@sentry/junior-github 0.146.0 → 0.147.0

package/SETUP.md

@@ -14,6 +14,7 @@ In GitHub:
 - Contents: Read and write
 - Pull requests: Read and write
 - Actions: Read and write
+- Checks: Read
 - Deployments: Read
 - Workflows: Write
 - Metadata: Read

package/dist/{chunk-AI2A6UER.js → chunk-IG5VPAKL.js}

@@ -292,36 +292,138 @@ function deploymentSourceTargets(input) {
 var checkSuiteWebhookSchema = z.object({
   action: z.string(),
   check_suite: z.object({
+    app: z.object({
+      name: z.string().optional().nullable(),
+      slug: z.string().optional().nullable()
+    }).optional().nullable(),
     conclusion: z.string().optional().nullable(),
     head_sha: z.string().optional(),
+    id: z.number().optional(),
+    latest_check_runs_count: z.number().optional().nullable(),
     pull_requests: z.array(z.object({ number: z.number() }))
   }),
   repository: repositorySchema
 });
-function normalizeCheckSuiteEvents(deliveryId, body) {
+var FAILING_CHECK_CONCLUSIONS = /* @__PURE__ */ new Set([
+  "failure",
+  "timed_out",
+  "cancelled",
+  "action_required",
+  "startup_failure"
+]);
+function buildCheckSuiteUrl(args) {
+  return `https://github.com/${args.repo}/commit/${args.headSha}/checks?check_suite_id=${args.checkSuiteId}`;
+}
+function oneLineLabel(value, maxLength = 80) {
+  return value.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim().slice(0, maxLength);
+}
+function buildCheckSuiteResourceEvent(args) {
+  const resource = gitHubPullRequestResource({
+    number: args.pullRequestNumber,
+    repo: args.repo
+  });
+  const shortSha = args.headSha?.slice(0, 12);
+  const failingChecks = (args.failingChecks ?? []).slice(0, 12);
+  const failingCount = failingChecks.length;
+  const trustedSummary = args.eventType === "pull_request.checks.failed" ? `${resource.label} checks failed${failingCount > 0 ? ` (${failingCount})` : ""}${shortSha ? ` for ${shortSha}` : ""}.` : `${resource.label} check suite recovered${shortSha ? ` for ${shortSha}` : ""}.`;
+  const data = {
+    repo: args.repo,
+    pullRequest: args.pullRequestNumber,
+    scope: "check_suite",
+    suiteConclusion: args.suiteConclusion
+  };
+  if (args.headSha) data.headSha = args.headSha;
+  if (args.checkSuiteId !== void 0) data.checkSuiteId = args.checkSuiteId;
+  if (args.checkSuiteId !== void 0 && args.headSha) {
+    data.checkSuiteUrl = buildCheckSuiteUrl({
+      checkSuiteId: args.checkSuiteId,
+      headSha: args.headSha,
+      repo: args.repo
+    });
+  }
+  if (args.appName) data.appName = oneLineLabel(args.appName, 120);
+  if (args.latestCheckRunsCount !== void 0) {
+    data.latestCheckRunsCount = args.latestCheckRunsCount;
+  }
+  if (args.eventType === "pull_request.checks.failed" && failingCount > 0) {
+    data.failingChecks = failingChecks.map((check) => ({
+      conclusion: check.conclusion,
+      ...check.htmlUrl ? { htmlUrl: check.htmlUrl } : {},
