@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.45

package/server-managed/repository-risk.ts

@@ -12,58 +12,47 @@
 // host with an integrity, such as a company's mirror of npm's, as npm's
 // package of its name and version where npm's integrity is among it; one
 // from elsewhere (git, a tarball with no integrity, a file) is listed, not
-// assessed. Repositories are read one at a time, as GitHub's limits are the
-// caller's; packages are assessed meanwhile, as many at a time as npm-risk.ts
+// assessed. Repositories are read a few at a time (READ_AHEAD), each told in
+// turn, as GitHub's limits are the caller's; packages are assessed meanwhile, as many at a time as npm-risk.ts
 // makes spare assessments, those only devDependencies need in every lockfile
 // that locks them (LockedPackage `dev`) once all the rest are, as an install
 // of no devDependencies leaves them out. A lockfile's packages of npm's
 // registry or a mirror are asked of npm's advisories all at once, as `npm
 // audit` asks, each advisory told with whether it is of malware (risk's
 // npmMalwareAdvisory), which alone is a supply chain's risk; the rest are
-// vulnerabilities, told beside.
-import type { LockfileFormat, RepoLockfile } from '@preventive/upstream/github.js'
-import type { Severity } from '../risk/index.js'
+// vulnerabilities, told beside. A repository's Dependabot alerts of npm's, open or dismissed,
+// are told once its lockfiles' advisories are, each with the versions its
+// lockfile locks that it covers, for the page to blend them into npm's; one
+// whose alerts couldn't be had tells why, and the scan goes on. Its GitHub
+// Actions are told once its lockfiles are, the references they make
+// resolved as the scan goes on (repository-actions.ts).
+import type { LockfileFormat } from '@preventive/upstream/github.js'
+import { type Severity, npmMalwareAdvisory } from '../risk/index.js'
 import { isNpmPackageName, isNpmPackageSpec } from '../common/managed/npm-packages.js'
 import type { NpmVersionDocument } from './npm-packages.ts'
 import { type Lru, lru } from './lru.ts'
 import type { KeptStore } from './npm-kept.ts'
 import { MAX_SPARE_ASSESSMENTS } from './npm-risk.ts'
-import { type LockedPackage, isTestFixture, lockedPackages } from './locked-packages.ts'
+import type { LockedPackage } from './locked-packages.ts'
 import { type Queue, queue } from './queue.ts'
 import { type DownloadsSource, readyingDownloads } from './scan-downloads.ts'
 import { type AssessedPackage, type Assessment, BUSY_RETRIES, BUSY_WAIT_MS, RISK_KEPT_MS, type RiskFailure, assessPackage, failureOf, isBusy } from './repository-risk-assess.ts'
 import { type AdvisoryRow, type Audit, type AuditSource, auditLockfile } from './repository-risk-audit.ts'
+import { type DependabotRead, type ListedLockfile, type LockfileRead, type OpenedRepository, type RepositoryFailure, type RepositoryRead, SCAN_READ_KEPT_MS,
+  readRepository } from './repository-risk-read.ts'
+import { type DependabotAlert, alertVersions } from './dependabot-alerts.ts'
+import type { ActionsSource } from '../risk/index.js'
+import { type ActionAnswers, type ActionLine, type ActionRef, type WorkflowLine, type WorkflowsLine, type WorkflowsRead, actionsLines, answerWeight,
+  lockedNames, resolvingActions } from './repository-actions.ts'
 
 export { RISK_KEPT_MS, highestSeverity } from './repository-risk-assess.ts'
-
-// The formats of npm's ecosystem, as findRepoLockfiles names them, and those
-// of them read here.
-const NPM_LOCKFILE_FORMATS: ReadonlySet<LockfileFormat> = new Set(['npm', 'pnpm', 'yarn', 'bun', 'deno'])
-const READ_FORMATS: ReadonlySet<LockfileFormat> = new Set(['npm', 'pnpm', 'yarn'])
+export { type OpenedRepository, SCAN_READ_KEPT_MS } from './repository-risk-read.ts'
 
 // A repository to read: where `paths` are given, a team's directories in it,
 // only the lockfiles in them or above them, as a workspace's root lockfile
 // locks them too.
 export interface RepositoryRiskRepo { repoId: number; fullName: string; paths?: readonly string[] }
 
