@oneuptime/common 11.5.4 → 11.5.6

package/Server/Utils/CodeRepository/GitHub/GitHub.ts

@@ -6,6 +6,10 @@ import HTTPResponse from "../../../../Types/API/HTTPResponse";
 import URL from "../../../../Types/API/URL";
 import PullRequest from "../../../../Types/CodeRepository/PullRequest";
 import PullRequestState from "../../../../Types/CodeRepository/PullRequestState";
+import FixPullRequestCiStatus, {
+  FixPullRequestCiCheckRunCounts,
+  FixPullRequestCiStatusHelper,
+} from "../../../../Types/AI/FixPullRequestCiStatus";
 import OneUptimeDate from "../../../../Types/Date";
 import { JSONArray, JSONObject } from "../../../../Types/JSON";
 import API from "../../../../Utils/API";
@@ -16,6 +20,7 @@ import {
   GitHubAppWebhookSecret,
 } from "../../../EnvironmentConfig";
 import BadDataException from "../../../../Types/Exception/BadDataException";
+import GlobalCache from "../../../Infrastructure/GlobalCache";
 import * as crypto from "crypto";
 
 /**
@@ -45,6 +50,11 @@ export interface GitHubInstallationToken {
   expiresAt: Date;
 }
 
+// Check-run counts for one ref plus the rolled-up conclusion.
+export interface GitHubCheckRunsSummary extends FixPullRequestCiCheckRunCounts {
+  conclusion: FixPullRequestCiStatus;
+}
+
 export default class GitHubUtil extends HostedCodeRepository {
   private getPullRequestFromJSONObject(data: {
     pullRequest: JSONObject;
@@ -357,6 +367,13 @@ export default class GitHubUtil extends HostedCodeRepository {
       permissions?: {
         contents?: "read" | "write";
         pull_requests?: "read" | "write";
+        /*
+         * Check-run READ access for the Tier 1 CI verification sweep. The
+         * GitHub App must have the "Checks: Read-only" permission configured
+         * or requesting this scope fails with 422 — callers that can degrade
+         * (the PR sync sweep) retry without it.
+         */
+        checks?: "read";
         metadata?: "read";
       };
     },
@@ -408,7 +425,7 @@ export default class GitHubUtil extends HostedCodeRepository {
         logger.error(
           `GitHub App permission error: ${errorMessage}. ` +
             `Please ensure the GitHub App is configured with the required permissions ` +
-            `(contents: write, pull_requests: write, metadata: read) in the GitHub App settings.`,
+            `(contents: write, pull_requests: write, metadata: read; checks: read for CI verification) in the GitHub App settings.`,
         );
       }
 
@@ -421,6 +438,225 @@ export default class GitHubUtil extends HostedCodeRepository {
     };
   }
 
