@impeccable/reviews 0.1.0 → 0.1.2

package/dist/cloudflare.js

@@ -0,0 +1,291 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { commandRunner } from './netlify.js';
+import { ownFolder } from './sandbox.js';
+/**
+ * Cloudflare Pages: the preview deployments this repository's pull requests
+ * get, from GitHub's record and from cf, Cloudflare's CLI, on this machine
+ * when it is signed in (read only), and whether cf is signed in. Cloudflare's
+ * GitHub app records no deployment and no commit status: its record is a
+ * check run on each commit it built and a comment on the pull request, both
+ * naming the deployment's address (https://<id>.<project>.pages.dev) and the
+ * branch's alias (https://<branch>.<project>.pages.dev), which follows the
+ * branch's latest build. Nothing here reads a token, and nothing comes back
+ * beyond the fields below.
+ */
+/** How many pull requests, the most recently updated, the evidence reads. */
+const NEWEST = 10;
+const LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+/** A Pages deployment's address, or a branch's alias: one label, then the project, under pages.dev. */
+export const PAGES_ADDRESS = new RegExp(`^https://(${LABEL})\\.(${LABEL})\\.pages\\.dev$`);
+const LINKS = new RegExp(`https://${LABEL}\\.${LABEL}\\.pages\\.dev`, 'g');
+/** Cloudflare's GitHub app, by the slug its check runs carry and the login its comments carry; the earlier Pages-only app posted the same. */
+const APPS = new Set(['cloudflare-workers-and-pages', 'cloudflare-pages']);
+const isApp = (login) => typeof login === 'string' && APPS.has(login.replace(/\[bot\]$/, ''));
+const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
+const positive = (value) => typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+const list = (value) => (Array.isArray(value) ? value.map(record).filter((item) => item !== undefined) : []);
+const sha = (value) => typeof value === 'string' && /^[0-9a-f]{40}$/.test(value);
+/** A branch name GitHub can be asked about: the characters git allows, no `..`, and neither a slash nor a dot at the end. */
+const branchName = (value) => /^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(value) && !value.includes('..') && !value.endsWith('/') && !value.endsWith('.');
+/** A branch, as GitHub names it in a check run's summary or cf in a deployment: git's characters, and not too long to be one. */
+const branchOf = (value) => (typeof value === 'string' && branchName(value) ? value : undefined);
+/** The project a Pages address belongs to; null for any other address. */
+export function pagesProject(url) {
+    return PAGES_ADDRESS.exec(url)?.[2] ?? null;
+}
+/** The deployment's address and the branch's alias, as the app's table names them, else the first two Pages links in order; a page mentions each once. */
+function addresses(html) {
+    const row = (label) => new RegExp(`${label}:</strong>[\\s\\S]{0,200}?href='(https://[^']+)'`).exec(html)?.[1];
+    const fits = (value) => (value && PAGES_ADDRESS.test(value) ? value : undefined);
+    const links = [...new Set(html.match(LINKS) ?? [])];
+    return { url: fits(row('Preview URL')) ?? links[0], alias: fits(row('Branch Preview URL')) ?? (links[1] !== links[0] ? links[1] : undefined) };
+}
+/** What a check run's conclusion, or the words the app's table says, tell of the build. */
+const stateOf = (value) => (typeof value !== 'string' ? 'building' : /succe/i.test(value) ? 'success' : /fail|timed_out|error/i.test(value) ? 'failure' : /cancel/i.test(value) ? 'canceled' : 'building');
+/**
+ * GitHub's record: the Cloudflare check run on each head (or, with `only`, that pull request's; with `branch`, the
+ * pushed branch's head alone, before its pull request exists), and the app's comment on each pull request when it
+ * describes the head. `failed` when a read did not answer.
+ */
+async function fromGitHub(owner, repo, gh, only, branch) {
+    const base = `/repos/${owner}/${repo}`;
+    const get = async (route) => JSON.parse(await gh(['api', '--hostname', 'github.com', '--method', 'GET', route]));
+    let failed = false;
+    const read = async (what, none) => what.catch(() => ((failed = true), none));
+    const when = (value) => (typeof value === 'string' && Number.isFinite(Date.parse(value)) ? Date.parse(value) : 0);
+    const heads = [];
+    if (branch !== undefined) {
+        const ref = record(await read(get(`${base}/branches/${encodeURIComponent(branch)}`), null));
+        const head = record(ref?.commit)?.sha;
+        if (ref?.name === branch && sha(head))
+            heads.push({ branch, sha: head, at: 0 });
+    }
+    else {
+        const pulls = await read(only ? get(`${base}/pulls/${only}`).then((one) => [one]) : get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${NEWEST}`), []);
+        for (const pull of list(pulls)) {
+            const head = record(pull.head);
+            if (positive(pull.number) && (!only || pull.number === only) && sha(head?.sha))
+                heads.push({ number: pull.number, branch: branchOf(head?.ref), sha: head.sha, at: when(pull.updated_at) });
+        }
+    }
+    const found = [];
+    // Cloudflare posts its check run once the build ended, so a head with none is still building, or was never built.