-// Whether a lockfile at `path` is of `paths` (RepositoryRiskRepo).
-function lockfileOf(path: string, paths: readonly string[] | undefined) {
-  const dir = path.slice(0, Math.max(path.lastIndexOf('/'), 0))
-  return !paths || paths.some(scope => dir === '' || dir === scope || dir.startsWith(`${scope}/`) || scope.startsWith(`${dir}/`))
-}
-
-type ListedLockfile = Pick<RepoLockfile, 'path' | 'format' | 'sha'>
-
-// A repository opened at its default branch's head (`commit`): its lockfiles,
-// as findRepoLockfiles lists them, each with its blob's id, and a file's
-// text; `recheck` checks access to it again, throwing where it is gone.
-export interface OpenedRepository {
-  commit: string
-  lockfiles(): Promise<ListedLockfile[]>
-  file(path: string): Promise<string>
-  recheck(): Promise<void>
-}
-
 export interface RepositoryRiskSource<R extends RepositoryRiskRepo> extends AuditSource {
   repos(): Promise<R[]>
   open(repo: R): Promise<OpenedRepository>
@@ -94,10 +83,21 @@ export interface RepositoryRiskSource<R extends RepositoryRiskRepo> extends Audi
   // Readies npm's downloads of packages before they are assessed
   // (scan-downloads.ts); without it, each assessment asks its own.
   downloads?: DownloadsSource
+  // GitHub as references are resolved with; none without it.
+  actions?: ActionsSource
+  // Where Actions' files read and references resolved are kept.
+  actionFiles?: KeptStore<WorkflowsRead>
+  actionLines?: KeptStore<ActionLine>
 }
 
 
 
+// A Dependabot alert as a scan tells it: with the versions of its package
+// the lockfile it is of locks that it covers, none where it is of none read
+// (a package.json, bun's lockfile), and whether it is of malware, as an
+// advisory's is told.
+export type DependabotAlertRow = DependabotAlert & { versions: string[]; malware: boolean }
+
 // A risk line is of npm's package of its name and version, or, with an
 // `integrity`, of a mirror's that its lockfiles hold to it; its `score` risk's
 // of it, out of 100 (assessNpm `score`, risk/npm/score.js).
@@ -108,6 +108,8 @@ export type RepositoryRiskLine =
   | ({ type: 'risk'; name: string; version: string; integrity?: string; stale?: { assessedAt: number } }
     & ({ published: string | null; severity: Severity | null; score: number; findings: { id: string; severity: Severity; takenDown?: true }[] } | RiskFailure))
   | ({ type: 'advisories'; repo: number; path: string } & ({ advisories: AdvisoryRow[] } | RiskFailure))
+  | ({ type: 'dependabot'; repo: number } & ({ alerts: DependabotAlertRow[] } | RiskFailure))
+  | WorkflowsLine | WorkflowLine | ActionLine
   | { type: 'done' }
   // The scan stopped for its part's time (repositoryRiskLines `partMs`), what
   // it told kept: to be asked again, from where it stopped.
@@ -115,12 +117,12 @@ export type RepositoryRiskLine =
 
 // The repositories a scan answered in parts told whole by a part's end: each
 // by its id, its name and a team's directories in it then, and its
-// lockfiles' keys (`${format}\0${sha}`) of those read.
+// lockfiles' keys (`${format}\0${sha}`) of those read, and the references
+// its Actions make, to resolve.
 export interface ScanProgress { repos: ToldRepository[] }
-interface ToldRepository { id: number; name: string; paths: readonly string[] | null; lockfiles: string[] }
+interface ToldRepository { id: number; name: string; paths: readonly string[] | null; lockfiles: string[]; actions?: ActionRef[] }
 
 type RiskLine = Extract<RepositoryRiskLine, { type: 'risk' }>
-type LockfileRead = { packages: LockedPackage[] } | RiskFailure
 
 // What scans keep between them, in this instance's memory: a repository's
 // lockfiles as listed at a commit, and a lockfile's packages by its blob,
@@ -135,6 +137,9 @@ export interface RiskCaches {
   lockfiles: Lru<LockfileRead>
   risks: Lru<{ at: number; line: RiskLine }>
   advisories: Lru<{ at: number; audit: Audit }>
+  actionFiles: Lru<WorkflowsRead>
+  actions: Lru<{ at: number; line: ActionLine }>
+  actionAnswers: ActionAnswers
 }
 export const riskCaches = (): RiskCaches => ({
   listings: lru(1000),
@@ -142,10 +147,16 @@ export const riskCaches = (): RiskCaches => ({
   lockfiles: lru(200_000, read => 'packages' in read ? read.packages.length + 1 : 1),
   risks: lru(50_000),
   advisories: lru(50_000, kept => Array.isArray(kept.audit) ? kept.audit.length + 1 : 1),
+  // By their text, a kilobyte at a time.
+  actionFiles: lru(64 * 1024, read => 'files' in read ? read.files.reduce((sum, file) => sum + ('text' in file ? Math.ceil(file.text.length / 1024) : 1), 1) : 1),
+  actions: lru(10_000),
+  // What GitHub answered of public repositories' actions, by answerWeight.
+  actionAnswers: lru(200_000, answerWeight),
 })
-// How long the source's `listings` and `lockfiles` are read for: what
-// GitHub has at a commit or a blob doesn't change, how it is read here may.
-export const SCAN_READ_KEPT_MS = 24 * 60 * 60_000
+// How many repositories are read at once (repository-risk-read.ts), ahead of
+// the one told: each asks GitHub one thing after another (opening it, and
+// its head) even where all else is kept.
+const READ_AHEAD = 6
 // How long a part's progress, written as it ends (`progress`), is waited on.
 const PROGRESS_WRITE_MS = 5000
 // How many kept risk lines are read of the source's `risks` at once.
@@ -168,6 +179,7 @@ interface Scan {
   stale: AssessedPackage[]
   // The repositories told whole, this part or one before (ScanProgress).
   told: Map<number, ToldRepository>
+  actions: ReturnType<typeof resolvingActions> | null
 }
 
