canopycms 0.0.67 → 0.0.68-int.93

package/dist/worker/task-runner.js

@@ -3,10 +3,10 @@ import { simpleGit } from 'simple-git';
 import { completeTask, dequeueTask, failTask, recoverOrphanedTasks, retryTask, } from '../task-queue/cms-task-queue.js';
 import { createOrUpdatePullRequest } from '../github-service.js';
 import { BranchMetadataFileManager, getBranchMetadataFileManager } from '../branch-metadata.js';
-import { sanitizeBranchName } from '../paths/branch-name.js';
+import { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX } from '../paths/branch-name.js';
 import { gitNetworkChildEnv } from '../git-manager.js';
 import { getErrorMessage, redactCredentials } from '../utils/error.js';
-import { isNonFastForwardRejection, isStaleLeaseRejection } from '../utils/git.js';
+import { isNonFastForwardRejection, isStaleLeaseRejection, workflowPushRefusalFile, } from '../utils/git.js';
 import { clearHistoryRewrittenMarker, readPublishedSha } from './history-rewrite.js';
 import { writeWorkerStatus } from '../task-queue/worker-status.js';
 import { workerLog, workerLogError } from './log.js';
@@ -90,6 +90,15 @@ function isRateLimitSignal403(err) {
     return false;
 }
 // Payload validation helpers — fail fast with clear errors instead of silent `as` casts
+/**
+ * Whether `branch` carries the reserved settings-branch prefix. Matching on the prefix
+ * alone, never on a configured name, is what keeps a content branch out: branch creation
+ * rejects the prefix, while a configured name the worker and API disagree on could be a
+ * content branch's.
+ */
+function isSettingsBranch(branch) {
+    return branch.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX);
+}
 function requireString(payload, key) {
     const val = payload[key];
     if (typeof val !== 'string')
@@ -282,6 +291,13 @@ export async function executeTask(ctx, task, signal) {
             if (sanitizeBranchName(branch) === ctx.sanitizedBaseBranch) {
                 throw new PermanentTaskError(`Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`);
             }
+            // The settings branch is an orphan with no history in common with the
+            // base, so GitHub 422s a PR for it: push it and stop.
+            if (isSettingsBranch(branch)) {
+                await ctx.pushBranchToGitHub(branch);
+                workerLog(`Pushed settings branch ${branch}; settings branches never get a PR`);
+                return { pushed: true };
+            }
             await ctx.pushBranchToGitHub(branch);
             const result = await createOrUpdatePullRequest({
                 octokit: ctx.octokit(),
@@ -291,9 +307,9 @@ export async function executeTask(ctx, task, signal) {
                 base,
                 title: optionalString(payload, 'title', `Submit ${branch}`),
                 body: optionalString(payload, 'body', ''),
-                // Content submits (api/github-sync.ts) set this; settings-branch
-                // syncs (services.ts) deliberately don't.
+                // Content submits (api/github-sync.ts) set both.
                 markReadyIfDraft: payload.markReadyIfDraft === true,
+                mergeSectionIntoBody: payload.mergeSectionIntoBody === true,
                 signal,
             });
             workerLog(result.created
@@ -415,6 +431,23 @@ async function updateBranchMetadataOnFailure(ctx, task, error) {
         workerLogError(`Failed to update failure metadata for ${branch}:`, err instanceof Error ? err.message : err);
     }
 }
+/**
+ * Fail fast when GitHub refused the push for adding workflow content it does not already hold: the
+ * worker's credential deliberately lacks the workflows permission, so the identical push can never
+ * succeed. Rebasing onto a base that changed a workflow does not trigger it; a workflow edit made
+ * outside the editor, auto-merged by the rebase with a base change to the same file, does.
+ */
+function throwIfWorkflowRefusal(branch, message) {
+    const file = workflowPushRefusalFile(message);
+    if (file === null)
+        return;
+    throw new PermanentTaskError(`Push refused for branch "${branch}": it would put a version of ${file} on GitHub that ` +
+        `GitHub does not already have, and this deployment's GitHub credential is deliberately not ` +
+        `allowed to change workflow files. Such a change usually comes from outside the editor, ` +
+        `such as a direct push to this branch. Nothing was pushed, and ` +
+        `retrying will not help until a developer with permission to change workflow files ` +
+        `resolves it on GitHub.`);
+}
 export async function pushBranchToGitHub(ctx, branch) {
     const git = simpleGit({
         baseDir: ctx.remoteGitPath,
@@ -473,6 +506,7 @@ export async function pushBranchToGitHub(ctx, branch) {
     }
     catch (err) {
         const message = getErrorMessage(err);
+        throwIfWorkflowRefusal(branch, message);
         // A refused lease means GitHub is not at the commit we rewrote, so the
         // marker is stale -- routine, not exceptional: tasks are re-run after a
         // crash (recoverOrphanedTasks) and the marker survives any failure to
@@ -494,6 +528,7 @@ export async function pushBranchToGitHub(ctx, branch) {
             }
             catch (retryErr) {
                 const retryMessage = getErrorMessage(retryErr);
+                throwIfWorkflowRefusal(branch, retryMessage);
                 if (isNonFastForwardRejection(retryMessage)) {
                     throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is neither the commit this ` +
                         `deployment last published nor an ancestor of what it is pushing, so the branch ` +

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.67",
+  "version": "0.0.68-int.93",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {