@vypdev/copilot 3.5.2 → 3.5.3

package/build/cli/index.js

@@ -51946,7 +51946,14 @@ class DeploymentOrchestrationRuntime {
             selectedPrMode: inspection.decision.mode,
         };
         await this.persist(context, managed);
-        await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        try {
+            await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        }
+        catch (cause) {
+            const message = `GitHub could not configure automatic merge for PR #${pullRequest.number}. Check the PR and retry the stored ${category} phase.`;
+            const error = new application_error_1.ApplicationError("provider.unavailable", message, { cause, retryable: true });
+            return { kind: "blocked", result: await this.block(context, managed, category, message, true, error) };
+        }
         await this.publishDashboard(context, managed);
         return { kind: "configured", operation: managed };
     }
@@ -52876,22 +52883,19 @@ const application_error_1 = __nccwpck_require__(75999);
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
+const deployment_continuation_guard_1 = __nccwpck_require__(1779);
 class ConfirmPublicationHandler {
     constructor(runtime, reconciliation) {
         this.runtime = runtime;
         this.reconciliation = reconciliation;
     }
     async invoke(context) {
-        const operation = await this.resumeRetryableBlock(context, (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context));
-        if (operation.phase === "reconciliation_pending" && operation.publicationVerified) {
-            return await this.reconciliation.plan(context, operation)
-                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; reconciliation state was recovered.`);
-        }
-        if (operation.phase === "completed" && operation.publicationVerified) {
-            await this.runtime.publishDashboard(context, operation);
-            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; duplicate notification ignored.`);
-        }
-        assertPublicationPhase(operation);
+        const current = (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context);
+        const invalid = (0, deployment_continuation_guard_1.validateDeploymentContinuation)(current, context.singleAction.operationId, ["published", "publishing", "promoted", "reconciliation_pending", "completed"], context.singleAction.version);
+        if (invalid)
+            throw new application_error_1.ApplicationError("workflow.stale", invalid);
+        // Verify external receipts before clearing a block or retrying any merge/cleanup effect.
+        const operation = current;
         const productionSha = requireProductionSha(operation);
         const publication = await this.runtime.dependencies.publication.inspect({
             tag: operation.tag,
@@ -52908,8 +52912,18 @@ class ConfirmPublicationHandler {
         if (!reachable) {
             return await this.runtime.block(context, operation, "publication", "Published SHA is not reachable from the stored production branch.", false);
         }
+        const resumed = await this.resumeRetryableBlock(context, operation);
+        if (resumed.phase === "reconciliation_pending" && resumed.publicationVerified) {
+            return await this.reconciliation.plan(context, resumed)
+                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; reconciliation state was recovered.`);
+        }
+        if (resumed.phase === "completed" && resumed.publicationVerified) {
+            await this.runtime.publishDashboard(context, resumed);
+            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; duplicate notification ignored.`);
+        }
+        assertPublicationPhase(resumed);
         const published = {
-            ...operation,
+            ...resumed,
             phase: "published",
             publicationVerified: true,
             publicationReceipt: publication.receipt,
@@ -53228,6 +53242,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconciliationHandler = void 0;
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
+const managed_pull_request_1 = __nccwpck_require__(95914);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
 class ReconciliationHandler {
     constructor(runtime) {
@@ -53264,10 +53279,12 @@ class ReconciliationHandler {
         return await this.complete(context, updated, ` after reconciliation PR #${pullRequest.number}`);
     }
     async plan(context, operation) {
-        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending" && target.pullRequest === undefined);
+        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending");
         if (index < 0)
             return await this.finishOrPresent(context, operation);
         let target = operation.reconciliationTargets[index];
+        if (target.pullRequest !== undefined)
+            return await this.resumePullRequest(context, operation, target);
         const targetRole = (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch);
         const preflight = await this.runtime.inspectMergeBehavior(context, operation, target.targetBranch, targetRole, target.sourceSha);
         if (preflight.kind === "blocked") {
@@ -53324,6 +53341,26 @@ class ReconciliationHandler {
         await this.runtime.publishMilestone(context, completed, { kind: "orchestration-complete", tag: completed.tag });
         return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Deployment ${completed.tag} completed${completionContext}.`);
     }
+    async resumePullRequest(context, operation, target) {
+        const pullRequest = await this.runtime.dependencies.pullRequests.getPullRequest(target.pullRequest);
+        const identity = (0, managed_pull_request_1.parseManagedPullRequestMarker)(pullRequest.body);
+        const expectedHead = target.syncBranch ? target.syncSha : target.sourceSha;
+        if (!identity || identity.operationId !== operation.operationId || identity.phase !== "reconciliation"
+            || identity.issue !== context.singleAction.issue || pullRequest.number !== target.pullRequest
+            || pullRequest.repositoryFullName.toLowerCase() !== `${context.owner}/${context.repo}`.toLowerCase()
+            || pullRequest.baseBranch !== target.targetBranch
+            || pullRequest.headBranch !== (target.syncBranch ?? target.sourceBranch)
+            || !expectedHead || pullRequest.headSha !== expectedHead) {
+            return await this.runtime.block(context, operation, "reconciliation", "The recorded reconciliation PR no longer matches its durable identity and head SHA.", false);
+        }
+        if (pullRequest.merged)
+            return await this.accept(context, operation, pullRequest);
+        if (pullRequest.state === "closed") {
+            return await this.runtime.block(context, operation, "reconciliation", `Reconciliation PR #${pullRequest.number} was closed without merge.`, true);
+        }
+        const configured = await this.runtime.configureMergeBehavior(context, operation, pullRequest, "reconciliation", (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch));
+        return configured.kind === "blocked" ? configured.result : undefined;
+    }
     async finishOrPresent(context, operation) {
         if (operation.reconciliationTargets.length > 0
             && operation.reconciliationTargets.every((target) => target.status === "completed")) {