 // A package as a scan meets it: by its name, version and a mirror's integrity.
@@ -255,36 +267,6 @@ async function assessing(scan: Scan, feed: (assess: (packages: AssessedPackage[]
   await Promise.all(assessors)
 }
 
-type LockfileLine = Extract<RepositoryRiskLine, { type: 'lockfile' }>
-
-// What is kept by `key`: in this instance's memory, else in `store` within
-// SCAN_READ_KEPT_MS, else `read` and kept in both.
-async function keptRead<T>(memory: Lru<T>, store: KeptStore<T> | undefined, key: string, read: () => Promise<T>) {
-  const known = memory.get(key)
-  if (known !== undefined) return known
-  const kept = await store?.read(key)
-  if (kept && Date.now() - kept.at < SCAN_READ_KEPT_MS) { memory.set(key, kept.value); return kept.value }
-  const value = await read()
-  memory.set(key, value)
-  await store?.write(key, value, Date.now())
-  return value
-}
-
-// A lockfile's line, its packages or why they couldn't be had: as kept by its
-// blob, else read from GitHub and kept.
-async function readLockfile({ source, caches }: Scan, repo: number, opened: OpenedRepository, { path, format, sha }: ListedLockfile): Promise<LockfileLine> {
-  const at = { type: 'lockfile', repo, path, format } as const
-  if (!READ_FORMATS.has(format)) return { ...at, error: 'unsupported-format' }
-  try {
-    return { ...at, ...await keptRead(caches.lockfiles, source.lockfiles, `${format}\0${sha}`, async (): Promise<LockfileRead> => {
-      const text = await opened.file(path)
-      try { return { packages: lockedPackages(format, text) } } catch (error) {
-        return { error: 'lockfile-unreadable', ...error instanceof Error ? { detail: error.message.slice(0, 500) } : {} }
-      }
-    }) }
-  } catch (error) { return { ...at, ...failureOf(error) } }
-}
-
 // A lockfile's packages of npm's registry or a mirror not yet seen this scan,
 // to look up as kept (lookUp), and assess where none is; and one seen as only
 // devDependencies need it, and put off, that this lockfile needs otherwise,
@@ -303,25 +285,8 @@ function assessLater(scan: Scan, packages: LockedPackage[]) {
   if (fresh.length > 0) scan.lookups.add(fresh)
 }
 
-// A repository opened and its lockfiles of npm's ecosystem listed, as kept
-// for its commit or else from GitHub, those of its `paths` alone; null, with
-// its line telling why, where either failed, or where the scan stopped.
-async function listLockfiles(scan: Scan, repo: RepositoryRiskRepo) {
-  let doing = 'opening it'
-  try {
-    const opened = await scan.source.open(repo)
-    if (scan.signal.aborted) return null
-    doing = 'listing its lockfiles'
-    const listed = await keptRead(scan.caches.listings, scan.source.listings, `${repo.repoId}@${opened.commit}`, () => opened.lockfiles())
-    const lockfiles = listed.filter(({ path, format }) => NPM_LOCKFILE_FORMATS.has(format) && lockfileOf(path, repo.paths))
-    return { opened, lockfiles }
-  } catch (error) {
-    if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, doing) })
-    return null
-  }
-}
-
 type AdvisoriesLine = Extract<RepositoryRiskLine, { type: 'advisories' }>
+type LockfileLine = Extract<RepositoryRiskLine, { type: 'lockfile' }>
 
 // A lockfile's advisories line (repository-risk-audit.ts auditLockfile);
 // null where it locks none, or once the scan stops.
@@ -331,38 +296,67 @@ async function readAdvisories(scan: Scan, { repo, path, format, packages }: Lock
   return audit === null ? null : Array.isArray(audit) ? { ...at, advisories: audit } : { ...at, ...audit }
 }
 
