@continuous-excellence/ze-great-dashboard-aws 0.19.0 → 0.20.0

package/client/index.html

@@ -11,8 +11,8 @@
     <title>Trust Dashboard</title>
 
   <script type="importmap">{"imports":{"react":"https://esm.sh/react@19.2.8","react/":"https://esm.sh/react@19.2.8/","react-dom":"https://esm.sh/react-dom@19.2.8","react-dom/":"https://esm.sh/react-dom@19.2.8/","scheduler":"https://esm.sh/scheduler@0.27.0","scheduler/":"https://esm.sh/scheduler@0.27.0/","zod":"https://esm.sh/zod@4.4.3","zod/":"https://esm.sh/zod@4.4.3/"}}</script>
-    <script type="module" crossorigin src="/__ASSET_PATH__/assets/index-BbZhtr6c.js"></script>
-    <link rel="stylesheet" crossorigin href="/__ASSET_PATH__/assets/index-BCZ7NCP8.css">
+    <script type="module" crossorigin src="/__ASSET_PATH__/assets/index-k3N7vI0h.js"></script>
+    <link rel="stylesheet" crossorigin href="/__ASSET_PATH__/assets/index-Cuk6kga3.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/cli.js

@@ -353,7 +353,32 @@ var pullRequestHealthSchema = z4.object({
   status: pipelineStatusSchema.shape.status,
   summary: z4.string().min(1),
   workflows: z4.array(pullRequestHealthItemSchema),
-  pullRequests: z4.array(pullRequestHealthItemSchema)
+  pullRequests: z4.array(pullRequestHealthItemSchema),
+  /** Missing component reads remain visible even when the evidence we did get is reassuring. */
+  incompleteObservations: z4.array(z4.object({ label: z4.string().min(1), message: z4.string().min(1) })).optional(),
+  /** The latest component reading, disclosed beside the oldest aggregate evidence. */
+  newestObservedAt: z4.iso.datetime().optional()
+});
+var pullRequestCandidateSchema = z4.object({
+  number: z4.number().int().positive(),
+  branch: z4.string().min(1),
+  link: z4.url()
+});
+var pullRequestCandidatesSchema = z4.object({
+  type: z4.literal("pull-request-candidates"),
+  pullRequests: z4.array(pullRequestCandidateSchema),
+  /** GitHub's first page is a deliberate bounded observation, not proof that no later PR exists. */
+  truncated: z4.boolean().optional()
+});
+var pullRequestWorkflowObservationSchema = z4.object({
+  type: z4.literal("pull-request-workflow"),
+  workflow: z4.string().min(1),
+  item: pullRequestHealthItemSchema
+});
+var pullRequestBuildObservationSchema = z4.object({
+  type: z4.literal("pull-request-build"),
+  branch: z4.string().min(1),
+  item: pullRequestHealthItemSchema
 });
 var httpValueSchema = z4.object({
   type: z4.literal("http-value"),

package/dist/index.js

@@ -1035,7 +1035,32 @@ var pullRequestHealthSchema = z4.object({
   status: pipelineStatusSchema.shape.status,
   summary: z4.string().min(1),
   workflows: z4.array(pullRequestHealthItemSchema),
-  pullRequests: z4.array(pullRequestHealthItemSchema)
+  pullRequests: z4.array(pullRequestHealthItemSchema),
+  /** Missing component reads remain visible even when the evidence we did get is reassuring. */
+  incompleteObservations: z4.array(z4.object({ label: z4.string().min(1), message: z4.string().min(1) })).optional(),
+  /** The latest component reading, disclosed beside the oldest aggregate evidence. */
+  newestObservedAt: z4.iso.datetime().optional()
+});
+var pullRequestCandidateSchema = z4.object({
+  number: z4.number().int().positive(),
+  branch: z4.string().min(1),
+  link: z4.url()
+});
+var pullRequestCandidatesSchema = z4.object({
+  type: z4.literal("pull-request-candidates"),
+  pullRequests: z4.array(pullRequestCandidateSchema),
+  /** GitHub's first page is a deliberate bounded observation, not proof that no later PR exists. */
+  truncated: z4.boolean().optional()
+});
+var pullRequestWorkflowObservationSchema = z4.object({
+  type: z4.literal("pull-request-workflow"),
+  workflow: z4.string().min(1),
+  item: pullRequestHealthItemSchema
+});
+var pullRequestBuildObservationSchema = z4.object({
+  type: z4.literal("pull-request-build"),
+  branch: z4.string().min(1),
+  item: pullRequestHealthItemSchema
 });
 var httpValueSchema = z4.object({
   type: z4.literal("http-value"),

package/dist/lambda.mjs

@@ -64247,7 +64247,32 @@ var pullRequestHealthSchema = external_exports.object({
   status: pipelineStatusSchema.shape.status,
   summary: external_exports.string().min(1),
   workflows: external_exports.array(pullRequestHealthItemSchema),
-  pullRequests: external_exports.array(pullRequestHealthItemSchema)
+  pullRequests: external_exports.array(pullRequestHealthItemSchema),
