@goodfellow-cms/github 0.3.0 → 0.5.0

package/dist/testing.d.ts

@@ -20,6 +20,10 @@ export interface FakeGitHubUser {
   actions?: boolean;
   /** Whether the token may run workflows, as owner tokens can. Defaults to the `administration` setting. */
   actionsWrite?: boolean;
+  /** Whether the token may read and change Actions variables, as owner tokens can. Defaults to the `administration` setting. */
+  variables?: boolean;
+  /** Whether the token may set Actions secrets and add deploy keys. Defaults to true. */
+  secrets?: boolean;
 }
 /** A GitHub Actions workflow run, with its jobs and their steps. */
 export interface FakeRun {
@@ -32,6 +36,8 @@ export interface FakeRun {
   createdAt?: string;
   status: "queued" | "in_progress" | "completed";
   conclusion: "success" | "failure" | "startup_failure" | "cancelled" | null;
+  /** The workflow's file, `.github/workflows/deploy.yml` by default. */
+  path?: string;
   jobs: Array<{
     name: string;
     conclusion: string | null;
@@ -70,6 +76,17 @@ export interface FakeGitHubOptions {
    * reports success after being checked this many times. Off by default.
    */
   deployAfterChecks?: number;
+  /**
+   * Simulates Cloudflare Pages: every commit to the default branch gets a
+   * build, which reports success after being checked this many times, as a
+   * check run of Cloudflare's GitHub App, or as a commit status. Off by default.
+   */
+  cloudflare?: {
+    afterChecks: number;
+    report?: "check-runs" | "statuses";
+  };
+  /** Answers 403 to reading check runs, as GitHub does for fine-grained tokens, which can't have the permission. */
+  checkRunsForbidden?: boolean;
   /** Organizations the users belong to, which new repositories can be created in. */
   orgs?: string[];
   /** The default branch of repositories created through the API, as an account's settings choose. Defaults to `main`. */
@@ -84,6 +101,8 @@ export interface FakeGitHubOptions {
   accounts?: string[];
   /** GitHub Apps, which the sign-in worker signs people in with. */
   apps?: FakeGitHubApp[];
+  /** Whether the site's repository is private. Public by default. */
+  private?: boolean;
 }
 /** A GitHub App, as the sign-in worker uses one: its JWTs, installations, OAuth sign-in and tokens. */
 export interface FakeGitHubApp {
@@ -125,8 +144,21 @@ export interface FakeCreatedRepo {
   repo: FakeRepo;
   pages?: {
     build_type: string;
+    cname?: string;
   };
   rulesets: unknown[];
+  /** Deploy keys added to it, by their public key. */
+  deployKeys: Array<{
+    title: string;
+    key: string;
+    read_only: boolean;
+  }>;
+  /** Its Actions secrets, opened. */
+  secrets: Map<string, string>;
+  /** The key pair GitHub seals secrets with. */
+  secretKey?: CryptoKeyPair;
+  /** People's permission on it, by login, as `collaborators/{login}/permission` says; others have none. */
+  collaborators?: Map<string, "admin" | "write" | "read">;
 }
 interface Deployment {
   id: number;
@@ -134,6 +166,11 @@ interface Deployment {
   statuses: FakeDeploymentStatus[];
   checks: number;
 }
+/** A build Cloudflare Pages reports on a commit, which tests can fail with `failCloudflare()`. */
+export interface FakeCloudflareBuild {
+  checks: number;
+  failed?: boolean;
+}
 export declare function fakeGitHub(options: FakeGitHubOptions): {
   repo: FakeRepo;
   /** How many GraphQL requests read files, as `readFiles()` makes. */
@@ -150,8 +187,13 @@ export declare function fakeGitHub(options: FakeGitHubOptions): {
     code: string;
     installation: number;
   };
-  /** Repositories created through the API, by `owner/name`. */
+  /** Repositories created through the API, or added with `addRepo()`, by `owner/name`. */
   created: Map<string, FakeCreatedRepo>;
+  addRepo: (fullName: string, repoOptions?: {
+    files?: Record<string, string>;
+    private?: boolean;
+    collaborators?: Record<string, "admin" | "write" | "read">;
+  }) => FakeCreatedRepo;
   /** The site's GitHub Pages settings, which tests can change, such as to issue the certificate. */
   pages: {
     current?: FakePages;
@@ -161,9 +203,15 @@ export declare function fakeGitHub(options: FakeGitHubOptions): {
   invitations: FakeInvitation[];
