@rmartz/merge-safety 0.13.0 → 0.15.0

package/README.md

@@ -6,11 +6,13 @@ breaking-change, and conflict facts for a PR, posts them as the `merge-safety`
 check-run, and re-holds every open PR when the base branch moves — so a PR only
 auto-merges once it is genuinely safe against the current base.
 
-It is distributed the same way [`@rmartz/repo-hygiene`](https://github.com/rmartz/repo-hygiene)
-is:
+Consuming repos adopt it through the composite action
+[**`rmartz/merge-safety-action`**](https://github.com/rmartz/merge-safety-action),
+distributed the same way as the fleet's other `-action` repos:
 
-1. **Updates propagate automatically.** Consuming repos pin one reusable workflow
-   by SHA; Dependabot's `github-actions` ecosystem opens PRs to bump that pin.
+1. **Updates propagate automatically.** Consuming repos pin the action by SHA;
+   Dependabot's `github-actions` ecosystem opens PRs to bump that pin, and each
+   action release pins a specific version of this CLI.
 2. **The check-run name is a fleet contract.** Every consumer requires a status
    check named exactly `merge-safety`; see
    [docs/check-run-contract.md](docs/check-run-contract.md).
@@ -20,60 +22,22 @@ is:
 
 ## Using it in a consuming repo
 
-Add one caller workflow (this is what Dependabot keeps current). Unlike a
-read-only hygiene check, this caller carries the triggers, grants write scopes,
-and passes secrets through — because a reusable workflow can't declare its own
-triggers and runs with the intersection of granted and declared permissions:
-
-```yaml
-# .github/workflows/merge-safety.yml
-name: merge-safety
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, edited, labeled, unlabeled]
-  push:
-    branches: [main]
-  check_suite:
-    types: [completed]
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: PR number to evaluate
-        required: true
-permissions:
-  checks: write
-  statuses: write
-  pull-requests: write
-  contents: read
-  actions: write
-  packages: read
-jobs:
-  merge-safety:
-    uses: rmartz/merge-safety/.github/workflows/merge-safety.yml@<sha> # vX.Y.Z
-    with:
-      pr: ${{ inputs.pr }}
-    secrets: inherit
-```
-
-Then require the `merge-safety` status check on the default branch. Both the
-caller and the Dependabot entry are seeded once by
-[`@rmartz/bootstrap`](https://github.com/rmartz/ai-tools)
-(`ai-ensure-project-config`); after that Dependabot maintains the pin. The
-`@rmartz/merge-safety` CLI is public on npmjs, so installing it needs no token.
-(Pins at v0.6.0 or earlier install from GitHub Packages instead, which is what the
-`packages: read` permission above is for; it can be dropped once your pin is past
-v0.6.0.)
+Add the caller workflow from the action's
+[consumer guide](https://github.com/rmartz/merge-safety-action/blob/main/docs/consuming.md),
+create the labels merge-safety manages, and require the `merge-safety` status
+check on the default branch. See [docs/consuming.md](docs/consuming.md) for what
+the verdict expects of a repo and how it behaves.
 
-> For the full walkthrough — the caller's permissions, why it isn't trigger-free,
-> and how to verify the setup — see the
-> [consumer setup guide](docs/consuming.md).
+> **The reusable workflow in this repo is deprecated.** Repos pinned to
+> `rmartz/merge-safety/.github/workflows/merge-safety.yml` keep working and see a
+> deprecation warning on each run; migrate them to the action.
 
 ## Requirements
 
 - Node.js >= 20.11
 - pnpm 9 (pinned via `packageManager`)
 
-Consuming repos need neither — the reusable workflow runs the published CLI on a
+Consuming repos need neither — the action runs the published CLI on a
 GitHub-hosted runner.
 
 ## Local development
@@ -98,9 +62,9 @@ OIDC trusted publishing with provenance — no npm token), and creates the git t
 GitHub Release with generated notes — using only the built-in `GITHUB_TOKEN`, no
 release-please and no PAT. There is deliberately **no
 `@semantic-release/git`**: `package.json`'s `version` is a frozen `0.0.0` placeholder
-and is never committed back. The version installed by the reusable workflow is
-resolved at runtime from the **release tag at its own pinned commit**, so it lives
-only in the git tag. Config: [`.releaserc.json`](.releaserc.json).
+and is never committed back. The version installed by the deprecated reusable
+workflow is resolved at runtime from the **release tag at its own pinned commit**,
+so it lives only in the git tag; the action pins the version in its own lockfile. Config: [`.releaserc.json`](.releaserc.json).
 
 **Version mapping (v0):** `feat:` → minor; `fix:`/`perf:` → patch. Pre-1.0, a
 breaking change (`!`) is **capped at minor** so it can't auto-jump to `1.0.0`;