+  /** Missing component reads remain visible even when the evidence we did get is reassuring. */
+  incompleteObservations: external_exports.array(external_exports.object({ label: external_exports.string().min(1), message: external_exports.string().min(1) })).optional(),
+  /** The latest component reading, disclosed beside the oldest aggregate evidence. */
+  newestObservedAt: external_exports.iso.datetime().optional()
+});
+var pullRequestCandidateSchema = external_exports.object({
+  number: external_exports.number().int().positive(),
+  branch: external_exports.string().min(1),
+  link: external_exports.url()
+});
+var pullRequestCandidatesSchema = external_exports.object({
+  type: external_exports.literal("pull-request-candidates"),
+  pullRequests: external_exports.array(pullRequestCandidateSchema),
+  /** GitHub's first page is a deliberate bounded observation, not proof that no later PR exists. */
+  truncated: external_exports.boolean().optional()
+});
+var pullRequestWorkflowObservationSchema = external_exports.object({
+  type: external_exports.literal("pull-request-workflow"),
+  workflow: external_exports.string().min(1),
+  item: pullRequestHealthItemSchema
+});
+var pullRequestBuildObservationSchema = external_exports.object({
+  type: external_exports.literal("pull-request-build"),
+  branch: external_exports.string().min(1),
+  item: pullRequestHealthItemSchema
 });
 var httpValueSchema = external_exports.object({
   type: external_exports.literal("http-value"),
@@ -66927,90 +66952,117 @@ function permittedGithubActionsCalls(panel, source, _credentials) {
   url2.searchParams.set("per_page", "1");
   return [{ url: url2.toString(), headers: new Headers() }];
 }
-function permittedGithubActionsPullRequestHealthCalls(panel, source) {
-  const parsedPanel = pullRequestHealthPanelSchema.parse(panel);
-  const parsedSource = githubActionsSourceSchema.parse(source);
-  const calls = parsedPanel.update_workflows.map(
-    ({ workflow }) => githubRunsCall(parsedSource, workflow)
+function pullRequestHealthCapabilities(panel) {
+  const parsed = pullRequestHealthPanelSchema.parse(panel);
+  return {
+    panel: parsed,
+    configuredUpdateWorkflow(workflow) {
+      return parsed.update_workflows.find((candidate) => candidate.workflow === workflow);
+    },
+    permitsBuildBranch(branch) {
+      return parsed.update_workflows.some(
+        ({ branch_prefixes }) => branch_prefixes.some((prefix) => branch.startsWith(prefix))
+      );
+    }
+  };
+}
+async function fetchGithubActionsPullRequestCandidates(args) {
+  const capabilities = pullRequestHealthCapabilities(args.panel);
+  const panel = capabilities.panel;
+  const source = githubActionsSourceSchema.parse(args.source);
+  return githubObservation(
+    args,
+    source,
+    pullRequestsCall(source, panel.base_branch, 1),
+    (value, observedAt4) => {
+      const page = pullRequestsSchema.parse(value);
+      const pullRequests = page.filter(
+        (pullRequest) => capabilities.permitsBuildBranch(pullRequest.head.ref)
+      );
+      return {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt4,
+        link: sourceLinkForRepository(source),
+        signal: {
+          type: "pull-request-candidates",
+          pullRequests: pullRequests.map((pullRequest) => ({
+            number: pullRequest.number,
+            branch: pullRequest.head.ref,
+            link: pullRequest.html_url
+          })),
+          ...page.length === 100 ? { truncated: true } : {}
+        }
+      };
+    }
   );
-  calls.push({
-    ...pullRequestsCall(parsedSource, parsedPanel.base_branch, 1)
-  });
-  return calls;
 }
-async function fetchGithubActionsPullRequestHealth(args) {
-  const panel = pullRequestHealthPanelSchema.parse(args.panel);
+async function fetchGithubActionsUpdateWorkflow(args) {
+  const capabilities = pullRequestHealthCapabilities(args.panel);
+  const panel = capabilities.panel;
   const source = githubActionsSourceSchema.parse(args.source);
+  const configured = capabilities.configuredUpdateWorkflow(args.workflow);
+  if (!configured) throw new Error("Unconfigured update workflow");
+  return githubObservation(
+    args,
+    source,
+    githubRunsCall(source, configured.workflow, void 0, void 0, 100),
+    (value, observedAt4) => {
+      const run = runsSchema.parse(value).workflow_runs.find((candidate) => {