+  /*
+   * Maps GitHub's pull-request JSON to our PullRequestState. GitHub reports
+   * merged PRs as state "closed" with merged_at set — merged must be checked
+   * first or every merge counts as a plain close.
+   */
+  public static mapGitHubPullRequestToState(
+    pullRequest: JSONObject,
+  ): PullRequestState {
+    if (pullRequest["merged_at"] || pullRequest["merged"] === true) {
+      return PullRequestState.Merged;
+    }
+
+    if (pullRequest["state"] === "closed") {
+      return PullRequestState.Closed;
+    }
+
+    return PullRequestState.Open;
+  }
+
+  // Fetches the current state of one pull request via the GitHub App installation.
+  @CaptureSpan()
+  public static async getPullRequestState(data: {
+    installationId: string;
+    organizationName: string;
+    repositoryName: string;
+    pullRequestNumber: number;
+  }): Promise<PullRequestState> {
+    const tokenData: GitHubInstallationToken =
+      await GitHubUtil.getInstallationAccessToken(data.installationId, {
+        permissions: {
+          pull_requests: "read",
+          metadata: "read",
+        },
+      });
+
+    return GitHubUtil.getPullRequestStateWithToken({
+      token: tokenData.token,
+      organizationName: data.organizationName,
+      repositoryName: data.repositoryName,
+      pullRequestNumber: data.pullRequestNumber,
+    });
+  }
+
+  /*
+   * Same as getPullRequestState but with a pre-minted installation token, so
+   * callers syncing many PRs in one repository can reuse a single token.
+   */
+  @CaptureSpan()
+  public static async getPullRequestStateWithToken(data: {
+    token: string;
+    organizationName: string;
+    repositoryName: string;
+    pullRequestNumber: number;
+  }): Promise<PullRequestState> {
+    const url: URL = URL.fromString(
+      `https://api.github.com/repos/${data.organizationName}/${data.repositoryName}/pulls/${data.pullRequestNumber}`,
+    );
+
+    const result: HTTPErrorResponse | HTTPResponse<JSONObject> = await API.get({
+      url: url,
+      headers: {
+        Authorization: `Bearer ${data.token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+      },
+    });
+
+    if (result instanceof HTTPErrorResponse) {
+      throw result;
+    }
+
+    return GitHubUtil.mapGitHubPullRequestToState(result.data);
+  }
+
+  /*
+   * Check-run conclusions that count as PASSING when the run completes.
+   * "success" is obvious; "neutral" and "skipped" are conventionally passing
+   * (GitHub itself treats both as success for required checks). EVERYTHING
+   * else — failure, timed_out, cancelled, action_required, stale,
+   * startup_failure, or any future conclusion we have never seen — counts as
+   * FAILED: per gate G9 an unknown conclusion must read as unverified, never
+   * verified.
+   */
+  private static readonly passingCheckRunConclusions: Array<string> = [
+    "success",
+    "neutral",
+    "skipped",
+  ];
+
+  /*
+   * Counts a ref's check runs and rolls them into one conclusion
+   * (Tier 1 CI verification: we READ the customer's CI, we never re-run or
+   * gate it). A check run is pending until its status is "completed";
+   * roll-up order (no runs -> NoCiConfigured, any pending -> Pending, any
+   * failed -> Red, else Green) lives in FixPullRequestCiStatusHelper.
+   */
+  public static summarizeCheckRuns(
+    checkRuns: JSONArray,
+  ): GitHubCheckRunsSummary {
+    let completed: number = 0;
+    let failed: number = 0;
+    let pending: number = 0;
+
+    for (const checkRun of checkRuns) {
