@coderook/cli 0.35.0 → 0.36.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/README.md

@@ -194,6 +194,33 @@ Tests whenever a line is proposed or saved onto, and its result is a required
 check. `--on-save` runs an action on every save, and `--by-hand` only when
 somebody starts it.
 
+Every proposal also has a `coderook/malware` check: what the line adds or
+changes is scanned before it can land, and a finding names the file and stops
+the proposal being applied.
+
+### Reviewing proposals on GitHub
+
+CodeRabbit, Blacksmith and most CI only connect to GitHub, so `cbx github`
+keeps a GitHub repository as a mirror: each open proposal becomes a pull
+request there, whatever is installed on it reviews and builds it, and the
+results come back to the proposal as checks (`github/<check>`,
+`review/<reviewer>`).
+
+```
+cbx github setup my-name/my-game-mirror           token, secret, workflow
+cbx submit                                        save the workflow into the project
+cbx github sync --repo my-name/my-game-mirror     mirror once from here
+```
+
+`setup` makes a token that reaches this project only and can only read it and
+report checks, stores it as the repository's `CODEROOK_TOKEN` secret (with the
+GitHub CLI; otherwise it prints it once), and writes
+`.github/workflows/coderook-bridge.yml`, which then runs on GitHub every ten
+minutes. Add `CODEROOK_BRIDGE_PUSH`, a fine-grained GitHub token with Contents
+and Pull requests read and write: GitHub's own workflow token cannot start
+other workflows, so CI would never run. Results are advice unless named in
+`CODEROOK_REQUIRED` (or `--required`). Use a repository nothing else pushes to.
+
 A **protected** line refuses saves made straight onto it — from `cbx submit`,
 the desktop application and `git push` alike — so the way in is a line of your
 own and a proposal. It also cannot be put back on an earlier save, and a merge
@@ -452,6 +479,10 @@ no need for a second project that only holds releases. `--downloads private`
 takes them back. Without a release name it changes an existing release and
 leaves its notes alone.
 
+Every attached file is scanned for malware before anybody outside the project
+can download it, usually within a minute; one that fails is never offered, and
+whoever attached it and the owner are told what was found.
+
 `cbx releases` marks each one `public`, `downloads public` or `private`, and
 for a public project prints the addresses an app or a script reads, which
 need no account:

package/dist/cli/src/api.js

@@ -45,6 +45,8 @@ exports.changeWorkflow = changeWorkflow;
 exports.runs = runs;
 exports.runLogs = runLogs;
 exports.tokens = tokens;
+exports.createToken = createToken;
+exports.reportMergeCheck = reportMergeCheck;
 exports.revokeToken = revokeToken;
 exports.deleteProject = deleteProject;
 exports.projectLabels = projectLabels;
@@ -806,6 +808,20 @@ async function tokens() {
         createdAt: String(row.createdAt ?? ""),
     }));
 }
+/** Make a token. Limited to one project when `repositoryId` is given; shown once. */
+async function createToken(input) {
+    return call("/v1/account/tokens", {
+        method: "POST",
+        body: input,
+    });
+}
+/** Say how a check on a proposal went; the same name again replaces it. */
+async function reportMergeCheck(mergeTrackId, name, input) {
+    await call(`/v1/merge-tracks/${mergeTrackId}/checks/${encodeURIComponent(name)}`, {
+        method: "PUT",
+        body: input,
+    });
+}
 async function revokeToken(tokenId) {
     await call(`/v1/account/tokens/${encodeURIComponent(tokenId)}`, {
         method: "DELETE",

