@decohere/ci-tools 0.0.1-dev.20 → 0.0.1-dev.20261105.103

package/src/github/npm-bootstrap.mjs

@@ -0,0 +1,182 @@
+/**
+ * First-publish a new package name (public) and give it its Trusted Publisher,
+ * so `publish.yml` can release it over OIDC from then on.
+ *
+ *   pnpm npm:bootstrap [--otp <code>] [--dry-run] [--channel dev] [<package-name>...]
+ *
+ * Without names: every publishable package whose name is not on npm yet.
+ * Run from the repo root after `npm login` to the org. Each step is skipped when
+ * it is already done (the name exists, the Trusted Publisher is set).
+ *
+ * npm runs on this terminal, so it does its own 2FA: it asks for a code, or
+ * opens the browser for web authentication. `--otp` hands it a code up front
+ * through `NPM_CONFIG_OTP`; `npm trust` takes no `--otp` flag of its own.
+ */
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { pathToFileURL } from "node:url";
+import { listPublishablePackages, npmNameExists } from "./publish-verify.mjs";
+
+/** The Trusted Publisher every package gets: `publish.yml`'s npm job. */
+export const TRUSTED_PUBLISHER = {
+	repo: "typesmiths/decohere",
+	file: "publish.yml",
+	environment: "npm-publish",
+};
+
+/** @param {string | undefined} version */
+export function needsPrereleaseTag(version) {
+	return String(version ?? "").includes("-");
+}
+
+/**
+ * npm arguments for a name-only first publish. Scoped names default to restricted,
+ * so `--access public`. `./` stops npm reading the path as a GitHub `owner/repo`.
+ *
+ * @param {{ dir: string, version?: string }} pkg
+ * @param {string} channel
+ */
+export function publishArgs(pkg, channel) {
+	const tag = needsPrereleaseTag(pkg.version) ? ["--tag", channel] : [];
+	return ["publish", `./projects/${pkg.dir}`, "--access", "public", ...tag];
+}
+
+/** @param {string} name */
+export function trustArgs(name) {
+	return [
+		"trust",
+		"github",
+		name,
+		"--file",
+		TRUSTED_PUBLISHER.file,
+		"--repo",
+		TRUSTED_PUBLISHER.repo,
+		"--env",
+		TRUSTED_PUBLISHER.environment,
+		"--allow-publish",
+		"--yes",
+	];
+}
+
+/** @param {string} output `npm trust list <name> --json` */
+export function hasTrustedPublisher(output) {
+	return output.includes(TRUSTED_PUBLISHER.file) && output.includes(TRUSTED_PUBLISHER.repo);
+}
+
+/**
+ * @typedef {{ capture?: boolean, otp?: string }} NpmOptions
+ * `capture` keeps stdout to read it (npm can then not prompt for 2FA);
+ * otherwise npm owns the terminal.
+ */
+
+/**
+ * @param {string[]} args
+ * @param {NpmOptions} [options]
+ * @returns {{ status: number, output: string }}
+ */
+function runNpm(args, { capture = false, otp } = {}) {
+	const result = spawnSync("npm", args, {
+		encoding: "utf8",
+		stdio: capture ? ["inherit", "pipe", "inherit"] : "inherit",
+		env: otp ? { ...process.env, NPM_CONFIG_OTP: otp } : process.env,
+	});
+	return { status: result.status ?? 1, output: result.stdout ?? "" };
+}
+
+/**
+ * @param {{
+ *   argv?: string[],
+ *   root?: string,
+ *   io?: {
