@elalfner/relevo 0.0.0-stage → 0.3.0

package/scripts/lib/ship.mjs

@@ -0,0 +1,161 @@
+// Decides whether a pull request may be merged and what the person must still confirm.
+// Implements openspec/specs/ship/spec.md.
+//
+// `pr` is the JSON of `gh pr view --json number,state,isDraft,mergeable,title,author,reviews,statusCheckRollup,headRefName,headRefOid,baseRefName`.
+
+import { resolveLabelNames } from './labels.mjs';
+
+const OK_CONCLUSIONS = new Set(['SUCCESS', 'NEUTRAL', 'SKIPPED']);
+
+/** Latest decisive review of each person: APPROVED, CHANGES_REQUESTED or DISMISSED. Plain comments never count. */
+export function latestReviewStates(reviews = []) {
+  const ordered = [...reviews].sort((a, b) => String(a.submittedAt ?? '').localeCompare(String(b.submittedAt ?? '')));
+  const states = new Map();
+  ordered.forEach((r) => {
+    const login = r.author?.login;
+    if (!login) return;
+    if (['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(r.state)) states.set(login, r.state);
+  });
+  return states;
+}
+
+/** Like latestReviewStates, with the commit each decisive review was given on: login -> { state, oid }. */
+export function latestReviews(reviews = []) {
+  const ordered = [...reviews].sort((a, b) => String(a.submittedAt ?? '').localeCompare(String(b.submittedAt ?? '')));
+  const latest = new Map();
+  ordered.forEach((r) => {
+    const login = r.author?.login;
+    if (!login) return;
+    if (['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(r.state)) latest.set(login, { state: r.state, oid: r.commit?.oid ?? null });
+  });
+  return latest;
+}
+
+// state of the issue -> the command that is missing
+const MISSING_COMMAND = {
+  built: '/relevo:review',
+  'in-review': '/relevo:review',
+  'qa-failed': '/relevo:fix',
+  'changes-requested': '/relevo:fix',
+};
+const STATE_KEYS = ['ready', 'queued', 'building', 'built', 'in-review', 'pr-open', 'qa-failed', 'changes-requested', 'needs-spec', 'blocked'];
+
+/** Summarise the checks of a pull request: none, passing, failing or pending. */
+export function checkRollup(rollup = []) {
+  if (!rollup || rollup.length === 0) return { state: 'none', failing: [], pending: [] };
+  const failing = [];
+  const pending = [];
+  rollup.forEach((c) => {
+    if (c.__typename === 'StatusContext') {
+      if (['FAILURE', 'ERROR'].includes(c.state)) failing.push(c.context);
+      else if (c.state !== 'SUCCESS') pending.push(c.context);
+      return;
+    }
+    const name = c.name ?? 'a check';
+    if (c.status !== 'COMPLETED') pending.push(name);
+    else if (!OK_CONCLUSIONS.has(c.conclusion)) failing.push(name);
+  });
+  if (failing.length > 0) return { state: 'failing', failing, pending };
+  if (pending.length > 0) return { state: 'pending', failing, pending };
+  return { state: 'passing', failing, pending };
+}
+
+/**
+ * config   effective configuration
+ * pr       the pull request, or null when none exists for the branch
+ * invoker  GitHub login of the person running ship
+ * baseline optional: the head commit recorded when ship started; an approval given on it still counts
+ * labels   optional: the names of the issue's labels; when given, the issue must be pr-open
+ * issue    optional: the issue number, used in the messages about the state
+ * Returns { allowed, reasons, confirm, summary }.