+      const run: JSONObject = checkRun as JSONObject;
+
+      if (run["status"] !== "completed") {
+        pending++;
+        continue;
+      }
+
+      completed++;
+
+      if (
+        !GitHubUtil.passingCheckRunConclusions.includes(
+          String(run["conclusion"]),
+        )
+      ) {
+        failed++;
+      }
+    }
+
+    const counts: FixPullRequestCiCheckRunCounts = {
+      total: checkRuns.length,
+      completed: completed,
+      failed: failed,
+      pending: pending,
+    };
+
+    return {
+      ...counts,
+      conclusion: FixPullRequestCiStatusHelper.rollUpConclusion(counts),
+    };
+  }
+
+  /*
+   * Fetches the check runs for a ref (the PR's head branch) via the GitHub
+   * App and rolls them up into one conclusion. Requires the App to have
+   * "Checks: Read-only" — the token is minted with checks: read.
+   */
+  @CaptureSpan()
+  public static async getCheckRunsConclusion(data: {
+    installationId: string;
+    organizationName: string;
+    repositoryName: string;
+    headRefName: string;
+  }): Promise<GitHubCheckRunsSummary> {
+    const tokenData: GitHubInstallationToken =
+      await GitHubUtil.getInstallationAccessToken(data.installationId, {
+        permissions: {
+          checks: "read",
+          metadata: "read",
+        },
+      });
+
+    return GitHubUtil.getCheckRunsConclusionWithToken({
+      token: tokenData.token,
+      organizationName: data.organizationName,
+      repositoryName: data.repositoryName,
+      headRefName: data.headRefName,
+    });
+  }
+
+  /*
+   * Same as getCheckRunsConclusion but with a pre-minted installation token
+   * (which must carry checks: read), so callers sweeping many PRs can reuse
+   * a single token per installation — the SyncPullRequestStates idiom.
+   */
+  @CaptureSpan()
+  public static async getCheckRunsConclusionWithToken(data: {
+    token: string;
+    organizationName: string;
+    repositoryName: string;
+    headRefName: string;
+  }): Promise<GitHubCheckRunsSummary> {
+    const allCheckRuns: JSONArray = [];
+    let page: number = 1;
+    let hasMore: boolean = true;
+
+    while (hasMore) {
+      /*
+       * GET commits/{ref}/check-runs resolves a branch name to its latest
+       * commit and returns the latest check run per check name
+       * (filter=latest is the API default) — exactly the conclusion a
+       * reviewer sees on the PR.
+       */
+      const url: URL = URL.fromString(
+        `https://api.github.com/repos/${data.organizationName}/${
+          data.repositoryName
+        }/commits/${encodeURIComponent(
+          data.headRefName,
+        )}/check-runs?per_page=100&page=${page}`,
+      );
+
+      const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
+        await API.get({
+          url: url,
+          headers: {
+            Authorization: `Bearer ${data.token}`,
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+          },
+        });
+
+      if (result instanceof HTTPErrorResponse) {
+        throw result;
+      }
+
+      const checkRuns: JSONArray =
+        (result.data["check_runs"] as JSONArray) || [];
+      allCheckRuns.push(...checkRuns);
+
+      hasMore = checkRuns.length === 100;
+      page++;
+    }
+
+    return GitHubUtil.summarizeCheckRuns(allCheckRuns);
+  }
+
   /**
    * Lists repositories accessible to a GitHub App installation
    * @param installationId - The GitHub App installation ID
@@ -487,6 +723,88 @@ export default class GitHubUtil extends HostedCodeRepository {
     return allRepositories;
   }
 
