@shipfox/api-integration-github 11.0.0 → 12.2.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-integration-github",
   "license": "MIT",
-  "version": "11.0.0",
+  "version": "12.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -27,14 +27,14 @@
     "ky": "^2.0.0",
     "octokit": "^5.0.3",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "11.0.0",
-    "@shipfox/api-integration-spi": "0.2.2",
-    "@shipfox/api-integration-github-dto": "9.0.2",
+    "@shipfox/api-auth-context": "12.2.0",
+    "@shipfox/api-integration-spi": "1.0.1",
+    "@shipfox/api-integration-github-dto": "12.2.0",
     "@shipfox/config": "1.2.4",
-    "@shipfox/node-drizzle": "0.3.4",
-    "@shipfox/node-fastify": "0.4.0",
-    "@shipfox/node-postgres": "0.4.4",
-    "@shipfox/node-opentelemetry": "0.6.3",
+    "@shipfox/node-drizzle": "0.3.5",
+    "@shipfox/node-fastify": "0.4.2",
+    "@shipfox/node-postgres": "0.5.0",
+    "@shipfox/node-opentelemetry": "0.6.4",
     "@shipfox/node-error-monitoring": "0.3.0"
   },
   "imports": {

package/src/connection-external-url.test.ts

@@ -40,6 +40,7 @@ function createProvider(lookup: (connectionId: string) => Promise<GithubInstalla
     connectGithubInstallation: vi.fn() as never,
     coreDb: vi.fn() as never,
     publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: false})),
+    publishSourceRepositoryUpdated: vi.fn(() => Promise.resolve({published: false})),
     publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
     recordDeliveryOnly: vi.fn(() => Promise.resolve()),
     getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),

package/src/core/agent-tools.test.ts

@@ -547,6 +547,7 @@ function createProvider() {
     connectGithubInstallation: vi.fn() as never,
     coreDb: vi.fn() as never,
     publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: false})),
+    publishSourceRepositoryUpdated: vi.fn(() => Promise.resolve({published: false})),
     publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
     recordDeliveryOnly: vi.fn(() => Promise.resolve()),
     getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),

package/src/core/source-control.test.ts

@@ -3,6 +3,8 @@ import {githubInstallationFactory} from '#test/index.js';
 import {GithubIntegrationProviderError} from './errors.js';
 import {GithubSourceControlProvider} from './source-control.js';
 
+const VALID_COMMIT = 'a'.repeat(40);
+
 function githubClient(overrides: Partial<GithubApiClient> = {}): GithubApiClient {
   return {
     exchangeOAuthCode: vi.fn(() => Promise.resolve('token')),
@@ -95,6 +97,84 @@ describe('GithubSourceControlProvider', () => {
     };
   }
 
