@bongos/core 1.19.82 → 1.19.84

package/scripts/gds/publish-credential-check.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// scripts/gds/publish-credential-check.js — can the publish credential SEE Actions?
+// (task 1002733, promoted from idea 1000705.)
+//
+// Run ON THE HOST, where GITHUB_PUSH_TOKEN / the GitHub App env lives:
+//   node scripts/gds/publish-credential-check.js
+//
+// WHY. On 2026-08-12 task 1002695 stranded at 'confirmed' across four reconciler
+// sweeps: its PR was MERGED with green checks, but the server's deploy probe kept
+// answering 'pending' because the credential could not read the Actions API. That
+// blindness was invisible — the only way to find it was to notice a strand and
+// hand-run getPublishStatus against the live server. This turns a silent
+// misconfiguration into a one-command answer.
+//
+// Task 1002724 stopped the blindness from stranding work (a blind probe no longer
+// vetoes a git-history-proven land). This tells you whether you are relying on that
+// fallback instead of a real deploy gate.
+//
+// Exit codes: 0 = credential can read Actions (gate is real, or the workflow is
+// legitimately absent), 1 = BLIND (remediation printed), 2 = nothing to check.
+
+const githubPush = require('../../modules/lifecycle/github-push');
+const { cliExit } = require('./cli-lib');
+
+const C = process.stdout.isTTY
+  ? { g: '\x1b[32m', y: '\x1b[33m', r: '\x1b[31m', b: '\x1b[1m', x: '\x1b[0m' }
+  : { g: '', y: '', r: '', b: '', x: '' };
+
+(async () => {
+  if (!githubPush.isConfigured()) {
+    console.log(`${C.y}!${C.x} No publish credential configured on this machine.`);
+    console.log('  This check belongs on the server/host that holds GITHUB_PUSH_TOKEN or the GitHub App env.');
+    return cliExit(2);
+  }
+
+  let probe;
+  try {
+    probe = await githubPush.probeDeployVisibility();
+  } catch (e) {
+    console.log(`${C.r}✖${C.x} probe failed: ${e && e.message}`);
+    return cliExit(1);
+  }
+
+  const http = probe.http ? ` (HTTP ${probe.http})` : '';
+  switch (probe.state) {
+    case 'readable':
+      console.log(`${C.g}✓${C.x} ${C.b}Actions readable${C.x}${http} — ${probe.detail}`);
+      return cliExit(0);
+    case 'readable_no_workflow':
+      console.log(`${C.g}✓${C.x} ${C.b}Actions readable${C.x}${http} — ${probe.detail}`);
+      return cliExit(0);
+    case 'blind':
+      console.log(`${C.r}✖${C.x} ${C.b}BLIND${C.x}${http} — ${probe.detail}`);
+      console.log('');
+      console.log(`  ${C.b}Fix:${C.x} ${probe.remediation}`);
+      console.log('  Until then the reconciler falls back to the git-history land proof (task 1002724),');
+      console.log('  so work still lands — but the deploy gate is not actually being enforced.');
+      return cliExit(1);
+    default:
+      console.log(`${C.y}!${C.x} ${probe.state}${http} — ${probe.detail}`);
+      return cliExit(2);
+  }
+})();

package/src/module-api.js

@@ -591,8 +591,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.80 with no explicit bump. run 31649705242. (task 1002620)
 //   1.19.82 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.81 with no explicit bump. run 31650108283. (task 1002620)
+//   1.19.83 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.82 with no explicit bump. run 31651046759. (task 1002620)
+//   1.19.84 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.83 with no explicit bump. run 31651217970. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.82'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.84'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -570,5 +570,74 @@ await t('landConfirmed: unconfigured deploy counts as landed, but ONLY when merg
   assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'none' }), false, 'none ≠ unconfigured — no PR at all is not a land');
 });
 
+// ===========================================================================
+// task 1002733 — probeDeployVisibility: is the publish credential BLIND?
+//
+// On a private repo GitHub deliberately blurs "not there" and "not yours" — both
+// can surface as 404 — so one call cannot tell "this repo has no deploy-prod.yml"
+// (fine) from "this credential cannot read Actions" (the silent misconfiguration
+// that stranded task 1002695 across 4 sweeps). The CONTROL call is listing the
+// repo's workflows: if that works, a 404 on the specific workflow is genuine.
+// ===========================================================================
+
+await t('probeDeployVisibility: workflows list 403 → blind, with remediation', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(403, { message: 'Resource not accessible' });
+    throw new Error('must not probe the specific workflow once the list is refused: ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'blind');
+  assert.equal(p.http, 403);
+  assert.match(p.remediation, /Actions: read/i);
+  // The remediation must name the credential that is ACTUALLY live rather than
+  // guessing: resolveToken prefers the App and falls back to GITHUB_PUSH_TOKEN, and an
+  // instance runs on exactly one of them. Pointing at the wrong one sends the operator
+  // to widen permissions on a credential that is not in play (cloudbongos.com is on
+  // the PAT, despite ADR 0055's history saying the App replaced it — task 1002733).
+  assert.match(
+    p.remediation, /GITHUB_APP_\*|GITHUB_PUSH_TOKEN/,
+    'must identify which credential resolveToken will actually use'
+  );
+});
+
+await t('probeDeployVisibility: list OK + runs 404 → readable_no_workflow (NOT blind)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [{ id: 1, path: '.github/workflows/unit.yml' }] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(404, { message: 'Not Found' });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'readable_no_workflow', 'a 404 behind a readable list means the workflow is genuinely absent');
+  assert.equal(p.remediation, null, 'nothing to fix — this is the ADR 0108 pin-bump shape');
+});
+
+await t('probeDeployVisibility: list OK + runs OK → readable (the deploy gate is real)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(200, { workflow_runs: [] });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'readable');
+  assert.equal(p.remediation, null);
+});
+
+await t('probeDeployVisibility: list OK but runs 403 → still blind', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(403, { message: 'nope' });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'blind');
+  assert.equal(p.http, 403);
+});
+
+await t('probeDeployVisibility: no credential → no_credential, not a false alarm', async () => {
+  const p = await gp.probeDeployVisibility({ token: null, repoInfo: REPO, fetchImpl: async () => { throw new Error('must not fetch'); } });
+  assert.equal(p.state, 'no_credential');
+  assert.equal(p.remediation, null);
+});
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);