+      checkRunId: check.checkRunId
+    }));
+  }
+  const untrustedParts = args.eventType === "pull_request.checks.failed" ? failingChecks.map((check) => {
+    const name = oneLineLabel(check.name);
+    if (!name) return void 0;
+    return check.htmlUrl ? `${name}: ${check.htmlUrl}` : name;
+  }).filter((part) => part !== void 0) : [];
+  const untrustedText = untrustedParts.length > 0 ? [`Failed checks:`, ...untrustedParts.map((part) => `- ${part}`)].join(
+    "\n"
+  ) : void 0;
+  return {
+    eventKey: gitHubEventKey(
+      args.deliveryId,
+      `${args.eventType}:${args.pullRequestNumber}`
+    ),
+    eventType: args.eventType,
+    occurredAtMs: Date.now(),
+    identifier: resource.identifier,
+    trustedSummary,
+    data,
+    ...untrustedText ? { untrustedText } : {}
+  };
+}
+function selectFailingChecks(checkRuns, options) {
+  if (!Array.isArray(checkRuns)) return [];
+  const failing = [];
+  for (const run of checkRuns) {
+    if (!run || typeof run !== "object" || Array.isArray(run)) continue;
+    const record = run;
+    if (options?.checkSuiteId !== void 0) {
+      const suite = record.check_suite;
+      const suiteId = suite && typeof suite === "object" && !Array.isArray(suite) && typeof suite.id === "number" ? suite.id : void 0;
+      if (suiteId !== void 0 && suiteId !== options.checkSuiteId) continue;
+    }
+    const conclusion = typeof record.conclusion === "string" ? record.conclusion : void 0;
+    const name = typeof record.name === "string" ? record.name.trim() : "";
+    const checkRunId = typeof record.id === "number" && Number.isSafeInteger(record.id) ? record.id : void 0;
+    if (!conclusion || !FAILING_CHECK_CONCLUSIONS.has(conclusion)) continue;
+    if (!name || checkRunId === void 0) continue;
+    const htmlUrl = typeof record.html_url === "string" && record.html_url.length > 0 ? record.html_url : void 0;
+    failing.push({
+      checkRunId,
+      conclusion,
+      ...htmlUrl ? { htmlUrl } : {},
+      name
+    });
+  }
+  return failing.slice(0, 12);
+}
+function normalizeCheckSuiteEvents(deliveryId, body, options) {
   const parsed = checkSuiteWebhookSchema.safeParse(body);
   if (!parsed.success || parsed.data.action !== "completed") return [];
   const conclusion = parsed.data.check_suite.conclusion;
+  if (!conclusion) return [];
   const eventType = conclusion === "failure" || conclusion === "timed_out" ? "pull_request.checks.failed" : conclusion === "success" ? "pull_request.checks.recovered" : void 0;
   if (!eventType) return [];
-  const sha = parsed.data.check_suite.head_sha?.slice(0, 12);
-  return parsed.data.check_suite.pull_requests.flatMap((pullRequest) => {
+  const suite = parsed.data.check_suite;
+  const appName = suite.app?.name?.trim() || suite.app?.slug?.trim() || void 0;
+  const headSha = typeof suite.head_sha === "string" && /^[0-9a-f]{7,40}$/i.test(suite.head_sha) ? suite.head_sha : void 0;
