@intentius/chant 0.124.30 → 0.124.32

package/src/pr-forge.test.ts

@@ -85,6 +85,21 @@ describe("github", () => {
     expect(calls[0].body).toEqual({ state: "success", context: "chant/plan", description: "2 members", target_url: "https://ci/run/1" });
   });
 
+  test("the authors of a pull request are its opener and every commit's author and committer, every page read (#4000)", async () => {
+    const page1 = Array.from({ length: 100 }, () => ({ author: { login: "carol" }, committer: { login: "carol" } }));
+    const { fetch, calls } = fakeFetch({
+      "GET /repos/acme/infra/pulls/12": { number: 12, user: { login: "carol" } },
+      "GET /repos/acme/infra/pulls/12/commits?page=1": page1,
+      "GET /repos/acme/infra/pulls/12/commits?page=2": [{ author: null, committer: { login: "dave" } }, { author: { login: "erin" }, committer: { login: "web-flow" } }],
+    });
+    expect(await githubForge({ ...opts, fetch }).authors(12)).toEqual(["carol", "dave", "erin", "web-flow"]);
+    expect(calls.map((c) => c.url)).toEqual([
+      "https://api.github.com/repos/acme/infra/pulls/12",
+      "https://api.github.com/repos/acme/infra/pulls/12/commits?per_page=100&page=1",
+      "https://api.github.com/repos/acme/infra/pulls/12/commits?per_page=100&page=2",
+    ]);
+  });
+
   test("an approver is someone whose newest deciding review approves", async () => {
     const { fetch } = fakeFetch({
       "GET /repos/acme/infra/pulls/12/reviews": [
@@ -195,6 +210,15 @@ describe("forgejo", () => {
     expect(calls[0].headers.Authorization).toBe("token t0k");
   });
 
+  test("the authors of a pull request come from the same endpoints, paged by limit (#4000)", async () => {
+    const { fetch, calls } = fakeFetch({
+      "GET /api/v1/repos/acme/infra/pulls/4": { number: 4, user: { login: "ana" } },
+      "GET /api/v1/repos/acme/infra/pulls/4/commits": [{ author: { login: "ana" }, committer: { login: "ben" } }],
+    });
+    expect(await forgejoForge({ ...opts, fetch }).authors(4)).toEqual(["ana", "ben"]);
+    expect(calls.map((c) => c.url)).toContain("https://codeberg.org/api/v1/repos/acme/infra/pulls/4/commits?limit=50&page=1");
+  });
+
   test("a dismissed approval no longer counts, and a comment review decides nothing", async () => {
     const { fetch } = fakeFetch({
       "GET /api/v1/repos/acme/infra/pulls/4/reviews": [
@@ -240,6 +264,24 @@ describe("gitlab", () => {
     expect(calls[0].body).toEqual({ state: "failed", name: "chant/apply", description: "refused" });
   });
 
