@open-cr-agent/vcs-github 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -0,0 +1,3 @@
+# @open-cr-agent/vcs-github
+
+The adapter for GitHub pull requests of [Open-CR-Agent](https://github.com/jma49/Open-CR-Agent), the multi-agent code reviewer. Most users want [`@open-cr-agent/cli`](https://www.npmjs.com/package/@open-cr-agent/cli), which provides the `ocra` command and installs this package; see the [manual](https://ocra.majincheng.com). All `@open-cr-agent` packages are released together at one version. Apache-2.0.

package/dist/adapter.d.ts

@@ -0,0 +1,61 @@
+import { type ChangeRequest, type CodeMatch, type FileDiff, type PriorReview, type ReviewReport, type VcsAdapter } from "@open-cr-agent/core";
+import { type GitHubApi, type PullRequest } from "./client.js";
+export interface GitHubPullRequest {
+    owner: string;
+    repo: string;
+    number: number;
+}
+export type CodeSource = Pick<VcsAdapter, "getDiff" | "readFile" | "searchCode">;
+export interface History {
+    filesChangedSince(from: string, to: string): Promise<{
+        files: string[];
+    } | {
+        reason: string;
+    }>;
+}
+export interface GitHubAdapterOptions {
+    pullRequest: GitHubPullRequest;
+    api: GitHubApi;
+    code: CodeSource;
+    botLogin: string;
+    requestChanges?: boolean;
+    history?: History;
+    snapshot?: PullRequest;
+}
+export declare const DEFAULT_BOT_LOGIN = "github-actions[bot]";
+export declare function declinesFinding(reply: string): boolean;
+export declare class GitHubAdapter implements VcsAdapter {
+    private readonly options;
+    readonly name = "github";
+    private pullRequest;
+    private previous;
+    private reviewThreads;
+    private issueComments;
+    private readonly writers;
+    private prior;
+    constructor(options: GitHubAdapterOptions);
+    getChangeRequest(): Promise<ChangeRequest>;
+    private override;
+    private unedited;
+    private canWrite;
+    getDiff(): Promise<FileDiff[]>;
+    readFile(path: string): Promise<string | undefined>;
+    searchCode(literal: string): Promise<CodeMatch[]>;
+    getPriorReview(): Promise<PriorReview | undefined>;
+    private priorState;
+    private changesSince;
+    private repliesByPeople;
+    publish(report: ReviewReport): Promise<{
+        warnings: string[];
+    }>;
+    private syncChangeRequest;
+    private resolveFixedThreads;
+    private lastEditor;
+    private isBot;
+    private postReview;
+    private threads;
+    private pr;
+    private comments;
+    private summaryComment;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.js

@@ -0,0 +1,410 @@
+import { errorMessage, } from "@open-cr-agent/core";
+import { GitHubApiError, } from "./client.js";
+import { FINDING_MARKER, inlineComment, renderSummary } from "./render.js";
+import { readState, SUMMARY_MARKER } from "./state.js";
+export const DEFAULT_BOT_LOGIN = "github-actions[bot]";
+const OVERRIDE = /^\/ocra override ([0-9a-fA-F]{40}(?:[0-9a-fA-F]{24})?)\s+(\S.*)$/m;
+const MAX_OVERRIDE_REASON = 300;
+const MAX_REPLIES = 3;
+const MAX_REPLY_CHARS = 1_000;
+const DECLINE = /^(won['’]?t fix|wontfix|will not fix|by design|false positive|not a bug|working as intended|intended behaviou?r)(?=$|[\s.,;:!—–-])/i;
+const COMMAND = /^\/ocra dismiss\b/im;
+// A dismissal takes a clear decline: an explicit `/ocra dismiss`, or a reply
+// that opens with a decline and does not ask. Words anywhere else in a reply
+// ("this is not intended", "is this by design?", "acknowledged, will fix")
+// do not dismiss, since a dismissed finding leaves the verdict. Disagreement
+// ("I disagree") keeps the finding reported.
+export function declinesFinding(reply) {
+    if (COMMAND.test(reply))
+        return true;
+    const opening = reply
+        .trim()
+        .split(/(?<=[.!?])\s|\n/)[0]
+        ?.trim() ?? "";
+    return DECLINE.test(opening) && !opening.endsWith("?");
+}
+export class GitHubAdapter {
+    options;
+    name = "github";
+    pullRequest;
+    previous;
+    reviewThreads;
+    issueComments;
+    writers = new Map();
+    prior;
+    constructor(options) {
+        this.options = options;
+    }
+    async getChangeRequest() {
+        const pr = await this.pr();
+        const { owner, repo } = this.options.pullRequest;
+        const override = await this.override(pr);
+        return {
+            id: `${owner}/${repo}#${pr.number}`,
+            title: pr.title,
+            description: pr.body ?? "",
+            baseSha: pr.base.sha,
+            headSha: pr.head.sha,
+            ...(override ? { override } : {}),
+        };
+    }
+    // "Break glass": `/ocra override <commit> <reason>` from someone with
+    // write access other than the author lets a blocking verdict pass for that
+    // commit only, so a later push with new problems needs a new decision. The
+    // author can never overrule the review of their own change. Comments are
+    // best effort: without them there is simply no override.