package/build/github_action/index.js

@@ -50260,7 +50260,14 @@ class DeploymentOrchestrationRuntime {
             selectedPrMode: inspection.decision.mode,
         };
         await this.persist(context, managed);
-        await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        try {
+            await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        }
+        catch (cause) {
+            const message = `GitHub could not configure automatic merge for PR #${pullRequest.number}. Check the PR and retry the stored ${category} phase.`;
+            const error = new application_error_1.ApplicationError("provider.unavailable", message, { cause, retryable: true });
+            return { kind: "blocked", result: await this.block(context, managed, category, message, true, error) };
+        }
         await this.publishDashboard(context, managed);
         return { kind: "configured", operation: managed };
     }
@@ -51190,22 +51197,19 @@ const application_error_1 = __nccwpck_require__(75999);
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
+const deployment_continuation_guard_1 = __nccwpck_require__(1779);
 class ConfirmPublicationHandler {
     constructor(runtime, reconciliation) {
         this.runtime = runtime;
         this.reconciliation = reconciliation;
     }
     async invoke(context) {
-        const operation = await this.resumeRetryableBlock(context, (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context));
-        if (operation.phase === "reconciliation_pending" && operation.publicationVerified) {
-            return await this.reconciliation.plan(context, operation)
-                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; reconciliation state was recovered.`);
-        }
-        if (operation.phase === "completed" && operation.publicationVerified) {
-            await this.runtime.publishDashboard(context, operation);
-            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; duplicate notification ignored.`);
-        }
-        assertPublicationPhase(operation);
+        const current = (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context);
+        const invalid = (0, deployment_continuation_guard_1.validateDeploymentContinuation)(current, context.singleAction.operationId, ["published", "publishing", "promoted", "reconciliation_pending", "completed"], context.singleAction.version);
+        if (invalid)
+            throw new application_error_1.ApplicationError("workflow.stale", invalid);
+        // Verify external receipts before clearing a block or retrying any merge/cleanup effect.
+        const operation = current;
         const productionSha = requireProductionSha(operation);
         const publication = await this.runtime.dependencies.publication.inspect({
             tag: operation.tag,
@@ -51222,8 +51226,18 @@ class ConfirmPublicationHandler {
         if (!reachable) {
             return await this.runtime.block(context, operation, "publication", "Published SHA is not reachable from the stored production branch.", false);
         }
+        const resumed = await this.resumeRetryableBlock(context, operation);
+        if (resumed.phase === "reconciliation_pending" && resumed.publicationVerified) {
+            return await this.reconciliation.plan(context, resumed)
+                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; reconciliation state was recovered.`);
+        }
+        if (resumed.phase === "completed" && resumed.publicationVerified) {
+            await this.runtime.publishDashboard(context, resumed);
+            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; duplicate notification ignored.`);
+        }
+        assertPublicationPhase(resumed);
         const published = {
-            ...operation,