package/dist/cli/src/cli.js

@@ -32,6 +32,7 @@ const build_command_js_1 = require("./build_command.js");
 const node_check_js_1 = require("./node_check.js");
 const pages_command_js_1 = require("./pages_command.js");
 const mods_command_js_1 = require("./mods_command.js");
+const github_bridge_js_1 = require("./github_bridge.js");
 const project_commands_js_1 = require("./project_commands.js");
 const track_commands_js_1 = require("./track_commands.js");
 const tracks_js_1 = require("../../cbx/src/core/tracks.js");
@@ -2793,6 +2794,35 @@ const SPECS = [
         ],
         run: pages_command_js_1.commandPages,
     },
+    {
+        name: "github",
+        group: "Your projects",
+        summary: "review and test proposals with GitHub tools (CodeRabbit, Blacksmith, Actions)",
+        usage: "github <setup|sync> …",
+        detail: "Mirrors a project's open proposals to pull requests in a GitHub repository,\n" +
+            "so tools that only connect to GitHub review and build them, and reports\n" +
+            "what they conclude back to each proposal as checks. A required check that\n" +
+            "fails stops the proposal being applied, like any other check.\n\n" +
+            "It runs on GitHub, in a workflow setup writes into the project. CodeRook\n" +
+            "never holds a GitHub credential; GitHub holds a CodeRook token that reaches\n" +
+            "this project only and can read it and report checks, nothing else.\n\n" +
+            "  setup <owner>/<repo> [folder]   make the token, write the workflow\n" +
+            "  sync [--repo <owner>/<repo>]    mirror and report once (what the workflow runs)\n\n" +
+            "Use a GitHub repository nothing else pushes to: the mirror only moves\n" +
+            "forward, and a branch changed on GitHub is left alone and reported.",
+        options: [
+            { flags: "--repo <owner/repo>", description: "sync: the GitHub repository (default: the one the workflow runs in)" },
+            { flags: "--project <slug>", description: "sync: the CodeRook project (default: this folder's)" },
+            { flags: "--required <names>", description: "checks that must pass, e.g. \"github/build,review/coderabbitai[bot]\"" },
+            { flags: "--force", description: "setup: write the workflow again" },
+        ],
+        examples: [
+            "cbx github setup my-name/my-game-mirror",
+            "cbx submit",
+            "cbx github sync --repo my-name/my-game-mirror",
+        ],
+        run: github_bridge_js_1.commandGithub,
+    },
     {
         name: "mods",
         group: "Your projects",