+        const branch = candidate.head_branch;
+        return typeof branch === "string" && configured.branch_prefixes.some((prefix) => branch.startsWith(prefix));
+      });
+      return {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt4,
+        link: sourceLinkForRepository(source),
+        signal: {
+          type: "pull-request-workflow",
+          workflow: configured.workflow,
+          item: healthItem(configured.workflow, run, `Update workflow ${configured.workflow}`)
+        }
+      };
+    }
+  );
+}
+async function fetchGithubActionsPullRequestBuild(args) {
+  const capabilities = pullRequestHealthCapabilities(args.panel);
+  const panel = capabilities.panel;
+  const source = githubActionsSourceSchema.parse(args.source);
+  if (!capabilities.permitsBuildBranch(args.branch))
+    throw new Error("Unpermitted pull request branch");
+  return githubObservation(
+    args,
+    source,
+    githubRunsCall(source, panel.build_workflow, args.branch, "pull_request"),
+    (value, observedAt4) => {
+      const run = runsSchema.parse(value).workflow_runs[0];
+      return {
+        panelId: panel.id,
+        state: "ok",
+        observedAt: observedAt4,
+        link: sourceLinkForRepository(source),
+        signal: {
+          type: "pull-request-build",
+          branch: args.branch,
+          item: healthItem(args.branch, run, args.branch)
+        }
+      };
+    }
+  );
+}
+async function githubObservation(args, source, call, normalize) {
+  let upstream;
   try {
-    const workflowResults = await Promise.all(
-      panel.update_workflows.map(async ({ workflow, branch_prefixes }) => ({
-        workflow,
-        run: await latestRun({
-          source,
-          workflow,
-          branchPrefixes: branch_prefixes,
-          requestHeaders: args.requestHeaders,
-          fetcher: args.fetcher,
-          githubClient: githubClientFor(args)
-        })
-      }))
-    );
-    const pullRequests = await openPullRequests({
-      source,
-      baseBranch: panel.base_branch,
-      requestHeaders: args.requestHeaders,
-      fetcher: args.fetcher,
-      githubClient: githubClientFor(args)
-    });
-    const matching = pullRequests.filter(
-      (pullRequest) => panel.update_workflows.some(
-        ({ branch_prefixes }) => branch_prefixes.some((prefix) => pullRequest.head.ref.startsWith(prefix))
-      )
-    );
-    const pullRequestResults = await Promise.all(
-      matching.map(async (pullRequest) => ({
-        pullRequest,
-        run: await latestRun({
-          source,
-          workflow: panel.build_workflow,
-          branch: pullRequest.head.ref,
-          event: "pull_request",
-          requestHeaders: args.requestHeaders,
-          fetcher: args.fetcher,
-          githubClient: githubClientFor(args)
-        })
-      }))
-    );
-    const workflows = workflowResults.map(
-      ({ workflow, run }) => healthItem(workflow, run, `Update workflow ${workflow}`)
-    );
-    const pullRequestItems = pullRequestResults.map(
-      ({ pullRequest, run }) => healthItem(`PR #${pullRequest.number}`, run, pullRequest.head.ref, pullRequest.html_url)
-    );
-    const allItems = [...workflows, ...pullRequestItems];
-    const status = aggregateStatus(allItems.map((item) => item.status));
-    const summary = summarize(status, workflows, pullRequestItems);
-    const envelope = {
-      panelId: panel.id,
-      state: "ok",
-      observedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      link: sourceLinkForRepository(source),
-      signal: {
-        type: "pull-request-health",
-        status,
-        summary,
-        workflows,
-        pullRequests: pullRequestItems
-      }
-    };
-    return { envelope, response: new Response(null, { status: 200 }) };
+    upstream = await githubFetch(call, { ...args, source, githubClient: githubClientFor(args) });
   } catch (error52) {
     return {
       response: new Response(
         JSON.stringify(
           errorEnvelope2(
-            panel.id,
-            error52 instanceof GithubAuthenticationError ? "unauthorized" : "upstream-error",
+            args.panel.id,
+            error52 instanceof GithubAuthenticationError ? "unauthorized" : "unreachable",
             error52,
             sourceLinkForRepository(source)
           )
@@ -67019,34 +67071,42 @@ async function fetchGithubActionsPullRequestHealth(args) {