+    async override(pr) {
+        const comments = await this.comments().catch(() => []);
+        const author = pr.user?.login;
+        let found;
+        for (const c of comments) {
+            const login = c.user?.login;
+            const match = OVERRIDE.exec(c.body);
+            if (!match || !login || login === author || this.isBot(login))
+                continue;
+            const [, commit = "", reason = ""] = match;
+            // The full commit id: a short prefix can be matched by a new commit.
+            if (commit.toLowerCase() !== pr.head.sha)
+                continue;
+            if (!(await this.unedited(c.node_id, login)) || !(await this.canWrite(login)))
+                continue;
+            found = { by: login, reason: reason.trim().slice(0, MAX_OVERRIDE_REASON) };
+        }
+        return found;
+    }
+    // Anyone with write access can edit anyone's comment, and GitHub keeps
+    // showing the original author: a command counts only when nobody else
+    // edited it. Unknown means no.
+    async unedited(nodeId, login) {
+        if (!nodeId)
+            return false;
+        try {
+            const editor = await this.options.api.commentEditor(nodeId);
+            return editor === undefined || editor === login;
+        }
+        catch {
+            return false;
+        }
+    }
+    // Write access from the repository's permissions, memoized per login;
+    // a failed lookup means no.
+    canWrite(login) {
+        let known = this.writers.get(login);
+        if (!known) {
+            known = this.options.api.canWrite(login).catch(() => false);
+            this.writers.set(login, known);
+        }
+        return known;
+    }
+    getDiff() {
+        return this.options.code.getDiff();
+    }
+    readFile(path) {
+        return this.options.code.readFile(path);
+    }
+    searchCode(literal) {
+        return this.options.code.searchCode(literal);
+    }
+    async getPriorReview() {
+        const prior = await this.priorState();
+        if ("untrusted" in prior)
+            return { findings: [], fullReviewReason: prior.untrusted };
+        const { state } = prior;
+        if (!state)
+            return undefined;
+        const { dismissed, replies } = await this.repliesByPeople(state.findings);
+        return {
+            findings: state.findings.map((f) => dismissed.has(f.fingerprint) ? { ...f, dismissed: true } : f),
+            ...(await this.changesSince(state)),
+            ...(state.tier ? { tier: state.tier } : {}),
+            ...(Object.keys(replies).length > 0 ? { replies } : {}),
+        };
+    }
+    // Anyone with write access can edit the summary comment, including a pull
+    // request's author. Every part of the state is then suspect: a head skips
+    // their next changes, a `commented` flag hides a finding from both the
+    // inline comments and the summary. So the state counts only when ocra was
+    // the last to edit the comment; otherwise the run starts over.
+    priorState() {
+        this.prior ??= (async () => {
+            const comment = await this.summaryComment();
+            const state = comment ? readState(comment.body) : undefined;
+            if (!comment || !state)
+                return {};
+            const editor = await this.lastEditor(comment);
+            if (editor === undefined) {
+                return { untrusted: "could not check who last edited the previous review's summary" };
+            }
+            if (!this.isBot(editor)) {
+                return { untrusted: "the previous review's summary was edited by someone else" };
+            }
+            return { state };
+        })();
+        return this.prior;
+    }
+    async changesSince(state) {
+        const { history } = this.options;
+        if (!state.head)
+            return { fullReviewReason: "the previous review did not record its commit" };
+        if (!history)
+            return { fullReviewReason: "no repository history to compare with" };
+        const head = (await this.pr()).head.sha;
+        const changed = await history.filesChangedSince(state.head, head);
+        if ("reason" in changed)
+            return { fullReviewReason: changed.reason };
+        return {
+            changedSince: {
+                head: state.head,
+                files: [...new Set([...changed.files, ...(state.pending ?? [])])],
+            },
+        };
+    }
+    // A thread of ocra's that a reviewer resolved, or answered with a clear
+    // "won't fix", dismisses its finding. A reviewer is someone with write
+    // access other than the pull request's author, in a comment nobody else
+    // edited: otherwise the author could resolve or argue a finding away. Any
+    // other reply from a reviewer dismisses nothing, but the judge weighs it
+    // when the finding comes back (and cannot drop a confirmed critical for
+    // it). Replies are collected for every thread of ocra's, not only tracked
+    // findings, so a finding a reply argued away does not return without it.
+    // Thread data is best effort: without it nothing is dismissed or replied.