   accept: (login: string) => void;
   deployments: Deployment[];
-  /** GitHub Actions workflow runs, which tests add with `failBuild()`. */
+  /** Cloudflare Pages' builds, by commit, with `cloudflare`; `failCloudflare()` makes one fail. */
+  cloudflareBuilds: Map<string, FakeCloudflareBuild>;
+  failCloudflare: (sha: string) => void;
+  /** GitHub Actions workflow runs, which tests add with `failBuild()` and `cancelBuild()`. */
   runs: FakeRun[];
+  /** The repository's Actions variables, such as `GOODFELLOW_NIGHTLY`. */
+  variables: Map<string, string>;
   failBuild: (sha: string, step?: string, job?: string) => FakeRun;
+  cancelBuild: (sha: string) => FakeRun;
   /** Every request received, for checking what the backend sent. */
   requests: Request[];
   /** Simulates someone else publishing. */

package/dist/testing.js

@@ -1,3 +1,4 @@
+import { n as openSealedSecret } from "./deploy-keys-DAj2oX-N.js";
 import { decodeBase64, encodeBase64Bytes } from "@goodfellow-cms/core";
 import { FakeConflictError, FakeRepo, fakeFileBytes, fakeFileFromBytes } from "@goodfellow-cms/core/testing";
 //#region src/testing.ts
@@ -52,7 +53,10 @@ function fakeGitHub(options) {
 	let nextToken = 1;
 	let nextRepoId = 100;
 	const deployments = [];
+	const cloudflareBuilds = /* @__PURE__ */ new Map();
 	const runs = [];
+	/** The repository's Actions variables, by name. */
+	const variables = /* @__PURE__ */ new Map();
 	const requests = [];
 	let nextDeployment = 1;
 	let graphqlReads = 0;
@@ -186,12 +190,44 @@ function fakeGitHub(options) {
 		runs.push(run);
 		return run;
 	}
+	/**
+	* Simulates the deploy workflow's run for a commit being cancelled, as a
+	* newer run in its concurrency group replaces one still waiting: it never
+	* deploys.
+	*/
+	function cancelBuild(sha) {
+		for (const [index, deployment] of [...deployments.entries()].reverse()) if (deployment.sha === sha) deployments.splice(index, 1);
+		const run = {
+			id: runs.length + 1,
+			sha,
+			status: "completed",
+			conclusion: "cancelled",
+			jobs: []
+		};
+		runs.push(run);
+		return run;
+	}
 	/** Simulates an invited person accepting the invitation. */
 	function accept(login) {
 		const index = invitations.findIndex((invitation) => invitation.login === login);
 		const [invitation] = index === -1 ? [] : invitations.splice(index, 1);
 		if (invitation) collaborators.set(login, invitation.permission === "admin" ? "admin" : "push");
 	}
+	/** Adds another repository, as if someone had made it, such as a site's code repository beside its content's. */
+	function addRepo(fullName, repoOptions = {}) {
+		const added = {
+			id: nextRepoId++,
+			fullName,
+			private: repoOptions.private === true,
+			repo: new FakeRepo(repoOptions.files ?? {}, "main"),
+			rulesets: [],
+			deployKeys: [],
+			secrets: /* @__PURE__ */ new Map(),
+			collaborators: new Map(Object.entries(repoOptions.collaborators ?? {}))
+		};
+		created.set(fullName, added);
+		return added;
+	}
 	/** Repository creation and the Git data API, for repositories created through the fake. */
 	async function handleCreated(request, path, principal) {
 		const login = principal.login;
@@ -215,7 +251,9 @@ function fakeGitHub(options) {
 				private: body.private === true,
 				description: body.description,
 				repo,
-				rulesets: []
+				rulesets: [],
+				deployKeys: [],
+				secrets: /* @__PURE__ */ new Map()
 			});
 			return json({
 				id,
@@ -234,12 +272,48 @@ function fakeGitHub(options) {
 		if (rest === "" && method === "GET") return json({
 			id: site.id,
 			full_name: site.fullName,
+			private: site.private,
 			default_branch: repo.defaultBranch,
 			permissions: {
 				push: true,
 				admin: true
 			}
 		});
+		const tree = rest.match(/^\/git\/trees\/([0-9a-f]{40})$/);
+		if (tree && method === "GET" && repo.commitAt(tree[1] ?? "")) {
+			const entries = [...repo.files(tree[1] ?? "")].map(([file, content]) => ({
+				path: file,
+				type: "blob",
+				sha: repo.blobSha(content),
+				size: fakeFileBytes(content).length
+			}));
+			return json({
+				sha: tree[1],
+				tree: entries,
+				truncated: false
+			});
+		}
+		const blob = rest.match(/^\/git\/blobs\/([0-9a-f]{40})$/);
