@ticatec/omniflow-github 1.0.0

package/src/client/GitHubClient.ts

@@ -0,0 +1,242 @@
+import {
+  maskSecrets,
+  safeFetch,
+  extractErrorMessage
+} from '@ticatec/omniflow-artifact'
+
+export interface GitHubClientConfig {
+  baseUrl?: string
+  token?: string
+  timeoutMs?: number
+}
+
+export interface ParsedGitHubRepo {
+  host: string
+  owner: string
+  repo: string
+  fullName: string
+}
+
+export interface GitHubReleaseAsset {
+  id: number
+  name: string
+  size?: number
+  browser_download_url?: string
+}
+
+export interface GitHubRelease {
+  id: number
+  tag_name: string
+  name: string
+  upload_url: string
+  html_url: string
+  assets?: GitHubReleaseAsset[]
+}
+
+export class GitHubClient {
+  readonly baseUrl: string
+  readonly token?: string
+  readonly timeoutMs: number
+
+  constructor(config: GitHubClientConfig = {}) {
+    let base = (config.baseUrl || 'https://api.github.com').trim().replace(/\/+$/, '')
+    if (!/^https?:\/\//i.test(base)) {
+      base = `https://${base}`
+    }
+    this.baseUrl = base
+    this.token = config.token
+    this.timeoutMs = config.timeoutMs ?? 30000
+  }
+
+  get isGitHubCom(): boolean {
+    try {
+      const parsed = new URL(this.baseUrl)
+      return parsed.hostname === 'github.com' || parsed.hostname === 'api.github.com'
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * Return sensitive credential strings of length >= 3 for scrubbing.
+   */
+  getSecrets(): string[] {
+    return [this.token].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+  }
+
+  maskSecrets(input: string): string {
+    return maskSecrets(input, this.getSecrets())
+  }
+
+  async extractErrorMessage(response: Response): Promise<string> {
+    return extractErrorMessage(response, this.getSecrets())
+  }
+
+  getAuthHeaders(): Record<string, string> {
+    const headers: Record<string, string> = {
+      Accept: 'application/vnd.github+json',
+      'X-GitHub-Api-Version': '2022-11-28'
+    }
+    if (this.token) {
+      headers['Authorization'] = `Bearer ${this.token}`
+    }
+    return headers
+  }
+
+  getRepoApiUrl(owner: string, repo: string, subpath = ''): string {
+    const cleanSubpath = subpath ? (subpath.startsWith('/') ? subpath : `/${subpath}`) : ''
+    return `${this.baseUrl}/repos/${owner}/${repo}${cleanSubpath}`
+  }
+
+  async request(url: string, init: RequestInit = {}): Promise<Response> {
+    const headers = {
+      ...this.getAuthHeaders(),
+      ...((init.headers as Record<string, string>) || {})
+    }
+
+    return safeFetch(url, {
+      ...init,
+      headers,
+      timeoutMs: this.timeoutMs,
+      secrets: this.getSecrets()
+    })
+  }
+
+  /**
+   * Get release by tag. Returns null if not found (404).
+   */
+  async getReleaseByTag(owner: string, repo: string, tag: string): Promise<GitHubRelease | null> {
+    const url = `${this.getRepoApiUrl(owner, repo)}/releases/tags/${encodeURIComponent(tag)}`
+    const res = await this.request(url)
+    if (res.status === 404) {
+      return null
+    }
+    if (!res.ok) {
+      const errText = await this.extractErrorMessage(res)
+      throw new Error(`Failed to query GitHub release for tag "${tag}" (${res.status}): ${errText}`)
+    }
+    return (await res.json()) as GitHubRelease
+  }
+
+  /**
+   * Create a new GitHub Release.
+   */
+  async createRelease(
+    owner: string,
+    repo: string,
+    params: {
+      tagName: string
+      name?: string
+      body?: string
+      draft?: boolean
+      prerelease?: boolean
+    }
+  ): Promise<GitHubRelease> {
+    const url = `${this.getRepoApiUrl(owner, repo)}/releases`
+    const res = await this.request(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        tag_name: params.tagName,
+        name: params.name || params.tagName,
+        body: params.body || '',
+        draft: params.draft ?? false,
+        prerelease: params.prerelease ?? false
+      })
+    })
+
+    if (!res.ok) {
+      const err = await this.extractErrorMessage(res)
+      throw new Error(`Failed to create GitHub release "${params.tagName}" (${res.status}): ${err}`)
+    }
+    return (await res.json()) as GitHubRelease
+  }
+
+  /**
+   * Upload binary asset to a release.
+   */
+  async uploadReleaseAsset(
+    uploadUrlTemplate: string,
+    fileName: string,
+    data: Buffer | Uint8Array,
+    contentType = 'application/octet-stream'
+  ): Promise<{ id: number; name: string; browser_download_url: string }> {
+    // uploadUrlTemplate is like: https://uploads.github.com/repos/octocat/Hello-World/releases/1/assets{?name,label}
+    const cleanUrl = uploadUrlTemplate.replace(/\{.*?\}$/, '')
+    const targetUrl = `${cleanUrl}?name=${encodeURIComponent(fileName)}`
+
+    const res = await this.request(targetUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': contentType,
+        'Content-Length': String(data.byteLength)
+      },
+      body: data as unknown as BodyInit
+    })
+
+    if (!res.ok) {
+      const err = await this.extractErrorMessage(res)
+      throw new Error(`Failed to upload asset "${fileName}" to GitHub release (${res.status}): ${err}`)
+    }
+    return (await res.json()) as { id: number; name: string; browser_download_url: string }
+  }
+
+  /**
+   * Parse GitHub repo URL or slug into host, owner, and repo.
+   */
+  static parseRepo(urlOrSlug: string, defaultHost = 'github.com'): ParsedGitHubRepo {
+    let clean = urlOrSlug.trim()
+    let host = defaultHost
+
+    if (clean.includes('://')) {
+      const parsed = new URL(clean)
+      host = parsed.host
+      clean = parsed.pathname
+    } else if (clean.includes('@') && clean.includes(':')) {
+      const parts = clean.split(':')
+      host = parts[0].replace(/.*@/, '')
+      clean = parts[1]
+    }
+
+    clean = clean.replace(/^\/+/, '').replace(/\.git$/, '')
+    const segments = clean.split('/').filter(Boolean)
+    if (segments.length < 2) {
+      throw new Error(`Invalid GitHub repository path: "${urlOrSlug}". Expected owner/repo format.`)
+    }
+
+    const owner = segments[0]
+    const repo = segments[1]
+    const fullName = `${owner}/${repo}`
+
+    return { host, owner, repo, fullName }
+  }
+
+  /**
+   * Determine the API base URL from serverUrl and optional contextPath.
+   */
+  static resolveApiBase(serverUrl: string, contextPath?: string): string {
+    const url = new URL(serverUrl)
+    if (url.hostname === 'github.com' || url.hostname === 'www.github.com' || url.hostname === 'api.github.com') {
+      return 'https://api.github.com'
+    }
+    return `${serverUrl.replace(/\/+$/, '')}${contextPath || ''}/api/v3`
+  }
+
+  /**
+   * Determine whether a hostname is a genuine GitHub host (avoiding suffix/substring spoofing).
+   */
+  static isGitHubHost(hostname: string): boolean {
+    const host = hostname.toLowerCase().trim()
+    return (
+      host === 'github.com' ||
+      host.endsWith('.github.com') ||
+      host === 'api.github.com' ||
+      host === 'ghcr.io' ||
+      host.endsWith('.ghcr.io')
+    )
+  }
+}

