@mocoto/mahoraga 0.14.0

package/dist/app/github/app/installation-store.js

@@ -0,0 +1,99 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { decryptJson, encryptJson } from '../middleware/crypto.js';
+const DEFAULT_CONFIG = {
+    pushAnalysisEnabled: true,
+    pullRequestAnalysisEnabled: true,
+    fast: false,
+    incrementalOnPush: true
+};
+function storePath() {
+    const base = process.env.MAHORAGA_DATA_DIR || join(process.cwd(), '.mahoraga-data');
+    return join(base, 'installations.json');
+}
+function isStringRecord(val) {
+    if (typeof val !== 'object' || val === null)
+        return false;
+    return Object.values(val).every(v => typeof v === 'string');
+}
+function isInstallationConfig(val) {
+    if (typeof val !== 'object' || val === null)
+        return false;
+    const v = val;
+    return typeof v.installationId === 'number' && typeof v.updatedAt === 'number';
+}
+function loadAll() {
+    const path = storePath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const raw = readFileSync(path, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!isStringRecord(parsed))
+            return {};
+        const result = {};
+        for (const [key, val] of Object.entries(parsed)) {
+            try {
+                const decrypted = decryptJson(val);
+                if (isInstallationConfig(decrypted)) {
+                    result[key] = decrypted;
+                }
+            }
+            catch {
+                try {
+                    const fallback = JSON.parse(val);
+                    if (isInstallationConfig(fallback)) {
+                        result[key] = fallback;
+                    }
+                }
+                catch {
+                    return {};
+                }
+            }
+        }
+        return result;
+    }
+    catch {
+        return {};
+    }
+}
+function saveAll(data) {
+    const path = storePath();
+    mkdirSync(dirname(path), { recursive: true });
+    const encrypted = {};
+    for (const [key, val] of Object.entries(data)) {
+        encrypted[key] = encryptJson(val);
+    }
+    writeFileSync(path, JSON.stringify(encrypted, null, 2), 'utf-8');
+}
+export function obterConfigInstalacao(installationId) {
+    const all = loadAll();
+    const key = String(installationId);
+    return all[key] ?? {
+        installationId,
+        ...DEFAULT_CONFIG,
+        updatedAt: Date.now()
+    };
+}
+export function salvarConfigInstalacao(partial) {
+    const all = loadAll();
+    const key = String(partial.installationId);
+    const atual = all[key] ?? {
+        installationId: partial.installationId,
+        ...DEFAULT_CONFIG,
+        updatedAt: Date.now()
+    };
+    const merged = {
+        ...atual,
+        ...partial,
+        installationId: partial.installationId,
+        updatedAt: Date.now()
+    };
+    all[key] = merged;
+    saveAll(all);
+    return merged;
+}
+export function listarConfigsInstalacao() {
+    return Object.values(loadAll()).sort((a, b) => b.updatedAt - a.updatedAt);
+}
+//# sourceMappingURL=installation-store.js.map

package/dist/app/github/app/installation-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-store.js","sourceRoot":"","sources":["../../../../src/app/github/app/installation-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAInE,MAAM,cAAc,GAA6D;IAC/E,mBAAmB,EAAE,IAAI;IACzB,0BAA0B,EAAE,IAAI;IAChC,IAAI,EAAE,KAAK;IACX,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC;AACjF,CAAC;AAED,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,MAAM,GAAuC,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,WAAW,CAAU,GAAG,CAAC,CAAC;gBAC5C,IAAI,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC1C,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACnC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;oBACzB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAwC;IACvD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,SAAS,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,cAAsB;IAC1D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI;QACjB,cAAc;QACd,GAAG,cAAc;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAiE;IAEjE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,GAAG,cAAc;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,MAAM,MAAM,GAAuB;QACjC,GAAG,KAAK;QACR,GAAG,OAAO;QACV,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;IAClB,OAAO,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\n\nimport type { InstallationConfig } from '../../../types/github/app.js';\nimport { decryptJson, encryptJson } from '../middleware/crypto.js';\n\nexport type { InstallationConfig };\n\nconst DEFAULT_CONFIG: Omit<InstallationConfig, 'installationId' | 'updatedAt'> = {\n  pushAnalysisEnabled: true,\n  pullRequestAnalysisEnabled: true,\n  fast: false,\n  incrementalOnPush: true\n};\n\nfunction storePath(): string {\n  const base = process.env.MAHORAGA_DATA_DIR || join(process.cwd(), '.mahoraga-data');\n  return join(base, 'installations.json');\n}\n\nfunction isStringRecord(val: unknown): val is Record<string, string> {\n  if (typeof val !== 'object' || val === null) return false;\n  return Object.values(val).every(v => typeof v === 'string');\n}\n\nfunction isInstallationConfig(val: unknown): val is InstallationConfig {\n  if (typeof val !== 'object' || val === null) return false;\n  const v = val as Record<string, unknown>;\n  return typeof v.installationId === 'number' && typeof v.updatedAt === 'number';\n}\n\nfunction loadAll(): Record<string, InstallationConfig> {\n  const path = storePath();\n  if (!existsSync(path)) return {};\n  try {\n    const raw = readFileSync(path, 'utf-8');\n    const parsed: unknown = JSON.parse(raw);\n    if (!isStringRecord(parsed)) return {};\n    const result: Record<string, InstallationConfig> = {};\n    for (const [key, val] of Object.entries(parsed)) {\n      try {\n        const decrypted = decryptJson<unknown>(val);\n        if (isInstallationConfig(decrypted)) {\n          result[key] = decrypted;\n        }\n      } catch {\n        try {\n          const fallback: unknown = JSON.parse(val);\n          if (isInstallationConfig(fallback)) {\n            result[key] = fallback;\n          }\n        } catch {\n          return {};\n        }\n      }\n    }\n    return result;\n  } catch {\n    return {};\n  }\n}\n\nfunction saveAll(data: Record<string, InstallationConfig>): void {\n  const path = storePath();\n  mkdirSync(dirname(path), { recursive: true });\n  const encrypted: Record<string, string> = {};\n  for (const [key, val] of Object.entries(data)) {\n    encrypted[key] = encryptJson(val);\n  }\n  writeFileSync(path, JSON.stringify(encrypted, null, 2), 'utf-8');\n}\n\nexport function obterConfigInstalacao(installationId: number): InstallationConfig {\n  const all = loadAll();\n  const key = String(installationId);\n  return all[key] ?? {\n    installationId,\n    ...DEFAULT_CONFIG,\n    updatedAt: Date.now()\n  };\n}\n\nexport function salvarConfigInstalacao(\n  partial: Partial<InstallationConfig> & { installationId: number }\n): InstallationConfig {\n  const all = loadAll();\n  const key = String(partial.installationId);\n  const atual = all[key] ?? {\n    installationId: partial.installationId,\n    ...DEFAULT_CONFIG,\n    updatedAt: Date.now()\n  };\n  const merged: InstallationConfig = {\n    ...atual,\n    ...partial,\n    installationId: partial.installationId,\n    updatedAt: Date.now()\n  };\n  all[key] = merged;\n  saveAll(all);\n  return merged;\n}\n\nexport function listarConfigsInstalacao(): InstallationConfig[] {\n  return Object.values(loadAll()).sort((a, b) => b.updatedAt - a.updatedAt);\n}\n"]}

