@sous-io/sous 0.2.15 → 0.2.17

package/src/lib/repos/catalog.ts

@@ -78,6 +78,11 @@ export type CatalogInputs = {
   lock: Lockfile;
   /** The ref keys the project subscribes to: namespaces, and `namespace/recipe`. */
   subscriptions: string[];
+  /**
+   * The repositories read from a linked working copy instead of the store, by
+   * short name, each with the checkout's path.
+   */
+  linked?: Record<string, string>;
   /**
    * Reads one published recipe's manifest, when its files are on this machine.
    * Returning undefined means "not available", and the recipe is described from
@@ -119,6 +124,11 @@ export type RecipeListing = {
   latest?: string;
   /** The version this project's lockfile pins, when it pins one. */
   pinned?: string;
+  /**
+   * The linked checkout builds read this recipe from instead of the pinned
+   * version, when the project pins it and its repository is linked.
+   */
+  linkedPath?: string;
   /** True when the project subscribes to this recipe, or to the whole namespace holding it. */
   subscribed: boolean;
   /** The recipe's one-paragraph summary, when its index carries one. */
@@ -212,6 +222,11 @@ export type RecipeDetail = {
   latest?: string;
   /** The version this project's lockfile pins, when it pins one. */
   pinned?: string;
+  /**
+   * The linked checkout builds read this recipe from instead of the pinned
+   * version, when the project pins it and its repository is linked.
+   */
+  linkedPath?: string;
   /** True when the project subscribes to this recipe, or to the whole namespace holding it. */
   subscribed: boolean;
   /**
@@ -275,7 +290,7 @@ export function listRecipes(inputs: CatalogInputs): RecipeListing[] {
 
   for (const repo of inputs.repos) {
     for (const key of Object.keys(repo.index.recipes)) {
-      listings.push(recipeListing(key, repo, inputs.lock, subscriptions));
+      listings.push(recipeListing(key, repo, inputs, subscriptions));
     }
   }
 
@@ -305,7 +320,7 @@ export function describeNamespace(inputs: CatalogInputs, ref: string): Namespace
     ...(declared.description === undefined ? {} : { description: declared.description }),
     subscribed: coverageOf(found.namespace, found.repo.index, subscriptions),
     recipes: recipeKeysIn(found.repo.index, found.namespace).map((key) =>
-      recipeListing(key, found.repo, inputs.lock, subscriptions)
+      recipeListing(key, found.repo, inputs, subscriptions)
     ),
   };
 }
@@ -320,7 +335,7 @@ export function describeNamespace(inputs: CatalogInputs, ref: string): Namespace
 export function describeRecipe(inputs: CatalogInputs, ref: string): RecipeDetail {
   const found = resolveRecipeRef(inputs, ref);
   const subscriptions = new Set(inputs.subscriptions);
-  const listing = recipeListing(found.key, found.repo, inputs.lock, subscriptions);
+  const listing = recipeListing(found.key, found.repo, inputs, subscriptions);
   const entry = found.repo.index.recipes[found.key]!;
 
   const describing = listing.pinned ?? listing.latest;
@@ -355,6 +370,75 @@ export function describeRecipe(inputs: CatalogInputs, ref: string): RecipeDetail
   };
 }
 
