@empire-builder-kit/nx 1.0.0-beta.10

package/src/git-policy/github-bootstrap.js

@@ -0,0 +1,759 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EBK_CODE_OWNER_PLACEHOLDER = exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = exports.EBK_DEPLOYMENT_ROLE_SECRET = exports.EBK_REQUIRED_CHECKS = exports.EBK_PROTECTED_BRANCH_RULESET_NAME = void 0;
+exports.runGitHubBootstrap = runGitHubBootstrap;
+const index_js_1 = require("../repository-policy/index.js");
+exports.EBK_PROTECTED_BRANCH_RULESET_NAME = 'Empire Builder Kit protected branches';
+exports.EBK_REQUIRED_CHECKS = ['policy', 'verify'];
+exports.EBK_DEPLOYMENT_ROLE_SECRET = 'AWS_DEPLOY_ROLE_ARN';
+exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES = [
+    'AWS_EXPECTED_ACCOUNT_ID',
+    'AWS_REGION',
+    'EBK_ALLOW_PRODUCTION_REMOVE',
+];
+exports.EBK_CODE_OWNER_PLACEHOLDER = '@REPLACE_WITH_GITHUB_CODE_OWNER';
+const GITHUB_API_VERSION = '2022-11-28';
+const PROTECTED_BRANCHES = ['develop', 'main'];
+const ENVIRONMENT_BRANCHES = {
+    production: 'main',
+    staging: 'develop',
+};
+const PRIVATE_ENVIRONMENT_REVIEWER_PLANS = new Set([
+    'business_plus',
+    'enterprise',
+    'enterprise_cloud',
+]);
+class GitHubApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+class GitHubApi {
+    token;
+    baseUrl;
+    constructor(baseUrl, token) {
+        this.token = token;
+        this.baseUrl = baseUrl.replace(/\/$/, '');
+    }
+    async request(method, path, body) {
+        const response = await fetch(`${this.baseUrl}${path}`, {
+            body: body === undefined ? undefined : JSON.stringify(body),
+            headers: {
+                Accept: 'application/vnd.github+json',
+                Authorization: `Bearer ${this.token}`,
+                'X-GitHub-Api-Version': GITHUB_API_VERSION,
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+            },
+            method,
+        });
+        if (!response.ok) {
+            let detail = response.statusText;
+            try {
+                const payload = (await response.json());
+                detail = payload.message ?? detail;
+            }
+            catch {
+                // The status and endpoint are sufficient for a safe diagnostic.
+            }
+            throw new GitHubApiError(response.status, `GitHub ${method} ${path} failed (${response.status}): ${detail}`);
+        }
+        if (response.status === 204)
+            return undefined;
+        return (await response.json());
+    }
+}
+function parseRepository(repository) {
+    const match = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(repository.trim());
+    if (!match) {
+        throw new Error('GitHub repository must be explicit and formatted as owner/repository.');
+    }
+    return { owner: match[1], repo: match[2] };
+}
+function asObjects(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'object' && item !== null && !Array.isArray(item))
+        : [];
+}
+function asStrings(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : [];
+}
+function requiresPrivateEnvironmentCapabilities(repo) {
+    if (typeof repo.visibility === 'string') {
+        return repo.visibility !== 'public';
+    }
+    if (typeof repo.private === 'boolean')
+        return repo.private;
+    return true;
+}
+function namedValues(value, property = 'name') {
+    return asObjects(value)
+        .map((item) => item[property])
+        .filter((item) => typeof item === 'string')
+        .sort();
+}
+async function readPagedObjects(api, path, collectionProperty) {
+    const values = [];
+    for (let page = 1; page <= 100; page += 1) {
+        const separator = path.includes('?') ? '&' : '?';
+        const payload = await api.request('GET', `${path}${separator}per_page=100&page=${page}`);
+        const pageValues = collectionProperty
+            ? asObjects(typeof payload === 'object' && payload !== null
+                ? payload[collectionProperty]
+                : undefined)
+            : asObjects(payload);
+        values.push(...pageValues);
+        if (pageValues.length < 100)
+            return values;
+    }
+    throw new Error(`GitHub pagination exceeded 10,000 records for ${path}.`);
+}
+function rulesetRules(ruleset) {
+    return asObjects(ruleset.rules);
+}
+function ruleParameters(rule) {