package/dist/app/github/app/issues-handler.d.ts

@@ -0,0 +1,4 @@
+import type { App } from '@octokit/app';
+import type { IssuesPayload } from '../../../types/github/app.js';
+export declare function processarIssues(app: App, payload: IssuesPayload): Promise<void>;
+//# sourceMappingURL=issues-handler.d.ts.map

package/dist/app/github/app/issues-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues-handler.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/issues-handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAIxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAOlE,wBAAsB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDrF"}

package/dist/app/github/app/issues-handler.js

@@ -0,0 +1,85 @@
+import { GithubWebhookMensagens } from '../../../core/messages/index.js';
+import { statsStore } from '../dashboard/stats-store.js';
+import { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';
+const TRIGGER_TOKEN = '@mahoraga scan';
+const MAX_DETALHES = 10;
+export async function processarIssues(app, payload) {
+    const { repository, issue, installation, action } = payload;
+    if (action !== 'opened')
+        return;
+    if (!installation?.id)
+        return;
+    const issueBody = (issue.body || '').toLowerCase();
+    if (!issueBody.includes(TRIGGER_TOKEN))
+        return;
+    const owner = repository.owner.login;
+    const repo = repository.name;
+    const issueNumber = issue.number;
+    const octokit = await app.getInstallationOctokit(installation.id);
+    try {
+        const { data: repoInfo } = await octokit.request('GET /repos/{owner}/{repo}', { owner, repo });
+        const defaultBranch = repoInfo.default_branch;
+        const workflows = await buscarWorkflows(octokit, owner, repo, defaultBranch);
+        if (workflows.length === 0) {
+            await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+                owner,
+                repo,
+                issue_number: issueNumber,
+                body: GithubWebhookMensagens.nenhumWorkflowRepo
+            });
+            return;
+        }
+        const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(octokit, owner, repo, defaultBranch, workflows);
+        statsStore.recordAnalysis({
+            repository: `${owner}/${repo}`,
+            event: 'issues',
+            score: scoreGeral,
+            workflowsCount: workflows.length,
+            occurrencesCount: ocorrencias.length
+        });
+        const comment = renderIssuesComment(scoreGeral, workflowsInfo, ocorrencias);
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: issueNumber,
+            body: comment
+        });
+    }
+    catch (err) {
+        const error = err;
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: issueNumber,
+            body: GithubWebhookMensagens.erroScan(error.message)
+        });
+    }
+}
+function renderIssuesComment(scoreGeral, workflowsInfo, ocorrencias) {
+    let comment = `## Mahoraga - Scan Sob Demanda\n\n**Score Geral:** ${scoreGeral}/100\n\n`;
+    for (const wf of workflowsInfo) {
+        const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';
+        comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100, ${wf.ocorrencias} ocorrências)\n`;
+    }
+    if (ocorrencias.length > 0) {
+        const erros = ocorrencias.filter(o => o.nivel === 'erro');
+        const avisos = ocorrencias.filter(o => o.nivel === 'aviso');
+        if (erros.length > 0) {
+            comment += `\n#### Erros (${erros.length})\n\n`;
+            for (const o of erros.slice(0, MAX_DETALHES)) {
+                comment += `- \`${o.relPath}:${o.linha || 1}\` - ${o.mensagem}\n`;
+            }
+        }
+        if (avisos.length > 0) {
+            comment += `\n#### Avisos (${avisos.length})\n\n`;
+            for (const o of avisos.slice(0, MAX_DETALHES)) {
+                comment += `- \`${o.relPath}:${o.linha || 1}\` - ${o.mensagem}\n`;
+            }
+        }
+    }
+    else {
+        comment += `\nNenhum problema encontrado. Workflows em bom estado!\n`;
+    }
+    return comment;
+}
+//# sourceMappingURL=issues-handler.js.map

