@biffo/cli 0.207.2 → 0.208.0

package/dist/index.js

@@ -1249,6 +1249,11 @@ function formatBranchProtectionSummary(outcomes) {
   lines.push(
     "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now."
   );
+  if (unprotected.some((o) => o.status === "unsealed")) {
+    lines.push(
+      "  An unsealed branch enforces its rules on everyone except a repo admin \u2014 which, on a solo or agent-driven estate, is everyone who merges."
+    );
+  }
   if (unprotected.some((o) => o.status === "skipped-no-contexts")) {
     lines.push(
       "  Where the required checks could not be determined, the fix is the CI job names, not the plan: make the workflow report named jobs, let one run complete, then backfill."
@@ -1268,6 +1273,8 @@ function whyUnprotected(outcome) {
       return "the required status checks could not be determined, and protection requiring nothing reads as configured while gating on nothing";
     case "failed":
       return "branch protection failed";
+    case "unsealed":
+      return "protection was applied but does not bind admins, so every required check on it is advisory for whoever merges";
     default:
       return "branch protection incomplete";
   }
@@ -1776,6 +1783,76 @@ var GitHubAdapter = class {
       unprotectedBranches: []
     });
   }
+  /**
+   * Bind the protection to admins too — the last thing a scaffolding run does
+   * to a repo (#1058).
+   *
+   * ## Why this is a separate call and not a field above
+   *
+   * `configureBranchProtection` deliberately applies `enforce_admins: false`,
+   * and that is **correct while the scaffold is still running**: `biffo init` is
+   * resumable and step-checkpointed, so a resumed run may need `commitFiles` to
+   * write to branches an earlier attempt already protected. The init token is
+   * the repo's own creator, so the bypass is what lets that succeed.
+   *
+   * The defect was never that value — it was that nothing ever *closed* it. A
+   * scaffold-time bypass with no expiry became the estate's permanent state on
+   * 26 of 27 branches, every one of them showing a full required-check list that
+   * bound nobody, and every audit calling them fine (#1052).
+   *
+   * So the lifetime is made explicit instead: open during the scaffold, closed
+   * at the end of it. Sealing is **the last thing the run does to the repo**,
+   * after every git-object write, which is the property that keeps resumability
+   * intact — a run interrupted before the seal leaves the branches unsealed and
+   * therefore still writable on resume, and a run that reached the seal has
+   * nothing left to write. `cli/src/commands/init.test.ts` asserts that
+   * ordering, because it is an invariant of the step list rather than of this
+   * function.
+   *
+   * Idempotent: `PUT .../enforce_admins` on an already-sealed branch is a no-op,
+   * so a resumed or re-run scaffold re-seals harmlessly.
+   *
+   * Failures are recorded, never thrown. A repo that ends the run protected but
+   * unsealed is a real finding and appears in the end-of-run summary as one —
+   * but it is strictly better than the pre-#1052 state, and aborting a completed
+   * scaffold over it would trade a reported weakness for an unreported mess.
+   */
+  async sealBranchProtection(org, repo, branches = ["dev", "staging", "main"]) {
+    const sealed = [];
+    const unsealed = [];
+    let reason;
+    for (const branch of branches) {
+      try {
+        await this.octokit.repos.setAdminBranchProtection({ owner: org, repo, branch });
+        sealed.push(branch);
+      } catch (err) {
+        const status = err.status;
+        unsealed.push(branch);
+        if (status !== 404) {
+          reason ??= err.message;
+          log.warn(`Could not bind branch protection to admins on ${branch}: ${reason}`);
+        }
+      }
+    }
+    if (unsealed.length === 0) {
+      log.success(`Branch protection now binds admins on ${sealed.join(", ")}`);
+      return recordBranchProtectionOutcome({
+        status: "applied",
+        org,
+        repo,
+        protectedBranches: sealed,
+        unprotectedBranches: []
+      });
+    }
+    return recordBranchProtectionOutcome({
+      status: "unsealed",
+      org,
+      repo,
+      protectedBranches: sealed,
+      unprotectedBranches: unsealed,
+      ...reason ? { reason } : {}
+    });
+  }
   /**
    * Protect a single branch with caller-supplied required checks (#803).
    *
@@ -6226,6 +6303,7 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
   await github.setDefaultBranch(org, repo, "dev");
   await github.configureBranchProtection(config);
   await github.createEnvironments(config);
+  await github.sealBranchProtection(org, repo);
   await github.enableVulnerabilityAlerts(org, repo);
   await github.setRepoVariable(org, repo, "PROJECT_NAME", config.project.name);
   const pathPrefix = resolvePathPrefix(config);
@@ -6532,7 +6610,7 @@ function resolveConfigFileSession(config, awsAccountId, awsRegion, fresh) {
   return session;
 }
 async function runInit(github, aws, config, session, appSibling) {
-  const totalSteps = appSibling ? 6 : 5;
+  const totalSteps = appSibling ? 7 : 6;
   if (!session.completedSteps.includes("verify_credentials")) {
     log.step(1, totalSteps, "Verifying AWS credentials...");
     await aws.verifyCredentials();
@@ -6641,6 +6719,13 @@ async function runInit(github, aws, config, session, appSibling) {
       log.step(6, totalSteps, "Application sibling already created \u2014 skipping");
     }
   }
+  if (!hasCompleted(session, "github_protection_sealed")) {
+    log.step(7, totalSteps, "Binding branch protection to admins...");
+    await github.sealBranchProtection(org, repo);
+    markStepComplete(session, "github_protection_sealed");
+  } else {
+    log.step(7, totalSteps, "Branch protection already binds admins \u2014 skipping");
+  }
   reportBranchProtectionSummary();
   deleteSession(config.project.name);
   saveProjectConfig(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.207.2",
+  "version": "0.208.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",