+ *   reasons  why it must stop (empty when allowed)
+ *   confirm  what the person must still confirm in writing, always including "merge"
+ */
+export function shipDecision({ config, pr, invoker, baseline, labels, issue }) {
+  const reasons = [];
+  const warnings = [];
+  const confirm = ['merge'];
+
+  if (!pr) {
+    return { allowed: false, reasons: ['there is no pull request for this branch: it is opened by /relevo:review'], confirm: [], summary: null };
+  }
+  if (pr.state === 'MERGED') return { allowed: false, reasons: ['the pull request is already merged'], confirm: [], summary: null };
+  if (pr.state === 'CLOSED') return { allowed: false, reasons: ['the pull request was closed without merging'], confirm: [], summary: null };
+  if (pr.isDraft) reasons.push('the pull request is still a draft');
+
+  if (labels) {
+    const names = resolveLabelNames(config.labels);
+    const state = STATE_KEYS.find((k) => labels.includes(names[k])) ?? null;
+    if (state !== 'pr-open') {
+      const command = MISSING_COMMAND[state] ?? '/relevo:review';
+      reasons.push(`the issue is ${state ? `"${state}"` : 'not in a Relevo state'}, not "pr-open": run ${command}${issue ? ` ${issue}` : ''} first`);
+    }
+  }
+
+  if (pr.mergeable === 'CONFLICTING') reasons.push('the pull request has conflicts: the author must synchronise the branch with the base branch');
+  else if (pr.mergeable !== 'MERGEABLE') reasons.push('GitHub has not finished checking whether the pull request can be merged: try again in a minute');
+
+  const checks = checkRollup(pr.statusCheckRollup);
+  if (checks.state === 'failing') reasons.push(`checks are failing: ${checks.failing.join(', ')}`);
+  else if (checks.state === 'pending') reasons.push(`checks are still running: ${checks.pending.join(', ')}`);
+  else if (checks.state === 'none') confirm.push('no-ci');
+
+  const author = pr.author?.login;
+  const mode = config.review.mode;
+  let approvedBy = [];
+
+  if (mode === 'peer' || mode === 'roles') {
+    const latest = latestReviews(pr.reviews);
+    const eligible = (login) => login !== author && (mode !== 'roles' || config.team.approvers.includes(login));
+    const approvals = [...latest].filter(([login, r]) => r.state === 'APPROVED' && eligible(login));
+    const stale = [];
+    approvedBy = approvals
+      .filter(([login, r]) => {
+        if (!pr.headRefOid) return true;
+        if (!r.oid) {
+          if (!warnings.includes('review-commit-unknown')) warnings.push('review-commit-unknown');
+          return true;
+        }
+        if (r.oid === pr.headRefOid || (baseline && r.oid === baseline)) return true;
+        stale.push(`${login} (${r.oid.slice(0, 7)})`);
+        return false;
+      })
+      .map(([login]) => login);
+    const changesBy = [...latest].filter(([, r]) => r.state === 'CHANGES_REQUESTED').map(([login]) => login);
+    if (stale.length > 0) reasons.push(`the approval of ${stale.join(', ')} was given on an older commit than the current ${pr.headRefOid.slice(0, 7)}: a new approval is needed on the current code`);
+
+    if (changesBy.length > 0) reasons.push(`changes were requested by ${changesBy.join(', ')} and not yet resolved`);
+    if (approvedBy.length === 0) {
+      reasons.push(mode === 'roles' ? 'waiting for an approval from one of the approvers (someone other than the author)' : 'waiting for an approval from someone other than the author');
+    }
+
+    if (config.review.merger === 'approver' && invoker === author) {
+      const peers = approvedBy.length > 0 ? approvedBy : config.team.members.filter((m) => m !== author && m !== config.team.spec_writer);
+      reasons.push(`the author cannot run ship here (review.merger is "approver"): ${peers.join(' or ')} should run it`);
+    } else if (config.review.merger === 'approver') {
+      const { spec_writer: writer, members, approvers } = config.team;
+      let eligibleToRun = true;
+      if (invoker === writer) {
+        reasons.push('the spec writer never reviews or merges: someone else should run ship');
+        eligibleToRun = false;
+      } else if (members.length > 0 && !members.includes(invoker)) {
+        reasons.push(`${invoker} is not listed in team.members: only members run ship`);
+        eligibleToRun = false;
+      } else if (mode === 'roles' && !approvers.includes(invoker)) {
+        reasons.push(`${invoker} is not one of the approvers (team.approvers): one of them should run ship`);
+        eligibleToRun = false;
+      }
+      if (eligibleToRun && approvedBy.length > 0 && !approvedBy.includes(invoker)) confirm.push('not-approver');
+    }
+    if (config.review.merger === 'author' && invoker !== author) {
+      reasons.push(`the author (${author}) runs ship here (review.merger is "author")`);
+    }
+  }
+
+  return {
+    allowed: reasons.length === 0,
+    reasons,
+    confirm,
+    summary: { pr: pr.number, title: pr.title, author, branch: pr.headRefName, base: pr.baseRefName, mode, approvedBy, checks: checks.state, ...(warnings.length > 0 ? { warnings } : {}) },
+  };
+}

package/scripts/lib/sla.mjs

@@ -0,0 +1,90 @@
+// Review reminder and escalation. Implements "Review reminders and escalation" of
+// openspec/specs/issue-lifecycle/spec.md.
