@standards-kit/conform 0.1.0

package/dist/validator-6PL5I5EC.js

@@ -0,0 +1,156 @@
+// src/process/sync/validator.ts
+import { execa } from "execa";
+var VALID_REPO_ROLE_IDS = {
+  1: "Read",
+  2: "Triage",
+  3: "Write",
+  4: "Maintain",
+  5: "Admin"
+};
+async function validateBypassActors(repoInfo, actors) {
+  const errors = [];
+  const warnings = [];
+  for (const actor of actors) {
+    const error = await validateSingleActor(repoInfo, actor);
+    if (error) {
+      errors.push({ actor, error });
+    }
+  }
+  const hasAdmin = actors.some((a) => a.actor_type === "RepositoryRole" && a.actor_id === 5);
+  if (hasAdmin) {
+    warnings.push(
+      "Warning: Repository Admin role (ID 5) can bypass rules. Consider if this is intended."
+    );
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+async function validateSingleActor(repoInfo, actor) {
+  switch (actor.actor_type) {
+    case "RepositoryRole":
+      return validateRepositoryRole(actor);
+    case "OrganizationAdmin":
+      return null;
+    case "Team":
+      return validateTeam(repoInfo, actor);
+    case "Integration":
+      return validateIntegration(repoInfo, actor);
+    case "DeployKey":
+      return validateDeployKey(repoInfo, actor);
+    default:
+      return `Unknown actor type: ${actor.actor_type}`;
+  }
+}
+function validateRepositoryRole(actor) {
+  if (actor.actor_id === void 0) {
+    return "RepositoryRole requires an actor_id (1=Read, 2=Triage, 3=Write, 4=Maintain, 5=Admin)";
+  }
+  const roleName = VALID_REPO_ROLE_IDS[actor.actor_id];
+  if (!roleName) {
+    return `Invalid RepositoryRole ID: ${actor.actor_id}. Valid IDs: 1=Read, 2=Triage, 3=Write, 4=Maintain, 5=Admin`;
+  }
+  return null;
+}
+async function validateTeam(repoInfo, actor) {
+  if (actor.actor_id === void 0) {
+    return "Team requires an actor_id (the team's numeric ID)";
+  }
+  try {
+    await execa("gh", [
+      "api",
+      `orgs/${repoInfo.owner}/teams`,
+      "--jq",
+      `.[] | select(.id == ${actor.actor_id})`
+    ]);
+    return null;
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (msg.includes("404") || msg.includes("Not Found")) {
+      return `Team with ID ${actor.actor_id} not found in organization '${repoInfo.owner}'`;
+    }
+    if (msg.includes("403")) {
+      return null;
+    }
+    return `Failed to validate team: ${msg}`;
+  }
+}
+async function validateIntegration(repoInfo, actor) {
+  if (actor.actor_id === void 0) {
+    return "Integration requires an actor_id (the GitHub App installation ID)";
+  }
+  try {
+    const result = await execa("gh", [
+      "api",
+      `orgs/${repoInfo.owner}/installations`,
+      "--jq",
+      `.installations[] | select(.id == ${actor.actor_id}) | .id`
+    ]);
+    if (!result.stdout.trim()) {
+      const repoResult = await execa("gh", [
+        "api",
+        `repos/${repoInfo.owner}/${repoInfo.repo}/installation`,
+        "--jq",
+        ".id"
+      ]).catch(() => ({ stdout: "" }));
+      if (repoResult.stdout.trim() !== String(actor.actor_id)) {
+        return `GitHub App installation with ID ${actor.actor_id} not found`;
+      }
+    }
+    return null;
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (msg.includes("404") || msg.includes("Not Found")) {
+      return `GitHub App installation with ID ${actor.actor_id} not found`;
+    }
