@lousy-agents/cli 2.11.0 → 3.1.0

package/dist/index.js

@@ -32630,6 +32630,15 @@ const RulesetSchema = schemas_object({
     enforcement: schemas_string(),
     rules: schemas_array(RulesetRuleSchema).optional()
 });
+const RepoSecuritySchema = schemas_object({
+    // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+    security_and_analysis: schemas_object({
+        // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+        advanced_security: schemas_object({
+            status: schemas_string()
+        })
+    }).optional()
+});
 /**
  * Parses a GitHub remote URL to extract owner and repo name
  */ function parseRepoFromRemoteUrl(remoteUrl) {
@@ -32704,6 +32713,24 @@ function defaultExec(command, args, options) {
             return null;
         }
     }
+    async hasAdvancedSecurity(owner, repo) {
+        if (!this.octokit) {
+            return false;
+        }
+        try {
+            const { data } = await this.octokit.rest.repos.get({
+                owner,
+                repo
+            });
+            const parsed = RepoSecuritySchema.safeParse(data);
+            if (!parsed.success) {
+                return false;
+            }
+            return parsed.data.security_and_analysis?.advanced_security?.status === "enabled";
+        } catch  {
+            return false;
+        }
+    }
     async listRulesets(owner, repo) {
         if (!this.octokit) {
             throw new Error("Not authenticated");
@@ -32737,18 +32764,16 @@ function defaultExec(command, args, options) {
 }
 /**
  * Resolves a GitHub token from GH_TOKEN/GITHUB_TOKEN env vars, with gh CLI fallback
- */ async function resolveGitHubToken() {
-    const envToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+ */ async function resolveGitHubToken(exec = defaultExec) {
+    const envToken = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim();
     if (envToken) {
         return envToken;
     }
     try {
-        const { stdout } = await execFileAsync("gh", [
+        const { stdout } = await exec("gh", [
             "auth",
             "token"
-        ], {
-            encoding: "utf-8"
-        });
+        ]);
         const token = stdout.trim();
         return token || null;
     } catch  {
@@ -33671,8 +33696,44 @@ function isCopilotCodeScanningRule(rule) {
     return findCopilotRuleset(rulesets) !== undefined;
 }
 /**
- * Builds a ruleset payload for enabling Copilot code review
- */ function buildCopilotReviewRulesetPayload() {
+ * Builds a ruleset payload for enabling Copilot code review.
+ * Includes code_scanning rules configured with CodeQL and Copilot Autofix when GitHub Advanced Security is enabled.
+ */ function buildCopilotReviewRulesetPayload(options) {
+    const rules = [
+        {
+            type: "copilot_code_review",
+            parameters: {
+                // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                review_on_push: true,
+                // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                review_draft_pull_requests: true
+            }
+        }
+    ];
+    if (options.advancedSecurityEnabled) {
+        rules.push({
+            type: "code_scanning",
+            parameters: {
+                // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                code_scanning_tools: [
+                    {
+                        tool: "CodeQL",
+                        // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                        security_alerts_threshold: "high_or_higher",
+                        // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                        alerts_threshold: "errors"
+                    },
+                    {
+                        tool: "Copilot Autofix",
+                        // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                        security_alerts_threshold: "high_or_higher",
+                        // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
+                        alerts_threshold: "errors"
+                    }
+                ]
+            }
+        });
+    }
     return {
         name: "Copilot Code Review",
         enforcement: "active",
@@ -33688,32 +33749,7 @@ function isCopilotCodeScanningRule(rule) {
                 exclude: []
             }
         },
-        rules: [
-            {
-                type: "copilot_code_review",
-                parameters: {
-                    // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
-                    review_on_push: true,
-                    // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
-                    review_draft_pull_requests: true
-                }
-            },
-            {
-                type: "code_scanning",
-                parameters: {
-                    // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
-                    code_scanning_tools: [
-                        {
-                            tool: "Copilot Autofix",
-                            // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
-                            security_alerts_threshold: "high_or_higher",
-                            // biome-ignore lint/style/useNamingConvention: GitHub API schema requires snake_case
-                            alerts_threshold: "errors"
-                        }
-                    ]
-                }
-            }
-        ]
+        rules
     };
 }
 /**
@@ -34683,7 +34719,10 @@ async function checkAndPromptRuleset(rulesetGateway, targetDir, prompt) {
         return;
     }
     try {
-        const payload = buildCopilotReviewRulesetPayload();
+        const advancedSecurityEnabled = await rulesetGateway.hasAdvancedSecurity(repoInfo.owner, repoInfo.repo);
+        const payload = buildCopilotReviewRulesetPayload({
+            advancedSecurityEnabled
+        });
         await rulesetGateway.createRuleset(repoInfo.owner, repoInfo.repo, payload);
         consola.success(`Created Copilot PR review ruleset: "${payload.name}"`);
     } catch (error) {