@catladder/cli 5.7.0 → 5.7.1

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "5.7.0",
+  "version": "5.7.1",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/reviewApps/__tests__/github.test.ts

@@ -0,0 +1,118 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { githubReviewDeployGuardJob } from "../github";
+
+const HEAD = "4a60abe0000000000000000000000000000000aa";
+
+type Call = { url: string; method: string; body?: any };
+
+/** a github api double: one PR, a `catladder ✅` check in a given state */
+const mockGithub = (
+  check: { status: string; conclusion: string | null } | null,
+) => {
+  const calls: Call[] = [];
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (url: string, init: any = {}) => {
+      const path = url.replace("https://api.github.com/repos/o/r/", "");
+      calls.push({
+        url: path,
+        method: init.method ?? "GET",
+        body: init.body ? JSON.parse(init.body) : undefined,
+      });
+      const json = (data: unknown) => ({
+        ok: true,
+        status: 200,
+        json: async () => data,
+        text: async () => JSON.stringify(data),
+      });
+      if (path.startsWith("pulls/")) {
+        return json({
+          number: 159,
+          state: "open",
+          draft: false,
+          labels: [{ name: "catladder:review-app" }],
+          head: { sha: HEAD, ref: "feat/x" },
+        });
+      }
+      if (path.startsWith("commits/")) {
+        return json({ check_runs: check ? [{ id: 1, ...check }] : [] });
+      }
+      return json({});
+    }),
+  );
+  return calls;
+};
+
+describe("review deploy guard: label added while the CI runs", () => {
+  let output: string;
+  beforeEach(() => {
+    output = "";
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    process.env.GITHUB_REPOSITORY = "o/r";
+    process.env.GITHUB_TOKEN = "t";
+    process.env.GITHUB_RUN_ID = "1";
+    process.env.CL_PR_NUMBER = "159";
+    process.env.CL_HEAD_SHA = HEAD;
+    process.env.CL_DEPLOY_SOURCE = "label";
+    process.env.CL_REVIEW_APPS = JSON.stringify({
+      deploy: "optIn",
+      label: "catladder:review-app",
+      skipLabel: "catladder:no-review-app",
+      drafts: "likeReady",
+    });
+    // capture the step output
+    const file = `${process.env.TMPDIR ?? "/tmp"}/gh-output-${process.pid}-${Math.random()}`;
+    process.env.GITHUB_OUTPUT = file;
+    output = file;
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+  const deployOutput = async () =>
+    (await import("fs")).readFileSync(output, "utf8");
+
+  it("defers and reports a pending status while the CI is not finished", async () => {
+    const calls = mockGithub({ status: "in_progress", conclusion: null });
+    await githubReviewDeployGuardJob();
+    expect(await deployOutput()).toContain("deploy=false");
+    const status = calls.find((c) => c.url === `statuses/${HEAD}`);
+    expect(status?.method).toBe("POST");
+    expect(status?.body).toMatchObject({
+      state: "pending",
+      context: "catladder review app",
+    });
+    expect(status?.body.description).toContain("waiting for the CI");
+  });
+
+  it("defers and reports pending while the CI has not even reported", async () => {
+    const calls = mockGithub(null);
+    await githubReviewDeployGuardJob();
+    expect(await deployOutput()).toContain("deploy=false");
+    expect(calls.some((c) => c.url === `statuses/${HEAD}`)).toBe(true);
+  });
+
+  it("deploys without a pending status when the CI already finished green", async () => {
+    const calls = mockGithub({ status: "completed", conclusion: "success" });
+    await githubReviewDeployGuardJob();
+    expect(await deployOutput()).toContain("deploy=true");
+    expect(calls.some((c) => c.url.startsWith("statuses/"))).toBe(false);
+  });
+
+  it("trusts a ci dispatch: deploys although the checks api still reports the CI in progress", async () => {
+    process.env.CL_DEPLOY_SOURCE = "ci";
+    const calls = mockGithub({ status: "in_progress", conclusion: null });
+    await githubReviewDeployGuardJob();
+    expect(await deployOutput()).toContain("deploy=true");
+    expect(calls.some((c) => c.url.startsWith("commits/"))).toBe(false);
+    expect(calls.some((c) => c.url.startsWith("statuses/"))).toBe(false);
+  });
+
+  it("a ci dispatch for a head the PR moved away from does not deploy", async () => {
+    process.env.CL_DEPLOY_SOURCE = "ci";
+    process.env.CL_HEAD_SHA = "0000000000000000000000000000000000000000";
+    mockGithub({ status: "completed", conclusion: "success" });
+    await githubReviewDeployGuardJob();
+    expect(await deployOutput()).toContain("deploy=false");
+  });
+});