+  /**
+   * Lists every file (blob) path in a repository's tree at the given branch.
+   * Results are cached in GlobalCache for an hour because callers (e.g. the
+   * stack-trace repository resolver) may probe several repositories per
+   * exception and re-run often.
+   * @returns Array of repository-relative file paths
+   */
+  @CaptureSpan()
+  public static async getRepositoryTreePaths(data: {
+    installationId: string;
+    organizationName: string;
+    repositoryName: string;
+    branchName: string;
+  }): Promise<Array<string>> {
+    const cacheNamespace: string = "github-repo-tree";
+    const cacheKey: string = `${data.organizationName}/${data.repositoryName}@${data.branchName}`;
+
+    try {
+      const cachedPaths: Array<string> | null =
+        await GlobalCache.getStringArray(cacheNamespace, cacheKey);
+
+      if (cachedPaths !== null) {
+        return cachedPaths;
+      }
+    } catch (err) {
+      // Cache being unavailable must not block the tree fetch.
+      logger.debug(err);
+    }
+
+    const tokenData: GitHubInstallationToken =
+      await GitHubUtil.getInstallationAccessToken(data.installationId, {
+        permissions: {
+          contents: "read",
+          metadata: "read",
+        },
+      });
+
+    const url: URL = URL.fromString(
+      `https://api.github.com/repos/${data.organizationName}/${data.repositoryName}/git/trees/${data.branchName}?recursive=1`,
+    );
+
+    const result: HTTPErrorResponse | HTTPResponse<JSONObject> = await API.get({
+      url: url,
+      headers: {
+        Authorization: `Bearer ${tokenData.token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+      },
+    });
+
+    if (result instanceof HTTPErrorResponse) {
+      throw result;
+    }
+
+    if (result.data["truncated"] === true) {
+      logger.warn(
+        `GitHub tree for ${data.organizationName}/${data.repositoryName}@${data.branchName} is truncated - the repository is very large, so path matching may be incomplete.`,
+      );
+    }
+
+    const tree: JSONArray = (result.data["tree"] as JSONArray) || [];
+    const paths: Array<string> = [];
+
+    for (const entry of tree) {
+      const entryData: JSONObject = entry as JSONObject;
+
+      if (entryData["type"] === "blob" && entryData["path"]) {
+        paths.push(entryData["path"] as string);
+      }
+    }
+
+    try {
+      await GlobalCache.setStringArray(cacheNamespace, cacheKey, paths, {
+        expiresInSeconds: 60 * 60, // 1 hour
+      });
+    } catch (err) {
+      logger.debug(err);
+    }
+
+    return paths;
+  }
+
   /**
    * Verifies a GitHub webhook signature
    * @param payload - The raw request body