-// A repository's line, its lockfiles or why they couldn't be listed, and
-// then its lockfiles', and their advisories: told once they are all read
-// and access to the repository is checked again, as GitHub may have
-// withdrawn it meanwhile. A test's fixture or example its reader refuses
-// (isTestFixture) isn't told at all, as a test may keep one so on purpose.
-async function readRepository(scan: Scan, repo: RepositoryRiskRepo) {
-  const listed = await listLockfiles(scan, repo)
-  if (!listed) return
-  const lockfiles: { sha: string; line: LockfileLine }[] = []
-  for (const lockfile of listed.lockfiles) {
-    if (scan.signal.aborted) return
-    const line = await readLockfile(scan, repo.repoId, listed.opened, lockfile)
-    if (!('error' in line && line.error === 'lockfile-unreadable' && isTestFixture(line.path))) lockfiles.push({ sha: lockfile.sha, line })
-  }
-  try { await listed.opened.recheck() } catch (error) {
+type DependabotLine = Extract<RepositoryRiskLine, { type: 'dependabot' }>
+
+// A repository's Dependabot alerts' line, each alert with the versions the
+// lockfile it is of locks that it covers (`lockfiles`, a repository read's),
+// or why they couldn't be had.
+function dependabotLine(repo: number, read: DependabotRead, lockfiles: RepositoryRead['lockfiles']): DependabotLine {
+  if ('error' in read) return { type: 'dependabot', repo, ...read }
+  const locked = new Map(lockfiles.flatMap(({ line }) => 'packages' in line ? [[line.path, line.packages] as const] : []))
+  return { type: 'dependabot', repo, alerts: read.alerts.map(alert => ({ ...alert, versions: alertVersions(alert, locked.get(alert.manifest)),
+    malware: npmMalwareAdvisory({ id: alert.ghsa, aliases: alert.aliases, cwe: alert.cwe, title: alert.title }) })) }
+}
+
+// A repository's alerts checked again just before they are told, as access to
+// the repository is (DependabotRead `recheck`): why not, where the user's
+// access to them is withdrawn since they were read.
+async function rechecked(read: DependabotRead): Promise<DependabotRead> {
+  if (!('alerts' in read) || !read.recheck) return read
+  try { await read.recheck() } catch (error) { return failureOf(error, 'checking access to its Dependabot alerts again') }
+  return read
+}
+
+// A repository read (repository-risk-read.ts readRepository) told: its
+// line, or why it couldn't be read, then its lockfiles', and their
+// advisories, its packages assessed meanwhile, then its Dependabot alerts.
+// Access to it is checked again
+// just before, however long ago it was read, as GitHub may have withdrawn it.
+async function tellRepository(scan: Scan, repo: RepositoryRiskRepo, read: RepositoryRead | RepositoryFailure | null) {
+  if (!read || scan.signal.aborted) return
+  if ('type' in read) { scan.lines.add(read); return }
+  try { await read.recheck() } catch (error) {
     if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, 'checking access to it again') })
     return
   }
   if (scan.signal.aborted) return
-  scan.lines.add({ type: 'repo', id: repo.repoId, commit: listed.opened.commit, lockfiles: lockfiles.map(({ line: { path, format } }) => ({ path, format })) })
+  const { commit, lockfiles } = read
+  scan.lines.add({ type: 'repo', id: repo.repoId, commit, lockfiles: lockfiles.map(({ line: { path, format } }) => ({ path, format })) })
   for (const { line } of lockfiles) {
     scan.lines.add(line)
     if ('packages' in line) assessLater(scan, line.packages)
   }
+  const refs = read.actions ? tellActions(scan, repo, read.actions, lockfiles) : []
   for (const { sha, line } of lockfiles) {
     if (scan.signal.aborted) return
     const advisories = 'packages' in line ? await readAdvisories(scan, line, sha) : null
     if (advisories) scan.lines.add(advisories)
   }
   if (scan.signal.aborted) return
+  const dependabot = read.dependabot && await rechecked(read.dependabot)
+  if (scan.signal.aborted) return
+  if (dependabot) scan.lines.add(dependabotLine(repo.repoId, dependabot, lockfiles))
   scan.told.set(repo.repoId, { id: repo.repoId, name: repo.fullName, paths: repo.paths ?? null,
-    lockfiles: lockfiles.flatMap(({ sha, line }) => 'packages' in line ? [`${line.format}\0${sha}`] : []) })
+    lockfiles: lockfiles.flatMap(({ sha, line }) => 'packages' in line ? [`${line.format}\0${sha}`] : []), ...refs.length > 0 ? { actions: refs } : {} })
+}
+
+// A repository's Actions told, and the references they make to resolve.
+function tellActions(scan: Scan, repo: RepositoryRiskRepo, read: WorkflowsRead, lockfiles: RepositoryRead['lockfiles']) {
+  const locked = lockfiles.flatMap(({ line }) => 'packages' in line ? [lockedNames(line.path, line.packages)] : [])
+  const { lines, refs } = actionsLines(repo.repoId, repo.fullName.split('/')[0]!, read, locked)
+  for (const line of lines) scan.lines.add(line)
+  scan.actions?.add(refs)
+  return refs
 }
 