package/dist/bin/merge-safety.js

@@ -53,16 +53,35 @@ var MAX_RETRIES = 2;
 var BACKOFF_BASE_MS = 1e3;
 var BACKOFF_CAP_MS = 8e3;
 var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var GhTransientError = class extends Error {
+  constructor(stderr) {
+    super(`transient GitHub API failure: ${stderr}`);
+    this.stderr = stderr;
+    this.name = "GhTransientError";
+  }
+  stderr;
+};
 function isRateLimited(text) {
   const t = (text ?? "").toLowerCase();
   return t.includes("rate limit") || t.includes("rate-limit");
 }
+var TRANSIENT_PATTERNS = [
+  /\bHTTP 5\d\d\b/,
+  /bad gateway|service unavailable|gateway time-?out|internal server error/i,
+  /timed out|timeout/i,
+  /connection (?:reset|refused)/i,
+  /could not resolve host|no such host|tls handshake|unexpected eof/i
+];
+function isTransientGhFailure(stderr) {
+  return isRateLimited(stderr) || TRANSIENT_PATTERNS.some((p) => p.test(stderr));
+}
 async function runTransport({ argv, stdin }, cwd) {
   const [command, ...args] = argv;
   if (command === void 0) return { stdout: null, stderr: "empty argv" };
   try {
     const r = await boundedRun(command, args, { timeoutMs: GH_API_TIMEOUT_MS, cwd, input: stdin });
     if (r.code === 0) return { stdout: r.stdout, stderr: "" };
+    if (r.timedOut) return { stdout: null, stderr: `gh timed out after ${GH_API_TIMEOUT_MS}ms` };
     return { stdout: null, stderr: r.stderr || "" };
   } catch (err) {
     return { stdout: null, stderr: err instanceof Error ? err.message : String(err) };
@@ -70,17 +89,22 @@ async function runTransport({ argv, stdin }, cwd) {
 }
 async function ghCall(primary, fallback, opts = {}) {
   const sleep = opts.sleep ?? realSleep;
+  let lastStderr = "";
   for (const transport of [primary, fallback]) {
     if (!transport) continue;
     for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
       const { stdout, stderr } = await runTransport(transport, opts.cwd);
       if (stdout !== null) return stdout;
+      lastStderr = stderr;
       if (isRateLimited(stderr)) break;
       if (attempt < MAX_RETRIES) {
         await sleep(Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS));
       }
     }
   }
+  if (opts.throwOnTransient && isTransientGhFailure(lastStderr)) {
+    throw new GhTransientError(lastStderr.trim());
+  }
   return null;
 }
 function parseSlugFromRemoteUrl(url) {
@@ -225,6 +249,40 @@ async function postCheckRun(repo, headSha, output, conclusion, cwd) {
   );
 }
 
+// src/lib/cancel-run.ts
+var EXIT_TRANSIENT = 75;
+var CANCEL_GRACE_MS = 12e4;
+async function requestRunCancel(opts = {}) {
+  const { GITHUB_ACTIONS, GITHUB_REPOSITORY, GITHUB_RUN_ID } = opts.env ?? process.env;
+  if (GITHUB_ACTIONS !== "true" || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) return false;
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        "-X",
+        "POST",
+        `repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/cancel`
+      ]
+    },
+    null,
+    { cwd: opts.cwd }
+  );
+  return out !== null;
+}
+async function abandonRunAsCancelled(err, opts = {}) {
+  console.warn(
+    `::warning title=merge-safety cancelled::${err.message} \u2014 cancelling this run; the next event re-evaluates.`
+  );
+  process.exitCode = EXIT_TRANSIENT;
+  if (!await requestRunCancel(opts)) {
+    console.error("could not request cancellation of this run; exiting as failed");
+    return;
+  }
+  const wait = opts.wait ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  await wait(CANCEL_GRACE_MS);
+}
+
 // src/conventional-commits.ts
 var BREAKING_SUBJECT_RE = /^[a-z]+(?:!(?:\([^)]*\))?|(?:\([^)]*\))?!):/;
 var BREAKING_FOOTER_RE = /^BREAKING[ -]CHANGE:/m;
@@ -644,7 +702,7 @@ function parse(argv) {
   return args;
 }
 async function ghJson(argv, cwd) {
-  const out = await ghCall({ argv }, null, { cwd });
+  const out = await ghCall({ argv }, null, { cwd, throwOnTransient: true });
   if (out === null) return null;
   try {
     return JSON.parse(out);
@@ -835,8 +893,18 @@ async function main() {
     console.error("error: could not resolve target repo (pass --repo <owner/repo>)");
     process.exit(2);
   }
-  if (args.mode === "evaluate") await runEvaluate(repo, args.pr, args);
-  else await runInvalidate(repo, args);
+  try {
+    if (args.mode === "evaluate") await runEvaluate(repo, args.pr, args);
+    else await runInvalidate(repo, args);
+  } catch (err) {
+    if (!(err instanceof GhTransientError)) throw err;
+    if (args.json) {
+      console.error(`error: ${err.message}`);
+      process.exitCode = EXIT_TRANSIENT;
+    } else {
+      await abandonRunAsCancelled(err, { cwd: args.cwd });
+    }
+  }
 }
 function isDirectRun() {
   const entry = process.argv[1];

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@rmartz/merge-safety",
-  "version": "0.13.0",
-  "description": "The pre-auto-merge safety verdict for a PR (base-currency, breaking-change, and conflict facts), posted as the `merge-safety` check-run and distributed via a reusable workflow kept current by Dependabot.",
+  "version": "0.15.0",
+  "description": "The pre-auto-merge safety verdict for a PR (base-currency, breaking-change, and conflict facts), posted as the `merge-safety` check-run and distributed through the `rmartz/merge-safety-action` composite action kept current by Dependabot.",
   "keywords": [
     "ci",
     "merge-safety",
     "auto-merge",
     "github-actions",
-    "reusable-workflow",
+    "composite-action",
     "check-run"
   ],
   "homepage": "https://github.com/rmartz/merge-safety#readme",