@norskvideo/ctl-dev-kit 0.2.26 → 0.2.27

package/conventions/bot-prs.yml

@@ -38,8 +38,9 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
+  checks: read
+  pull-requests: read
 
 concurrency:
   # One at a time per repo, and never cancelled: a merge half-done by a run that
@@ -54,18 +55,36 @@ jobs:
       - name: Merge green bot PRs, report red ones
         id: triage
         env:
-          GH_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          # Reads go through the job's own token, which the permissions above
+          # scope to exactly what is read; CI_DISPATCH_TOKEN (a PAT) has no
+          # Checks access, and the check-runs call returned an error object.
+          # Merges and branch deletes go through the PAT, because a push made
+          # with GITHUB_TOKEN does not trigger main's own workflows.
+          READ_TOKEN: ${{ github.token }}
+          WRITE_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           api="https://api.github.com/repos/$REPO"
-          gh_api() { curl -sS --retry 3 --retry-all-errors -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$@"; }
+          curl_as() { local tok="$1"; shift; curl -sS --retry 3 --retry-all-errors -H "Authorization: Bearer $tok" -H "Accept: application/vnd.github+json" "$@"; }
+          gh_api() { curl_as "$READ_TOKEN" "$@"; }
+          gh_write() { curl_as "$WRITE_TOKEN" "$@"; }
+          # An API error is a JSON object with a message; say what it was rather
+          # than letting jq fail later on a missing field.
+          expect() {
+            local what="$1" filter="$2" body="$3"
+            jq -e "$filter" >/dev/null 2>&1 <<<"$body" && return 0
+            echo "::error::$what: $(jq -r '.message // .' <<<"$body" 2>/dev/null || echo "$body")"
+            exit 1
+          }
 
           # The bots own exactly these branches (see each workflow's PR step).
-          prs="$(gh_api "$api/pulls?state=open&per_page=100" | jq -c --arg repo "$REPO" '
+          pulls="$(gh_api "$api/pulls?state=open&per_page=100")"
+          expect "listing open PRs" 'type == "array"' "$pulls"
+          prs="$(jq -c --arg repo "$REPO" '
             [.[] | select(.head.repo.full_name == $repo)
                  | select(.head.ref | test("^(upgrade-latest/|sync-dev-kit/|chore/sync-ctl-packages$)"))
-                 | {number, ref: .head.ref, sha: .head.sha, draft, url: .html_url}]')"
+                 | {number, ref: .head.ref, sha: .head.sha, draft, url: .html_url}]' <<<"$pulls")"
 
           red=()
           merged=()
@@ -73,6 +92,7 @@ jobs:
             [ -n "$pr" ] || continue
             n="$(jq -r .number <<<"$pr")"; ref="$(jq -r .ref <<<"$pr")"; sha="$(jq -r .sha <<<"$pr")"
             runs="$(gh_api "$api/commits/$sha/check-runs?per_page=100")"
+            expect "reading checks for #$n" '.check_runs | type == "array"' "$runs"
             failed="$(jq -r '[.check_runs[] | select(.conclusion | IN("failure","cancelled","timed_out","action_required","startup_failure")) | .name] | unique | join(", ")' <<<"$runs")"
             pending="$(jq -r '[.check_runs[] | select(.status != "completed")] | length' <<<"$runs")"
             passed="$(jq -r '[.check_runs[] | select(.conclusion == "success")] | length' <<<"$runs")"
@@ -89,12 +109,12 @@ jobs:
             if [ "$mergeable" != "true" ]; then red+=("#$n $ref: does not merge cleanly with main"); continue; fi
             # sha pins the merge to what was checked: a bot force-pushing the
             # branch meanwhile makes this refuse rather than land unchecked code.
-            res="$(gh_api -X PUT "$api/pulls/$n/merge" -d "$(jq -nc --arg sha "$sha" '{merge_method:"squash", sha:$sha}')")"
+            res="$(gh_write -X PUT "$api/pulls/$n/merge" -d "$(jq -nc --arg sha "$sha" '{merge_method:"squash", sha:$sha}')")"
             if [ "$(jq -r '.merged // false' <<<"$res")" = "true" ]; then
               merged+=("#$n")
               echo "merged #$n ($ref)"
               # The bots recreate their branch on the next bump.
-              gh_api -X DELETE "$api/git/refs/heads/$ref" -o /dev/null || true
+              gh_write -X DELETE "$api/git/refs/heads/$ref" -o /dev/null || true
             else
               red+=("#$n $ref: merge refused: $(jq -r '.message // "unknown"' <<<"$res")")
             fi
@@ -112,10 +132,13 @@ jobs:
           echo "detail=${detail%; }" >> "$GITHUB_OUTPUT"
 
       - name: Report to the product dashboard
+        # Always: a triage that broke is exactly what nobody would otherwise see.
+        if: always()
         env:
           TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
-          STATUS: ${{ steps.triage.outputs.state }}
-          DETAIL: ${{ steps.triage.outputs.detail }}
+          READ_TOKEN: ${{ github.token }}
+          STATUS: ${{ steps.triage.outputs.state || 'failure' }}
+          DETAIL: ${{ steps.triage.outputs.detail || 'the bot-PR triage itself failed; see the run' }}
           SHA: ${{ github.sha }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           REPO: ${{ github.repository }}
@@ -123,7 +146,7 @@ jobs:
           set -euo pipefail
           # The dashboard key is the one upgrade-latest.yml reports under, read
           # from it so this file can stay byte-identical across products.
-          product="$(curl -sS -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.github.raw" \
+          product="$(curl -sS -H "Authorization: Bearer $READ_TOKEN" -H "Accept: application/vnd.github.raw" \
             "https://api.github.com/repos/$REPO/contents/.github/workflows/upgrade-latest.yml" \
             | sed -nE 's/^[[:space:]]*product:[[:space:]]*([^[:space:]]+).*/\1/p' | head -1)"
           if [ -z "$product" ] || [ "$product" = "__PRODUCT__" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",