+/**
+ * The same inputs, narrowed to what this project has installed: each
+ * repository's index keeps only the recipes the lockfile pins from that
+ * repository, and only the namespaces holding one of them. Every listing and
+ * every ref lookup over the result therefore sees only installed recipes. A
+ * recipe's published version history is kept whole, so the installed version
+ * still sits among the others.
+ *
+ * narrowToInstalled(inputs)
+ * // -> the index of "r" holds "a/x" only, when the lockfile pins "a/x" from "r"
+ *
+ * @param inputs - The catalog's inputs.
+ */
+export function narrowToInstalled(inputs: CatalogInputs): CatalogInputs {
+  const repos = inputs.repos.map((repo) => {
+    const recipes = Object.fromEntries(
+      Object.entries(repo.index.recipes).filter(
+        ([key]) => inputs.lock.recipes[key]?.repo === repo.name
+      )
+    );
+    const held = new Set(Object.keys(recipes).map((key) => key.slice(0, key.indexOf("/"))));
+    const namespaces = Object.fromEntries(
+      Object.entries(repo.index.namespaces).filter(([namespace]) => held.has(namespace))
+    );
+    return { ...repo, index: { ...repo.index, recipes, namespaces } };
+  });
+  return { ...inputs, repos };
+}
+
+/**
+ * Looks a ref up among the installed recipes only, so an ambiguity between an
+ * installed recipe and one the project does not use settles itself. A ref that
+ * names something published but not installed is an error saying exactly that,
+ * rather than the "no repository publishes" error the narrowed lookup alone
+ * would raise.
+ *
+ * describeInstalled(inputs, "workflow/task-files", describeRecipe, "recipe")
+ * // -> the recipe, when the lockfile pins it; otherwise an error saying the
+ * //    project has not installed it
+ *
+ * @param inputs - The catalog's inputs, not yet narrowed.
+ * @param ref - The ref being looked up.
+ * @param describe - The lookup to run: `describeNamespace` or `describeRecipe`.
+ * @param what - What the ref names, for the error.
+ */
+export function describeInstalled<T>(
+  inputs: CatalogInputs,
+  ref: string,
+  describe: (inputs: CatalogInputs, ref: string) => T,
+  what: "namespace" | "recipe"
+): T {
+  try {
+    return describe(narrowToInstalled(inputs), ref);
+  } catch {
+    // The full lookup either explains the ref better (ambiguous, unknown) or
+    // proves it is published and simply not installed.
+    describe(inputs, ref);
+    throw what === "namespace"
+      ? new ConfigError(
+          `This project has installed no recipe from the namespace '${ref}', so there is ` +
+            `nothing to show with '--installed'.`
+        )
+      : new ConfigError(
+          `This project has not installed the recipe '${ref}', so there is nothing to ` +
+            `show with '--installed'.`
+        );
+  }
+}
+
 // --- Resolving a ref ----------------------------------------------------------------------------
 
 /** One namespace a ref resolved to. */
@@ -488,15 +572,16 @@ function coverageOf(
  *
  * @param key - The recipe key.
  * @param repo - The repository publishing it.
- * @param lock - The project's lockfile.
+ * @param inputs - The lockfile and the linked repositories.
  * @param subscriptions - The ref keys the project subscribes to.
  */
 function recipeListing(
   key: string,
   repo: CatalogRepo,
-  lock: Lockfile,
+  inputs: Pick<CatalogInputs, "lock" | "linked">,
   subscriptions: Set<string>
 ): RecipeListing {
+  const lock = inputs.lock;
   const entry = repo.index.recipes[key]!;
   const namespace = key.slice(0, key.indexOf("/"));
   const name = key.slice(namespace.length + 1);
@@ -507,6 +592,7 @@ function recipeListing(
   // the recipe came from this repository.
   const locked = lock.recipes[key];
   const pinned = locked !== undefined && locked.repo === repo.name ? locked.version : undefined;
+  const linkedPath = pinned === undefined ? undefined : inputs.linked?.[repo.name];
 
   return {
     key,
@@ -515,6 +601,7 @@ function recipeListing(
     repo: repo.name,
     ...(latest === undefined ? {} : { latest }),
     ...(pinned === undefined ? {} : { pinned }),
+    ...(linkedPath === undefined ? {} : { linkedPath }),
     subscribed: subscriptions.has(key) || subscriptions.has(namespace),
     ...(entry.description === undefined ? {} : { description: entry.description }),
   };

package/src/lib/repos/formats/common.ts

@@ -313,6 +313,26 @@ export function extensibleObject<Shape extends z.ZodRawShape>(shape: Shape) {
   return z.preprocess(stripExtensionKeys, z.strictObject(shape));
 }
 
+/**
+ * The `submissions` block a repo manifest and a recipe manifest may both carry:
+ * whether the recipes it covers take proposed changes, and where to send a
+ * change instead when they do not. On a repo manifest it covers every recipe;
+ * on a recipe manifest it covers that recipe, and wins over the repository's.
+ *
+ *     submissions:
+ *       allowed: false
+ *       instead: Propose changes in sous-io/sous, under recipes/core/sous-skills/.
+ */
+export const submissionsSchema = extensibleObject({
+  /** Whether a proposed change to the covered recipes is accepted. Defaults to true. */
+  allowed: z.boolean().default(true),
+  /** Where a change should go instead, printed when one is proposed anyway. */
+  instead: z.string().min(1, "must not be empty").optional(),
+});
+
+/** A validated `submissions` block. */
+export type Submissions = z.infer<typeof submissionsSchema>;
+
 // --- Error reporting ----------------------------------------------------------------------------
 