+ *     npm?: (args: string[], options?: NpmOptions) => { status: number, output: string },
+ *     nameExists?: (name: string) => boolean,
+ *     log?: (line: string) => void,
+ *   },
+ * }} [options]
+ * @returns {Promise<number>} exit code
+ */
+export async function runBootstrap(options = {}) {
+	const { values, positionals } = parseArgs({
+		args: options.argv ?? process.argv.slice(2),
+		options: {
+			otp: { type: "string" },
+			"dry-run": { type: "boolean", default: false },
+			channel: { type: "string", default: "dev" },
+		},
+		allowPositionals: true,
+	});
+	const io = options.io ?? {};
+	const npm = io.npm ?? runNpm;
+	const nameExists = io.nameExists ?? ((name) => npmNameExists(name));
+	const log = io.log ?? ((line) => process.stdout.write(`${line}\n`));
+	const dryRun = values["dry-run"];
+
+	// Even on a dry run: the names are private, so `npm view` 404s without a login
+	// and every package would look unpublished.
+	if (npm(["whoami"]).status !== 0) {
+		log("Not logged in to npm: run `npm login` first.");
+		return 1;
+	}
+
+	const publishable = listPublishablePackages(options.root ?? process.cwd());
+	const unknown = positionals.filter((name) => !publishable.some((pkg) => pkg.name === name));
+	if (unknown.length > 0) {
+		log(`Not a publishable package in projects/: ${unknown.join(", ")}`);
+		return 1;
+	}
+	const packages =
+		positionals.length > 0
+			? publishable.filter((pkg) => positionals.includes(pkg.name))
+			: publishable.filter((pkg) => !nameExists(pkg.name));
+	if (packages.length === 0) {
+		log("Every package name is on npm already. Name one to check its Trusted Publisher.");
+		return 0;
+	}
+
+	// A code npm rejects (they last about 30 seconds) makes npm ask for a new one.
+	/** @param {string[]} args */
+	const change = (args) => {
+		if (dryRun) {
+			log(`[dry run] npm ${args.join(" ")}`);
+			return true;
+		}
+		return npm(args, { otp: values.otp }).status === 0;
+	};
+
+	for (const pkg of packages) {
+		log(`\n${pkg.name} (projects/${pkg.dir}, ${pkg.version})`);
+
+		if (nameExists(pkg.name)) {
+			log("  name is on npm: skip the first publish");
+		} else if (!change(publishArgs(pkg, values.channel))) {
+			log(`  first publish failed: stopping`);
+			return 1;
+		}
+
+		const listed = dryRun
+			? { status: 1, output: "" }
+			: npm(["trust", "list", pkg.name, "--json"], { capture: true, otp: values.otp });
+		if (listed.status === 0 && hasTrustedPublisher(listed.output)) {
+			log("  Trusted Publisher is set: skip");
+		} else if (!change(trustArgs(pkg.name))) {
+			log("  Trusted Publisher failed: stopping");
+			return 1;
+		}
+	}
+
+	log(
+		"\nFor each new package, also run `pnpm npm:trust-promote --otp <code>`, so Promote to latest can move its tag.",
+	);
+	log(
+		"\nDone. Add the PR to the merge queue. If Publish already failed on this, rerun it: `gh run rerun --failed <run-id>`.",
+	);
+	return 0;
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	process.exit(await runBootstrap());
+}

