@shipfox/api-integration-github 12.6.0 → 13.1.0

package/src/core/agent-tools.ts

@@ -13,8 +13,9 @@ import {
   createGithubInstallationTokenProvider,
   type GithubInstallationTokenProvider,
 } from '#api/installation-token-provider.js';
-import {config, normalizedGithubApiBaseUrl} from '#config.js';
+import {normalizedGithubApiBaseUrl} from '#config.js';
 import type {GithubInstallation} from '#db/installations.js';
+import {githubAppBotLogin} from './bot-identity.js';
 import {GithubIntegrationProviderError} from './errors.js';
 import {
   type GithubAgentToolCatalogEntry,
@@ -59,7 +60,6 @@ const GITHUB_GRAPHQL_ROUTE = 'POST /graphql';
 const GITHUB_ARTIFACT_ARCHIVE_FORMAT = 'zip';
 const GITHUB_ARTIFACT_DOWNLOAD_ROUTE = `GET /repos/{owner}/{repo}/actions/artifacts/{resource_id}/${GITHUB_ARTIFACT_ARCHIVE_FORMAT}`;
 const GITHUB_ARTIFACT_DOWNLOAD_TIMEOUT_MS = 30_000;
-const GITHUB_APP_BOT_SUFFIX = '[bot]';
 const PENDING_REVIEW_PAGE_SIZE = 100;
 const PENDING_REVIEW_MAX_PAGE_REQUESTS = 5;
 const PENDING_REVIEW_LOOKUP_TIMEOUT_MS = 15_000;
@@ -78,6 +78,63 @@ const ADD_PENDING_REVIEW_COMMENT_MUTATION = `
   }
 `;
 
+const GET_PULL_REQUEST_REVIEW_THREADS_QUERY = `
+  query GetPullRequestReviewThreads(
+    $owner: String!
+    $repo: String!
+    $pullNumber: Int!
+    $after: String
+  ) {
+    repository(owner: $owner, name: $repo) {
+      pullRequest(number: $pullNumber) {
+        reviewThreads(first: 100, after: $after) {
+          nodes {
+            id
+            isResolved
+            comments(first: 100) {
+              nodes {
+                id
+                databaseId
+                body
+                author {
+                  login
+                }
+                path
+                line
+                side
+                startLine
+                startSide
+                createdAt
+                updatedAt
+                url
+              }
+              pageInfo {
+                hasNextPage
+                endCursor
+              }
+            }
+          }
+          pageInfo {
+            hasNextPage
+            endCursor
+          }
+        }
+      }
+    }
+  }
+`;
+
+const RESOLVE_PULL_REQUEST_REVIEW_THREAD_MUTATION = `
+  mutation ResolvePullRequestReviewThread($input: ResolveReviewThreadInput!) {
+    resolveReviewThread(input: $input) {
+      thread {
+        id
+        isResolved
+      }
+    }
+  }
+`;
+
 export class GithubAgentToolsProvider
   implements
     AgentToolsProvider<
@@ -145,11 +202,17 @@ export class GithubAgentToolsProvider
 
         if (operation.kind === 'graphql') {
           const data = await mapGithubError(() =>
-            addCommentToPendingReview(client, operation.parameters),
+            executeGithubGraphqlOperation(
+              client,
+              tool.id as GithubAgentToolId,
+              method,
+              operation.parameters,
+            ),
           );
-          return data === undefined
-            ? githubToolError(NO_PENDING_REVIEW_MESSAGE, 'provider-rejected')
-            : githubToolResult(tool.id as GithubAgentToolId, data);
+          if (data === undefined && tool.id === 'add_comment_to_pending_review') {
+            return githubToolError(NO_PENDING_REVIEW_MESSAGE, 'provider-rejected');
+          }
+          return githubToolResult(tool.id as GithubAgentToolId, data);
         }
 
         const operationParameters = await mapGithubError(() =>
@@ -322,6 +385,8 @@ export function githubOperationRoute(
       return `GET ${repoPath}/pulls/${pull}/commits`;
     case 'pull_request_read.get_review_comments':
       return `GET ${repoPath}/pulls/${pull}/comments`;
+    case 'pull_request_read.get_review_threads':
+      return GITHUB_GRAPHQL_ROUTE;
     case 'pull_request_read.get_reviews':
       return `GET ${repoPath}/pulls/${pull}/reviews`;
     case 'pull_request_read.get_comments':
@@ -350,6 +415,8 @@ export function githubOperationRoute(
       return `POST ${repoPath}/pulls/${pull}/reviews/{review_id}/events`;
     case 'pull_request_review_write.delete_pending':
       return `DELETE ${repoPath}/pulls/${pull}/reviews/{review_id}`;
+    case 'pull_request_review_thread_write.resolve':
+      return GITHUB_GRAPHQL_ROUTE;
     case 'add_comment_to_pending_review.':
       return GITHUB_GRAPHQL_ROUTE;
     case 'actions_list.list_workflows':
@@ -423,6 +490,43 @@ async function addCommentToPendingReview(
   return await client.graphql(ADD_PENDING_REVIEW_COMMENT_MUTATION, {input});
 }
 