+		if (blob && method === "GET") {
+			const content = repo.blobs.get(blob[1] ?? "");
+			if (content === void 0) return json({ message: "Not Found" }, 404);
+			return new Response(fakeFileBytes(content));
+		}
+		const contents = rest.match(/^\/contents\/(.+)$/);
+		if (contents && method === "GET") {
+			if (principal.app && !principal.permissions?.contents) return json({ message: "Resource not accessible" }, 403);
+			const file = repo.files().get(decodeURIComponent(contents[1] ?? ""));
+			if (file === void 0) return json({ message: "Not Found" }, 404);
+			return new Response(typeof file === "string" ? file : fakeFileBytes(file));
+		}
+		const permission = rest.match(/^\/collaborators\/([^/]+)\/permission$/);
+		if (permission && method === "GET") {
+			const login = decodeURIComponent(permission[1] ?? "");
+			return json({
+				permission: site.collaborators?.get(login) ?? "none",
+				user: { login }
+			});
+		}
 		if (rest === "" && method === "PATCH") {
 			const body = await request.json();
 			if (body.default_branch) {
@@ -279,6 +353,48 @@ function fakeGitHub(options) {
 				build_type: site.pages.build_type
 			}, 201);
 		}
+		if (rest === "/pages" && method === "PUT" && site.pages) {
+			const body = await request.json();
+			if (body.cname && options.takenDomains?.includes(body.cname)) return json({ message: `The CNAME \`${body.cname}\` is already taken.` }, 422);
+			if (body.cname) site.pages.cname = body.cname;
+			return new Response(null, { status: 204 });
+		}
+		const notAllowed = (permission) => principal.app ? principal.permissions?.[permission] !== "write" : principal.secrets === false;
+		if (rest === "/keys" && method === "POST") {
+			if (notAllowed("administration")) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!/^ssh-ed25519 [A-Za-z0-9+/=]+( |$)/.test(body.key)) return json({ message: "key is invalid" }, 422);
+			site.deployKeys.push({
+				title: body.title,
+				key: body.key,
+				read_only: body.read_only === true
+			});
+			return json({
+				id: site.deployKeys.length,
+				...body
+			}, 201);
+		}
+		if (rest === "/actions/secrets/public-key" && method === "GET") {
+			if (notAllowed("secrets")) return json({ message: "Resource not accessible by integration" }, 403);
+			site.secretKey ??= await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]);
+			const raw = new Uint8Array(await crypto.subtle.exportKey("raw", site.secretKey.publicKey));
+			return json({
+				key_id: `key-${site.id}`,
+				key: encodeBase64Bytes(raw)
+			});
+		}
+		const secret = rest.match(/^\/actions\/secrets\/([A-Z0-9_]+)$/);
+		if (secret && method === "PUT") {
+			if (notAllowed("secrets")) return json({ message: "Resource not accessible by integration" }, 403);
+			const body = await request.json();
+			if (!site.secretKey || body.key_id !== `key-${site.id}`) return json({ message: "Bad key id" }, 422);
+			try {
+				site.secrets.set(secret[1] ?? "", await openSealedSecret(decodeBase64(body.encrypted_value), site.secretKey));
+			} catch {
+				return json({ message: "Bad encrypted value" }, 422);
+			}
+			return new Response(null, { status: 201 });
+		}
 		if (rest === "/rulesets" && method === "POST") {
 			if (site.private && !options.paidPlan) return json({ message: "Upgrade to GitHub Pro" }, 403);
 			site.rulesets.push(await request.json());
@@ -357,6 +473,7 @@ function fakeGitHub(options) {
 		}
 	}
 	function deploy(sha) {
+		if (options.cloudflare) cloudflareBuilds.set(sha, { checks: 0 });
 		if (options.deployAfterChecks === void 0) return;
 		deployments.unshift({
 			id: nextDeployment++,
@@ -365,6 +482,20 @@ function fakeGitHub(options) {
 			checks: 0
 		});
 	}
+	/** Where a Cloudflare build is up to, counting the check. */
+	function cloudflareState(sha) {
+		const build = cloudflareBuilds.get(sha);
+		if (!build) return void 0;
+		build.checks += 1;
+		if (build.failed) return "failure";
+		return build.checks > (options.cloudflare?.afterChecks ?? 0) ? "success" : "building";
+	}
+	function failCloudflare(sha) {
+		cloudflareBuilds.set(sha, {
+			checks: 0,
+			failed: true
+		});
+	}
 	function commit(changes, message, expectedHead, author, branch = repo.defaultBranch) {