+            ...resumed,
             phase: "published",
             publicationVerified: true,
             publicationReceipt: publication.receipt,
@@ -51542,6 +51556,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconciliationHandler = void 0;
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
+const managed_pull_request_1 = __nccwpck_require__(95914);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
 class ReconciliationHandler {
     constructor(runtime) {
@@ -51578,10 +51593,12 @@ class ReconciliationHandler {
         return await this.complete(context, updated, ` after reconciliation PR #${pullRequest.number}`);
     }
     async plan(context, operation) {
-        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending" && target.pullRequest === undefined);
+        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending");
         if (index < 0)
             return await this.finishOrPresent(context, operation);
         let target = operation.reconciliationTargets[index];
+        if (target.pullRequest !== undefined)
+            return await this.resumePullRequest(context, operation, target);
         const targetRole = (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch);
         const preflight = await this.runtime.inspectMergeBehavior(context, operation, target.targetBranch, targetRole, target.sourceSha);
         if (preflight.kind === "blocked") {
@@ -51638,6 +51655,26 @@ class ReconciliationHandler {
         await this.runtime.publishMilestone(context, completed, { kind: "orchestration-complete", tag: completed.tag });
         return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Deployment ${completed.tag} completed${completionContext}.`);
     }
+    async resumePullRequest(context, operation, target) {
+        const pullRequest = await this.runtime.dependencies.pullRequests.getPullRequest(target.pullRequest);
+        const identity = (0, managed_pull_request_1.parseManagedPullRequestMarker)(pullRequest.body);
+        const expectedHead = target.syncBranch ? target.syncSha : target.sourceSha;
+        if (!identity || identity.operationId !== operation.operationId || identity.phase !== "reconciliation"
+            || identity.issue !== context.singleAction.issue || pullRequest.number !== target.pullRequest
+            || pullRequest.repositoryFullName.toLowerCase() !== `${context.owner}/${context.repo}`.toLowerCase()
+            || pullRequest.baseBranch !== target.targetBranch
+            || pullRequest.headBranch !== (target.syncBranch ?? target.sourceBranch)
+            || !expectedHead || pullRequest.headSha !== expectedHead) {
+            return await this.runtime.block(context, operation, "reconciliation", "The recorded reconciliation PR no longer matches its durable identity and head SHA.", false);
+        }
+        if (pullRequest.merged)
+            return await this.accept(context, operation, pullRequest);
+        if (pullRequest.state === "closed") {
+            return await this.runtime.block(context, operation, "reconciliation", `Reconciliation PR #${pullRequest.number} was closed without merge.`, true);
+        }
+        const configured = await this.runtime.configureMergeBehavior(context, operation, pullRequest, "reconciliation", (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch));
+        return configured.kind === "blocked" ? configured.result : undefined;
+    }
     async finishOrPresent(context, operation) {
         if (operation.reconciliationTargets.length > 0
             && operation.reconciliationTargets.every((target) => target.status === "completed")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vypdev/copilot",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "packageManager": "pnpm@10.12.4",
   "pnpm": {
     "overrides": {

