@biffo/cli 0.199.1 → 0.199.3

package/dist/index.js

@@ -216,6 +216,34 @@ function latestCoreVersionFromTags(repo, git = defaultTagRunner, options = {}) {
 var CORE_TAG_PREFIX = "core-v";
 var defaultTagRunner = (args) => execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
 
+// src/lib/git-tracked-files.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { realpathSync } from "fs";
+var defaultGit = (args) => execFileSync2("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function gitTrackedFiles(root, git = defaultGit) {
+  let top;
+  try {
+    top = git(["-C", root, "rev-parse", "--show-toplevel"]).trim();
+  } catch {
+    return null;
+  }
+  if (!top) return null;
+  try {
+    if (realpathSync(top) !== realpathSync(root)) return null;
+  } catch {
+    return null;
+  }
+  let out;
+  try {
+    out = git(["-C", root, "ls-files", "-z"]);
+  } catch {
+    return null;
+  }
+  const files = out.split("\0").filter((p) => p !== "");
+  if (files.length === 0) return null;
+  return new Set(files);
+}
+
 // src/lib/core-manifest.ts
 var CORE_MANIFEST_FILE = "core-manifest.json";
 var CoreManifestSchema2 = z2.object({
@@ -315,8 +343,9 @@ function isTemplateOwned(relPath, manifest) {
 function toPosix(p) {
   return sep === "/" ? p : p.split(sep).join("/");
 }
-function listTemplateOwnedFiles(root, manifest) {
+function listTemplateOwnedFiles(root, manifest, options = {}) {
   const out = [];
+  const tracked = options.trackedOnly ? options.git ? gitTrackedFiles(root, options.git) : gitTrackedFiles(root) : null;
   function walk(dir) {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
       if (entry.isDirectory() && HARD_EXCLUDED_DIRS.has(entry.name)) continue;
@@ -325,6 +354,7 @@ function listTemplateOwnedFiles(root, manifest) {
         walk(abs);
       } else if (entry.isFile()) {
         const rel = toPosix(relative(root, abs));
+        if (tracked && !tracked.has(rel)) continue;
         if (isTemplateOwned(rel, manifest)) out.push(rel);
       }
     }
@@ -335,10 +365,11 @@ function listTemplateOwnedFiles(root, manifest) {
 function sameFile(a, b) {
   return readFileSync2(a).equals(readFileSync2(b));
 }
-function computeCoreDiff(templateRoot, instanceRoot, manifest, baseRoot) {
-  const templateFiles = new Set(listTemplateOwnedFiles(templateRoot, manifest));
+function computeCoreDiff(templateRoot, instanceRoot, manifest, baseRoot, options = {}) {
+  const trackedOnly = options.git ? { trackedOnly: true, git: options.git } : { trackedOnly: true };
+  const templateFiles = new Set(listTemplateOwnedFiles(templateRoot, manifest, trackedOnly));
   const instanceFiles = new Set(listTemplateOwnedFiles(instanceRoot, manifest));
-  const baseFiles = baseRoot ? new Set(listTemplateOwnedFiles(baseRoot, manifest)) : void 0;
+  const baseFiles = baseRoot ? new Set(listTemplateOwnedFiles(baseRoot, manifest, trackedOnly)) : void 0;
   const diff = {
     added: [],
     removed: [],
@@ -687,9 +718,10 @@ var EMPTY_SUMMARY = () => ({
 });
 async function planCoreUpgrade(options) {
   const mergeFile = options.mergeFile ?? gitMergeFile;
-  const base = new Set(listTemplateOwnedFiles(options.baseDir, options.manifest));
+  const trackedOnly = { trackedOnly: true };
+  const base = new Set(listTemplateOwnedFiles(options.baseDir, options.manifest, trackedOnly));
   const ours = new Set(listTemplateOwnedFiles(options.oursDir, options.manifest));
-  const theirs = new Set(listTemplateOwnedFiles(options.theirsDir, options.manifest));
+  const theirs = new Set(listTemplateOwnedFiles(options.theirsDir, options.manifest, trackedOnly));
   const divergentPrefixes = readDivergenceConfig(options.oursDir).warnOnly.map((e) => e.prefix);
   const isDeclaredDivergent = (path) => divergentPrefixes.some((prefix) => path.startsWith(prefix));
   const paths = [.../* @__PURE__ */ new Set([...base, ...ours, ...theirs])].sort();
@@ -1190,16 +1222,37 @@ function formatBranchProtectionSummary(outcomes) {
   ];
   for (const outcome of unprotected) {
     const left = outcome.unprotectedBranches.join(", ") || "unknown";
-    const why = outcome.status === "skipped-403" ? "GitHub returned 403 \u2014 the org's plan does not allow branch protection on this repo" : outcome.status === "failed" ? "branch protection failed" : "branch protection incomplete";
-    lines.push(`  ${outcome.org}/${outcome.repo} \u2014 unprotected: ${left} (${why})`);
+    lines.push(
+      `  ${outcome.org}/${outcome.repo} \u2014 unprotected: ${left} (${whyUnprotected(outcome)})`
+    );
     if (outcome.reason) lines.push(`      ${outcome.reason}`);
   }
   lines.push(
-    "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now.",
-    "  Fix it with:  biffo check branch-protection --fix   (after upgrading the plan, or making the repo public)"
+    "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now."