+  return suite.pull_requests.flatMap((pullRequest) => {
     const repo = parsed.data.repository.full_name;
-    const resource = gitHubPullRequestResource({
-      number: pullRequest.number,
-      repo
-    });
     return pullRequestTargets(
-      {
-        eventKey: gitHubEventKey(
-          deliveryId,
-          `${eventType}:${pullRequest.number}`
-        ),
+      buildCheckSuiteResourceEvent({
+        appName,
+        checkSuiteId: suite.id,
+        deliveryId,
         eventType,
-        occurredAtMs: Date.now(),
-        identifier: resource.identifier,
-        trustedSummary: eventType === "pull_request.checks.failed" ? `${resource.label} checks failed${sha ? ` for ${sha}` : ""}.` : `${resource.label} checks recovered${sha ? ` for ${sha}` : ""}.`
-      },
+        failingChecks: eventType === "pull_request.checks.failed" ? options?.failingChecks : void 0,
+        headSha,
+        latestCheckRunsCount: typeof suite.latest_check_runs_count === "number" ? suite.latest_check_runs_count : void 0,
+        pullRequestNumber: pullRequest.number,
+        repo,
+        suiteConclusion: conclusion
+      }),
       repo
     );
   });
@@ -651,6 +753,20 @@ function normalizeReleaseEvent(deliveryId, body) {
     })
   );
 }
+function parseCheckSuiteEnrichmentTarget(body) {
+  const parsed = checkSuiteWebhookSchema.safeParse(body);
+  if (!parsed.success || parsed.data.action !== "completed") return void 0;
+  const conclusion = parsed.data.check_suite.conclusion;
+  if (conclusion !== "failure" && conclusion !== "timed_out") return void 0;
+  const headSha = parsed.data.check_suite.head_sha;
+  const checkSuiteId = parsed.data.check_suite.id;
+  if (typeof headSha !== "string" || !/^[0-9a-f]{7,40}$/i.test(headSha) || typeof checkSuiteId !== "number") {
+    return void 0;
+  }
+  const [owner, repoName, ...extra] = parsed.data.repository.full_name.split("/");
+  if (!owner || !repoName || extra.length > 0) return void 0;
+  return { checkSuiteId, headSha, owner, repoName };
+}
 function normalizeGitHubResourceEvents(args) {
   switch (args.eventName) {
     case "deployment": {
@@ -675,7 +791,9 @@ function normalizeGitHubResourceEvents(args) {
       return normalizePullRequestReviewCommentEvent(args.deliveryId, args.body);
     }
     case "check_suite":
-      return normalizeCheckSuiteEvents(args.deliveryId, args.body);
+      return normalizeCheckSuiteEvents(args.deliveryId, args.body, {
+        failingChecks: args.failingChecks
+      });
     case "release":
       return normalizeReleaseEvent(args.deliveryId, args.body);
     default:
@@ -697,5 +815,7 @@ export {
   GITHUB_RELEASE_SUGGESTED_EVENTS,
   gitHubReleaseSourceSubscribable,
   gitHubRepositorySubscribable,
+  selectFailingChecks,
+  parseCheckSuiteEnrichmentTarget,
   normalizeGitHubResourceEvents
 };

