@jphutchins/code-review 0.1.0-alpha.30 → 0.1.0-alpha.31

package/dist/index.js

@@ -404,6 +404,7 @@ var renderStraysSection = (strays) => {
 };
 var asRecord = (u) => typeof u === "object" && u !== null && !Array.isArray(u) ? u : null;
 var errMsg = (e) => e instanceof Error ? e.message : String(e);
+var annotationSafe = (msg) => msg.replaceAll(/[\r\n]+/g, " ");
 var tryParseJson = (text) => {
   try {
     return { ok: true, value: JSON.parse(text) };
@@ -972,16 +973,32 @@ var pad2 = (n) => String(n).padStart(2, "0");
 var formatUtc = (d) => `${String(d.getUTCFullYear())}-${pad2(d.getUTCMonth() + 1)}-${pad2(d.getUTCDate())} ${pad2(d.getUTCHours())}:${pad2(d.getUTCMinutes())} UTC`;
 
 // src/notice.ts
-var isNoticeKind = (s) => s === "security-blocked" || s === "setup-failed" || s === "checkout-failed" || s === "no-output";
+var NOTICE_KINDS = [
+  "security-blocked",
+  "triage-error",
+  "setup-failed",
+  "checkout-failed",
+  "no-output"
+];
+var isNoticeKind = (s) => NOTICE_KINDS.some((k) => k === s);
 var blockquote = (text) => text.replaceAll("\n", "\n> ");
+var reasoned = (lead, noReason, reasons) => typeof reasons === "string" && reasons.trim() !== "" ? `${lead}
+
+> ${blockquote(reasons)}` : noReason;
 var noticeSummary = (kind, reasons) => {
   switch (kind) {
     case "security-blocked":
-      return reasons !== void 0 && reasons.trim() !== "" ? `### \u{1F6D1} Code review skipped by the security gate
-
-The diff was flagged as unsafe to apply and execute:
-
-> ${blockquote(reasons)}` : "### \u{1F6D1} Code review skipped by the security gate\n\nThe security triage returned an unsafe verdict without a reason. See workflow logs.";
+      return reasoned(
+        "### \u{1F6D1} Code review skipped by the security gate\n\nThe diff was flagged as unsafe to apply and execute:",
+        "### \u{1F6D1} Code review skipped by the security gate\n\nThe security triage returned an unsafe verdict without a reason. See workflow logs.",
+        reasons
+      );
+    case "triage-error":
+      return reasoned(
+        "### \u{1F6E0}\uFE0F Security gate could not evaluate\n\nThe security triage could not produce a verdict (operational error), so the review failed closed \u2014 this is an infrastructure failure, not a finding about this diff. Re-run to retry a transient fault; a persistent one is a configuration issue (see the workflow logs). The triage step reported:",
+        "### \u{1F6E0}\uFE0F Security gate could not evaluate\n\nThe security triage could not produce a verdict (operational error), so the review failed closed \u2014 this is an infrastructure failure, not a finding about this diff. Re-run to retry a transient fault; a persistent one is a configuration issue (see the workflow logs).",
+        reasons
+      );
     case "setup-failed":
       return "### \u{1F6E0}\uFE0F Review did not run\n\nThe review job failed before the security triage could run (e.g. dependency install or environment setup). See the workflow logs \u2014 this is an infrastructure failure, not a security verdict.";
     case "checkout-failed":
@@ -990,15 +1007,21 @@ The diff was flagged as unsafe to apply and execute:
       return "### \u26A0\uFE0F Review did not complete\n\nThe diff passed triage but the review produced no output. See workflow logs.";
   }
 };
-var buildNoticeEnvelope = (kind, reasons) => ({
+var noticeEnvelope = (summary) => ({
   schema_version: DEFAULT_SCHEMA_VERSION,
-  findings: noticeFindings(noticeSummary(kind, reasons)),
+  findings: noticeFindings(summary),
   models: [],
   turns: 0,
   duration_ms: 0,
   vendor_cost_usd: null,
   incomplete: true
 });
+var buildNoticeEnvelope = (kind, reasons) => noticeEnvelope(noticeSummary(kind, reasons));
+var buildUnknownNoticeEnvelope = (kind) => noticeEnvelope(
+  `### \u26A0\uFE0F Review could not be rendered
+
+The workflow asked for an unrecognized notice kind (\`${kind}\`) \u2014 the pinned code-review CLI is older than the workflow calling it (check that its version matches). Failing closed. See the workflow logs.`
+);
 var identity = (decoded) => decoded;
 var findingsTable = [
   {
@@ -1082,6 +1105,7 @@ var resolvers = {
   prices: (raw) => resolveSingleVersion("prices", raw)
 };
 var resolve = (kind, raw) => resolvers[kind](raw);
+var describeEndpoint = (args) => args.find((a) => a === "graphql" || a.includes("/") && !a.startsWith("-")) ?? args[0] ?? "(no endpoint)";
 var runGhApi = (args, stdin, env) => new Promise((resolve3, reject) => {
   const child = execFile(
     "gh",