+    if (msg.includes("403")) {
+      return null;
+    }
+    return `Failed to validate integration: ${msg}`;
+  }
+}
+async function validateDeployKey(repoInfo, actor) {
+  if (actor.actor_id === void 0) {
+    return "DeployKey requires an actor_id (the deploy key's numeric ID)";
+  }
+  try {
+    await execa("gh", ["api", `repos/${repoInfo.owner}/${repoInfo.repo}/keys/${actor.actor_id}`]);
+    return null;
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    if (msg.includes("404") || msg.includes("Not Found")) {
+      return `Deploy key with ID ${actor.actor_id} not found in repository`;
+    }
+    if (msg.includes("403")) {
+      return null;
+    }
+    return `Failed to validate deploy key: ${msg}`;
+  }
+}
+function formatValidationResult(result) {
+  const lines = [];
+  if (result.valid) {
+    lines.push("All bypass actors are valid.");
+  } else {
+    lines.push("Bypass actor validation failed:");
+    for (const { actor, error } of result.errors) {
+      lines.push(
+        `  - ${actor.actor_type}${actor.actor_id ? ` (ID: ${actor.actor_id})` : ""}: ${error}`
+      );
+    }
+  }
+  if (result.warnings.length > 0) {
+    lines.push("");
+    for (const warning of result.warnings) {
+      lines.push(warning);
+    }
+  }
+  return lines.join("\n");
+}
+export {
+  formatValidationResult,
+  validateBypassActors
+};
+//# sourceMappingURL=validator-6PL5I5EC.js.map

package/dist/validator-6PL5I5EC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/process/sync/validator.ts"],"sourcesContent":["import { execa } from \"execa\";\n\nimport { type RepoInfo } from \"./types.js\";\n\n/** Bypass actor configuration from standards.toml */\nexport interface BypassActorConfig {\n  actor_type: \"Integration\" | \"OrganizationAdmin\" | \"RepositoryRole\" | \"Team\" | \"DeployKey\";\n  actor_id?: number;\n  bypass_mode?: \"always\" | \"pull_request\";\n}\n\n/** Validation error for a single actor */\nexport interface ActorValidationError {\n  actor: BypassActorConfig;\n  error: string;\n}\n\n/** Result of validating bypass actors */\nexport interface ValidationResult {\n  valid: boolean;\n  errors: ActorValidationError[];\n  warnings: string[];\n}\n\n/** Valid repository role IDs */\nconst VALID_REPO_ROLE_IDS: Record<number, string> = {\n  1: \"Read\",\n  2: \"Triage\",\n  3: \"Write\",\n  4: \"Maintain\",\n  5: \"Admin\",\n};\n\n/** Validate bypass actors against GitHub API */\nexport async function validateBypassActors(\n  repoInfo: RepoInfo,\n  actors: BypassActorConfig[]\n): Promise<ValidationResult> {\n  const errors: ActorValidationError[] = [];\n  const warnings: string[] = [];\n\n  for (const actor of actors) {\n    const error = await validateSingleActor(repoInfo, actor);\n    if (error) {\n      errors.push({ actor, error });\n    }\n  }\n\n  // Add warnings for common issues\n  const hasAdmin = actors.some((a) => a.actor_type === \"RepositoryRole\" && a.actor_id === 5);\n  if (hasAdmin) {\n    warnings.push(\n      \"Warning: Repository Admin role (ID 5) can bypass rules. Consider if this is intended.