package/dist/index.js

@@ -12,8 +12,10 @@ import {
   gitHubPullRequestSubscribable,
   gitHubReleaseSourceSubscribable,
   gitHubRepositorySubscribable,
-  normalizeGitHubResourceEvents
-} from "./chunk-AI2A6UER.js";
+  normalizeGitHubResourceEvents,
+  parseCheckSuiteEnrichmentTarget,
+  selectFailingChecks
+} from "./chunk-IG5VPAKL.js";
 
 // src/plugin.ts
 import {
@@ -2445,10 +2447,12 @@ function createGitHubWebhookRoute(args) {
         args.db,
         pullRequestLinkedIssues
       ) : false;
+      const failingChecks = eventName === "check_suite" && args.loadFailingChecks ? await args.loadFailingChecks(body) : void 0;
       const resourceEvents = normalizeGitHubResourceEvents({
         body,
         deliveryId,
-        eventName
+        eventName,
+        failingChecks
       });
       for (const event of resourceEvents) {
         await args.resourceEvents.publish(event);
@@ -3330,215 +3334,6 @@ async function classifyGitHubPullRequestCommitComposition(args) {
   return foundCommit ? "junior_only" : void 0;
 }
 
-// src/git-config.ts
-function cleanIdentityPart(value) {
-  return String(value ?? "").replaceAll("\n", " ").replaceAll("\r", " ").replace(/[<>]/g, "").trim();
-}
-function isSlackUserId(value) {
-  return /^[UW][A-Z0-9]{5,}$/.test(value);
-}
-function isUserActor(actor) {
-  return Boolean(actor && "userId" in actor);
-}
-function actorDisplayName(value, actor) {
-  const name = cleanIdentityPart(value);
-  if (!name || name.toLowerCase() === "unknown" || name === cleanIdentityPart(isUserActor(actor) ? actor.userId : void 0)) {
-    return void 0;
-  }
-  return isSlackUserId(name) ? void 0 : name;
-}
-function actorName(actor) {
-  if (!isUserActor(actor)) {
-    return void 0;
-  }
-  return actorDisplayName(actor?.fullName, actor) || actorDisplayName(actor?.userName, actor) || void 0;
-}
-function actorEmail(actor) {
-  if (!isUserActor(actor)) {
-    return void 0;
-  }
-  const email = cleanIdentityPart(actor?.email);
-  return /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(email) ? email : void 0;
-}
-function actorIdentityKey(actor) {
-  if (actor.platform === "system") {
-    return `system ${actor.name}`;
-  }
-  return actor.platform === "slack" ? `slack ${actor.teamId} ${actor.userId}` : `${actor.platform} ${actor.userId}`;
-}
-function additionalActorCoauthorTrailers(args) {
-  if (!args.actors || args.actors.length === 0) {
-    return [];
-  }
-  const seenEmails = /* @__PURE__ */ new Set([args.botEmail.toLowerCase()]);
-  const seenActors = /* @__PURE__ */ new Set();
-  const trailers = [];
-  for (const candidate of args.actors) {
-    const actorKey = actorIdentityKey(candidate);
-    if (seenActors.has(actorKey)) {
-      continue;
-    }
-    const name = actorName(candidate);
-    const email = actorEmail(candidate);
-    if (!name || !email) {
-      continue;
-    }
-    const emailKey = email.toLowerCase();
-    if (seenEmails.has(emailKey)) {
-      continue;
-    }
-    seenActors.add(actorKey);
-    seenEmails.add(emailKey);
-    trailers.push(`Co-Authored-By: ${name} <${email}>`);
-  }
-  return trailers;
-}
-function prepareCommitMsgHook() {
-  return `#!/usr/bin/env bash
-set -eu
-
-message_file="\${1:-}"
-if [ -z "$message_file" ]; then
-  exit 1
-fi
-
-if [ -z "\${JUNIOR_GIT_AUTHOR_NAME:-}" ] || [ -z "\${JUNIOR_GIT_AUTHOR_EMAIL:-}" ]; then
-  echo "Junior GitHub plugin internal error: Junior author identity was not injected by the host runtime. Do not set Git author env vars manually; report this configuration error." >&2
-  exit 1
-fi
-
-if [ "\${GIT_AUTHOR_NAME:-}" != "$JUNIOR_GIT_AUTHOR_NAME" ] || [ "\${GIT_AUTHOR_EMAIL:-}" != "$JUNIOR_GIT_AUTHOR_EMAIL" ]; then
