@shipfox/api-integration-github 11.0.0 → 12.0.0

package/src/core/webhook.ts

@@ -1,6 +1,8 @@
 import {
   type GithubPushPayloadDto,
+  githubInstallationRepositoriesPayloadSchema,
   githubPushPayloadSchema,
+  githubRepositoryRenamedPayloadSchema,
   githubWebhookActionSchema,
   githubWebhookInstallationSchema,
 } from '@shipfox/api-integration-github-dto';
@@ -10,8 +12,10 @@ import {
   type IntegrationTx,
   type PublishIntegrationEventReceivedFn,
   type PublishSourcePushFn,
+  type PublishSourceRepositoryUpdatedFn,
   type RecordDeliveryOnlyFn,
   type SourcePushPayload,
+  type SourceRepositoryIdentity,
 } from '@shipfox/api-integration-spi';
 import {logger} from '@shipfox/node-opentelemetry';
 import {getGithubInstallationByInstallationId} from '#db/installations.js';
@@ -27,6 +31,7 @@ export interface HandleGithubEventParams {
   event: string;
   payload: unknown;
   publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  publishSourceRepositoryUpdated: PublishSourceRepositoryUpdatedFn;
   publishSourcePush: PublishSourcePushFn;
   recordDeliveryOnly: RecordDeliveryOnlyFn;
   getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
@@ -39,6 +44,7 @@ export type HandleGithubEventOutcome =
   | 'duplicate-envelope'
   | 'published-push-envelope-only'
   | 'duplicate-push-envelope-only'
+  | 'fork-pull-request'
   | 'unknown-installation'
   | 'missing-connection'
   | 'inactive-connection'
@@ -53,11 +59,88 @@ function isBranchDeletion(after: string): boolean {
   return after === DELETED_BRANCH_SHA;
 }
 
+interface GithubRepositoryIdentity {
+  id?: string;
+  fullName?: string;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+function repositoryIdentity(value: unknown): GithubRepositoryIdentity | undefined {
+  if (!isRecord(value)) return undefined;
+
+  const id =
+    (typeof value.id === 'number' && Number.isInteger(value.id) ? String(value.id) : undefined) ??
+    (typeof value.id === 'string' && value.id.trim() ? value.id.trim() : undefined);
+  const fullName =
+    typeof value.full_name === 'string' && value.full_name.trim()
+      ? value.full_name.trim().toLowerCase()
+      : undefined;
+  if (!id && !fullName) return undefined;
+
+  return {...(id ? {id} : {}), ...(fullName ? {fullName} : {})};
+}
+
+function areSameRepositories(
+  head: GithubRepositoryIdentity,
+  base: GithubRepositoryIdentity,
+): boolean {
+  if (head.id && base.id) return head.id === base.id;
+  if (head.fullName && base.fullName) return head.fullName === base.fullName;
+  return false;
+}
+
+function pullRequestRepositories(
+  payload: unknown,
+):
+  | {head: GithubRepositoryIdentity | undefined; base: GithubRepositoryIdentity | undefined}
+  | undefined {
+  if (!isRecord(payload) || !isRecord(payload.pull_request)) return undefined;
+
+  const pullRequest = payload.pull_request;
+  const head = isRecord(pullRequest.head) ? repositoryIdentity(pullRequest.head.repo) : undefined;
+  const base =
+    (isRecord(pullRequest.base) ? repositoryIdentity(pullRequest.base.repo) : undefined) ??
+    repositoryIdentity(payload.repository);
+  return {head, base};
+}
+
 export async function handleGithubEvent(
   params: HandleGithubEventParams,
 ): Promise<HandleGithubEventResult> {
   const actionEnvelope = githubWebhookActionSchema.safeParse(params.payload);
   const action = actionEnvelope.success ? actionEnvelope.data.action : undefined;
+
+  const pullRequestRepos = pullRequestRepositories(params.payload);
+  if (
+    pullRequestRepos &&
+    (!pullRequestRepos.head ||
+      !pullRequestRepos.base ||
+      !areSameRepositories(pullRequestRepos.head, pullRequestRepos.base))
+  ) {
+    logger().info(
+      {
+        deliveryId: params.deliveryId,
+        event: params.event,
+        reason:
+          !pullRequestRepos.head || !pullRequestRepos.base
+            ? 'repository_unresolved'
+            : 'repositories_differ',
+        headRepository: pullRequestRepos.head,
+        baseRepository: pullRequestRepos.base,
+      },
+      'github webhook: fork or indeterminate pull request, dropping',
+    );
+    await params.recordDeliveryOnly({
+      tx: params.tx,
+      provider: GITHUB_SOURCE,
+      deliveryId: params.deliveryId,
+    });
+    return {outcome: 'fork-pull-request'};
+  }
+
   const installationEnvelope = githubWebhookInstallationSchema.safeParse(params.payload);
   const installationId = installationEnvelope.success
     ? installationEnvelope.data.installation?.id
@@ -157,6 +240,30 @@ export async function handleGithubEvent(
   }
 
