@effected/github 0.3.0 → 0.4.0

package/RepositorySecret.js

@@ -0,0 +1,186 @@
+import { GitHubError } from "./GitHubError.js";
+import { GitHubClient } from "./GitHubClient.js";
+import { Repo } from "./Repo.js";
+import { encryptSecret } from "./internal/crypto.js";
+import { Context, Effect, Layer, Redacted, Result } from "effect";
+
+//#region src/RepositorySecret.ts
+const ROUTES = {
+	actions: {
+		publicKey: "GET /repos/{owner}/{repo}/actions/secrets/public-key",
+		put: "PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}",
+		list: "GET /repos/{owner}/{repo}/actions/secrets",
+		remove: "DELETE /repos/{owner}/{repo}/actions/secrets/{secret_name}"
+	},
+	dependabot: {
+		publicKey: "GET /repos/{owner}/{repo}/dependabot/secrets/public-key",
+		put: "PUT /repos/{owner}/{repo}/dependabot/secrets/{secret_name}",
+		list: "GET /repos/{owner}/{repo}/dependabot/secrets",
+		remove: "DELETE /repos/{owner}/{repo}/dependabot/secrets/{secret_name}"
+	},
+	codespaces: {
+		publicKey: "GET /repos/{owner}/{repo}/codespaces/secrets/public-key",
+		put: "PUT /repos/{owner}/{repo}/codespaces/secrets/{secret_name}",
+		list: "GET /repos/{owner}/{repo}/codespaces/secrets",
+		remove: "DELETE /repos/{owner}/{repo}/codespaces/secrets/{secret_name}"
+	}
+};
+/**
+* Secrets, encrypted client-side before they leave the process.
+*
+* @remarks
+* Every write is a **two-step**: fetch the store's public key, then `PUT` a
+* libsodium sealed box. The plaintext never crosses the wire, and the key fetch
+* cannot be cached across stores because each has its own key.
+*
+* ## The value is `Redacted`
+*
+* Not decoration. A plaintext secret in a `string` is one interpolation, one
+* `JSON.stringify` of a params object, or one logged error away from a
+* transcript — and the log line that leaks it usually looks like a diagnostic
+* someone added to debug an unrelated failure. `Redacted` closes those paths at
+* the type; this module performs the single `Redacted.value` unwrap, at the
+* moment of encryption, and the sealed box is what continues.
+*
+* @public
+*/
+var RepositorySecret = class RepositorySecret extends Context.Service()("@effected/github/RepositorySecret") {
+	/**
+	* @remarks
+	* `(client) => make(client)` rather than `make`: a static initializer runs
+	* while the module body is still evaluating, so naming a `const` declared
+	* further down throws at import time with a clean typecheck.
+	*/
+	static layer = Layer.effect(this, Effect.map(GitHubClient, (client) => make(client)));
+	/** An in-memory double; unstubbed members die naming themselves. */
+	static makeTest = (overrides = {}) => ({
+		set: overrides.set ?? (() => unstubbed("set")),
+		list: overrides.list ?? (() => unstubbed("list")),
+		delete: overrides.delete ?? (() => unstubbed("delete")),
+		setForEnvironment: overrides.setForEnvironment ?? (() => unstubbed("setForEnvironment")),
+		listForEnvironment: overrides.listForEnvironment ?? (() => unstubbed("listForEnvironment")),
+		deleteForEnvironment: overrides.deleteForEnvironment ?? (() => unstubbed("deleteForEnvironment"))
+	});
+	/** {@link RepositorySecret.makeTest} behind a `Layer`. */
+	static layerTest = (overrides = {}) => Layer.succeed(RepositorySecret, RepositorySecret.makeTest(overrides));
+};
+const unstubbed = (member) => {
+	throw new Error(`RepositorySecret.makeTest: ${member}() was called but not stubbed — pass an override.`);
+};
+/**
+* Seal a value, turning a malformed public key into a typed failure.
+*
+* @remarks
+* `encryptSecret` returns a `Result` because a base64 decode can fail. A public
+* key GitHub cannot have produced is still *input*, and input failures are
+* typed rather than thrown — so this maps it onto the same `GitHubError` a
+* caller already handles, naming the route it came from.