 // Whether an earlier part told `repo` whole, by its name and a team's
@@ -379,11 +373,12 @@ async function toldBefore(scan: Scan, repo: RepositoryRiskRepo) {
     reads.push(read.packages)
   }
   for (const packages of reads) assessLater(scan, packages)
+  scan.actions?.add(told.actions ?? [])
   return true
 }
 
-// Each repository, a repository at a time, but those an earlier part told
-// whole (ScanProgress).
+// Each repository, READ_AHEAD read at a time, each told in turn, but those an
+// earlier part told whole (ScanProgress), read of none.
 async function readRepositories(scan: Scan) {
   const repos = await scan.source.repos()
   scan.lines.add({ type: 'repos', repos: repos.map(repo => ({ id: repo.repoId, fullName: repo.fullName })) })
@@ -393,9 +388,19 @@ async function readRepositories(scan: Scan) {
   const kept = await scan.source.progress?.read()
   const progress = kept && Date.now() - kept.at < SCAN_READ_KEPT_MS ? kept.value.repos : []
   for (const told of progress) if (listed.has(told.id)) scan.told.set(told.id, told)
-  for (const repo of repos) {
+  const reads: Promise<RepositoryRead | RepositoryFailure | null>[] = []
+  const read = (at: number) => {
+    if (reads[at]) return reads[at]
+    const repo = repos[at]!
+    const started = reads[at] = toldBefore(scan, repo).then(told => told ? null : readRepository(scan, repo))
+    // One read ahead and no longer waited on, as the scan stopped, fails alone.
+    started.catch(() => {})
+    return started
+  }
+  for (const [at, repo] of repos.entries()) {
     if (scan.signal.aborted) return
-    if (!await toldBefore(scan, repo)) await readRepository(scan, repo)
+    for (let ahead = at; ahead < Math.min(at + READ_AHEAD, repos.length); ahead++) void read(ahead)
+    await tellRepository(scan, repo, await read(at))
   }
 }
 
@@ -431,7 +436,9 @@ export async function* repositoryRiskLines<R extends RepositoryRiskRepo>(source:
   // none waited for: the work under way, such as a request to GitHub, which
   // isn't given up on at once, outlasting it.
   const lines = queue<RepositoryRiskLine>(AbortSignal.any([signal, part.signal]), { drain: true })
-  const scan: Scan = { source, caches, signal: running, lines, lookups: queue(running), seen: new Map(), dev: new Map(), stale: [], told: new Map() }
+  const actions = source.actions ? resolvingActions({ source: source.actions, signal: running, tell: line => { lines.add(line) }, memory: caches.actions,
+    answers: caches.actionAnswers, store: source.actionLines }) : null
+  const scan: Scan = { source, caches, signal: running, lines, lookups: queue(running), seen: new Map(), dev: new Map(), stale: [], told: new Map(), actions }
   const failed: unknown[] = []
   void (async () => {
     try {
@@ -446,6 +453,7 @@ export async function* repositoryRiskLines<R extends RepositoryRiskRepo>(source:
       for (const left of leftOver(scan)) {
         if (!running.aborted && left.length > 0) await assessing(scan, assess => { assess(left); return Promise.resolve() })
       }
+      await actions?.close()
       if (!running.aborted) scan.lines.add({ type: 'done' })
     } catch (error) {
       failed.push(error)