package/Server/Utils/CodeRepository/ServiceRepoLinkSuggester.ts

@@ -0,0 +1,221 @@
+/*
+ * Deterministic name-matching between Service Catalog services and connected
+ * code repositories. Used at RUNTIME as a fallback when stack-trace path
+ * resolution can't pin the repository (see StackTraceRepoResolver). Pure
+ * functions — no persistence, no LLM — cheap, explainable, unit-testable.
+ */
+
+export interface SuggestableService {
+  id: string;
+  name: string;
+}
+
+export interface SuggestableRepository {
+  id: string;
+  // Display name in OneUptime.
+  name: string;
+  // Actual repository name on the git host (usually the strongest signal).
+  repositoryName: string;
+  organizationName: string;
+}
+
+export interface ExistingLinkPair {
+  serviceId: string;
+  codeRepositoryId: string;
+}
+
+export interface ServiceRepoLinkSuggestion {
+  serviceId: string;
+  serviceName: string;
+  codeRepositoryId: string;
+  codeRepositoryName: string;
+  repositoryFullName: string;
+  reason: string;
+  // 3 = exact name match, 2 = one name contains the other, 1 = token overlap.
+  score: number;
+}
+
+const MAX_SUGGESTIONS: number = 50;
+const MIN_CONTAINMENT_LENGTH: number = 4;
+const MIN_SHARED_TOKEN_LENGTH: number = 3;
+const MIN_TOKEN_JACCARD: number = 0.5;
+
+type NormalizeFunction = (value: string) => string;
+
+const normalize: NormalizeFunction = (value: string): string => {
+  return value.toLowerCase().replace(/[^a-z0-9]/g, "");
+};
+
+type TokenizeFunction = (value: string) => Set<string>;
+
+const tokenize: TokenizeFunction = (value: string): Set<string> => {
+  const withBoundaries: string = value
+    // camelCase / PascalCase boundaries become separators.
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2");
+
+  const tokens: Array<string> = withBoundaries
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter((token: string) => {
+      return token.length >= 2;
+    });
+
+  return new Set(tokens);
+};
+
+interface MatchResult {
+  score: number;
+  reason: string;
+}
+
+type MatchNamesFunction = (
+  serviceName: string,
+  repository: SuggestableRepository,
+) => MatchResult | null;
+
+const matchNames: MatchNamesFunction = (
+  serviceName: string,
+  repository: SuggestableRepository,
+): MatchResult | null => {
+  const normalizedService: string = normalize(serviceName);
+
+  if (!normalizedService) {
+    return null;
+  }
+
+  const candidateNames: Array<string> = [
+    repository.repositoryName,
+    repository.name,
+  ].filter(Boolean);
+
+  // Tier 1 — exact match after normalization.
+  for (const candidate of candidateNames) {
+    if (normalize(candidate) === normalizedService) {
+      return {
+        score: 3,
+        reason: `Service name matches the repository name "${candidate}"`,
+      };
+    }
+  }
+
+  // Tier 2 — one name contains the other (both reasonably long).
+  for (const candidate of candidateNames) {
+    const normalizedCandidate: string = normalize(candidate);
+
+    if (
+      normalizedCandidate.length >= MIN_CONTAINMENT_LENGTH &&
+      normalizedService.length >= MIN_CONTAINMENT_LENGTH
+    ) {
+      if (normalizedCandidate.includes(normalizedService)) {
+        return {
+          score: 2,
+          reason: `Repository name "${candidate}" contains the service name`,
+        };
+      }
+
+      if (normalizedService.includes(normalizedCandidate)) {
+        return {
+          score: 2,
+          reason: `Service name contains the repository name "${candidate}"`,
+        };
+      }
+    }
+  }
+
+  // Tier 3 — token overlap (checkout-service ↔ checkout, billing-api ↔ billing_api_v2).
+  const serviceTokens: Set<string> = tokenize(serviceName);
+
+  for (const candidate of candidateNames) {
+    const candidateTokens: Set<string> = tokenize(candidate);
+
+    if (serviceTokens.size === 0 || candidateTokens.size === 0) {
+      continue;
+    }
+
+    const shared: Array<string> = Array.from(serviceTokens).filter(
+      (token: string) => {
+        return candidateTokens.has(token);
+      },
+    );
+
+    const hasMeaningfulSharedToken: boolean = shared.some((token: string) => {
+      return token.length >= MIN_SHARED_TOKEN_LENGTH;
+    });
+
+    const unionSize: number =
+      serviceTokens.size + candidateTokens.size - shared.length;
+    const jaccard: number = unionSize === 0 ? 0 : shared.length / unionSize;
+
+    if (hasMeaningfulSharedToken && jaccard >= MIN_TOKEN_JACCARD) {
+      return {
+        score: 1,
+        reason: `Names share: ${shared.sort().join(", ")}`,
+      };
+    }
+  }
+
+  return null;
+};
+
+export type ComputeLinkSuggestionsFunction = (data: {
+  services: Array<SuggestableService>;
+  repositories: Array<SuggestableRepository>;
+  existingLinks: Array<ExistingLinkPair>;
+}) => Array<ServiceRepoLinkSuggestion>;
+
+export const computeLinkSuggestions: ComputeLinkSuggestionsFunction = (data: {
+  services: Array<SuggestableService>;
+  repositories: Array<SuggestableRepository>;
+  existingLinks: Array<ExistingLinkPair>;
+}): Array<ServiceRepoLinkSuggestion> => {
+  /*
+   * A service already linked anywhere is considered mapped — suggesting a
+   * second repo for it is more likely noise than help. Repositories stay
+   * eligible for many services (monorepos).
+   */
+  const linkedServiceIds: Set<string> = new Set(
+    data.existingLinks.map((link: ExistingLinkPair) => {
+      return link.serviceId;
+    }),
+  );
+
+  const suggestions: Array<ServiceRepoLinkSuggestion> = [];
+
+  for (const service of data.services) {
+    if (linkedServiceIds.has(service.id)) {
+      continue;
+    }
+
+    for (const repository of data.repositories) {
+      const match: MatchResult | null = matchNames(service.name, repository);
+
+      if (!match) {
+        continue;
+      }
+
+      suggestions.push({
+        serviceId: service.id,
+        serviceName: service.name,
+        codeRepositoryId: repository.id,
+        codeRepositoryName: repository.name,
+        repositoryFullName:
+          repository.organizationName && repository.repositoryName
+            ? `${repository.organizationName}/${repository.repositoryName}`
+            : repository.repositoryName || repository.name,
+        reason: match.reason,
+        score: match.score,
+      });
+    }
+  }
+
+  suggestions.sort(
+    (a: ServiceRepoLinkSuggestion, b: ServiceRepoLinkSuggestion) => {
+      if (b.score !== a.score) {
+        return b.score - a.score;
+      }
+      return a.serviceName.localeCompare(b.serviceName);
+    },
+  );
+
+  return suggestions.slice(0, MAX_SUGGESTIONS);
+};