 /** Renders a zod issue path (`["variables",0,"name"]`) as `variables[0].name`. */

package/src/lib/repos/formats/recipe-manifest.ts

@@ -34,6 +34,7 @@ import {
   recipeNameSchema,
   relativePathSchema,
   semverVersionSchema,
+  submissionsSchema,
   variableNameSchema,
 } from "./common.js";
 import { parseDependencyRef } from "../ref.js";
@@ -301,6 +302,12 @@ export const recipeManifestSchema = extensibleObject({
   version: semverVersionSchema,
   /** One-paragraph summary, shown by `sous repo search` and `sous repo list`. */
   description: z.string().optional(),
+  /**
+   * Whether this recipe takes proposed changes, winning over the repository's
+   * own `submissions` block. A recipe whose files are copied in from somewhere
+   * else sets `allowed: false` and says where to go instead.
+   */
+  submissions: submissionsSchema.optional(),
   /**
    * Build dependencies: fetched and addressable here, but not added to the
    * project. Each entry is a bare ref naming a sibling recipe in this same

package/src/lib/repos/formats/repo-manifest.ts

@@ -17,6 +17,7 @@ import {
   parseFormat,
   relativePathSchema,
   repoNameSchema,
+  submissionsSchema,
 } from "./common.js";
 
 /** A namespace declaration. Namespaces group recipes and are not versioned. */
@@ -48,6 +49,13 @@ export const repoManifestSchema = extensibleObject({
    * contributor is never left without a route.
    */
   contribute: z.string().min(1, "must not be empty").optional(),
+  /**
+   * Whether the repository's recipes take proposed changes. A recipe's own
+   * `submissions` block wins over this one. `sous repo submit` warns before
+   * proposing a change to a recipe that does not, and `sous repo release
+   * --check` fails a pull request that changes one.
+   */
+  submissions: submissionsSchema.optional(),
   /** Every namespace the repo publishes, keyed by namespace name. */
   namespaces: z.record(namespaceNameSchema, repoNamespaceSchema),
   /**

package/src/lib/repos/freshness.ts

@@ -206,3 +206,59 @@ export function effectiveRangeForHolders(
   const combined = constraints.join(" ");
   return semver.validRange(combined) === null ? undefined : combined;
 }
+
+/**
+ * How long a build waits for a repository that it is only checking so it can
+ * say whether a newer version exists: three seconds. Past that the check is
+ * abandoned, quietly, and the build goes on with what the cache already knew.
+ */
+export const NEWER_VERSION_CHECK_TIMEOUT_MS = 3000;
+
+/**
+ * Runs a piece of upstream work with a deadline. The work is handed an abort
+ * signal that fires at the deadline, so a request that honors it is cancelled
+ * rather than left to keep the process alive; either way the returned promise
+ * rejects at the deadline, and the timer never holds the process open itself.
+ *
+ * await withDeadline((signal) => fetchSomething(signal), 3000);
+ * // -> the result, or an error saying the repository did not answer in time
+ *
+ * @param work - The work to run, given the signal that cancels it.
+ * @param milliseconds - How long to wait.
+ */
+export async function withDeadline<T>(
+  work: (signal: AbortSignal) => Promise<T>,
+  milliseconds: number
+): Promise<T> {
+  const controller = new AbortController();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(
+        new Error(
+          `The repository did not answer within ${formatSeconds(milliseconds)}, so sous ` +
+            `stopped waiting for it.`
+        )
+      );
+    }, milliseconds);
+    timer.unref?.();
+  });
+
+  try {
+    return await Promise.race([work(controller.signal), deadline]);
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+}
+
+/**
+ * A duration in plain words, such as "3 seconds" or "1 second".
+ *
+ * @param milliseconds - The duration.
+ */
+function formatSeconds(milliseconds: number): string {
+  const seconds = Math.round((milliseconds / 1000) * 10) / 10;
+  return seconds === 1 ? "1 second" : `${seconds} seconds`;
+}

package/src/lib/repos/providers/base.ts

@@ -10,7 +10,8 @@
  * declare the `submit` feature (the local one, for instance) inherits four
  * methods that raise a ConfigError naming the provider and what was asked of
  * it, so a caller that skips the feature check gets a sentence rather than a
- * `TypeError`.
+ * `TypeError`. The three calls behind the `proposals` feature are refused the
+ * same way.
  */
 
 import { ConfigError } from "../../errors.js";
@@ -26,6 +27,10 @@ import type {
   ChangeProposal,
   FetchedIndex,
   ForkedRepo,
+  ProposalQuery,
+  ProposalStatus,
+  ProposalSummary,
+  ProposalUpdate,
   ProposedChange,
   ProviderCli,
   ProviderFeature,
@@ -187,6 +192,33 @@ export abstract class ProviderBase implements RepoProvider {
     throw this.unsupported("submit", "propose a change to it");
   }
 