+    const runs = await Promise.all(heads.map((head) => read(get(`${base}/commits/${head.sha}/check-runs?per_page=100`), null)));
+    runs.forEach((result, i) => {
+        const head = heads[i];
+        for (const run of list(record(result)?.check_runs)) {
+            if (!isApp(record(run.app)?.slug))
+                continue;
+            const { url, alias } = addresses(String(record(run.output)?.summary ?? ''));
+            if (!url)
+                continue;
+            found.push({ ...(head.number ? { pullRequest: head.number } : {}), ...(head.branch ? { branch: head.branch } : {}), sha: head.sha, url, ...(alias ? { alias } : {}), state: run.status === 'completed' ? stateOf(run.conclusion) : 'building', from: 'check run', at: when(run.completed_at) || head.at });
+            break;
+        }
+    });
+    if (branch === undefined) {
+        const comments = await read(get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`), []);
+        for (const comment of list(comments)) {
+            const issue = typeof comment.issue_url === 'string' ? Number(/\/issues\/([1-9]\d*)$/.exec(comment.issue_url)?.[1]) : NaN;
+            const head = heads.find((h) => h.number === issue);
+            if (!head || !isApp(record(comment.user)?.login) || typeof comment.body !== 'string')
+                continue;
+            // The app edits its one comment as the pull request moves on: it describes the head when the commit it names is the head's.
+            const commit = /Latest commit:<\/strong>[\s\S]{0,80}?<code>([0-9a-f]{7,40})<\/code>/.exec(comment.body)?.[1];
+            if (!commit || !head.sha.startsWith(commit))
+                continue;
+            const { url, alias } = addresses(comment.body);
+            if (!url || found.some((p) => p.pullRequest === issue && p.url === url))
+                continue;
+            found.push({ pullRequest: issue, ...(head.branch ? { branch: head.branch } : {}), sha: head.sha, url, ...(alias ? { alias } : {}), state: stateOf(/Status:<\/strong>[\s\S]{0,120}?<\/td>/.exec(comment.body)?.[0]), from: 'bot comment', at: when(comment.updated_at) || head.at });
+        }
+    }
+    return { previews: found, heads, failed };
+}
+/** The Pages project the checkout's wrangler config names: only a config with a Pages output directory is a Pages project's, since a Worker's config names a Worker. */
+export async function configuredProject(cwd) {
+    const name = (value) => (typeof value === 'string' && new RegExp(`^${LABEL}$`).test(value) ? value : undefined);
+    try {
+        const toml = await readFile(join(cwd, 'wrangler.toml'), 'utf8');
+        if (/^\s*pages_build_output_dir\s*=/m.test(toml))
+            return name(/^\s*name\s*=\s*"([^"\n]+)"/m.exec(toml)?.[1]);
+    }
+    catch {
+        // No TOML config: the JSON ones next.
+    }
+    for (const file of ['wrangler.json', 'wrangler.jsonc']) {
+        try {
+            // A jsonc config may carry comments, on their own lines or after a value, and trailing commas.
+            const config = record(JSON.parse(plainJson(await readFile(join(cwd, file), 'utf8'))));
+            if (typeof config?.pages_build_output_dir === 'string')
+                return name(config.name);
+        }
+        catch {
+            // Not there, or not readable as JSON.
+        }
+    }
+    return undefined;
+}
+/** JSON with comments as JSON: line and block comments outside strings go, and so does a comma before a closing bracket. */
+export function plainJson(text) {
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"') {
+            // A string, its escapes kept, so a // inside it stays.