+    return typeof rule.parameters === 'object' && rule.parameters !== null
+        ? rule.parameters
+        : {};
+}
+function activeBranchRuleset(ruleset) {
+    return ruleset.target === 'branch' && ruleset.enforcement === 'active';
+}
+function refPatternMatches(pattern, ref) {
+    if (pattern === '~ALL')
+        return true;
+    if (pattern === '~DEFAULT_BRANCH')
+        return ref === 'refs/heads/main';
+    const expression = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*/g, '*')
+        .replace(/\*/g, '.*')
+        .replace(/\?/g, '.');
+    return new RegExp(`^${expression}$`).test(ref);
+}
+function rulesetTouchesProtectedBranches(ruleset) {
+    const conditions = typeof ruleset.conditions === 'object' && ruleset.conditions !== null
+        ? ruleset.conditions
+        : {};
+    const refName = typeof conditions.ref_name === 'object' && conditions.ref_name !== null
+        ? conditions.ref_name
+        : undefined;
+    if (!refName)
+        return true;
+    const include = asStrings(refName.include);
+    const exclude = asStrings(refName.exclude);
+    return PROTECTED_BRANCHES.some((branch) => {
+        const ref = `refs/heads/${branch}`;
+        const included = include.length === 0 ||
+            include.some((pattern) => refPatternMatches(pattern, ref));
+        const excluded = exclude.some((pattern) => refPatternMatches(pattern, ref));
+        return included && !excluded;
+    });
+}
+function conflictsWithMergeCommitContract(ruleset) {
+    if (!activeBranchRuleset(ruleset) ||
+        !rulesetTouchesProtectedBranches(ruleset)) {
+        return [];
+    }
+    const conflicts = [];
+    for (const rule of rulesetRules(ruleset)) {
+        if (rule.type === 'required_linear_history') {
+            conflicts.push('requires linear history');
+        }
+        if (rule.type === 'pull_request') {
+            const methods = asStrings(ruleParameters(rule).allowed_merge_methods);
+            if (methods.length > 0 && !methods.includes('merge')) {
+                conflicts.push('does not permit merge commits');
+            }
+        }
+    }
+    return conflicts;
+}
+function reviewerState(environment) {
+    const rule = asObjects(environment.protection_rules).find((candidate) => candidate.type === 'required_reviewers');
+    if (!rule)
+        return { preventSelfReview: false, reviewers: [] };
+    const reviewers = asObjects(rule.reviewers).flatMap((entry) => {
+        const reviewer = typeof entry.reviewer === 'object' && entry.reviewer !== null
+            ? entry.reviewer
+            : {};
+        const id = reviewer.id;
+        const candidateType = entry.type ?? reviewer.type;
+        if (typeof id !== 'number' ||
+            !Number.isSafeInteger(id) ||
+            (candidateType !== 'Team' && candidateType !== 'User')) {
+            return [];
+        }
+        return [{ id, type: candidateType }];
+    });
+    reviewers.sort((left, right) => left.type === right.type
+        ? left.id - right.id
+        : left.type.localeCompare(right.type));
+    return {
+        preventSelfReview: rule.prevent_self_review === true,
+        reviewers,
+    };
+}
+function environmentWaitTimer(environment) {
+    const rule = asObjects(environment.protection_rules).find((candidate) => candidate.type === 'wait_timer');
+    const waitTimer = rule?.wait_timer;
+    return typeof waitTimer === 'number' && Number.isSafeInteger(waitTimer)
+        ? waitTimer
+        : 0;
+}
+function hasValidCatchAllCodeOwner(contents) {
+    const catchAllOwners = contents.split(/\r?\n/).flatMap((line) => {
+        const withoutComment = line.split('#', 1)[0]?.trim() ?? '';
+        if (!withoutComment)
+            return [];
+        const [pattern, ...owners] = withoutComment.split(/\s+/);
+        return pattern === '*' ? [owners] : [];
+    });
+    const effectiveOwners = catchAllOwners.at(-1);
+    return (effectiveOwners !== undefined &&
+        effectiveOwners.length > 0 &&
+        effectiveOwners.every((owner) => owner.startsWith('@') && owner !== exports.EBK_CODE_OWNER_PLACEHOLDER));
+}
+function desiredRuleset() {
+    return {
+        bypass_actors: [],
+        conditions: {
+            ref_name: {
+                exclude: [],
+                include: PROTECTED_BRANCHES.map((branch) => `refs/heads/${branch}`),
