@homeflare/alchemy 0.27.4 → 0.29.0

package/dist/github/index.js

@@ -208,6 +208,18 @@ class BypassActorWidened extends Data.TaggedError("BypassActorWidened") {
   }
 }
 
+class BypassActorNarrowed extends Data.TaggedError("BypassActorNarrowed") {
+  get message() {
+    return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the ` + `declaration drops a bypass actor the live ruleset has (${this.narrowed.join(", ")}), and ` + "the declaration carries no `acknowledgeBypassNarrowing`. Add one with a reason once the " + "removal is deliberate, or restore the actor to match live.";
+  }
+}
+
+class RuleNarrowed extends Data.TaggedError("RuleNarrowed") {
+  get message() {
+    return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the ` + `declaration drops a live "${this.ruleType}" rule, and carries no ` + "`acknowledgeRuleNarrowing`. Add one with a reason once the removal is deliberate, or " + "declare the rule to match live.";
+  }
+}
+
 class UndeclaredLiveRule extends Data.TaggedError("UndeclaredLiveRule") {
   get message() {
     return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the live ` + `ruleset has a "${this.ruleType}" rule this resource does not model. Declare it (if it is ` + "now modeled) or an explicit `false` to remove it — the PUT replaces `rules` wholesale, so " + "nothing may be dropped silently.";
@@ -222,7 +234,7 @@ class RequiredChecksOmitted extends Data.TaggedError("RequiredChecksOmitted") {
 
 class NeverReportedContext extends Data.TaggedError("NeverReportedContext") {
   get message() {
-    return `GitHub.RepositoryRuleset: "${this.context}" has never reported success on ` + `${this.owner}/${this.repository}'s default branch. Requiring it now would leave every ` + "pull request waiting on a check that has never once reported — refused before any write.";
+    return `GitHub.RepositoryRuleset: "${this.context}" has never reported success on ` + `${this.owner}/${this.repository}'s default branch tip or any of its recent merged pull ` + "requests. Requiring it now would leave every pull request waiting on a check that has " + "never once reported — refused before any write.";
   }
 }
 
@@ -247,6 +259,53 @@ var octokitFor = (baseUrl) => Effect.gen(function* () {
   return baseUrl === undefined ? creds.octokit() : creds.octokit({ baseUrl });
 }).pipe(Effect.mapError(asError));
 var is404 = (e) => e?.status === 404;
+var RECENT_MERGED_PR_LIMIT = 10;
+var RECENT_CLOSED_PR_PAGE_SIZE = 100;
+var hasRefReportedSuccess = (octokit, owner, repo, ref, context) => Effect.gen(function* () {
+  const [checkRuns, statuses] = yield* Effect.all([
+    Effect.tryPromise({
+      try: () => octokit.rest.checks.listForRef({ owner, repo, ref, check_name: context }),
+      catch: asError
+    }),
+    Effect.tryPromise({
+      try: () => octokit.rest.repos.listCommitStatusesForRef({ owner, repo, ref }),
+      catch: asError
+    })
+  ]);
+  const checkReported = checkRuns.data.check_runs.some((run) => run.name === context && run.conclusion === "success");
+  const statusReported = statuses.data.some((status) => status.context === context && status.state === "success");
+  return checkReported || statusReported;
+});
+var recentMergedHeadShas = (octokit, owner, repo, base) => Effect.gen(function* () {
+  const closed = yield* Effect.tryPromise({
+    try: () => octokit.rest.pulls.list({
+      owner,
+      repo,
+      state: "closed",
+      base,
+      sort: "updated",
+      direction: "desc",
+      per_page: RECENT_CLOSED_PR_PAGE_SIZE
+    }),
+    catch: asError
+  });
+  return closed.data.filter((pr) => pr.merged_at !== null).slice(0, RECENT_MERGED_PR_LIMIT).map((pr) => pr.head.sha);
+});
+var contextReportedSuccess = (octokit, owner, repo, context) => Effect.gen(function* () {
+  const repository = yield* Effect.tryPromise({
+    try: () => octokit.rest.repos.get({ owner, repo }),
+    catch: asError
+  });
+  const ref = repository.data.default_branch;
+  if (yield* hasRefReportedSuccess(octokit, owner, repo, ref, context))
+    return true;
+  const heads = yield* recentMergedHeadShas(octokit, owner, repo, ref);
+  for (const sha of heads) {
+    if (yield* hasRefReportedSuccess(octokit, owner, repo, sha, context))
+      return true;
+  }
+  return false;
+});
 var makeRulesetOctokit = (baseUrl) => ({
   list: ({ owner, repo }) => Effect.gen(function* () {
     const octokit = yield* octokitFor(baseUrl);
@@ -302,24 +361,7 @@ var makeRulesetOctokit = (baseUrl) => ({
   }),
   hasContextReportedSuccess: ({ owner, repo, context }) => Effect.gen(function* () {
     const octokit = yield* octokitFor(baseUrl);
-    const repository = yield* Effect.tryPromise({
-      try: () => octokit.rest.repos.get({ owner, repo }),
-      catch: asError
-    });
-    const ref = repository.data.default_branch;
-    const [checkRuns, statuses] = yield* Effect.all([
-      Effect.tryPromise({
-        try: () => octokit.rest.checks.listForRef({ owner, repo, ref, check_name: context }),
-        catch: asError
-      }),
-      Effect.tryPromise({
-        try: () => octokit.rest.repos.listCommitStatusesForRef({ owner, repo, ref }),
-        catch: asError
-      })
-    ]);
-    const checkReported = checkRuns.data.check_runs.some((run) => run.name === context && run.conclusion === "success");
-    const statusReported = statuses.data.some((status) => status.context === context && status.state === "success");
-    return checkReported || statusReported;
+    return yield* contextReportedSuccess(octokit, owner, repo, context);
   })
 });
 