package/server-managed/reviewed-dependencies.ts

@@ -0,0 +1,149 @@
+// The reviewed dependencies a host keeps beyond the app, as it registers
+// them before the server is assembled (server.ts registerReviewedDependencies):
+// an async method telling whether a dependency, as a lockfile locks it, is
+// reviewed there (`lookup`), and, optionally, one reading the reviews of
+// dependencies an open pull request's comments make (`parseComments`,
+// pull-comment-reviews.ts), and one formatting one's own dependency reviews
+// as a comment, for a copy button to give (`formatDependencyReviews`,
+// dependency-review-comments.ts). Registered, they replace the commit a repository
+// is reviewed since (pull-dependency-reviews.ts): a version passes by the
+// reviews its teams publish, and those its pull request's comments make, as
+// many as the repository requires, or by `lookup`'s saying so, and is
+// otherwise unreviewed. A patched version (pnpm's patchedDependencies)
+// passes by `lookup`, or reviews its comments make of its patch, alone, the
+// app reviewing no patch yet. Those comments' reviews count for the pull
+// request alone, as it is open: the host's to keep, as it is merged, among
+// those `lookup` tells of.
+//
+// Each version is asked of `lookup` once a request, as many at once as
+// ASK_AT_ONCE, its answer kept in this instance KEPT_MS; one it fails to
+// answer is unreviewed, and counted so (`unasked`).
+import { type Lru, lru } from './lru.ts'
+
+export type ReviewedLockfile = 'npm' | 'pnpm' | 'yarn1'
+// A dependency as a lockfile locks it: npm's always with its integrity (one
+// with none is never reviewed, nor asked of), its shasum where the lockfile
+// has one (Yarn 1's, after a tarball's `#`), and the hash of its patch where
+// it is patched (pnpm's).
+export interface ReviewedDependency {
+  ecosystem: 'npm'
+  lockfile: ReviewedLockfile
+  name: string
+  version: string
+  integrity?: string
+  shasum?: string
+  patchHash?: string
+}
+export type ReviewVerdict = 'accept' | 'accept-with-nits' | 'request-changes' | 'reject'
+// A comment of an open pull request's, as `parseComments` is given it: one
+// on the pull request (`comment`), a review's own (`review`, whatever its
+// state, a comment's alone too), or one on a line of its diff
+// (`review-comment`); by its author's GitHub login; when it was written, and
+// last edited (`editedAt`) where it was.
+export interface ReviewComment {
+  kind: 'comment' | 'review' | 'review-comment'
+  id: string
+  author: string | null
+  body: string
+  state?: string
+  createdAt: string
+  editedAt?: string
+  url: string
+}
+// What `parseComments` reads: the pull request, its comments, and the
+// dependencies: every one the lockfiles its review holds to add that can be
+// reviewed and `lookup` doesn't pass, and the others still wanting reviews.
+export interface ParseCommentsInput { repository: string; number: number; comments: ReviewComment[]; dependencies: ReviewedDependency[] }
+// A review its comments make, by `user` (a GitHub login, one of their
+// authors'), of each of `dependencies`, with its verdict, as of `time` (when
+// it was made, an ISO date or milliseconds; that user's latest comment's
+// where none is told).
+export interface CommentReview {
+  user: string
+  time?: string | number
+  dependencies: { ecosystem?: 'npm'; name: string; version: string; integrity: string; patchHash?: string; status: ReviewVerdict }[]
+}
+// A version a dependency review is of, or compared it with: its package's
+// name, its version and integrity, and its tarball's shasum and its patch's
+// hash where they are known (a lockfile's, pnpm's patched dependencies').
+export interface ReviewedVersion { name: string; version: string; integrity: string; shasum?: string; patchHash?: string }
+// One of one's own published dependency reviews, as `formatDependencyReviews`
+// is given it: the version it is of (`new`) and the one it compared it with
+// (`old`, none where it read its package whole); its verdict (`status`);
+// whether it read every file (`coverage`, `full`, else `partial`); its final
+// comment; each file's verdict and comment (`files`, of those with either);
+// by whom (`reviewer`, their GitHub login), and when it was published.
+export interface DependencyReviewEntry {
+  ecosystem: 'npm'
+  old: ReviewedVersion | null
+  new: ReviewedVersion
+  status: ReviewVerdict
+  coverage: 'full' | 'partial'
+  comment: string
+  files: { path: string; status: ReviewVerdict | null; comment: string }[]
+  reviewer: string
+  publishedAt: number
+}
+// What `formatDependencyReviews` formats: one's own reviews, never another's,
+// and the pull request whose versions they are of, where its copy asks.
+export interface FormatDependencyReviewsInput { reviews: DependencyReviewEntry[]; pullRequest?: { repository: string; number: number } }
+export interface ReviewedDependencies {
+  lookup(dependency: ReviewedDependency): Promise<boolean>
+  parseComments?(input: ParseCommentsInput): Promise<CommentReview[]>
+  // The comment to copy, none where it is empty, null or undefined.
+  formatDependencyReviews?(input: FormatDependencyReviewsInput): Promise<string | null | undefined>
+}
+
+const ASK_AT_ONCE = 16
+const KEPT_MS = 60_000
+
+let registered: ReviewedDependencies | null = null
+let assembled = false
+// Each lookup's answers, apart.
+const answers = new WeakMap<ReviewedDependencies['lookup'], Lru<{ at: number; reviewed: boolean }>>()
+
+// Registers the host's reviewed dependencies, once, before the server is
+// assembled (init()): a server already assembled keeps what it was given.
+export function registerReviewedDependencies(reviewed: ReviewedDependencies): void {
+  const optional = (method: unknown) => method === undefined || typeof method === 'function'
+  if (typeof reviewed?.lookup !== 'function' || !optional(reviewed.parseComments) || !optional(reviewed.formatDependencyReviews)) {
+    throw new TypeError('registerReviewedDependencies: expected { lookup, parseComments?, formatDependencyReviews? }, async methods')
+  }
+  if (assembled) throw new Error('registerReviewedDependencies: call it before init(), as the server takes them as it is assembled')
+  if (registered) throw new Error('registerReviewedDependencies: reviewed dependencies are registered already')
+  registered = { lookup: reviewed.lookup.bind(reviewed), ...reviewed.parseComments ? { parseComments: reviewed.parseComments.bind(reviewed) } : {},
+    ...reviewed.formatDependencyReviews ? { formatDependencyReviews: reviewed.formatDependencyReviews.bind(reviewed) } : {} }
+}
+
+// The reviewed dependencies registered, as a server takes them once it is
+// assembled; none registers after.
+export function assembledReviewedDependencies(): ReviewedDependencies | null {
+  assembled = true
+  return registered
+}
+
+// Which of `dependencies`, by their keys, `lookup` passes, and how many it
+// failed to answer.
+export async function askReviewed(lookup: ReviewedDependencies['lookup'], dependencies: Map<string, ReviewedDependency>): Promise<{ passed: Set<string>; unasked: number }> {
+  const passed = new Set<string>()
+  let unasked = 0
+  const pending = [...dependencies]
+  const kept = answers.get(lookup) ?? answers.set(lookup, lru(100_000)).get(lookup)!
+  await Promise.all(Array.from({ length: Math.min(ASK_AT_ONCE, pending.length) }, async () => {
+    for (let next = pending.pop(); next; next = pending.pop()) {
+      const [key, dependency] = next
+      const known = kept.get(key)
+      let answer = known && Date.now() - known.at < KEPT_MS ? known.reviewed : null
+      if (answer === null) {
+        try { answer = await lookup({ ...dependency }) === true } catch (error) {
+          unasked++
+          console.warn('reviewed dependencies: failed to answer', `${dependency.name}@${dependency.version}`, error instanceof Error ? error.message : error)
+          continue
+        }
+        kept.set(key, { at: Date.now(), reviewed: answer })
+      }
+      if (answer) passed.add(key)
+    }
+  }))
+  return { passed, unasked }
+}

