@perrylink/dsh-github 0.6.2 → 0.6.4

package/scripts/action-post.mjs

@@ -1,61 +1,61 @@
-// Post-process the CI run for the composite action: publish the step outputs
-// from dsh-github-ci-result.json and enforce the blocking gate.
-//
-// Exit codes:
-//   0 — report exists and the gate passed (or the verdict is non-blocking).
-//   1 — report missing (the headless run never produced one), or
-//       blocking=true and the verdict is "needs-changes".
-// The status check itself (published by the pipeline) is what gates branch
-// protection; this exit code fails the CI job for blocking=false-style
-// workflow-level enforcement and for downstream status reporting.
-import { readFileSync, appendFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-// Local-machine protection: the post step reads the CI result from the output
-// directory and publishes step outputs through GITHUB_OUTPUT, both of which
-// only exist on a GitHub Actions runner. Outside a runner the fallback would
-// read an arbitrary `./dsh-github` directory next to the caller's cwd and
-// report phantom verdicts. Refuse to run instead of guessing.
-const runnerTemp = (process.env.RUNNER_TEMP ?? '').trim()
-const workspace = (process.env.GITHUB_WORKSPACE ?? '').trim()
-if (runnerTemp === '' || workspace === '') {
-  console.error('dsh-github: refusing to run outside a GitHub Actions runner — both RUNNER_TEMP and GITHUB_WORKSPACE must be set.')
-  console.error('dsh-github: to exercise the action locally, use `node scripts/local-test.mjs`; it pins DSH_HOME, DSH_PROFILE_DIR, and the output directory under the system temp directory.')
-  process.exit(1)
-}
-
-const outputDir = process.env.INPUT_OUTPUT_DIR?.trim() || join(process.env.RUNNER_TEMP ?? '.', 'dsh-github')
-const resultPath = join(outputDir, 'dsh-github-ci-result.json')
-const blocking = (process.env.INPUT_BLOCKING ?? 'true').trim() === 'true'
-const outputFile = process.env.GITHUB_OUTPUT ?? ''
-
-let result
-try {
-  result = JSON.parse(readFileSync(resultPath, 'utf8'))
-} catch (error) {
-  console.error(`dsh-github: no CI result at ${resultPath} — the headless run did not produce a review (${error instanceof Error ? error.message : String(error)}). Check the dsh stderr log next to it.`)
-  if (outputFile !== '') appendFileSync(outputFile, 'verdict=error\n')
-  process.exit(1)
-}
-
-const markdownPath = join(outputDir, 'dsh-github-ci-summary.md')
-const verdict = typeof result.verdict === 'string' ? result.verdict : 'error'
-if (outputFile !== '') {
-  appendFileSync(outputFile,
-    `verdict=${verdict}\n`
-    + `report-json=${resultPath}\n`
-    + `report-markdown=${markdownPath}\n`
-    + `${result.checkRun?.url !== undefined ? `check-url=${result.checkRun.url}\n` : ''}`)
-}
-
-console.log(`dsh-github: verdict ${verdict} — PR #${result.pr} in ${result.repo}${result.alreadyReviewed ? ' (already reviewed at this head commit)' : ''}`)
-console.log(`dsh-github: ${result.summary}`)
-
-if (blocking && verdict === 'needs-changes') {
-  console.error(`dsh-github: blocking gate failed — the review verdict is "needs-changes". See ${markdownPath}`)
-  process.exit(1)
-}
-if (verdict === 'error') {
-  console.error('dsh-github: the pipeline reported an error verdict')
-  process.exit(1)
-}
+// Post-process the CI run for the composite action: publish the step outputs
+// from dsh-github-ci-result.json and enforce the blocking gate.
+//
+// Exit codes:
+//   0 — report exists and the gate passed (or the verdict is non-blocking).
+//   1 — report missing (the headless run never produced one), or
+//       blocking=true and the verdict is "needs-changes".
+// The status check itself (published by the pipeline) is what gates branch
+// protection; this exit code fails the CI job for blocking=false-style
+// workflow-level enforcement and for downstream status reporting.
+import { readFileSync, appendFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+// Local-machine protection: the post step reads the CI result from the output
+// directory and publishes step outputs through GITHUB_OUTPUT, both of which
+// only exist on a GitHub Actions runner. Outside a runner the fallback would
+// read an arbitrary `./dsh-github` directory next to the caller's cwd and
+// report phantom verdicts. Refuse to run instead of guessing.
+const runnerTemp = (process.env.RUNNER_TEMP ?? '').trim()
+const workspace = (process.env.GITHUB_WORKSPACE ?? '').trim()
+if (runnerTemp === '' || workspace === '') {
+  console.error('dsh-github: refusing to run outside a GitHub Actions runner — both RUNNER_TEMP and GITHUB_WORKSPACE must be set.')
+  console.error('dsh-github: to exercise the action locally, use `node scripts/local-test.mjs`; it pins DSH_HOME, DSH_PROFILE_DIR, and the output directory under the system temp directory.')
+  process.exit(1)
+}
+
+const outputDir = process.env.INPUT_OUTPUT_DIR?.trim() || join(process.env.RUNNER_TEMP ?? '.', 'dsh-github')
+const resultPath = join(outputDir, 'dsh-github-ci-result.json')
+const blocking = (process.env.INPUT_BLOCKING ?? 'true').trim() === 'true'
+const outputFile = process.env.GITHUB_OUTPUT ?? ''
+
+let result
+try {
+  result = JSON.parse(readFileSync(resultPath, 'utf8'))
+} catch (error) {
+  console.error(`dsh-github: no CI result at ${resultPath} — the headless run did not produce a review (${error instanceof Error ? error.message : String(error)}). Check the dsh stderr log next to it.`)
+  if (outputFile !== '') appendFileSync(outputFile, 'verdict=error\n')
+  process.exit(1)
+}
+
+const markdownPath = join(outputDir, 'dsh-github-ci-summary.md')
+const verdict = typeof result.verdict === 'string' ? result.verdict : 'error'
+if (outputFile !== '') {
+  appendFileSync(outputFile,
+    `verdict=${verdict}\n`
+    + `report-json=${resultPath}\n`
+    + `report-markdown=${markdownPath}\n`
+    + `${result.checkRun?.url !== undefined ? `check-url=${result.checkRun.url}\n` : ''}`)
+}
+
+console.log(`dsh-github: verdict ${verdict} — PR #${result.pr} in ${result.repo}${result.alreadyReviewed ? ' (already reviewed at this head commit)' : ''}`)
+console.log(`dsh-github: ${result.summary}`)
+
+if (blocking && verdict === 'needs-changes') {
+  console.error(`dsh-github: blocking gate failed — the review verdict is "needs-changes". See ${markdownPath}`)
+  process.exit(1)
+}
+if (verdict === 'error') {
+  console.error('dsh-github: the pipeline reported an error verdict')
+  process.exit(1)
+}

