@teambit/ci 1.0.485 → 1.0.487

package/sync/git-ops.ts

@@ -0,0 +1,334 @@
+import { BitError } from '@teambit/bit-error';
+import { git } from '../git';
+import { validateBranchName } from './sync-config';
+
+/**
+ * Git primitives shared by the lane and main sync executors; each encodes a decision that must stay
+ * identical on both paths.
+ */
+
+/** paths the sync executors never treat as workspace content — see `cleanUntrackedScoped` */
+export const SYNC_EXCLUDED_PATHS = ['.bit', 'node_modules'];
+
+/**
+ * How a raw git invocation is run, injectable so a helper whose whole content is its argv can be unit
+ * tested without a repository. Production always uses {@link realGitRaw}.
+ */
+export type GitArgsRunner = (args: string[]) => Promise<unknown>;
+
+export const realGitRaw: GitArgsRunner = (args) => git.raw(args);
+
+/**
+ * Remove untracked files, leaving the local bit scope and installed packages alone. No `-x` (ignored
+ * files stay), and `.bit` / `node_modules` are excluded explicitly — without that, the clean deletes
+ * the local scope in a workspace whose `.gitignore` lacks Bit's block.
+ */
+export async function cleanUntrackedScoped(run: GitArgsRunner = realGitRaw): Promise<void> {
+  await run(['clean', '-fd', ...SYNC_EXCLUDED_PATHS.flatMap((path) => ['-e', path])]);
+}
+
+/**
+ * Refuse a branch name git would read as an option or reject as a ref. Not every branch reaching the
+ * checkout comes from validated config: the default branch is derived from the remote
+ * (`getDefaultBranchName`), so the primitive that builds the argv is where the guard belongs — every
+ * caller inherits it.
+ */
+export function assertCheckoutableBranch(branch: string): void {
+  const problem = validateBranchName(branch);
+  if (problem) {
+    throw new BitError(
+      `bit ci sync cannot check out "${branch}": ${problem}. Rename the branch, or set the intended name ` +
+        `explicitly in the "teambit.git/ci" sync config.`
+    );
+  }
+}
+
+/**
+ * Put the working tree on `branch` holding nothing but that commit's content, then make the workspace
+ * re-read the checked-out `.bitmap`. Order matters: `checkout -f` (leftover tracked changes must not
+ * abort the target), then the scoped clean (a forced checkout leaves untracked files in place, and
+ * every commit path stages with `-A`), then the reload so it reads the pristine tree. With
+ * `startPoint`, `-B` creates-or-resets the branch — refused when the local branch holds commits no
+ * remote contains, because moving it would orphan unpushed work; the predicate is remote containment,
+ * not start-point ancestry (a fully pushed tip loses nothing in either legitimate reset shape).
+ */
+export async function checkoutPristine(
+  branch: string,
+  startPoint: string | undefined,
+  reload: () => Promise<void>,
+  run: GitArgsRunner = realGitRaw
+): Promise<void> {
+  assertCheckoutableBranch(branch);
+  if (startPoint && (await localBranchExists(branch, run))) {
+    const containedIn = String((await run(['branch', '-r', '--contains', `refs/heads/${branch}`])) ?? '').trim();
+    if (!containedIn) {
+      throw new Error(
+        `local branch "${branch}" has commits that no remote branch contains — resetting it would ` +
+          `orphan them (recoverable only from the reflog). Push or back up the local branch, delete ` +
+          `it, or run from a clean checkout`
+      );
+    }
+  }
+  await run(startPoint ? ['checkout', '-f', '-B', branch, startPoint] : ['checkout', '-f', branch]);
+  await cleanUntrackedScoped(run);
+  await reload();
+}
+
+/**
+ * Whether the branch exists locally. Judged by output, never by whether the call threw: simple-git's
+ * `raw` resolves with empty output on some non-zero exits instead of rejecting.
+ */
+export async function localBranchExists(branch: string, run: GitArgsRunner = realGitRaw): Promise<boolean> {
+  const out = await run(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`]).catch(() => '');
+  return String(out ?? '').trim().length > 0;
+}
+
+/**
+ * `checkoutPristine` for the restore paths: a start point only when the branch is absent locally
+ * (detached-HEAD/single-branch checkouts) — passing `origin/<branch>` when it exists would `-B`-reset
+ * the developer's default branch and discard their unpushed commits.
