@oneuptime/common 13.0.0 → 13.0.1

package/Server/Services/WorkflowVariableService.ts

@@ -1,9 +1,212 @@
 import DatabaseService from "./DatabaseService";
+import { OnUpdate } from "../Types/Database/Hooks";
+import QueryHelper from "../Types/Database/QueryHelper";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import Typeof from "../../Types/Typeof";
 import Model from "../../Models/DatabaseModels/WorkflowVariable";
 
+/*
+ * isSecret is declared `string` over a genuinely boolean column, so the value
+ * that comes back is `true` from Postgres and can be the string "true" from a
+ * request body. Read exactly the way RunWorkflow.getSecretWorkflowVariableValues
+ * reads it, so what this service calls secret and what the run logs redact can
+ * never disagree.
+ */
+function isSecretValue(value: unknown): boolean {
+  return value === true || value === "true";
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /*
+   * @UniqueColumnBy(["workflowId", "projectId"]) on `name` is enforced by
+   * DatabaseService.checkUniqueColumnBy, which runs on create only - and there
+   * is no unique index on WorkflowVariable to catch what it misses. That was
+   * harmless while the dashboard offered no way to edit a variable. Now that it
+   * does, a rename is the one write that can put two rows with the same name in
+   * the same scope, and RunWorkflow.getVariables builds
+   * `storageMap.local.variables[variable.name] = variable.content` - a plain
+   * dictionary - so the second row would silently overwrite the first and
+   * {{local.variables.X}} would resolve to whichever the query happened to
+   * return last. Nothing would look broken; the workflow would just quietly run
+   * on the wrong value.
+   *
+   * Two things this cannot close, both shared with the create-side guard it
+   * mirrors: DatabaseService._updateBy skips every hook when props.ignoreHooks
+   * is set, and check-then-write is not atomic, so two concurrent renames onto
+   * the same free name can still both land. Closing either properly means a
+   * unique index on (projectId, workflowId, LOWER(name)), which needs a dedupe
+   * migration first because the racy create-side check may already have let
+   * duplicates through.
+   */
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    const rawName: unknown = updateBy.data.name;
+
+    /*
+     * Only an update that does not carry the column at all is exempt. An
+     * explicitly blank name is still a write to `name` - the column is
+     * nullable: false but the empty string satisfies that, and update does not
+     * re-run the required check - so two rows blanked in the same scope would
+     * both become "" and collide like any other duplicate. Let it through to
+     * the lookup rather than treating it as "no rename".
+     */
+    const isRename: boolean = rawName !== undefined && rawName !== null;
+
+    /*
+     * sanitizeUpdateData passes plain objects straight through, so `name` is
+     * whatever the request body said it was. Reject a non-string here rather
+     * than letting toLowerCase() throw a TypeError, which would surface as a
+     * 500 and a stack trace instead of a 400 naming the field.
+     */
+    if (isRename && typeof rawName !== Typeof.String) {
+      throw new BadDataException("Workflow variable name must be text.");
+    }
+
+    const newName: string = rawName as string;
+
+    /*
+     * Turning the secret flag OFF is the one direction that can expose
+     * something. isSecret decides whether RunWorkflow replaces this variable's
+     * value with [REDACTED] before a run log is persisted, and content itself
+     * is unreadable through the API - so a caller who may write a variable but
+     * may not read it could otherwise clear the flag, trigger a run, and read
+     * the value out of the log. Marking a variable secret stays freely
+     * available; unmarking one does not.
+     */
+    const isDeclassifying: boolean =
+      updateBy.data.isSecret !== undefined &&
+      updateBy.data.isSecret !== null &&
+      !isSecretValue(updateBy.data.isSecret);
+
+    if (!isRename && !isDeclassifying) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * Read the rows this update will actually touch. Two things about this
+     * query matter.
+     *
+     * It is scoped to the caller's tenant here rather than relying on the
+     * permission layer, because _updateBy runs this hook BEFORE
+     * ModelPermission.checkUpdateQueryPermissions - which is what appends the
+     * project clause. Reading unscoped-as-root would make this hook answer
+     * questions about another project's rows, and its refusal messages say
+     * whether a variable is global and whether a name is taken. A caller