       )
     };
   }
-}
-async function latestRun(args) {
-  const call = githubRunsCall(
-    args.source,
-    args.workflow,
-    args.branch,
-    args.event,
-    args.branchPrefixes ? 100 : 1
-  );
-  const response = await githubFetch(call, args);
-  if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-  const runs = runsSchema.parse(await response.json()).workflow_runs;
-  const branchPrefixes = args.branchPrefixes;
-  if (!branchPrefixes) return runs[0];
-  return runs.find((run) => {
-    const headBranch = run.head_branch;
-    return headBranch !== void 0 && headBranch !== null && branchPrefixes.some((prefix) => headBranch.startsWith(prefix));
-  });
-}
-async function openPullRequests(args) {
-  const result = [];
-  for (let page = 1; ; page += 1) {
-    const call = pullRequestsCall(args.source, args.baseBranch, page);
-    const response = await githubFetch(call, args);
-    if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
-    const pageResults = pullRequestsSchema.parse(await response.json());
-    result.push(...pageResults);
-    if (pageResults.length < 100) return result;
+  if (upstream.status === 304) return { response: upstream };
+  if (!upstream.ok)
+    return {
+      response: new Response(
+        JSON.stringify(
+          errorEnvelope2(
+            args.panel.id,
+            errorKind2(upstream.status),
+            `${upstream.status} ${upstream.statusText}`,
+            sourceLinkForRepository(source),
+            observedAt3(upstream.headers.get("date"))
+          )
+        ),
+        { status: 200 }
+      )
+    };
+  try {
+    return {
+      envelope: normalize(await upstream.json(), observedAt3(upstream.headers.get("date"))),
+      response: upstream
+    };
+  } catch (error52) {
+    return {
+      response: new Response(
+        JSON.stringify(
+          errorEnvelope2(
+            args.panel.id,
+            "upstream-error",
+            error52,
+            sourceLinkForRepository(source),
+            observedAt3(upstream.headers.get("date"))
+          )
+        ),
+        { status: 200 }
+      )
+    };
   }
 }
 function pullRequestsCall(source, baseBranch, page) {
@@ -67074,18 +67134,6 @@ function healthItem(label, run, detail, link) {
     link: link ?? run?.html_url ?? null
   };
 }
-function aggregateStatus(statuses) {
-  if (statuses.some((status) => status === "failed")) return "failed";
-  if (statuses.some((status) => status === "running")) return "running";
-  if (statuses.some((status) => status === "unknown")) return "unknown";
-  if (statuses.some((status) => status === "cancelled")) return "cancelled";
-  return "passed";
-}
-function summarize(status, workflows, pullRequests) {
-  const failed = [...workflows, ...pullRequests].find((item) => item.status === status);
-  if (status !== "passed" && failed) return `${failed.label}: ${failed.detail}`;
-  return pullRequests.length === 0 ? `${workflows.length} update workflow${workflows.length === 1 ? "" : "s"} \xB7 No open update PRs` : `${workflows.length} update workflow${workflows.length === 1 ? "" : "s"} \xB7 ${pullRequests.length} open update PR${pullRequests.length === 1 ? "" : "s"}`;
-}
 function sourceLinkForRepository(source) {
   return `https://github.com/${source.repo}`;
 }
@@ -67361,11 +67409,20 @@ function deriveAllowlist(config2) {
     for (const panel of board.panels) {
       const source = panel.source ? config2.sources[panel.source] : void 0;
       const calls = callsFor(panel, source);
-      if (calls) allowed.set(`${boardName}/${panel.id}`, calls);
+      if (calls) allowed.set(`${boardName}/${panel.id}`, /* @__PURE__ */ new Set(["read"]));
+      if (panel.type === "pull-request-health" && source?.type === "github-actions") {
+        allowed.set(
+          `${boardName}/${panel.id}`,
+          /* @__PURE__ */ new Set(["pull-requests", "update-workflow", "pull-request-build"])
+        );
+      }
     }
   }
   return allowed;
 }
+function permitsPanelOperation(allowlist, board, panel, operation2) {
+  return allowlist.get(`${board}/${panel}`)?.has(operation2) ?? false;
+}
 function callsFor(panel, source) {
   if (panel.type === "pipeline-status" && source?.type === "github-actions") {
     return permittedGithubActionsCalls(panel, source);
@@ -67373,9 +67430,6 @@ function callsFor(panel, source) {
   if (panel.type === "pipeline-status" && source?.type === "azure-devops") {