+  it('normalizes push trigger references', () => {
+    const provider = new GithubSourceControlProvider(githubClient());
+
+    const result = provider.resolveTriggerReference({
+      ref: 'refs/heads/feature/review',
+      after: VALID_COMMIT,
+      repository: {id: 42},
+      sender: {login: 'octocat'},
+    });
+
+    expect(result).toEqual({
+      externalRepositoryId: 'github:42',
+      ref: 'refs/heads/feature/review',
+      commit: VALID_COMMIT,
+      actor: 'octocat',
+    });
+  });
+
+  it('resolves a null actor when the payload names no sender', () => {
+    const provider = new GithubSourceControlProvider(githubClient());
+
+    const result = provider.resolveTriggerReference({
+      ref: 'refs/heads/main',
+      after: VALID_COMMIT,
+      repository: {id: 42},
+    });
+
+    expect(result).toMatchObject({actor: null});
+  });
+
+  it('normalizes pull-request trigger references from the head repository', () => {
+    const provider = new GithubSourceControlProvider(githubClient());
+
+    const result = provider.resolveTriggerReference({
+      repository: {id: 42},
+      sender: {login: 'octocat'},
+      pull_request: {
+        number: 17,
+        head: {
+          sha: VALID_COMMIT,
+          repo: {id: 42},
+        },
+        base: {repo: {id: 42}},
+      },
+    });
+
+    expect(result).toEqual({
+      externalRepositoryId: 'github:42',
+      ref: 'refs/pull/17/head',
+      commit: VALID_COMMIT,
+      actor: 'octocat',
+    });
+  });
+
+  it.each([
+    undefined,
+    {},
+    {ref: 'refs/heads/main', after: VALID_COMMIT},
+    {ref: 'refs/heads/feature branch', after: VALID_COMMIT, repository: {id: 42}},
+    {ref: 'refs/heads/feature..branch', after: VALID_COMMIT, repository: {id: 42}},
+    {ref: 'refs/heads/main', after: '0'.repeat(40), repository: {id: 42}},
+    {ref: 'refs/heads/main', after: 'not-a-commit', repository: {id: 42}},
+    {
+      repository: {id: 42},
+      pull_request: {
+        number: 17,
+        head: {sha: VALID_COMMIT, repo: {id: 84}},
+        base: {repo: {id: 42}},
+      },
+    },
+  ])('returns null for an unresolvable or unsafe trigger payload', (payload) => {
+    const provider = new GithubSourceControlProvider(githubClient());
+
+    const result = provider.resolveTriggerReference(payload);
+
+    expect(result).toBeNull();
+  });
+
   it('lists repositories using installation auth metadata', async () => {
     await createInstallation();
     const github = githubClient();

package/src/core/source-control.ts

@@ -1,5 +1,6 @@
 import {Buffer} from 'node:buffer';
 import {
+  asRecord,
   buildProviderRepositoryId,
   type CheckoutSpec,
   type CreateCheckoutSpecInput,
@@ -7,15 +8,21 @@ import {
   type FilePage,
   type FileSnapshot,
   type IntegrationConnection,
+  isRecord,
+  isValidGitObjectId,
+  isValidTriggerRef,
   type ListFilesInput,
   type ListRepositoriesInput,
   MAX_REPOSITORY_FILE_BYTES,
+  nonEmptyString,
   parseProviderRepositoryId,
+  positiveInteger,
   type RepositoryPage,
   type RepositorySnapshot,
   type RepositoryVisibility,
   type ResolveRepositoryInput,
   type SourceControlProvider,
+  type TriggerReference,
 } from '@shipfox/api-integration-spi';
 import type {GithubApiClient, GithubRepository} from '#api/client.js';
 import {config} from '#config.js';
@@ -143,6 +150,48 @@ export class GithubSourceControlProvider
     };
   }
 
+  resolveTriggerReference(payload: unknown): TriggerReference | null {
+    if (!isRecord(payload)) return null;
+
+    const actor = githubEventActor(payload);
+    const pullRequest = asRecord(payload.pull_request);
+    if (pullRequest) {
+      const head = asRecord(pullRequest.head);
+      const repository = asRecord(head?.repo);
+      const base = asRecord(pullRequest.base);
+      const baseRepository = asRecord(base?.repo) ?? asRecord(payload.repository);
+      if (!repository || !baseRepository || !sameGithubRepository(repository, baseRepository)) {
+        return null;
+      }
+      const repositoryId = githubRepositoryId(repository);
+      const number = positiveInteger(pullRequest.number);
+      const commit = nonEmptyString(head?.sha);
+      const ref = number === null ? null : `refs/pull/${number}/head`;
+      if (!repositoryId || !ref || !commit) return null;
+      const hasValidReference = isValidGitObjectId(commit) && isValidTriggerRef(ref);
+      if (!hasValidReference) return null;
+      return {
+        externalRepositoryId: buildProviderRepositoryId(GITHUB_PROVIDER, repositoryId),
+        ref,
+        commit,
+        actor,
+      };
+    }
+
+    const repositoryId = githubRepositoryId(asRecord(payload.repository));
+    const ref = nonEmptyString(payload.ref);
+    const commit = nonEmptyString(payload.after);
+    if (!repositoryId || !ref || !commit) return null;
+    const hasValidReference = isValidGitObjectId(commit) && isValidTriggerRef(ref);
+    if (!hasValidReference) return null;
+    return {
+      externalRepositoryId: buildProviderRepositoryId(GITHUB_PROVIDER, repositoryId),
+      ref,
+      commit,
+      actor,
+    };
+  }
+
   async createCheckoutSpec(
     input: CreateCheckoutSpecInput<GithubIntegrationConnection>,
   ): Promise<CheckoutSpec> {
@@ -178,6 +227,29 @@ export class GithubSourceControlProvider
   }
 }
 