+    async repliesByPeople(findings) {
+        const commented = new Set(findings.filter((f) => f.commented).map((f) => f.fingerprint));
+        const author = (await this.pr()).user?.login;
+        const reviewer = async (login) => login !== undefined && login !== author && !this.isBot(login) && (await this.canWrite(login));
+        const threads = await this.threads().catch(() => []);
+        const dismissed = new Set();
+        const replies = {};
+        for (const thread of threads) {
+            const [first, ...rest] = thread.comments;
+            const fingerprint = first && FINDING_MARKER.exec(first.body)?.[1];
+            if (!first || !fingerprint || !this.isBot(first.author))
+                continue;
+            const said = [];
+            let declined = false;
+            for (const r of rest) {
+                const own = r.editor === undefined || r.editor === r.author;
+                if (!own || !(await reviewer(r.author)))
+                    continue;
+                if (declinesFinding(r.body))
+                    declined = true;
+                else if (r.body.trim() !== "")
+                    said.push(r.body.trim().slice(0, MAX_REPLY_CHARS));
+            }
+            if (commented.has(fingerprint)) {
+                const resolved = thread.isResolved && (await reviewer(thread.resolvedBy));
+                if (resolved || declined) {
+                    dismissed.add(fingerprint);
+                    continue;
+                }
+            }
+            if (said.length > 0)
+                replies[fingerprint] = said.slice(-MAX_REPLIES);
+        }
+        return { dismissed, replies };
+    }
+    async publish(report) {
+        const { number } = this.options.pullRequest;
+        const pr = await this.pr();
+        const previous = await this.summaryComment();
+        const prior = await this.priorState();
+        const trusted = "state" in prior ? prior.state : undefined;
+        const before = trusted?.findings ?? [];
+        const alreadyCommented = new Set([
+            ...before.filter((f) => f.commented).map((f) => f.fingerprint),
+            ...(trusted?.posted ?? []),
+        ]);
+        const fresh = report.findings.flatMap((f) => {
+            if (alreadyCommented.has(f.fingerprint))
+                return [];
+            const comment = inlineComment(f);
+            return comment ? [{ fingerprint: f.fingerprint, comment }] : [];
+        });
+        const changeRequests = await this.syncChangeRequest(number, report);
+        const posted = await this.postReview(number, pr.head.sha, report, fresh, changeRequests.request);
+        const commented = new Set([...alreadyCommented, ...posted]);
+        const current = new Set(report.findings.map((f) => f.fingerprint));
+        const rereview = report.rereview;
+        const quiet = [
+            ...(rereview?.notReproduced ?? []),
+            ...(rereview?.notRechecked ?? []),
+            ...(rereview?.unchanged ?? []),
+            ...(rereview?.dismissed ?? []),
+        ];
+        // Low-confidence findings (--ultra) are shown, not counted; stored as
+        // ordinary findings they would count on the next push.
+        const state = [
+            ...report.findings
+                .filter((f) => !f.lowConfidence)
+                .map((f) => ({
+                fingerprint: f.fingerprint,
+                title: f.title,
+                file: f.file,
+                severity: f.severity,
+                commented: commented.has(f.fingerprint),
+                ...(f.quote ? { quote: f.quote } : {}),
+                ...(f.verification ? { verification: f.verification } : {}),
+            })),
+            ...quiet.filter((f) => !current.has(f.fingerprint)),
+        ];
+        const pending = report.coverage
+            .filter((c) => c.status === "failed" || c.status === "unreviewed")
+            .map((c) => c.path);
+        const tracked = new Set(state.map((f) => f.fingerprint));
+        const untracked = [...commented].filter((fp) => !tracked.has(fp));
+        const body = renderSummary({
+            report,
+            commented,
+            state: {
+                findings: state,
+                head: report.changeRequest.headSha,
+                pending,
+                tier: report.tier,
+                ...(untracked.length > 0 ? { posted: untracked } : {}),
+            },
+        });
+        if (previous)
+            await this.options.api.updateIssueComment(previous.id, body);
+        else
+            await this.options.api.createIssueComment(number, body);
+        return {
+            warnings: [
+                ...changeRequests.warnings,
+                ...(await changeRequests.withdraw()),
+                ...(await this.resolveFixedThreads(number, report)),
+            ],
+        };
+    }
+    // With requestChanges on, ocra's "changes requested" follows the verdict:
+    // requested once while it blocks, withdrawn (dismissed) once it no longer
+    // does. GitHub keeps a reviewer's last blocking review until it is
+    // dismissed, so otherwise a fixed pull request stayed blocked.
+    async syncChangeRequest(number, report) {
+        const none = { request: false, warnings: [], withdraw: async () => [] };
+        if (this.options.requestChanges !== true)
+            return none;
+        // An override lets the commit pass, so it lifts the request too.