+ */
+export async function checkoutPristineRestore(
+  branch: string,
+  reload: () => Promise<void>,
+  run: GitArgsRunner = realGitRaw
+): Promise<void> {
+  const startPoint = (await localBranchExists(branch, run)) ? undefined : `origin/${branch}`;
+  await checkoutPristine(branch, startPoint, reload, run);
+}
+
+/**
+ * Stage every change except `.bit` / `node_modules` (a bare `add -A` would commit the local scope when
+ * `.gitignore` lacks Bit's block). The `:(exclude)` pathspecs make git skip those trees instead of
+ * staging them for a reset to undo; `git add` refuses them when a named path IS ignored — the case where
+ * the traversal is already cheap — so the add-then-reset pair is the fallback. Both leave the same index,
+ * and `git reset -- <paths>` is a no-op for paths absent from it, so neither fallback command can fail.
+ */
+export async function addAllExceptScopeAndModules(run: GitArgsRunner = realGitRaw): Promise<void> {
+  const stageAll = ['add', '-A', '--', '.'];
+  try {
+    await run([...stageAll, ...SYNC_EXCLUDED_PATHS.map((path) => `:(exclude)${path}`)]);
+  } catch {
+    await run(stageAll);
+    await run(['reset', '-q', '--', ...SYNC_EXCLUDED_PATHS]);
+  }
+}
+
+/**
+ * Whether a `git status` path is one the sync executors never treat as workspace content. Applied
+ * everywhere a status is interpreted — otherwise `.bit`/`node_modules` files count as drift when
+ * `.gitignore` lacks Bit's block.
+ */
+export function isNonContentPath(path: string): boolean {
+  return SYNC_EXCLUDED_PATHS.some((excluded) => path === excluded || path.startsWith(`${excluded}/`));
+}
+
+/**
+ * The refspec every sync fetch passes **explicitly**, overriding whatever `remote.origin.fetch` this
+ * checkout was configured with.
+ */
+export const ALL_HEADS_REFSPEC = '+refs/heads/*:refs/remotes/origin/*';
+
+/**
+ * Fetch `origin` so every branch it has is available as `refs/remotes/origin/<branch>`. A bare fetch
+ * honours the checkout's configured `remote.origin.fetch`, which in a single-branch clone updates
+ * exactly one ref while enumeration (`ls-remote`) sees every branch; an explicit refspec overrides the
+ * config. Does not make shallow clones work — depth is a different axis.
+ */
+export async function fetchRemoteHeads(run: GitArgsRunner = realGitRaw): Promise<void> {
+  await run(['fetch', 'origin', ALL_HEADS_REFSPEC]);
+}
+
+/** Refspec that updates exactly one remote-tracking ref — a mid-run re-read of a single branch. */
+export function singleHeadRefspec(branch: string): string {
+  return `+refs/heads/${branch}:refs/remotes/origin/${branch}`;
+}
+
+/**
+ * `origin/<branch>`'s tip as the remote has it NOW: every other ref a run reads comes from one fetch at
+ * its start. Undefined when the branch is gone or unreadable — never a stale sha, because the answer
+ * decides whether a branch deletion is still safe.
+ */
+export async function refetchBranchTip(branch: string, run: GitArgsRunner = realGitRaw): Promise<string | undefined> {
+  try {
+    await run(['fetch', 'origin', singleHeadRefspec(branch)]);
+    const out = await run(['rev-parse', `refs/remotes/origin/${branch}`]);
+    return String(out ?? '').trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * `git push` argv that deletes a remote branch only while its tip is still `expectedTipSha`. Full
+ * `:refs/heads/<b>` refspec so the branch name can never be read as an option; the lease makes the server
+ * itself refuse a racing update rather than lose it.
+ */
+export function deleteBranchArgs(branch: string, expectedTipSha: string): string[] {
+  return ['origin', `--force-with-lease=refs/heads/${branch}:${expectedTipSha}`, `:refs/heads/${branch}`];
+}
+
+/**
+ * Whether a failed push was the lease refusing. The wording varies by git version and transport:
+ * "stale info" (client-side check), "is at X but expected Y" (receive-pack), and "incorrect old value
+ * provided" (the local/file transport, which is what CI's e2e remotes use). Over-matching is the safe
+ * direction — the only consequence is reporting a branch as kept rather than as a failed delete.