package/dist/cli/src/github_bridge.js

@@ -0,0 +1,403 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.forTests = void 0;
+exports.commandGithub = commandGithub;
+/**
+ * `cbx github` — proposals reviewed and tested on GitHub, results on CodeRook.
+ *
+ * CodeRabbit, Blacksmith and most CI only connect to GitHub-shaped hosts. So
+ * rather than each of them learning CodeRook, a GitHub repository is used as
+ * a mirror: every open proposal becomes a pull request there, whatever is
+ * installed on that repository reviews and builds it, and what they conclude
+ * comes back to the proposal as checks — where a required one stops it being
+ * applied, exactly like a check reported any other way.
+ *
+ * It runs on GitHub, in a workflow `setup` writes into the project, so
+ * CodeRook never holds a GitHub credential and the mirror costs the service
+ * nothing. Each side holds only the other's narrowest key: GitHub keeps a
+ * CodeRook token limited to this one project that can read it and report
+ * checks, and nothing else; the push token stays in GitHub's secrets.
+ *
+ * Commits are rebuilt by the git remote helper, which gives the same commit
+ * for the same version every time, so the mirror only ever moves forward.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const config_js_1 = require("./config.js");
+const WORKFLOW_PATH = ".github/workflows/coderook-bridge.yml";
+/** The bridge's own job, left out of what is reported back. */
+const BRIDGE_JOB = "sync with CodeRook";
+const MARKER = (id) => `<!-- coderook-proposal:${id} -->`;
+const MARKER_PATTERN = /<!-- coderook-proposal:([0-9a-f-]{36}) -->/;
+const flag = (parsed, name) => {
+    const value = parsed.flags.get(name);
+    return typeof value === "string" ? value : undefined;
+};
+async function gh(token, route, method = "GET", body) {
+    const response = await fetch(`https://api.github.com${route}`, {
+        method,
+        headers: {
+            accept: "application/vnd.github+json",
+            authorization: `Bearer ${token}`,
+            "x-github-api-version": "2022-11-28",
+            "user-agent": "CodeRook-CLI",
+            ...(body ? { "content-type": "application/json" } : {}),
+        },
+        body: body ? JSON.stringify(body) : undefined,
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        let message = text.slice(0, 300);
+        try {
+            message = JSON.parse(text).message ?? message;
+        }
+        catch {
+            /* not JSON */
+        }
+        throw new Error(`GitHub ${method} ${route.split("?")[0]}: ${response.status} ${message}`);
+    }
+    return (response.status === 204 ? undefined : await response.json());
+}
+/** Every page of a GitHub list, up to a sensible ceiling. */
+async function ghAll(token, route, key) {
+    const all = [];
+    for (let page = 1; page <= 10; page += 1) {
+        const joiner = route.includes("?") ? "&" : "?";
+        const body = await gh(token, `${route}${joiner}per_page=100&page=${page}`);
+        const rows = (key ? body[key] : body);
+        all.push(...rows);
+        if (rows.length < 100)
+            break;
+    }
+    return all;
+}
+function githubToken() {
+    for (const name of ["CODEROOK_BRIDGE_PUSH", "GH_TOKEN", "GITHUB_TOKEN"]) {
+        const value = node_process_1.default.env[name]?.trim();
+        if (value)
+            return value;
+    }
+    /* On somebody's own machine, the GitHub CLI's sign-in will do. */
+    const asked = (0, node_child_process_1.spawnSync)("gh", ["auth", "token"], { encoding: "utf8" });
+    const token = asked.status === 0 ? asked.stdout.trim() : "";
+    return token || null;
+}
+/* ------------------------------------------------------------------ git */
+function git(cwd, args, env = node_process_1.default.env, quiet = true) {
+    const run = (0, node_child_process_1.spawnSync)("git", args, {
+        cwd,
+        env,
+        encoding: "utf8",
+        stdio: quiet ? "pipe" : ["ignore", "inherit", "inherit"],
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    return { ok: run.status === 0, out: run.stdout ?? "", err: run.stderr ?? "" };
+}
+/**
+ * The push token as an HTTP header git sends, passed through git's
+ * environment-config variables so it never appears in an argument list or a
+ * remote URL that `git remote -v` would print.
+ */
+function pushEnvironment(token) {
+    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
+    return {
+        ...node_process_1.default.env,
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_CONFIG_COUNT: "1",
+        GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
+        GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
+    };
+}
+/* ------------------------------------------------------------------ setup */
+function workflow(project, required) {
+    return `# Mirrors this project's proposals to pull requests here, so tools that only
+# connect to GitHub (CodeRabbit, Blacksmith, any GitHub Actions CI) can review
+# and test them, and reports what they conclude back to each proposal on
+# CodeRook as checks. Written by \`cbx github setup\`; see
+# https://coderook.com/docs#github-bridge
+#
+# Secrets this needs, in this GitHub repository's settings:
+#   CODEROOK_TOKEN        a CodeRook token limited to this project (setup made it)
+#   CODEROOK_BRIDGE_PUSH  a GitHub token that can push and open pull requests here.
+#                         GitHub's own workflow token cannot: what it pushes starts
+#                         no other workflow, so CI would never run on a proposal.
+name: CodeRook bridge
+
+on:
+  schedule:
+    - cron: "*/10 * * * *"
+  workflow_dispatch:
+  pull_request_review:
+    types: [submitted]
+
+concurrency:
+  group: coderook-bridge
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  pull-requests: read
+  checks: read
+  statuses: read
+
+jobs:
+  sync:
+    name: ${BRIDGE_JOB}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      # What was already imported, so each run fetches only new versions.
+      - uses: actions/cache@v4
+        with:
+          path: .git/coderook
+          key: coderook-marks-\${{ github.run_id }}
+          restore-keys: coderook-marks-
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm install --global @coderook/cli@latest
+      - run: cbx github sync
+        env:
+          CODEROOK_TOKEN: \${{ secrets.CODEROOK_TOKEN }}
+          CODEROOK_BRIDGE_PUSH: \${{ secrets.CODEROOK_BRIDGE_PUSH }}
+          GITHUB_READ_TOKEN: \${{ github.token }}
+          CODEROOK_PROJECT: ${project}
+          # Checks that must pass before a proposal can be applied, by name, comma separated:
+          # e.g. "github/build, review/coderabbitai[bot]". Everything else is reported as advice.
+          CODEROOK_REQUIRED: "${required}"
+`;
+}
+async function setup(parsed) {
+    const repo = parsed.positional[1];
+    if (!repo || !/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+        console.error((0, colour_js_1.red)("Name the GitHub repository to mirror into: cbx github setup <owner>/<repo>"));
+        return 1;
+    }
+    const folder = node_path_1.default.resolve(parsed.positional[2] ?? ".");
+    const link = await (0, config_js_1.readLink)(folder);
+    if (!link) {
+        console.error((0, colour_js_1.red)("This folder is not linked to a project. Run it in the project's folder."));
+        return 1;
+    }
+    const file = node_path_1.default.join(folder, WORKFLOW_PATH);
+    if ((0, node_fs_1.existsSync)(file) && !parsed.flags.has("force")) {
+        console.error((0, colour_js_1.red)(`${WORKFLOW_PATH} is already here. Pass --force to write it again.`));
+        return 1;
+    }
+    const token = await (0, api_js_1.createToken)({
+        name: `GitHub bridge: ${repo}`.slice(0, 80),
+        scopes: ["projects:read", "checks:write"],
+        repositoryId: link.repositoryId,
+        expiresInDays: 365,
+    });
+    await (0, promises_1.mkdir)(node_path_1.default.dirname(file), { recursive: true });
+    await (0, promises_1.writeFile)(file, workflow(link.slug, flag(parsed, "required") ?? ""), "utf8");
+    console.log(`${(0, colour_js_1.green)("Wrote")} ${WORKFLOW_PATH}`);
+    /* Straight into GitHub's secrets when the GitHub CLI is here, so the token is never on screen. */
+    const stored = (0, node_child_process_1.spawnSync)("gh", ["secret", "set", "CODEROOK_TOKEN", "--repo", repo], {
+        input: token.token,
+        encoding: "utf8",
+    });
+    if (stored.status === 0) {
+        console.log(`${(0, colour_js_1.green)("Stored")} CODEROOK_TOKEN in ${repo}'s secrets. It reaches ${(0, colour_js_1.bold)(link.slug)} only, and can read it and report checks.`);
+    }
+    else {
+        console.log("");
+        console.log(`Add this as the secret ${(0, colour_js_1.bold)("CODEROOK_TOKEN")} in ${repo} (Settings → Secrets and variables → Actions).`);
+        console.log("It is shown once, reaches this project only, and can read it and report checks:");
+        console.log(`  ${token.token}`);
+    }
+    console.log("");
+    console.log("Then:");
+    console.log(`  1. Add ${(0, colour_js_1.bold)("CODEROOK_BRIDGE_PUSH")}: a GitHub fine-grained token for ${repo} with`);
+    console.log("     Contents and Pull requests set to read and write.");
+    console.log(`  2. Save the workflow into the project: ${(0, colour_js_1.accent)("cbx submit")}`);
+    console.log(`  3. Mirror it once from here, which also puts the workflow on GitHub: ${(0, colour_js_1.accent)(`cbx github sync --repo ${repo}`)}`);
+    console.log((0, colour_js_1.dim)("  After that it runs on GitHub every ten minutes, and whenever a review is submitted."));
+    console.log((0, colour_js_1.dim)("  Install CodeRabbit on the repository, or use Blacksmith runners in your workflows, as you would anywhere."));
+    return 0;
+}
+function fromCheckRun(run) {
+    const state = run.status !== "completed"
+        ? "pending"
+        : ["success", "neutral"].includes(run.conclusion ?? "")
+            ? "passing"
+            : run.conclusion === "skipped"
+                ? "skipped"
+                : "failing";
+    return {
+        name: `github/${run.name}`,
+        state,
+        detail: run.output?.title || (run.status === "completed" ? run.conclusion ?? "" : run.status),
+        url: run.html_url,
+    };
+}
+function fromStatus(status) {
+    const state = status.state === "success" ? "passing" : status.state === "pending" ? "pending" : "failing";
+    return { name: `github/${status.context}`, state, detail: status.description ?? "", url: status.target_url };