-  echo "Junior GitHub plugin internal error: Git author was not set to the Junior identity. Do not override Git author manually; report this configuration error." >&2
-  exit 1
-fi
-
-# Git and GitHub only interpret the final contiguous paragraph as the trailer
-# block, so all missing trailers are collected and appended as one block:
-# human actor trailers in run order.
-desired_trailers=""
-add_trailer() {
-  desired_trailers="$desired_trailers$1"$'\\n'
-}
-
-if [ -n "\${JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS:-}" ]; then
-  while IFS= read -r actor_trailer; do
-    if [ -n "$actor_trailer" ]; then
-      add_trailer "$actor_trailer"
-    fi
-  done <<< "$JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS"
-fi
-
-# The hook owns co-author attribution. Remove every model-supplied co-author
-# from the final Git trailer block before appending the host-derived actors.
-tmp_file=$(mktemp)
-trap 'rm -f "$tmp_file"' EXIT
-awk '
-  { lines[NR] = $0 }
-  END {
-    line = NR
-    while (line > 0 && lines[line] == "") {
-      line--
-    }
-    start = line
-    while (start > 0 && lines[start] != "") {
-      start--
-    }
-    valid = line > 0
-    for (i = start + 1; valid && i <= line; i++) {
-      if (lines[i] !~ /^[[:alnum:]-]+: .+/) {
-        valid = 0
-      }
-    }
-    if (!valid) {
-      for (i = 1; i <= NR; i++) {
-        print lines[i]
-      }
-      exit 0
-    }
-    kept = 0
-    for (i = start + 1; i <= line; i++) {
-      if (tolower(lines[i]) !~ /^co-authored-by: /) {
-        kept++
-      }
-    }
-    before = kept > 0 ? start : start - 1
-    for (i = 1; i <= before; i++) {
-      print lines[i]
-    }
-    for (i = start + 1; i <= line; i++) {
-      if (tolower(lines[i]) !~ /^co-authored-by: /) {
-        print lines[i]
-      }
-    }
-  }
-' "$message_file" > "$tmp_file"
-cat "$tmp_file" > "$message_file"
-
-final_trailer_block=$(awk '
-  { lines[NR] = $0 }
-  END {
-    line = NR
-    while (line > 0 && lines[line] == "") {
-      line--
-    }
-    if (line == 0) {
-      exit 0
-    }
-    start = line
-    while (start > 0 && lines[start] != "") {
-      start--
-    }
-    for (i = start + 1; i <= line; i++) {
-      if (lines[i] !~ /^[[:alnum:]-]+: .+/) {
-        exit 0
-      }
-    }
-    for (i = start + 1; i <= line; i++) {
-      print lines[i]
-    }
-  }
-' "$message_file")
-
-missing_trailers=""
-collect_missing_trailer() {
-  if ! printf '%s\\n' "$final_trailer_block" | grep -Fqx -- "$1"; then
-    missing_trailers="\${missing_trailers}\${1}"$'\\n'
-  fi
-}
-
-while IFS= read -r desired_trailer; do
-  if [ -n "$desired_trailer" ]; then
-    collect_missing_trailer "$desired_trailer"
-  fi
-done <<< "$desired_trailers"
-
-if [ -z "$missing_trailers" ]; then
-  exit 0
-fi
-
-if [ -n "$(tail -c 1 "$message_file")" ]; then
-  printf '\\n' >> "$message_file"
-fi
-
-if [ -n "$final_trailer_block" ]; then
-  printf '%s' "$missing_trailers" >> "$message_file"
-else
-  printf '\\n%s' "$missing_trailers" >> "$message_file"
-fi
-`;
-}
-async function configureGit(ctx, key, value) {
-  const result = await ctx.sandbox.run({
-    cmd: "git",
-    args: ["config", "--global", key, value]
-  });
-  if (result.exitCode !== 0) {
-    throw new Error(
-      `Failed to configure git ${key}: ${result.stderr || result.stdout}`
-    );
-  }
-}
-
 // src/credential-support.ts
 import { createPrivateKey, createSign } from "crypto";
 var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
@@ -3910,6 +3705,7 @@ async function resolveUserAccount(tokens) {
   }
   const url = typeof account.html_url === "string" ? account.html_url : void 0;
   return {
+    handle: login.trim(),
     id: String(id),
     label: login.trim(),
     ...url ? { url } : {}
@@ -4125,6 +3921,253 @@ function createPermissionCache() {
   };
 }
 
+// src/webhooks/check-suite-enrichment.ts
+function checkRunsFromResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return [];
+  }
+  const checkRuns = value.check_runs;
+  return Array.isArray(checkRuns) ? checkRuns : [];
+}
+async function loadFailingChecksForSuite(args) {
+  const target = parseCheckSuiteEnrichmentTarget(args.body);
+  if (!target) return void 0;
+  try {
+    const token = await issueInstallationToken({
+      appIdEnv: args.appIdEnv,
+      installationIdEnv: args.installationIdEnv,
+      permissions: { checks: "read" },
+      privateKeyEnv: args.privateKeyEnv,
+      repositories: [target.repoName]
+    });
+    const response = await githubRequest(
+      "https://api.github.com",
+      `/repos/${encodeURIComponent(target.owner)}/${encodeURIComponent(target.repoName)}/check-suites/${target.checkSuiteId}/check-runs?filter=latest&per_page=100`,
+      { token: token.token }
+    );
+    const failing = selectFailingChecks(checkRunsFromResponse(response), {
+      checkSuiteId: target.checkSuiteId
+    });
+    return failing.length > 0 ? failing : void 0;
+  } catch (error) {
+    args.log?.error("GitHub check suite enrichment failed", {
+      checkSuiteId: target.checkSuiteId,
+      errorType: error instanceof Error ? error.name : "UnknownError",
+      repository: `${target.owner}/${target.repoName}`
+    });
+    return void 0;
+  }
+}
+
+// src/git-config.ts
+function cleanIdentityPart(value) {
+  return String(value ?? "").replaceAll("\n", " ").replaceAll("\r", " ").replace(/[<>]/g, "").trim();
+}
+function isSlackUserId(value) {
+  return /^[UW][A-Z0-9]{5,}$/.test(value);
+}
+function isUserActor(actor) {
+  return Boolean(actor && "userId" in actor);
+}
+function actorDisplayName(value, actor) {
+  const name = cleanIdentityPart(value);
+  if (!name || name.toLowerCase() === "unknown" || name === cleanIdentityPart(isUserActor(actor) ? actor.userId : void 0)) {
+    return void 0;
+  }
+  return isSlackUserId(name) ? void 0 : name;
+}
+function actorName(actor) {
+  if (!isUserActor(actor)) {
+    return void 0;
+  }
+  return actorDisplayName(actor?.fullName, actor) || actorDisplayName(actor?.userName, actor) || void 0;
+}
+function actorEmail(actor) {
+  if (!isUserActor(actor)) {
+    return void 0;
+  }
+  const email = cleanIdentityPart(actor?.email);
+  return /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(email) ? email : void 0;
+}
+function actorIdentityKey(actor) {
+  if (actor.platform === "system") {
+    return `system ${actor.name}`;
+  }
+  return actor.platform === "slack" ? `slack ${actor.teamId} ${actor.userId}` : `${actor.platform} ${actor.userId}`;
+}
+function additionalActorCoauthorTrailers(args) {
+  if (!args.actors || args.actors.length === 0) {
+    return [];
+  }
+  const seenEmails = /* @__PURE__ */ new Set([args.botEmail.toLowerCase()]);
+  const seenActors = /* @__PURE__ */ new Set();
+  const trailers = [];
+  for (const candidate of args.actors) {
+    const actorKey = actorIdentityKey(candidate);
+    if (seenActors.has(actorKey)) {
+      continue;
+    }
+    const name = actorName(candidate);
+    const email = actorEmail(candidate);
+    if (!name || !email) {
+      continue;
+    }
+    const emailKey = email.toLowerCase();
+    if (seenEmails.has(emailKey)) {
+      continue;
+    }
+    seenActors.add(actorKey);
+    seenEmails.add(emailKey);
+    trailers.push(`Co-Authored-By: ${name} <${email}>`);
+  }
+  return trailers;
+}
+function prepareCommitMsgHook() {
+  return `#!/usr/bin/env bash
+set -eu
+
+message_file="\${1:-}"
+if [ -z "$message_file" ]; then
+  exit 1
+fi
+
+if [ -z "\${JUNIOR_GIT_AUTHOR_NAME:-}" ] || [ -z "\${JUNIOR_GIT_AUTHOR_EMAIL:-}" ]; then
+  echo "Junior GitHub plugin internal error: Junior author identity was not injected by the host runtime. Do not set Git author env vars manually; report this configuration error." >&2
+  exit 1
+fi
+
+if [ "\${GIT_AUTHOR_NAME:-}" != "$JUNIOR_GIT_AUTHOR_NAME" ] || [ "\${GIT_AUTHOR_EMAIL:-}" != "$JUNIOR_GIT_AUTHOR_EMAIL" ]; then
