@rmartz/bot-automerge 1.0.1 → 1.0.3

package/README.md

@@ -65,16 +65,20 @@ pnpm run test         # vitest
 
 ## Releases
 
-Versioned by [semantic-release](.releaserc.json). A push to `main` analyzes the
-Conventional-Commit history since the last `bot-automerge-v*` tag and, when a
-release is warranted, publishes the package to npmjs (public, via OIDC trusted
-publishing with provenance — no npm token) and creates the git tag + GitHub
-Release. Versions up to 0.2.1 were published to GitHub Packages and stay there for
-existing pins; new versions go to npmjs only. There is no release PR and no
-commit-back, so the
-built-in `GITHUB_TOKEN` suffices. `tagFormat` stays `bot-automerge-v${version}`
-for continuity with the prior release-please tags. A `Release dry-run` CI job
-validates the semantic-release config (that the changelog toolchain renders) on
+Versioned by [semantic-release](.releaserc.json), run through the fleet's shared
+[rmartz/semantic-release-ci](https://github.com/rmartz/semantic-release-ci)
+workflow. A push to `main` analyzes the Conventional-Commit history since the
+last `bot-automerge-v*` tag and, when a release is warranted, publishes the
+package to npmjs (public, via OIDC trusted publishing with provenance — no npm
+token) and creates the git tag + GitHub Release. The package is published
+**before** the tag is pushed, so a failed publish never leaves a tag with no
+package. Versions up to 0.2.1 were published to GitHub Packages and stay there
+for existing pins; new versions go to npmjs only. `bot-automerge-v1.0.0` is a tag
+with no package (its publish failed after tagging); use 1.0.1 or later. There is
+no release PR and no commit-back, so the built-in `GITHUB_TOKEN` suffices.
+`tagFormat` stays `bot-automerge-v${version}` for continuity with the prior
+release-please tags. The shared `release-check / release-check` check validates
+the semantic-release config (that commits analyze and the changelog renders) on
 every PR, so a broken release setup is caught before merge rather than on the
 post-merge release run.
 

package/dist/bin/bot-automerge.js

@@ -59,29 +59,38 @@ function isRateLimited(text) {
 }
 async function runTransport({ argv, stdin }, cwd) {
   const [command, ...args] = argv;
-  if (command === void 0) return { stdout: null, stderr: "empty argv" };
+  if (command === void 0) return { stdout: null, failure: { code: null, stderr: "empty argv" } };
   try {
     const r = await boundedRun(command, args, { timeoutMs: GH_API_TIMEOUT_MS, cwd, input: stdin });
-    if (r.code === 0) return { stdout: r.stdout, stderr: "" };
-    return { stdout: null, stderr: r.stderr || "" };
+    if (r.code === 0) return { stdout: r.stdout, failure: { code: 0, stderr: "" } };
+    const stderr = r.timedOut ? `timed out after ${GH_API_TIMEOUT_MS}ms` : r.stderr || "";
+    return { stdout: null, failure: { code: r.timedOut ? null : r.code, stderr } };
   } catch (err) {
-    return { stdout: null, stderr: err instanceof Error ? err.message : String(err) };
+    return {
+      stdout: null,
+      failure: { code: null, stderr: err instanceof Error ? err.message : String(err) }
+    };
   }
 }
-async function ghCall(primary, fallback, opts = {}) {
+async function ghCallDetailed(primary, fallback, opts = {}) {
   const sleep = opts.sleep ?? realSleep;
+  let lastFailure = { code: null, stderr: "no transport attempted" };
   for (const transport of [primary, fallback]) {
     if (!transport) continue;
     for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-      const { stdout, stderr } = await runTransport(transport, opts.cwd);
-      if (stdout !== null) return stdout;
-      if (isRateLimited(stderr)) break;
+      const { stdout, failure } = await runTransport(transport, opts.cwd);
+      if (stdout !== null) return { stdout, failure: null };
+      lastFailure = failure;
+      if (isRateLimited(failure.stderr)) break;
       if (attempt < MAX_RETRIES) {
         await sleep(Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS));
       }
     }
   }
-  return null;
+  return { stdout: null, failure: lastFailure };
+}
+async function ghCall(primary, fallback, opts = {}) {
+  return (await ghCallDetailed(primary, fallback, opts)).stdout;
 }
 function parseSlugFromRemoteUrl(url) {
   const trimmed = url.trim();
@@ -130,6 +139,43 @@ async function addLabels(repo, issue, labels, call = {}) {
   return out !== null ? out.trim() : null;
 }
 