@@ -1091,7 +1115,7 @@ var runGhApi = (args, stdin, env) => new Promise((resolve3, reject) => {
       if (err) {
         const stderrStr = typeof stderr === "string" && stderr.trim() ? stderr.trim() : "";
         const errStr = err instanceof Error ? err.message : "unknown error";
-        reject(new Error(`gh api failed: ${stderrStr || errStr}`));
+        reject(new Error(`gh api ${describeEndpoint(args)} failed: ${stderrStr || errStr}`));
       } else {
         resolve3(stdout);
       }
@@ -1105,10 +1129,17 @@ var runGhApi = (args, stdin, env) => new Promise((resolve3, reject) => {
 // src/pr.ts
 var CANDIDATE_JQ = ".[] | {number: .number, state: .state, headRef: .head.ref, headSha: .head.sha}";
 var parseCandidates = (stdout) => parseJsonl(stdout);
+var fetchDirectCandidates = async (repo, headSha, ghApi) => {
+  try {
+    return parseCandidates(
+      await ghApi([`repos/${repo}/commits/${headSha}/pulls`, "--jq", CANDIDATE_JQ])
+    );
+  } catch {
+    return [];
+  }
+};
 var fetchPrCandidates = async (repo, headSha, ghApi) => {
-  const direct = parseCandidates(
-    await ghApi([`repos/${repo}/commits/${headSha}/pulls`, "--jq", CANDIDATE_JQ])
-  );
+  const direct = await fetchDirectCandidates(repo, headSha, ghApi);
   if (direct.length > 0) return direct;
   const open = parseCandidates(
     await ghApi([
@@ -3240,25 +3271,36 @@ var adaptCmd = defineCommand({
 var noticeCmd = defineCommand({
   meta: {
     name: "notice",
-    description: "Emit an abstract envelope for a run that produced no completed review (security block, setup failure, unapplied diff, or empty run) \u2014 flagged incomplete so the commenter renders it honestly and won't bury a real review"
+    description: "Emit an abstract envelope for a run that produced no completed review (security block, triage error, setup failure, checkout failure, or empty run) \u2014 flagged incomplete so the commenter renders it honestly and won't bury a real review"
   },
   args: {
     kind: {
       type: "positional",
-      description: "One of: security-blocked, setup-failed, checkout-failed, no-output",
+      description: `One of: ${NOTICE_KINDS.join(", ")} (an unrecognized kind renders a generic incomplete notice rather than failing \u2014 the pinned CLI is older than the workflow)`,
       required: true
     },
     reasons: {
       type: "string",
-      description: "security-blocked only: the triage's fail-closed reason string (empty/omitted \u21D2 the no-reason wording)"
+      description: "security-blocked / triage-error only: the triage's fail-closed reason string (empty/omitted \u21D2 the no-reason wording)"
     }
   },
+  // An unrecognized kind degrades to a generic incomplete notice instead of exiting non-zero: a
+  // `notice <kind>` call under the workflow's `set -euo pipefail` must never crash the assemble
+  // step into posting nothing, and an unknown kind almost always means version skew, not a typo.
   run: ({ args }) => {
-    const kind = isNoticeKind(args.kind) ? args.kind : fail(
-      `Unknown notice kind "${args.kind}" \u2014 expected one of: security-blocked, setup-failed, checkout-failed, no-output`
-    );
-    process.stdout.write(`${JSON.stringify(buildNoticeEnvelope(kind, args.reasons), null, 2)}
+    if (!isNoticeKind(args.kind)) {
+      process.stderr.write(
+        `::warning::code-review notice: unrecognized kind "${args.kind}" \u2014 the pinned CLI is older than the workflow calling it; rendering a generic incomplete notice
+`
+      );
+      process.stdout.write(`${JSON.stringify(buildUnknownNoticeEnvelope(args.kind), null, 2)}
 `);
+      return;
+    }
+    process.stdout.write(
+      `${JSON.stringify(buildNoticeEnvelope(args.kind, args.reasons), null, 2)}
+`
+    );
   }
 });
 var isExtractSchemaKind = (s) => s === "findings" || s === "triage";
@@ -3685,9 +3727,13 @@ var announceCmd = defineCommand({
       runUrl: args["run-url"],
       headBranch: args["head-branch"]
     }).catch(
-      (err) => process.stderr.write(
-        `code-review announce: could not post the in-progress sticky (${errMsg(err)}) \u2014 continuing (cosmetic)
+      (err) => (
+        // `::warning::` so a persistently broken announce shows up in the run's annotations, not only
+        // buried in the step log — `announce` otherwise reports success while having posted nothing.
+        process.stderr.write(
+          `::warning::code-review announce: could not post the in-progress sticky (${annotationSafe(errMsg(err))}) \u2014 continuing (cosmetic)
 `
+        )
       )
     );
   }