+            },
+        },
+        enforcement: 'active',
+        name: exports.EBK_PROTECTED_BRANCH_RULESET_NAME,
+        rules: [
+            { type: 'deletion' },
+            { type: 'non_fast_forward' },
+            {
+                parameters: {
+                    allowed_merge_methods: ['merge'],
+                    dismiss_stale_reviews_on_push: true,
+                    require_code_owner_review: true,
+                    require_last_push_approval: true,
+                    required_approving_review_count: 1,
+                    required_review_thread_resolution: true,
+                },
+                type: 'pull_request',
+            },
+            {
+                parameters: {
+                    required_status_checks: exports.EBK_REQUIRED_CHECKS.map((context) => ({
+                        context,
+                    })),
+                    strict_required_status_checks_policy: true,
+                },
+                type: 'required_status_checks',
+            },
+        ],
+        target: 'branch',
+    };
+}
+async function inspectEnvironment(api, repositoryPath, name) {
+    const encoded = encodeURIComponent(name);
+    let environment;
+    try {
+        environment = await api.request('GET', `${repositoryPath}/environments/${encoded}`);
+    }
+    catch (error) {
+        if (error instanceof GitHubApiError && error.status === 404) {
+            return {
+                branchPolicies: [],
+                customBranchPolicies: false,
+                exists: false,
+                preventSelfReview: false,
+                reviewers: [],
+                secretNames: [],
+                variableNames: [],
+                waitTimer: 0,
+            };
+        }
+        throw error;
+    }
+    const customBranchPolicies = typeof environment.deployment_branch_policy === 'object' &&
+        environment.deployment_branch_policy !== null &&
+        environment.deployment_branch_policy
+            .custom_branch_policies === true;
+    let branchPolicyValues = [];
+    try {
+        const branchPolicies = await readPagedObjects(api, `${repositoryPath}/environments/${encoded}/deployment-branch-policies`, 'branch_policies');
+        branchPolicyValues = namedValues(branchPolicies);
+    }
+    catch (error) {
+        if (!(error instanceof GitHubApiError &&
+            error.status === 404 &&
+            !customBranchPolicies)) {
+            throw error;
+        }
+    }
+    const secrets = await readPagedObjects(api, `${repositoryPath}/environments/${encoded}/secrets`, 'secrets');
+    const variables = await readPagedObjects(api, `${repositoryPath}/environments/${encoded}/variables`, 'variables');
+    const reviewers = reviewerState(environment);
+    return {
+        branchPolicies: branchPolicyValues,
+        customBranchPolicies,
+        exists: true,
+        preventSelfReview: reviewers.preventSelfReview,
+        reviewers: reviewers.reviewers,
+        secretNames: namedValues(secrets),
+        variableNames: namedValues(variables),
+        waitTimer: environmentWaitTimer(environment),
+    };
+}
+async function inspect(api, repositoryPath, productionApprovalMode) {
+    const blockers = [];
+    const repo = await api.request('GET', repositoryPath);
+    let ownerPlanName;
+    if (productionApprovalMode === 'environment-reviewer' &&
+        requiresPrivateEnvironmentCapabilities(repo)) {
+        const owner = typeof repo.owner === 'object' && repo.owner !== null
+            ? repo.owner
+            : {};
+        const login = typeof owner.login === 'string' ? owner.login : undefined;
+        const ownerType = owner.type;
+        if (!login || (ownerType !== 'Organization' && ownerType !== 'User')) {
+            blockers.push('Private-repository GitHub plan capability could not be resolved from the repository owner.');
+        }
+        else {
+            const ownerPath = `${ownerType === 'Organization' ? '/orgs' : '/users'}/${encodeURIComponent(login)}`;
+            try {
+                const ownerState = await api.request('GET', ownerPath);
+                const plan = typeof ownerState.plan === 'object' && ownerState.plan !== null
+                    ? ownerState.plan
+                    : {};