+  test("the authors of a merge request: its author, and each commit email's account by the users search (#4000)", async () => {
+    const { fetch, calls } = fakeFetch({
+      "GET /api/v4/projects/42/merge_requests/5": { iid: 5, author: { username: "ana" } },
+      "GET /api/v4/projects/42/merge_requests/5/commits": [
+        { author_email: "ana@example.com", committer_email: "Ben@Example.com" },
+        { author_email: "ghost@example.com", committer_email: "ana@example.com" },
+      ],
+      "GET /api/v4/users": (c: Call) =>
+        ({ "ana@example.com": [{ username: "ana" }], "ben@example.com": [{ username: "ben" }] })[new URL(c.url).searchParams.get("search")!] ?? [],
+    });
+    expect(await gitlabForge({ ...opts, fetch }).authors(5)).toEqual(["ana", "ben"]);
+    expect(calls.filter((c) => new URL(c.url).pathname === "/api/v4/users").map((c) => new URL(c.url).searchParams.get("search"))).toEqual([
+      "ana@example.com",
+      "ben@example.com",
+      "ghost@example.com",
+    ]);
+  });
+
   test("approvers come from the approvals endpoint, merged requests from the commit", async () => {
     const { fetch } = fakeFetch({
       "GET /api/v4/projects/42/merge_requests/5/approvals": { approved_by: [{ user: { username: "ana" } }, { user: { username: "ben" } }] },
@@ -912,3 +954,32 @@ describe("pull requests over REST (#3798)", () => {
     await expect(forgejoForge({ ...fjOpts, fetch }).openPullRequest({ head: "h", title: "t", body: "b" })).rejects.toThrow(/no default branch.*pass base/);
   });
 });
+
+describe("setCommitStatus, a runner job's status (#4097)", () => {
+  const long = "x".repeat(300);
+
+  test("GitHub posts state, context, a description cut to 140 and target_url", async () => {
+    const { fetch, calls } = fakeFetch({ [`POST /repos/acme/infra/statuses/${SHA}`]: {} });
+    const forge = githubForge({ apiBase: "https://api.github.com", repo: "acme/infra", token: "t0k", fetch });
+    await forge.setCommitStatus!(SHA, { context: "chant/pr-plan", state: "failure", description: long, targetUrl: "https://host/reports/7/abc/" });
+    expect(calls).toHaveLength(1);
+    expect(calls[0]).toMatchObject({ method: "POST", url: `https://api.github.com/repos/acme/infra/statuses/${SHA}` });
+    expect(calls[0].headers.Authorization).toBe("Bearer t0k");
+    expect(calls[0].body).toEqual({ state: "failure", context: "chant/pr-plan", description: "x".repeat(140), target_url: "https://host/reports/7/abc/" });
+  });
+
+  test("Forgejo posts to /repos/{owner}/{repo}/statuses/{sha} under /api/v1, and omits target_url when there is none", async () => {
+    const { fetch, calls } = fakeFetch({ [`POST /api/v1/repos/acme/infra/statuses/${SHA}`]: {} });
+    const forge = forgejoForge({ apiBase: "https://codeberg.org/api/v1", repo: "acme/infra", token: "t0k", host: "codeberg.org", fetch });
+    await forge.setCommitStatus!(SHA, { context: "chant/pr-apply", state: "pending", description: "pr-apply running" });
+    expect(calls[0]).toMatchObject({ method: "POST", url: `https://codeberg.org/api/v1/repos/acme/infra/statuses/${SHA}` });
+    expect(calls[0].headers.Authorization).toBe("token t0k");
+    expect(calls[0].body).toEqual({ state: "pending", context: "chant/pr-apply", description: "pr-apply running" });
+  });
+
+  test("a refusal throws, and GitLab's client has none", async () => {
+    const { fetch } = fakeFetch({ [`POST /repos/acme/infra/statuses/${SHA}`]: 403 });
+    await expect(githubForge({ apiBase: "https://api.github.com", repo: "acme/infra", token: "t", fetch }).setCommitStatus!(SHA, { context: "c", state: "success", description: "d" })).rejects.toBeInstanceOf(ForgeApiError);
+    expect(gitlabForge({ apiBase: "https://gl/api/v4", project: "42", token: "t", fetch }).setCommitStatus).toBeUndefined();
+  });
+});

package/src/pr-forge.ts

@@ -61,6 +61,16 @@ export interface ForgeStatus {
   pipelineId?: number;
 }
 
+/** A runner job's commit status (#4097): the states GitHub and Forgejo both keep. */
+export interface CommitStatus {
+  context: string;
+  state: "pending" | "success" | "failure" | "error";
+  /** Cut to 140 characters. */
+  description: string;
+  /** Where the status links to. Omitted from the request when absent. */
+  targetUrl?: string;
+}
+
 /** A commit status's state, as a caller names it. */
 export type ForgeStatusState = "pending" | "running" | "success" | "failed" | "failure" | "canceled" | "error";
 