@@ -371,7 +413,9 @@ function buildPullRequestRule(rule) {
         minimum_approvals: r.minimumApprovals,
         reviewer: { id: r.reviewer.actorId, type: r.reviewer.actorType }
       })),
-      ...rule.extraApprovalForUnattributedChanges === undefined ? {} : { require_extra_approval_for_unattributed_changes: false }
+      ...rule.extraApprovalForUnattributedChanges === undefined ? {} : {
+        require_extra_approval_for_unattributed_changes: rule.extraApprovalForUnattributedChanges
+      }
     }
   };
 }
@@ -587,6 +631,65 @@ var refuseUnreportedContexts = (octokit, owner, repo, contexts) => Effect3.gen(f
   }
 });
 
+// src/github/repository-ruleset-narrowing-guards.ts
+var isBypassNarrowingAcknowledged = (props) => props.acknowledgeBypassNarrowing !== undefined && props.acknowledgeBypassNarrowing.reason.trim().length > 0;
+var isRuleNarrowingAcknowledged = (props) => props.acknowledgeRuleNarrowing !== undefined && props.acknowledgeRuleNarrowing.reason.trim().length > 0;
+function bypassNarrowingRefusal(input) {
+  if (input.acknowledged)
+    return;
+  if (input.live === undefined)
+    return;
+  const liveActors = input.live.bypass_actors ?? [];
+  const declaredKeys = new Set((input.declared ?? []).map((a) => bypassKey({
+    actor_type: a.actorType,
+    actor_id: a.actorId,
+    bypass_mode: a.bypassMode ?? "always"
+  })));
+  const narrowed = liveActors.map(bypassKey).filter((k) => !declaredKeys.has(k));
+  if (narrowed.length === 0)
+    return;
+  return new BypassActorNarrowed({
+    owner: input.owner,
+    repository: input.repository,
+    name: input.name,
+    narrowed
+  });
+}
+function droppedBooleanOrPullRequestType(rules, live) {
+  const declaredFalse = [
+    [rules.creation, "creation"],
+    [rules.update, "update"],
+    [rules.deletion, "deletion"],
+    [rules.requiredLinearHistory, "required_linear_history"],
+    [rules.requiredSignatures, "required_signatures"],
+    [rules.nonFastForward, "non_fast_forward"]
+  ];
+  for (const [declared, type] of declaredFalse) {
+    if (declared === false && live.has(type))
+      return type;
+  }
+  if (rules.pullRequest === false && live.has("pull_request"))
+    return "pull_request";
+  return;
+}
+function ruleNarrowingRefusal(input) {
+  if (input.acknowledged)
+    return;
+  const rules = input.declared;
+  if (rules === undefined)
+    return;
+  const live = liveRuleTypes(input.live);
+  const ruleType = droppedBooleanOrPullRequestType(rules, live) ?? (rules.requiredStatusChecks === false && live.has("required_status_checks") ? "required_status_checks" : undefined);
+  if (ruleType === undefined)
+    return;
+  return new RuleNarrowed({
+    owner: input.owner,
+    repository: input.repository,
+    name: input.name,
+    ruleType
+  });
+}
+
 // src/github/repository-ruleset-reconcile.ts
 var guardedPullRequestFields = (rule) => {
   const params = rule?.parameters ?? {};
@@ -631,6 +734,8 @@ var reconcileRuleset = (input) => Effect4.gen(function* () {
   if (observed === undefined) {
     observed = yield* probeByName(octokit, { owner, repo, name: news.name, target });
   }
+  const bypassAcknowledged = isBypassNarrowingAcknowledged(news);
+  const ruleAcknowledged = isRuleNarrowingAcknowledged(news);
   const bypassRefusal = news.bypassActors === undefined ? undefined : bypassWideningRefusal({