+     * holding a variable id from a project they cannot see would get an oracle
+     * before any authorization ran.
+     *
+     * isRoot inside that scope is still right: the conflicting row may be one
+     * this caller cannot read - read access is label-gated - and a count that
+     * cannot see it reports zero and waves the duplicate through.
+     */
+    const tenantId: ObjectID | undefined = updateBy.props.tenantId;
+
+    const itemsBeingUpdated: Array<Model> = await this.findBy({
+      query: tenantId
+        ? { ...updateBy.query, projectId: tenantId }
+        : updateBy.query,
+      select: {
+        _id: true,
+        name: true,
+        isSecret: true,
+        projectId: true,
+        workflowId: true,
+      },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (isDeclassifying) {
+      for (const item of itemsBeingUpdated) {
+        if (isSecretValue(item.isSecret)) {
+          throw new BadDataException(
+            `"${item.name}" is marked secret, and a secret variable cannot be un-marked. Its value is redacted from workflow run logs, and clearing the flag would publish that value to the logs of every later run. Delete the variable and create it again if it should no longer be secret.`,
+          );
+        }
+      }
+    }
+
+    if (!isRename) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * Renaming two rows to one name is a conflict the database lookup below
+     * cannot see: neither collides with anything that exists yet, they collide
+     * with each other once both are written.
+     */
+    if (itemsBeingUpdated.length > 1) {
+      throw new BadDataException(
+        `Cannot rename ${itemsBeingUpdated.length} workflow variables to "${newName}" at once. Variable names must be unique.`,
+      );
+    }
+
+    for (const item of itemsBeingUpdated) {
+      /*
+       * A no-op rename must stay a no-op. Compared case-insensitively because
+       * that is how the uniqueness lookup compares, so "TOKEN" -> "token" is a
+       * change of casing on the same row and not a collision with itself.
+       */
+      if (item.name && item.name.toLowerCase() === newName.toLowerCase()) {
+        continue;
+      }
+
+      /*
+       * The scope is what makes the lookup mean anything. projectId comes back
+       * from the select above and is non-nullable on the table, so its absence
+       * means the select or the row is wrong - and a missing projectId would
+       * silently drop the clause and count this name across every project on
+       * the instance. Refuse rather than answer the wrong question.
+       */
+      if (!item.projectId) {
+        throw new BadDataException(
+          "This workflow variable cannot be renamed because it is not attached to a project.",
+        );
+      }
+
+      const conflictCount: number = (
+        await this.countBy({
+          query: {
+            name: QueryHelper.findWithSameText(newName),
+            projectId: item.projectId,
+            /*
+             * Global variables are the rows with a null workflowId, and they
+             * share a namespace of their own. Querying `workflowId: undefined`
+             * would drop the clause entirely and compare a global variable
+             * against every workflow-local one in the project.
+             */
+            workflowId: item.workflowId
+              ? item.workflowId
+              : QueryHelper.isNull(),
+            _id: QueryHelper.notEquals(item.id as ObjectID),
+          },
+          props: {
+            isRoot: true,
+          },
+        })
+      ).toNumber();
+
+      if (conflictCount > 0) {
+        throw new BadDataException(
+          item.workflowId
+            ? `A workflow variable named "${newName}" already exists on this workflow. Variable names must be unique within a workflow.`
+            : `A global variable named "${newName}" already exists in this project. Global variable names must be unique.`,
+        );
+      }
+    }
+
+    return { updateBy, carryForward: null };
+  }
 }
 export default new Service();

package/Server/Types/Billing/MeteredPlan/ActiveMonitoringMeteredPlan.ts

@@ -9,6 +9,9 @@ import ObjectID from "../../../../Types/ObjectID";
 import PositiveNumber from "../../../../Types/PositiveNumber";
 import Project from "../../../../Models/DatabaseModels/Project";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService, {
+  LiveUsageAuthorization,
+} from "../../../Services/PayAsYouGoBillingService";
 
 export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
   @CaptureSpan()
@@ -44,6 +47,19 @@ export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
       },
     });
 