+*/
+const seal = (route, publicKey, value) => Result.match(encryptSecret(publicKey, Redacted.value(value)), {
+	onSuccess: (sealed) => Effect.succeed(sealed),
+	onFailure: () => Effect.fail(GitHubError.decode(route, "the secrets public key was not valid base64"))
+});
+const make = (client) => {
+	return {
+		set: Effect.fn("RepositorySecret.set")(function* (name, value, scope = "actions") {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				scope,
+				secret: name
+			});
+			const routes = ROUTES[scope];
+			const publicKey = yield* client.request(routes.publicKey, {
+				owner,
+				repo
+			});
+			yield* client.request(routes.put, {
+				owner,
+				repo,
+				secret_name: name,
+				encrypted_value: yield* seal(routes.publicKey, publicKey.key, value),
+				key_id: publicKey.key_id
+			});
+		}),
+		list: Effect.fn("RepositorySecret.list")(function* (scope = "actions") {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				scope
+			});
+			return (yield* client.paginate(ROUTES[scope].list, {
+				owner,
+				repo
+			})).map((secret) => ({ name: secret.name }));
+		}),
+		delete: Effect.fn("RepositorySecret.delete")(function* (name, scope = "actions") {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				scope,
+				secret: name
+			});
+			yield* client.request(ROUTES[scope].remove, {
+				owner,
+				repo,
+				secret_name: name
+			});
+		}),
+		setForEnvironment: Effect.fn("RepositorySecret.setForEnvironment")(function* (environment, name, value) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				environment,
+				secret: name
+			});
+			const publicKey = yield* client.request("GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/public-key", {
+				owner,
+				repo,
+				environment_name: environment
+			});
+			yield* client.request("PUT /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}", {
+				owner,
+				repo,
+				environment_name: environment,
+				secret_name: name,
+				encrypted_value: yield* seal("GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/public-key", publicKey.key, value),
+				key_id: publicKey.key_id
+			});
+		}),
+		listForEnvironment: Effect.fn("RepositorySecret.listForEnvironment")(function* (environment) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				environment
+			});
+			return (yield* client.paginate("GET /repos/{owner}/{repo}/environments/{environment_name}/secrets", {
+				owner,
+				repo,
+				environment_name: environment
+			})).map((secret) => ({ name: secret.name }));
+		}),
+		deleteForEnvironment: Effect.fn("RepositorySecret.deleteForEnvironment")(function* (environment, name) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				environment,
+				secret: name
+			});
+			yield* client.request("DELETE /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}", {
+				owner,
+				repo,
+				environment_name: environment,
+				secret_name: name
+			});
+		})
+	};
+};
+
+//#endregion
+export { RepositorySecret };

package/RepositorySecurity.js

@@ -0,0 +1,141 @@
+import { GitHubClient } from "./GitHubClient.js";
+import { Repo } from "./Repo.js";
+import { Context, Effect, Layer } from "effect";
+
+//#region src/RepositorySecurity.ts
+/**
+* Repository security features with dedicated endpoints.
+*
+* @remarks
+* These are **not** `security_and_analysis` fields and cannot ride along on the
+* settings `PATCH`. Each is its own pair of endpoints where **the HTTP verb is
+* the value**, which is why every setter branches on `enabled` rather than
+* sending a body.
+*
+* ## Reading them is inconsistent, and the inconsistency is GitHub's
+*
+* Preserved faithfully rather than smoothed over, because smoothing it would
+* mean inventing a behaviour for one of the three:
+*
+* | Feature | Enabled | Disabled |
+* | :--- | :--- | :--- |
+* | `vulnerability-alerts` | `204` | **`404`** |
+* | `automated-security-fixes` | `200 { enabled: true }` | `200 { enabled: false }` |
+* | `private-vulnerability-reporting` | `200 { enabled: true }` | `200 { enabled: false }` |
+*
+* So `vulnerabilityAlerts` maps `notFound` to `false` — and **only** `notFound`;
+* every other failure still fails. A 404 from the other two is a real failure
+* and stays one, which is why the mapping is not applied uniformly.