+            let j = i + 1;
+            for (; j < text.length && text[j] !== '"'; j++)
+                if (text[j] === '\\')
+                    j++;
+            out += text.slice(i, j + 1);
+            i = j;
+        }
+        else if (c === '/' && text[i + 1] === '/') {
+            const end = text.indexOf('\n', i);
+            i = end < 0 ? text.length : end - 1;
+        }
+        else if (c === '/' && text[i + 1] === '*') {
+            const end = text.indexOf('*/', i + 2);
+            i = end < 0 ? text.length : end + 1;
+        }
+        else
+            out += c;
+    }
+    return out.replace(/,(\s*[}\]])/g, '$1');
+}
+/** cf, Cloudflare's CLI, at the version this command is built against, run through npx, which installs it on first use. */
+export const CF_PACKAGE = 'cf@1.0.0-beta.8';
+/**
+ * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
+ * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
+ * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox: every cf
+ * command names its project or its account, so none needs the checkout.
+ */
+export function cfRunner(opts = {}, runner = commandRunner) {
+    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', CF_PACKAGE, ...args]);
+}
+/** The status of the API call a cf command failed on, which its error box names on a line of its own ("│ 403 Forbidden", "│ 404 Not Found · HTTP /accounts/…"); null when it names none. */
+export function cfFailure(err) {
+    const said = String(err.stderr ?? '').replace(/\x1b\[[0-9;]*m/g, '');
+    const status = /^│?\s*([1-5]\d\d)(?: [A-Z][A-Za-z ]*)?(?: · HTTP \S*)?\s*$/m.exec(said)?.[1];
+    return status ? Number(status) : null;
+}
+/** `cf auth whoami`, which prints JSON signed in or out: whether it is signed in with a token that works, its scopes and its accounts. */
+export async function cfStatus(cf, signal) {
+    let status;
+    try {
+        const printed = await cf(['auth', 'whoami'], { signal });
+        status = record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
+    }
+    catch (err) {
+        return { cli: err.missing ? 'missing' : 'unknown', accounts: [] };
+    }
+    // A stored sign-in that neither the user's record nor the accounts answer is one to sign in again.
+    if (status?.authenticated === false || (status?.authenticated === true && status.tokenValid === false))
+        return { cli: 'signed-out', accounts: [] };
+    if (status?.authenticated !== true)
+        return { cli: 'unknown', accounts: [] };
+    const scopes = Array.isArray(status.scopes) ? status.scopes.filter((s) => typeof s === 'string') : undefined;
+    const accounts = list(status.accounts).map((a) => a.id).filter((id) => typeof id === 'string' && /^[0-9a-f]{32}$/.test(id));
+    return { cli: 'signed-in', ...(scopes ? { scopes } : {}), accounts };
+}
+/** What a Pages deployment's latest stage says of its build: success once it deployed, and building until a stage failed or it was cancelled or skipped. */
+const stageState = (stage) => stage?.status === 'failure' ? 'failure' : stage?.status === 'canceled' || stage?.status === 'skipped' ? 'canceled' : stage?.status === 'success' && stage.name === 'deploy' ? 'success' : 'building';
+/** A page of cf's list of deployments, and how many it reads of each account at most: the newest pull requests' builds come first. */
+const PER_PAGE = 25;
+const PAGES = 4;
+/**
+ * What cf lists of the project's preview deployments when it is signed in with Pages access: `pages deployments list`
+ * prints them as Cloudflare's API has them, each with its address, the branch's alias, the branch and commit it built,
+ * its latest stage and the repository it was built from. Each account the sign-in reaches is read, since another may hold
+ * a project of the same name, a page at a time, until the list ends or every head has its build; a deployment Cloudflare
+ * built from another repository is not this one's.
+ */
+async function fromCf(project, cf, repository, signal) {
+    const { cli, scopes, accounts } = await cfStatus(cf, signal);
+    const pages = !scopes || scopes.includes('pages:read') || scopes.includes('pages:write');
+    if (cli !== 'signed-in' || !project || !pages)
+        return { cli, rows: [], failed: cli === 'unknown' };
+    const same = (value, name) => typeof value === 'string' && value.toLowerCase() === name.toLowerCase();
+    const ours = (d) => {
+        const source = record(record(d.source)?.config);
+        return !source || (same(source.owner, repository.owner) && same(source.repo_name, repository.repo));
+    };
+    const rows = [];
+    const built = () => repository.heads.every((sha) => rows.some((row) => row.sha && sha.startsWith(row.sha)));
+    let failed = false;
+    for (const account of accounts.length ? accounts : [undefined]) {
+        if (rows.length && built())
+            break;
+        for (let page = 1; page <= PAGES; page++) {
+            let listed;
+            try {
+                const printed = await cf(['pages', 'deployments', 'list', '--project-name', project, '--env', 'preview', '--page', String(page), '--per-page', String(PER_PAGE)], { account, signal });
+                listed = list(JSON.parse(printed.slice(printed.indexOf('['), printed.lastIndexOf(']') + 1)));
+            }
+            catch (err) {
+                // An account with no such project answers 404; one that could not be read leaves the others' builds standing.