package/src/index.ts

@@ -0,0 +1,54 @@
+import type { PluginContext } from '@ticatec/omniflow-core'
+import type { ArtifactPublisherRegistry } from '@ticatec/omniflow-artifact'
+import { GitHubContainerPublisher } from './artifacts/GitHubContainerPublisher.js'
+import { GitHubNpmPublisher } from './artifacts/GitHubNpmPublisher.js'
+import { GitHubMavenPublisher } from './artifacts/GitHubMavenPublisher.js'
+import { GitHubReleasePublisher } from './artifacts/GitHubReleasePublisher.js'
+
+export * from './client/GitHubClient.js'
+export * from './artifacts/GitHubContainerPublisher.js'
+export * from './artifacts/GitHubNpmPublisher.js'
+export * from './artifacts/GitHubMavenPublisher.js'
+export * from './artifacts/GitHubReleasePublisher.js'
+
+export interface RegisterGitHubOptions {
+  artifactRegistry?: ArtifactPublisherRegistry
+}
+
+/**
+ * Standard OmniFlow Plugin SPI entry point.
+ */
+export function register(ctx: PluginContext): void {
+  registerGitHub({ artifactRegistry: ctx.artifactRegistry })
+}
+
+export default register
+
+/**
+ * Register all GitHub artifact publishers into the artifact registry.
+ */
+export function registerGitHub(options: RegisterGitHubOptions = {}): {
+  containerPublisher: GitHubContainerPublisher
+  npmPublisher: GitHubNpmPublisher
+  mavenPublisher: GitHubMavenPublisher
+  releasePublisher: GitHubReleasePublisher
+} {
+  const containerPublisher = new GitHubContainerPublisher()
+  const npmPublisher = new GitHubNpmPublisher()
+  const mavenPublisher = new GitHubMavenPublisher()
+  const releasePublisher = new GitHubReleasePublisher()
+
+  if (options.artifactRegistry) {
+    options.artifactRegistry.register(containerPublisher)
+    options.artifactRegistry.register(npmPublisher)
+    options.artifactRegistry.register(mavenPublisher)
+    options.artifactRegistry.register(releasePublisher)
+  }
+
+  return {
+    containerPublisher,
+    npmPublisher,
+    mavenPublisher,
+    releasePublisher
+  }
+}