+// The GitHub client is injected (`gh(args) -> stdout`), so everything here is testable without a network.
+
+import { issueFromBranch } from './branch.mjs';
+import { resolveLabelNames } from './labels.mjs';
+import { renderMessage } from './messages.mjs';
+
+/** Hidden markers that make the reminder and the escalation happen once. */
+export const MARKERS = {
+  review_reminder: '<!-- relevo:review_reminder -->',
+  review_escalation: '<!-- relevo:review_escalation -->',
+};
+
+const HOUR = 3600 * 1000;
+
+/**
+ * prs: [{ number, issue, url, reviewer, requested_at, reviewed, reminded, escalated, labels: [names] }]
+ * Returns decisions: { pr, issue, action: 'remind' | 'escalate', hours, labels: { add }, comment: { kind, data } | null }
+ */
+export function planSla({ config, prs, now = new Date() }) {
+  const sla = config.limits.review_sla_hours;
+  const names = resolveLabelNames(config.labels);
+  const decisions = [];
+  prs.forEach((pr) => {
+    if (pr.reviewed || !pr.reviewer || !pr.requested_at) return;
+    const waited = (new Date(now).getTime() - Date.parse(pr.requested_at)) / HOUR;
+    const hours = Math.floor(waited);
+    if (waited >= 2 * sla && !pr.escalated) {
+      const specWriter = config.team.spec_writer;
+      decisions.push({
+        pr: pr.number, issue: pr.issue, action: 'escalate', hours,
+        labels: { add: pr.labels.includes(names['needs-reviewer']) ? [] : [names['needs-reviewer']] },
+        comment: specWriter
+          ? { kind: 'review_escalation', data: { spec_writer: specWriter, issue: pr.issue, pr: pr.url, reviewer: pr.reviewer, hours } }
+          : null,
+      });
+    } else if (waited >= sla && waited < 2 * sla && !pr.reminded && !pr.escalated) {
+      decisions.push({
+        pr: pr.number, issue: pr.issue, action: 'remind', hours, labels: { add: [] },
+        comment: { kind: 'review_reminder', data: { reviewer: pr.reviewer, issue: pr.issue, pr: pr.url, hours } },
+      });
+    }
+  });
+  return decisions;
+}
+
+const json = (gh, args) => JSON.parse(gh(args));
+const paged = (gh, path) => JSON.parse(gh(['api', '--paginate', '--slurp', path])).flat();
+
+/** Open pull requests of Relevo issues that wait for a review, with what the SLA needs to know. */
+export function gatherPrs({ gh, repo, config }) {
+  const names = resolveLabelNames(config.labels);
+  const prs = [];
+  paged(gh, `repos/${repo}/pulls?state=open&per_page=100`).forEach((pr) => {
+    const issue = issueFromBranch(pr.head.ref);
+    if (!issue) return;
+    const labels = json(gh, ['api', `repos/${repo}/issues/${issue}`]).labels.map((l) => (typeof l === 'string' ? l : l.name));
+    if (!labels.includes(names['pr-open'])) return;
+    const reviewer = (pr.requested_reviewers ?? [])[0]?.login ?? null;
+    const timeline = paged(gh, `repos/${repo}/issues/${pr.number}/timeline?per_page=100`);
+    const requests = timeline.filter((e) => e.event === 'review_requested' && (!reviewer || e.requested_reviewer?.login === reviewer));
+    const requested_at = requests.length ? requests[requests.length - 1].created_at : null;
+    const reviews = paged(gh, `repos/${repo}/pulls/${pr.number}/reviews?per_page=100`)
+      .filter((r) => r.submitted_at && r.user?.login !== pr.user?.login);
+    const reviewed = requested_at ? reviews.some((r) => Date.parse(r.submitted_at) >= Date.parse(requested_at)) : reviews.length > 0;
+    const comments = paged(gh, `repos/${repo}/issues/${pr.number}/comments?per_page=100`).map((c) => c.body ?? '');
+    prs.push({
+      number: pr.number, issue, url: pr.html_url, reviewer, requested_at, reviewed, labels,
+      reminded: comments.some((b) => b.includes(MARKERS.review_reminder)),
+      escalated: comments.some((b) => b.includes(MARKERS.review_escalation)),
+    });
+  });
+  return prs;
+}
+
+/** The `gh` commands that carry out one decision. Pure. */
+export function slaCommands(decision, { repo, config }) {
+  const commands = [];
+  if (decision.labels.add.length) {
+    const edit = ['issue', 'edit', String(decision.issue), '--repo', repo];
+    decision.labels.add.forEach((l) => edit.push('--add-label', l));
+    commands.push(edit);
+  }
+  if (decision.comment) {
+    const body = `${renderMessage(decision.comment.kind, decision.comment.data, config.language)}\n\n${MARKERS[decision.comment.kind]}`;
+    commands.push(['issue', 'comment', String(decision.pr), '--repo', repo, '--body', body]);
+  }
+  return commands;
+}

package/scripts/lib/stack-profile.mjs

@@ -0,0 +1,169 @@
+// Stack profiles. Implements the "platforms" specification: a profile is a Markdown file whose header scripts read
+// and whose body the agents read; the repository can add to the plugin's profile but never weaken it.