+    /*
+     * This runs on every monitor create and delete, so each live check here
+     * is a payment-provider read on a request path. Check once, and hand the
+     * answer to the usage write instead of letting it read the same payment
+     * setup again a moment later.
+     */
+    const liveAuthorization: LiveUsageAuthorization | null =
+      await PayAsYouGoBillingService.authorizeUsageNow(projectId);
+
+    if (!liveAuthorization) {
+      return;
+    }
+
     // update this count in project as well.
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
@@ -67,6 +83,7 @@ export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
           (project.paymentProviderMeteredSubscriptionId as string),
         this,
         count.toNumber(),
+        { liveAuthorization: liveAuthorization },
       );
     }
   }

package/Server/Types/Billing/MeteredPlan/TelemetryMeteredPlan.ts

@@ -8,6 +8,9 @@ import ObjectID from "../../../../Types/ObjectID";
 import Project from "../../../../Models/DatabaseModels/Project";
 import TelemetryUsageBilling from "../../../../Models/DatabaseModels/TelemetryUsageBilling";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService, {
+  LiveUsageAuthorization,
+} from "../../../Services/PayAsYouGoBillingService";
 
 export default class TelemetryMeteredPlan extends ServerMeteredPlan {
   private _productType!: ProductType;
@@ -54,11 +57,37 @@ export default class TelemetryMeteredPlan extends ServerMeteredPlan {
       meteredPlanSubscriptionId?: string | undefined;
     },
   ): Promise<void> {
-    // get all unreported logs
+    /*
+     * One live read of the payment setup for the whole report. Staging and the
+     * usage write each used to repeat it seconds later, for every product type
+     * of every project in the billing pass; they are handed this one instead,
+     * and still check live when it is not for this project or has aged out.
+     */
+    const liveAuthorization: LiveUsageAuthorization | null =
+      await PayAsYouGoBillingService.authorizeUsageNow(projectId);
+
+    if (!liveAuthorization) {
+      await TelemetryUsageBillingService.waiveUnreportedUsageBilling({
+        projectId: projectId,
+        productType: this.productType,
+      });
+      return;
+    }
+
+    const billingStartsAt: Date | undefined =
+      await PayAsYouGoBillingService.getTelemetryBillingStartDate(projectId);
+    if (billingStartsAt) {
+      await TelemetryUsageBillingService.waiveUnreportedUsageBilling({
+        projectId: projectId,
+        productType: this.productType,
+        before: billingStartsAt,
+      });
+    }
 
     await TelemetryUsageBillingService.stageTelemetryUsageForProject({
       projectId: projectId,
       productType: this.productType,
+      liveAuthorization: liveAuthorization,
     });
 
     const usageBillings: Array<TelemetryUsageBilling> =
@@ -119,6 +148,7 @@ export default class TelemetryMeteredPlan extends ServerMeteredPlan {
           (project.paymentProviderMeteredSubscriptionId as string),
         this,
         totalCostInCents,
+        { liveAuthorization: liveAuthorization },
       );
 
       for (const usageBilling of usageBillings) {

package/Server/Utils/CodeRepository/GitHub/GitHub.ts

@@ -398,6 +398,13 @@ export default class GitHubUtil extends HostedCodeRepository {
       permissions?: {
         contents?: "read" | "write";
         pull_requests?: "read" | "write";
+        /*
+         * Issue READ/WRITE for the interactive app: GitHub routes pull
+         * request CONVERSATION comments through the issues API, so posting
+         * the app's acknowledgement on a pull request needs this scope just
+         * as much as answering a mention on an issue does.
+         */
+        issues?: "read" | "write";
         /*
          * Check-run READ access for the Tier 1 CI verification sweep. The
          * GitHub App must have the "Checks: Read-only" permission configured