+function githubRepositoryId(repository: Record<string, unknown> | null): string | null {
+  return positiveInteger(repository?.id) === null ? null : String(repository?.id);
+}
+
+// `sender` is the one actor field every GitHub webhook event carries, so it stays correct
+// for pushes, pull requests, and anything else that reaches a trigger reference.
+function githubEventActor(payload: Record<string, unknown>): string | null {
+  return nonEmptyString(asRecord(payload.sender)?.login);
+}
+
+function sameGithubRepository(
+  first: Record<string, unknown>,
+  second: Record<string, unknown>,
+): boolean {
+  const firstId = githubRepositoryId(first);
+  const secondId = githubRepositoryId(second);
+  if (firstId && secondId) return firstId === secondId;
+
+  const firstName = nonEmptyString(first.full_name);
+  const secondName = nonEmptyString(second.full_name);
+  return Boolean(firstName && secondName && firstName.toLowerCase() === secondName.toLowerCase());
+}
+
 function githubAppGitAuthor(): CheckoutSpec['gitAuthor'] {
   const appUsername = config.GITHUB_APP_USERNAME?.trim();
   if (!appUsername) return undefined;

package/src/core/webhook-processor.test.ts

@@ -51,6 +51,7 @@ describe('GitHub webhook processor', () => {
     const processor = createGithubWebhookProcessor({
       coreDb,
       publishIntegrationEventReceived: vi.fn(),
+      publishSourceRepositoryUpdated: vi.fn(),
       publishSourcePush: vi.fn(),
       recordDeliveryOnly: vi.fn(),
       getIntegrationConnectionById: vi.fn(),
@@ -78,6 +79,7 @@ describe('GitHub webhook processor', () => {
     const processor = createGithubWebhookProcessor({
       coreDb: vi.fn(),
       publishIntegrationEventReceived: vi.fn(),
+      publishSourceRepositoryUpdated: vi.fn(),
       publishSourcePush: vi.fn(),
       recordDeliveryOnly: vi.fn(),
       getIntegrationConnectionById: vi.fn(),
@@ -114,6 +116,7 @@ describe('GitHub webhook processor', () => {
       coreDb: () =>
         ({transaction: (callback: (tx: unknown) => Promise<unknown>) => callback({})}) as never,
       publishIntegrationEventReceived: vi.fn(),
+      publishSourceRepositoryUpdated: vi.fn(),
       publishSourcePush: vi.fn(),
       recordDeliveryOnly: vi.fn(),
       getIntegrationConnectionById: vi.fn(),
@@ -145,6 +148,7 @@ describe('GitHub webhook processor', () => {
     const processor = createGithubWebhookProcessor({
       coreDb: db,
       publishIntegrationEventReceived,
+      publishSourceRepositoryUpdated: vi.fn(),
       publishSourcePush: vi.fn(),
       recordDeliveryOnly: vi.fn(),
       getIntegrationConnectionById: vi.fn(() => Promise.resolve(connection)),

package/src/core/webhook-processor.ts

@@ -5,6 +5,7 @@ import {
   type GetIntegrationConnectionByIdFn,
   type PublishIntegrationEventReceivedFn,
   type PublishSourcePushFn,
+  type PublishSourceRepositoryUpdatedFn,
   type RecordDeliveryOnlyFn,
   type StoredWebhookRequest,
   type WebhookProcessingResult,
@@ -21,6 +22,7 @@ const SIGNATURE_HEADER = 'x-hub-signature-256';
 export interface CreateGithubWebhookProcessorOptions {
   coreDb: () => NodePgDatabase<Record<string, unknown>>;
   publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  publishSourceRepositoryUpdated: PublishSourceRepositoryUpdatedFn;
   publishSourcePush: PublishSourcePushFn;
   recordDeliveryOnly: RecordDeliveryOnlyFn;
   getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
@@ -81,6 +83,7 @@ async function processGithubWebhookRequest(
       event,
       payload,
       publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+      publishSourceRepositoryUpdated: options.publishSourceRepositoryUpdated,
       publishSourcePush: options.publishSourcePush,
       recordDeliveryOnly: options.recordDeliveryOnly,
       getIntegrationConnectionById: options.getIntegrationConnectionById,