+                failed ||= cfFailure(err) !== 404;
+                break;
+            }
+            for (const d of listed.filter(ours)) {
+                const url = typeof d.url === 'string' && PAGES_ADDRESS.test(d.url) ? d.url : undefined;
+                if (!url || d.environment !== 'preview')
+                    continue;
+                const trigger = record(record(d.deployment_trigger)?.metadata);
+                const alias = (Array.isArray(d.aliases) ? d.aliases : []).find((a) => typeof a === 'string' && PAGES_ADDRESS.test(a));
+                const commit = typeof trigger?.commit_hash === 'string' && /^[0-9a-f]{7,40}$/.test(trigger.commit_hash) ? trigger.commit_hash : undefined;
+                rows.push({ ...(branchOf(trigger?.branch) ? { branch: trigger.branch } : {}), ...(commit ? { sha: commit } : {}), url, ...(alias ? { alias } : {}), state: stageState(record(d.latest_stage)), from: 'cf', at: -rows.length });
+            }
+            if (listed.length < PER_PAGE || built())
+                break;
+        }
+    }
+    return { cli, rows, failed };
+}
+/**
+ * Whether this repository's pull requests get Cloudflare Pages previews: the newest, as GitHub and cf have them;
+ * with `pull`, that pull request's only; with `branch`, the pushed branch's head's only, before its pull request exists.
+ */
+export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
+    const unread = () => ({ previews: [], cli: 'missing', error: "Cloudflare's previews could not be read.", unread: ['GitHub'] });
+    if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..')
+        return unread();
+    if (deps.branch !== undefined && !branchName(deps.branch))
+        return unread();
+    const github = await fromGitHub(owner, repo, deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal }), deps.pull, deps.branch);
+    const project = github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (await configuredProject(cwd));
+    // cf installs itself through npx on a machine without it, which takes a while the first time.
+    const cf = await fromCf(project, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha) }, deps.signal);
+    // A row is the head's when its commit is the head's; the pull request's heads say which. A wait for a pushed branch takes its head's rows alone.
+    const head = (row) => github.heads.find((h) => row.sha && h.sha.startsWith(row.sha) && (deps.branch === undefined || h.branch === deps.branch));
+    const rows = cf.rows.flatMap((row) => {
+        const of = head(row);
+        if (deps.branch !== undefined && !of)
+            return [];
+        if (deps.pull !== undefined && of?.number !== deps.pull)
+            return [];
+        return [of ? { ...row, ...(of.number ? { pullRequest: of.number } : {}), branch: of.branch ?? row.branch, sha: of.sha, at: of.at } : row];
+    });
+    // Of the same build, the check run outranks cf's row, and both the app's comment; each address once.
+    const rank = (p) => (p.from === 'check run' ? 0 : p.from === 'cf' ? 1 : 2);
+    const previews = [];
+    for (const p of [...github.previews, ...rows].sort((a, b) => rank(a) - rank(b))) {
+        const twin = previews.find((q) => q.url === p.url && (q.pullRequest ?? q.branch) === (p.pullRequest ?? p.branch));
+        if (!twin)
+            previews.push(p);
+        else if (!twin.alias && p.alias)
+            twin.alias = p.alias;
+    }
+    // The most recently updated pull request's first; a branch with no pull request among them last, as cf lists it.
+    previews.sort((a, b) => (b.pullRequest ? 1 : 0) - (a.pullRequest ? 1 : 0) || b.at - a.at);
+    return {
+        ...(project ? { project } : {}),
+        previews: previews.slice(0, deps.branch !== undefined ? previews.length : NEWEST).map(({ at, ...preview }) => preview),
+        cli: cf.cli,
+        ...(github.failed || cf.failed
+            ? { error: "Some of Cloudflare's previews could not be read: what is missing is unknown, not absent.", unread: [...(github.failed ? ['GitHub'] : []), ...(cf.failed ? ['cf'] : [])] }
+            : {}),
+    };
+}