package/dist/app/github/app/issues-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues-handler.js","sourceRoot":"","sources":["../../../../src/app/github/app/issues-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAMxD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAQ,EAAE,OAAsB;IACpE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC5D,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO;IAChC,IAAI,CAAC,YAAY,EAAE,EAAE;QAAE,OAAO;IAC9B,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO;IAE/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;gBACjF,KAAK;gBACL,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,sBAAsB,CAAC,kBAAkB;aAChD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAC/C,CAAC;QACF,UAAU,CAAC,cAAc,CAAC;YACxB,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;YAC9B,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,gBAAgB,EAAE,WAAW,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAY,CAAC;QAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,aAA0E,EAC1E,WAAyB;IAEzB,IAAI,OAAO,GAAG,sDAAsD,UAAU,UAAU,CAAC;IACzF,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,OAAO,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,WAAW,iBAAiB,CAAC;IAClG,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,iBAAiB,KAAK,CAAC,MAAM,OAAO,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,kBAAkB,MAAM,CAAC,MAAM,OAAO,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,0DAA0D,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { GithubWebhookMensagens } from '@core/messages';\nimport type { App } from '@octokit/app';\n\nimport type { Ocorrencia } from '@';\n\nimport type { IssuesPayload } from '../../../types/github/app.js';\nimport { statsStore } from '../dashboard/stats-store.js';\nimport { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';\n\nconst TRIGGER_TOKEN = '@mahoraga scan';\nconst MAX_DETALHES = 10;\n\nexport async function processarIssues(app: App, payload: IssuesPayload): Promise<void> {\n  const { repository, issue, installation, action } = payload;\n  if (action !== 'opened') return;\n  if (!installation?.id) return;\n  const issueBody = (issue.body || '').toLowerCase();\n  if (!issueBody.includes(TRIGGER_TOKEN)) return;\n\n  const owner = repository.owner.login;\n  const repo = repository.name;\n  const issueNumber = issue.number;\n  const octokit = await app.getInstallationOctokit(installation.id);\n\n  try {\n    const { data: repoInfo } = await octokit.request('GET /repos/{owner}/{repo}', { owner, repo });\n    const defaultBranch = repoInfo.default_branch;\n    const workflows = await buscarWorkflows(octokit, owner, repo, defaultBranch);\n    if (workflows.length === 0) {\n      await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n        owner,\n        repo,\n        issue_number: issueNumber,\n        body: GithubWebhookMensagens.nenhumWorkflowRepo\n      });\n      return;\n    }\n\n    const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(\n      octokit, owner, repo, defaultBranch, workflows\n    );\n    statsStore.recordAnalysis({\n      repository: `${owner}/${repo}`,\n      event: 'issues',\n      score: scoreGeral,\n      workflowsCount: workflows.length,\n      occurrencesCount: ocorrencias.length\n    });\n\n    const comment = renderIssuesComment(scoreGeral, workflowsInfo, ocorrencias);\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: issueNumber,\n      body: comment\n    });\n  } catch (err: unknown) {\n    const error = err as Error;\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: issueNumber,\n      body: GithubWebhookMensagens.erroScan(error.message)\n    });\n  }\n}\n\nfunction renderIssuesComment(\n  scoreGeral: number,\n  workflowsInfo: Array<{ nome: string; score: number; ocorrencias: number }>,\n  ocorrencias: Ocorrencia[]\n): string {\n  let comment = `## Mahoraga - Scan Sob Demanda\\n\\n**Score Geral:** ${scoreGeral}/100\\n\\n`;\n  for (const wf of workflowsInfo) {\n    const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';\n    comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100, ${wf.ocorrencias} ocorrências)\\n`;\n  }\n  if (ocorrencias.length > 0) {\n    const erros = ocorrencias.filter(o => o.nivel === 'erro');\n    const avisos = ocorrencias.filter(o => o.nivel === 'aviso');\n    if (erros.length > 0) {\n      comment += `\\n#### Erros (${erros.length})\\n\\n`;\n      for (const o of erros.slice(0, MAX_DETALHES)) {\n        comment += `- \\`${o.relPath}:${o.linha || 1}\\` - ${o.mensagem}\\n`;\n      }\n    }\n    if (avisos.length > 0) {\n      comment += `\\n#### Avisos (${avisos.length})\\n\\n`;\n      for (const o of avisos.slice(0, MAX_DETALHES)) {\n        comment += `- \\`${o.relPath}:${o.linha || 1}\\` - ${o.mensagem}\\n`;\n      }\n    }\n  } else {\n    comment += `\\nNenhum problema encontrado. Workflows em bom estado!\\n`;\n  }\n  return comment;\n}\n"]}