+                ownerPlanName =
+                    typeof plan.name === 'string' ? plan.name.toLowerCase() : undefined;
+                if (!ownerPlanName) {
+                    blockers.push('Private-repository GitHub plan capability could not be verified; environment-reviewer mode fails closed.');
+                }
+            }
+            catch (error) {
+                blockers.push(`Private-repository GitHub plan capability could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    for (const branch of PROTECTED_BRANCHES) {
+        try {
+            const codeOwners = await api.request('GET', `${repositoryPath}/contents/.github/CODEOWNERS?ref=${branch}`);
+            const content = codeOwners.content;
+            const encoding = codeOwners.encoding;
+            if (typeof content !== 'string' ||
+                encoding !== 'base64' ||
+                !hasValidCatchAllCodeOwner(Buffer.from(content, 'base64').toString('utf8'))) {
+                blockers.push(`Committed .github/CODEOWNERS on ${branch} must contain a valid effective final non-placeholder catch-all owner before code-owner review can be enforced.`);
+            }
+            const errors = await api.request('GET', `${repositoryPath}/codeowners/errors?ref=${branch}`);
+            const codeOwnerErrors = asObjects(errors.errors);
+            if (codeOwnerErrors.length > 0) {
+                blockers.push(`GitHub reports ${codeOwnerErrors.length} CODEOWNERS error${codeOwnerErrors.length === 1 ? '' : 's'} on ${branch}.`);
+            }
+        }
+        catch (error) {
+            blockers.push(`CODEOWNERS enforcement on ${branch} could not be verified: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    let rulesets = [];
+    try {
+        const summaries = await readPagedObjects(api, `${repositoryPath}/rulesets?includes_parents=true`);
+        rulesets = await Promise.all(summaries.map(async (summary) => {
+            const id = summary.id;
+            return typeof id === 'number'
+                ? api.request('GET', `${repositoryPath}/rulesets/${id}`)
+                : summary;
+        }));
+    }
+    catch (error) {
+        blockers.push(`Ruleset enforcement could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    for (const branch of PROTECTED_BRANCHES) {
+        try {
+            const branchState = await api.request('GET', `${repositoryPath}/branches/${branch}`);
+            const commit = typeof branchState.commit === 'object' && branchState.commit !== null
+                ? branchState.commit
+                : {};
+            const sha = typeof commit.sha === 'string' ? commit.sha : branch;
+            const checks = await readPagedObjects(api, `${repositoryPath}/commits/${encodeURIComponent(sha)}/check-runs`, 'check_runs');
+            const names = new Set(namedValues(checks));
+            for (const required of exports.EBK_REQUIRED_CHECKS) {
+                if (!names.has(required)) {
+                    blockers.push(`${branch} has not emitted the required ${required} check context.`);
+                }
+            }
+        }
+        catch (error) {
+            blockers.push(`${branch} branch/check discovery failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    let repositorySecretNames = [];
+    try {
+        const secrets = await readPagedObjects(api, `${repositoryPath}/actions/secrets`, 'secrets');
+        repositorySecretNames = namedValues(secrets);
+    }
+    catch (error) {
+        blockers.push(`Repository secret inventory could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let repositoryVariableNames = [];
+    try {
+        const variables = await readPagedObjects(api, `${repositoryPath}/actions/variables`, 'variables');
+        repositoryVariableNames = namedValues(variables);
+    }
+    catch (error) {
+        blockers.push(`Repository variable inventory could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let orgSecretNames;
+    let orgVariableNames;
+    const owner = typeof repo.owner === 'object' && repo.owner !== null
+        ? repo.owner
+        : undefined;
+    if (owner?.type === 'User') {
+        orgSecretNames = [];
+        orgVariableNames = [];
+    }
+    else {
+        try {
+            const secrets = await readPagedObjects(api, `${repositoryPath}/actions/organization-secrets`, 'secrets');