     owner,
     repository: repo,
@@ -640,6 +745,16 @@ var reconcileRuleset = (input) => Effect4.gen(function* () {
   });
   if (bypassRefusal !== undefined)
     return yield* Effect4.fail(bypassRefusal);
+  const bypassNarrowRefusal = news.bypassActors === undefined ? undefined : bypassNarrowingRefusal({
+    owner,
+    repository: repo,
+    name: news.name,
+    declared: news.bypassActors,
+    live: observed,
+    acknowledged: bypassAcknowledged
+  });
+  if (bypassNarrowRefusal !== undefined)
+    return yield* Effect4.fail(bypassNarrowRefusal);
   const ruleRefusal = undeclaredLiveRuleRefusal({
     owner,
     repository: repo,
@@ -649,6 +764,16 @@ var reconcileRuleset = (input) => Effect4.gen(function* () {
   });
   if (ruleRefusal !== undefined)
     return yield* Effect4.fail(ruleRefusal);
+  const ruleNarrowRefusal = ruleNarrowingRefusal({
+    owner,
+    repository: repo,
+    name: news.name,
+    declared: news.rules,
+    live: observed,
+    acknowledged: ruleAcknowledged
+  });
+  if (ruleNarrowRefusal !== undefined)
+    return yield* Effect4.fail(ruleNarrowRefusal);
   const checksRefusal = requiredChecksOmissionRefusal({
     owner,
     repository: repo,
@@ -700,7 +825,8 @@ var attrsOf = (r) => ({
   updatedAt: r.updated_at
 });
 function constraintRefusal(props) {
-  const approvals = props.rules?.pullRequest?.requiredApprovingReviewCount;
+  const pr = props.rules?.pullRequest === false ? undefined : props.rules?.pullRequest;
+  const approvals = pr?.requiredApprovingReviewCount;
   if (approvals !== undefined) {
     const reason = approvalCountRefusal(approvals);
     if (reason !== undefined) {
@@ -710,7 +836,7 @@ function constraintRefusal(props) {
       });
     }
   }
-  const methods = props.rules?.pullRequest?.allowedMergeMethods;
+  const methods = pr?.allowedMergeMethods;
   if (methods !== undefined) {
     const reason = allowedMergeMethodsRefusal(methods);
     if (reason !== undefined) {
@@ -796,7 +922,7 @@ function repoBaselineSettings(input) {
     allowSquashMerge: true,
     allowMergeCommit: false,
     allowRebaseMerge: false,
-    allowAutoMerge: true,
+    allowAutoMerge: input.checks.length > 0,
     deleteBranchOnMerge: true,
     hasWiki: false
   };
@@ -849,7 +975,15 @@ var declareRepoBaseline = (id, options) => Effect7.gen(function* () {
   const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)));
   return { repository, ruleset };
 });
+// src/github/repository-ruleset-providers.ts
+import * as GitHub3 from "alchemy/GitHub";
+import * as Layer from "effect/Layer";
+var repoPolicyProviders = (options) => {
+  const github = GitHub3.providers(options);
+  return Layer.mergeAll(github, RepositoryRulesetProvider().pipe(Layer.provideMerge(github)));
+};
 export {
+  BypassActorNarrowed,
   BypassActorWidened,
   DuplicateRuleset,
   NeverReportedContext,
@@ -859,14 +993,16 @@ export {
   RepositoryRuleset,
   RepositoryRulesetProvider,
   RequiredChecksOmitted,
+  RuleNarrowed,
   RulesetConstraintRefused,
   UndeclaredLiveRule,
   declareRepoBaseline,
   declareRepoPolicy,
   repoBaselineRuleset,
   repoBaselineSettings,
-  repoPolicy
+  repoPolicy,
+  repoPolicyProviders
 };
 
-//# debugId=45989F9C0ABF077664756E2164756E21
+//# debugId=4642631C8C22EC1064756E2164756E21
 //# sourceMappingURL=index.js.map