+ */
+export function isStaleLeaseRejection(message: string): boolean {
+  return /stale info|force-with-lease|but expected|incorrect old value/i.test(message);
+}
+
+/** Whether `origin` has the given branch. Assumes a `git fetch` isn't required (uses `ls-remote`). */
+export async function branchExistsOnRemote(branch: string): Promise<boolean> {
+  const out = await git.raw(['ls-remote', '--heads', 'origin', branch]);
+  return out.trim().length > 0;
+}
+
+/**
+ * Every branch `origin` has, by short name. `ls-remote` rather than `git branch -r` so the answer
+ * cannot be narrowed by the checkout's refspec or staleness.
+ */
+export async function listRemoteBranches(): Promise<string[]> {
+  const out = await git.raw(['ls-remote', '--heads', 'origin']);
+  const prefix = 'refs/heads/';
+  return out
+    .split('\n')
+    .map((line) => line.split('\t')[1]?.trim())
+    .filter((ref): ref is string => Boolean(ref && ref.startsWith(prefix)))
+    .map((ref) => ref.slice(prefix.length));
+}
+
+/**
+ * Is `maybeAncestor` reachable from `descendant` (true for identical commits)? Not `merge-base
+ * --is-ancestor`: it answers via the exit code, and simple-git's `raw` resolves on exit 1, so "not an
+ * ancestor" would read as yes. Throws when the commits share no history or a revision cannot resolve.
+ */
+export async function isAncestor(maybeAncestor: string, descendant: string): Promise<boolean> {
+  const ancestorSha = (await git.revparse([maybeAncestor])).trim();
+  const mergeBase = (await git.raw(['merge-base', maybeAncestor, descendant])).trim();
+  if (!ancestorSha || !mergeBase) throw new Error(`could not compare ${maybeAncestor} against ${descendant}`);
+  return ancestorSha === mergeBase;
+}
+
+/** The prefix `git symbolic-ref refs/remotes/origin/HEAD` puts in front of the default branch name. */
+export const ORIGIN_HEAD_REF_PREFIX = 'refs/remotes/origin/';
+
+/**
+ * The default branch name out of `git symbolic-ref refs/remotes/origin/HEAD` output, or undefined for
+ * an unrecognised shape. Strips the prefix; never splits on `/` — branch names may contain slashes
+ * (`release/main`), and truncating would protect the wrong branch.
+ */
+export function parseOriginHeadRef(symbolicRefOutput: string): string | undefined {
+  const ref = symbolicRefOutput.trim();
+  if (!ref.startsWith(ORIGIN_HEAD_REF_PREFIX)) return undefined;
+  return ref.slice(ORIGIN_HEAD_REF_PREFIX.length) || undefined;
+}
+
+/** The prefix a symref answer from `git ls-remote --symref origin HEAD` puts before the branch name. */
+const LS_REMOTE_SYMREF_PREFIX = 'ref: refs/heads/';
+
+/**
+ * The default branch name out of `git ls-remote --symref origin HEAD` output, or undefined when no
+ * symref line is present (some servers omit it). Same slash discipline as {@link parseOriginHeadRef}.
+ */
+export function parseLsRemoteSymref(lsRemoteOutput: string): string | undefined {
+  const line = lsRemoteOutput.split('\n').find((l) => l.startsWith(LS_REMOTE_SYMREF_PREFIX));
+  if (!line) return undefined;
+  const name = line.slice(LS_REMOTE_SYMREF_PREFIX.length).split('\t')[0].trim();
+  return name || undefined;
+}
+
+/**
+ * The remote's own answer for its default branch. Unlike the local `origin/HEAD` symref or enumerating
+ * `origin/*`, this cannot be stale or narrowed — only unanswered (undefined hands on to the fallback).
+ */
+export async function remoteHeadBranch(run: GitArgsRunner = realGitRaw): Promise<string | undefined> {
+  try {
+    const out = await run(['ls-remote', '--symref', 'origin', 'HEAD']);
+    return parseLsRemoteSymref(String(out ?? ''));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The git repository's root, or undefined outside a repo. A bit workspace is not necessarily the repo
+ * root, and GitHub only discovers workflows at `<repo>/.github/workflows`.