\"\n    );\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors,\n    warnings,\n  };\n}\n\n/** Validate a single bypass actor */\nasync function validateSingleActor(\n  repoInfo: RepoInfo,\n  actor: BypassActorConfig\n): Promise<string | null> {\n  switch (actor.actor_type) {\n    case \"RepositoryRole\":\n      return validateRepositoryRole(actor);\n\n    case \"OrganizationAdmin\":\n      // OrganizationAdmin doesn't require an actor_id\n      return null;\n\n    case \"Team\":\n      return validateTeam(repoInfo, actor);\n\n    case \"Integration\":\n      return validateIntegration(repoInfo, actor);\n\n    case \"DeployKey\":\n      return validateDeployKey(repoInfo, actor);\n\n    default:\n      return `Unknown actor type: ${actor.actor_type}`;\n  }\n}\n\n/** Validate RepositoryRole actor */\nfunction validateRepositoryRole(actor: BypassActorConfig): string | null {\n  if (actor.actor_id === undefined) {\n    return \"RepositoryRole requires an actor_id (1=Read, 2=Triage, 3=Write, 4=Maintain, 5=Admin)\";\n  }\n\n  const roleName = VALID_REPO_ROLE_IDS[actor.actor_id];\n  if (!roleName) {\n    return `Invalid RepositoryRole ID: ${actor.actor_id}. Valid IDs: 1=Read, 2=Triage, 3=Write, 4=Maintain, 5=Admin`;\n  }\n\n  return null;\n}\n\n/** Validate Team actor by checking if team exists */\nasync function validateTeam(repoInfo: RepoInfo, actor: BypassActorConfig): Promise<string | null> {\n  if (actor.actor_id === undefined) {\n    return \"Team requires an actor_id (the team's numeric ID)\";\n  }\n\n  try {\n    // Try to fetch the team - requires org membership\n    await execa(\"gh\", [\n      \"api\",\n      `orgs/${repoInfo.owner}/teams`,\n      \"--jq\",\n      `.[] | select(.id == ${actor.actor_id})`,\n    ]);\n    return null;\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n\n    if (msg.includes(\"404\") || msg.includes(\"Not Found\")) {\n      return `Team with ID ${actor.actor_id} not found in organization '${repoInfo.owner}'`;\n    }\n\n    if (msg.includes(\"403\")) {\n      // Can't validate due to permissions, but don't fail\n      return null;\n    }\n\n    return `Failed to validate team: ${msg}`;\n  }\n}\n\n/** Validate Integration (GitHub App) actor */\nasync function validateIntegration(\n  repoInfo: RepoInfo,\n  actor: BypassActorConfig\n): Promise<string | null> {\n  if (actor.actor_id === undefined) {\n    return \"Integration requires an actor_id (the GitHub App installation ID)\";\n  }\n\n  try {\n    // Try to list installations and find the one with matching ID\n    const result = await execa(\"gh\", [\n      \"api\",\n      `orgs/${repoInfo.owner}/installations`,\n      \"--jq\",\n      `.installations[] | select(.id == ${actor.actor_id}) | .id`,\n    ]);\n\n    if (!result.stdout.trim()) {\n      // Also try repo-level installations for non-org repos\n      const repoResult = await execa(\"gh\", [\n        \"api\",\n        `repos/${repoInfo.owner}/${repoInfo.repo}/installation`,\n        \"--jq\",\n        \".id\",\n      ]).catch(() => ({ stdout: \"\" }));\n\n      if (repoResult.stdout.trim() !== String(actor.actor_id)) {\n        return `GitHub App installation with ID ${actor.actor_id} not found`;\n      }\n    }\n\n    return null;\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n\n    if (msg.includes(\"404\") || msg.includes(\"Not Found\")) {\n      return `GitHub App installation with ID ${actor.actor_id} not found`;\n    }\n\n    if (msg.includes(\"403\")) {\n      // Can't validate due to permissions, but don't fail\n      return null;\n    }\n\n    return `Failed to validate integration: ${msg}`;\n  }\n}\n\n/** Validate DeployKey actor */\nasync function