@@ -309,6 +319,14 @@ export interface PrForge {
    */
   addComment(pr: number, body: string): Promise<AddedComment>;
   setStatus(sha: string, status: ForgeStatus): Promise<void>;
+  /**
+   * GitHub and Forgejo (#4097): set a commit status from a runner's job, one
+   * of `pending`, `success`, `failure` or `error`. The request is the one
+   * {@link setStatus} sends (`POST /repos/{owner}/{repo}/statuses/{sha}`), with
+   * the description cut to 140 characters and `target_url` only when given.
+   * `chant ci run` posts a job's progress through it.
+   */
+  setCommitStatus?(sha: string, status: CommitStatus): Promise<void>;
   /**
    * Keep one OPEN tracking issue for `marker` in line with `finding`: open
    * it, update its title and body, or, when `finding` is `null` and
@@ -331,6 +349,16 @@ export interface PrForge {
   upsertIssue(marker: string, title: string, body: string): Promise<string | undefined>;
   /** Logins whose standing review approves `pr`. */
   approvers(pr: number): Promise<string[]>;
+  /**
+   * Logins of the people who wrote `pr` (#4000): its author, and the author
+   * and committer of each of its commits. GitHub and Forgejo name a commit's
+   * people by the account its email belongs to; a commit whose email is on no
+   * account adds nobody. GitLab names them by email only, so each email is
+   * looked up among the users (`GET /users?search=`), which matches an
+   * account's public email; an email no account shows publicly adds nobody.
+   * Sorted, without repeats.
+   */
+  authors(pr: number): Promise<string[]>;
   /** The merged pull request that produced `sha`, or null. */
   pullRequestFor(sha: string): Promise<number | null>;
   /**
@@ -614,6 +642,14 @@ function githubShaped(kind: "github" | "forgejo", opts: GithubForgeOptions): Git
       await api.call("PATCH", `${repo}/issues/${n}`, { state: "closed" });
     },
   };
+  const postStatus = async (sha: string, state: ForgeStatusState, context: string, description: string, url?: string): Promise<void> => {
+    await api.call("POST", `${repo}/statuses/${sha}`, {
+      state: statusStateFor(kind, state),
+      context,
+      description: description.slice(0, GITHUB_DESCRIPTION),
+      ...(url ? { target_url: url } : {}),
+    });
+  };
   return {
     kind,
     host,
@@ -621,12 +657,10 @@ function githubShaped(kind: "github" | "forgejo", opts: GithubForgeOptions): Git
     principalOf: (login) => forgePrincipalOf(kind, host, login),
     ...threadCalls(t),
     async setStatus(sha, status) {
-      await api.call("POST", `${repo}/statuses/${sha}`, {
-        state: statusStateFor(kind, status.state),
-        context: status.context,
-        description: status.description.slice(0, GITHUB_DESCRIPTION),
-        ...(status.url ? { target_url: status.url } : {}),
-      });
+      await postStatus(sha, status.state, status.context, status.description, status.url);
+    },
+    async setCommitStatus(sha, status) {
+      await postStatus(sha, status.state, status.context, status.description, status.targetUrl);
     },
     async approvers(pr) {
       // A reviewer's newest deciding review is their standing one. A comment
@@ -643,6 +677,20 @@ function githubShaped(kind: "github" | "forgejo", opts: GithubForgeOptions): Git
       }
       return [...standing].filter(([, state]) => state === "APPROVED").map(([login]) => login).sort();
     },
+    async authors(pr) {
+      const logins = new Set<string>();
+      const add = (v: unknown) => {
+        if (isObject(v) && typeof v.login === "string" && v.login !== "") logins.add(v.login);
+      };
+      const opened = await api.call("GET", `${repo}/pulls/${pr}`);
+      if (isObject(opened)) add(opened.user);
+      for (const c of await api.list(`${repo}/pulls/${pr}/commits`, pageParams, pageSize)) {
+        if (!isObject(c)) continue;
+        add(c.author);
+        add(c.committer);
+      }
+      return [...logins].sort();
+    },
     async pullRequestFor(sha) {
       if (kind === "forgejo") {
         try {
@@ -898,6 +946,22 @@ export function gitlabForge(opts: GitlabForgeOptions): PrForge {
         .filter((l): l is string => l !== undefined);
       return [...new Set(logins)].sort();
     },
+    async authors(mr) {
+      const logins = new Set<string>();
+      const merge = await api.call("GET", `${notes}/${mr}`);
+      const author = isObject(merge) ? authorOf(merge) : undefined;
+      if (author) logins.add(author);
+      const emails = new Set<string>();
+      for (const c of await api.list(`${notes}/${mr}/commits`, pageParams, 100)) {
+        if (!isObject(c)) continue;
+        for (const email of [str(c.author_email), str(c.committer_email)]) if (email) emails.add(email.toLowerCase());
+      }
+      for (const email of [...emails].sort()) {
+        const users = await api.call("GET", `/users?search=${encodeURIComponent(email)}`);
+        for (const u of Array.isArray(users) ? users : []) if (isObject(u) && typeof u.username === "string") logins.add(u.username);
+      }
+      return [...logins].sort();
+    },
     async pullRequestFor(sha) {
       const mrs = await api.call("GET", `${project}/repository/commits/${sha}/merge_requests`);
       if (!Array.isArray(mrs)) return null;