 		const sha = repo.commit(changes, message, {
 			expectedHead,
@@ -427,7 +558,8 @@ function fakeGitHub(options) {
 			pages: app.permissions.pages === "write",
 			workflow: app.permissions.workflows === "write",
 			actions: app.permissions.actions !== void 0,
-			actionsWrite: app.permissions.actions === "write"
+			actionsWrite: app.permissions.actions === "write",
+			variables: app.permissions.variables === "write"
 		});
 		refreshTokens.set(refresh, {
 			app,
@@ -535,7 +667,8 @@ function fakeGitHub(options) {
 				administration: permissions.administration === "write",
 				admin: permissions.administration === "write",
 				actions: permissions.actions !== void 0,
-				actionsWrite: permissions.actions === "write"
+				actionsWrite: permissions.actions === "write",
+				variables: permissions.variables === "write"
 			});
 			issued.push({
 				token,
@@ -699,6 +832,17 @@ function fakeGitHub(options) {
 				object: { sha: body.sha }
 			}, 201);
 		}
+		const matching = rest.match(/^\/git\/matching-refs\/heads\/(.*)$/);
+		if (matching) {
+			const prefix = decodeURIComponent(matching[1] ?? "");
+			return json([...repo.branches].filter(([branch]) => branch.startsWith(prefix)).map(([branch, sha]) => ({
+				ref: `refs/heads/${branch}`,
+				object: {
+					sha,
+					type: "commit"
+				}
+			})));
+		}
 		const branchRef = rest.match(/^\/git\/refs\/heads\/(.+)$/);
 		if (branchRef && request.method === "DELETE") {
 			if (user.push === false) return json({ message: "Resource not accessible by integration" }, 403);
@@ -756,6 +900,8 @@ function fakeGitHub(options) {
 		if (rest === "") return json({
 			id: 1,
 			full_name: options.repo,
+			private: options.private === true,
+			visibility: options.private === true ? "private" : "public",
 			default_branch: repo.defaultBranch,
 			permissions: {
 				push: user.push !== false,
@@ -814,7 +960,35 @@ function fakeGitHub(options) {
 				author: null
 			})));
 		}
-		if (rest === "/actions/workflows/deploy.yml/dispatches" && request.method === "POST") {
+		const variable = rest.match(/^\/actions\/variables(?:\/([\w-]+))?$/);
+		if (variable) {
+			if (!(user.variables ?? user.administration)) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const [, name] = variable;
+			if (!name && request.method === "POST") {
+				const body = await request.json();
+				if (variables.has(body.name)) return json({ message: "Already exists" }, 409);
+				variables.set(body.name, body.value);
+				return new Response(null, { status: 201 });
+			}
+			if (name && !variables.has(name)) return json({ message: "Not Found" }, 404);
+			if (name && request.method === "GET") return json({
+				name,
+				value: variables.get(name)
+			});
+			if (name && request.method === "PATCH") {
+				const body = await request.json();
+				variables.set(name, body.value);
+				return new Response(null, { status: 204 });
+			}
+			if (name && request.method === "DELETE") {
+				variables.delete(name);
+				return new Response(null, { status: 204 });
+			}
+		}
+		const workflowFile = rest.match(/^\/actions\/workflows\/([\w.-]+)\/(?:dispatches|runs)$/)?.[1];
+		const workflowPath = `.github/workflows/${workflowFile}`;
+		const ofWorkflow = (run) => (run.path ?? ".github/workflows/deploy.yml") === workflowPath;
+		if (workflowFile && rest.endsWith("/dispatches") && request.method === "POST") {
 			if (!(user.actionsWrite ?? user.administration)) return json({ message: "Resource not accessible by personal access token" }, 403);
 			const body = await request.json();
 			runs.push({
@@ -824,15 +998,17 @@ function fakeGitHub(options) {
 				inputs: body.inputs,
 				status: "queued",
 				conclusion: null,
+				path: workflowPath,
 				jobs: []
 			});
 			return new Response(null, { status: 204 });
 		}
-		if (rest === "/actions/workflows/deploy.yml/runs") {
+		if (workflowFile && rest.endsWith("/runs")) {
 			if (user.actions === false) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const found = runs.filter(ofWorkflow);
 			return json({
-				total_count: runs.length,
-				workflow_runs: [...runs].reverse().map((run) => ({
+				total_count: found.length,
+				workflow_runs: [...found].reverse().map((run) => ({
