@dependabit/action 0.1.1

package/src/actions/validate.ts

@@ -0,0 +1,292 @@
+import {
+  readManifest,
+  validateManifest,
+  readConfig,
+  type DependencyManifest,
+  type DependabitConfig
+} from '@dependabit/manifest';
+import * as core from '@actions/core';
+
+/**
+ * Validation result
+ */
+export interface ValidationResult {
+  valid: boolean;
+  errors: string[];
+  warnings: string[];
+  manifest?: DependencyManifest;
+  config: DependabitConfig | undefined;
+}
+
+/**
+ * Main entry point for the validate action wrapped for error handling
+ */
+export async function run(): Promise<void> {
+  try {
+    const manifestPath = core.getInput('manifest_path') || '.dependabit/manifest.json';
+    const configPath = core.getInput('config_path') || '';
+
+    console.log('Starting validation...');
+    const result = await validateAction(manifestPath, configPath || undefined);
+
+    // Output the formatted result
+    const formatted = formatValidationErrors(result);
+    console.log('\n' + formatted);
+
+    if (!result.valid) {
+      core.setFailed(`Validation failed with ${result.errors.length} errors`);
+    } else {
+      core.setOutput('valid', 'true');
+      core.setOutput('errors', JSON.stringify(result.errors));
+      core.setOutput('warnings', JSON.stringify(result.warnings));
+    }
+  } catch (error) {
+    core.setFailed(error instanceof Error ? error.message : String(error));
+  }
+}
+
+/**
+ * Validate manifest file with comprehensive checks
+ *
+ * Performs:
+ * - Schema validation (Zod)
+ * - Business rule validation (duplicate IDs, valid URLs, timestamp order)
+ * - Optional config validation
+ *
+ * @param manifestPath Path to manifest.json
+ * @param configPath Optional path to config.yml
+ * @returns Validation result with errors and warnings
+ */
+export async function validateAction(
+  manifestPath: string,
+  configPath?: string
+): Promise<ValidationResult> {
+  const errors: string[] = [];
+  const warnings: string[] = [];
+  let manifest: DependencyManifest | undefined;
+  let config: DependabitConfig | undefined;
+
+  console.log(`Validating manifest: ${manifestPath}`);
+
+  // Step 1: Read and validate manifest schema
+  try {
+    const rawManifest = await readManifest(manifestPath);
+    manifest = validateManifest(rawManifest);
+    console.log(`✓ Schema validation passed`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    errors.push(`Schema validation failed: ${message}`);
+    console.error(`✗ Schema validation failed: ${message}`);
+    return { valid: false, errors, warnings, config: undefined };
+  }
+
+  // Step 2: Validate business rules
+  validateBusinessRules(manifest, errors, warnings);
+
+  // Step 3: Read and validate config if provided
+  if (configPath) {
+    try {
+      config = await readConfig(configPath);
+      console.log(`✓ Config validation passed: ${configPath}`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`Config validation failed: ${message}`);
+      console.error(`✗ Config validation failed: ${message}`);
+    }
+  }
+
+  // Step 4: Cross-validate manifest and config
+  if (manifest && config) {
+    validateManifestConfigCompatibility(manifest, config, errors, warnings);
+  }
+
+  const valid = errors.length === 0;
+
+  if (valid) {
+    console.log(`✓ Validation passed with ${warnings.length} warnings`);
+  } else {
+    console.error(`✗ Validation failed with ${errors.length} errors`);
+  }
+
+  return { valid, errors, warnings, manifest, config: config || undefined };
+}
+
+/**
+ * Validate business rules
+ */
+function validateBusinessRules(
+  manifest: DependencyManifest,
+  errors: string[],
+  warnings: string[]
+): void {
+  // Check for duplicate dependency IDs
+  const ids = new Set<string>();
+  const duplicateIds: string[] = [];
+
+  for (const dep of manifest.dependencies) {
+    if (ids.has(dep.id)) {
+      duplicateIds.push(dep.id);
+    }
+    ids.add(dep.id);
+  }
+
+  if (duplicateIds.length > 0) {
+    errors.push(`Duplicate dependency IDs found: ${duplicateIds.join(', ')}`);
+  }
+
+  // Check for duplicate URLs
+  const urls = new Set<string>();
+  const duplicateUrls: string[] = [];
+
+  for (const dep of manifest.dependencies) {