package/src/pr-loop-bundle.test.ts

@@ -41,6 +41,7 @@ describe("the pull-request loop bundle", () => {
       "packages/core/src/pr-forge.ts",
       "packages/core/src/pr-loop.ts",
     ]);
-    expect(result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0)).toBeLessThan(64 * 1024);
+    // About 65 KB today, after the pull request authors (#4000).
+    expect(result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0)).toBeLessThan(72 * 1024);
   });
 });

package/src/pr-loop.test.ts

@@ -14,7 +14,10 @@ import {
   describePlanChanged,
   memberCounts,
   PR_REPORT_DEPLOYED_OUTPUTS_FLOOR,
+  PR_REPORT_PLANNED_OUTPUTS_FLOOR,
+  prRoundGate,
   PR_REPORT_SCHEMA_ID,
+  PR_REPORT_WAVES_FLOOR,
   prApproveCommand,
   prNoteMarker,
   PR_GATE_OP,
@@ -113,6 +116,34 @@ const resumedReport: PrReport = {
 /** A plan whose members read `net` and `a` from the deployed estate (#4104). */
 const deployedReport: PrReport = { ...planReport, deployedOutputs: { a: ["id"], net: ["cidr"], dns: [] } };
 
+/** A plan where `app` reads `a.id`, which `a`'s plan knows only after apply, and `a.arn`, which it knows (#3999). */
+const unknownReport: PrReport = {
+  ...planReport,
+  deployedOutputs: { net: ["cidr"] },
+  plannedOutputs: { a: ["arn"] },
+  members: [planReport.members[0]!, { ...planReport.members[1]!, unknownInputs: ["a.id"], buildInputs: ["img.publish.digest"] }],
+};
+
+const roundDoc = composeChangeSet([part("app", 3, [{ address: "terraform_data.app", action: "update" }])]);
+/** The apply of {@link unknownReport}: `a` applied, and `app`, planned again, waits on round 2's gate (#3999). */
+const waitingReport: PrReport = {
+  ...unknownReport,
+  stage: "apply",
+  status: "waiting",
+  approval: { status: "approved", approvedBy: ["github:alice"] },
+  rounds: [{ round: 2, gate: prRoundGate("pr-apply", 2), digest: roundDoc.digest, components: ["app"], approval: { status: "pending" }, status: "waiting", changeSet: roundDoc }],
+  members: [
+    { ...planReport.members[0]!, status: "applied" },
+    {
+      ...unknownReport.members[1]!,
+      status: "waiting",
+      round: 2,
+      planDigest: `jcs1-sha256:${hex(3)}`,
+      held: "its plan read a.id before that output applied as another value",
+    },
+  ],
+};
+
 describe("the pr-report schema", () => {
   test("is a valid schema and names this module's id", () => {
     expect(validSchema(schema)).toBe(true);
@@ -120,7 +151,7 @@ describe("the pr-report schema", () => {
   });
 