+async function executeGithubGraphqlOperation(
+  client: GithubToolClient,
+  toolId: GithubAgentToolId,
+  method: string | undefined,
+  parameters: Record<string, unknown>,
+): Promise<unknown | undefined> {
+  if (client.graphql === undefined) {
+    throw new GithubIntegrationProviderError(
+      'malformed-provider-response',
+      'GitHub client does not support GraphQL operations',
+    );
+  }
+
+  switch (`${toolId}.${method ?? ''}`) {
+    case 'pull_request_read.get_review_threads': {
+      const variables: Record<string, unknown> = {
+        owner: parameters.owner,
+        repo: parameters.repo,
+        pullNumber: parameters.pull_number,
+      };
+      if (typeof parameters.cursor === 'string') variables.after = parameters.cursor;
+      return await client.graphql(GET_PULL_REQUEST_REVIEW_THREADS_QUERY, variables);
+    }
+    case 'pull_request_review_thread_write.resolve':
+      return await client.graphql(RESOLVE_PULL_REQUEST_REVIEW_THREAD_MUTATION, {
+        input: {threadId: parameters.thread_id},
+      });
+    case 'add_comment_to_pending_review.':
+      return await addCommentToPendingReview(client, parameters);
+    default:
+      throw new GithubIntegrationProviderError(
+        'malformed-provider-response',
+        'GitHub operation does not support GraphQL operations',
+      );
+  }
+}
+
 export function projectGithubOperationParameters(
   toolId: GithubAgentToolId,
   method: string | undefined,
@@ -621,13 +725,6 @@ function latestPendingReviewOnPage(
   return {malformed};
 }
 
-function githubAppBotLogin(): string {
-  const configuredUsername = config.GITHUB_APP_USERNAME?.trim() || config.GITHUB_APP_SLUG.trim();
-  return configuredUsername.toLowerCase().endsWith(GITHUB_APP_BOT_SUFFIX)
-    ? configuredUsername
-    : `${configuredUsername}${GITHUB_APP_BOT_SUFFIX}`;
-}
-
 function githubToolResult(
   toolId: GithubAgentToolId,
   data: unknown,

package/src/core/bot-identity.test.ts

@@ -0,0 +1,19 @@
+import {configuredGithubAppBotLogin, githubAppBotLogin, githubBotLogin} from './bot-identity.js';
+
+describe('GitHub App bot identity', () => {
+  it.each([
+    ['shipfox-ai', 'shipfox-ai[bot]'],
+    ['shipfox-ai[bot]', 'shipfox-ai[bot]'],
+    ['Shipfox-AI[Bot]', 'Shipfox-AI[Bot]'],
+  ])('normalizes %s to %s', (username, expected) => {
+    expect(githubBotLogin(username)).toBe(expected);
+  });
+
+  it('uses the configured username for commit attribution', () => {
+    expect(configuredGithubAppBotLogin()).toBe('shipfox-test[bot]');
+  });
+
+  it('uses the configured username for App review identity', () => {
+    expect(githubAppBotLogin()).toBe('shipfox-test[bot]');
+  });
+});

package/src/core/bot-identity.ts

@@ -0,0 +1,19 @@
+import {config} from '#config.js';
+
+const GITHUB_APP_BOT_SUFFIX = '[bot]';
+
+export function githubBotLogin(username: string): string {
+  const normalized = username.trim();
+  return normalized.toLowerCase().endsWith(GITHUB_APP_BOT_SUFFIX)
+    ? normalized
+    : `${normalized}${GITHUB_APP_BOT_SUFFIX}`;
+}
+
+export function configuredGithubAppBotLogin(): string | undefined {
+  const configuredUsername = config.GITHUB_APP_USERNAME?.trim();
+  return configuredUsername ? githubBotLogin(configuredUsername) : undefined;
+}
+
+export function githubAppBotLogin(): string {
+  return configuredGithubAppBotLogin() ?? githubBotLogin(config.GITHUB_APP_SLUG);
+}

package/src/core/github-agent-tool-catalog.ts

@@ -174,6 +174,13 @@ const pullRequestReadMethods = [
     false,
     scopes.pullRequestsRead,
   ),
+  method(
+    'get_review_threads',
+    'Get review threads, their resolution state, and comments for a specific pull request.',
+    'read',
+    false,
+    scopes.pullRequestsRead,
+  ),
   method(
     'get_reviews',
     'Get reviews for a specific pull request.',
@@ -221,6 +228,16 @@ const pullRequestReviewWriteMethods = [
   ),
 ] as const satisfies readonly GithubAgentToolCatalogMethod[];
 
