@semantic-release/github 10.1.4 → 10.1.6

package/lib/definitions/errors.js

@@ -139,6 +139,19 @@ By default the \`repositoryUrl\` option is retrieved from the \`repository\` pro
   };
 }
 
+export function EMISMATCHGITHUBURL({ repositoryUrl, clone_url }) {
+  return {
+    message: "The git repository URL mismatches the GitHub URL.",
+    details: `The **semantic-release** \`repositoryUrl\` option must have the same repository name and owner as the GitHub repo.
+
+Your configuration for the \`repositoryUrl\` option is \`${stringify(repositoryUrl)}\` and the \`clone_url\` of your GitHub repo is \`${stringify(clone_url)}\`.
+
+By default the \`repositoryUrl\` option is retrieved from the \`repository\` property of your \`package.json\` or the [git origin url](https://git-scm.com/book/en/v2/Git-Basics-Working-with-Remotes) of the repository cloned by your CI environment.
+
+Note: If you have recently changed your GitHub repository name or owner, update the value in **semantic-release** \`repositoryUrl\` option and the \`repository\` property of your \`package.json\` respectively to match the new GitHub URL.`,
+  };
+}
+
 export function EINVALIDPROXY({ proxy }) {
   return {
     message: "Invalid `proxy` option.",

package/lib/success.js

@@ -67,13 +67,44 @@ export default async function success(pluginConfig, context, { Octokit }) {
     const releaseInfos = releases.filter((release) => Boolean(release.name));
     const shas = commits.map(({ hash }) => hash);
 
-    const { repository } = await octokit.graphql(
-      buildAssociatedPRsQuery(shas),
-      { owner, repo },
-    );
-    const associatedPRs = Object.values(repository).map(
-      (item) => item.associatedPullRequests.nodes,
-    );
+    const associatedPRs = [];
+
+    // Split commit shas into chunks of 100 shas
+    const chunkSize = 100;
+    const shasChunks = [];
+    for (let i = 0; i < shas.length; i += chunkSize) {
+      const chunk = shas.slice(i, i + chunkSize);
+      shasChunks.push(chunk);
+    }
+    for (const chunk of shasChunks) {
+      const { repository } = await octokit.graphql(
+        buildAssociatedPRsQuery(chunk),
+        { owner, repo },
+      );
+      const responseAssociatedPRs = Object.values(repository).map(
+        (item) => item.associatedPullRequests,
+      );
+      for (const { nodes, pageInfo } of responseAssociatedPRs) {
+        associatedPRs.push(nodes);
+        if (pageInfo.hasNextPage) {
+          let cursor = pageInfo.endCursor;
+          let hasNextPage = true;
+          while (hasNextPage) {
+            const { repository } = await octokit.graphql(
+              loadSingleCommitAssociatedPRs,
+              { owner, repo, sha: response.commit.oid, cursor },
+            );
+            const { associatedPullRequests } = repository.commit;
+            associatedPRs.push(associatedPullRequests.nodes);
+            if (associatedPullRequests.pageInfo.hasNextPage) {
+              cursor = associatedPullRequests.pageInfo.endCursor;
+            } else {
+              hasNextPage = false;
+            }
+          }
+        }
+      }
+    }
 
     const uniqueAssociatedPRs = uniqBy(flatten(associatedPRs), "number");
 
@@ -252,7 +283,7 @@ export default async function success(pluginConfig, context, { Octokit }) {
  * @param {Array<string>} shas
  * @returns {string}
  */
-export function buildAssociatedPRsQuery(shas) {
+function buildAssociatedPRsQuery(shas) {
   return `#graphql
     query getAssociatedPRs($owner: String!, $repo: String!) {
       repository(owner: $owner, name: $repo) {
@@ -260,7 +291,12 @@ export function buildAssociatedPRsQuery(shas) {
           .map((sha) => {
             return `commit${sha.slice(0, 6)}: object(oid: "${sha}") {
             ...on Commit {
+              oid
               associatedPullRequests(first: 100) {
+                pageInfo {
+                  endCursor
+                  hasNextPage
+                }
                 nodes {
                   url
                   number
@@ -275,3 +311,28 @@ export function buildAssociatedPRsQuery(shas) {
     }
   `;
 }
+
+/**
+ * GraphQL Query to fetch additional associatedPR for commits that has more than 100 associatedPRs
+ */
+const loadSingleCommitAssociatedPRs = `#graphql
+  query getCommitAssociatedPRs($owner: String!, $repo: String!, $sha: String!, $cursor: String) {
+    repository(owner: $owner, name: $repo) {
+      commit: object(oid: $sha) {
+        ...on Commit {
+          associatedPullRequests(after: $cursor, first: 100) {
+            pageInfo {
+              endCursor
+              hasNextPage
+            }
+            nodes {
+              url
+              number
+              body
+            }
+          }
+        }
+      }
+    }
+  }
+`;

package/lib/verify.js

@@ -103,35 +103,34 @@ export default async function verify(pluginConfig, context, { Octokit }) {
         proxy,
       }),
     );
-
-    // https://github.com/semantic-release/github/issues/182
-    // Do not check for permissions in GitHub actions, as the provided token is an installation access token.
-    // octokit.request("GET /repos/{owner}/{repo}", {repo, owner}) does not return the "permissions" key in that case.
-    // But GitHub Actions have all permissions required for @semantic-release/github to work
-    if (env.GITHUB_ACTION) {
-      return;
-    }
-
     try {
       const {
-        data: {
-          permissions: { push },
-        },
+        data: { permissions, clone_url },
       } = await octokit.request("GET /repos/{owner}/{repo}", { repo, owner });
-      if (!push) {
+      // Verify if Repository Name wasn't changed
+      const parsedCloneUrl = parseGithubUrl(clone_url);
+      if (owner !== parsedCloneUrl.owner || repo !== parsedCloneUrl.repo) {
+        errors.push(
+          getError("EMISMATCHGITHUBURL", { repositoryUrl, clone_url }),
+        );
+      }
+
+      // https://github.com/semantic-release/github/issues/182
+      // Do not check for permissions in GitHub actions, as the provided token is an installation access token.
+      // octokit.request("GET /repos/{owner}/{repo}", {repo, owner}) does not return the "permissions" key in that case.
+      // But GitHub Actions have all permissions required for @semantic-release/github to work
+      if (!env.GITHUB_ACTION && !permissions?.push) {
         // If authenticated as GitHub App installation, `push` will always be false.
         // We send another request to check if current authentication is an installation.
         // Note: we cannot check if the installation has all required permissions, it's
         // up to the user to make sure it has
         if (
-          await octokit
+          !(await octokit
             .request("HEAD /installation/repositories", { per_page: 1 })
-            .catch(() => false)
+            .catch(() => false))
         ) {
-          return;
+          errors.push(getError("EGHNOPERMISSION", { owner, repo }));
         }
-
-        errors.push(getError("EGHNOPERMISSION", { owner, repo }));
       }
     } catch (error) {
       if (error.status === 401) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@semantic-release/github",
   "description": "semantic-release plugin to publish a GitHub release and comment on released Pull Requests/Issues",
-  "version": "10.1.4",
+  "version": "10.1.6",
   "type": "module",
   "author": "Pierre Vanduynslager (https://twitter.com/@pvdlg_)",
   "ava": {
@@ -49,7 +49,7 @@
     "ls-engines": "0.9.3",
     "npm-run-all2": "6.2.2",
     "prettier": "3.3.3",
-    "publint": "0.2.9",
+    "publint": "0.2.10",
     "semantic-release": "24.0.0",
     "sinon": "18.0.0",
     "tempy": "3.1.0"