+// src/lib/gh-failure.ts
+var MAX_DETAIL_CHARS = 200;
+function classifyGhFailure(stderr) {
+  if (/rate limit|HTTP 429|abuse detection/i.test(stderr)) return "rate-limited";
+  if (/HTTP 401|Bad credentials|SAML|\bSSO\b|gh auth login/i.test(stderr)) {
+    return "token-rejected";
+  }
+  if (/Resource not accessible|HTTP 403|scope/i.test(stderr)) return "permission-denied";
+  if (/Could not resolve to a PullRequest/i.test(stderr)) return "pr-not-found";
+  if (/Could not resolve to a Repository/i.test(stderr)) return "repo-not-found";
+  if (/HTTP 404|Not Found/i.test(stderr)) return "pr-not-found";
+  return "unknown";
+}
+function tokenSource(env = process.env) {
+  if (env.GH_TOKEN) return "GH_TOKEN";
+  if (env.GITHUB_TOKEN) return "GITHUB_TOKEN";
+  return "gh's stored login";
+}
+var SUMMARIES = {
+  "rate-limited": () => "rate limited by GitHub \u2014 wait for the limit to reset, then re-run",
+  "token-rejected": (source) => `token rejected (from ${source}) \u2014 it is expired, revoked, or SSO-deauthorized; rotate it, or unset it to fall back to the workflow token`,
+  "permission-denied": (source) => `token lacks permission (from ${source}) \u2014 it needs contents:write and pull-requests:write on this repo`,
+  "pr-not-found": () => "PR not found \u2014 check the PR number the caller passed",
+  "repo-not-found": (source) => `repository not found or not visible to the token (from ${source}) \u2014 check --repo and the token's repo access`,
+  unknown: () => "gh failed"
+};
+function firstLine(stderr) {
+  const line = stderr.split("\n").map((l) => l.trim()).find((l) => l !== "");
+  if (!line) return "(no stderr)";
+  return line.length > MAX_DETAIL_CHARS ? `${line.slice(0, MAX_DETAIL_CHARS)}\u2026` : line;
+}
+function describeGhFailure(failure, env = process.env) {
+  const summary = SUMMARIES[classifyGhFailure(failure.stderr)](tokenSource(env));
+  const exit = failure.code === null ? "gh did not exit cleanly" : `gh exited ${failure.code}`;
+  return `${summary} (${exit}: ${firstLine(failure.stderr)})`;
+}
+
 // src/lib/automerge-label.ts
 async function markPrHandled(repo, pr, opts = {}) {
   const out = await addLabels(repo, pr, [AUTOMERGE_HANDLED_LABEL], opts);
@@ -217,12 +263,14 @@ function parse(argv) {
   return args;
 }
 async function ghJson(argv, cwd) {
-  const out = await ghCall({ argv }, null, { cwd });
-  if (out === null) return null;
+  const { stdout, failure } = await ghCallDetailed({ argv }, null, { cwd });
+  if (stdout === null) {
+    return { ok: false, why: failure ? describeGhFailure(failure) : "gh failed" };
+  }
   try {
-    return JSON.parse(out);
+    return { ok: true, value: JSON.parse(stdout) };
   } catch {
-    return null;
+    return { ok: false, why: "gh returned output that is not valid JSON" };
   }
 }
 async function fetchPrView(repo, pr, cwd) {
@@ -245,22 +293,23 @@ function emitVerdictJson(verdict2, isError) {
   if (isError) process.exitCode = 1;
 }
 async function enableAutoMerge(repo, pr, cwd) {
-  const out = await ghCall(
+  const { failure } = await ghCallDetailed(
     { argv: ["gh", "pr", "merge", "--auto", "--squash", String(pr), "--repo", repo] },
     null,
     { cwd }
   );
-  return out !== null;
+  return failure ? describeGhFailure(failure) : null;
 }
 async function runEnable(repo, pr, args) {
-  const view = await fetchPrView(repo, pr, args.cwd);
-  if (!view) {
-    const msg = `could not read PR #${pr}`;
+  const fetched = await fetchPrView(repo, pr, args.cwd);
+  if (!fetched.ok) {
+    const msg = `could not read PR #${pr} \u2014 ${fetched.why}`;
     if (args.json) return emitVerdictJson(errorBotAutomergeVerdict(msg), true);
     console.error(`#${pr}: ${msg} \u2014 not enabling auto-merge`);
     process.exitCode = 1;
     return;
   }
+  const view = fetched.value;
   const prView = {
     author: view.author?.login ?? "",
     headRefName: view.headRefName,
@@ -279,9 +328,11 @@ async function runEnable(repo, pr, args) {
     console.log(`#${pr}: not eligible \u2014 ${verdict2.reason}`);
     return;
   }
-  const enabled = await enableAutoMerge(repo, pr, args.cwd);
-  if (!enabled) {
-    console.error(`#${pr}: eligible (${verdict2.reason}) but failed to enable auto-merge`);
+  const mergeFailure = await enableAutoMerge(repo, pr, args.cwd);
+  if (mergeFailure !== null) {
+    console.error(
+      `#${pr}: eligible (${verdict2.reason}) but failed to enable auto-merge \u2014 ${mergeFailure}`
+    );
     process.exitCode = 1;
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmartz/bot-automerge",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Enables GitHub-native auto-merge for trustworthy bot pull requests (Dependabot patch/minor bumps and release-please release PRs), distributed via rmartz/bot-automerge-action.",
   "keywords": [
     "ci",
@@ -49,6 +49,7 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
+    "@semantic-release/exec": "^7.1.0",
     "@types/node": "^26.6.2",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",