+ */
+export async function gitRepoRoot(): Promise<string | undefined> {
+  try {
+    const root = (await git.raw(['rev-parse', '--show-toplevel'])).trim();
+    return root || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Reading `git config`, injectable so the identity decision can be unit tested without a repository.
+ * There is deliberately no writer — see {@link resolveGitIdentity}.
+ */
+export type GitConfigIO = {
+  /** the configured value, or undefined when unset (or when git cannot answer) */
+  get(key: string): Promise<string | undefined>;
+};
+
+export const realGitConfigIO: GitConfigIO = {
+  get: (key) =>
+    git
+      .raw(['config', '--get', key])
+      .then((out) => (out.trim().length ? out.trim() : undefined))
+      // A missing key and "not a git repository" both exit non-zero; both mean "no identity to keep".
+      .catch(() => undefined),
+};
+
+/**
+ * The identity the sync commits with when nothing else says otherwise. A contract: the scaffolded
+ * workflow templates (`init-scaffold.ts`) and the GitHub Action's defaults must carry the same pair,
+ * or the same repository commits under different authors depending on entry point.
+ */
+export const DEFAULT_GIT_USER_NAME = 'bit-sync[bot]';
+export const DEFAULT_GIT_USER_EMAIL = 'bit-sync[bot]@users.noreply.github.com';
+
+export type GitIdentity = { name: string; email: string };
+
+/**
+ * Who the sync commits as. Read-only on purpose: writing these keys into the repository's config
+ * would outlive the run and re-author the developer's own later commits as the bot. Precedence per
+ * key: configured git identity > `GIT_USER_NAME`/`GIT_USER_EMAIL` > default.
+ */
+export async function resolveGitIdentity(
+  io: GitConfigIO = realGitConfigIO,
+  env: NodeJS.ProcessEnv = process.env
+): Promise<GitIdentity> {
+  return {
+    name: (await io.get('user.name')) || env.GIT_USER_NAME || DEFAULT_GIT_USER_NAME,
+    email: (await io.get('user.email')) || env.GIT_USER_EMAIL || DEFAULT_GIT_USER_EMAIL,
+  };
+}
+
+/** The `git -c` pair that applies an identity to ONE invocation, leaving the repo's config alone. */
+export function identityArgs(identity: GitIdentity): string[] {
+  return ['-c', `user.name=${identity.name}`, '-c', `user.email=${identity.email}`];
+}
+
+export type IdentityDeps = { run?: GitArgsRunner; io?: GitConfigIO; env?: NodeJS.ProcessEnv };
+
+/**
+ * Run a git command that may author a commit. Every such command needs the identity — a fresh CI
+ * checkout has none, and git refuses to commit ("Please tell me who you are") without one.
+ */
+export async function gitWithIdentity(args: string[], deps: IdentityDeps = {}): Promise<string> {
+  const { run = realGitRaw, io = realGitConfigIO, env = process.env } = deps;
+  const identity = await resolveGitIdentity(io, env);
+  return String((await run([...identityArgs(identity), ...args])) ?? '');
+}
+
+/** `git commit` under the sync identity; `extraArgs` carries flags such as `--allow-empty`. */
+export async function commitWithIdentity(
+  message: string,
+  opts: IdentityDeps & { extraArgs?: string[] } = {}
+): Promise<void> {
+  const { extraArgs = [], ...deps } = opts;
+  await gitWithIdentity(['commit', '-m', message, ...extraArgs], deps);
+}

package/sync/github-client.spec.ts

@@ -0,0 +1,174 @@
+import { expect } from 'chai';
+import { GitHubClient, isGitHubRemote, parseGitHubRepo } from './github-client';
+
+/**
+ * A claimed remote the parse then fails on silently degrades the whole run to PR-less mode, so the two
+ * predicates are pinned over the same remote shapes: whatever `isGitHubRemote` claims must parse.