 					id: run.id,
 					event: run.event ?? "push",
 					head_sha: run.sha,
@@ -856,8 +1032,8 @@ function fakeGitHub(options) {
 						head_sha: run.sha,
 						status: run.status,
 						conclusion: run.conclusion,
-						name: "Deploy to GitHub Pages",
-						path: ".github/workflows/deploy.yml",
+						name: run.path ? "Rebuild on Vercel" : "Deploy to GitHub Pages",
+						path: run.path ?? ".github/workflows/deploy.yml",
 						html_url: htmlUrl(run)
 					}))
 				});
@@ -881,6 +1057,43 @@ function fakeGitHub(options) {
 				files: repo.changedPaths(base, b).map((filename) => ({ filename }))
 			});
 		}
+		const commitSha = rest.match(/^\/commits\/([0-9a-f]{40})$/)?.[1];
+		if (commitSha) {
+			const found = repo.commitAt(commitSha);
+			if (!found) return json({ message: "No commit found for SHA" }, 422);
+			return json({
+				sha: commitSha,
+				parents: found.parent ? [{ sha: found.parent }] : []
+			});
+		}
+		const checkRunsSha = rest.match(/^\/commits\/([0-9a-f]{40})\/check-runs$/)?.[1];
+		if (checkRunsSha) {
+			if (options.checkRunsForbidden) return json({ message: "Resource not accessible by personal access token" }, 403);
+			const state = options.cloudflare?.report === "statuses" ? void 0 : cloudflareState(checkRunsSha);
+			const runsFound = state ? [{
+				id: 1,
+				name: "Cloudflare Pages",
+				app: { slug: "cloudflare-workers-and-pages" },
+				status: state === "building" ? "in_progress" : "completed",
+				conclusion: state === "building" ? null : state,
+				details_url: `https://dash.cloudflare.com/builds/${checkRunsSha}`,
+				output: { title: state === "failure" ? "Build failed" : "Deployed" }
+			}] : [];
+			return json({
+				total_count: runsFound.length,
+				check_runs: runsFound
+			});
+		}
+		const statusesSha = rest.match(/^\/commits\/([0-9a-f]{40})\/statuses$/)?.[1];
+		if (statusesSha) {
+			const state = options.cloudflare?.report === "statuses" ? cloudflareState(statusesSha) : void 0;
+			return json(state ? [{
+				context: "Cloudflare Pages",
+				state: state === "building" ? "pending" : state,
+				target_url: `https://dash.cloudflare.com/builds/${statusesSha}`,
+				description: state === "failure" ? "Build failed" : "Deployed"
+			}] : []);
+		}
 		if (rest === "/deployments") {
 			const sha = url.searchParams.get("sha");
 			return json(deployments.filter((deployment) => !sha || deployment.sha === sha).slice(0, Number(url.searchParams.get("per_page") ?? 30)).map(({ id, sha }) => ({
@@ -913,8 +1126,9 @@ function fakeGitHub(options) {
 		commitAuthors,
 		authorize,
 		install,
-		/** Repositories created through the API, by `owner/name`. */
+		/** Repositories created through the API, or added with `addRepo()`, by `owner/name`. */
 		created,
+		addRepo,
 		/** The site's GitHub Pages settings, which tests can change, such as to issue the certificate. */
 		pages,
 		/** The repository's collaborators, by login, and invitations waiting to be accepted. */
@@ -922,9 +1136,15 @@ function fakeGitHub(options) {
 		invitations,
 		accept,
 		deployments,
-		/** GitHub Actions workflow runs, which tests add with `failBuild()`. */
+		/** Cloudflare Pages' builds, by commit, with `cloudflare`; `failCloudflare()` makes one fail. */
+		cloudflareBuilds,
+		failCloudflare,
+		/** GitHub Actions workflow runs, which tests add with `failBuild()` and `cancelBuild()`. */
 		runs,
+		/** The repository's Actions variables, such as `GOODFELLOW_NIGHTLY`. */
+		variables,
 		failBuild,
+		cancelBuild,
 		/** Every request received, for checking what the backend sent. */
 		requests,
 		/** Simulates someone else publishing. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodfellow-cms/github",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Edit a Goodfellow site stored on GitHub, straight from the browser.",
   "keywords": [
     "goodfellow",
@@ -35,13 +35,15 @@
     "dist"
   ],
   "dependencies": {
-    "@goodfellow-cms/core": "0.3.0"
+    "@goodfellow-cms/core": "0.5.0",
+    "@noble/ciphers": "2.4.0",
+    "@noble/hashes": "2.4.0"
   },
   "devDependencies": {
     "@puckeditor/core": "0.23.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "publishConfig": {
     "access": "public"