package/Server/Utils/CodeRepository/GitHub/GitHubAgentTaskTrigger.ts

@@ -0,0 +1,341 @@
+import ObjectID from "../../../../Types/ObjectID";
+import AIRunType from "../../../../Types/AI/AIRunType";
+import AIRunStatus, {
+  AIRunStatusHelper,
+} from "../../../../Types/AI/AIRunStatus";
+import CodeFixTaskType, {
+  CodeFixTaskTypeHelper,
+} from "../../../../Types/AI/CodeFixTaskType";
+import CodeFixTaskContext, {
+  getGitHubConversationNumber,
+  getGitHubTaskContext,
+  GitHubTaskContext,
+} from "../../../../Types/AI/CodeFixTaskContext";
+import GitHubCommandType from "../../../../Types/CodeRepository/GitHubCommand";
+import { LIMIT_PER_PROJECT } from "../../../../Types/Database/LimitMax";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import OneUptimeDate from "../../../../Types/Date";
+import AIRun from "../../../../Models/DatabaseModels/AIRun";
+import AIRunService from "../../../Services/AIRunService";
+import FixRunBudget from "../../AI/CodeFix/FixRunBudget";
+import QueryHelper from "../../../Types/Database/QueryHelper";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+
+/*
+ * Turns a GitHub command that has ALREADY been verified — signed webhook,
+ * repository bound to the project, commenter holds write access — into a
+ * queued CodeFix AIRun the agent worker can claim.
+ *
+ * The sibling of SubjectCodeFixRun for conversations instead of incidents. It
+ * enforces the same two things every enqueue path must: the project's daily
+ * fix-run budget, and at most one live run per piece of work. What is
+ * different is the dedupe key. An incident dedupes on its subject row; a
+ * GitHub command has no row, so the key is (repository, issue-or-pull-request,
+ * command) — which is exactly the granularity a user expects: asking for a
+ * review while a revision is running is two different requests, asking for the
+ * same review twice is one.
+ */
+export default class GitHubAgentTaskTrigger {
+  // Which recipe carries out each command. Conversational commands have none.
+  public static getTaskTypeForCommand(
+    commandType: GitHubCommandType,
+  ): CodeFixTaskType | null {
+    switch (commandType) {
+      case GitHubCommandType.Implement:
+        return CodeFixTaskType.GitHubIssueFix;
+      case GitHubCommandType.Revise:
+        return CodeFixTaskType.GitHubPullRequestRevision;
+      case GitHubCommandType.Review:
+        return CodeFixTaskType.GitHubPullRequestReview;
+      default:
+        return null;
+    }
+  }
+
+  /*
+   * The live run, if any, for this exact piece of work.
+   *
+   * The conversation number lives inside the JSON taskContext, which the query
+   * layer cannot filter on — so this reads the project's non-terminal GitHub
+   * runs (bounded and short-lived: they exist only between a comment and its
+   * pull request) and matches in memory. The same honest trade
+   * SubjectCodeFixRun makes for its per-trace and per-service guards.
+   */
+  @CaptureSpan()
+  public static async findNonTerminalRunForConversation(data: {
+    projectId: ObjectID;
+    codeRepositoryId: ObjectID;
+    conversationNumber: number;
+    taskType: CodeFixTaskType;
+  }): Promise<AIRun | null> {
+    const activeRuns: Array<AIRun> = await AIRunService.findBy({
+      query: {
+        projectId: data.projectId,
+        runType: AIRunType.CodeFix,
+        codeFixTaskType: data.taskType,
+        status: QueryHelper.notIn(AIRunStatusHelper.terminalStatuses()),
+      },
+      select: { _id: true, taskContext: true },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: { isRoot: true },
+    });
+
+    return (
+      activeRuns.find((run: AIRun): boolean => {
+        const github: GitHubTaskContext | null = getGitHubTaskContext(
+          run.taskContext,
+        );
+
+        if (!github) {
+          return false;
+        }
+
+        return (
+          github.codeRepositoryId === data.codeRepositoryId.toString() &&
+          getGitHubConversationNumber(github) === data.conversationNumber
+        );
+      }) || null
+    );
+  }
+
+  /*
+   * Every live run for one conversation, whatever the recipe — what "@oneuptime