+ */
+const REMOTES: Array<[string, string | undefined, boolean]> = [
+  // url, parseGitHubRepo, isGitHubRemote
+  ['git@github.com:acme/shop.git', 'acme/shop', true],
+  ['https://github.com/acme/shop.git', 'acme/shop', true],
+  ['https://github.com/acme/shop', 'acme/shop', true],
+  ['ssh://git@github.com/acme/shop.git', 'acme/shop', true],
+  // mixed-case host, an explicit port, and credentials in the url are all still github.com
+  ['https://GitHub.com/acme/shop.git', 'acme/shop', true],
+  ['https://github.com:443/acme/shop.git', 'acme/shop', true],
+  ['ssh://git@github.com:22/acme/shop.git', 'acme/shop', true],
+  ['https://x-access-token:tok@github.com/acme/shop.git', 'acme/shop', true],
+  // an all-digits scp owner is an owner, never a port
+  ['git@github.com:12345/shop.git', '12345/shop', true],
+  // another host that merely has "github.com" in its path, in both url forms
+  ['https://gitlab.example.com/mirrors/github.com/acme/repo.git', undefined, false],
+  ['git@gitlab.example.com:mirrors/github.com/acme/repo.git', undefined, false],
+  // look-alike and unrelated hosts
+  ['https://mygithub.com/acme/shop', undefined, false],
+  ['https://github.company.com/acme/shop', undefined, false],
+  ['git@gitlab.com:acme/shop.git', undefined, false],
+  ['https://gitlab.com/acme/shop.git', undefined, false],
+  ['/srv/git/github.com/acme/shop.git', undefined, false],
+];
+
+describe('parseGitHubRepo / isGitHubRemote', () => {
+  it('agree on every remote form git accepts, and on every host that is not github.com', () => {
+    REMOTES.forEach(([url, repo, isGitHub]) => {
+      expect(parseGitHubRepo(url), url).to.equal(repo);
+      expect(isGitHubRemote(url), url).to.equal(isGitHub);
+    });
+  });
+});
+
+describe('GitHubClient.fromEnv', () => {
+  const envKeys = ['GITHUB_TOKEN', 'BIT_GITHUB_TOKEN', 'GITHUB_REPOSITORY'] as const;
+  const saved: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    envKeys.forEach((key) => {
+      saved[key] = process.env[key];
+      delete process.env[key];
+    });
+    process.env.GITHUB_TOKEN = 'tok';
+  });
+
+  afterEach(() => {
+    envKeys.forEach((key) => {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    });
+  });
+
+  const OURS = 'git@github.com:acme/shop.git';
+  /** [case, GITHUB_REPOSITORY, remote, resolved repo, warning fragments]. */
+  const RESOLUTION: Array<[string, string, string | undefined, string | undefined, string[]?]> = [
+    ['the remote and the environment agree', 'acme/shop', OURS, 'acme/shop'],
+    // the ORIGIN-parsed repository outranks GITHUB_REPOSITORY, and the disagreement must be reported
+    ['they disagree', 'other-org/other-repo', OURS, 'acme/shop', ['other-org/other-repo', 'acme/shop']],
+    // GitHub repository names are case-insensitive, so a case-only difference is not a disagreement
+    ['they differ only in case', 'Acme/Shop', OURS, 'acme/shop'],
+    ['there is no remote to parse', 'acme/shop', undefined, 'acme/shop'],
+    ['the remote is a github url nothing parses out of', 'acme/shop', 'https://github.com/', 'acme/shop'],
+    // a remote that is demonstrably not github stays unconfigured however complete the environment is
+    ['the remote is another host', 'acme/shop', 'https://gitlab.com/acme/shop.git', undefined],
+    ['the remote is a look-alike host', 'acme/shop', 'https://mygithub.com/acme/shop', undefined],
+  ];
+
+  RESOLUTION.forEach(([name, repository, remote, repo, warns]) => {
+    it(`resolves the repository when ${name}`, () => {
+      process.env.GITHUB_REPOSITORY = repository;
+      const warnings: string[] = [];
+      const client = GitHubClient.fromEnv(remote, (message) => warnings.push(message));
+      expect(client?.repo).to.equal(repo);
+      (warns ?? []).forEach((fragment) => expect(warnings.join('\n')).to.contain(fragment));
+      if (!warns) expect(warnings).to.deep.equal([]);
+    });
+  });
+
+  it('needs a token: a repository on its own configures nothing', () => {
+    delete process.env.GITHUB_TOKEN;
+    process.env.GITHUB_REPOSITORY = 'acme/shop';
+    expect(GitHubClient.fromEnv('git@github.com:acme/shop.git')).to.equal(undefined);
+  });
+
+  // Asserted through the `authorization` header, so what is pinned is the token the client actually
+  // sends. The fetch stub must be installed before `fromEnv` runs.
