}...`);
-      const params = {
-        owner: org,
-        repo,
-        branch,
-        required_status_checks: { strict: true, contexts: statusChecks },
-        enforce_admins: false,
-        required_pull_request_reviews: {
-          required_approving_review_count: 0,
-          dismiss_stale_reviews: false
-        },
-        restrictions: null,
-        required_linear_history: true,
-        allow_force_pushes: false,
-        allow_deletions: false
-      };
-      const deadline = Date.now() + 3e4;
-      while (true) {
-        try {
-          await this.octokit.repos.updateBranchProtection(params);
-          break;
-        } catch (err) {
-          const status = err.status;
-          if (status === 403) {
-            log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
-            log.warn(
-              "  This usually means the organization is on a plan that only supports branch protection on public repos (GitHub Team/Enterprise is required for private org repos). Skipping branch protection \u2014 add it later via GitHub once the plan allows it, or make the repo public."
-            );
-            return;
+    const applied = [];
+    const remaining = () => branches.filter((b) => !applied.includes(b));
+    try {
+      for (const branch of branches) {
+        log.info(`Waiting for ${branch} branch to be ready...`);
+        await this.waitForBranch(org, repo, branch);
+        log.info(`Configuring branch protection on ${branch}...`);
+        const params = {
+          owner: org,
+          repo,
+          branch,
+          required_status_checks: { strict: true, contexts: statusChecks },
+          enforce_admins: false,
+          required_pull_request_reviews: {
+            required_approving_review_count: 0,
+            dismiss_stale_reviews: false
+          },
+          restrictions: null,
+          required_linear_history: true,
+          allow_force_pushes: false,
+          allow_deletions: false
+        };
+        const deadline = Date.now() + 3e4;
+        while (true) {
+          try {
+            await this.octokit.repos.updateBranchProtection(params);
+            applied.push(branch);
+            break;
+          } catch (err) {
+            const status = err.status;
+            if (status === 403) {
+              log.warn(
+                `Branch protection unavailable for ${org}/${repo}: ${err.message}`
+              );
+              log.warn(
+                "  This usually means the organization is on a plan that only supports branch protection on public repos (GitHub Team/Enterprise is required for private org repos). Skipping branch protection \u2014 add it later via GitHub once the plan allows it, or make the repo public."
+              );
+              return recordBranchProtectionOutcome({
+                status: "skipped-403",
+                org,
+                repo,
+                protectedBranches: applied,
+                unprotectedBranches: remaining(),
+                reason: err.message
+              });
+            }
+            if (status !== 404 || Date.now() >= deadline) throw err;
+            log.info("Branch protection endpoint not yet ready, retrying...");
+            await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
           }
-          if (status !== 404 || Date.now() >= deadline) throw err;
-          log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
         }
       }
+    } catch (err) {
+      recordBranchProtectionOutcome({
+        status: "failed",
+        org,
+        repo,
+        protectedBranches: applied,
+        unprotectedBranches: remaining(),
+        reason: err.message
+      });
+      throw err;
     }
     log.success("Branch protection configured on dev, staging, and main");
+    return recordBranchProtectionOutcome({
+      status: "applied",
+      org,
+      repo,
+      protectedBranches: applied,
+      unprotectedBranches: []
+    });
   }
   /**
    * Protect a single branch with caller-supplied required checks (#803).
@@ -2937,8 +3040,44 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     throw new Error(`${options.cwd} is not a git repository.`);
   }
   const branch = upgradeBranchName(fromVersion, toVersion);
+  const callerBranch = await git.currentBranch(options.cwd);
   log.step(1, 4, `Creating branch ${branch}`);
   await git.createBranch(options.cwd, branch);
+  try {
+    await buildCommitAndOpenPr(
+      options,
+      deps,
+      plan,
+      migrations,
+      fromVersion,
+      toVersion,
+      breaking,
+      theirsDir,
+      coreVersionCleanup,
+      branch,
+      token
+    );
+  } finally {
+    await restoreCallerBranch(git, options.cwd, callerBranch, branch);
+  }
+}
+async function restoreCallerBranch(git, cwd, callerBranch, upgradeBranch) {
+  if (callerBranch === "HEAD" || callerBranch === "") {
+    log.warn(
+      `Left ${cwd} on ${upgradeBranch}: HEAD was detached on entry, so there is no branch to restore (#984).`
+    );
+    return;
+  }
+  try {
+    await git.switchBranch(cwd, callerBranch);
+  } catch {
+    log.warn(
+      `Could not switch ${cwd} back to ${callerBranch} \u2014 it is still on ${upgradeBranch}. Restore it with \`git switch ${callerBranch}\` (#984).`
+    );
+  }
+}
+async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, branch, token) {
+  const { git } = deps;
   const applied = applyUpgradePlan(options.cwd, plan, theirsDir);
   const carried = applyMigrationCarry(options.cwd, migrations);
   writeInstanceCoreVersion(options.cwd, toVersion);
@@ -5643,11 +5782,15 @@ async function runSiblingCreateCommand(name, options) {
   const aws = new AwsAdapter(config);
   const coreAws = new AwsAdapter(coreConfig);
   const git = new GitAdapter();
-  await runSiblingCreate(github, aws, coreAws, git, config, session, {
-    coreConfig,
-    skeletonRoot: options.templateRoot,
-    githubToken: token
-  });
+  try {
+    await runSiblingCreate(github, aws, coreAws, git, config, session, {
+      coreConfig,
+      skeletonRoot: options.templateRoot,
+      githubToken: token
+    });
+  } finally {
+    reportBranchProtectionSummary();
+  }
   const { org, repo } = githubRepo(config);
   const pathPrefix = resolvePathPrefix(config);
   log.success("\nSibling repo created successfully!");
@@ -5781,6 +5924,7 @@ async function runSiblingCreate(github, aws, coreAws, git, config, session, opti
   } else {
     log.step(8, totalSteps, "Already registered with the core project \u2014 skipping");
   }
+  reportBranchProtectionSummary();
   deleteSiblingSession(config.project.name);
 }
 function resolvePathPrefix(config) {
@@ -6197,12 +6341,16 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     githubToken ??= await resolveGithubToken3(options.yes === true || Boolean(options.config));
     const github = new GitHubAdapter(githubToken);
     const aws = new AwsAdapter(config);
-    await runInit(github, aws, config, session, {
-      git: new GitAdapter(),
-      awsFor: (siblingConfig) => new AwsAdapter(siblingConfig),
-      skeletonRoot: defaultSiblingTemplateRoot(),
-      githubToken
-    });
+    try {
+      await runInit(github, aws, config, session, {
+        git: new GitAdapter(),
+        awsFor: (siblingConfig) => new AwsAdapter(siblingConfig),
+        skeletonRoot: defaultSiblingTemplateRoot(),
+        githubToken
+      });
+    } finally {
+      reportBranchProtectionSummary();
+    }
     const { org, repo } = config.source_control.config;
     const appRepo = rootSiblingProjectName(config.project.name);
     log.success("\nProject initialised successfully!");
@@ -6340,6 +6488,7 @@ async function runInit(github, aws, config, session, appSibling) {
       log.step(6, totalSteps, "Application sibling already created \u2014 skipping");
     }
   }
+  reportBranchProtectionSummary();
   deleteSession(config.project.name);
   saveProjectConfig(config);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.198.2",
+  "version": "0.198.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",