+   * cancel" acts on. A user cancelling a thread means "stop whatever you are
+   * doing here", not "stop the one recipe I happen to name".
+   */
+  @CaptureSpan()
+  public static async findNonTerminalRunsForConversation(data: {
+    projectId: ObjectID;
+    codeRepositoryId: ObjectID;
+    conversationNumber: number;
+  }): Promise<Array<AIRun>> {
+    const activeRuns: Array<AIRun> = await AIRunService.findBy({
+      query: {
+        projectId: data.projectId,
+        runType: AIRunType.CodeFix,
+        codeFixTaskType: QueryHelper.any(
+          CodeFixTaskTypeHelper.getGitHubTaskTypes(),
+        ),
+        status: QueryHelper.notIn(AIRunStatusHelper.terminalStatuses()),
+      },
+      select: { _id: true, taskContext: true, status: true },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: { isRoot: true },
+    });
+
+    return activeRuns.filter((run: AIRun): boolean => {
+      const github: GitHubTaskContext | null = getGitHubTaskContext(
+        run.taskContext,
+      );
+
+      if (!github) {
+        return false;
+      }
+
+      return (
+        github.codeRepositoryId === data.codeRepositoryId.toString() &&
+        getGitHubConversationNumber(github) === data.conversationNumber
+      );
+    });
+  }
+
+  /*
+   * Record the durable intent as a Queued CodeFix AIRun.
+   *
+   * Created as root: AIRun rows are server-written only (empty create ACL).
+   * The caller must already have established that this command is allowed —
+   * that the webhook signature verified, that the installation is bound to
+   * the project, and that the commenter can write to the repository.
+   *
+   * Throws BadDataException when a run for this work is already live or when
+   * the project is over its daily fix-run budget. The webhook handler turns
+   * both into a plain-English reply in the thread rather than a silent drop:
+   * a command that produces no visible response reads as a broken integration.
+   */
+  @CaptureSpan()
+  public static async enqueueGitHubCodeFixRun(data: {
+    projectId: ObjectID;
+    taskType: CodeFixTaskType;
+    github: GitHubTaskContext;
+  }): Promise<AIRun> {
+    if (!CodeFixTaskTypeHelper.isGitHubTaskType(data.taskType)) {
+      throw new BadDataException(
+        `${data.taskType} is not a GitHub-triggered task type.`,
+      );
+    }
+
+    const github: GitHubTaskContext | null = getGitHubTaskContext({
+      github: data.github,
+    } as CodeFixTaskContext);
+
+    if (!github) {
+      throw new BadDataException(
+        "A GitHub run needs a repository and exactly one issue or pull request.",
+      );
+    }
+
+    GitHubAgentTaskTrigger.assertTaskTypeMatchesContext(data.taskType, github);
+
+    const conversationNumber: number = getGitHubConversationNumber(github);
+
+    const existingRun: AIRun | null =
+      await GitHubAgentTaskTrigger.findNonTerminalRunForConversation({
+        projectId: data.projectId,
+        codeRepositoryId: new ObjectID(github.codeRepositoryId),
+        conversationNumber: conversationNumber,
+        taskType: data.taskType,
+      });
+
+    if (existingRun) {
+      throw new BadDataException(
+        "I am already working on this — I will comment here when I am done.",
+      );
+    }
+
+    await FixRunBudget.assertWithinBudget(data.projectId, {});
+
+    const run: AIRun = new AIRun();
+    run.projectId = data.projectId;
+    run.runType = AIRunType.CodeFix;
+    run.codeFixTaskType = data.taskType;
+    run.status = AIRunStatus.Queued;
+    run.taskContext = { github: github };
+
+    return AIRunService.create({
+      data: run,
+      props: { isRoot: true },
+    });
+  }
+
+  /*
+   * A queued run must be EXECUTABLE by the recipe it names.
+   *
+   * getGitHubTaskContext proves the context is well formed; it does not prove
+   * it matches the recipe. A revision with an issue-only context, or one with
+   * no head branch pinned, passes every other check and is then claimed by a
+   * worker that has nothing to push to — a run that was accepted, told the