+const pullRequestReviewThreadWriteMethods = [
+  method(
+    'resolve',
+    'Resolve a pull request review thread.',
+    'write',
+    false,
+    scopes.pullRequestsWrite,
+  ),
+] as const satisfies readonly GithubAgentToolCatalogMethod[];
+
 const actionsListMethods = [
   method('list_workflows', 'List workflows in a repository.', 'read', false, scopes.actionsRead),
   method(
@@ -472,6 +489,7 @@ export const githubAgentToolCatalog = [
           methodRequiredSchema('get_files', []),
           methodRequiredSchema('get_commits', []),
           methodRequiredSchema('get_review_comments', []),
+          methodRequiredSchema('get_review_threads', []),
           methodRequiredSchema('get_reviews', []),
           methodRequiredSchema('get_comments', []),
           methodRequiredSchema('get_check_runs', ['ref']),
@@ -666,6 +684,23 @@ export const githubAgentToolCatalog = [
     ),
     outputSchema: openObjectSchema('Pull request review write result'),
   }),
+  tool({
+    id: 'pull_request_review_thread_write',
+    category: 'pull_requests',
+    description: 'Resolve review threads on a pull request in a GitHub repository.',
+    methods: pullRequestReviewThreadWriteMethods,
+    inputSchema: repositoryInputSchema(
+      {
+        method: methodSchema(
+          pullRequestReviewThreadWriteMethods,
+          'The write operation to perform on a pull request review thread',
+        ),
+        thread_id: stringSchema('The node ID of the review thread'),
+      },
+      ['method', 'thread_id'],
+    ),
+    outputSchema: openObjectSchema('Pull request review thread write result'),
+  }),
   tool({
     id: 'add_comment_to_pending_review',
     category: 'pull_requests',

package/src/core/source-control.test.ts

@@ -8,6 +8,7 @@ const VALID_COMMIT = 'a'.repeat(40);
 function githubClient(overrides: Partial<GithubApiClient> = {}): GithubApiClient {
   return {
     exchangeOAuthCode: vi.fn(() => Promise.resolve('token')),
+    getBotUser: vi.fn(() => Promise.resolve({id: 12_345, login: 'shipfox-test[bot]'})),
     listUserInstallations: vi.fn(() => Promise.resolve({installationIds: [], nextCursor: null})),
     getInstallation: vi.fn(() => {
       throw new Error('not used');
@@ -349,7 +350,7 @@ describe('GithubSourceControlProvider', () => {
       },
       gitAuthor: {
         name: 'shipfox-test[bot]',
-        email: '1+shipfox-test[bot]@users.noreply.github.com',
+        email: '12345+shipfox-test[bot]@users.noreply.github.com',
       },
     });
     expect(result.repositoryUrl).not.toContain('ghs_installationtoken');
@@ -358,6 +359,91 @@ describe('GithubSourceControlProvider', () => {
       repositoryId: 42,
       permissions: {contents: 'write'},
     });
+    expect(github.getBotUser).toHaveBeenCalledWith({
+      username: 'shipfox-test[bot]',
+      installationAccessToken: 'ghs_installationtoken',
+    });
+  });
+
+  it('propagates bot identity resolution failures for write checkouts', async () => {
+    await createInstallation();
+    const github = githubClient({
+      getBotUser: vi.fn(() =>
+        Promise.reject(
+          new GithubIntegrationProviderError('provider-rejected', 'bot user not found'),
+        ),
+      ),
+    });
+    const provider = new GithubSourceControlProvider(github);
+
+    const result = provider.createCheckoutSpec({
+      connection: connection(),
+      externalRepositoryId: 'github:42',
+      permissions: {contents: 'write'},
+    });
+
+    await expect(result).rejects.toMatchObject({reason: 'provider-rejected'});
+  });
+
+  it('propagates unexpected bot lookup errors', async () => {
+    await createInstallation();
+    const github = githubClient({
+      getBotUser: vi.fn(() => Promise.reject(new Error('unexpected lookup failure'))),
+    });
+    const provider = new GithubSourceControlProvider(github);
+
+    const result = provider.createCheckoutSpec({
+      connection: connection(),
+      externalRepositoryId: 'github:42',
+      permissions: {contents: 'write'},
+    });
+
+    await expect(result).rejects.toThrow('unexpected lookup failure');
+  });
+
+  it('rejects write checkout when the bot identity resolver is unavailable', async () => {
+    await createInstallation();
+    const github = githubClient();
+    delete github.getBotUser;
+    const provider = new GithubSourceControlProvider(github);
+
+    const result = provider.createCheckoutSpec({
+      connection: connection(),
+      externalRepositoryId: 'github:42',
+      permissions: {contents: 'write'},
+    });
+
+    await expect(result).rejects.toMatchObject({reason: 'provider-unavailable'});
+  });
+
+  it('omits the author and bot lookup for read-only checkouts', async () => {
+    await createInstallation();
+    const github = githubClient();
+    const provider = new GithubSourceControlProvider(github);
+
+    const result = await provider.createCheckoutSpec({
+      connection: connection(),
+      externalRepositoryId: 'github:42',
+      permissions: {contents: 'read'},
+    });
+
+    expect(result.gitAuthor).toBeUndefined();
+    expect(github.getBotUser).not.toHaveBeenCalled();
+  });
+
+  it('omits the author and bot lookup when the App username is unset', async () => {
+    await createInstallation();
+    const github = githubClient();
+    const provider = new GithubSourceControlProvider(github, () => undefined);
+
+    const result = await provider.createCheckoutSpec({
+      connection: connection(),
+      externalRepositoryId: 'github:42',
+      permissions: {contents: 'write'},
+    });
+
+    expect(result.gitAuthor).toBeUndefined();
+    expect(github.getBotUser).not.toHaveBeenCalled();
   });
 