+  );
+  if (unprotected.some((o) => o.status === "skipped-no-contexts")) {
+    lines.push(
+      "  Where the required checks could not be determined, the fix is the CI job names, not the plan: make the workflow report named jobs, let one run complete, then backfill."
+    );
+  }
+  const has403 = unprotected.some((o) => o.status === "skipped-403");
+  lines.push(
+    "  Fix it with:  biffo check branch-protection --fix   " + (has403 ? "(after upgrading the plan, or making the repo public)" : "(it derives the required checks from the runs the repo has actually reported)")
   );
   return lines;
 }
+function whyUnprotected(outcome) {
+  switch (outcome.status) {
+    case "skipped-403":
+      return "GitHub returned 403 \u2014 the org's plan does not allow branch protection on this repo";
+    case "skipped-no-contexts":
+      return "the required status checks could not be determined, and protection requiring nothing reads as configured while gating on nothing";
+    case "failed":
+      return "branch protection failed";
+    default:
+      return "branch protection incomplete";
+  }
+}
 function reportBranchProtectionSummary() {
   const outcomes = pending.splice(0, pending.length);
   const lines = formatBranchProtectionSummary(outcomes);
@@ -1722,51 +1775,91 @@ var GitHubAdapter = class {
    * `statusChecks` must be non-empty. Protection that requires nothing is worse
    * than none: it reads as configured while gating on nothing, so callers that
    * could not determine the contexts must not silently land here.
+   *
+   * Like `configureBranchProtection`, this **returns and records** what actually
+   * happened (#1001). It used to return `Promise<void>` and swallow the 403 with
+   * two log warnings, so `biffo plugin create --org` printed its next-steps
+   * block and exited 0 with nothing anywhere recording that the repo it had just
+   * created had an unprotected `dev` — the identical defect #715 described for
+   * the deployable path, on the path #999 deliberately left out of scope.
    */
   async protectSingleBranch(org, repo, branch, statusChecks, protectionIntervalMs = 3e3) {
     if (statusChecks.length === 0) {
-      throw new Error(
-        `Refusing to protect ${org}/${repo}@${branch} with no required status checks \u2014 that reads as protected while gating on nothing. Determine the workflow's job contexts first.`
-      );
+      const message = `Refusing to protect ${org}/${repo}@${branch} with no required status checks \u2014 that reads as protected while gating on nothing. Determine the workflow's job contexts first.`;
+      recordBranchProtectionOutcome({
+        status: "skipped-no-contexts",
+        org,
+        repo,
+        protectedBranches: [],
+        unprotectedBranches: [branch],
+        reason: message
+      });
+      throw new Error(message);
     }
-    log.info(`Waiting for ${branch} branch to be ready...`);
-    await this.waitForBranch(org, repo, branch);
-    log.info(`Configuring branch protection on ${branch}...`);
-    const params = {
-      owner: org,
-      repo,
-      branch,
-      required_status_checks: { strict: true, contexts: statusChecks },
-      enforce_admins: false,
-      required_pull_request_reviews: {
-        required_approving_review_count: 0,
-        dismiss_stale_reviews: false
-      },
-      restrictions: null,
-      required_linear_history: true,
-      allow_force_pushes: false,
-      allow_deletions: false
-    };
-    const deadline = Date.now() + 3e4;
-    while (true) {
-      try {
-        await this.octokit.repos.updateBranchProtection(params);
-        break;
-      } catch (err) {
-        const status = err.status;
-        if (status === 403) {
-          log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
-          log.warn("  Add it later via GitHub once the plan allows it, or make the repo public.");
-          return;
+    try {
+      log.info(`Waiting for ${branch} branch to be ready...`);
+      await this.waitForBranch(org, repo, branch);
+      log.info(`Configuring branch protection on ${branch}...`);
+      const params = {
+        owner: org,
+        repo,
+        branch,
+        required_status_checks: { strict: true, contexts: statusChecks },
+        enforce_admins: false,
+        required_pull_request_reviews: {
+          required_approving_review_count: 0,
+          dismiss_stale_reviews: false
+        },
+        restrictions: null,
+        required_linear_history: true,
+        allow_force_pushes: false,
+        allow_deletions: false
+      };
+      const deadline = Date.now() + 3e4;
+      while (true) {
+        try {
+          await this.octokit.repos.updateBranchProtection(params);
+          break;
+        } catch (err) {
+          const status = err.status;
+          if (status === 403) {
+            log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
+            log.warn("  Add it later via GitHub once the plan allows it, or make the repo public.");
+            return recordBranchProtectionOutcome({
+              status: "skipped-403",
+              org,
+              repo,
+              protectedBranches: [],
+              unprotectedBranches: [branch],
+              reason: err.message
+            });
+          }
+          if (status !== 404 || Date.now() >= deadline) throw err;
+          log.info("Branch protection endpoint not yet ready, retrying...");