package/setup/workflows/hotfix_workflow.yml

@@ -8,7 +8,7 @@ on:
         required: true
         default: prepare
         type: choice
-        options: [prepare, publish]
+        options: [prepare, publish, resume]
       operation-id:
         description: 'Internal durable operation identifier'
         required: false
@@ -66,10 +66,10 @@ jobs:
               if (operationId) errors.push('Operation ID must be empty in prepare mode.');
               if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
               if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
-            } else if (mode === 'publish') {
+            } else if (mode === 'publish' || mode === 'resume') {
               if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
-              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
-            } else errors.push('Mode must be prepare or publish.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish or resume mode.');
+            } else errors.push('Mode must be prepare, publish, or resume.');
             if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
@@ -185,17 +185,66 @@ jobs:
           single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
+  resume-reconciliation:
+    name: Resume published deployment
+    if: ${{ inputs.mode == 'resume' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 15
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Verify published operation before recovery
+        uses: actions/github-script@v9
+        env:
+          ISSUE: ${{ inputs.issue }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+        with:
+          script: |
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: Number(process.env.ISSUE) });
+            if (response.data.pull_request) throw new Error('The launcher must be an issue.');
+            const body = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const first = body.indexOf(start);
+            const last = body.indexOf(end, first + start.length);
+            if (first < 0 || last < 0 || body.indexOf(start, first + start.length) >= 0) throw new Error('A unique durable configuration is required.');
+            const payload = JSON.parse(body.slice(first + start.length, last));
+            const state = payload?.deploymentOrchestration;
+            const receipt = state?.publicationReceipt;
+            const phase = state?.phase === 'blocked' && state?.lastFailure?.retryable === true
+              ? state.lastFailure.previousPhase : state?.phase;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1
+              || !Number.isSafeInteger(state?.revision) || state.revision < 1
+              || state.operationId !== process.env.OPERATION_ID || state.version !== process.env.VERSION
+              || !['reconciliation_pending', 'completed'].includes(phase) || state.publicationVerified !== true
+              || !/^[a-f0-9]{40}$/i.test(state.productionSha || '') || state.tag !== `v${process.env.VERSION}`
+              || receipt?.operationId !== state.operationId || receipt?.productionSha !== state.productionSha
+              || receipt?.tag !== state.tag) throw new Error('Recovery requires the matching, already verified publication and reconciliation state.');
+      - name: Resume reconciliation from verified receipts
+        uses: vypdev/copilot@v3
+        with:
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}
+
   report-failure:
     name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [validate, prepare-version-files, promote, publish]
+    needs: [validate, prepare-version-files, promote, publish, resume-reconciliation]
     if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
       - name: Persist publication failure
-        if: ${{ inputs.mode == 'publish' }}
+        if: ${{ inputs.mode == 'publish' || inputs.mode == 'resume' }}
         uses: vypdev/copilot@v3
         with:
           single-action: failed_deployment_action

package/setup/workflows/release_workflow.yml

@@ -8,7 +8,7 @@ on:
         required: true
         default: prepare
         type: choice
-        options: [prepare, publish]
+        options: [prepare, publish, resume]
       operation-id:
         description: 'Internal durable operation identifier'
         required: false
@@ -66,10 +66,10 @@ jobs:
               if (operationId) errors.push('Operation ID must be empty in prepare mode.');
               if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
               if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
-            } else if (mode === 'publish') {
+            } else if (mode === 'publish' || mode === 'resume') {
               if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
-              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
-            } else errors.push('Mode must be prepare or publish.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish or resume mode.');
+            } else errors.push('Mode must be prepare, publish, or resume.');
             if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
@@ -185,17 +185,66 @@ jobs:
           single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
+  resume-reconciliation:
+    name: Resume published deployment
+    if: ${{ inputs.mode == 'resume' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 15
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Verify published operation before recovery
+        uses: actions/github-script@v9
+        env:
+          ISSUE: ${{ inputs.issue }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+        with:
+          script: |
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: Number(process.env.ISSUE) });
+            if (response.data.pull_request) throw new Error('The launcher must be an issue.');
+            const body = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const first = body.indexOf(start);
+            const last = body.indexOf(end, first + start.length);
+            if (first < 0 || last < 0 || body.indexOf(start, first + start.length) >= 0) throw new Error('A unique durable configuration is required.');
+            const payload = JSON.parse(body.slice(first + start.length, last));
+            const state = payload?.deploymentOrchestration;
+            const receipt = state?.publicationReceipt;
+            const phase = state?.phase === 'blocked' && state?.lastFailure?.retryable === true
+              ? state.lastFailure.previousPhase : state?.phase;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1
+              || !Number.isSafeInteger(state?.revision) || state.revision < 1
+              || state.operationId !== process.env.OPERATION_ID || state.version !== process.env.VERSION
+              || !['reconciliation_pending', 'completed'].includes(phase) || state.publicationVerified !== true
+              || !/^[a-f0-9]{40}$/i.test(state.productionSha || '') || state.tag !== `v${process.env.VERSION}`
+              || receipt?.operationId !== state.operationId || receipt?.productionSha !== state.productionSha
+              || receipt?.tag !== state.tag) throw new Error('Recovery requires the matching, already verified publication and reconciliation state.');
+      - name: Resume reconciliation from verified receipts
+        uses: vypdev/copilot@v3
+        with:
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}
+
   report-failure:
     name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [validate, prepare-version-files, promote, publish]
+    needs: [validate, prepare-version-files, promote, publish, resume-reconciliation]
     if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
       - name: Persist publication failure
-        if: ${{ inputs.mode == 'publish' }}
+        if: ${{ inputs.mode == 'publish' || inputs.mode == 'resume' }}
         uses: vypdev/copilot@v3
         with:
           single-action: failed_deployment_action