@biffo/cli 0.199.2 → 0.199.4

package/dist/index.js

@@ -1222,16 +1222,37 @@ function formatBranchProtectionSummary(outcomes) {
   ];
   for (const outcome of unprotected) {
     const left = outcome.unprotectedBranches.join(", ") || "unknown";
-    const why = outcome.status === "skipped-403" ? "GitHub returned 403 \u2014 the org's plan does not allow branch protection on this repo" : outcome.status === "failed" ? "branch protection failed" : "branch protection incomplete";
-    lines.push(`  ${outcome.org}/${outcome.repo} \u2014 unprotected: ${left} (${why})`);
+    lines.push(
+      `  ${outcome.org}/${outcome.repo} \u2014 unprotected: ${left} (${whyUnprotected(outcome)})`
+    );
     if (outcome.reason) lines.push(`      ${outcome.reason}`);
   }
   lines.push(
-    "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now.",
-    "  Fix it with:  biffo check branch-protection --fix   (after upgrading the plan, or making the repo public)"
+    "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now."
+  );
+  if (unprotected.some((o) => o.status === "skipped-no-contexts")) {
+    lines.push(
+      "  Where the required checks could not be determined, the fix is the CI job names, not the plan: make the workflow report named jobs, let one run complete, then backfill."
+    );
+  }
+  const has403 = unprotected.some((o) => o.status === "skipped-403");
+  lines.push(
+    "  Fix it with:  biffo check branch-protection --fix   " + (has403 ? "(after upgrading the plan, or making the repo public)" : "(it derives the required checks from the runs the repo has actually reported)")
   );
   return lines;
 }
+function whyUnprotected(outcome) {
+  switch (outcome.status) {
+    case "skipped-403":
+      return "GitHub returned 403 \u2014 the org's plan does not allow branch protection on this repo";
+    case "skipped-no-contexts":
+      return "the required status checks could not be determined, and protection requiring nothing reads as configured while gating on nothing";
+    case "failed":
+      return "branch protection failed";
+    default:
+      return "branch protection incomplete";
+  }
+}
 function reportBranchProtectionSummary() {
   const outcomes = pending.splice(0, pending.length);
   const lines = formatBranchProtectionSummary(outcomes);
@@ -1754,51 +1775,91 @@ var GitHubAdapter = class {
    * `statusChecks` must be non-empty. Protection that requires nothing is worse
    * than none: it reads as configured while gating on nothing, so callers that
    * could not determine the contexts must not silently land here.
+   *
+   * Like `configureBranchProtection`, this **returns and records** what actually
+   * happened (#1001). It used to return `Promise<void>` and swallow the 403 with
+   * two log warnings, so `biffo plugin create --org` printed its next-steps
+   * block and exited 0 with nothing anywhere recording that the repo it had just
+   * created had an unprotected `dev` — the identical defect #715 described for
+   * the deployable path, on the path #999 deliberately left out of scope.
    */
   async protectSingleBranch(org, repo, branch, statusChecks, protectionIntervalMs = 3e3) {
     if (statusChecks.length === 0) {
-      throw new Error(
-        `Refusing to protect ${org}/${repo}@${branch} with no required status checks \u2014 that reads as protected while gating on nothing. Determine the workflow's job contexts first.`
-      );
+      const message = `Refusing to protect ${org}/${repo}@${branch} with no required status checks \u2014 that reads as protected while gating on nothing. Determine the workflow's job contexts first.`;
+      recordBranchProtectionOutcome({
+        status: "skipped-no-contexts",
+        org,
+        repo,
+        protectedBranches: [],
+        unprotectedBranches: [branch],
+        reason: message
+      });
+      throw new Error(message);
     }
-    log.info(`Waiting for ${branch} branch to be ready...`);
-    await this.waitForBranch(org, repo, branch);
-    log.info(`Configuring branch protection on ${branch}...`);
-    const params = {
-      owner: org,
-      repo,
-      branch,
-      required_status_checks: { strict: true, contexts: statusChecks },
-      enforce_admins: false,
-      required_pull_request_reviews: {
-        required_approving_review_count: 0,
-        dismiss_stale_reviews: false
-      },
-      restrictions: null,
-      required_linear_history: true,
-      allow_force_pushes: false,
-      allow_deletions: false
-    };
-    const deadline = Date.now() + 3e4;
-    while (true) {
-      try {
-        await this.octokit.repos.updateBranchProtection(params);
-        break;
-      } catch (err) {
-        const status = err.status;
-        if (status === 403) {
-          log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
-          log.warn("  Add it later via GitHub once the plan allows it, or make the repo public.");
-          return;
+    try {
+      log.info(`Waiting for ${branch} branch to be ready...`);
+      await this.waitForBranch(org, repo, branch);
+      log.info(`Configuring branch protection on ${branch}...`);
+      const params = {
+        owner: org,
+        repo,
+        branch,