+            orgSecretNames = namedValues(secrets);
+        }
+        catch (error) {
+            blockers.push(`Organization secret exposure is unverified and requires a credential with inspection access: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        try {
+            const variables = await readPagedObjects(api, `${repositoryPath}/actions/organization-variables`, 'variables');
+            orgVariableNames = namedValues(variables);
+        }
+        catch (error) {
+            blockers.push(`Organization variable exposure is unverified and requires a credential with inspection access: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    let actionsCanApprovePullRequests;
+    let actionsDefaultWorkflowPermissions;
+    try {
+        const permissions = await api.request('GET', `${repositoryPath}/actions/permissions/workflow`);
+        actionsCanApprovePullRequests =
+            permissions.can_approve_pull_request_reviews === true;
+        actionsDefaultWorkflowPermissions =
+            typeof permissions.default_workflow_permissions === 'string'
+                ? permissions.default_workflow_permissions
+                : undefined;
+    }
+    catch (error) {
+        blockers.push(`Workflow pull-request permission could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const inspectNamedEnvironment = async (name) => {
+        try {
+            return await inspectEnvironment(api, repositoryPath, name);
+        }
+        catch (error) {
+            blockers.push(`${name} environment inventory could not be inspected: ${error instanceof Error ? error.message : String(error)}`);
+            return {
+                branchPolicies: [],
+                customBranchPolicies: false,
+                exists: false,
+                preventSelfReview: false,
+                reviewers: [],
+                secretNames: [],
+                variableNames: [],
+                waitTimer: 0,
+            };
+        }
+    };
+    const [production, staging] = await Promise.all([
+        inspectNamedEnvironment('production'),
+        inspectNamedEnvironment('staging'),
+    ]);
+    return {
+        blockers,
+        state: {
+            actionsCanApprovePullRequests,
+            actionsDefaultWorkflowPermissions,
+            environments: { production, staging },
+            orgSecretNames,
+            orgVariableNames,
+            ownerPlanName,
+            ownedRuleset: rulesets.find((ruleset) => ruleset.name === exports.EBK_PROTECTED_BRANCH_RULESET_NAME &&
+                ruleset.source_type !== 'Organization'),
+            repo,
+            repositorySecretNames,
+            repositoryVariableNames,
+            rulesets,
+        },
+    };
+}
+function evaluate(repository, state, inspectionBlockers, productionApprovalMode, productionReviewerIds) {
+    const blockers = [...inspectionBlockers];
+    const changes = [];
+    const warnings = [];
+    const privateRepository = requiresPrivateEnvironmentCapabilities(state.repo);
+    if (productionApprovalMode === 'environment-reviewer' &&
+        privateRepository &&
+        state.ownerPlanName !== undefined &&
+        !PRIVATE_ENVIRONMENT_REVIEWER_PLANS.has(state.ownerPlanName)) {
+        blockers.push(`Committed environment-reviewer mode requires GitHub Enterprise support for a private repository; the inspected owner plan is ${state.ownerPlanName}.`);
+    }
+    if (state.repo.allow_merge_commit !== true) {
+        changes.push('Enable repository merge commits.');
+    }
+    if (state.repo.allow_squash_merge !== false) {
+        changes.push('Disable repository squash merging.');
+    }
+    if (state.repo.allow_rebase_merge !== false) {
+        changes.push('Disable repository rebase merging.');
+    }
+    if (state.actionsCanApprovePullRequests !== true) {
+        blockers.push('GitHub Actions is not permitted to create or approve pull requests for managed sync-back.');
+    }
+    if (state.actionsDefaultWorkflowPermissions !== 'read') {
+        blockers.push('GitHub Actions default workflow permissions must be read-only; write access must remain job-scoped.');
+    }
+    if (state.repositorySecretNames.includes(exports.EBK_DEPLOYMENT_ROLE_SECRET)) {