+  echo "Junior GitHub plugin internal error: Git author was not set to the Junior identity. Do not override Git author manually; report this configuration error." >&2
+  exit 1
+fi
+
+# Git and GitHub only interpret the final contiguous paragraph as the trailer
+# block, so all missing trailers are collected and appended as one block:
+# human actor trailers in run order.
+desired_trailers=""
+add_trailer() {
+  desired_trailers="$desired_trailers$1"$'\\n'
+}
+
+if [ -n "\${JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS:-}" ]; then
+  while IFS= read -r actor_trailer; do
+    if [ -n "$actor_trailer" ]; then
+      add_trailer "$actor_trailer"
+    fi
+  done <<< "$JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS"
+fi
+
+# The hook owns co-author attribution. Remove every model-supplied co-author
+# from the final Git trailer block before appending the host-derived actors.
+tmp_file=$(mktemp)
+trap 'rm -f "$tmp_file"' EXIT
+awk '
+  { lines[NR] = $0 }
+  END {
+    line = NR
+    while (line > 0 && lines[line] == "") {
+      line--
+    }
+    start = line
+    while (start > 0 && lines[start] != "") {
+      start--
+    }
+    valid = line > 0
+    for (i = start + 1; valid && i <= line; i++) {
+      if (lines[i] !~ /^[[:alnum:]-]+: .+/) {
+        valid = 0
+      }
+    }
+    if (!valid) {
+      for (i = 1; i <= NR; i++) {
+        print lines[i]
+      }
+      exit 0
+    }
+    kept = 0
+    for (i = start + 1; i <= line; i++) {
+      if (tolower(lines[i]) !~ /^co-authored-by: /) {
+        kept++
+      }
+    }
+    before = kept > 0 ? start : start - 1
+    for (i = 1; i <= before; i++) {
+      print lines[i]
+    }
+    for (i = start + 1; i <= line; i++) {
+      if (tolower(lines[i]) !~ /^co-authored-by: /) {
+        print lines[i]
+      }
+    }
+  }
+' "$message_file" > "$tmp_file"
+cat "$tmp_file" > "$message_file"
+
+final_trailer_block=$(awk '
+  { lines[NR] = $0 }
+  END {
+    line = NR
+    while (line > 0 && lines[line] == "") {
+      line--
+    }
+    if (line == 0) {
+      exit 0
+    }
+    start = line
+    while (start > 0 && lines[start] != "") {
+      start--
+    }
+    for (i = start + 1; i <= line; i++) {
+      if (lines[i] !~ /^[[:alnum:]-]+: .+/) {
+        exit 0
+      }
+    }
+    for (i = start + 1; i <= line; i++) {
+      print lines[i]
+    }
+  }
+' "$message_file")
+
+missing_trailers=""
+collect_missing_trailer() {
+  if ! printf '%s\\n' "$final_trailer_block" | grep -Fqx -- "$1"; then
+    missing_trailers="\${missing_trailers}\${1}"$'\\n'
+  fi
+}
+
+while IFS= read -r desired_trailer; do
+  if [ -n "$desired_trailer" ]; then
+    collect_missing_trailer "$desired_trailer"
+  fi
+done <<< "$desired_trailers"
+
+if [ -z "$missing_trailers" ]; then
+  exit 0
+fi
+
+if [ -n "$(tail -c 1 "$message_file")" ]; then
+  printf '\\n' >> "$message_file"
+fi
+
+if [ -n "$final_trailer_block" ]; then
+  printf '%s' "$missing_trailers" >> "$message_file"
+else
+  printf '\\n%s' "$missing_trailers" >> "$message_file"
+fi
+`;
+}
+async function configureGit(ctx, key, value) {
+  const result = await ctx.sandbox.run({
+    cmd: "git",
+    args: ["config", "--global", key, value]
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Failed to configure git ${key}: ${result.stderr || result.stdout}`
+    );
+  }
+}
+
 // src/plugin.ts
 function githubSmartHttpAccess(upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
@@ -4618,6 +4661,13 @@ function githubPlugin(options = {}) {
             },
             db: ctx.db,
             installationId: () => readEnv(installationIdEnv),
+            loadFailingChecks: async (body) => await loadFailingChecksForSuite({
+              appIdEnv,
+              body,
+              installationIdEnv,
+              log: ctx.log,
+              privateKeyEnv
+            }),
             log: ctx.log,
             resourceEvents: ctx.resourceEvents,
             webhookSecret: () => readEnv("GITHUB_WEBHOOK_SECRET")