+//
+// The filesystem is injected (`read(path) -> text | null`) so the logic is tested without a repository.
+
+import { parse, YamlLiteError } from './yaml-lite.mjs';
+
+export const ROLES = ['dev', 'qa', 'issue', 'review'];
+const HEADER_KEYS = new Set(['stack', 'commands', 'generated', 'tools', 'requires_skills', 'skills', 'targets']);
+const STACK_RE = /^[a-z][a-z0-9-]*$/;
+
+const isMap = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const isStringList = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string' && x.trim() !== '');
+const unique = (list) => [...new Set(list)];
+
+const emptyProfile = (stack) => ({
+  stack,
+  commands: {},
+  generated: [],
+  tools: [],
+  requires_skills: [],
+  skills: Object.fromEntries(ROLES.map((r) => [r, []])),
+  targets: {},
+  body: '',
+  questions: '',
+});
+
+export const QUESTIONS_HEADING = 'Questions for the issue writer';
+
+/** Split the section "## Questions for the issue writer" (up to the next heading of level 2) out of a body. */
+export function splitQuestions(text) {
+  const lines = String(text).split('\n');
+  const start = lines.findIndex((l) => /^##\s+/.test(l) && l.replace(/^##\s+/, '').trim().toLowerCase() === QUESTIONS_HEADING.toLowerCase());
+  if (start === -1) return { body: text, questions: '' };
+  let end = lines.findIndex((l, i) => i > start && /^##\s+/.test(l));
+  if (end === -1) end = lines.length;
+  return {
+    body: [...lines.slice(0, start), ...lines.slice(end)].join('\n').replace(/\n{3,}/g, '\n\n').trim(),
+    questions: lines.slice(start + 1, end).join('\n').trim(),
+  };
+}
+
+/**
+ * Read the text of a profile file. Returns { profile, errors }.
+ * The header is the block between the first two `---` lines; the body is the rest.