+*
+* @public
+*/
+var RepositorySecurity = class RepositorySecurity extends Context.Service()("@effected/github/RepositorySecurity") {
+	/**
+	* @remarks
+	* `(client) => make(client)` rather than `make`: a static initializer runs
+	* while the module body is still evaluating, so naming a `const` declared
+	* further down throws at import time with a clean typecheck.
+	*/
+	static layer = Layer.effect(this, Effect.map(GitHubClient, (client) => make(client)));
+	/** An in-memory double; unstubbed members die naming themselves. */
+	static makeTest = (overrides = {}) => ({
+		vulnerabilityAlerts: overrides.vulnerabilityAlerts ?? (() => unstubbed("vulnerabilityAlerts")),
+		setVulnerabilityAlerts: overrides.setVulnerabilityAlerts ?? (() => unstubbed("setVulnerabilityAlerts")),
+		automatedSecurityFixes: overrides.automatedSecurityFixes ?? (() => unstubbed("automatedSecurityFixes")),
+		setAutomatedSecurityFixes: overrides.setAutomatedSecurityFixes ?? (() => unstubbed("setAutomatedSecurityFixes")),
+		privateVulnerabilityReporting: overrides.privateVulnerabilityReporting ?? (() => unstubbed("privateVulnerabilityReporting")),
+		setPrivateVulnerabilityReporting: overrides.setPrivateVulnerabilityReporting ?? (() => unstubbed("setPrivateVulnerabilityReporting"))
+	});
+	/** {@link RepositorySecurity.makeTest} behind a `Layer`. */
+	static layerTest = (overrides = {}) => Layer.succeed(RepositorySecurity, RepositorySecurity.makeTest(overrides));
+};
+const unstubbed = (member) => {
+	throw new Error(`RepositorySecurity.makeTest: ${member}() was called but not stubbed — pass an override.`);
+};
+const make = (client) => {
+	return {
+		vulnerabilityAlerts: Effect.fn("RepositorySecurity.vulnerabilityAlerts")(function* () {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo
+			});
+			return yield* client.request("GET /repos/{owner}/{repo}/vulnerability-alerts", {
+				owner,
+				repo
+			}).pipe(Effect.as(true), Effect.catchIf((error) => error.kind === "notFound", () => Effect.succeed(false)));
+		}),
+		setVulnerabilityAlerts: Effect.fn("RepositorySecurity.setVulnerabilityAlerts")(function* (enabled) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				enabled
+			});
+			yield* enabled ? client.request("PUT /repos/{owner}/{repo}/vulnerability-alerts", {
+				owner,
+				repo
+			}) : client.request("DELETE /repos/{owner}/{repo}/vulnerability-alerts", {
+				owner,
+				repo
+			});
+		}),
+		automatedSecurityFixes: Effect.fn("RepositorySecurity.automatedSecurityFixes")(function* () {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo
+			});
+			const data = yield* client.request("GET /repos/{owner}/{repo}/automated-security-fixes", {
+				owner,
+				repo
+			});
+			return Boolean(data.enabled);
+		}),
+		setAutomatedSecurityFixes: Effect.fn("RepositorySecurity.setAutomatedSecurityFixes")(function* (enabled) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				enabled
+			});
+			yield* enabled ? client.request("PUT /repos/{owner}/{repo}/automated-security-fixes", {
+				owner,
+				repo
+			}) : client.request("DELETE /repos/{owner}/{repo}/automated-security-fixes", {
+				owner,
+				repo
+			});
+		}),
+		privateVulnerabilityReporting: Effect.fn("RepositorySecurity.privateVulnerabilityReporting")(function* () {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo
+			});
+			const data = yield* client.request("GET /repos/{owner}/{repo}/private-vulnerability-reporting", {
+				owner,
+				repo
+			});
+			return Boolean(data.enabled);
+		}),
+		setPrivateVulnerabilityReporting: Effect.fn("RepositorySecurity.setPrivateVulnerabilityReporting")(function* (enabled) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				enabled
+			});
+			yield* enabled ? client.request("PUT /repos/{owner}/{repo}/private-vulnerability-reporting", {
+				owner,
+				repo
+			}) : client.request("DELETE /repos/{owner}/{repo}/private-vulnerability-reporting", {
+				owner,
+				repo
+			});
+		})
+	};
+};
+
+//#endregion
+export { RepositorySecurity };

package/RepositoryVariable.js

@@ -0,0 +1,174 @@
+import { GitHubClient } from "./GitHubClient.js";
+import { Repo } from "./Repo.js";
+import { Context, Effect, Layer } from "effect";
+
+//#region src/RepositoryVariable.ts
+/**
+* Repository and environment variables.
