@coderook/cli 0.36.0 → 0.38.1

package/dist/cli/src/github_bridge.js

@@ -1,403 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.forTests = void 0;
-exports.commandGithub = commandGithub;
-/**
- * `cbx github` — proposals reviewed and tested on GitHub, results on CodeRook.
- *
- * CodeRabbit, Blacksmith and most CI only connect to GitHub-shaped hosts. So
- * rather than each of them learning CodeRook, a GitHub repository is used as
- * a mirror: every open proposal becomes a pull request there, whatever is
- * installed on that repository reviews and builds it, and what they conclude
- * comes back to the proposal as checks — where a required one stops it being
- * applied, exactly like a check reported any other way.
- *
- * It runs on GitHub, in a workflow `setup` writes into the project, so
- * CodeRook never holds a GitHub credential and the mirror costs the service
- * nothing. Each side holds only the other's narrowest key: GitHub keeps a
- * CodeRook token limited to this one project that can read it and report
- * checks, and nothing else; the push token stays in GitHub's secrets.
- *
- * Commits are rebuilt by the git remote helper, which gives the same commit
- * for the same version every time, so the mirror only ever moves forward.
- */
-const node_child_process_1 = require("node:child_process");
-const node_fs_1 = require("node:fs");
-const promises_1 = require("node:fs/promises");
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
-const node_process_1 = __importDefault(require("node:process"));
-const api_js_1 = require("./api.js");
-const colour_js_1 = require("./colour.js");
-const config_js_1 = require("./config.js");
-const WORKFLOW_PATH = ".github/workflows/coderook-bridge.yml";
-/** The bridge's own job, left out of what is reported back. */
-const BRIDGE_JOB = "sync with CodeRook";
-const MARKER = (id) => `<!-- coderook-proposal:${id} -->`;
-const MARKER_PATTERN = /<!-- coderook-proposal:([0-9a-f-]{36}) -->/;
-const flag = (parsed, name) => {
-    const value = parsed.flags.get(name);
-    return typeof value === "string" ? value : undefined;
-};
-async function gh(token, route, method = "GET", body) {
-    const response = await fetch(`https://api.github.com${route}`, {
-        method,
-        headers: {
-            accept: "application/vnd.github+json",
-            authorization: `Bearer ${token}`,
-            "x-github-api-version": "2022-11-28",
-            "user-agent": "CodeRook-CLI",
-            ...(body ? { "content-type": "application/json" } : {}),
-        },
-        body: body ? JSON.stringify(body) : undefined,
-        signal: AbortSignal.timeout(30_000),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        let message = text.slice(0, 300);
-        try {
-            message = JSON.parse(text).message ?? message;
-        }
-        catch {
-            /* not JSON */
-        }
-        throw new Error(`GitHub ${method} ${route.split("?")[0]}: ${response.status} ${message}`);
-    }
-    return (response.status === 204 ? undefined : await response.json());
-}
-/** Every page of a GitHub list, up to a sensible ceiling. */
-async function ghAll(token, route, key) {
-    const all = [];
-    for (let page = 1; page <= 10; page += 1) {
-        const joiner = route.includes("?") ? "&" : "?";
-        const body = await gh(token, `${route}${joiner}per_page=100&page=${page}`);
-        const rows = (key ? body[key] : body);
-        all.push(...rows);
-        if (rows.length < 100)
-            break;
-    }
-    return all;
-}
-function githubToken() {
-    for (const name of ["CODEROOK_BRIDGE_PUSH", "GH_TOKEN", "GITHUB_TOKEN"]) {
-        const value = node_process_1.default.env[name]?.trim();
-        if (value)
-            return value;
-    }
-    /* On somebody's own machine, the GitHub CLI's sign-in will do. */
-    const asked = (0, node_child_process_1.spawnSync)("gh", ["auth", "token"], { encoding: "utf8" });
-    const token = asked.status === 0 ? asked.stdout.trim() : "";
-    return token || null;
-}
-/* ------------------------------------------------------------------ git */
-function git(cwd, args, env = node_process_1.default.env, quiet = true) {
-    const run = (0, node_child_process_1.spawnSync)("git", args, {
-        cwd,
-        env,
-        encoding: "utf8",
-        stdio: quiet ? "pipe" : ["ignore", "inherit", "inherit"],
-        maxBuffer: 64 * 1024 * 1024,
-    });
-    return { ok: run.status === 0, out: run.stdout ?? "", err: run.stderr ?? "" };
-}
-/**
- * The push token as an HTTP header git sends, passed through git's
- * environment-config variables so it never appears in an argument list or a
- * remote URL that `git remote -v` would print.