+ */
+export function parseProfile(text) {
+  const errors = [];
+  const match = String(text ?? '').replace(/\r\n/g, '\n').match(/^---\n([\s\S]*?)\n---[ \t]*(?:\n([\s\S]*))?$/);
+  if (!match) return { profile: null, errors: ['the profile must start with a header between two "---" lines'] };
+  let raw;
+  try {
+    raw = parse(match[1]);
+  } catch (err) {
+    if (err instanceof YamlLiteError) return { profile: null, errors: [`the profile header is not valid: ${err.message}`] };
+    throw err;
+  }
+  if (!isMap(raw)) return { profile: null, errors: ['the profile header must be a map'] };
+
+  Object.keys(raw).filter((k) => !HEADER_KEYS.has(k)).forEach((k) => errors.push(`unknown header key "${k}"; allowed: ${[...HEADER_KEYS].join(', ')}`));
+  if (typeof raw.stack !== 'string' || !STACK_RE.test(raw.stack)) errors.push('the header needs "stack" with the name of the stack');
+
+  const profile = emptyProfile(raw.stack);
+  if (raw.commands !== undefined) {
+    if (!isMap(raw.commands) || Object.values(raw.commands).some((v) => typeof v !== 'string' || v.trim() === '')) errors.push('"commands" must map a name to a command');
+    else profile.commands = { ...raw.commands };
+  }
+  ['generated', 'tools', 'requires_skills'].forEach((key) => {
+    if (raw[key] === undefined) return;
+    if (!isStringList(raw[key])) errors.push(`"${key}" must be a list of names`);
+    else profile[key] = unique(raw[key]);
+  });
+  if (raw.skills !== undefined) {
+    if (!isMap(raw.skills)) errors.push('"skills" must map a role to a list of skill names');
+    else {
+      Object.entries(raw.skills).forEach(([role, list]) => {
+        if (!ROLES.includes(role)) errors.push(`"skills" has unknown role "${role}"; allowed: ${ROLES.join(', ')}`);
+        else if (!isStringList(list)) errors.push(`"skills.${role}" must be a list of skill names`);
+        else profile.skills[role] = unique(list);
+      });
+    }
+  }
+  if (raw.targets !== undefined) {
+    if (!isMap(raw.targets) || Object.values(raw.targets).some((v) => typeof v !== 'string')) errors.push('"targets" must map a target to the tool it needs (empty when none)');
+    else profile.targets = { ...raw.targets };
+  }
+  // The questions for the issue writer are kept apart from the body: dev and qa never receive them.
+  const { body, questions } = splitQuestions((match[2] ?? '').trim());
+  profile.body = body;
+  profile.questions = questions;
+  return { profile: errors.length ? null : profile, errors };
+}
+
+/**
+ * Add the repository's profile to the plugin's. Lists are joined, bodies follow each other, and a value the
+ * plugin already sets is kept (the difference is reported in `ignored`). With no plugin profile the repository's
+ * is the whole profile.
+ */
+export function mergeProfiles(plugin, repository) {
+  if (!plugin && !repository) return null;
+  if (!plugin) return { ...repository, layers: ['repository'], ignored: [] };
+  if (!repository) return { ...plugin, layers: ['plugin'], ignored: [] };
+
+  const out = structuredClone(plugin);
+  const ignored = [];
+  ['generated', 'tools', 'requires_skills'].forEach((key) => { out[key] = unique([...plugin[key], ...repository[key]]); });
+  ROLES.forEach((role) => { out.skills[role] = unique([...plugin.skills[role], ...repository.skills[role]]); });
+  ['commands', 'targets'].forEach((key) => {
+    Object.entries(repository[key]).forEach(([name, value]) => {
+      if (!(name in plugin[key])) out[key][name] = value;
+      else if (plugin[key][name] !== value) ignored.push({ key: `${key}.${name}`, value, kept: plugin[key][name] });
+    });
+  });
+  out.body = [plugin.body, repository.body].filter(Boolean).join('\n\n');
+  out.questions = [plugin.questions, repository.questions].filter(Boolean).join('\n\n');
+  return { ...out, layers: ['plugin', 'repository'], ignored };
+}
+
+/** Apply `platforms.<name>.checks` of relevo.yml: the only way to replace a command. */
+export function applyChecks(profile, checks = {}) {
+  const out = structuredClone(profile);
+  out.commands = { ...profile.commands, ...checks };
+  out.overridden = Object.keys(checks);
+  return out;
+}
+
+export const pluginProfilePath = (pluginRoot, stack) => `${pluginRoot}/stacks/${stack}.md`;
+export const repositoryProfilePath = (stack) => `.relevo/stacks/${stack}.md`;
+
+/** Where a profile for `stack` can be defined, for the messages. */
+export const profileLocations = (stack) => `stacks/${stack}.md in the plugin or ${repositoryProfilePath(stack)} in the repository`;
+
+function readProfile(read, path) {
+  const text = read(path);
+  if (text === null || text === undefined) return { profile: null, errors: [] };
+  const r = parseProfile(text);
+  return { profile: r.profile, errors: r.errors.map((e) => `${path}: ${e}`) };
+}
+
+/**
+ * Resolve the profile of one platform entry ({ stack, path, targets, checks }).
+ * Returns { ok: true, profile } or { ok: false, errors }.