+*
+* @remarks
+* No encryption and no public key, unlike secrets — but also **no upsert**,
+* which is the asymmetry worth knowing: every write costs a read first, because
+* the create and update routes are different endpoints with different verbs and
+* neither tolerates the other's case.
+*
+* @public
+*/
+var RepositoryVariable = class RepositoryVariable extends Context.Service()("@effected/github/RepositoryVariable") {
+	/**
+	* @remarks
+	* `(client) => make(client)` rather than `make`: a static initializer runs
+	* while the module body is still evaluating, so naming a `const` declared
+	* further down throws at import time with a clean typecheck.
+	*/
+	static layer = Layer.effect(this, Effect.map(GitHubClient, (client) => make(client)));
+	/** An in-memory double; unstubbed members die naming themselves. */
+	static makeTest = (overrides = {}) => ({
+		set: overrides.set ?? (() => unstubbed("set")),
+		list: overrides.list ?? (() => unstubbed("list")),
+		delete: overrides.delete ?? (() => unstubbed("delete")),
+		setForEnvironment: overrides.setForEnvironment ?? (() => unstubbed("setForEnvironment")),
+		listForEnvironment: overrides.listForEnvironment ?? (() => unstubbed("listForEnvironment")),
+		deleteForEnvironment: overrides.deleteForEnvironment ?? (() => unstubbed("deleteForEnvironment"))
+	});
+	/** {@link RepositoryVariable.makeTest} behind a `Layer`. */
+	static layerTest = (overrides = {}) => Layer.succeed(RepositoryVariable, RepositoryVariable.makeTest(overrides));
+};
+const unstubbed = (member) => {
+	throw new Error(`RepositoryVariable.makeTest: ${member}() was called but not stubbed — pass an override.`);
+};
+const make = (client) => {
+	/**
+	* Does this variable already exist? One by-name read, not a listing.
+	*
+	* @remarks
+	* GitHub answers 404 for an absent variable, which makes the pre-write check
+	* constant cost — paginating the whole collection to answer one yes/no grows
+	* with a repository that has nothing to do with the variable being written.
+	* Only `notFound` is absorbed: a 403 from a mis-scoped token still fails,
+	* which a blanket "treat any error as absent" would destroy, turning a
+	* permissions problem into a spurious create.
+	*/
+	const exists = (route, params) => client.request(route, params).pipe(Effect.as(true), Effect.catchIf((error) => error.kind === "notFound", () => Effect.succeed(false)));
+	return {
+		set: Effect.fn("RepositoryVariable.set")(function* (name, value) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				variable: name
+			});
+			if (yield* exists("GET /repos/{owner}/{repo}/actions/variables/{name}", {
+				owner,
+				repo,
+				name
+			})) {
+				yield* client.request("PATCH /repos/{owner}/{repo}/actions/variables/{name}", {
+					owner,
+					repo,
+					name,
+					value
+				});
+				return;
+			}
+			yield* client.request("POST /repos/{owner}/{repo}/actions/variables", {
+				owner,
+				repo,
+				name,
+				value
+			});
+		}),
+		list: Effect.fn("RepositoryVariable.list")(function* () {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo
+			});
+			return (yield* client.paginate("GET /repos/{owner}/{repo}/actions/variables", {
+				owner,
+				repo
+			})).map((variable) => ({
+				name: variable.name,
+				value: variable.value
+			}));
+		}),
+		delete: Effect.fn("RepositoryVariable.delete")(function* (name) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				variable: name
+			});
+			yield* client.request("DELETE /repos/{owner}/{repo}/actions/variables/{name}", {
+				owner,
+				repo,
+				name
+			});
+		}),
+		setForEnvironment: Effect.fn("RepositoryVariable.setForEnvironment")(function* (environment, name, value) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				environment,
+				variable: name
+			});
+			if (yield* client.request("GET /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}", {