   it('defaults the checkout ref to the repository default branch', async () => {

package/src/core/source-control.ts

@@ -25,21 +25,23 @@ import {
   type TriggerReference,
 } from '@shipfox/api-integration-spi';
 import type {GithubApiClient, GithubRepository} from '#api/client.js';
-import {config} from '#config.js';
 import {getGithubInstallationByConnectionId} from '#db/installations.js';
+import {configuredGithubAppBotLogin} from './bot-identity.js';
 import {GithubIntegrationProviderError} from './errors.js';
 
 type GithubIntegrationConnection = IntegrationConnection<'github'>;
 
 const GITHUB_PROVIDER = 'github';
-const GITHUB_APP_BOT_SUFFIX = '[bot]';
 const SEARCH_PAGE_SIZE = 100;
 const SEARCH_MAX_PAGES_PER_REQUEST = 5;
 
 export class GithubSourceControlProvider
   implements SourceControlProvider<GithubIntegrationConnection>
 {
-  constructor(private readonly github: GithubApiClient) {}
+  constructor(
+    private readonly github: GithubApiClient,
+    private readonly appBotLogin: () => string | undefined = configuredGithubAppBotLogin,
+  ) {}
 
   async listRepositories(
     input: ListRepositoriesInput<GithubIntegrationConnection>,
@@ -204,7 +206,11 @@ export class GithubSourceControlProvider
       repositoryId,
       permissions: input.permissions,
     });
-    const gitAuthor = githubAppGitAuthor();
+    const botLogin = this.appBotLogin();
+    const gitAuthor =
+      botLogin && input.permissions?.contents === 'write'
+        ? await githubAppGitAuthor(this.github, token, botLogin)
+        : undefined;
 
     return {
       repositoryUrl: repository.cloneUrl,
@@ -250,13 +256,23 @@ function sameGithubRepository(
   return Boolean(firstName && secondName && firstName.toLowerCase() === secondName.toLowerCase());
 }
 
-function githubAppGitAuthor(): CheckoutSpec['gitAuthor'] {
-  const appUsername = config.GITHUB_APP_USERNAME?.trim();
-  if (!appUsername) return undefined;
-  const name = appUsername.endsWith(GITHUB_APP_BOT_SUFFIX)
-    ? appUsername
-    : `${appUsername}${GITHUB_APP_BOT_SUFFIX}`;
-  return {name, email: `${config.GITHUB_APP_ID}+${name}@users.noreply.github.com`};
+async function githubAppGitAuthor(
+  github: GithubApiClient,
+  installationAccessToken: string,
+  name: string,
+): Promise<CheckoutSpec['gitAuthor']> {
+  if (!github.getBotUser) {
+    throw new GithubIntegrationProviderError(
+      'provider-unavailable',
+      'GitHub bot identity resolution is unavailable',
+    );
+  }
+
+  const botUser = await github.getBotUser({username: name, installationAccessToken});
+  return {
+    name: botUser.login,
+    email: `${botUser.id}+${botUser.login}@users.noreply.github.com`,
+  };
 }
 
 function toRepositorySnapshot(repository: GithubRepository): RepositorySnapshot {