package/src/github/npm-trust-promote.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+/**
+ * Gives every public @decohere package the Trusted Publisher `promote-latest.yml` needs, by copying
+ * it from one package an owner set up on npmjs.com. `npm trust` has no flag for the "Allow npm
+ * dist-tag" permission (`manageDistTags` in the registry), so this calls the same registry endpoint
+ * it uses. npm doesn't document that endpoint. It only adds entries, and packages that already have
+ * one are skipped.
+ *
+ * Reads the owner's npm login from NPM_TOKEN, and never prints it.
+ *
+ *   NPM_TOKEN="$(sed -n 's#^//registry.npmjs.org/:_authToken=##p' ~/.npmrc)" \
+ *     pnpm npm:trust-promote --otp <code> [--from @decohere/cli]
+ */
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { listPublishablePackages } from "./publish-verify.mjs";
+
+export const PROMOTE_WORKFLOW = "promote-latest.yml";
+const REGISTRY = "https://registry.npmjs.org";
+
+/**
+ * @typedef {{ type?: string, claims?: { workflow_ref?: { file?: string } }, permissions?: string[] }} TrustEntry
+ */
+
+/**
+ * @param {TrustEntry[]} entries
+ * @returns {TrustEntry | undefined}
+ */
+function findPromoteEntry(entries) {
+	return entries.find((entry) => entry.claims?.workflow_ref?.file === PROMOTE_WORKFLOW);
+}
+
+/**
+ * @param {{
+ *   packages: string[],
+ *   from: string,
+ *   token: string,
+ *   otp: string,
+ *   fetch: typeof globalThis.fetch,
+ *   log?: (message: string) => void,
+ * }} options
+ * @returns {Promise<number>} exit code
+ */
+export async function copyPromoteTrust(options) {
+	const { packages, from, token, otp, fetch } = options;
+	const log = options.log ?? console.log;
+	const headers = {
+		authorization: `Bearer ${token}`,
+		"npm-otp": otp,
+		"content-type": "application/json",
+	};
+	const trustUrl = (name) => `${REGISTRY}/-/package/${name.replace("/", "%2f")}/trust`;
+
+	const list = async (name) => {
+		const response = await fetch(trustUrl(name), { headers });
+		if (!response.ok) {
+			throw new Error(`reading ${name}: ${response.status} ${await response.text()}`);
+		}
+		return /** @type {TrustEntry[]} */ (await response.json());
+	};
+
+	let source;
+	try {
+		source = findPromoteEntry(await list(from));
+	} catch (error) {
+		log(`Nothing changed. ${String(error)}`);
+		return 1;
+	}
+	if (source == null) {
+		log(
+			`${from} has no Trusted Publisher for ${PROMOTE_WORKFLOW}. On npmjs.com, in its settings, add ` +
+				`one: GitHub Actions, organization typesmiths, repository decohere, workflow ${PROMOTE_WORKFLOW}, ` +
+				"no environment, Allow npm publish off, Allow npm dist-tag on. Then run this again. " +
+				"If you set it up on another package, pass that one with --from. Nothing changed.",
+		);
+		return 1;
+	}
+	log(`Copying from ${from}, with permissions: ${(source.permissions ?? []).join(", ")}`);
+
+	const entry = { type: source.type, claims: source.claims, permissions: source.permissions };
+	const others = packages.filter((name) => name !== from);
+	const failures = [];
+	// All at once, so one OTP code covers them before it expires.
+	await Promise.all(
+		others.map(async (name) => {
+			try {
+				if (findPromoteEntry(await list(name)) != null) {
+					log(`already set: ${name}`);
+					return;
+				}
+				const response = await fetch(trustUrl(name), {
+					method: "POST",
+					headers,
+					body: JSON.stringify([entry]),
+				});
+				if (!response.ok) {
+					failures.push(`${name}: ${response.status} ${await response.text()}`);
+					return;
+				}
+				log(`set: ${name}`);
+			} catch (error) {
+				failures.push(`${name}: ${String(error)}`);
+			}
+		}),
+	);
+
+	if (failures.length > 0) {
+		log(`Failed:\n${failures.join("\n")}\nRun it again with a new code to finish.`);
+		return 1;
+	}
+	log(`Done: ${packages.length} packages have a Trusted Publisher for ${PROMOTE_WORKFLOW}.`);
+	return 0;
+}
+
+if (process.argv[1] != null && import.meta.url === pathToFileURL(process.argv[1]).href) {
+	const { values } = parseArgs({
+		options: {
+			otp: { type: "string" },
+			from: { type: "string", default: "@decohere/cli" },
+		},
+	});
+	const token = process.env.NPM_TOKEN;
+	if (!token || !values.otp) {
+		console.error(
+			`Usage: NPM_TOKEN="$(sed -n 's#^//registry.npmjs.org/:_authToken=##p' ~/.npmrc)" pnpm npm:trust-promote --otp <code>`,
+		);
+		process.exit(1);
+	}
+	process.exit(
+		await copyPromoteTrust({
+			packages: listPublishablePackages(resolve(".")).map((pkg) => pkg.name),
+			from: values.from,
+			token,
+			otp: values.otp,
+			fetch: globalThis.fetch,
+		}),
+	);
+}