- */
-function pushEnvironment(token) {
-    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
-    return {
-        ...node_process_1.default.env,
-        GIT_TERMINAL_PROMPT: "0",
-        GIT_CONFIG_COUNT: "1",
-        GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
-        GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
-    };
-}
-/* ------------------------------------------------------------------ setup */
-function workflow(project, required) {
-    return `# Mirrors this project's proposals to pull requests here, so tools that only
-# connect to GitHub (CodeRabbit, Blacksmith, any GitHub Actions CI) can review
-# and test them, and reports what they conclude back to each proposal on
-# CodeRook as checks. Written by \`cbx github setup\`; see
-# https://coderook.com/docs#github-bridge
-#
-# Secrets this needs, in this GitHub repository's settings:
-#   CODEROOK_TOKEN        a CodeRook token limited to this project (setup made it)
-#   CODEROOK_BRIDGE_PUSH  a GitHub token that can push and open pull requests here.
-#                         GitHub's own workflow token cannot: what it pushes starts
-#                         no other workflow, so CI would never run on a proposal.
-name: CodeRook bridge
-
-on:
-  schedule:
-    - cron: "*/10 * * * *"
-  workflow_dispatch:
-  pull_request_review:
-    types: [submitted]
-
-concurrency:
-  group: coderook-bridge
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  pull-requests: read
-  checks: read
-  statuses: read
-
-jobs:
-  sync:
-    name: ${BRIDGE_JOB}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      # What was already imported, so each run fetches only new versions.
-      - uses: actions/cache@v4
-        with:
-          path: .git/coderook
-          key: coderook-marks-\${{ github.run_id }}
-          restore-keys: coderook-marks-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - run: npm install --global @coderook/cli@latest
-      - run: cbx github sync
-        env:
-          CODEROOK_TOKEN: \${{ secrets.CODEROOK_TOKEN }}
-          CODEROOK_BRIDGE_PUSH: \${{ secrets.CODEROOK_BRIDGE_PUSH }}
-          GITHUB_READ_TOKEN: \${{ github.token }}
-          CODEROOK_PROJECT: ${project}
-          # Checks that must pass before a proposal can be applied, by name, comma separated:
-          # e.g. "github/build, review/coderabbitai[bot]". Everything else is reported as advice.
-          CODEROOK_REQUIRED: "${required}"
-`;
-}
-async function setup(parsed) {
-    const repo = parsed.positional[1];
-    if (!repo || !/^[\w.-]+\/[\w.-]+$/.test(repo)) {
-        console.error((0, colour_js_1.red)("Name the GitHub repository to mirror into: cbx github setup <owner>/<repo>"));
-        return 1;
-    }
-    const folder = node_path_1.default.resolve(parsed.positional[2] ?? ".");
-    const link = await (0, config_js_1.readLink)(folder);
-    if (!link) {
-        console.error((0, colour_js_1.red)("This folder is not linked to a project. Run it in the project's folder."));
-        return 1;
-    }
-    const file = node_path_1.default.join(folder, WORKFLOW_PATH);
-    if ((0, node_fs_1.existsSync)(file) && !parsed.flags.has("force")) {
-        console.error((0, colour_js_1.red)(`${WORKFLOW_PATH} is already here. Pass --force to write it again.`));
-        return 1;
-    }
-    const token = await (0, api_js_1.createToken)({
-        name: `GitHub bridge: ${repo}`.slice(0, 80),
-        scopes: ["projects:read", "checks:write"],
-        repositoryId: link.repositoryId,
-        expiresInDays: 365,
-    });
-    await (0, promises_1.mkdir)(node_path_1.default.dirname(file), { recursive: true });
-    await (0, promises_1.writeFile)(file, workflow(link.slug, flag(parsed, "required") ?? ""), "utf8");
-    console.log(`${(0, colour_js_1.green)("Wrote")} ${WORKFLOW_PATH}`);
-    /* Straight into GitHub's secrets when the GitHub CLI is here, so the token is never on screen. */
-    const stored = (0, node_child_process_1.spawnSync)("gh", ["secret", "set", "CODEROOK_TOKEN", "--repo", repo], {
-        input: token.token,
-        encoding: "utf8",
-    });
-    if (stored.status === 0) {
-        console.log(`${(0, colour_js_1.green)("Stored")} CODEROOK_TOKEN in ${repo}'s secrets. It reaches ${(0, colour_js_1.bold)(link.slug)} only, and can read it and report checks.`);
-    }
-    else {
-        console.log("");
-        console.log(`Add this as the secret ${(0, colour_js_1.bold)("CODEROOK_TOKEN")} in ${repo} (Settings → Secrets and variables → Actions).`);
-        console.log("It is shown once, reaches this project only, and can read it and report checks:");
-        console.log(`  ${token.token}`);
-    }
-    console.log("");
-    console.log("Then:");
-    console.log(`  1. Add ${(0, colour_js_1.bold)("CODEROOK_BRIDGE_PUSH")}: a GitHub fine-grained token for ${repo} with`);
-    console.log("     Contents and Pull requests set to read and write.");
-    console.log(`  2. Save the workflow into the project: ${(0, colour_js_1.accent)("cbx submit")}`);
-    console.log(`  3. Mirror it once from here, which also puts the workflow on GitHub: ${(0, colour_js_1.accent)(`cbx github sync --repo ${repo}`)}`);
-    console.log((0, colour_js_1.dim)("  After that it runs on GitHub every ten minutes, and whenever a review is submitted."));
-    console.log((0, colour_js_1.dim)("  Install CodeRabbit on the repository, or use Blacksmith runners in your workflows, as you would anywhere."));
-    return 0;
-}
-function fromCheckRun(run) {
-    const state = run.status !== "completed"
-        ? "pending"
-        : ["success", "neutral"].includes(run.conclusion ?? "")
-            ? "passing"
-            : run.conclusion === "skipped"
-                ? "skipped"
-                : "failing";
-    return {
-        name: `github/${run.name}`,
-        state,
-        detail: run.output?.title || (run.status === "completed" ? run.conclusion ?? "" : run.status),
-        url: run.html_url,
-    };
-}
-function fromStatus(status) {
-    const state = status.state === "success" ? "passing" : status.state === "pending" ? "pending" : "failing";
-    return { name: `github/${status.context}`, state, detail: status.description ?? "", url: status.target_url };
-}
-/** The last word from each reviewer: approved passes, changes requested fails, a comment is advice. */
-function fromReviews(reviews) {
-    const latest = new Map();
-    for (const review of reviews) {
-        const login = review.user?.login;
-        if (!login || review.state === "PENDING" || review.state === "DISMISSED")
-            continue;
-        const state = review.state === "APPROVED" ? "passing" : review.state === "CHANGES_REQUESTED" ? "failing" : "passing";
-        const said = (review.body ?? "").replace(/\s+/g, " ").trim();
-        latest.set(login, {
-            name: `review/${login}`,
-            state,
-            detail: (review.state === "COMMENTED" ? "commented" : review.state.toLowerCase().replace(/_/g, " ")) + (said ? `: ${said}` : ""),
-            url: review.html_url,
-        });
-    }
-    return [...latest.values()];
-}
-async function sync(parsed) {
-    const repo = flag(parsed, "repo") ?? node_process_1.default.env.GITHUB_REPOSITORY;
-    if (!repo) {
-        console.error((0, colour_js_1.red)("Which GitHub repository? Pass --repo <owner>/<repo>."));
-        return 1;
-    }
-    const write = githubToken();
-    if (!write) {
-        console.error((0, colour_js_1.red)("No GitHub token. Set CODEROOK_BRIDGE_PUSH (or GH_TOKEN), or sign in with the GitHub CLI."));
-        return 1;
-    }
-    const github = { repo, write, read: node_process_1.default.env.GITHUB_READ_TOKEN?.trim() || write };
-    const required = new Set((flag(parsed, "required") ?? node_process_1.default.env.CODEROOK_REQUIRED ?? "").split(",").map((name) => name.trim()).filter(Boolean));
-    /* The project: named, or the one this folder (or the token) belongs to. */
-    const named = flag(parsed, "project") ?? node_process_1.default.env.CODEROOK_PROJECT;
-    const link = named ? null : await (0, config_js_1.readLink)(node_process_1.default.cwd());
-    const listed = await (0, api_js_1.projects)();
-    const project = listed.find((one) => one.id === named || one.slug === named) ??