+    if (urls.has(dep.url)) {
+      duplicateUrls.push(dep.url);
+    }
+    urls.add(dep.url);
+  }
+
+  if (duplicateUrls.length > 0) {
+    warnings.push(`Duplicate URLs found: ${duplicateUrls.join(', ')}`);
+  }
+
+  // Validate URL formats explicitly
+  for (const dep of manifest.dependencies) {
+    try {
+      new URL(dep.url);
+    } catch {
+      errors.push(`Dependency ${dep.name}: invalid URL format: ${dep.url}`);
+    }
+  }
+
+  // Validate timestamps order
+  for (const dep of manifest.dependencies) {
+    const detectedAt = new Date(dep.detectedAt);
+    const lastChecked = new Date(dep.lastChecked);
+
+    if (lastChecked < detectedAt) {
+      errors.push(
+        `Dependency ${dep.name}: lastChecked (${dep.lastChecked}) is before detectedAt (${dep.detectedAt})`
+      );
+    }
+
+    if (dep.lastChanged) {
+      const lastChanged = new Date(dep.lastChanged);
+      if (lastChanged < detectedAt) {
+        errors.push(
+          `Dependency ${dep.name}: lastChanged (${dep.lastChanged}) is before detectedAt (${dep.detectedAt})`
+        );
+      }
+    }
+  }
+
+  // Validate statistics consistency
+  if (manifest.statistics.totalDependencies !== manifest.dependencies.length) {
+    errors.push(
+      `Statistics mismatch: totalDependencies (${manifest.statistics.totalDependencies}) != actual count (${manifest.dependencies.length})`
+    );
+  }
+
+  // Validate referenced files exist (warning only)
+  const missingReferences: string[] = [];
+  for (const dep of manifest.dependencies) {
+    for (const ref of dep.referencedIn) {
+      // This is a warning because files might have been deleted
+      // We don't fail validation for this
+      if (!ref.file) {
+        missingReferences.push(`Dependency ${dep.name} has empty file reference`);
+      }
+    }
+  }
+
+  if (missingReferences.length > 0) {
+    warnings.push(...missingReferences);
+  }
+
+  // Check for low confidence detections
+  const lowConfidence = manifest.dependencies.filter((dep) => dep.detectionConfidence < 0.5);
+
+  if (lowConfidence.length > 0) {
+    warnings.push(`${lowConfidence.length} dependencies have low detection confidence (<0.5)`);
+  }
+
+  // Check manifest size
+  const manifestSize = JSON.stringify(manifest).length;
+  const sizeInMB = manifestSize / (1024 * 1024);
+
+  if (sizeInMB > 10) {
+    errors.push(`Manifest size (${sizeInMB.toFixed(2)}MB) exceeds maximum (10MB)`);
+  } else if (sizeInMB > 5) {
+    warnings.push(`Manifest size (${sizeInMB.toFixed(2)}MB) is large (target: <1MB, warn: >5MB)`);
+  }
+
+  console.log(`✓ Business rule validation completed`);
+}
+
+/**
+ * Validate manifest and config compatibility
+ */
+function validateManifestConfigCompatibility(
+  manifest: DependencyManifest,
+  config: DependabitConfig,
+  errors: string[],
+  warnings: string[]
+): void {
+  // Check that dependency overrides reference valid dependencies
+  if (config.dependencies) {
+    for (const override of config.dependencies) {
+      const found = manifest.dependencies.some((dep) => dep.url === override.url);
+      if (!found) {
+        warnings.push(
+          `Config override for ${override.url} does not match any dependency in manifest`
+        );
+      }
+    }
+  }
+
+  // Check that ignored URLs are not in manifest (warning)
+  if (config.ignore?.urls) {
+    for (const ignoredUrl of config.ignore.urls) {
+      const found = manifest.dependencies.some((dep) => dep.url === ignoredUrl);
+      if (found) {
+        warnings.push(`Dependency ${ignoredUrl} is in manifest but marked as ignored in config`);
+      }
+    }
+  }
+
+  console.log(`✓ Cross-validation completed`);
+}
+
+/**
+ * Format validation errors for CLI output
+ */
+export function formatValidationErrors(result: ValidationResult): string {
+  const lines: string[] = [];
+
+  if (result.valid) {
+    lines.push('✓ Validation passed');
+    if (result.warnings.length > 0) {
+      lines.push('');
+      lines.push(`Warnings (${result.warnings.length}):`);
+      for (const warning of result.warnings) {
+        lines.push(`  ⚠ ${warning}`);
+      }
+    }
+  } else {
+    lines.push('✗ Validation failed');