package/src/reviewApps/github.ts

@@ -13,10 +13,13 @@
  *   whether the run deploys (`deploy` step output):
  *   - source `manual` (a dispatch by a human or agent): always,
  *     provided the PR is open and its CI is green
- *   - source `ci` (dispatched by the trigger) and `label` (the switch
- *     label changed / a draft was marked ready): when the policy says
- *     so — and the CI is green. A label switched on while CI still runs
- *     is no deploy here: the trigger picks it up once CI is green.
+ *   - source `ci` (dispatched by the trigger, which runs after the
+ *     aggregate check succeeded): when the policy says so; the CI is
+ *     green by construction, the guard verifies only the head
+ *   - source `label` (the switch label changed / a draft was marked
+ *     ready): when the policy says so — and the CI is green. A label
+ *     switched on while CI still runs is no deploy here (status
+ *     `pending`): the trigger picks it up once CI is green.
  */
 import {
   type ResolvedReviewAppsConfig,
@@ -39,6 +42,13 @@ const GITHUB_REVIEW_DEPLOY_WORKFLOW = "catladder-deploy-review.yml";
  */
 const AGGREGATE_CHECK_NAME = "catladder ✅";
 
+/**
+ * the commit status the review app result is reported on. Keep in sync
+ * with REVIEW_APP_STATUS_CONTEXT in
+ * packages/pipeline/src/backends/github/reviewDeployWorkflow.ts.
+ */
+const REVIEW_APP_STATUS_CONTEXT = "catladder review app";
+
 type PullRequest = {
   number: number;
   state: string;
@@ -119,6 +129,29 @@ const getAggregateCheck = async (
   return newest ?? null;
 };
 
+/**
+ * a deploy that waits for the CI must not leave the PR without a
+ * status: a merge gate would see nothing and wait without a reason
+ */
+const reportWaitingForCi = async (sha: string, message: string) => {
+  const response = await githubApi(`statuses/${sha}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      state: "pending",
+      context: REVIEW_APP_STATUS_CONTEXT,
+      description: message.slice(0, 140),
+      target_url: `${process.env.GITHUB_SERVER_URL ?? "https://github.com"}/${requireEnv("GITHUB_REPOSITORY")}/actions/runs/${process.env.GITHUB_RUN_ID ?? ""}`,
+    }),
+  });
+  if (!response.ok) {
+    // informational only — never fail the guard over it
+    console.log(
+      `::warning::reporting the pending review app status failed: ${response.status}`,
+    );
+  }
+};
+
 const short = (sha: string) => sha.slice(0, 7);
 
 const mrState = (pr: PullRequest) => ({
@@ -172,8 +205,29 @@ export const githubReviewDeployGuardJob = async () => {
         : `#${pr.number} moved on to ${short(pr.head.sha)} — its own review run decides`,
     );
   }
+  // the trigger job dispatches with source `ci` only after the review
+  // run's aggregate check succeeded for this very head — reading the
+  // check again here raced the checks api (a deploy was lost 17 s after
+  // the check completed, zue-zuerich-tourismus#159): the head match
+  // above is the whole verification for a ci dispatch
+  if (source === "ci") {
+    console.log(
+      `deploying the review apps of #${pr.number} (${short(headSha)}): ${reason}; the review run (${AGGREGATE_CHECK_NAME}) dispatched this deploy after it was green`,
+    );
+    appendStepSummary(
+      `🚀 **Deploying** the review apps of #${pr.number} (\`${short(headSha)}\`): ${reason}.`,
+    );
+    setStepOutput("deploy", "true");
+    return;
+  }
   const check = await getAggregateCheck(headSha);
   if (!check || check.status !== "completed") {
+    if (!explicit) {
+      await reportWaitingForCi(
+        headSha,
+        `waiting for the CI of ${short(headSha)} (${AGGREGATE_CHECK_NAME}) — the review apps deploy once it is green`,
+      );
+    }
     return refuse(
       `the CI of ${short(headSha)} (${AGGREGATE_CHECK_NAME}) is not finished yet` +
         (explicit