+ */
+export function resolveProfile({ platform, pluginRoot, read }) {
+  const plugin = readProfile(read, pluginProfilePath(pluginRoot, platform.stack));
+  const repository = readProfile(read, repositoryProfilePath(platform.stack));
+  const errors = [...plugin.errors, ...repository.errors];
+  if (errors.length > 0) return { ok: false, errors };
+  const merged = mergeProfiles(plugin.profile, repository.profile);
+  if (!merged) return { ok: false, errors: [`no profile for stack "${platform.stack}": define one in ${profileLocations(platform.stack)}`] };
+  const profile = applyChecks(merged, platform.checks ?? {});
+  profile.stack = platform.stack;
+  return { ok: true, profile };
+}
+
+/**
+ * Lookups for the validation of relevo.yml: the targets and the commands a stack defines, or null when no profile
+ * can be read (then nothing is checked against it; `doctor` reports the missing profile).
+ */
+export function profileLookups({ pluginRoot, read }) {
+  const of = (stack) => {
+    const r = resolveProfile({ platform: { stack }, pluginRoot, read });
+    return r.ok ? r.profile : null;
+  };
+  return {
+    knownTargets: (stack) => { const p = of(stack); return p ? Object.keys(p.targets) : null; },
+    knownChecks: (stack) => { const p = of(stack); return p ? Object.keys(p.commands) : null; },
+  };
+}

package/scripts/lib/staging.mjs

@@ -0,0 +1,21 @@
+// Safe staging: commits must name the files they include. Never "add everything".
+
+const FORBIDDEN_ARGS = new Set(['.', '*', ':/', '-A', '--all', '-a', '-u', '--update', '--patch', '-p', '-i', '--interactive']);
+
+/**
+ * Validate a list of paths to stage and return the arguments for `git add`.
+ * Throws if the list is empty or tries to stage everything.
+ */
+export function explicitStageArgs(paths) {
+  if (!Array.isArray(paths) || paths.length === 0) {
+    throw new Error('staging needs an explicit list of files; refusing to stage nothing or everything');
+  }
+  paths.forEach((p) => {
+    if (typeof p !== 'string' || p.trim() === '') throw new Error('staging paths must be non-empty strings');
+    if (FORBIDDEN_ARGS.has(p) || p.startsWith('-')) {
+      throw new Error(`refusing to stage "${p}": name the files explicitly instead of staging everything`);
+    }
+    if (p.split('/').includes('..')) throw new Error(`refusing to stage "${p}": path leaves the repository`);
+  });
+  return ['add', '--', ...paths];
+}

package/scripts/lib/status-data.mjs

@@ -0,0 +1,109 @@
+// Reads what `status` and the digest need from GitHub. Read-only: every call is a GET.
+// The client is injected (`gh(args) -> stdout`).
+
+import { issueFromBranch } from './branch.mjs';
+import { LABELS, resolveLabelNames } from './labels.mjs';
+import { parseIssueBody } from './issue-parse.mjs';
+import { cloudBuilds, CLOUD_VARIABLE } from './execution-mode.mjs';
+
+const paged = (gh, path) => JSON.parse(gh(['api', '--paginate', '--slurp', path])).flat();
+
+export function gatherStatus({ gh, ghLinks = gh, repo, config }) {
+  const names = resolveLabelNames(config.labels);
+  const byNumber = new Map();
+  LABELS.forEach((l) => {
+    paged(gh, `repos/${repo}/issues?state=open&per_page=100&labels=${encodeURIComponent(names[l.key])}`)
+      .filter((i) => !i.pull_request)
+      .forEach((i) => byNumber.set(i.number, {
+        number: i.number, title: i.title, updated_at: i.updated_at ?? null, labels: i.labels.map((x) => (typeof x === 'string' ? x : x.name)),
+        assignees: (i.assignees ?? []).map((a) => a.login), milestone: i.milestone?.number ?? null,
+        // Only blocked issues need their text: it names what they wait for in other repositories.
