@synkro-sh/cli 1.3.25 → 1.3.26

package/dist/bootstrap.js

@@ -2508,7 +2508,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       pull-requests: write
       checks: write
     steps:
@@ -3333,7 +3333,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.3.25")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.3.26")}`
   ];
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);
   if (safeOrgId) lines.push(`SYNKRO_ORG_ID=${shellQuoteSingle(safeOrgId)}`);
@@ -4374,6 +4374,60 @@ function ghJson(args2) {
   });
   return JSON.parse(out);
 }
+async function ensureOpenPr(repo, prNumber, sha) {
+  let pr;
+  try {
+    pr = ghJson(["api", `/repos/${repo}/pulls/${prNumber}`]);
+  } catch {
+    return { prNumber, sha, branched: false };
+  }
+  if (pr.state === "open") {
+    return { prNumber, sha, branched: false };
+  }
+  if (pr.merged) {
+    console.log(`PR #${prNumber} is merged. Scanning original diff and posting findings there.
+`);
+    return { prNumber, sha: pr.head.sha, branched: false };
+  }
+  console.log(`PR #${prNumber} is closed. Creating a scan branch...
+`);
+  const scanBranch = `synkro/scan-${pr.head.ref}-${Date.now()}`;
+  try {
+    execSync5(`gh api -X POST /repos/${repo}/git/refs --input -`, {
+      encoding: "utf-8",
+      input: JSON.stringify({ ref: `refs/heads/${scanBranch}`, sha: pr.head.sha }),
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch (err) {
+    console.warn(`Failed to create scan branch: ${err.message}`);
+    return { prNumber, sha, branched: false };
+  }
+  try {
+    const newPrBody = `Security scan of closed PR #${prNumber} (\`${pr.head.ref}\`).
+
+This PR contains no code changes \u2014 it exists so Synkro can post review findings on an active PR.`;
+    const result = ghJson([
+      "api",
+      "-X",
+      "POST",
+      `/repos/${repo}/pulls`,
+      "-f",
+      `title=Synkro Scan: ${pr.title}`,
+      "-f",
+      `body=${newPrBody}`,
+      "-f",
+      `head=${scanBranch}`,
+      "-f",
+      `base=${pr.base.ref}`
+    ]);
+    console.log(`Opened PR #${result.number} for scan findings.
+`);
+    return { prNumber: result.number, sha: result.head.sha, branched: true };
+  } catch (err) {
+    console.warn(`Failed to open scan PR: ${err.message}`);
+    return { prNumber, sha, branched: false };
+  }
+}
 function getPrFiles(repo, prNumber) {
   const data = ghJson([
     "api",
@@ -4766,6 +4820,9 @@ async function scanPrCommand() {
   }
   console.log(`Synkro scan-pr: ${repo}#${prNumber} @ ${sha.slice(0, 7)}
 `);
+  const prTarget = await ensureOpenPr(repo, prNumber, sha);
+  const activePrNumber = prTarget.prNumber;
+  const activeSha = prTarget.sha;
   const orgRules = await fetchOrgRules(gatewayUrl, synkroApiKey);
   const auditRules = orgRules.filter((r) => r.mode === "audit");
   const literalNegativeRules = orgRules.filter((r) => {
@@ -4776,22 +4833,22 @@ async function scanPrCommand() {
   const promptHeader = buildPrPrompt(auditRules);
   let files;
   try {
-    files = getPrFiles(repo, prNumber);
+    files = getPrFiles(repo, activePrNumber);
   } catch (err) {
     console.error("Failed to fetch PR files:", err.message);
     process.exit(2);
   }
-  const scanCtx = await fetchScanContext(gatewayUrl, synkroApiKey, repo, prNumber, sha);
+  const scanCtx = await fetchScanContext(gatewayUrl, synkroApiKey, repo, activePrNumber, activeSha);
   if (scanCtx.skip) {
-    console.log(`Already scanned at ${sha.slice(0, 7)}, skipping.
+    console.log(`Already scanned at ${activeSha.slice(0, 7)}, skipping.
 `);
-    postCheckRun(repo, sha, "success", []);
+    postCheckRun(repo, activeSha, "success", []);
     await postEventToBackend({
       gatewayUrl,
       apiKey: synkroApiKey,
       repo,
-      prNumber,
-      sha,
+      prNumber: activePrNumber,
+      sha: activeSha,
       findings: [],
       filesScanned: 0,
       totalLatencyMs: 0
@@ -4814,13 +4871,13 @@ async function scanPrCommand() {
   console.log(`${files.length} files in PR, ${eligible.length} eligible for scan.
 `);
   if (eligible.length === 0) {
-    postCheckRun(repo, sha, "success", []);
+    postCheckRun(repo, activeSha, "success", []);
     await postEventToBackend({
       gatewayUrl,
       apiKey: synkroApiKey,
       repo,
-      prNumber,
-      sha,
+      prNumber: activePrNumber,
+      sha: activeSha,
       findings: [],
       filesScanned: 0,
       totalLatencyMs: 0
@@ -4847,17 +4904,17 @@ Total: ${allFindings.length} finding(s) across ${eligible.length} file(s) in ${t
     const review = await spawnOpusConsolidator(allFindings, claudeToken);
     console.log(`  \u2192 ${review.comments.length} review comment(s), severity: ${review.severity}`);
     if (review.comments.length > 0) {
-      postPrReview(repo, prNumber, sha, review);
+      postPrReview(repo, activePrNumber, activeSha, review);
     }
   }
   const conclusion = shouldFail(allFindings, failThreshold) ? "failure" : "success";
-  postCheckRun(repo, sha, conclusion, allFindings);
+  postCheckRun(repo, activeSha, conclusion, allFindings);
   await postEventToBackend({
     gatewayUrl,
     apiKey: synkroApiKey,
     repo,
-    prNumber,
-    sha,
+    prNumber: activePrNumber,
+    sha: activeSha,
     findings: allFindings,
     filesScanned: eligible.length,
     totalLatencyMs