+        blockers.push(`${exports.EBK_DEPLOYMENT_ROLE_SECRET} exists at repository scope and would bypass environment protection.`);
+    }
+    if (state.orgSecretNames?.includes(exports.EBK_DEPLOYMENT_ROLE_SECRET)) {
+        blockers.push(`${exports.EBK_DEPLOYMENT_ROLE_SECRET} is exposed from organization scope and would bypass environment protection.`);
+    }
+    for (const variable of exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES) {
+        if (state.repositoryVariableNames.includes(variable)) {
+            blockers.push(`${variable} exists at repository variable scope instead of its protected environment.`);
+        }
+        if (state.orgVariableNames?.includes(variable)) {
+            blockers.push(`${variable} is exposed from organization variable scope instead of its protected environment.`);
+        }
+    }
+    for (const ruleset of state.rulesets) {
+        const conflicts = conflictsWithMergeCommitContract(ruleset);
+        if (conflicts.length > 0) {
+            blockers.push(`Active ruleset ${String(ruleset.name ?? ruleset.id ?? 'unknown')} ${conflicts.join(' and ')}.`);
+        }
+    }
+    if (!state.ownedRuleset) {
+        changes.push(`Create ruleset ${exports.EBK_PROTECTED_BRANCH_RULESET_NAME}.`);
+    }
+    else if (JSON.stringify(normalizeRuleset(state.ownedRuleset)) !==
+        JSON.stringify(normalizeRuleset(desiredRuleset()))) {
+        changes.push(`Update ruleset ${exports.EBK_PROTECTED_BRANCH_RULESET_NAME}.`);
+    }
+    for (const [environment, branch] of Object.entries(ENVIRONMENT_BRANCHES)) {
+        const current = state.environments[environment];
+        if (!current.exists)
+            changes.push(`Create ${environment} environment.`);
+        if (!current.customBranchPolicies) {
+            changes.push(`Enable custom deployment branch policy for ${environment}.`);
+        }
+        const extras = current.branchPolicies.filter((item) => item !== branch);
+        if (extras.length > 0) {
+            blockers.push(`${environment} permits unexpected deployment branches: ${extras.join(', ')}.`);
+        }
+        if (!current.branchPolicies.includes(branch)) {
+            changes.push(`Restrict ${environment} deployment to ${branch}.`);
+        }
+        if (!current.secretNames.includes(exports.EBK_DEPLOYMENT_ROLE_SECRET)) {
+            blockers.push(`${environment} environment is missing ${exports.EBK_DEPLOYMENT_ROLE_SECRET}; bootstrap never creates secret values.`);
+        }
+        const requiredVariables = environment === 'production'
+            ? exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES
+            : exports.EBK_PROTECTED_ENVIRONMENT_VARIABLES.filter((variable) => variable !== 'EBK_ALLOW_PRODUCTION_REMOVE');
+        for (const variable of requiredVariables) {
+            if (!current.variableNames.includes(variable)) {
+                blockers.push(`${environment} environment is missing required variable ${variable}; bootstrap never creates variable values.`);
+            }
+        }
+    }
+    const production = state.environments.production;
+    if (productionApprovalMode === 'promotion-pr') {
+        warnings.push('Production authorization is the required non-author CODEOWNER approval on the develop-to-main promotion pull request; its merge starts deployment without an EBK-managed environment approval.');
+        warnings.push('The promotion approver may also be the human whose merge triggers deployment; rollback uses a reviewed protected revert and redeploy.');
+        warnings.push('A repository write actor who can run Actions may manually dispatch deploy, refresh, or unlock against the approved main tip without another human gate; remove remains separately variable-gated.');
+        if (production.reviewers.length > 0 || production.waitTimer > 0) {
+            warnings.push('Production retains stronger environment protection outside promotion-pr mode; bootstrap preserves it, so merge may wait for that additional gate.');
+        }
+    }
+    else {
+        const requestedProductionReviewers = existingReviewerPayload(productionReviewerIds);
+        const effectiveReviewers = productionReviewerIds.length > 0
+            ? requestedProductionReviewers
+            : production.reviewers;
+        if (effectiveReviewers.length === 0) {