+  describe('token precedence', () => {
+    let realFetch: typeof fetch;
+    let calls: Array<{ url: string; init: any }>;
+
+    beforeEach(() => {
+      realFetch = globalThis.fetch;
+      calls = [];
+      globalThis.fetch = (async (url: any, init: any) => {
+        calls.push({ url: String(url), init });
+        return new Response(JSON.stringify([]), { status: 200, headers: { 'content-type': 'application/json' } });
+      }) as typeof fetch;
+    });
+
+    afterEach(() => {
+      globalThis.fetch = realFetch;
+    });
+
+    /** The token a client built from this environment puts on the wire. */
+    async function sentToken(): Promise<string | undefined> {
+      const client = GitHubClient.fromEnv('git@github.com:acme/shop.git');
+      await client?.findPrByBranch('lane-x');
+      return calls[0]?.init?.headers?.authorization;
+    }
+
+    const PRECEDENCE: Array<[string, Record<string, string | undefined>, string]> = [
+      // the override beats the ambient default
+      ['both set', { GITHUB_TOKEN: 'workflow-token', BIT_GITHUB_TOKEN: 'user-pat' }, 'Bearer user-pat'],
+      // the ordinary Actions job
+      ['only GITHUB_TOKEN', { GITHUB_TOKEN: 'workflow-token' }, 'Bearer workflow-token'],
+      // any CI that is not Actions
+      ['only BIT_GITHUB_TOKEN', { BIT_GITHUB_TOKEN: 'user-pat' }, 'Bearer user-pat'],
+      ['an EMPTY override', { GITHUB_TOKEN: 'workflow-token', BIT_GITHUB_TOKEN: '' }, 'Bearer workflow-token'],
+    ];
+
+    PRECEDENCE.forEach(([name, env, expected]) => {
+      it(`sends the right token with ${name}`, async () => {
+        delete process.env.GITHUB_TOKEN;
+        Object.entries(env).forEach(([key, value]) => {
+          process.env[key] = value;
+        });
+        expect(await sentToken()).to.equal(expected);
+      });
+    });
+
+    it('is not configured when neither token is set, and puts nothing on the wire', async () => {
+      delete process.env.GITHUB_TOKEN;
+      process.env.GITHUB_REPOSITORY = 'acme/shop';
+      expect(GitHubClient.fromEnv('git@github.com:acme/shop.git')).to.equal(undefined);
+      expect(calls).to.have.lengthOf(0);
+    });
+  });
+});
+
+describe('GitHubClient', () => {
+  it('createPr posts the pull-request payload to the pulls endpoint', async () => {
+    const calls: Array<{ url: string; init: any }> = [];
+    const fakeFetch = (async (url: any, init: any) => {
+      calls.push({ url: String(url), init });
+      return new Response(
+        JSON.stringify({ number: 7, state: 'open', labels: [], head: { ref: 'lane-x' }, html_url: 'http://pr/7' }),
+        { status: 201, headers: { 'content-type': 'application/json' } }
+      );
+    }) as typeof fetch;
+    const client = new GitHubClient({ token: 'tok', repo: 'acme/shop', fetchImpl: fakeFetch });
+    const pr = await client.createPr({ head: 'lane-x', base: 'main', title: 't', body: 'b' });
+    expect(pr.number).to.equal(7);
+    expect(calls[0].url).to.equal('https://api.github.com/repos/acme/shop/pulls');
+    expect(calls[0].init.method).to.equal('POST');
+    expect(JSON.parse(calls[0].init.body)).to.deep.equal({ head: 'lane-x', base: 'main', title: 't', body: 'b' });
+  });
+
+  it('findPrByBranch returns undefined on empty list', async () => {
+    const fakeFetch = (async () =>
+      new Response(JSON.stringify([]), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })) as typeof fetch;
+    const client = new GitHubClient({ token: 'tok', repo: 'acme/shop', fetchImpl: fakeFetch });
+    expect(await client.findPrByBranch('lane-x')).to.equal(undefined);
+  });
+});