package/dist/app/github/app/octokit.d.ts

@@ -0,0 +1,14 @@
+import type { App } from '@octokit/app';
+import type { RepositoryBase } from '../../../types/github/app.js';
+export type OctokitInstance = Awaited<ReturnType<InstanceType<typeof App>['getInstallationOctokit']>>;
+export declare const HTTP_OK = 200;
+export declare const HTTP_BAD_REQUEST = 400;
+export declare const HTTP_NOT_FOUND = 404;
+export declare const HTTP_INTERNAL_ERROR = 500;
+export declare function repoBase(repo: {
+    owner: {
+        login?: string | null;
+    } | null;
+    name: string;
+}): RepositoryBase;
+//# sourceMappingURL=octokit.d.ts.map

package/dist/app/github/app/octokit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"octokit.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/octokit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;AAEtG,eAAO,MAAM,OAAO,MAAM,CAAC;AAC3B,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAC7B,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,cAAc,CAEjB"}

package/dist/app/github/app/octokit.js

@@ -0,0 +1,8 @@
+export const HTTP_OK = 200;
+export const HTTP_BAD_REQUEST = 400;
+export const HTTP_NOT_FOUND = 404;
+export const HTTP_INTERNAL_ERROR = 500;
+export function repoBase(repo) {
+    return { owner: { login: repo.owner?.login ?? '' }, name: repo.name };
+}
+//# sourceMappingURL=octokit.js.map

package/dist/app/github/app/octokit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"octokit.js","sourceRoot":"","sources":["../../../../src/app/github/app/octokit.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,MAAM,UAAU,QAAQ,CAAC,IAGxB;IACC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport type { App } from '@octokit/app';\n\nimport type { RepositoryBase } from '../../../types/github/app.js';\n\nexport type OctokitInstance = Awaited<ReturnType<InstanceType<typeof App>['getInstallationOctokit']>>;\n\nexport const HTTP_OK = 200;\nexport const HTTP_BAD_REQUEST = 400;\nexport const HTTP_NOT_FOUND = 404;\nexport const HTTP_INTERNAL_ERROR = 500;\n\nexport function repoBase(repo: {\n  owner: { login?: string | null } | null;\n  name: string;\n}): RepositoryBase {\n  return { owner: { login: repo.owner?.login ?? '' }, name: repo.name };\n}\n"]}

package/dist/app/github/app/pr-review-handler.d.ts

@@ -0,0 +1,4 @@
+import type { App } from '@octokit/app';
+import type { PullRequestReviewPayload } from '../../../types/github/app.js';
+export declare function processarPullRequestReview(app: App, payload: PullRequestReviewPayload): Promise<void>;
+//# sourceMappingURL=pr-review-handler.d.ts.map

package/dist/app/github/app/pr-review-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-review-handler.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/pr-review-handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAO7E,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/app/github/app/pr-review-handler.js

@@ -0,0 +1,81 @@
+import { GithubWebhookMensagens } from '../../../core/messages/index.js';
+import { statsStore } from '../dashboard/stats-store.js';
+import { MAX_ANNOTATIONS } from './check-run-builder.js';
+import { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';
+const TRIGGER_TOKEN = '@mahoraga analyze';
+export async function processarPullRequestReview(app, payload) {
+    const { repository, pull_request, review, installation, action } = payload;
+    if (action !== 'submitted' || review.state !== 'commented')
+        return;
+    if (!installation?.id)
+        return;
+    const owner = repository.owner.login;
+    const repo = repository.name;
+    const headSha = pull_request.head.sha;
+    const prNumber = pull_request.number;
+    const reviewBody = (review.body || '').toLowerCase();
+    if (!reviewBody.includes(TRIGGER_TOKEN))
+        return;
+    const octokit = await app.getInstallationOctokit(installation.id);
+    try {
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: prNumber,
+            body: '[BUSCA] **Mahoraga** iniciando análise dos workflows...'
+        });
+        const workflows = await buscarWorkflows(octokit, owner, repo, headSha);
+        if (workflows.length === 0) {
+            await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+                owner,
+                repo,
+                issue_number: prNumber,
+                body: GithubWebhookMensagens.nenhumWorkflow
+            });
+            return;
+        }
+        const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(octokit, owner, repo, headSha, workflows);
+        statsStore.recordAnalysis({
+            repository: `${owner}/${repo}`,
+            event: 'pull_request_review',
+            score: scoreGeral,
+            workflowsCount: workflows.length,
+            occurrencesCount: ocorrencias.length
+        });
+        const comment = renderReviewComment(scoreGeral, workflowsInfo, ocorrencias);
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: prNumber,
+            body: comment
+        });
+    }
+    catch (err) {
+        const error = err;
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: prNumber,
+            body: `Erro na análise: \`${error.message}\``
+        });
+    }
+}
+function renderReviewComment(scoreGeral, workflowsInfo, ocorrencias) {
+    let comment = `## Mahoraga - Análise Sob Demanda\n\n`;
+    comment += `**Score Geral:** ${scoreGeral}/100\n\n`;
+    for (const wf of workflowsInfo) {
+        const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';
+        comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100)\n`;
+    }
+    if (ocorrencias.length > 0) {
+        comment += `\n### Ocorrências (${ocorrencias.length})\n\n`;
+        for (const o of ocorrencias.slice(0, MAX_ANNOTATIONS)) {
+            comment += `- **${o.nivel?.toUpperCase() || 'INFO'}**: \`${o.relPath}:${o.linha || 1}\` - ${o.mensagem}\n`;
+        }
+    }
+    else {
+        comment += `\nNenhuma ocorrência encontrada.\n`;
+    }
+    return comment;
+}
+//# sourceMappingURL=pr-review-handler.js.map