+            blockers.push('Environment-reviewer mode requires at least one existing or explicitly supplied production reviewer ID.');
+        }
+        else {
+            if (productionReviewerIds.length > 0 &&
+                JSON.stringify(requestedProductionReviewers) !==
+                    JSON.stringify(production.reviewers)) {
+                changes.push('Set the explicit production environment reviewers.');
+            }
+            if (!production.preventSelfReview) {
+                changes.push('Enable production environment self-review prevention.');
+            }
+        }
+    }
+    if (state.environments.staging.reviewers.length > 0) {
+        warnings.push('Staging has additional reviewer protection; bootstrap will preserve it.');
+    }
+    return {
+        blockers: [...new Set(blockers)].sort(),
+        changes: [...new Set(changes)].sort(),
+        ready: blockers.length === 0 && changes.length === 0,
+        repository,
+        productionApprovalMode,
+        warnings: [...new Set(warnings)].sort(),
+    };
+}
+function normalizeRuleset(ruleset) {
+    const conditions = typeof ruleset.conditions === 'object' && ruleset.conditions !== null
+        ? ruleset.conditions
+        : {};
+    const refName = typeof conditions.ref_name === 'object' && conditions.ref_name !== null
+        ? conditions.ref_name
+        : {};
+    const rules = rulesetRules(ruleset)
+        .map((rule) => {
+        const type = String(rule.type ?? '');
+        const parameters = ruleParameters(rule);
+        if (type === 'pull_request') {
+            return {
+                parameters: {
+                    allowed_merge_methods: asStrings(parameters.allowed_merge_methods).sort(),
+                    dismiss_stale_reviews_on_push: parameters.dismiss_stale_reviews_on_push === true,
+                    require_code_owner_review: parameters.require_code_owner_review === true,
+                    require_last_push_approval: parameters.require_last_push_approval === true,
+                    required_approving_review_count: parameters.required_approving_review_count,
+                    required_review_thread_resolution: parameters.required_review_thread_resolution === true,
+                },
+                type,
+            };
+        }
+        if (type === 'required_status_checks') {
+            return {
+                parameters: {
+                    required_status_checks: asObjects(parameters.required_status_checks)
+                        .map(({ context }) => ({ context }))
+                        .sort((left, right) => String(left.context).localeCompare(String(right.context))),
+                    strict_required_status_checks_policy: parameters.strict_required_status_checks_policy === true,
+                },
+                type,
+            };
+        }
+        return { type };
+    })
+        .sort((left, right) => String(left.type).localeCompare(String(right.type)));
+    return {
+        bypass_actors: Array.isArray(ruleset.bypass_actors)
+            ? ruleset.bypass_actors
+            : [],
+        conditions: {
+            ref_name: {
+                exclude: asStrings(refName.exclude).sort(),
+                include: asStrings(refName.include).sort(),
+            },
+        },
+        enforcement: ruleset.enforcement,
+        name: ruleset.name,
+        rules,
+        target: ruleset.target,
+    };
+}
+function existingReviewerPayload(ids) {
+    return ids.map((id) => ({ id, type: 'User' }));
+}
+function rulesetMatchesDesired(ruleset) {
+    return (JSON.stringify(normalizeRuleset(ruleset)) ===
+        JSON.stringify(normalizeRuleset(desiredRuleset())));
+}
+async function applyChanges(api, repositoryPath, state, productionApprovalMode, productionReviewerIds) {
+    if (state.repo.allow_merge_commit !== true ||
+        state.repo.allow_rebase_merge !== false ||
+        state.repo.allow_squash_merge !== false) {
+        await api.request('PATCH', repositoryPath, {
+            allow_merge_commit: true,
+            allow_rebase_merge: false,
+            allow_squash_merge: false,
+        });
+    }
+    const desired = desiredRuleset();
+    if (state.ownedRuleset &&
+        typeof state.ownedRuleset.id === 'number' &&
+        !rulesetMatchesDesired(state.ownedRuleset)) {