+  // --- Proposals after the fact, refused unless a provider overrides them ----
+
+  async findProposal(
+    _repo: CanonicalRepo,
+    _query: ProposalQuery,
+    _options: ProviderOptions = {}
+  ): Promise<ProposalSummary | undefined> {
+    throw this.unsupported("proposals", "look for a proposal that is already open");
+  }
+
+  async proposalStatus(
+    _repo: CanonicalRepo,
+    _id: string,
+    _options: ProviderOptions = {}
+  ): Promise<ProposalStatus> {
+    throw this.unsupported("proposals", "report where a proposal stands");
+  }
+
+  async updateProposal(
+    _repo: CanonicalRepo,
+    _id: string,
+    _update: ProposalUpdate,
+    _options: ProviderOptions = {}
+  ): Promise<ProposedChange> {
+    throw this.unsupported("proposals", "change a proposal's title or body");
+  }
+
   /**
    * The refusal a provider gives when it is asked for something it never
    * claimed. It names the provider and the feature, so the caller learns why

package/src/lib/repos/providers/github.ts

@@ -12,6 +12,8 @@
  * request opened by `gh pr create`, a contributor without push permission works
  * through a fork made by `gh repo fork`, and both are reported back as plain
  * data, so the service that sequences them never learns a GitHub-shaped fact.
+ * Finding a pull request again, reporting where it stands and replacing its
+ * text go through `gh pr list`, `gh pr view` and `gh pr edit` the same way.
  */
 
 import { ConfigError } from "../../errors.js";
@@ -28,6 +30,13 @@ import {
   type ChangeProposal,
   type FetchedIndex,
   type ForkedRepo,
+  type ProposalChecks,
+  type ProposalQuery,
+  type ProposalReview,
+  type ProposalState,
+  type ProposalStatus,
+  type ProposalSummary,
+  type ProposalUpdate,
   type ProposedChange,
   type ProviderCli,
   type ProviderFeature,
@@ -59,10 +68,10 @@ export class GithubProvider extends ProviderBase {
   readonly id = "github" as const;
 
   /**
-   * Reads the index and recipe subtrees, and proposes a change through
-   * the GitHub CLI ('gh').
+   * Reads the index and recipe subtrees, proposes a change through the GitHub
+   * CLI ('gh'), and finds, reports on and updates that pull request afterwards.
    */
-  readonly features: ProviderFeature[] = ["fetch", "submit"];
+  readonly features: ProviderFeature[] = ["fetch", "submit", "proposals"];
 
   /** The command line tool the write path is built on. */
   readonly cli: ProviderCli = {
@@ -113,6 +122,7 @@ export class GithubProvider extends ProviderBase {
       ...(options.fetchImpl === undefined
         ? {}
         : { fetchImpl: options.fetchImpl as FetchLike }),
+      ...(options.signal === undefined ? {} : { signal: options.signal }),
       label: "repo index",
     });
 