-        (link ? listed.find((one) => one.id === link.repositoryId) : undefined) ??
-        (listed.length === 1 ? listed[0] : undefined);
-    if (!project) {
-        console.error((0, colour_js_1.red)(named ? `No project called ${named} on this account.` : "Name the project: --project <slug>."));
-        return 1;
-    }
-    /* A git repository to work in: this one on GitHub's runner, a scratch one on somebody's machine. */
-    const here = git(node_process_1.default.cwd(), ["rev-parse", "--is-inside-work-tree"]).ok && Boolean(node_process_1.default.env.GITHUB_ACTIONS);
-    const work = here ? node_process_1.default.cwd() : await (0, promises_1.mkdtemp)(node_path_1.default.join(node_os_1.default.tmpdir(), "cbx-github-"));
-    try {
-        if (!here)
-            git(work, ["init", "--quiet"]);
-        git(work, ["remote", "remove", "coderook"]);
-        git(work, ["remote", "add", "coderook", `coderook://${project.slug}`]);
-        console.log(`Fetching ${(0, colour_js_1.bold)(project.slug)} from CodeRook…`);
-        const fetched = git(work, ["fetch", "--quiet", "coderook"], node_process_1.default.env, false);
-        if (!fetched.ok) {
-            console.error((0, colour_js_1.red)("Could not fetch the project from CodeRook."));
-            return 1;
-        }
-        const open = (await (0, api_js_1.proposals)(project.id)).filter((one) => one.proposal?.from && one.proposal?.into);
-        const lines = new Set([project.defaultBranch || "main"]);
-        for (const one of open) {
-            lines.add(one.proposal.from);
-            lines.add(one.proposal.into);
-        }
-        /* Each line to the branch of the same name. Never forced: the mirror only moves forward. */
-        const pushEnv = pushEnvironment(github.write);
-        const pushed = new Set();
-        for (const line of lines) {
-            if (!git(work, ["rev-parse", "--verify", "--quiet", `refs/remotes/coderook/${line}`]).ok)
-                continue;
-            const result = git(work, ["push", "--quiet", `https://github.com/${repo}.git`, `refs/remotes/coderook/${line}:refs/heads/${line}`], pushEnv);
-            if (result.ok) {
-                pushed.add(line);
-            }
-            else {
-                console.error((0, colour_js_1.accent)(`  ${line}: not pushed. ${result.err.trim().split("\n").pop() ?? ""}`));
-                console.error((0, colour_js_1.dim)("  The branch on GitHub has commits CodeRook does not. Mirror into a repository nothing else pushes to."));
-            }
-        }
-        console.log(`${(0, colour_js_1.green)("Mirrored")} ${pushed.size} line${pushed.size === 1 ? "" : "s"} to ${repo}`);
-        /* Pull requests: one per open proposal, found again by the marker in its description. */
-        const existing = await ghAll(github.write, `/repos/${repo}/pulls?state=all`);
-        const byProposal = new Map();
-        for (const pull of existing) {
-            const match = MARKER_PATTERN.exec(pull.body ?? "");
-            if (match && !byProposal.has(match[1]))
-                byProposal.set(match[1], pull);
-        }
-        const site = (node_process_1.default.env.CODEROOK_SITE_URL ?? "https://coderook.com").replace(/\/+$/, "");
-        let reported = 0;
-        for (const one of open) {
-            const from = one.proposal.from;
-            const into = one.proposal.into;
-            if (!pushed.has(from) || !pushed.has(into))
-                continue;
-            const title = `${one.proposal.title ?? `${from} into ${into}`} (${one.reference})`;