+          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
         }
-        if (status !== 404 || Date.now() >= deadline) throw err;
-        log.info("Branch protection endpoint not yet ready, retrying...");
-        await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
       }
+    } catch (err) {
+      recordBranchProtectionOutcome({
+        status: "failed",
+        org,
+        repo,
+        protectedBranches: [],
+        unprotectedBranches: [branch],
+        reason: err.message
+      });
+      throw err;
     }
     log.success(
       `Branch protection configured on ${branch} (${statusChecks.length} required check(s))`
     );
+    return recordBranchProtectionOutcome({
+      status: "applied",
+      org,
+      repo,
+      protectedBranches: [branch],
+      unprotectedBranches: []
+    });
   }
   async createEnvironments(config) {
     const { org, repo } = config.source_control.config;
@@ -2401,7 +2494,7 @@ function applyMigrationCarry(instanceDir, plan) {
 }
 
 // src/lib/core-template-trees.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync3 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join8 } from "path";
@@ -2409,8 +2502,8 @@ function coreTag(version) {
   parseCoreVersion(version);
   return `core-v${version}`;
 }
-var defaultGit = (args) => execFileSync2("git", args, { encoding: "utf8" });
-function workingTreeMatchesTag(repo, version, git = defaultGit) {
+var defaultGit2 = (args) => execFileSync3("git", args, { encoding: "utf8" });
+function workingTreeMatchesTag(repo, version, git = defaultGit2) {
   const tag = coreTag(version);
   try {
     const head = git(["-C", repo, "rev-parse", "HEAD"]).trim();
@@ -2430,7 +2523,7 @@ function tagExists(repo, tag, git) {
     return false;
   }
 }
-function materializeTemplateAtTag(repo, version, git = defaultGit) {
+function materializeTemplateAtTag(repo, version, git = defaultGit2) {
   const tag = coreTag(version);
   if (!tagExists(repo, tag, git)) {
     try {
@@ -2447,7 +2540,7 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
   const tarball = join8(dir, ".tree.tar");
   try {
     git(["-C", repo, "archive", "--format=tar", "-o", tarball, tag]);
-    execFileSync2("tar", ["-x", "-f", tarball, "-C", dir]);
+    execFileSync3("tar", ["-x", "-f", tarball, "-C", dir]);
     rmSync3(tarball, { force: true });
   } catch (err) {
     rmSync3(dir, { recursive: true, force: true });
@@ -7150,25 +7243,29 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
   async (name, options) => {
     const cwd = options.cwd ? resolve11(options.cwd) : process.cwd();
     try {
-      await runPluginCreate(
-        name,
-        {
-          firstParty: options.firstParty ?? false,
-          standalone: options.standalone ?? false,
-          ...options.org ? { org: options.org } : {},
-          ...options.runnerLabel ? { runnerLabel: options.runnerLabel } : {},
-          register: options.register !== false,
-          ...options.skeleton ? { skeletonRoot: resolve11(options.skeleton) } : {},
-          dryRun: options.dryRun ?? false,
-          commit: options.commit !== false,
-          cwd
-        },
-        {
-          git: new GitAdapter(),
-          makeGitHub: (token) => new GitHubAdapter(token),
-          resolveToken: resolveGithubToken3
-        }
-      );
+      try {
+        await runPluginCreate(
+          name,
+          {
+            firstParty: options.firstParty ?? false,
+            standalone: options.standalone ?? false,
+            ...options.org ? { org: options.org } : {},
+            ...options.runnerLabel ? { runnerLabel: options.runnerLabel } : {},
+            register: options.register !== false,
+            ...options.skeleton ? { skeletonRoot: resolve11(options.skeleton) } : {},
+            dryRun: options.dryRun ?? false,
+            commit: options.commit !== false,
+            cwd
+          },
+          {
+            git: new GitAdapter(),
+            makeGitHub: (token) => new GitHubAdapter(token),
+            resolveToken: resolveGithubToken3
+          }
+        );
+      } finally {
+        reportBranchProtectionSummary();
+      }
     } catch (err) {
       log.error(err.message);
       process.exit(1);
@@ -7184,6 +7281,7 @@ async function runPluginCreate(name, options, deps) {
       );
     }
     await runStandaloneCreate(names, options, deps);
+    reportBranchProtectionSummary();
     return;
   }
   const isInstance = existsSync23(join23(options.cwd, INSTANCE_CORE_FILE));
@@ -7309,6 +7407,14 @@ async function createAndPushStandaloneRepo(org, names, destDir, options, deps) {
     log.warn(
       `Could not determine required status checks from ${ciPath} \u2014 skipping branch protection. Configure it manually on dev once you know the CI job names.`
     );
+    recordBranchProtectionOutcome({
+      status: "skipped-no-contexts",
+      org,
+      repo: names.dist,
+      protectedBranches: [],
+      unprotectedBranches: ["dev"],
+      reason: `No status-check contexts could be derived from ${ciPath}, so there was nothing to require. Protection with an empty context list reads as configured while admitting every PR, so none was applied.`
+    });
   } else {
     await github.protectSingleBranch(org, names.dist, "dev", contexts);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.199.1",
+  "version": "0.199.3",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",