+        const blocking = report.verdict === "significant_concerns" && report.changeRequest.override === undefined;
+        let active;
+        try {
+            active = (await this.options.api.listReviews(number))
+                .filter((r) => r.state === "CHANGES_REQUESTED" && r.user && this.isBot(r.user.login))
+                .map((r) => r.id);
+        }
+        catch (error) {
+            return {
+                request: blocking,
+                warnings: [`could not list earlier reviews: ${errorMessage(error)}`],
+                withdraw: async () => [],
+            };
+        }
+        if (blocking)
+            return { ...none, request: active.length === 0 };
+        return {
+            request: false,
+            warnings: [],
+            withdraw: async () => {
+                const warnings = [];
+                for (const id of active) {
+                    await this.options.api
+                        .dismissReview(number, id, `ocra: no blocking findings remain (verdict: ${report.verdict.replaceAll("_", " ")}).`)
+                        .catch((error) => warnings.push(`could not withdraw ocra's request for changes: ${errorMessage(error)}`));
+                }
+                return warnings;
+            },
+        };
+    }
+    // Resolving threads is a courtesy: the summary already lists what was
+    // fixed, so a failure here is a warning, not a failed publish.
+    async resolveFixedThreads(number, report) {
+        const fixed = new Set((report.rereview?.fixed ?? []).filter((f) => f.commented).map((f) => f.fingerprint));
+        if (fixed.size === 0)
+            return [];
+        try {
+            for (const thread of await this.threads()) {
+                const first = thread.comments[0];
+                const fingerprint = first && FINDING_MARKER.exec(first.body)?.[1];
+                if (thread.isResolved || !fingerprint || !fixed.has(fingerprint))
+                    continue;
+                if (!this.isBot(first.author))
+                    continue;
+                await this.options.api.resolveReviewThread(thread.id);
+            }
+            return [];
+        }
+        catch (error) {
+            return [`could not resolve the threads of fixed findings: ${errorMessage(error)}`];
+        }
+    }
+    // The account that last edited the comment (ocra itself when nobody did),
+    // or undefined when that cannot be told.
+    async lastEditor(comment) {
+        if (!comment.node_id)
+            return undefined;
+        try {
+            return (await this.options.api.commentEditor(comment.node_id)) ?? this.options.botLogin;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // REST names the Actions bot "github-actions[bot]", GraphQL "github-actions".
+    isBot(login) {
+        return login === this.options.botLogin || `${login}[bot]` === this.options.botLogin;
+    }
+    // Returns the fingerprints that now have inline comments. GitHub rejects
+    // positions outside its own diff with 422; those findings then stay in the
+    // summary instead of failing the publish.
+    async postReview(number, commitId, report, fresh, requestChanges) {
+        // GitHub rejects the whole review when one comment sits on a file it
+        // shows no diff for (too large, too many files); those go to the summary.
+        if (fresh.length > 0) {
+            const shown = await this.options.api.filesWithDiff(number).catch(() => undefined);
+            if (shown)
+                fresh = fresh.filter((f) => shown.has(f.comment.path));
+        }
+        if (fresh.length === 0 && !requestChanges)
+            return [];
+        const review = {
+            commit_id: commitId,
+            event: requestChanges ? "REQUEST_CHANGES" : "COMMENT",
+            body: `ocra: ${report.findings.length} finding(s); details in the summary comment.`,
+        };
+        try {
+            await this.options.api.createReview(number, {
+                ...review,
+                comments: fresh.map((f) => f.comment),
+            });
+            return fresh.map((f) => f.fingerprint);
+        }
+        catch (error) {
+            if (!(error instanceof GitHubApiError) || error.status !== 422)
+                throw error;
+            // The request for changes still matters; if GitHub refuses it too (for
+            // example on the token owner's own pull request), the summary remains.
+            if (requestChanges) {
+                await this.options.api.createReview(number, { ...review, comments: [] }).catch(() => { });
+            }
+            return [];
+        }
+    }
+    threads() {
+        this.reviewThreads ??= this.options.api.listReviewThreads(this.options.pullRequest.number);
+        return this.reviewThreads;
+    }
+    pr() {
+        this.pullRequest ??= this.options.snapshot
+            ? Promise.resolve(this.options.snapshot)
+            : this.options.api.getPullRequest(this.options.pullRequest.number);
+        return this.pullRequest;
+    }
+    comments() {
+        this.issueComments ??= this.options.api.listIssueComments(this.options.pullRequest.number);
+        return this.issueComments;
+    }
+    summaryComment() {
+        this.previous ??= this.comments().then((comments) => comments.findLast((c) => c.user?.login === this.options.botLogin && c.body.includes(SUMMARY_MARKER)));
+        return this.previous;
+    }
+}
+//# sourceMappingURL=adapter.js.map