package/server-managed/session.ts

@@ -13,13 +13,15 @@ import { hashToken, randomToken } from './crypto.ts'
 // `cookieName` when cookies are Secure.
 export const STATE_COOKIE = 'dvstate'
 
-// Base names for GitHub issue authorization state (github-issue-oauth.ts) and
-// an administrator's read-only view as another user (view-as.ts).
+// Base names for GitHub issue authorization state (github-issue-oauth.ts),
+// linking another GitHub account (github-link-oauth.ts) and an
+// administrator's read-only view as another user (view-as.ts).
 export const ISSUE_STATE_COOKIE = 'dvissuestate'
+export const LINK_STATE_COOKIE = 'dvlinkstate'
 export const VIEW_COOKIE = 'dvview'
 // The session cookie cannot share a name with these, or one would overwrite
 // or be read as the other.
-export const RESERVED_COOKIES: readonly string[] = [STATE_COOKIE, ISSUE_STATE_COOKIE, VIEW_COOKIE]
+export const RESERVED_COOKIES: readonly string[] = [STATE_COOKIE, ISSUE_STATE_COOKIE, LINK_STATE_COOKIE, VIEW_COOKIE]
 
 // `__Host-`-prefix the base name when cookies are Secure (the prefix mandates
 // Secure + Path=/ + no Domain, which `buildCookie` already emits).
@@ -55,13 +57,15 @@ export function parseCookies(header: string | undefined): Map<string, string> {
 
 // Mint a session for a freshly-authenticated user. Upserts the identity, then
 // stores the session keyed by the cookie token's hash. Returns the cookie to
-// set and the CSRF token (also persisted on the row).
+// set and the CSRF token (also persisted on the row), or null for an account
+// a user linked to theirs, which can neither sign in nor register.
 export async function createSession(
   config: ManagedConfig, db: ManagedDb, user: ManagedUser, now: number,
-): Promise<{ setCookie: string; csrfToken: string; userId: string }> {
+): Promise<{ setCookie: string; csrfToken: string; userId: string } | null> {
   const token = randomToken()
   const csrfToken = randomToken()
   const userId = await db.upsertUser(user, now, config.initialAdminGithubId)
+  if (userId == null) return null
   await db.createSession({ id: hashToken(token), userId, csrfToken, expiresAt: now + config.sessionTtlMs }, now)
   const setCookie = buildCookie(config.sessionCookieName, token, {
     maxAgeS: Math.floor(config.sessionTtlMs / 1000), secure: config.cookieSecure, sameSite: 'Lax',

package/server-managed/sql.ts

@@ -23,7 +23,7 @@ const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'g
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
-  'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits'])
+  'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits', 'getAvatarKey', 'listUsersByAccount'])
 // Session presence and upload keys change only their own rows.
 const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensureSessionUploadKey'])
 