validateDeployKey(\n  repoInfo: RepoInfo,\n  actor: BypassActorConfig\n): Promise<string | null> {\n  if (actor.actor_id === undefined) {\n    return \"DeployKey requires an actor_id (the deploy key's numeric ID)\";\n  }\n\n  try {\n    await execa(\"gh\", [\"api\", `repos/${repoInfo.owner}/${repoInfo.repo}/keys/${actor.actor_id}`]);\n    return null;\n  } catch (error) {\n    const msg = error instanceof Error ? error.message : String(error);\n\n    if (msg.includes(\"404\") || msg.includes(\"Not Found\")) {\n      return `Deploy key with ID ${actor.actor_id} not found in repository`;\n    }\n\n    if (msg.includes(\"403\")) {\n      // Can't validate due to permissions, but don't fail\n      return null;\n    }\n\n    return `Failed to validate deploy key: ${msg}`;\n  }\n}\n\n/** Format validation result for display */\nexport function formatValidationResult(result: ValidationResult): string {\n  const lines: string[] = [];\n\n  if (result.valid) {\n    lines.push(\"All bypass actors are valid.\");\n  } else {\n    lines.push(\"Bypass actor validation failed:\");\n    for (const { actor, error } of result.errors) {\n      lines.push(\n        `  - ${actor.actor_type}${actor.actor_id ? ` (ID: ${actor.actor_id})` : \"\"}: ${error}`\n      );\n    }\n  }\n\n  if (result.warnings.length > 0) {\n    lines.push(\"\");\n    for (const warning of result.warnings) {\n      lines.push(warning);\n    }\n  }\n\n  return lines.join(\"\\n\");\n}\n"],"mappings":";AAAA,SAAS,aAAa;AAyBtB,IAAM,sBAA8C;AAAA,EAClD,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAGA,eAAsB,qBACpB,UACA,QAC2B;AAC3B,QAAM,SAAiC,CAAC;AACxC,QAAM,WAAqB,CAAC;AAE5B,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,MAAM,oBAAoB,UAAU,KAAK;AACvD,QAAI,OAAO;AACT,aAAO,KAAK,EAAE,OAAO,MAAM,CAAC;AAAA,IAC9B;AAAA,EACF;AAGA,QAAM,WAAW,OAAO,KAAK,CAAC,MAAM,EAAE,eAAe,oBAAoB,EAAE,aAAa,CAAC;AACzF,MAAI,UAAU;AACZ,aAAS;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AACF;AAGA,eAAe,oBACb,UACA,OACwB;AACxB,UAAQ,MAAM,YAAY;AAAA,IACxB,KAAK;AACH,aAAO,uBAAuB,KAAK;AAAA,IAErC,KAAK;AAEH,aAAO;AAAA,IAET,KAAK;AACH,aAAO,aAAa,UAAU,KAAK;AAAA,IAErC,KAAK;AACH,aAAO,oBAAoB,UAAU,KAAK;AAAA,IAE5C,KAAK;AACH,aAAO,kBAAkB,UAAU,KAAK;AAAA,IAE1C;AACE,aAAO,uBAAuB,MAAM,UAAU;AAAA,EAClD;AACF;AAGA,SAAS,uBAAuB,OAAyC;AACvE,MAAI,MAAM,aAAa,QAAW;AAChC,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,oBAAoB,MAAM,QAAQ;AACnD,MAAI,CAAC,UAAU;AACb,WAAO,8BAA8B,MAAM,QAAQ;AAAA,EACrD;AAEA,SAAO;AACT;AAGA,eAAe,aAAa,UAAoB,OAAkD;AAChG,MAAI,MAAM,aAAa,QAAW;AAChC,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,QAAQ,SAAS,KAAK;AAAA,MACtB;AAAA,MACA,uBAAuB,MAAM,QAAQ;AAAA,IACvC,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAEjE,QAAI,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,WAAW,GAAG;AACpD,aAAO,gBAAgB,MAAM,QAAQ,+BAA+B,SAAS,KAAK;AAAA,IACpF;AAEA,QAAI,IAAI,SAAS,KAAK,GAAG;AAEvB,aAAO;AAAA,IACT;AAEA,WAAO,4BAA4B,GAAG;AAAA,EACxC;AACF;AAGA,eAAe,oBACb,UACA,OACwB;AACxB,MAAI,MAAM,aAAa,QAAW;AAChC,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,UAAM,SAAS,MAAM,MAAM,MAAM;AAAA,MAC/B;AAAA,MACA,QAAQ,SAAS,KAAK;AAAA,MACtB;AAAA,MACA,oCAAoC,MAAM,QAAQ;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,OAAO,OAAO,KAAK,GAAG;AAEzB,YAAM,aAAa,MAAM,MAAM,MAAM;AAAA,QACnC;AAAA,QACA,SAAS,SAAS,KAAK,IAAI,SAAS,IAAI;AAAA,QACxC;AAAA,QACA;AAAA,MACF,CAAC,EAAE,MAAM,OAAO,EAAE,QAAQ,GAAG,EAAE;AAE/B,UAAI,WAAW,OAAO,KAAK,MAAM,OAAO,MAAM,QAAQ,GAAG;AACvD,eAAO,mCAAmC,MAAM,QAAQ;AAAA,MAC1D;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAEjE,QAAI,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,WAAW,GAAG;AACpD,aAAO,mCAAmC,MAAM,QAAQ;AAAA,IAC1D;AAEA,QAAI,IAAI,SAAS,KAAK,GAAG;AAEvB,aAAO;AAAA,IACT;AAEA,WAAO,mCAAmC,GAAG;AAAA,EAC/C;AACF;AAGA,eAAe,kBACb,UACA,OACwB;AACxB,MAAI,MAAM,aAAa,QAAW;AAChC,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,CAAC,OAAO,SAAS,SAAS,KAAK,IAAI,SAAS,IAAI,SAAS,MAAM,QAAQ,EAAE,CAAC;AAC5F,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAEjE,QAAI,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,WAAW,GAAG;AACpD,aAAO,sBAAsB,MAAM,QAAQ;AAAA,IAC7C;AAEA,QAAI,IAAI,SAAS,KAAK,GAAG;AAEvB,aAAO;AAAA,IACT;AAEA,WAAO,kCAAkC,GAAG;AAAA,EAC9C;AACF;AAGO,SAAS,uBAAuB,QAAkC;AACvE,QAAM,QAAkB,CAAC;AAEzB,MAAI,OAAO,OAAO;AAChB,UAAM,KAAK,8BAA8B;AAAA,EAC3C,OAAO;AACL,UAAM,KAAK,iCAAiC;AAC5C,eAAW,EAAE,OAAO,MAAM,KAAK,OAAO,QAAQ;AAC5C,YAAM;AAAA,QACJ,OAAO,MAAM,UAAU,GAAG,MAAM,WAAW,SAAS,MAAM,QAAQ,MAAM,EAAE,KAAK,KAAK;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,UAAM,KAAK,EAAE;AACb,eAAW,WAAW,OAAO,UAAU;AACrC,YAAM,KAAK,OAAO;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/package.json

@@ -0,0 +1,91 @@
+{
+  "name": "@standards-kit/conform",
+  "version": "0.1.0",
+  "description": "Standards conformance checking - in-repo enforcement CLI",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "conform": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "start": "node dist/cli.js",
+    "test": "vitest run tests/unit/",
+    "test:unit": "vitest run tests/unit/",
+    "test:watch": "vitest tests/unit/",
+    "test:coverage": "vitest run tests/unit/ --coverage",
+    "test:e2e": "vitest run tests/e2e/",
+    "test:all": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src"
+  },
+  "keywords": [
+    "linting",
+    "code-quality",
+    "standards",
+    "process",
+    "ci",
+    "cli"
+  ],
+  "author": "",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chrismlittle123/standards-kit.git",
+    "directory": "packages/conform"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@iarna/toml": "^2.2.5",
+    "minimatch": "^10.1.1",
+    "zod": "^3.24.1",
+    "@aws-sdk/client-cloudwatch-logs": "^3.974.0",
+    "@aws-sdk/client-dynamodb": "^3.974.0",
+    "@aws-sdk/client-ec2": "^3.975.0",
+    "@aws-sdk/client-ecs": "^3.975.0",
+    "@aws-sdk/client-elastic-load-balancing-v2": "^3.975.0",
+    "@aws-sdk/client-elasticache": "^3.975.0",
+    "@aws-sdk/client-iam": "^3.974.0",
+    "@aws-sdk/client-lambda": "^3.974.0",
+    "@aws-sdk/client-rds": "^3.975.0",
+    "@aws-sdk/client-s3": "^3.967.0",
+    "@aws-sdk/client-secrets-manager": "^3.974.0",
+    "@aws-sdk/client-sns": "^3.974.0",
+    "@aws-sdk/client-sqs": "^3.974.0",
+    "@google-cloud/artifact-registry": "^4.6.0",
+    "@google-cloud/run": "^3.1.0",
+    "@google-cloud/secret-manager": "^6.1.1",
+    "@modelcontextprotocol/sdk": "^1.25.3",
+    "chalk": "^5.6.2",
+    "commander": "^13.0.0",
+    "execa": "^9.6.1",
+    "glob": "^13.0.0",
+    "google-auth-library": "^10.5.0",
+    "gray-matter": "^4.0.3",
+    "js-yaml": "^4.1.1",
+    "zod-to-json-schema": "^3.25.1"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^22.10.2",
+    "@vitest/coverage-v8": "^2.1.9",
+    "aws-sdk-client-mock": "^4.1.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^2.1.8"
+  }
+}