   const eventName = action ? `${params.event}.${action}` : params.event;
+  const repositories = normalizeRepositoryUpdates(params.event, action, params.payload);
+  if (repositories) {
+    const result = await params.publishSourceRepositoryUpdated({
+      tx: params.tx,
+      provider: GITHUB_SOURCE,
+      source: connection.slug,
+      workspaceId: connection.workspaceId,
+      connectionId: connection.id,
+      connectionName: connection.displayName,
+      deliveryId: params.deliveryId,
+      receivedAt: new Date().toISOString(),
+      rawPayload: params.payload,
+      event: eventName,
+      repositories,
+    });
+    return withInstallationTokenCleanup(
+      {outcome: result.published ? 'published' : 'duplicate'},
+      params.event,
+      action,
+      connection.workspaceId,
+      installationId,
+    );
+  }
+
   const result = await publishGithubEnvelopeOnly({
     tx: params.tx,
     deliveryId: params.deliveryId,
@@ -174,6 +281,49 @@ export async function handleGithubEvent(
   );
 }
 
+function normalizeRepositoryUpdates(
+  event: string,
+  action: string | undefined,
+  payload: unknown,
+): SourceRepositoryIdentity[] | undefined {
+  if (event === 'repository' && action === 'renamed') {
+    const parsed = githubRepositoryRenamedPayloadSchema.safeParse(payload);
+    if (!parsed.success) return undefined;
+    return [toSourceRepositoryIdentity(parsed.data.repository)];
+  }
+
+  if (event !== 'installation_repositories' || (action !== 'added' && action !== 'removed')) {
+    return undefined;
+  }
+
+  const parsed = githubInstallationRepositoriesPayloadSchema.safeParse(payload);
+  if (!parsed.success) return undefined;
+
+  const repositories = new Map<number, SourceRepositoryIdentity>();
+  for (const repository of [
+    ...parsed.data.repositories_added,
+    ...parsed.data.repositories_removed,
+  ]) {
+    const normalized = toSourceRepositoryIdentity(repository);
+    repositories.set(repository.id, normalized);
+  }
+  return repositories.size > 0 ? [...repositories.values()] : undefined;
+}
+
+function toSourceRepositoryIdentity(repository: {
+  id: number;
+  name: string;
+  owner: {login: string};
+  default_branch: string;
+}): SourceRepositoryIdentity {
+  return {
+    externalRepositoryId: buildProviderRepositoryId(GITHUB_SOURCE, String(repository.id)),
+    owner: repository.owner.login,
+    name: repository.name,
+    defaultBranch: repository.default_branch,
+  };
+}
+
 function shouldDeleteInstallationTokenSecret(event: string, action: string | undefined): boolean {
   return event === 'installation' && (action === 'deleted' || action === 'suspend');
 }

package/src/index.test.ts

@@ -25,6 +25,7 @@ describe('createGithubIntegrationProvider', () => {
       connectGithubInstallation: vi.fn() as never,
       coreDb: vi.fn() as never,
       publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: false})),
+      publishSourceRepositoryUpdated: vi.fn(() => Promise.resolve({published: false})),
       publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
       recordDeliveryOnly: vi.fn(() => Promise.resolve()),
       getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),

package/src/index.ts

@@ -2,6 +2,7 @@ import type {
   GetIntegrationConnectionByIdFn,
   PublishIntegrationEventReceivedFn,
   PublishSourcePushFn,
+  PublishSourceRepositoryUpdatedFn,
   RecordDeliveryOnlyFn,
 } from '@shipfox/api-integration-spi';
 import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
@@ -69,6 +70,7 @@ export interface CreateGithubIntegrationProviderOptions
   github?: GithubApiClient | undefined;
   coreDb: () => NodePgDatabase<Record<string, unknown>>;
   publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  publishSourceRepositoryUpdated: PublishSourceRepositoryUpdatedFn;
   publishSourcePush: PublishSourcePushFn;
   recordDeliveryOnly: RecordDeliveryOnlyFn;
   getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
@@ -129,6 +131,7 @@ export function createGithubIntegrationProvider(options: CreateGithubIntegration
       createGithubWebhookRoutes({
         coreDb: options.coreDb,
         publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+        publishSourceRepositoryUpdated: options.publishSourceRepositoryUpdated,
         publishSourcePush: options.publishSourcePush,
         recordDeliveryOnly: options.recordDeliveryOnly,
         getIntegrationConnectionById: options.getIntegrationConnectionById,

package/src/presentation/routes/install.test.ts

@@ -100,9 +100,10 @@ async function createTestApp(options: CreateTestAppOptions = {}): Promise<Fastif
 
         return Promise.resolve(connection);
       }),
-    // Webhook receiver dependencies — install/OAuth tests don't exercise them.
+    // Webhook receiver dependencies: install/OAuth tests don't exercise them.
     coreDb: vi.fn() as never,
     publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: false})),
+    publishSourceRepositoryUpdated: vi.fn(() => Promise.resolve({published: false})),
     publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
     recordDeliveryOnly: vi.fn(() => Promise.resolve()),
     getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),

package/src/presentation/routes/webhooks.test.ts

@@ -11,6 +11,7 @@ import {createGithubWebhookRoutes} from './webhooks.js';
 const WEBHOOK_SECRET = 'test-webhook-secret';
 