package/src/core/webhook.test.ts

@@ -4,6 +4,7 @@ import type {
   IntegrationConnection,
   PublishIntegrationEventReceivedFn,
   PublishSourcePushFn,
+  PublishSourceRepositoryUpdatedFn,
   RecordDeliveryOnlyFn,
 } from '@shipfox/api-integration-spi';
 import {db} from '#db/db.js';
@@ -30,6 +31,7 @@ function deps(
   options: {
     connection?: IntegrationConnection | undefined;
     publishIntegrationEventReceivedResult?: {published: boolean};
+    publishSourceRepositoryUpdatedResult?: {published: boolean};
     publishSourcePushResult?: {published: boolean};
   } = {},
 ) {
@@ -37,6 +39,9 @@ function deps(
     publishIntegrationEventReceived: vi.fn<PublishIntegrationEventReceivedFn>(() =>
       Promise.resolve(options.publishIntegrationEventReceivedResult ?? {published: true}),
     ),
+    publishSourceRepositoryUpdated: vi.fn<PublishSourceRepositoryUpdatedFn>(() =>
+      Promise.resolve(options.publishSourceRepositoryUpdatedResult ?? {published: true}),
+    ),
     publishSourcePush: vi.fn<PublishSourcePushFn>(() =>
       Promise.resolve(options.publishSourcePushResult ?? {published: true}),
     ),
@@ -272,7 +277,12 @@ describe('handleGithubEvent', () => {
     const payload = {
       action: 'opened',
       installation: {id: installationId},
-      pull_request: {number: 17},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        number: 17,
+        head: {repo: {id: 42, full_name: 'shipfox/platform'}},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
     };
 
     const result = await handleGithubEvent({
@@ -299,6 +309,186 @@ describe('handleGithubEvent', () => {
     });
   });
 