package/dist/app/github/app/pr-review-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-review-handler.js","sourceRoot":"","sources":["../../../../src/app/github/app/pr-review-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAQ,EACR,OAAiC;IAEjC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO;IACnE,IAAI,CAAC,YAAY,EAAE,EAAE;QAAE,OAAO;IAE9B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC;IACrC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO;IAEhD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,yDAAyD;SAChE,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;gBACjF,KAAK;gBACL,IAAI;gBACJ,YAAY,EAAE,QAAQ;gBACtB,IAAI,EAAE,sBAAsB,CAAC,cAAc;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CACzC,CAAC;QACF,UAAU,CAAC,cAAc,CAAC;YACxB,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;YAC9B,KAAK,EAAE,qBAAqB;YAC5B,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,gBAAgB,EAAE,WAAW,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAY,CAAC;QAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,sBAAsB,KAAK,CAAC,OAAO,IAAI;SAC9C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,aAAqD,EACrD,WAAyF;IAEzF,IAAI,OAAO,GAAG,uCAAuC,CAAC;IACtD,OAAO,IAAI,oBAAoB,UAAU,UAAU,CAAC;IACpD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,OAAO,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,KAAK,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,sBAAsB,WAAW,CAAC,MAAM,OAAO,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,MAAM,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,IAAI,CAAC;QAC7G,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,oCAAoC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { GithubWebhookMensagens } from '@core/messages';\nimport type { App } from '@octokit/app';\n\nimport type { PullRequestReviewPayload } from '../../../types/github/app.js';\nimport { statsStore } from '../dashboard/stats-store.js';\nimport { MAX_ANNOTATIONS } from './check-run-builder.js';\nimport { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';\n\nconst TRIGGER_TOKEN = '@mahoraga analyze';\n\nexport async function processarPullRequestReview(\n  app: App,\n  payload: PullRequestReviewPayload\n): Promise<void> {\n  const { repository, pull_request, review, installation, action } = payload;\n  if (action !== 'submitted' || review.state !== 'commented') return;\n  if (!installation?.id) return;\n\n  const owner = repository.owner.login;\n  const repo = repository.name;\n  const headSha = pull_request.head.sha;\n  const prNumber = pull_request.number;\n  const reviewBody = (review.body || '').toLowerCase();\n  if (!reviewBody.includes(TRIGGER_TOKEN)) return;\n\n  const octokit = await app.getInstallationOctokit(installation.id);\n  try {\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: prNumber,\n      body: '[BUSCA] **Mahoraga** iniciando análise dos workflows...'\n    });\n\n    const workflows = await buscarWorkflows(octokit, owner, repo, headSha);\n    if (workflows.length === 0) {\n      await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n        owner,\n        repo,\n        issue_number: prNumber,\n        body: GithubWebhookMensagens.nenhumWorkflow\n      });\n      return;\n    }\n\n    const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(\n      octokit, owner, repo, headSha, workflows\n    );\n    statsStore.recordAnalysis({\n      repository: `${owner}/${repo}`,\n      event: 'pull_request_review',\n      score: scoreGeral,\n      workflowsCount: workflows.length,\n      occurrencesCount: ocorrencias.length\n    });\n\n    const comment = renderReviewComment(scoreGeral, workflowsInfo, ocorrencias);\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: prNumber,\n      body: comment\n    });\n  } catch (err: unknown) {\n    const error = err as Error;\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: prNumber,\n      body: `Erro na análise: \\`${error.message}\\``\n    });\n  }\n}\n\nfunction renderReviewComment(\n  scoreGeral: number,\n  workflowsInfo: Array<{ nome: string; score: number }>,\n  ocorrencias: Array<{ relPath: string; linha?: number; nivel?: string; mensagem: string }>\n): string {\n  let comment = `## Mahoraga - Análise Sob Demanda\\n\\n`;\n  comment += `**Score Geral:** ${scoreGeral}/100\\n\\n`;\n  for (const wf of workflowsInfo) {\n    const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';\n    comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100)\\n`;\n  }\n  if (ocorrencias.length > 0) {\n    comment += `\\n### Ocorrências (${ocorrencias.length})\\n\\n`;\n    for (const o of ocorrencias.slice(0, MAX_ANNOTATIONS)) {\n      comment += `- **${o.nivel?.toUpperCase() || 'INFO'}**: \\`${o.relPath}:${o.linha || 1}\\` - ${o.mensagem}\\n`;\n    }\n  } else {\n    comment += `\\nNenhuma ocorrência encontrada.\\n`;\n  }\n  return comment;\n}\n"]}