package/server-managed/storage-stores.ts

@@ -61,6 +61,11 @@ function avatarStore(objects: ObjectStorage, sidecar: boolean): AvatarStore {
       if (split < 0 || split > 100) throw new Error('Invalid cached avatar')
       return { contentType: bytes.subarray(0, split).toString(), bytes: bytes.subarray(split + 1) }
     },
+    async delete(value) {
+      const path = `avatars/${id(value)}`
+      await objects.delete(path)
+      if (sidecar) await objects.delete(`${path}.type`)
+    },
   }
 }
 

package/server-managed/team-app.ts

@@ -8,6 +8,13 @@
 // The same read names the reports a restricted reader would find nothing in:
 // under -deps or -security the catalog leaves those out of the team's list.
 // Readers with both permissions keep every report, empty or not.
+//
+// A team that is not App also says how many of its reports open in App mode
+// on their own, and its findings for the badge it collapses to. None is as
+// uniform as an App team, and collapses like one. A team mixing App and non-App
+// reports stays expanded, and so does one whose reports each open as App but
+// whose combined workspace does not (contradicting verdicts, say): it has App
+// findings, and only expanded does it show that they fail to combine.
 import { reportEntries } from '@preventive/report'
 import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
 import type { BlobStore } from './blob-store.ts'
@@ -48,10 +55,14 @@ function remember(db: ManagedDb, key: string, summary: TeamWorkspaceSummary): Te
   return summary
 }
 
+function isLinks(data: unknown): boolean {
+  const record = data as { source?: unknown; links?: unknown } | null
+  return record?.source === 'links' && Array.isArray(record.links)
+}
+
 // A links document counts by its links, every other report by its findings.
 function hasContent(data: unknown): boolean {
-  const record = data as { source?: unknown; links?: unknown } | null
-  if (record?.source === 'links' && Array.isArray(record.links)) return record.links.length > 0
+  if (isLinks(data)) return (data as { links: unknown[] }).links.length > 0
   return (reportEntries(data) ?? []).some(entry => !Array.isArray(entry) || entry.length > 0)
 }
 
@@ -79,7 +90,12 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
     }
     const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
     const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
-    return remember(db, key, { app: managedTeamAppMetadata(Object.assign(body.reports, { links: body.links ?? [] })), empty })
+    const links = body.links ?? []
+    const app = managedTeamAppMetadata(Object.assign(body.reports, { links }), { countFindings: true })
+    if (app.appMode) return remember(db, key, { app, empty })
+    const appReports = body.reports.filter(report => !isLinks(report.data)
+      && managedTeamAppMetadata(Object.assign([report], { links })).appMode).length
+    return remember(db, key, { app: { ...app, appReports }, empty })
   })().catch((error: unknown) => {
     if (error instanceof TeamReportsError && [413, 422].includes(error.status)) return remember(db, key, NO_APP)
     if (!(error instanceof TeamReportsError)) console.warn('managed: team App classification failed:', error)

package/server-managed/workspace-shares.ts

@@ -145,15 +145,18 @@ export function workspaceShareMethods(db: ManagedSql): WorkspaceShareStore {
       const links = await linkRevision(db)
       const bundleRows = (await q.bundles.all(team.id) as (Omit<ManagedBundle, 'buildConditions'> & { buildConditions: string | null; repoFullName: string })[])
         .map(row => ({ ...row, buildConditions: row.buildConditions == null ? null : JSON.parse(row.buildConditions) as BundleBuildConditions }))
+      const repositories = await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories']
       return {
         user: { id: `share:${tokenHash}`, login: 'public', name: 'Public workspace', avatarUrl: null, role: 'view' },
         teamId: team.id,
         linkRevision: links,
         permissions,
-        repositories: await q.repositories.all(team.id) as WorkspaceShareSnapshot['repositories'],
+        repositories,
         reports: rows.map(row => ({ id: row.id, filename: row.filename, byteSize: row.byteSize, sha256: row.sha256,
           repo: { github: row.github, directory: row.directory }, permissions })),
         team: { ...team, permissions, cacheKey: links,
+          repos: repositories.map(repo => ({ repoId: repo.repoId, fullName: repo.github, path: repo.path || null }))
+            .toSorted((a, b) => a.fullName.localeCompare(b.fullName) || (a.path ?? '').localeCompare(b.path ?? '')),
           reports: rows.map(row => ({ id: row.id, slug: row.slug, filename: row.filename, visible: true, analyzer: row.analyzer, repoFullName: row.github, repoDirectory: row.directory,
             cacheKey: JSON.stringify([row.sha256, row.github, row.directory, row.filename, permissions, links]) })),
           bundles: bundleRows.map(row => ({ id: row.id, slug: row.slug, integrity: row.integrity,