package/src/github/publish-verify.mjs

@@ -0,0 +1,204 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { listProjectDirs } from "../lib/workspace-packages.mjs";
+
+/**
+ * Workspace packages that `forge publish` will upload (not `"private": true`), including
+ * grouped ones such as `projects/data/data-typeorm`.
+ * @param {string} root
+ */
+export function listPublishablePackages(root) {
+	const packages = [];
+	for (const projectDir of listProjectDirs(root)) {
+		const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
+		if (typeof pkg.name !== "string" || pkg.private === true) {
+			continue;
+		}
+		packages.push({
+			name: pkg.name,
+			version: pkg.version,
+			dir: relative(join(root, "projects"), projectDir),
+		});
+	}
+	return packages.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+export function dockerRepositories(root) {
+	const create = JSON.parse(readFileSync(join(root, "projects/create/package.json"), "utf8"));
+	const devcontainer = JSON.parse(
+		readFileSync(join(root, "projects/devcontainer/package.json"), "utf8"),
+	);
+	return {
+		create: create.decohere?.dockerImageRepository ?? "ghcr.io/typesmiths/decohere/create",
+		devcontainer:
+			devcontainer.decohere?.dockerImageRepository ??
+			"ghcr.io/typesmiths/decohere/devcontainer",
+		createVersion: create.version,
+		workspaceVersion: JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version,
+	};
+}
+
+/**
+ * @param {string} spec package or package@version
+ * @param {{ spawnSync?: typeof spawnSync }} [io]
+ */
+export function npmNameExists(spec, io = {}) {
+	const spawn = io.spawnSync ?? spawnSync;
+	const result = spawn("npm", ["view", spec, "name"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return result.status === 0;
+}
+
+/**
+ * @param {string} spec package@version
+ * @param {{ spawnSync?: typeof spawnSync }} [io]
+ */
+export function npmVersionExists(spec, io = {}) {
+	const spawn = io.spawnSync ?? spawnSync;
+	const result = spawn("npm", ["view", spec, "version"], {
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return result.status === 0;
+}
+
+/**
+ * Parse `ghcr.io/org/name/image` into GitHub packages API coordinates.
+ * @param {string} repository
+ */
+export function parseGhcrRepository(repository) {
+	const withoutHost = repository.replace(/^ghcr\.io\//, "");
+	const slash = withoutHost.indexOf("/");
+	if (slash < 0) {
+		throw new Error(`Not a GHCR repository: ${repository}`);
+	}
+	return {
+		org: withoutHost.slice(0, slash),
+		packageName: withoutHost.slice(slash + 1),
+	};
+}
+
+/**
+ * @param {string} repository ghcr.io/org/pkg
+ * @param {string} tag
+ * @param {{ token: string, fetch?: typeof fetch }} io
+ */
+export async function ghcrTagExists(repository, tag, io) {
+	const { org, packageName } = parseGhcrRepository(repository);
+	const encoded = encodeURIComponent(packageName);
+	const headers = {
+		Authorization: `Bearer ${io.token}`,
+		Accept: "application/vnd.github+json",
+		"X-GitHub-Api-Version": "2022-11-28",
+	};
+	const fetchImpl = io.fetch ?? fetch;
+	for (let page = 1; page <= 20; page += 1) {
+		const url = `https://api.github.com/orgs/${org}/packages/container/${encoded}/versions?per_page=100&page=${page}`;
+		const response = await fetchImpl(url, { headers });
+		if (response.status === 404) {
+			return false;
+		}
+		if (!response.ok) {
+			throw new Error(`GHCR versions ${response.status} for ${repository}`);
+		}
+		const versions = await response.json();
+		if (!Array.isArray(versions) || versions.length === 0) {
+			return false;
+		}
+		for (const version of versions) {
+			const tags = version.metadata?.container?.tags ?? [];
+			if (tags.includes(tag)) {
+				return true;
+			}
+		}
+		if (versions.length < 100) {
+			return false;
+		}
+	}
+	return false;
+}
+
+/**
+ * @param {{
+ *   root: string,
+ *   spawnSync?: typeof spawnSync,
+ *   fetch?: typeof fetch,
+ *   githubToken?: string,
+ * }} options
+ */
+export async function collectPublishVerify(options) {
+	const packages = listPublishablePackages(options.root);
+	const unpublished = [];
+	let publishedVersions = 0;
+	for (const pkg of packages) {
+		if (!npmNameExists(pkg.name, options)) {
+			unpublished.push(pkg.name);
+			continue;
+		}
+		if (npmVersionExists(`${pkg.name}@${pkg.version}`, options)) {
+			publishedVersions += 1;
+		}
+	}
+
+	const images = dockerRepositories(options.root);
+	const token = options.githubToken ?? "";
+	let skipDocker = false;
+	if (token) {
+		const createExists = await ghcrTagExists(images.create, images.workspaceVersion, {
+			token,
+			fetch: options.fetch,
+		});
+		const devExists = await ghcrTagExists(images.devcontainer, images.workspaceVersion, {
+			token,
+			fetch: options.fetch,
+		});
+		skipDocker = createExists && devExists;
+	}
+
+	return {
+		unpublished,
+		skipNpm: packages.length > 0 && publishedVersions === packages.length,
+		skipDocker,
+		imageTag: images.workspaceVersion,
+		createVersion: images.createVersion,
+		repository: images.create,
+		devcontainerRepository: images.devcontainer,
+		packageCount: packages.length,
+		publishedVersions,
+	};
+}
+
+export function formatGithubOutput(result) {
+	return [
+		`unpublished=${result.unpublished.join(" ")}`,
+		`skip_npm=${result.skipNpm ? "true" : "false"}`,
+		`skip_docker=${result.skipDocker ? "true" : "false"}`,
+		`image_tag=${result.imageTag}`,
+		`create_version=${result.createVersion}`,
+		`repository=${result.repository}`,
+		`devcontainer_repository=${result.devcontainerRepository}`,
+	].join("\n");
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	const result = await collectPublishVerify({
+		root: process.cwd(),
+		githubToken: process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN,
+	});
+	const body = formatGithubOutput(result);
+	process.stdout.write(`${body}\n`);
+	if (process.env.GITHUB_OUTPUT) {
+		const { appendFileSync } = await import("node:fs");
+		appendFileSync(process.env.GITHUB_OUTPUT, `${body}\n`);
+	}
+	if (result.unpublished.length) {
+		process.stderr.write(`Not on npm yet: ${result.unpublished.join(", ")}\n`);
+	}
+}

