@polymorphism-tech/morph-spec 8.44.0 → 8.46.0

package/src/lib/ci/github-ci.js

@@ -0,0 +1,192 @@
+import { execFileSync, spawnSync } from 'child_process';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { resolveGh } from '../git/gh.js';
+
+export const CI_WORKFLOW_DIR = '.github/workflows';
+export const CI_WORKFLOW_FILE = 'morph-verify.yml';
+export const CI_ARTIFACT = 'morph-verify';
+export const CI_RESULT_FILE = 'morph-verify.json';
+
+// A run that never judged the code (superseded, filtered out, quota) is no proof either way.
+const NO_VERDICT = new Set(['cancelled', 'skipped', 'startup_failure', 'stale', 'neutral']);
+
+const VERIFY_CALL = /morph-spec\S*\s+verify\b/;
+
+const git = (cwd, args) => execFileSync('git', args, { cwd, stdio: 'pipe' }).toString();
+
+function gh(cwd, args, timeout = 15000) {
+  const { bin, prefix } = resolveGh();
+  return execFileSync(bin, [...prefix, ...args], { cwd, stdio: 'pipe', timeout }).toString();
+}
+
+/**
+ * The workflow that can stand in for `verify {feature}`: it must call `morph-spec verify` AND
+ * publish its JSON, because only that artifact becomes a stamp. A green run of any other
+ * workflow (lint, deploy) proves nothing about the suite.
+ *
+ * @param {string} root
+ * @returns {string|null} workflow file name, as `gh run list --workflow` takes it
+ */
+export function findCiWorkflow(root) {
+  const dir = join(root, CI_WORKFLOW_DIR);
+  if (!existsSync(dir)) return null;
+  const files = readdirSync(dir).filter((f) => /\.ya?ml$/i.test(f)).sort((a, b) =>
+    (a === CI_WORKFLOW_FILE ? -1 : b === CI_WORKFLOW_FILE ? 1 : a.localeCompare(b)));
+  for (const file of files) {
+    let text;
+    try {
+      text = readFileSync(join(dir, file), 'utf8');
+    } catch {
+      continue;
+    }
+    if (VERIFY_CALL.test(text) && text.includes(CI_RESULT_FILE)) return file;
+  }
+  return null;
+}
+
+export function currentBranch(root) {
+  try {
+    return git(root, ['rev-parse', '--abbrev-ref', 'HEAD']).trim();
+  } catch {
+    return null;
+  }
+}
+
+function originUrl(root) {
+  try {
+    return git(root, ['config', '--get', 'remote.origin.url']).trim();
+  } catch {
+    return null;
+  }
+}
+
+function ghAuthText(root) {
+  const { bin, prefix } = resolveGh();
+  const res = spawnSync(bin, [...prefix, 'auth', 'status'], { cwd: root, stdio: 'pipe', timeout: 10000 });
+  if (res.error || res.status !== 0) return null;
+  return `${res.stdout ?? ''}${res.stderr ?? ''}`;
+}
+
+/**
+ * Whether CI can answer for this feature, and why not. Never throws: every "no" is a reason the
+ * caller prints before falling back to the local verify.
+ *
+ * @param {string} root - the feature's tree
+ * @param {string} featureName
+ * @param {object|null} config - `.morph/config/config.json`
+ * @returns {{ ok: true, branch: string, https: boolean, scopes: string|null } | { ok: false, reason: string }}
+ */
+export function ciAvailability(root, featureName, config) {
+  if (config?.project?.ci === false) return { ok: false, reason: 'project.ci = false no config.json' };
+  const url = originUrl(root);
+  if (!url) return { ok: false, reason: 'sem remote origin' };
+  if (!/github\.com/i.test(url)) return { ok: false, reason: 'origin não é GitHub' };
+  const branch = currentBranch(root);
+  if (branch !== `morph/${featureName}`) {
+    return { ok: false, reason: `branch atual "${branch}" não é morph/${featureName}` };
+  }
+  const auth = ghAuthText(root);
+  if (auth === null) return { ok: false, reason: 'gh ausente ou não autenticado' };
+  const scopes = auth.match(/Token scopes:\s*(.*)/i)?.[1] ?? null;
+  return { ok: true, branch, https: /^https?:/i.test(url), scopes };
+}
+
+/**
+ * Creating a workflow file over HTTPS needs the token's `workflow` scope; without it GitHub
+ * rejects the whole push. Unknown scopes (fine-grained token, SSH remote) are not a refusal.