   test("every stage's report validates, and its change set validates against the change-set schema", () => {
-    for (const report of [planReport, refusedReport, appliedReport, resumedReport, deployedReport]) {
+    for (const report of [planReport, refusedReport, appliedReport, resumedReport, deployedReport, unknownReport, waitingReport]) {
       expectValid(report);
       expectValidChangeSet(report.changeSet);
       expect(report.changeSet.digest).toBe(report.digest);
@@ -170,6 +201,27 @@ describe("the note", () => {
     expect(schema.required).not.toContain("deployedOutputs");
   });
 
+  test("a plan names the outputs read from upstream plans and the ones known only after apply (#3999)", () => {
+    const note = renderPrNote(unknownReport);
+    expect(note).toContain("Planned against the outputs this change's plans say its upstreams will have: `a` (`arn`).");
+    expect(note).toContain("Known only after apply: `app` reads `a.id`. This approval does not cover what those members do with them.");
+    expect(renderPrNote(planReport)).not.toContain("Known only after apply");
+    expect(note).toContain("From this pull request's build: `app` reads `img.publish.digest`. The image digest comes from this pull request's build");
+    expect(renderPrNote(planReport)).not.toContain("From this pull request's build");
+    expect(PR_REPORT_PLANNED_OUTPUTS_FLOOR).toBe("0.124.32");
+    expect(schema.required).not.toContain("plannedOutputs");
+  });
+
+  test("a waiting apply names the round's digest and the command that approves it (#3999)", () => {
+    const note = renderPrNote(waitingReport, { approver: "github:<your-login>" });
+    expect(note).toContain("Applied 1 of 2 members; 1 wait on an approval of the plan made after their upstream applied.");
+    expect(note).toContain(`chant approve pr-12 pr-apply-round-2 --plan ${roundDoc.digest} --approver github:<your-login> --sign`);
+    expect(note).toContain("| `app` | app | waiting on its new plan |");
+    expect(prStatusState(waitingReport)).toBe("pending");
+    expect(prStatusDescription(waitingReport)).toBe("waiting: app planned again after an upstream applied, not approved yet");
+    expect(prRoundGate("pr-apply", 1)).toBe("pr-apply");
+  });
+
   test("a small limit leaves the summary out rather than cutting the table", () => {
     const note = renderPrNote(planReport, { limit: 800 });
     expect(note).toContain("| `app` |");
@@ -181,6 +233,7 @@ describe("the status", () => {
   test("describes each stage in at most 140 characters", () => {
     expect(prStatusDescription(planReport)).toMatch(/^2 members: 1 to change, 0 to destroy or replace; plan [0-9a-f]{12}$/);
     expect(prStatusDescription(refusedReport)).toBe("refused: the plan changed after review");
+    expect(prStatusDescription({ ...refusedReport, refusal: "author-approved" })).toBe("refused: the approver wrote the change");
     expect(prStatusDescription(appliedReport)).toMatch(/^applied 2 members/);
     for (const r of [planReport, refusedReport, appliedReport]) expect(prStatusDescription(r).length).toBeLessThanOrEqual(140);
   });
@@ -221,3 +274,66 @@ describe("a workspace member's loop (#3465)", () => {
     expect(note).toContain("chant approve pr-12-network pr-apply");
   });
 });
+
+describe("a gate per wave on merge (#4003)", () => {
+  const waveDigest = `jcs1-sha256:${hex(7)}`;
+  const wave1 = { wave: 1, components: ["a"], status: "applied" as const, approval: "pull-request" as const, gate: "pr-apply", digest: doc.digest, approvedBy: ["github:alice"] };