+  it('records and drops pull request deliveries whose head repository is a fork', async () => {
+    const handlers = deps();
+    const deliveryId = randomUUID();
+    const payload = {
+      action: 'opened',
+      installation: {id: 7787},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        head: {repo: {id: 84, full_name: 'contributor/platform'}},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
+    };
+
+    const result = await handleGithubEvent({
+      tx: db(),
+      deliveryId,
+      event: 'pull_request',
+      payload,
+      ...handlers,
+    });
+
+    expect(result.outcome).toBe('fork-pull-request');
+    expect(handlers.publishSourcePush).not.toHaveBeenCalled();
+    expect(handlers.publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(handlers.getIntegrationConnectionById).not.toHaveBeenCalled();
+    expect(firstRecordDeliveryOnlyCall(handlers.recordDeliveryOnly)).toMatchObject({
+      provider: 'github',
+      deliveryId,
+    });
+  });
+
+  it('records and drops pull request deliveries whose head repository is unresolved', async () => {
+    const handlers = deps();
+    const deliveryId = randomUUID();
+    const payload = {
+      action: 'synchronize',
+      installation: {id: 7789},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        head: {repo: null},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
+    };
+
+    const result = await handleGithubEvent({
+      tx: db(),
+      deliveryId,
+      event: 'pull_request',
+      payload,
+      ...handlers,
+    });
+
+    expect(result.outcome).toBe('fork-pull-request');
+    expect(handlers.publishSourcePush).not.toHaveBeenCalled();
+    expect(handlers.publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(handlers.getIntegrationConnectionById).not.toHaveBeenCalled();
+    expect(firstRecordDeliveryOnlyCall(handlers.recordDeliveryOnly)).toMatchObject({
+      provider: 'github',
+      deliveryId,
+    });
+  });
+
+  it('publishes pull request deliveries whose head and base repositories match', async () => {
+    const installationId = 7788;
+    const connection = fakeConnection();
+    await seedInstallation(installationId, connection.id);
+    const handlers = deps({connection});
+    const payload = {
+      action: 'opened',
+      installation: {id: installationId},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        head: {repo: {id: 42, full_name: 'shipfox/platform'}},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
+    };
+
+    const result = await handleGithubEvent({
+      tx: db(),
+      deliveryId: randomUUID(),
+      event: 'pull_request',
+      payload,
+      ...handlers,
+    });
+
+    expect(result.outcome).toBe('published-envelope');
+    expect(handlers.recordDeliveryOnly).not.toHaveBeenCalled();
+    expect(handlers.publishIntegrationEventReceived).toHaveBeenCalledTimes(1);
+  });
+
+  it('publishes a typed repository update for a repository rename', async () => {
+    const installationId = 7784;
+    const connection = fakeConnection();
+    await seedInstallation(installationId, connection.id);
+    const handlers = deps({connection});
+    const deliveryId = randomUUID();
+    const payload = {
+      action: 'renamed',
+      installation: {id: installationId},
+      repository: {
+        id: 42,
+        name: 'platform-renamed',
+        owner: {login: 'acme'},
+        default_branch: 'trunk',
+      },
+    };
+
+    const result = await handleGithubEvent({
+      tx: db(),
+      deliveryId,
+      event: 'repository',
+      payload,
+      ...handlers,
+    });
+
+    expect(result.outcome).toBe('published');
+    expect(handlers.publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(handlers.publishSourceRepositoryUpdated).toHaveBeenCalledWith(
+      expect.objectContaining({
+        event: 'repository.renamed',
+        rawPayload: payload,
+        repositories: [
+          {
+            externalRepositoryId: 'github:42',
+            owner: 'acme',
+            name: 'platform-renamed',
+            defaultBranch: 'trunk',
+          },
+        ],
+      }),
+    );
+  });
+
+  it('publishes one typed repository update per installation repository', async () => {
+    const installationId = 7785;
+    const connection = fakeConnection();
+    await seedInstallation(installationId, connection.id);
+    const handlers = deps({connection});
+    const deliveryId = randomUUID();
+    const payload = {
+      action: 'added',
+      installation: {id: installationId},
+      repositories_added: [
+        {id: 42, name: 'platform', owner: {login: 'acme'}, default_branch: 'main'},
+      ],
+      repositories_removed: [
+        {id: 43, name: 'runner', owner: {login: 'acme'}, default_branch: 'trunk'},
+      ],
+    };
+
+    const result = await handleGithubEvent({
+      tx: db(),
+      deliveryId,
+      event: 'installation_repositories',
+      payload,
+      ...handlers,
+    });
+
+    expect(result.outcome).toBe('published');
+    expect(handlers.publishSourceRepositoryUpdated).toHaveBeenCalledWith(
+      expect.objectContaining({
+        event: 'installation_repositories.added',
+        repositories: [
+          {
+            externalRepositoryId: 'github:42',
+            owner: 'acme',
+            name: 'platform',
+            defaultBranch: 'main',
+          },
+          {
+            externalRepositoryId: 'github:43',
+            owner: 'acme',
+            name: 'runner',
+            defaultBranch: 'trunk',
+          },
+        ],
+      }),
+    );
+  });
+
   it('returns the cached installation token cleanup handle when the installation is deleted', async () => {
     const installationId = 7791;
     const connection = fakeConnection();
@@ -374,7 +564,12 @@ describe('handleGithubEvent', () => {
     const payload = {
       action: null,
       installation: {id: installationId},
-      pull_request: {number: 17},
+      repository: {id: 42, full_name: 'shipfox/platform'},
+      pull_request: {
+        number: 17,
+        head: {repo: {id: 42, full_name: 'shipfox/platform'}},
+        base: {repo: {id: 42, full_name: 'shipfox/platform'}},
+      },
     };
 
     const result = await handleGithubEvent({