+}
+/** The last word from each reviewer: approved passes, changes requested fails, a comment is advice. */
+function fromReviews(reviews) {
+    const latest = new Map();
+    for (const review of reviews) {
+        const login = review.user?.login;
+        if (!login || review.state === "PENDING" || review.state === "DISMISSED")
+            continue;
+        const state = review.state === "APPROVED" ? "passing" : review.state === "CHANGES_REQUESTED" ? "failing" : "passing";
+        const said = (review.body ?? "").replace(/\s+/g, " ").trim();
+        latest.set(login, {
+            name: `review/${login}`,
+            state,
+            detail: (review.state === "COMMENTED" ? "commented" : review.state.toLowerCase().replace(/_/g, " ")) + (said ? `: ${said}` : ""),
+            url: review.html_url,
+        });
+    }
+    return [...latest.values()];
+}
+async function sync(parsed) {
+    const repo = flag(parsed, "repo") ?? node_process_1.default.env.GITHUB_REPOSITORY;
+    if (!repo) {
+        console.error((0, colour_js_1.red)("Which GitHub repository? Pass --repo <owner>/<repo>."));
+        return 1;
+    }
+    const write = githubToken();
+    if (!write) {
+        console.error((0, colour_js_1.red)("No GitHub token. Set CODEROOK_BRIDGE_PUSH (or GH_TOKEN), or sign in with the GitHub CLI."));
+        return 1;
+    }
+    const github = { repo, write, read: node_process_1.default.env.GITHUB_READ_TOKEN?.trim() || write };
+    const required = new Set((flag(parsed, "required") ?? node_process_1.default.env.CODEROOK_REQUIRED ?? "").split(",").map((name) => name.trim()).filter(Boolean));
+    /* The project: named, or the one this folder (or the token) belongs to. */
+    const named = flag(parsed, "project") ?? node_process_1.default.env.CODEROOK_PROJECT;
+    const link = named ? null : await (0, config_js_1.readLink)(node_process_1.default.cwd());
+    const listed = await (0, api_js_1.projects)();
+    const project = listed.find((one) => one.id === named || one.slug === named) ??
+        (link ? listed.find((one) => one.id === link.repositoryId) : undefined) ??
+        (listed.length === 1 ? listed[0] : undefined);
+    if (!project) {
+        console.error((0, colour_js_1.red)(named ? `No project called ${named} on this account.` : "Name the project: --project <slug>."));
+        return 1;
+    }
+    /* A git repository to work in: this one on GitHub's runner, a scratch one on somebody's machine. */
+    const here = git(node_process_1.default.cwd(), ["rev-parse", "--is-inside-work-tree"]).ok && Boolean(node_process_1.default.env.GITHUB_ACTIONS);
+    const work = here ? node_process_1.default.cwd() : await (0, promises_1.mkdtemp)(node_path_1.default.join(node_os_1.default.tmpdir(), "cbx-github-"));
+    try {
+        if (!here)
+            git(work, ["init", "--quiet"]);
+        git(work, ["remote", "remove", "coderook"]);
+        git(work, ["remote", "add", "coderook", `coderook://${project.slug}`]);
+        console.log(`Fetching ${(0, colour_js_1.bold)(project.slug)} from CodeRook…`);
+        const fetched = git(work, ["fetch", "--quiet", "coderook"], node_process_1.default.env, false);
+        if (!fetched.ok) {
+            console.error((0, colour_js_1.red)("Could not fetch the project from CodeRook."));
+            return 1;
+        }
+        const open = (await (0, api_js_1.proposals)(project.id)).filter((one) => one.proposal?.from && one.proposal?.into);
+        const lines = new Set([project.defaultBranch || "main"]);
+        for (const one of open) {
+            lines.add(one.proposal.from);
+            lines.add(one.proposal.into);
+        }
+        /* Each line to the branch of the same name. Never forced: the mirror only moves forward. */
+        const pushEnv = pushEnvironment(github.write);
+        const pushed = new Set();
+        for (const line of lines) {
+            if (!git(work, ["rev-parse", "--verify", "--quiet", `refs/remotes/coderook/${line}`]).ok)
+                continue;
+            const result = git(work, ["push", "--quiet", `https://github.com/${repo}.git`, `refs/remotes/coderook/${line}:refs/heads/${line}`], pushEnv);
+            if (result.ok) {
+                pushed.add(line);
+            }
+            else {
+                console.error((0, colour_js_1.accent)(`  ${line}: not pushed. ${result.err.trim().split("\n").pop() ?? ""}`));
+                console.error((0, colour_js_1.dim)("  The branch on GitHub has commits CodeRook does not. Mirror into a repository nothing else pushes to."));
+            }
+        }
+        console.log(`${(0, colour_js_1.green)("Mirrored")} ${pushed.size} line${pushed.size === 1 ? "" : "s"} to ${repo}`);
+        /* Pull requests: one per open proposal, found again by the marker in its description. */
+        const existing = await ghAll(github.write, `/repos/${repo}/pulls?state=all`);
+        const byProposal = new Map();
+        for (const pull of existing) {
+            const match = MARKER_PATTERN.exec(pull.body ?? "");
+            if (match && !byProposal.has(match[1]))
+                byProposal.set(match[1], pull);
+        }
+        const site = (node_process_1.default.env.CODEROOK_SITE_URL ?? "https://coderook.com").replace(/\/+$/, "");