+  const waveApplied: PrReport = {
+    ...appliedReport,
+    status: "wave-applied",
+    waveGate: "release",
+    waves: [wave1],
+    members: [{ ...planReport.members[0], status: "applied" }, planReport.members[1]],
+  };
+  const waiting: PrReport = {
+    ...waveApplied,
+    status: "refused",
+    refusal: "wave-not-approved",
+    message: "Wave 2 was planned after the waves before it applied, and the pull request's approved plan does not cover it.",
+    waves: [
+      wave1,
+      { wave: 2, components: ["app"], status: "waiting", approval: "wave", gate: "release-wave-2", digest: waveDigest, moved: ["app now writes app.main.cidr to a different value than the approved plan"] },
+    ],
+  };
+
+  test("the reports validate, waveGate and waves are optional, and both came with the same chant", () => {
+    for (const r of [waveApplied, waiting]) expectValid(r);
+    expect(schema.required).not.toContain("waves");
+    expect(schema.required).not.toContain("waveGate");
+    expect(PR_REPORT_WAVES_FLOOR).toBe("0.124.32");
+  });
+
+  test("the note has a row per wave saying whose approval it applied under", () => {
+    const note = renderPrNote(waveApplied);
+    expect(note).toContain("Applied wave 1 of 2. The next wave runs in its own job.");
+    expect(note).toContain("| 1 | `a` | applied | the pull request's `pr-apply` by `github:alice` |");
+  });
+
+  test("a wave that waits names why its plan moved and the approve command for its own gate", () => {
+    const note = renderPrNote(waiting, { approver: "github:<your-login>" });
+    expect(note).toContain("Wave 2 waits at its gate `release-wave-2`; nothing in it applied.");
+    expect(note).toContain("| 2 | `app` | waiting | its own `release-wave-2`, not approved yet |");
+    expect(note).toContain("- app now writes app.main.cidr to a different value than the approved plan");
+    expect(note).toContain(`chant approve pr-12 release-wave-2 --plan ${waveDigest} --approver github:<your-login> --sign`);
+    golden("pr-apply-wave-waiting.note.golden.md", note);
+  });
+
+  test("with --wave-gate the plan's note says later waves are planned again and may stop at their own gate; without it, nothing", () => {
+    const sentence = "On merge each wave after the first is planned again once the waves before it apply, and a wave whose plan moved stops at its own gate, `release-wave-<k>`, for approval.";
+    const planned = renderPrNote({ ...planReport, waveGate: "release" });
+    expect(planned).toContain(sentence);
+    expect(renderPrNote({ ...planReport, waveGate: "release", approval: { status: "approved", approvedBy: ["github:alice"] } })).toContain(sentence);
+    expect(renderPrNote(planReport)).not.toContain("planned again");
+    expect(renderPrNote(waveApplied)).not.toContain("planned again");
+    expectValid({ ...planReport, waveGate: "release" });
+  });
+
+  test("the status: a wave applied succeeds, a wave waiting on its approval is pending, a moved approval fails", () => {
+    expect(prStatusDescription(waveApplied)).toBe("applied wave 1 of 2 under the pull request's approval");
+    expect(prStatusState(waveApplied)).toBe("success");
+    expect(prStatusDescription(waiting)).toBe("wave 2 waits at release-wave-2: its plan moved, approve it");
+    expect(prStatusState(waiting)).toBe("pending");
+    expect(prStatusState({ ...waiting, refusal: "wave-plan-changed" })).toBe("failure");
+    expect(prStatusDescription({ ...waiting, waves: [wave1], refusal: "earlier-wave" })).toBe("refused: an earlier wave has not applied");
+  });
+});