-            const body = `Mirrored from CodeRook proposal ${one.reference} so the tools installed here can review and test it. ` +
-                `Results are reported back to it as checks; apply it on CodeRook, not here.\n\n` +
-                `${site}/merges?merge=${one.id}\n\n${MARKER(one.id)}`;
-            let pull = byProposal.get(one.id);
-            if (!pull) {
-                pull = await gh(github.write, `/repos/${repo}/pulls`, "POST", { title, head: from, base: into, body, maintainer_can_modify: false });
-                console.log(`${(0, colour_js_1.green)("Opened")} ${pull.html_url} for ${one.reference}`);
-            }
-            else if (pull.state !== "open" || pull.title !== title) {
-                pull = await gh(github.write, `/repos/${repo}/pulls/${pull.number}`, "PATCH", { title, state: "open", body });
-            }
-            /* What GitHub's side concluded, back to the proposal; only what changed is reported. */
-            const head = (await gh(github.read, `/repos/${repo}/pulls/${pull.number}`)).head.sha;
-            const found = [];
-            const runs = await ghAll(github.read, `/repos/${repo}/commits/${head}/check-runs`, "check_runs");
-            found.push(...runs.filter((run) => run.name !== BRIDGE_JOB).map(fromCheckRun));
-            const combined = await gh(github.read, `/repos/${repo}/commits/${head}/status`);
-            found.push(...combined.statuses.map(fromStatus));
-            found.push(...fromReviews(await ghAll(github.read, `/repos/${repo}/pulls/${pull.number}/reviews`)));
-            const current = new Map((await (0, api_js_1.mergeTrack)(one.id)).checks?.map((check) => [check.name, check]) ?? []);
-            for (const check of found) {
-                const name = check.name.slice(0, 100);
-                const detail = check.detail.slice(0, 2000);
-                const before = current.get(name);
-                const url = check.url && /^https:\/\//.test(check.url) ? check.url : null;
-                if (before && before.state === check.state && (before.detail ?? "") === detail)
-                    continue;
-                await (0, api_js_1.reportMergeCheck)(one.id, name, { state: check.state, required: required.has(name), detail, detailsUrl: url });
-                reported += 1;
-            }
-        }
-        /* A proposal applied or withdrawn on CodeRook closes its pull request here. */
-        const stillOpen = new Set(open.map((one) => one.id));
-        for (const [id, pull] of byProposal) {
-            if (pull.state === "open" && !stillOpen.has(id)) {
-                await gh(github.write, `/repos/${repo}/pulls/${pull.number}`, "PATCH", { state: "closed" });
-                console.log(`${(0, colour_js_1.dim)("Closed")} ${pull.html_url}: its proposal is no longer open`);
-            }
-        }
-        console.log(`${(0, colour_js_1.green)("Reported")} ${reported} check result${reported === 1 ? "" : "s"} to CodeRook`);
-        return 0;
-    }
-    finally {
-        if (!here)
-            await (0, promises_1.rm)(work, { recursive: true, force: true }).catch(() => undefined);
-    }
-}
-async function commandGithub(parsed) {
-    const sub = parsed.positional[0];
-    if (sub === "setup")
-        return setup(parsed);
-    if (sub === "sync")
-        return sync(parsed);
-    console.error((0, colour_js_1.red)(sub ? `cbx github has no "${sub}". ` : "") + "See: " + (0, colour_js_1.accent)("cbx help github"));
-    return 1;
-}
-/** For tests: the workflow text and the mappings. */
-exports.forTests = { workflow, fromCheckRun, fromStatus, fromReviews };