package/dist/app/github/app/repo-downloader.d.ts

@@ -0,0 +1,8 @@
+import type { App } from '@octokit/app';
+import type { RepoDownloadResult } from '../../../types/github/app.js';
+export declare function getInstallationToken(app: App, installationId: number): Promise<string>;
+export declare function downloadRepo(app: App, installationId: number, owner: string, repo: string, ref: string): Promise<RepoDownloadResult>;
+export declare function escreverAskpassScript(): string;
+export declare function limparAskpassScript(caminho: string): void;
+export declare function cloneRepo(app: App, installationId: number, owner: string, repo: string, ref: string): Promise<RepoDownloadResult>;
+//# sourceMappingURL=repo-downloader.d.ts.map

package/dist/app/github/app/repo-downloader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-downloader.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/repo-downloader.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA0BvE,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK5F;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CA6D7B;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAK9C;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzD;AAoBD,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CA0C7B"}

package/dist/app/github/app/repo-downloader.js

@@ -0,0 +1,156 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { messages } from '../../../core/messages/index.js';
+const HTTP_REDIRECT = 302;
+const { GithubRepoDownloaderMensagens } = messages;
+const OWNER_REPO_RE = /^[a-zA-Z0-9_.-]+$/;
+const REF_RE = /^[a-zA-Z0-9_.\-/]+$/;
+function validarInput(valor, regex, nome) {
+    if (!regex.test(valor)) {
+        throw new Error(messages.ExcecoesMensagens.inputInvalido(nome));
+    }
+}
+function validarRedirectUrl(url) {
+    const parsed = new URL(url);
+    if (!parsed.hostname.endsWith('.github.com') && parsed.hostname !== 'github.com') {
+        throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);
+    }
+    if (!parsed.protocol.startsWith('https')) {
+        throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);
+    }
+    return parsed;
+}
+export async function getInstallationToken(app, installationId) {
+    const { data } = await app.octokit.request('POST /app/installations/{installation_id}/access_tokens', {
+        installation_id: installationId
+    });
+    return data.token;
+}
+export async function downloadRepo(app, installationId, owner, repo, ref) {
+    validarInput(owner, OWNER_REPO_RE, 'owner');
+    validarInput(repo, OWNER_REPO_RE, 'repo');
+    validarInput(ref, REF_RE, 'ref');
+    const tempDir = mkdtempSync(join(tmpdir(), 'mahoraga-repo-'));
+    const zipPath = join(tempDir, 'repo.zip');
+    try {
+        const octokit = await app.getInstallationOctokit(installationId);
+        const response = await octokit.request('GET /repos/{owner}/{repo}/zipball/{ref}', {
+            owner,
+            repo,
+            ref,
+            request: { redirect: 'manual' }
+        });
+        let zipBuffer;
+        if (response.status === HTTP_REDIRECT && response.headers.location) {
+            const redirectUrl = validarRedirectUrl(response.headers.location);
+            const token = await getInstallationToken(app, installationId);
+            const zipResponse = await fetch(redirectUrl, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            if (!zipResponse.ok) {
+                throw new Error(GithubRepoDownloaderMensagens.falhaBaixarZipball(zipResponse.status));
+            }
+            zipBuffer = Buffer.from(await zipResponse.arrayBuffer());
+        }
+        else if (Buffer.isBuffer(response.data)) {
+            zipBuffer = response.data;
+        }
+        else {
+            throw new Error(GithubRepoDownloaderMensagens.respostaInesperada);
+        }
+        writeFileSync(zipPath, zipBuffer);
+        execFileSync('unzip', ['-q', zipPath, '-d', tempDir], { stdio: 'pipe' });
+        rmSync(zipPath);
+        validarSemPathTraversal(tempDir);
+        const entries = readdirSync(tempDir);
+        const repoDirName = entries?.find(e => e !== 'repo.zip') ?? '';
+        if (!repoDirName) {
+            throw new Error(GithubRepoDownloaderMensagens.nenhumDiretorioEncontrado);
+        }
+        return {
+            tempDir,
+            repoDir: join(tempDir, repoDirName),
+            cleanup: () => {
+                try {
+                    rmSync(tempDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
+        };
+    }
+    catch (err) {
+        rmSync(tempDir, { recursive: true, force: true });
+        throw err;
+    }
+}
+export function escreverAskpassScript() {
+    const tmpScript = join(tmpdir(), `mahoraga-askpass-${Date.now()}.sh`);
+    writeFileSync(tmpScript, '#!/bin/sh\necho "$MAHORAGA_GIT_TOKEN"');
+    chmodSync(tmpScript, 0o500);
+    return tmpScript;
+}
+export function limparAskpassScript(caminho) {
+    try {
+        rmSync(caminho);
+    }
+    catch { }
+}
+function validarSemPathTraversal(dir) {
+    const pilha = [dir];
+    while (pilha.length > 0) {
+        const atual = pilha.pop();
+        if (!atual)
+            continue;
+        for (const entry of readdirSync(atual)) {
+            const caminhoCompleto = join(atual, entry);
+            if (!caminhoCompleto.startsWith(dir)) {
+                rmSync(dir, { recursive: true, force: true });
+                throw new Error(GithubRepoDownloaderMensagens.pathTraversalDetectado);
+            }
+            if (statSync(caminhoCompleto).isDirectory()) {
+                pilha.push(caminhoCompleto);
+            }
+        }
+    }
+}
+export async function cloneRepo(app, installationId, owner, repo, ref) {
+    validarInput(owner, OWNER_REPO_RE, 'owner');
+    validarInput(repo, OWNER_REPO_RE, 'repo');
+    validarInput(ref, REF_RE, 'ref');
+    const tempDir = mkdtempSync(join(tmpdir(), 'mahoraga-repo-'));
+    const repoDir = join(tempDir, 'repo');
+    const token = await getInstallationToken(app, installationId);
+    const askpassScript = escreverAskpassScript();
+    try {
+        execFileSync('git', ['clone', '--depth', '1', '--branch', ref,
+            `https://github.com/${owner}/${repo}.git`, repoDir], {
+            stdio: 'pipe',
+            timeout: 120000,
+            env: {
+                ...process.env,
+                MAHORAGA_GIT_TOKEN: token,
+                GIT_ASKPASS: askpassScript,
+                GIT_TERMINAL_PROMPT: '0'
+            }
+        });
+        return {
+            tempDir,
+            repoDir,
+            cleanup: () => {
+                limparAskpassScript(askpassScript);
+                try {
+                    rmSync(tempDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
+        };
+    }
+    catch (err) {
+        limparAskpassScript(askpassScript);
+        rmSync(tempDir, { recursive: true, force: true });
+        throw err;
+    }
+}
+//# sourceMappingURL=repo-downloader.js.map