package/src/github/smoke-create-launcher.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/**
+ * Run `npx @decohere/create@version --help` from an empty temp directory.
+ * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
+ * `@decohere/create` into the workspace tree and npm's npx misses the bin.
+ * No token: the packages are public, so this installs the launcher the way a user does.
+ * Anonymous reads go through npm's cache, which can lag minutes behind a publish, so it
+ * first waits until npm serves the version (`attempts` tries, `intervalMs` apart).
+ *
+ * @param {{
+ *   createVersion: string,
+ *   attempts?: number,
+ *   intervalMs?: number,
+ *   sleep?: (ms: number) => void,
+ *   mkdtempSync?: typeof mkdtempSync,
+ *   writeFileSync?: typeof writeFileSync,
+ *   spawnSync?: typeof spawnSync,
+ *   tmpdir?: () => string,
+ *   stdio?: import("node:child_process").StdioOptions,
+ * }} options
+ */
+export function runCreateLauncherSmoke(options) {
+	const version = options.createVersion?.trim() ?? "";
+	if (!version) {
+		throw new Error("CREATE_VERSION is required");
+	}
+
+	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
+	const writeFile = options.writeFileSync ?? writeFileSync;
+	const spawn = options.spawnSync ?? spawnSync;
+	const tmp = options.tmpdir ?? tmpdir;
+	const sleep = options.sleep ?? sleepSync;
+	const attempts = options.attempts ?? 20;
+	const intervalMs = options.intervalMs ?? 15_000;
+
+	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
+	const npmrc = join(workDir, ".npmrc");
+	writeFile(npmrc, "@decohere:registry=https://registry.npmjs.org/\n");
+
+	const env = { ...process.env, NPM_CONFIG_USERCONFIG: npmrc };
+	const spec = `@decohere/create@${version}`;
+
+	for (let attempt = 1; ; attempt++) {
+		const view = spawn("npm", ["view", spec, "version"], { cwd: workDir, env, stdio: "pipe" });
+		if (view.status === 0) break;
+		if (attempt >= attempts) {
+			console.error(`${spec} is still not served by npm after ${attempts} tries`);
+			return { workDir, status: 1 };
+		}
+		console.log(`${spec} not served by npm yet (try ${attempt} of ${attempts}); waiting`);
+		sleep(intervalMs);
+	}
+
+	const result = spawn("npx", ["--yes", spec, "--help"], {
+		cwd: workDir,
+		env,
+		stdio: options.stdio ?? "inherit",
+	});
+
+	return {
+		workDir,
+		status: result.status ?? 1,
+	};
+}
+
+/** @param {number} ms */
+function sleepSync(ms) {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+const isCli =
+	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
+
+if (isCli) {
+	const { status } = runCreateLauncherSmoke({
+		createVersion: process.env.CREATE_VERSION ?? "",
+	});
+	process.exit(status);
+}