+ */
+export function workflowPushProblem({ https, scopes }) {
+  if (!https || scopes === null) return null;
+  return /\bworkflow\b/.test(scopes) ? null : 'o token do gh não tem o escopo "workflow" (gh auth refresh -s workflow)';
+}
+
+/**
+ * Paths CI would not see: uncommitted or untracked files outside `.morph/`, plus the config,
+ * which names the test commands.
+ *
+ * @returns {string[]|null} null when git did not answer
+ */
+export function uncommittedCode(root) {
+  let out;
+  try {
+    out = git(root, ['status', '--porcelain', '-z', '--untracked-files=all', '--no-renames']);
+  } catch {
+    return null;
+  }
+  return out.split('\0').filter(Boolean).map((line) => line.slice(3))
+    .filter((path) => !path.startsWith('.morph/') || path === '.morph/config/config.json');
+}
+
+export function pushBranch(root, branch) {
+  try {
+    git(root, ['push', '-u', 'origin', branch]);
+    return null;
+  } catch (err) {
+    return (err.stderr?.toString() || err.message).trim().split('\n').slice(-3).join(' ');
+  }
+}
+
+/** @returns {Array<object>|null} newest first; null = gh did not answer */
+export function listRuns(root, branch, workflow) {
+  try {
+    return JSON.parse(gh(root, ['run', 'list', '--branch', branch, '--workflow', workflow, '--limit', '20',
+      '--json', 'databaseId,status,conclusion,headSha,url,createdAt']));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The newest run over the same code as HEAD. `isCurrent` is a tree comparison, not SHA equality:
+ * the evaluator and the archive commit only `.morph/`, and the workflow does not re-run for them.
+ */
+export function pickRun(runs, isCurrent) {
+  return (runs || []).find((run) => !(run.status === 'completed' && NO_VERDICT.has(run.conclusion))
+    && run.headSha && isCurrent(run.headSha)) ?? null;
+}
+
+/** @returns {object|null} the parsed `verify --json` the run uploaded; null when absent or unreadable */
+export function downloadResult(root, runId) {
+  const dir = mkdtempSync(join(tmpdir(), 'morph-ci-'));
+  try {
+    gh(root, ['run', 'download', String(runId), '--name', CI_ARTIFACT, '--dir', dir], 120000);
+    return JSON.parse(readFileSync(join(dir, CI_RESULT_FILE), 'utf8'));
+  } catch {
+    return null;
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Polls until the run over the current tree completes. Never decides: the caller turns
+ * `timeout`/`no-run`/`unknown` into "no CI proof", never into red.
+ *
+ * @returns {Promise<{ state: 'completed'|'timeout'|'no-run'|'unknown', run?: object }>}
+ */
+export async function waitForRun(root, { branch, workflow, isCurrent, timeoutMs, appearMs, pollMs = 15000,
+  sleep = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now, onPending = () => {}, list = listRuns }) {
+  const start = now();
+  let seen = false;
+  let misses = 0;
+  for (;;) {
+    const runs = list(root, branch, workflow);
+    if (runs === null) {
+      if (++misses >= 3) return { state: 'unknown' };
+    } else {
+      misses = 0;
+      const run = pickRun(runs, isCurrent);
+      if (run?.status === 'completed') return { state: 'completed', run };
+      if (run) {
+        if (!seen) onPending(run);
+        seen = true;
+      }
+    }
+    const elapsed = now() - start;
+    if (!seen && elapsed >= appearMs) return { state: 'no-run' };
+    if (elapsed >= timeoutMs) return { state: 'timeout' };
+    await sleep(pollMs);
+  }
+}

package/src/lib/ci/workflow-scaffold.js

@@ -0,0 +1,122 @@
+import { existsSync, readdirSync } from 'fs';
+import { join, posix, relative, resolve } from 'path';
+import { PACKAGE_LOCATIONS } from '../detectors/index.js';
+import { CI_ARTIFACT, CI_RESULT_FILE } from './github-ci.js';
+
+const LOCKFILES = [
+  ['package-lock.json', 'npm ci'],
+  ['pnpm-lock.yaml', 'corepack enable && pnpm install --frozen-lockfile'],
+  ['yarn.lock', 'corepack enable && yarn install --frozen-lockfile'],
+];
+const PLAYWRIGHT_CONFIGS = ['playwright.config.ts', 'playwright.config.js', 'playwright.config.mjs'];
+
+function packageDirs(root, config) {