+    lines.push('');
+    lines.push(`Errors (${result.errors.length}):`);
+    for (const error of result.errors) {
+      lines.push(`  ✗ ${error}`);
+    }
+
+    if (result.warnings.length > 0) {
+      lines.push('');
+      lines.push(`Warnings (${result.warnings.length}):`);
+      for (const warning of result.warnings) {
+        lines.push(`  ⚠ ${warning}`);
+      }
+    }
+  }
+
+  return lines.join('\n');
+}

package/src/index.ts

@@ -0,0 +1,43 @@
+/**
+ * Entry point for @dependabit/action
+ * Routes to the appropriate action based on input
+ */
+
+import * as core from '@actions/core';
+import { run as runGenerate } from './actions/generate.js';
+import { run as runUpdate } from './actions/update.js';
+import { run as runValidate } from './actions/validate.js';
+
+async function main(): Promise<void> {
+  const action = core.getInput('action') || 'generate';
+
+  switch (action) {
+    case 'generate':
+      await runGenerate();
+      break;
+
+    case 'update':
+      await runUpdate();
+      break;
+
+    case 'check':
+      core.setFailed('Check action not yet implemented');
+      break;
+
+    case 'validate':
+      await runValidate();
+      break;
+
+    default:
+      core.setFailed(`Unknown action: ${action}`);
+  }
+}
+
+// Run the action
+main().catch((error) => {
+  core.setFailed(error instanceof Error ? error.message : String(error));
+});
+
+// Export for testing
+export { main };
+export * from './logger.js';

package/src/logger.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import * as core from '@actions/core';
+import { Logger, createLogger, withTiming } from '../src/logger.js';
+
+// Mock @actions/core
+vi.mock('@actions/core', () => ({
+  debug: vi.fn(),
+  info: vi.fn(),
+  warning: vi.fn(),
+  error: vi.fn(),
+  startGroup: vi.fn(),
+  endGroup: vi.fn()
+}));
+
+describe('Logger Tests', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('Logger', () => {
+    it('should create logger with auto-generated correlation ID', () => {
+      const logger = new Logger();
+      expect(logger.getCorrelationId()).toBeDefined();
+      expect(logger.getCorrelationId()).toMatch(/^\d+-[a-z0-9]+$/);
+    });
+
+    it('should create logger with custom correlation ID', () => {
+      const logger = new Logger({ correlationId: 'test-123' });
+      expect(logger.getCorrelationId()).toBe('test-123');
+    });
+
+    it('should log info messages with JSON formatting', () => {
+      const logger = new Logger({ correlationId: 'test-123' });
+      logger.info('Test message', { key: 'value' });
+
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"level":"info"'));
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"message":"Test message"'));
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"correlationId":"test-123"'));
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"key":"value"'));
+    });
+
+    it('should log warning messages', () => {
+      const logger = new Logger();
+      logger.warning('Warning message');
+
+      expect(core.warning).toHaveBeenCalledWith(expect.stringContaining('"level":"warning"'));
+      expect(core.warning).toHaveBeenCalledWith(
+        expect.stringContaining('"message":"Warning message"')
+      );
+    });
+
+    it('should log error messages', () => {
+      const logger = new Logger();
+      logger.error('Error message');
+
+      expect(core.error).toHaveBeenCalledWith(expect.stringContaining('"level":"error"'));
+      expect(core.error).toHaveBeenCalledWith(expect.stringContaining('"message":"Error message"'));
+    });
+
+    it('should only log debug when enabled', () => {
+      const logger1 = new Logger({ enableDebug: false });
+      logger1.debug('Debug message');
+      expect(core.debug).not.toHaveBeenCalled();
+
+      const logger2 = new Logger({ enableDebug: true });
+      logger2.debug('Debug message');
+      expect(core.debug).toHaveBeenCalledWith(expect.stringContaining('"level":"debug"'));
+    });
+
+    it('should start and end log groups', () => {
+      const logger = new Logger();
+      logger.startGroup('Test Group');
+      expect(core.startGroup).toHaveBeenCalledWith('Test Group');
+
+      logger.endGroup();