+   * user "on it", and could never have succeeded. Catch it at the boundary,
+   * where the message can still be honest about what went wrong.
+   */
+  private static assertTaskTypeMatchesContext(
+    taskType: CodeFixTaskType,
+    github: GitHubTaskContext,
+  ): void {
+    if (taskType === CodeFixTaskType.GitHubIssueFix) {
+      if (github.issueNumber === undefined) {
+        throw new BadDataException(
+          "A GitHub issue task needs an issue to work on.",
+        );
+      }
+
+      return;
+    }
+
+    if (github.pullRequestNumber === undefined) {
+      throw new BadDataException(
+        "A GitHub pull request task needs a pull request to work on.",
+      );
+    }
+
+    /*
+     * Only a revision needs a branch. A review of a pull request from a fork
+     * deliberately has none — it works from the base branch plus the diff.
+     */
+    if (
+      taskType === CodeFixTaskType.GitHubPullRequestRevision &&
+      !github.pullRequestHeadRefName
+    ) {
+      throw new BadDataException(
+        "I cannot revise this pull request because its branch is not in this repository — it may come from a fork.",
+      );
+    }
+  }
+
+  /*
+   * Record the app's acknowledgement comment on the run, so a later status
+   * change edits that comment instead of posting another one.
+   *
+   * Written after the INSERT rather than as part of it because the comment
+   * cannot exist before the run does — the comment links to the run's page.
+   * A failure here is not worth failing the run over: the worst case is one
+   * extra comment when the run finishes.
+   *
+   * The stored context is re-read and merged rather than overwritten from the
+   * caller's in-memory copy. TypeORM replaces a jsonb column wholesale, so
+   * writing the caller's object would clobber anything another writer put
+   * there in between — a narrow window, but a lost update on a column the
+   * outcome sweeper also touches.
+   */
+  @CaptureSpan()
+  public static async recordAcknowledgementComment(data: {
+    aiRunId: ObjectID;
+    github: GitHubTaskContext;
+    acknowledgementCommentId: number;
+  }): Promise<void> {
+    const run: AIRun | null = await AIRunService.findOneById({
+      id: data.aiRunId,
+      select: { _id: true, taskContext: true },
+      props: { isRoot: true },
+    });
+
+    const storedContext: CodeFixTaskContext = run?.taskContext || {};
+
+    await AIRunService.updateOneById({
+      id: data.aiRunId,
+      data: {
+        taskContext: {
+          ...storedContext,
+          github: {
+            ...data.github,
+            ...(storedContext.github || {}),
+            acknowledgementCommentId: data.acknowledgementCommentId,
+          },
+        },
+      } as never,
+      props: { isRoot: true },
+    });
+  }
+
+  /*
+   * Cancel every live run for a conversation.
+   *
+   * A Queued run is cancelled outright — no worker holds it. A Running one is
+   * also marked Cancelled: the worker cannot be reached mid-run, but the CAS
+   * transitions on the reporting endpoints mean its late Completed/Error
+   * report simply loses the race and does not resurrect the run. The user gets
+   * the honest answer either way, which is why the count is returned.
+   */
+  @CaptureSpan()
+  public static async cancelRunsForConversation(data: {
+    projectId: ObjectID;
+    codeRepositoryId: ObjectID;
+    conversationNumber: number;
+  }): Promise<number> {
+    const runs: Array<AIRun> =
+      await GitHubAgentTaskTrigger.findNonTerminalRunsForConversation(data);
+
+    let cancelledCount: number = 0;
+
+    for (const run of runs) {
+      if (!run.id || !run.status) {
+        continue;
+      }
+
+      const transitioned: number = await AIRunService.attemptStatusTransition({
+        aiRunId: run.id,
+        fromStatus: run.status,
+        set: {
+          status: AIRunStatus.Cancelled,
+          completedAt: OneUptimeDate.getCurrentDate(),
+          errorMessage: "Cancelled from GitHub.",
+        },
+      });
+
+      cancelledCount += transitioned;
+    }
+
+    return cancelledCount;
+  }
+}