+        ...(i.labels.some((x) => (typeof x === 'string' ? x : x.name) === names.blocked) ? { body: i.body ?? '' } : {}),
+      }));
+  });
+  const issues = [...byNumber.values()];
+
+  const wanted = new Set(issues.map((i) => i.milestone).filter(Boolean));
+  const milestones = [...wanted].map((n) => {
+    const m = JSON.parse(gh(['api', `repos/${repo}/milestones/${n}`]));
+    return { number: m.number, title: m.title, due_on: m.due_on ?? null, closed_issues: m.closed_issues ?? 0 };
+  });
+
+  const prs = [];
+  paged(gh, `repos/${repo}/pulls?state=open&per_page=100`).forEach((pr) => {
+    const issue = issueFromBranch(pr.head.ref);
+    if (!issue) return;
+    const reviewer = (pr.requested_reviewers ?? [])[0]?.login ?? null;
+    const reviews = paged(gh, `repos/${repo}/pulls/${pr.number}/reviews?per_page=100`);
+    const latest = new Map();
+    reviews.filter((r) => r.user && r.user.login !== pr.user.login && ['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(r.state))
+      .forEach((r) => latest.set(r.user.login, r));
+    const approvedBy = [...latest.values()].filter((r) => r.state === 'APPROVED').map((r) => r.user.login);
+    const timeline = paged(gh, `repos/${repo}/issues/${pr.number}/timeline?per_page=100`)
+      .filter((e) => e.event === 'review_requested');
+    let behind = 0;
+    try {
+      behind = JSON.parse(gh(['api', `repos/${repo}/compare/${pr.head.sha}...${pr.base.ref}`])).ahead_by ?? 0;
+    } catch {
+      behind = 0;
+    }
+    prs.push({
+      number: pr.number, issue, url: pr.html_url, author: pr.user.login,
+      reviewer: reviewer ?? approvedBy[0] ?? null,
+      requested_at: timeline.length ? timeline[timeline.length - 1].created_at : null,
+      approved: approvedBy.length > 0, behind_by: behind,
+    });
+  });
+  return { issues: issues.map(({ body, ...rest }) => rest), prs, milestones, externalBlocks: readExternalBlocks({ ghLinks, issues, repo, config, names }), cloudBuilds: readCloudBuilds({ gh, repo }) };
+}
+
+/**
+ * What each blocked issue waits for in other (linked) repositories: { [issue number]: [{ ref, state, lifecycle }] }.
+ * `state` is `open`, `closed` (not completed) or `unreadable`; a dependency that is completed is not listed. The
+ * lifecycle is the Relevo label of the other issue, without its prefix, as that repository names it.
+ */
+function readExternalBlocks({ ghLinks, issues, repo, config, names }) {
+  const linked = new Set((config.links ?? []).map((l) => l.toLowerCase()));
+  const out = {};
+  issues.filter((i) => i.labels.includes(names.blocked)).forEach((i) => {
+    const waits = [];
+    parseIssueBody(i.body ?? '').dependsOnExternal
+      .filter((d) => d.repo.toLowerCase() !== String(repo).toLowerCase() && linked.has(d.repo.toLowerCase()))
+      .forEach((d) => {
+        const ref = `${d.repo}#${d.number}`;
+        try {
+          const dep = JSON.parse(ghLinks(['api', `repos/${d.repo}/issues/${d.number}`]));
+          if (dep.state === 'closed' && dep.state_reason === 'completed') return;
+          const label = (dep.labels ?? []).map((x) => (typeof x === 'string' ? x : x.name)).find((n) => String(n).startsWith('relevo:'));
+          waits.push({ ref, state: dep.state === 'closed' ? 'closed' : 'open', lifecycle: label ? label.slice('relevo:'.length) : null });
+        } catch {
+          waits.push({ ref, state: 'unreadable', lifecycle: null });
+        }
+      });
+    if (waits.length) out[i.number] = waits;
+  });
+  return out;
+}
+
+/**
+ * Does the cloud build? The go workflow is on the default branch and the repository variable that pauses the cloud
+ * is not `off`. When the workflow cannot be read the answer is `true` (the cautious one: no extra rows, no claim
+ * that a person must build by hand).
+ */
+function readCloudBuilds({ gh, repo }) {
+  let workflowPresent;
+  try {
+    gh(['api', `repos/${repo}/contents/.github/workflows/relevo-go.yml`]);
+    workflowPresent = true;
+  } catch (err) {
+    if (!/404|Not Found/i.test(String(err.stderr ?? err.message ?? err))) return true;
+    workflowPresent = false;
+  }
+  let variable = null;
+  try {
+    variable = JSON.parse(gh(['api', `repos/${repo}/actions/variables/${CLOUD_VARIABLE}`])).value ?? null;
+  } catch {
+    variable = null;
+  }
+  return cloudBuilds({ workflowPresent, variable });
+}