+        await api.request('PUT', `${repositoryPath}/rulesets/${state.ownedRuleset.id}`, desired);
+    }
+    else if (!state.ownedRuleset) {
+        await api.request('POST', `${repositoryPath}/rulesets`, desired);
+    }
+    for (const [environment, branch] of Object.entries(ENVIRONMENT_BRANCHES)) {
+        const current = state.environments[environment];
+        const reviewers = environment === 'production' &&
+            productionApprovalMode === 'environment-reviewer' &&
+            productionReviewerIds.length > 0
+            ? existingReviewerPayload(productionReviewerIds)
+            : current.reviewers;
+        const desiredPreventSelfReview = environment === 'production' &&
+            productionApprovalMode === 'environment-reviewer'
+            ? true
+            : current.preventSelfReview;
+        const reviewersChanged = JSON.stringify(reviewers) !== JSON.stringify(current.reviewers);
+        if (!current.exists ||
+            !current.customBranchPolicies ||
+            reviewersChanged ||
+            desiredPreventSelfReview !== current.preventSelfReview) {
+            const configureProductionReviewers = environment === 'production' &&
+                productionApprovalMode === 'environment-reviewer';
+            const preserveEnvironmentProtection = configureProductionReviewers ||
+                reviewers.length > 0 ||
+                current.waitTimer > 0;
+            await api.request('PUT', `${repositoryPath}/environments/${encodeURIComponent(environment)}`, {
+                deployment_branch_policy: {
+                    custom_branch_policies: true,
+                    protected_branches: false,
+                },
+                ...(preserveEnvironmentProtection
+                    ? {
+                        prevent_self_review: desiredPreventSelfReview,
+                        reviewers,
+                        wait_timer: current.waitTimer,
+                    }
+                    : {}),
+            });
+        }
+        if (!current.branchPolicies.includes(branch)) {
+            await api.request('POST', `${repositoryPath}/environments/${encodeURIComponent(environment)}/deployment-branch-policies`, { name: branch, type: 'branch' });
+        }
+    }
+}
+async function runGitHubBootstrap(options) {
+    const repository = options.repository.trim();
+    const { owner, repo } = parseRepository(repository);
+    if (!options.token.trim()) {
+        throw new Error('GH_TOKEN or GITHUB_TOKEN is required for GitHub bootstrap.');
+    }
+    if (!index_js_1.PRODUCTION_APPROVAL_MODES.includes(options.productionApprovalMode)) {
+        throw new Error('Production approval mode must be the explicit committed value promotion-pr or environment-reviewer.');
+    }
+    const productionReviewerIds = [
+        ...new Set(options.productionReviewerIds ?? []),
+    ].sort((left, right) => left - right);
+    if (productionReviewerIds.some((id) => !Number.isSafeInteger(id) || id <= 0)) {
+        throw new Error('Production reviewer IDs must be positive integers.');
+    }
+    if (options.productionApprovalMode === 'promotion-pr' &&
+        productionReviewerIds.length > 0) {
+        throw new Error('Production reviewer IDs are valid only when committed policy selects environment-reviewer mode.');
+    }
+    const api = new GitHubApi(options.apiBaseUrl?.trim() || 'https://api.github.com', options.token);
+    const repositoryPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+    const initial = await inspect(api, repositoryPath, options.productionApprovalMode);
+    const report = evaluate(repository, initial.state, initial.blockers, options.productionApprovalMode, productionReviewerIds);
+    if (!options.apply)
+        return report;
+    if (report.blockers.length > 0) {
+        throw new Error(`GitHub bootstrap apply is blocked:\n- ${report.blockers.join('\n- ')}`);
+    }
+    await applyChanges(api, repositoryPath, initial.state, options.productionApprovalMode, productionReviewerIds);
+    const completed = await inspect(api, repositoryPath, options.productionApprovalMode);
+    return evaluate(repository, completed.state, completed.blockers, options.productionApprovalMode, productionReviewerIds);
+}
+//# sourceMappingURL=github-bootstrap.js.map