package/dist/app/github/app/repo-downloader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-downloader.js","sourceRoot":"","sources":["../../../../src/app/github/app/repo-downloader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK1C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,EAAE,6BAA6B,EAAE,GAAG,QAAQ,CAAC;AAGnD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY;IAC9D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAQ,EAAE,cAAsB;IACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,yDAAyD,EAAE;QACpG,eAAe,EAAE,cAAc;KAChC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAQ,EACR,cAAsB,EACtB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,yCAAyC,EAAE;YAChF,KAAK;YACL,IAAI;YACJ,GAAG;YACH,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,SAAiB,CAAC;QACtB,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACxF,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QAED,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAGlC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,CAAC;QAGhB,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,yBAAyB,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YACnC,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,CAAC;oBAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtE,aAAa,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAClE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,sBAAsB,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,cAAsB,EACtB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAG9D,MAAM,aAAa,GAAG,qBAAqB,EAAE,CAAC;IAE9C,IAAI,CAAC;QACH,YAAY,CACV,KAAK,EACL,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;YACvC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,OAAO,CAAC,EACrD;YACE,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,MAAM;YACf,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,kBAAkB,EAAE,KAAK;gBACzB,WAAW,EAAE,aAAa;gBAC1B,mBAAmB,EAAE,GAAG;aACzB;SACF,CACF,CAAC;QAEF,OAAO;YACL,OAAO;YACP,OAAO;YACP,OAAO,EAAE,GAAG,EAAE;gBACZ,mBAAmB,CAAC,aAAa,CAAC,CAAC;gBACnC,IAAI,CAAC;oBAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { execFileSync } from 'node:child_process';\nimport { chmodSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\nimport { messages } from '@core/messages';\nimport type { App } from '@octokit/app';\n\nimport type { RepoDownloadResult } from '../../../types/github/app.js';\n\nconst HTTP_REDIRECT = 302;\nconst { GithubRepoDownloaderMensagens } = messages;\n\n// Expressões para validar owner/repo/ref - apenas caracteres seguros\nconst OWNER_REPO_RE = /^[a-zA-Z0-9_.-]+$/;\nconst REF_RE = /^[a-zA-Z0-9_.\\-/]+$/;\n\nfunction validarInput(valor: string, regex: RegExp, nome: string): void {\n  if (!regex.test(valor)) {\n    throw new Error(messages.ExcecoesMensagens.inputInvalido(nome));\n  }\n}\n\nfunction validarRedirectUrl(url: string): URL {\n  const parsed = new URL(url);\n  if (!parsed.hostname.endsWith('.github.com') && parsed.hostname !== 'github.com') {\n    throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);\n  }\n  if (!parsed.protocol.startsWith('https')) {\n    throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);\n  }\n  return parsed;\n}\n\nexport async function getInstallationToken(app: App, installationId: number): Promise<string> {\n  const { data } = await app.octokit.request('POST /app/installations/{installation_id}/access_tokens', {\n    installation_id: installationId\n  });\n  return data.token;\n}\n\nexport async function downloadRepo(\n  app: App,\n  installationId: number,\n  owner: string,\n  repo: string,\n  ref: string\n): Promise<RepoDownloadResult> {\n  validarInput(owner, OWNER_REPO_RE, 'owner');\n  validarInput(repo, OWNER_REPO_RE, 'repo');\n  validarInput(ref, REF_RE, 'ref');\n\n  const tempDir = mkdtempSync(join(tmpdir(), 'mahoraga-repo-'));\n  const zipPath = join(tempDir, 'repo.zip');\n\n  try {\n    const octokit = await app.getInstallationOctokit(installationId);\n\n    const response = await octokit.request('GET /repos/{owner}/{repo}/zipball/{ref}', {\n      owner,\n      repo,\n      ref,\n      request: { redirect: 'manual' }\n    });\n\n    let zipBuffer: Buffer;\n    if (response.status === HTTP_REDIRECT && response.headers.location) {\n      const redirectUrl = validarRedirectUrl(response.headers.location);\n      const token = await getInstallationToken(app, installationId);\n      const zipResponse = await fetch(redirectUrl, {\n        headers: { Authorization: `Bearer ${token}` }\n      });\n      if (!zipResponse.ok) {\n        throw new Error(GithubRepoDownloaderMensagens.falhaBaixarZipball(zipResponse.status));\n      }\n      zipBuffer = Buffer.from(await zipResponse.arrayBuffer());\n    } else if (Buffer.isBuffer(response.data)) {\n      zipBuffer = response.data;\n    } else {\n      throw new Error(GithubRepoDownloaderMensagens.respostaInesperada);\n    }\n\n    writeFileSync(zipPath, zipBuffer);\n\n    // Extrai o zip usando Node.js child_process com argument array (sem shell)\n    execFileSync('unzip', ['-q', zipPath, '-d', tempDir], { stdio: 'pipe' });\n    rmSync(zipPath);\n\n    // Valida que nenhum entry do zip escapou do diretório (Zip Slip protection)\n    validarSemPathTraversal(tempDir);\n\n    const entries = readdirSync(tempDir);\n    const repoDirName = entries?.find(e => e !== 'repo.zip') ?? '';\n    if (!repoDirName) {\n      throw new Error(GithubRepoDownloaderMensagens.nenhumDiretorioEncontrado);\n    }\n\n    return {\n      tempDir,\n      repoDir: join(tempDir, repoDirName),\n      cleanup: () => {\n        try { rmSync(tempDir, { recursive: true, force: true }); } catch { }\n      }\n    };\n  } catch (err) {\n    rmSync(tempDir, { recursive: true, force: true });\n    throw err;\n  }\n}\n\nexport function escreverAskpassScript(): string {\n  const tmpScript = join(tmpdir(), `mahoraga-askpass-${Date.now()}.sh`);\n  writeFileSync(tmpScript, '#!/bin/sh\\necho \"$MAHORAGA_GIT_TOKEN\"');\n  chmodSync(tmpScript, 0o500);\n  return tmpScript;\n}\n\nexport function limparAskpassScript(caminho: string): void {\n  try { rmSync(caminho); } catch { }\n}\n\nfunction validarSemPathTraversal(dir: string): void {\n  const pilha = [dir];\n  while (pilha.length > 0) {\n    const atual = pilha.pop();\n    if (!atual) continue;\n    for (const entry of readdirSync(atual)) {\n      const caminhoCompleto = join(atual, entry);\n      if (!caminhoCompleto.startsWith(dir)) {\n        rmSync(dir, { recursive: true, force: true });\n        throw new Error(GithubRepoDownloaderMensagens.pathTraversalDetectado);\n      }\n      if (statSync(caminhoCompleto).isDirectory()) {\n        pilha.push(caminhoCompleto);\n      }\n    }\n  }\n}\n\nexport async function cloneRepo(\n  app: App,\n  installationId: number,\n  owner: string,\n  repo: string,\n  ref: string\n): Promise<RepoDownloadResult> {\n  validarInput(owner, OWNER_REPO_RE, 'owner');\n  validarInput(repo, OWNER_REPO_RE, 'repo');\n  validarInput(ref, REF_RE, 'ref');\n\n  const tempDir = mkdtempSync(join(tmpdir(), 'mahoraga-repo-'));\n  const repoDir = join(tempDir, 'repo');\n  const token = await getInstallationToken(app, installationId);\n\n  // Usa GIT_ASKPASS em vez de token na URL para evitar vazamento em process listing\n  const askpassScript = escreverAskpassScript();\n\n  try {\n    execFileSync(\n      'git',\n      ['clone', '--depth', '1', '--branch', ref,\n        `https://github.com/${owner}/${repo}.git`, repoDir],\n      {\n        stdio: 'pipe',\n        timeout: 120000,\n        env: {\n          ...process.env,\n          MAHORAGA_GIT_TOKEN: token,\n          GIT_ASKPASS: askpassScript,\n          GIT_TERMINAL_PROMPT: '0'\n        }\n      }\n    );\n\n    return {\n      tempDir,\n      repoDir,\n      cleanup: () => {\n        limparAskpassScript(askpassScript);\n        try { rmSync(tempDir, { recursive: true, force: true }); } catch { }\n      }\n    };\n  } catch (err) {\n    limparAskpassScript(askpassScript);\n    rmSync(tempDir, { recursive: true, force: true });\n    throw err;\n  }\n}\n"]}

package/dist/app/github/app/server.d.ts

@@ -0,0 +1,3 @@
+import type { ServidorAppOptions } from '../../../types/index.js';
+export declare function iniciarServidorApp(opts: ServidorAppOptions): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/app/github/app/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/server.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,GAAG,CAAC;AAwD5C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkF1E"}