+        required_status_checks: { strict: true, contexts: statusChecks },
+        enforce_admins: false,
+        required_pull_request_reviews: {
+          required_approving_review_count: 0,
+          dismiss_stale_reviews: false
+        },
+        restrictions: null,
+        required_linear_history: true,
+        allow_force_pushes: false,
+        allow_deletions: false
+      };
+      const deadline = Date.now() + 3e4;
+      while (true) {
+        try {
+          await this.octokit.repos.updateBranchProtection(params);
+          break;
+        } catch (err) {
+          const status = err.status;
+          if (status === 403) {
+            log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
+            log.warn("  Add it later via GitHub once the plan allows it, or make the repo public.");
+            return recordBranchProtectionOutcome({
+              status: "skipped-403",
+              org,
+              repo,
+              protectedBranches: [],
+              unprotectedBranches: [branch],
+              reason: err.message
+            });
+          }
+          if (status !== 404 || Date.now() >= deadline) throw err;
+          log.info("Branch protection endpoint not yet ready, retrying...");
+          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
         }
-        if (status !== 404 || Date.now() >= deadline) throw err;
-        log.info("Branch protection endpoint not yet ready, retrying...");
-        await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
       }
+    } catch (err) {
+      recordBranchProtectionOutcome({
+        status: "failed",
+        org,
+        repo,
+        protectedBranches: [],
+        unprotectedBranches: [branch],
+        reason: err.message
+      });
+      throw err;
     }
     log.success(
       `Branch protection configured on ${branch} (${statusChecks.length} required check(s))`
     );
+    return recordBranchProtectionOutcome({
+      status: "applied",
+      org,
+      repo,
+      protectedBranches: [branch],
+      unprotectedBranches: []
+    });
   }
   async createEnvironments(config) {
     const { org, repo } = config.source_control.config;
@@ -7182,25 +7243,29 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
   async (name, options) => {
     const cwd = options.cwd ? resolve11(options.cwd) : process.cwd();
     try {
-      await runPluginCreate(
-        name,
-        {
-          firstParty: options.firstParty ?? false,
-          standalone: options.standalone ?? false,
-          ...options.org ? { org: options.org } : {},
-          ...options.runnerLabel ? { runnerLabel: options.runnerLabel } : {},
-          register: options.register !== false,
-          ...options.skeleton ? { skeletonRoot: resolve11(options.skeleton) } : {},
-          dryRun: options.dryRun ?? false,
-          commit: options.commit !== false,
-          cwd
-        },
-        {
-          git: new GitAdapter(),
-          makeGitHub: (token) => new GitHubAdapter(token),
-          resolveToken: resolveGithubToken3
-        }
-      );
+      try {
+        await runPluginCreate(
+          name,
+          {
+            firstParty: options.firstParty ?? false,
+            standalone: options.standalone ?? false,
+            ...options.org ? { org: options.org } : {},
+            ...options.runnerLabel ? { runnerLabel: options.runnerLabel } : {},
+            register: options.register !== false,
+            ...options.skeleton ? { skeletonRoot: resolve11(options.skeleton) } : {},
+            dryRun: options.dryRun ?? false,
+            commit: options.commit !== false,
+            cwd
+          },
+          {
+            git: new GitAdapter(),
+            makeGitHub: (token) => new GitHubAdapter(token),
+            resolveToken: resolveGithubToken3
+          }
+        );
+      } finally {
+        reportBranchProtectionSummary();
+      }
     } catch (err) {
       log.error(err.message);
       process.exit(1);
@@ -7216,6 +7281,7 @@ async function runPluginCreate(name, options, deps) {
       );
     }
     await runStandaloneCreate(names, options, deps);
+    reportBranchProtectionSummary();
     return;
   }
   const isInstance = existsSync23(join23(options.cwd, INSTANCE_CORE_FILE));
@@ -7341,6 +7407,14 @@ async function createAndPushStandaloneRepo(org, names, destDir, options, deps) {
     log.warn(
       `Could not determine required status checks from ${ciPath} \u2014 skipping branch protection. Configure it manually on dev once you know the CI job names.`
     );
+    recordBranchProtectionOutcome({
+      status: "skipped-no-contexts",
+      org,
+      repo: names.dist,
+      protectedBranches: [],
+      unprotectedBranches: ["dev"],
+      reason: `No status-check contexts could be derived from ${ciPath}, so there was nothing to require. Protection with an empty context list reads as configured while admitting every PR, so none was applied.`
+    });
   } else {
     await github.protectSingleBranch(org, names.dist, "dev", contexts);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.199.2",
+  "version": "0.199.4",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",