 // The route persists through injected core functions (publishSourcePush,
+// publishSourceRepositoryUpdated,
 // recordDeliveryOnly, getIntegrationConnectionById) that @shipfox/api-integration-core
 // owns and wires in production. github only orchestrates them, so here we fake that
 // interface with spies and assert the route's own behavior: signature/payload
@@ -34,6 +35,7 @@ function fakeConnection(overrides: Partial<IntegrationConnection> = {}): Integra
 interface TestApp {
   app: FastifyInstance;
   publishIntegrationEventReceived: ReturnType<typeof vi.fn>;
+  publishSourceRepositoryUpdated: ReturnType<typeof vi.fn>;
   publishSourcePush: ReturnType<typeof vi.fn>;
   recordDeliveryOnly: ReturnType<typeof vi.fn>;
   getIntegrationConnectionById: ReturnType<typeof vi.fn>;
@@ -41,6 +43,7 @@ interface TestApp {
 
 async function createTestApp(options: {connection?: IntegrationConnection} = {}): Promise<TestApp> {
   const publishIntegrationEventReceived = vi.fn(() => Promise.resolve({published: true}));
+  const publishSourceRepositoryUpdated = vi.fn(() => Promise.resolve({published: true}));
   const publishSourcePush = vi.fn(() => Promise.resolve({published: true}));
   const recordDeliveryOnly = vi.fn(() => Promise.resolve());
   const getIntegrationConnectionById = vi.fn(() =>
@@ -49,6 +52,7 @@ async function createTestApp(options: {connection?: IntegrationConnection} = {})
   const routes = createGithubWebhookRoutes({
     coreDb: db,
     publishIntegrationEventReceived,
+    publishSourceRepositoryUpdated,
     publishSourcePush,
     recordDeliveryOnly,
     getIntegrationConnectionById,
@@ -58,6 +62,7 @@ async function createTestApp(options: {connection?: IntegrationConnection} = {})
   return {
     app,
     publishIntegrationEventReceived,
+    publishSourceRepositoryUpdated,
     publishSourcePush,
     recordDeliveryOnly,
     getIntegrationConnectionById,
@@ -250,7 +255,12 @@ describe('GitHub webhook route', () => {
     const rawPayload = {
       action: 'opened',
       installation: {id: installationId},
-      pull_request: {number: 17},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        number: 17,
+        head: {repo: {id: 42, full_name: 'shipfox/platform'}},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
     };
     const body = JSON.stringify(rawPayload);
 
@@ -278,6 +288,44 @@ describe('GitHub webhook route', () => {
     });
   });
 
+  it('records and drops a pull request opened from a fork', async () => {
+    const installationId = 7787;
+    const connection = fakeConnection();
+    await seedInstallation(installationId, connection.id);
+    const {
+      app,
+      publishIntegrationEventReceived,
+      publishSourcePush,
+      recordDeliveryOnly,
+      getIntegrationConnectionById,
+    } = await createTestApp({connection});
+    const deliveryId = randomUUID();
+    const rawPayload = {
+      action: 'opened',
+      installation: {id: installationId},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        head: {repo: {id: 84, full_name: 'contributor/platform'}},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
+    };
+    const body = JSON.stringify(rawPayload);
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/github',
+      headers: signedHeaders(body, 'pull_request', deliveryId),
+      payload: body,
+    });
+
+    expect(res.statusCode).toBe(204);
+    expect(publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(publishSourcePush).not.toHaveBeenCalled();
+    expect(recordDeliveryOnly).toHaveBeenCalledTimes(1);
+    expect(recordDeliveryOnly.mock.calls[0]?.[0]).toMatchObject({provider: 'github', deliveryId});
+    expect(getIntegrationConnectionById).not.toHaveBeenCalled();
+  });
+
   it('publishes a generic envelope for a non-push event without an action', async () => {
     const installationId = 7785;
     const connection = fakeConnection();

package/src/presentation/routes/webhooks.ts

@@ -3,6 +3,7 @@ import type {
   GetIntegrationConnectionByIdFn,
   PublishIntegrationEventReceivedFn,
   PublishSourcePushFn,
+  PublishSourceRepositoryUpdatedFn,
   RecordDeliveryOnlyFn,
   StoredWebhookRequest,
   WebhookProcessingResult,
@@ -28,6 +29,7 @@ const DELIVERY_HEADER = 'x-github-delivery';
 export interface CreateGithubWebhookRoutesOptions {
   coreDb: () => NodePgDatabase<Record<string, unknown>>;
   publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  publishSourceRepositoryUpdated: PublishSourceRepositoryUpdatedFn;
   publishSourcePush: PublishSourcePushFn;
   recordDeliveryOnly: RecordDeliveryOnlyFn;
   getIntegrationConnectionById: GetIntegrationConnectionByIdFn;