+        let reported = 0;
+        for (const one of open) {
+            const from = one.proposal.from;
+            const into = one.proposal.into;
+            if (!pushed.has(from) || !pushed.has(into))
+                continue;
+            const title = `${one.proposal.title ?? `${from} into ${into}`} (${one.reference})`;
+            const body = `Mirrored from CodeRook proposal ${one.reference} so the tools installed here can review and test it. ` +
+                `Results are reported back to it as checks; apply it on CodeRook, not here.\n\n` +
+                `${site}/merges?merge=${one.id}\n\n${MARKER(one.id)}`;
+            let pull = byProposal.get(one.id);
+            if (!pull) {
+                pull = await gh(github.write, `/repos/${repo}/pulls`, "POST", { title, head: from, base: into, body, maintainer_can_modify: false });
+                console.log(`${(0, colour_js_1.green)("Opened")} ${pull.html_url} for ${one.reference}`);
+            }
+            else if (pull.state !== "open" || pull.title !== title) {
+                pull = await gh(github.write, `/repos/${repo}/pulls/${pull.number}`, "PATCH", { title, state: "open", body });
+            }
+            /* What GitHub's side concluded, back to the proposal; only what changed is reported. */
+            const head = (await gh(github.read, `/repos/${repo}/pulls/${pull.number}`)).head.sha;
+            const found = [];
+            const runs = await ghAll(github.read, `/repos/${repo}/commits/${head}/check-runs`, "check_runs");
+            found.push(...runs.filter((run) => run.name !== BRIDGE_JOB).map(fromCheckRun));
+            const combined = await gh(github.read, `/repos/${repo}/commits/${head}/status`);
+            found.push(...combined.statuses.map(fromStatus));
+            found.push(...fromReviews(await ghAll(github.read, `/repos/${repo}/pulls/${pull.number}/reviews`)));
+            const current = new Map((await (0, api_js_1.mergeTrack)(one.id)).checks?.map((check) => [check.name, check]) ?? []);
+            for (const check of found) {
+                const name = check.name.slice(0, 100);
+                const detail = check.detail.slice(0, 2000);
+                const before = current.get(name);
+                const url = check.url && /^https:\/\//.test(check.url) ? check.url : null;
+                if (before && before.state === check.state && (before.detail ?? "") === detail)
+                    continue;
+                await (0, api_js_1.reportMergeCheck)(one.id, name, { state: check.state, required: required.has(name), detail, detailsUrl: url });
+                reported += 1;
+            }
+        }
+        /* A proposal applied or withdrawn on CodeRook closes its pull request here. */
+        const stillOpen = new Set(open.map((one) => one.id));
+        for (const [id, pull] of byProposal) {
+            if (pull.state === "open" && !stillOpen.has(id)) {
+                await gh(github.write, `/repos/${repo}/pulls/${pull.number}`, "PATCH", { state: "closed" });
+                console.log(`${(0, colour_js_1.dim)("Closed")} ${pull.html_url}: its proposal is no longer open`);
+            }
+        }
+        console.log(`${(0, colour_js_1.green)("Reported")} ${reported} check result${reported === 1 ? "" : "s"} to CodeRook`);
+        return 0;
+    }
+    finally {
+        if (!here)
+            await (0, promises_1.rm)(work, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+async function commandGithub(parsed) {
+    const sub = parsed.positional[0];
+    if (sub === "setup")
+        return setup(parsed);
+    if (sub === "sync")
+        return sync(parsed);
+    console.error((0, colour_js_1.red)(sub ? `cbx github has no "${sub}". ` : "") + "See: " + (0, colour_js_1.accent)("cbx help github"));
+    return 1;
+}
+/** For tests: the workflow text and the mappings. */
+exports.forTests = { workflow, fromCheckRun, fromStatus, fromReviews };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",

package/skills/coderook/SKILL.md

@@ -306,6 +306,25 @@ unasked. `--ship` attaches the results to the newest save, so **ask before
 `--ship`**, as before any save. A project's own build description lives in
 `coderook.build.json`.
 
+## Reviewing proposals with GitHub tools
+
+When someone wants CodeRabbit, Blacksmith or GitHub Actions on their CodeRook
+proposals, that is `cbx github`: a GitHub repository mirrors each open
+proposal as a pull request, and the results come back as checks named
+`github/<check>` and `review/<reviewer>`.
+
+```bash
+cbx github setup OWNER/REPO   # token limited to this project, secret, workflow file
+cbx submit                    # the workflow has to be saved into the project
+cbx github sync --repo OWNER/REPO
+```
+
+**Ask before `setup`**: it creates a token and stores it in GitHub. The person
+adds the second secret, `CODEROOK_BRIDGE_PUSH` (a GitHub fine-grained token
+with Contents and Pull requests read/write), themselves, because it is their
+GitHub credential. Every proposal also carries a `coderook/malware` check; a
+failure names the file. Do not try to get round it.
+
 ## Mod repositories for games
 
 A game's maker can run a mod repository: players' game clients read a signed