package/src/lib/github-issue.mjs

@@ -0,0 +1,75 @@
+/**
+ * One GitHub issue per subject, found again by its exact title and updated in place: CI files
+ * a reminder once and keeps it current instead of opening a new issue every run. Needs `gh` and
+ * GH_TOKEN (or GITHUB_TOKEN) with issues: write.
+ */
+
+import { spawnSync } from "node:child_process";
+
+/**
+ * @param {string[]} args
+ * @param {string} [input]
+ */
+export function gh(args, input) {
+	const result = spawnSync("gh", args, { encoding: "utf8", input, env: process.env });
+	if (result.status !== 0) {
+		throw new Error(result.stderr || result.stdout || `gh ${args.join(" ")} failed`);
+	}
+	return result.stdout;
+}
+
+/**
+ * The issue titled exactly `title`, preferring an open one over a closed one.
+ *
+ * @param {{ number: number, title: string, state: string, url: string }[]} issues
+ * @param {string} title
+ */
+export function pickIssue(issues, title) {
+	const matches = issues.filter((issue) => issue.title === title);
+	return matches.find((issue) => issue.state === "OPEN") ?? matches[0] ?? null;
+}
+
+/**
+ * @param {{ title: string, body: string, assignees?: string[], repo?: string }} options
+ * @param {typeof gh} [run]
+ * @returns {{ number: number, url: string, created: boolean }}
+ */
+export function upsertIssue(options, run = gh) {
+	const { title, body, assignees = [] } = options;
+	const repo = options.repo ? ["--repo", options.repo] : [];
+	const issues = JSON.parse(
+		run([
+			"issue",
+			"list",
+			...repo,
+			"--state",
+			"all",
+			"--limit",
+			"200",
+			"--search",
+			// Quoted: GitHub's search can't match a title like `security(ci): …` unquoted.
+			// The exact-title match in pickIssue still decides.
+			`"${title.replaceAll('"', "")}" in:title`,
+			"--json",
+			"number,title,state,url",
+		]),
+	);
+	const assign = assignees.flatMap((login) => ["--add-assignee", login]);
+	const existing = pickIssue(issues, title);
+	if (existing != null) {
+		if (existing.state !== "OPEN") {
+			run(["issue", "reopen", String(existing.number), ...repo]);
+		}
+		run(
+			["issue", "edit", String(existing.number), ...repo, "--body-file", "-", ...assign],
+			body,
+		);
+		return { number: existing.number, url: existing.url, created: false };
+	}
+	const url = run(
+		["issue", "create", ...repo, "--title", title, "--body-file", "-", ...assign],
+		body,
+	).trim();
+	const number = Number(url.split("/").pop());
+	return { number, url, created: true };
+}

package/src/lib/lcov.mjs

@@ -13,7 +13,7 @@ function normalizePath(filePath) {
 
 /**
  * Extracts the top-level project name from a source path like
- * `/workspace/projects/hearth/src/foo.ts` → `"hearth"`.
+ * `/workspace/projects/core/src/foo.ts` → `"core"`.
  * @param {string} sourcePath
  * @returns {string | undefined}
  */