+      expect(core.endGroup).toHaveBeenCalled();
+    });
+
+    it('should create child logger with same correlation ID', () => {
+      const parent = new Logger({ correlationId: 'parent-123' });
+      const child = parent.child();
+
+      expect(child.getCorrelationId()).toBe('parent-123');
+    });
+
+    it('should create child logger with merged context', () => {
+      const parent = new Logger({
+        correlationId: 'parent-123',
+        context: { service: 'api' }
+      });
+      const child = parent.child({ operation: 'fetch' });
+
+      child.info('Test message');
+
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"service":"api"'));
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"operation":"fetch"'));
+    });
+
+    it('should log LLM interactions', () => {
+      const logger = new Logger();
+      logger.logLLMInteraction({
+        provider: 'github-copilot',
+        model: 'gpt-4',
+        prompt: 'Test prompt',
+        response: 'Test response',
+        tokens: 100,
+        latencyMs: 500
+      });
+
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"type":"llm_interaction"'));
+      expect(core.info).toHaveBeenCalledWith(
+        expect.stringContaining('"provider":"github-copilot"')
+      );
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"tokens":100'));
+    });
+
+    it('should log API calls', () => {
+      const logger = new Logger();
+      logger.logAPICall({
+        endpoint: '/repos/owner/repo',
+        method: 'GET',
+        statusCode: 200,
+        latencyMs: 300,
+        rateLimit: {
+          remaining: 4999,
+          limit: 5000,
+          reset: 1609459200
+        }
+      });
+
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"type":"api_call"'));
+      expect(core.info).toHaveBeenCalledWith(
+        expect.stringContaining('"endpoint":"/repos/owner/repo"')
+      );
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"statusCode":200'));
+    });
+
+    it('should log operation duration', () => {
+      const logger = new Logger();
+      logger.logDuration('test-operation', 1234, { result: 'success' });
+
+      expect(core.info).toHaveBeenCalledWith(
+        expect.stringContaining('"type":"operation_duration"')
+      );
+      expect(core.info).toHaveBeenCalledWith(
+        expect.stringContaining('"operation":"test-operation"')
+      );
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"durationMs":1234'));
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"result":"success"'));
+    });
+  });
+
+  describe('createLogger', () => {
+    it('should create a logger instance', () => {
+      const logger = createLogger();
+      expect(logger).toBeInstanceOf(Logger);
+      expect(logger.getCorrelationId()).toBeDefined();
+    });
+
+    it('should accept configuration', () => {
+      const logger = createLogger({ correlationId: 'custom-id' });
+      expect(logger.getCorrelationId()).toBe('custom-id');
+    });
+  });
+
+  describe('withTiming', () => {
+    it('should measure and log successful operation', async () => {
+      const logger = new Logger();
+      const fn = vi.fn(async () => {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+        return 'result';
+      });
+
+      const result = await withTiming(logger, 'test-operation', fn);
+
+      expect(result).toBe('result');
+      expect(fn).toHaveBeenCalled();
+      expect(core.info).toHaveBeenCalledWith(
+        expect.stringContaining('"operation":"test-operation"')
+      );
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"durationMs":'));
+    });
+
+    it('should measure and log failed operation', async () => {
+      const logger = new Logger();
+      const error = new Error('Test error');
+      const fn = vi.fn(async () => {
+        throw error;
+      });
+
+      await expect(withTiming(logger, 'test-operation', fn)).rejects.toThrow('Test error');
+
+      expect(fn).toHaveBeenCalled();
+      expect(core.info).toHaveBeenCalledWith(
+        expect.stringContaining('"operation":"test-operation"')
+      );
+      expect(core.info).toHaveBeenCalledWith(expect.stringContaining('"error":"Test error"'));
+    });
+  });
+});