@@ -291,4 +301,267 @@ export class GithubProvider extends ProviderBase {
     }
     return { url, detail: `The ${this.proposalNoun} is at ${url}.` };
   }
+
+  // --- Proposals after the fact ------------------------------------------------
+
+  /**
+   * The pull request a branch was pushed for. GitHub lists pull requests by
+   * head branch name alone, so the list is narrowed here by where the branch
+   * lives: the repository itself, or the contributor's fork. When a branch has
+   * had several, the open one wins, and otherwise the newest.
+   *
+   * @param repo - The canonicalized repository the proposal targets.
+   * @param query - The branch, and whether it lives on a fork.
+   * @param options - Subprocess runner and working directory overrides.
+   */
+  async findProposal(
+    repo: CanonicalRepo,
+    query: ProposalQuery,
+    options: ProviderOptions = {}
+  ): Promise<ProposalSummary | undefined> {
+    const forkOwner = query.fromFork
+      ? (query.forkOwner ?? (await this.signedInLogin(options)))
+      : undefined;
+
+    const listed = await this.ghJson<GhPullRequest[]>(
+      [
+        "pr",
+        "list",
+        "--repo",
+        `${repo.owner}/${repo.name}`,
+        "--head",
+        query.branch,
+        "--state",
+        "all",
+        "--limit",
+        "50",
+        "--json",
+        "number,url,state,title,isDraft,baseRefName,headRepositoryOwner,isCrossRepository",
+      ],
+      "pr list",
+      options
+    );
+
+    const mine = listed.filter((entry) =>
+      query.fromFork
+        ? entry.isCrossRepository === true && entry.headRepositoryOwner?.login === forkOwner
+        : entry.isCrossRepository !== true
+    );
+    if (mine.length === 0) return undefined;
+
+    const open = mine.find((entry) => entry.state === "OPEN");
+    const chosen = open ?? [...mine].sort((a, b) => b.number - a.number)[0]!;
+    return summarizePullRequest(chosen);
+  }
+
+  /**
+   * Where one pull request stands: its state, its review decision, and how
+   * its checks are going, counted.
+   *
+   * @param repo - The canonicalized repository the proposal targets.
+   * @param id - The pull request number.
+   * @param options - Subprocess runner and working directory overrides.
+   */
+  async proposalStatus(
+    repo: CanonicalRepo,
+    id: string,
+    options: ProviderOptions = {}
+  ): Promise<ProposalStatus> {
+    const viewed = await this.ghJson<GhPullRequest>(
+      [
+        "pr",
+        "view",
+        id,
+        "--repo",
+        `${repo.owner}/${repo.name}`,
+        "--json",
+        "number,url,state,title,isDraft,baseRefName,reviewDecision,statusCheckRollup,mergeable",
+      ],
+      "pr view",
+      options
+    );
+
+    const review = reviewFrom(viewed.reviewDecision);
+    const checks = checksFrom(viewed.statusCheckRollup);
+    const mergeable =
+      viewed.mergeable === "MERGEABLE"
+        ? true
+        : viewed.mergeable === "CONFLICTING"
+          ? false
+          : undefined;
+
+    return {
+      proposal: summarizePullRequest(viewed),
+      ...(review === undefined ? {} : { review }),
+      ...(checks === undefined ? {} : { checks }),
+      ...(mergeable === undefined ? {} : { mergeable }),
+    };
+  }
+
+  /**
+   * Replaces a pull request's title, its body, or both.
+   *
+   * @param repo - The canonicalized repository the proposal targets.
+   * @param id - The pull request number.
+   * @param update - What to replace.
+   * @param options - Subprocess runner and working directory overrides.
+   */
+  async updateProposal(
+    repo: CanonicalRepo,
+    id: string,
+    update: ProposalUpdate,
+    options: ProviderOptions = {}
+  ): Promise<ProposedChange> {
+    const args = ["pr", "edit", id, "--repo", `${repo.owner}/${repo.name}`];
+    if (update.title !== undefined) args.push("--title", update.title);
+    if (update.body !== undefined) args.push("--body", update.body);
+
+    const result = await this.runCommand(this.cli.command, args, options);
+    if (result.code !== 0) {
+      const reported = result.stderr.trim() || result.stdout.trim();
+      throw new ConfigError(
+        `'${this.cli.command} pr edit' did not succeed, so the ${this.proposalNoun} kept its ` +
+          `title and body.` +
+          (reported.length === 0 ? "" : `\n  ${reported}`)
+      );
+    }
+
+    const url = firstUrlIn(result.stdout);
+    return url === undefined
+      ? { detail: `The ${this.proposalNoun} was updated.` }
+      : { url, detail: `The ${this.proposalNoun} at ${url} was updated.` };
+  }
+
+  /**
+   * The login of the account `gh` is signed in as, which is the owner of any
+   * fork sous made for the contributor.
+   *
+   * @param options - Subprocess runner and working directory overrides.
+   */
+  private async signedInLogin(options: ProviderOptions): Promise<string> {