+				owner,
+				repo,
+				environment_name: environment,
+				name
+			}).pipe(Effect.as(true), Effect.catchIf((error) => error.kind === "notFound", () => Effect.succeed(false)))) {
+				yield* client.request("PATCH /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}", {
+					owner,
+					repo,
+					environment_name: environment,
+					name,
+					value
+				});
+				return;
+			}
+			yield* client.request("POST /repos/{owner}/{repo}/environments/{environment_name}/variables", {
+				owner,
+				repo,
+				environment_name: environment,
+				name,
+				value
+			});
+		}),
+		listForEnvironment: Effect.fn("RepositoryVariable.listForEnvironment")(function* (environment) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				environment
+			});
+			return (yield* client.paginate("GET /repos/{owner}/{repo}/environments/{environment_name}/variables", {
+				owner,
+				repo,
+				environment_name: environment
+			})).map((variable) => ({
+				name: variable.name,
+				value: variable.value
+			}));
+		}),
+		deleteForEnvironment: Effect.fn("RepositoryVariable.deleteForEnvironment")(function* (environment, name) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				environment,
+				variable: name
+			});
+			yield* client.request("DELETE /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}", {
+				owner,
+				repo,
+				environment_name: environment,
+				name
+			});
+		})
+	};
+};
+
+//#endregion
+export { RepositoryVariable };

package/Ruleset.js

@@ -0,0 +1,143 @@
+import { GitHubError } from "./GitHubError.js";
+import { GitHubClient } from "./GitHubClient.js";
+import { Repo } from "./Repo.js";
+import { Context, Effect, Layer } from "effect";
+
+//#region src/Ruleset.ts
+/**
+* Repository rulesets.
+*
+* @remarks
+* ## An inherited ruleset is never written to
+*
+* `GET /repos/{owner}/{repo}/rulesets` returns rulesets **inherited from the
+* organization** alongside the repository's own. Matching by name alone lets a
+* repository-scoped call issue a `PUT` against the organization's ruleset id —
+* rewriting policy for **every repository the organization owns**, from a caller
+* that never mentioned the organization.
+*
+* {@link RulesetShape.upsert} filters on `source_type` before matching, so an
+* inherited ruleset can never be the target of a write. This arrived as a fix
+* for a live defect in the consumer this module was ported from, where the
+* filter was absent.
+*
+* @public
+*/
+var Ruleset = class Ruleset extends Context.Service()("@effected/github/Ruleset") {
+	/**
+	* @remarks
+	* `(client) => make(client)` rather than `make`: a static initializer runs
+	* while the module body is still evaluating, so naming a `const` declared
+	* further down throws at import time with a clean typecheck.
+	*/
+	static layer = Layer.effect(this, Effect.map(GitHubClient, (client) => make(client)));
+	/** An in-memory double; unstubbed members die naming themselves. */
+	static makeTest = (overrides = {}) => ({
+		upsert: overrides.upsert ?? (() => unstubbed("upsert")),
+		list: overrides.list ?? (() => unstubbed("list")),
+		delete: overrides.delete ?? (() => unstubbed("delete")),
+		teamId: overrides.teamId ?? (() => unstubbed("teamId")),
+		roleId: overrides.roleId ?? (() => unstubbed("roleId"))
+	});
+	/** {@link Ruleset.makeTest} behind a `Layer`. */
+	static layerTest = (overrides = {}) => Layer.succeed(Ruleset, Ruleset.makeTest(overrides));
+};
+const unstubbed = (member) => {
+	throw new Error(`Ruleset.makeTest: ${member}() was called but not stubbed — pass an override.`);
+};
+/** An inherited ruleset belongs to the organization and is not this repository's to write. */
+const isOwnedByRepository = (ruleset) => ruleset.source_type !== "Organization";
+const make = (client) => {
+	return {