package/scripts/check-endpoints.mjs

@@ -0,0 +1,48 @@
+// scripts/check-endpoints.mjs — M3 外部端点存活探测（Claude Code check-mcp-urls
+// 模式）：401/403/405/5xx = 存活（未带凭据的预期响应），仅 404/410/DNS/TLS/超时
+// = 失败。GitHub API 为插件声明的固定公共端点。
+import { request } from 'node:https'
+
+const ENDPOINTS = [
+  { name: 'GitHub API', url: 'https://api.github.com' },
+  { name: 'GitHub web', url: 'https://github.com' },
+]
+
+const TIMEOUT_MS = Number(process.env.TIMEOUT_MS ?? 15000)
+
+function probe(url) {
+  return new Promise((resolve) => {
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS)
+    const req = request(url, { method: 'GET', headers: { 'user-agent': 'dsh-endpoint-liveness/1.0' }, signal: controller.signal }, (res) => {
+      res.resume()
+      clearTimeout(timer)
+      resolve({ status: res.statusCode })
+    })
+    req.on('error', (error) => {
+      clearTimeout(timer)
+      const message = String(error?.message ?? error)
+      if (controller.signal.aborted) return resolve({ status: null, error: 'timeout' })
+      if (message.includes('ENOTFOUND')) return resolve({ status: null, error: 'DNS' })
+      if (/certificate|TLS|SSL|EPROTO/u.test(message)) return resolve({ status: null, error: 'TLS' })
+      resolve({ status: null, error: message })
+    })
+    req.end()
+  })
+}
+
+const failures = []
+for (const endpoint of ENDPOINTS) {
+  const result = await probe(endpoint.url)
+  const status = result.status
+  const alive = status === 200 || (status !== null && status >= 400 && status !== 404 && status !== 410)
+  const verdict = alive ? 'ALIVE' : 'FAIL'
+  console.log(`${verdict} ${String(status ?? result.error)} ${endpoint.name} ${endpoint.url}`)
+  if (!alive) failures.push(`${endpoint.name}: ${String(status ?? result.error)}`)
+}
+
+if (failures.length > 0) {
+  console.error(`\nendpoint liveness failed:\n- ${failures.join('\n- ')}`)
+  process.exit(1)
+}
+console.log(`\nendpoint liveness passed: ${ENDPOINTS.length} endpoint(s) alive`)

package/scripts/fix-dts.mjs

@@ -0,0 +1,39 @@
+// fix-dts.mjs — rewrite `.ts` relative specifiers to `.js` in emitted
+// declarations (lib/**/*.d.ts). TypeScript 5.9's
+// `rewriteRelativeImportExtensions` rewrites the JS emit but NOT the
+// declaration emit (verified empirically), so declaration consumers under
+// NodeNext resolution would fail on `.ts` specifiers. Node builtins only:
+// this runs inside the git-install `prepare` with production deps alone.
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..', 'lib')
+if (!existsSync(root)) {
+  console.log('fix-dts: no lib to rewrite')
+  process.exit(0)
+}
+
+let files = 0
+let rewrites = 0
+const rewrite = (dir) => {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) {
+      rewrite(full)
+    } else if (entry.name.endsWith('.d.ts')) {
+      const text = readFileSync(full, 'utf8')
+      const next = text.replace(
+        /((?:from\s+|import\()['"])(\.\.?\/[^'"]+?)(\.ts|\.tsx)(['"])/gu,
+        (match, prefix, specifier, ext, quote) => `${prefix}${specifier}.js${quote}`,
+      )
+      if (next !== text) {
+        writeFileSync(full, next)
+        files += 1
+        rewrites += (text.match(/(?:from\s+|import\()['"]\.\.?\/[^'"]+?\.tsx?['"]/gu) ?? []).length
+      }
+    }
+  }
+}
+rewrite(root)
+console.log(`fix-dts: ${files} file(s), ${rewrites} specifier(s) rewritten to .js`)