+    const who = await this.capturedOutput(
+      this.cli.command,
+      ["api", "user", "--jq", ".login"],
+      options
+    );
+    if (who === undefined || who.trim().length === 0) {
+      throw new ConfigError(
+        "Sous could not read your GitHub login from " +
+          `'${this.cli.command} api user', so it cannot tell which fork a ${this.proposalNoun} ` +
+          "would come from."
+      );
+    }
+    return who.trim();
+  }
+
+  /**
+   * Runs a `gh` command that prints JSON, and parses what it printed.
+   *
+   * @param args - The arguments, ending with the `--json` field list.
+   * @param what - The subcommand, as it is named in a failure.
+   * @param options - Subprocess runner and working directory overrides.
+   */
+  private async ghJson<T>(args: string[], what: string, options: ProviderOptions): Promise<T> {
+    const result = await this.runCommand(this.cli.command, args, options);
+    if (result.code !== 0) {
+      const reported = result.stderr.trim() || result.stdout.trim();
+      throw new ConfigError(
+        `'${this.cli.command} ${what}' did not succeed.` +
+          (reported.length === 0 ? "" : `\n  ${reported}`)
+      );
+    }
+    try {
+      return JSON.parse(result.stdout) as T;
+    } catch {
+      throw new ConfigError(
+        `'${this.cli.command} ${what}' printed something that is not JSON, so sous cannot read ` +
+          `the ${this.proposalNoun} it describes.`
+      );
+    }
+  }
+}
+
+// --- What gh prints, and how it maps onto plain data ---------------------------------------------
+
+/** The fields sous asks `gh` for, as it prints them. */
+type GhPullRequest = {
+  number: number;
+  url?: string;
+  state?: string;
+  title?: string;
+  isDraft?: boolean;
+  baseRefName?: string;
+  headRepositoryOwner?: { login?: string } | null;
+  isCrossRepository?: boolean;
+  reviewDecision?: string | null;
+  statusCheckRollup?: GhCheck[] | null;
+  mergeable?: string;
+};
+
+/** One entry of a pull request's status check rollup: a check run or a commit status. */
+type GhCheck = {
+  __typename?: string;
+  status?: string;
+  conclusion?: string | null;
+  state?: string;
+};
+
+/** A pull request's state, in the words every provider shares. */
+function stateFrom(state: string | undefined): ProposalState {
+  if (state === "MERGED") return "merged";
+  if (state === "CLOSED") return "closed";
+  return "open";
+}
+
+/**
+ * The plain summary of a pull request.
+ *
+ * @param entry - What `gh` printed for it.
+ */
+function summarizePullRequest(entry: GhPullRequest): ProposalSummary {
+  return {
+    id: String(entry.number),
+    ...(entry.url === undefined ? {} : { url: entry.url }),
+    state: stateFrom(entry.state),
+    title: entry.title ?? "",
+    draft: entry.isDraft === true,
+    ...(entry.baseRefName === undefined ? {} : { base: entry.baseRefName }),
+  };
+}
+
+/** GitHub's review decision, in the words every provider shares. */
+function reviewFrom(decision: string | null | undefined): ProposalReview | undefined {
+  if (decision === "APPROVED") return "approved";
+  if (decision === "CHANGES_REQUESTED") return "changes requested";
+  if (decision === "REVIEW_REQUIRED") return "review required";
+  return undefined;
+}
+
+/** Check runs whose conclusion counts as passing. */
+const PASSING_CONCLUSIONS = new Set(["SUCCESS", "NEUTRAL", "SKIPPED"]);
+
+/**
+ * Counts a status check rollup into passed, failed and pending. A check run
+ * that has not completed is pending; a commit status reports its state directly.
+ *
+ * @param rollup - What `gh` printed as the rollup, when it printed one.
+ */
+function checksFrom(rollup: GhCheck[] | null | undefined): ProposalChecks | undefined {
+  if (rollup === null || rollup === undefined || rollup.length === 0) return undefined;
+  const counts: ProposalChecks = { passed: 0, failed: 0, pending: 0 };
+  for (const check of rollup) {
+    const isStatus =
+      check.__typename === "StatusContext" ||
+      (check.status === undefined && check.state !== undefined);
+    if (isStatus) {
+      if (check.state === "SUCCESS") counts.passed += 1;
+      else if (check.state === "PENDING" || check.state === "EXPECTED") counts.pending += 1;
+      else counts.failed += 1;
+      continue;
+    }
+    if (check.status !== "COMPLETED") counts.pending += 1;
+    else if (PASSING_CONCLUSIONS.has(check.conclusion ?? "")) counts.passed += 1;
+    else counts.failed += 1;
+  }
+  return counts;
 }

package/src/lib/repos/providers/gitlab.ts

@@ -119,6 +119,7 @@ export class GitlabProvider extends ProviderBase {
       ...(options.fetchImpl === undefined
         ? {}
         : { fetchImpl: options.fetchImpl as FetchLike }),
+      ...(options.signal === undefined ? {} : { signal: options.signal }),
       label: "repo index",
     });