+		upsert: Effect.fn("Ruleset.upsert")(function* (payload) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				ruleset: payload.name
+			});
+			const match = (yield* client.paginate("GET /repos/{owner}/{repo}/rulesets", {
+				owner,
+				repo
+			})).find((ruleset) => ruleset.name === payload.name && isOwnedByRepository(ruleset));
+			const body = {
+				name: payload.name,
+				target: payload.target,
+				enforcement: payload.enforcement,
+				...payload.conditions !== void 0 ? { conditions: payload.conditions } : {},
+				...payload.rules !== void 0 ? { rules: payload.rules } : {},
+				...payload.bypass_actors !== void 0 ? { bypass_actors: payload.bypass_actors } : {}
+			};
+			if (match !== void 0) {
+				yield* client.request("PUT /repos/{owner}/{repo}/rulesets/{ruleset_id}", {
+					owner,
+					repo,
+					ruleset_id: match.id,
+					...body
+				});
+				return;
+			}
+			yield* client.request("POST /repos/{owner}/{repo}/rulesets", {
+				owner,
+				repo,
+				...body
+			});
+		}),
+		list: Effect.fn("Ruleset.list")(function* () {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo
+			});
+			return (yield* client.paginate("GET /repos/{owner}/{repo}/rulesets", {
+				owner,
+				repo
+			})).map((ruleset) => ({
+				id: ruleset.id,
+				name: ruleset.name,
+				source_type: ruleset.source_type
+			}));
+		}),
+		delete: Effect.fn("Ruleset.delete")(function* (rulesetId) {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo,
+				ruleset_id: rulesetId
+			});
+			yield* client.request("DELETE /repos/{owner}/{repo}/rulesets/{ruleset_id}", {
+				owner,
+				repo,
+				ruleset_id: rulesetId
+			});
+		}),
+		teamId: Effect.fn("Ruleset.teamId")(function* (slug) {
+			const { owner } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				org: owner,
+				team_slug: slug
+			});
+			return (yield* client.request("GET /orgs/{org}/teams/{team_slug}", {
+				org: owner,
+				team_slug: slug
+			})).id;
+		}),
+		roleId: Effect.fn("Ruleset.roleId")(function* (name) {
+			const { owner } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				org: owner,
+				role: name
+			});
+			const roles = (yield* client.request("GET /orgs/{org}/organization-roles", { org: owner })).roles ?? [];
+			const role = roles.find((candidate) => candidate.name === name);
+			if (role === void 0) {
+				const available = roles.map((candidate) => candidate.name).join(", ");
+				return yield* GitHubError.notFound("Ruleset.roleId", `organization role '${name}' in '${owner}' (available: ${available || "none"})`);
+			}
+			return role.id;
+		})
+	};
+};
+
+//#endregion
+export { Ruleset };

package/WorkflowDispatch.js

@@ -36,6 +36,7 @@ var WorkflowDispatch = class WorkflowDispatch extends Context.Service()("@effect
 	static makeTest = (overrides = {}) => ({
 		dispatch: overrides.dispatch ?? (() => unstubbed("dispatch")),
 		runStatus: overrides.runStatus ?? (() => unstubbed("runStatus")),
+		list: overrides.list ?? Effect.sync(() => unstubbed("list")),
 		dispatchAndWait: overrides.dispatchAndWait ?? (() => unstubbed("dispatchAndWait"))
 	});
 	/** {@link WorkflowDispatch.makeTest} behind a `Layer`. */
@@ -83,6 +84,22 @@ const make = (client) => {
 			});
 			return statusOf(raw);
 		}),
+		list: Effect.fn("WorkflowDispatch.list")(function* () {
+			const { owner, repo } = yield* Repo;
+			yield* Effect.annotateCurrentSpan({
+				owner,
+				repo
+			});
+			return (yield* client.paginate("GET /repos/{owner}/{repo}/actions/workflows", {
+				owner,
+				repo
+			})).map((workflow) => ({
+				id: workflow.id,
+				name: workflow.name,
+				path: workflow.path,
+				state: workflow.state
+			}));
+		})(),
 		dispatchAndWait: Effect.fn("WorkflowDispatch.dispatchAndWait")(function* (workflow, ref, options) {
 			const { owner, repo } = yield* Repo;
 			const interval = options?.poll?.interval ?? DEFAULT_INTERVAL;