     return permittedAzureDevOpsCalls(panel, source);
   }
-  if (panel.type === "pull-request-health" && source?.type === "github-actions") {
-    return permittedGithubActionsPullRequestHealthCalls(panel, source);
-  }
   if (panel.type === "http-value") return permittedHttpValueCalls(panel);
   return void 0;
 }
@@ -67525,7 +67579,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     const board = deps.boardConfig?.boards[boardName];
     const panel = board?.panels.find((candidate) => candidate.id === panelId);
     const source = panel?.source ? deps.boardConfig?.sources[panel.source] : void 0;
-    if (!panel || panel.type !== "http-value" && !source || !allowlist.has(`${boardName}/${panelId}`))
+    if (!panel || panel.type !== "http-value" && !source || !permitsPanelOperation(allowlist, boardName, panelId, "read"))
       return c5.notFound();
     if (panel.type === "pipeline-status" && source?.type === "github-actions" && source) {
       const result = await fetchGithubActionsPipeline({
@@ -67547,16 +67601,7 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
       });
       return adapterRouteResponse(result);
     }
-    if (panel.type === "pull-request-health" && source?.type === "github-actions" && source) {
-      const result = await fetchGithubActionsPullRequestHealth({
-        panel,
-        source,
-        requestHeaders: c5.req.raw.headers,
-        fetcher: deps.fetcher ?? globalThis.fetch,
-        githubClient
-      });
-      return adapterRouteResponse(result);
-    }
+    if (panel.type === "pull-request-health") return c5.notFound();
     if (panel.type === "http-value") {
       const result = await fetchHttpValue({
         panel,
@@ -67567,6 +67612,64 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
     }
     return c5.notFound();
   });
+  app.get("/api/panel/:board/:panelId/pull-requests", async (c5) => {
+    const resolved = pullRequestPanel(c5.req.param("board"), c5.req.param("panelId"), "pull-requests");
+    if (!resolved) return c5.notFound();
+    return adapterRouteResponse(
+      await fetchGithubActionsPullRequestCandidates({
+        ...resolved,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        githubClient
+      })
+    );
+  });
+  app.get("/api/panel/:board/:panelId/update-workflow/:workflow", async (c5) => {
+    const resolved = pullRequestPanel(
+      c5.req.param("board"),
+      c5.req.param("panelId"),
+      "update-workflow"
+    );
+    const workflow = c5.req.param("workflow");
+    if (!resolved?.capabilities.configuredUpdateWorkflow(workflow)) return c5.notFound();
+    return adapterRouteResponse(
+      await fetchGithubActionsUpdateWorkflow({
+        ...resolved,
+        workflow,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        githubClient
+      })
+    );
+  });
+  app.get("/api/panel/:board/:panelId/pull-request-build", async (c5) => {
+    const resolved = pullRequestPanel(
+      c5.req.param("board"),
+      c5.req.param("panelId"),
+      "pull-request-build"
+    );
+    const branch = c5.req.query("branch");
+    if (!resolved || !branch || !resolved.capabilities.permitsBuildBranch(branch))
+      return c5.notFound();
+    return adapterRouteResponse(
+      await fetchGithubActionsPullRequestBuild({
+        ...resolved,
+        branch,
+        requestHeaders: c5.req.raw.headers,
+        fetcher: deps.fetcher ?? globalThis.fetch,
+        githubClient
+      })
+    );
+  });
+  function pullRequestPanel(boardName, panelId, operation2) {
+    const panel = deps.boardConfig?.boards[boardName]?.panels.find(
+      (candidate) => candidate.id === panelId
+    );
+    const source = panel?.source ? deps.boardConfig?.sources[panel.source] : void 0;
+    const capabilities = panel?.type === "pull-request-health" ? pullRequestHealthCapabilities(panel) : void 0;
+    if (!capabilities) return void 0;
+    return panel?.type === "pull-request-health" && source?.type === "github-actions" && permitsPanelOperation(allowlist, boardName, panelId, operation2) ? { panel, source, capabilities } : void 0;
+  }
   async function renderEntrypoint(_request, board) {
     const template = await templates.get(config2.assetPath);
     const env2 = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "type": "module",
   "description": "AWS Lambda and CloudFormation adapter for Ze Great Dashboard.",
   "keywords": [