+  const dirs = [...PACKAGE_LOCATIONS];
+  if (typeof config?.project?.frontendPath === 'string') dirs.push(config.project.frontendPath);
+  for (const node of Array.isArray(config?.project?.tests) ? config.project.tests : []) {
+    if (typeof node?.cwd === 'string') dirs.push(node.cwd);
+  }
+  const seen = new Set();
+  const out = [];
+  for (const dir of dirs) {
+    const abs = resolve(root, dir.trim() || '.');
+    const rel = relative(root, abs).split('\\').join('/') || '.';
+    if (rel.startsWith('..') || seen.has(rel)) continue;
+    seen.add(rel);
+    const lock = LOCKFILES.find(([file]) => existsSync(join(abs, file)));
+    if (lock) out.push({ dir: rel, install: lock[1], playwright: PLAYWRIGHT_CONFIGS.some((f) => existsSync(join(abs, f))) });
+  }
+  return out;
+}
+
+function usesDotnet(root, config) {
+  if (existsSync(join(root, 'global.json'))) return true;
+  if (/dotnet/i.test(String(config?.project?.stack ?? ''))) return true;
+  if ((config?.project?.tests ?? []).some?.((node) => node?.runner === 'dotnet' || /\bdotnet\b/.test(node?.command ?? ''))) return true;
+  try {
+    return readdirSync(root).some((f) => /\.(sln|slnx|csproj)$/i.test(f));
+  } catch {
+    return false;
+  }
+}
+
+function dotnetSetup(root, config) {
+  if (!usesDotnet(root, config)) return [];
+  const hasGlobalJson = existsSync(join(root, 'global.json'));
+  return [
+    '      - uses: actions/setup-dotnet@v4',
+    '        with:',
+    hasGlobalJson ? '          global-json-file: global.json' : "          dotnet-version: '10.0.x'",
+  ];
+}
+
+const step = (name, dir, run) => [
+  `      - name: ${name}`,
+  ...(dir === '.' ? [] : [`        working-directory: ${posix.normalize(dir)}`]),
+  `        run: ${run}`,
+];
+
+/**
+ * The workflow `verify {f} --ci` relies on. Same judge as the local run: it calls the project's
+ * pinned morph-spec, so the suite is whatever `project.tests` says, not a second definition here.
+ * `.morph/` is out of the trigger (bookkeeping commits would cancel the run over the code) except
+ * the config, which names the commands.
+ *
+ * @param {string} root
+ * @param {object|null} config
+ * @returns {string}
+ */
+export function renderCiWorkflow(root, config) {
+  const packages = packageDirs(root, config);
+  const lines = [
+    '# Gerado por morph-spec: a prova do Gate 3 roda aqui (verify {feature} --ci).',
+    'name: morph-verify',
+    '',
+    'on:',
+    '  push:',
+    "    branches: ['morph/**']",
+    '    paths:',
+    "      - '**'",
+    "      - '!.morph/**'",
+    "      - '.morph/config/config.json'",
+    '  workflow_dispatch:',
+    '',
+    'concurrency:',
+    '  group: morph-verify-${{ github.ref }}',
+    '  cancel-in-progress: true',
+    '',
+    'jobs:',
+    '  verify:',
+    '    runs-on: ubuntu-latest',
+    '    timeout-minutes: 45',
+    '    env:',
+    "      MORPH_HEAVY: 'off'",
+    '    steps:',
+    '      - uses: actions/checkout@v4',
+    '      - uses: actions/setup-node@v4',
+    '        with:',
+    "          node-version: '22'",
+    ...dotnetSetup(root, config),
+  ];
+  for (const pkg of packages) {
+    lines.push(...step(`install (${pkg.dir})`, pkg.dir, pkg.install));
+    if (pkg.playwright) lines.push(...step(`playwright browsers (${pkg.dir})`, pkg.dir, 'npx playwright install --with-deps chromium'));
+  }
+  lines.push(
+    '      - name: morph-spec verify',
+    '        shell: bash',
+    '        run: |',
+    '          feature="${GITHUB_REF_NAME#morph/}"',
+    "          version=$(node -p \"try { require('./.morph/.morphversion').morphVersion } catch { 'latest' }\")",
+    `          npx -y "@polymorphism-tech/morph-spec@\${version}" verify "$feature" --json --no-persist > ${CI_RESULT_FILE}`,
+    '      - uses: actions/upload-artifact@v4',
+    '        if: always()',
+    '        with:',
+    `          name: ${CI_ARTIFACT}`,
+    `          path: ${CI_RESULT_FILE}`,
+    '          if-no-files-found: ignore',
+    '          retention-days: 7',
+    '',
+  );
+  return lines.join('\n');
+}