package/dist/testing.js

@@ -1,6 +1,6 @@
 import {
   normalizeGitHubResourceEvents
-} from "./chunk-AI2A6UER.js";
+} from "./chunk-IG5VPAKL.js";
 export {
   normalizeGitHubResourceEvents
 };

package/dist/webhooks/check-suite-enrichment.d.ts

@@ -0,0 +1,11 @@
+import { type GitHubFailingCheck } from "./resource-events.js";
+/** Load failed check-run names and urls for one failed check suite. */
+export declare function loadFailingChecksForSuite(args: {
+    appIdEnv: string;
+    body: unknown;
+    installationIdEnv: string;
+    log?: {
+        error(message: string, metadata?: Record<string, unknown>): void;
+    };
+    privateKeyEnv: string;
+}): Promise<GitHubFailingCheck[] | undefined>;

package/dist/webhooks/handler.d.ts

@@ -1,6 +1,7 @@
 import type { PluginLogger, PluginRoute, ResourceEventPublisher } from "@sentry/junior-plugin-api";
 import type { GitHubDb } from "../db/database.js";
 import type { GitHubPullRequestCommitComposition } from "../db/schema.js";
+import { type GitHubFailingCheck } from "./resource-events.js";
 /** Create the public, signed GitHub webhook route owned by the plugin. */
 export declare function createGitHubWebhookRoute(args: {
     botEmail(): string | undefined;
@@ -10,6 +11,7 @@ export declare function createGitHubWebhookRoute(args: {
     }): Promise<GitHubPullRequestCommitComposition | undefined>;
     db: GitHubDb;
     installationId(): string | undefined;
+    loadFailingChecks?(body: unknown): Promise<GitHubFailingCheck[] | undefined>;
     log?: Pick<PluginLogger, "error">;
     resourceEvents: ResourceEventPublisher;
     webhookSecret(): string | undefined;

package/dist/webhooks/resource-events.d.ts

@@ -1,7 +1,44 @@
 import type { ResourceEventInput } from "@sentry/junior-plugin-api";
+export type GitHubFailingCheck = {
+    checkRunId: number;
+    conclusion: string;
+    htmlUrl?: string;
+    name: string;
+};
+/** Build a browser URL for one check suite. GitHub does not send html_url. */
+export declare function buildCheckSuiteUrl(args: {
+    checkSuiteId: number;
+    headSha: string;
+    repo: string;
+}): string;
+/** Build the trusted data and summary for one check-suite PR event. */
+export declare function buildCheckSuiteResourceEvent(args: {
+    appName?: string;
+    checkSuiteId?: number;
+    deliveryId: string;
+    eventType: "pull_request.checks.failed" | "pull_request.checks.recovered";
+    failingChecks?: GitHubFailingCheck[];
+    headSha?: string;
+    latestCheckRunsCount?: number;
+    pullRequestNumber: number;
+    repo: string;
+    suiteConclusion: string;
+}): ResourceEventInput;
+/** Keep only failed check runs from one suite. */
+export declare function selectFailingChecks(checkRuns: unknown, options?: {
+    checkSuiteId?: number;
+}): GitHubFailingCheck[];
+/** Read the check suite target used to load failed check runs. */
+export declare function parseCheckSuiteEnrichmentTarget(body: unknown): {
+    checkSuiteId: number;
+    headSha: string;
+    owner: string;
+    repoName: string;
+} | undefined;
 /** Normalize one verified GitHub delivery into conversation resource events. */
 export declare function normalizeGitHubResourceEvents(args: {
     body: unknown;
     deliveryId: string;
     eventName: string;
+    failingChecks?: GitHubFailingCheck[];
 }): ResourceEventInput[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.146.0",
+  "version": "0.147.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.146.0"
+    "@sentry/junior-plugin-api": "0.147.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",