code-foundry 1.47.5 → 1.48.1

package/src/lib/task-filters.mjs

@@ -1,6 +1,10 @@
 // @ts-check
 
 import { execFileSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { listValue, readConfig } from './config.mjs'
+import { resolveMonorepoTool } from './profile.mjs'
 
 /**
  * Tasks that support `filter_<task>` path filters in code-foundry.yml. A
@@ -151,3 +155,379 @@ export function taskAffected(task, filters, paths) {
   const matchers = globs.map(globToRegExp)
   return paths.some((path) => matchers.some((matcher) => matcher.test(path)))
 }
+
+/**
+ * @typedef {{ name: string, dir: string, dependencies: string[] }} WorkspacePackage
+ * `dir` is repo-relative with forward slashes; the workspace root is ''.
+ */
+/** @typedef {{ label: string, files: string[], read: (path: string) => string }} WorkspaceSource */
+/**
+ * @typedef {{
+ *   tool: 'turbo'|'vite-plus'|'none',
+ *   base: string,
+ *   head: string,
+ *   all: boolean,
+ *   conservative: boolean,
+ *   reason: string,
+ *   mergeBase?: string,
+ *   changedFiles: number,
+ *   packages: string[],
+ *   removedPackages: string[],
+ *   filterArgs: string[],
+ * }} AffectedResult
+ */
+
+const SAFE_REF = /^[A-Za-z0-9._/~^@{}-]+$/
+const SAFE_PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/i
+/** Workspace glob syntax this module cannot evaluate faithfully. */
+const UNSUPPORTED_GLOB = /[{}[\]()+@\\]|^!!|\*\*[^/]|[^/]\*\*/
+
+/** @param {string} ref @param {string} label */
+function assertRef(ref, label) {
+  if (!ref || ref.startsWith('-') || !SAFE_REF.test(ref))
+    throw new Error(`invalid ${label} ref: ${ref}`)
+}
+
+/** @param {string} root @param {string[]} args */
+const git = (root, args) =>
+  execFileSync('git', args, {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 256 * 1024 * 1024,
+  })
+
+/**
+ * Workspace files as of a git ref (committed objects, not the working tree).
+ * @param {string} root
+ * @param {string} ref
+ * @returns {WorkspaceSource}
+ */
+export function gitWorkspaceSource(root, ref) {
+  assertRef(ref, 'workspace')
+  const files = git(root, ['ls-tree', '-r', '-z', '--name-only', ref]).split('\0').filter(Boolean)
+  return { label: ref, files, read: (path) => git(root, ['show', `${ref}:${path}`]) }
+}
+
+/**
+ * Workspace globs from package.json `workspaces` and pnpm-workspace.yaml.
+ * Throws on syntax it cannot evaluate so callers fail closed.
+ * @param {WorkspaceSource} source
+ * @returns {string[]}
+ */
+export function workspaceGlobs(source) {
+  /** @type {string[]} */
+  const globs = []
+  if (source.files.includes('package.json')) {
+    let manifest
+    try {
+      manifest = JSON.parse(source.read('package.json'))
+    } catch {
+      throw new Error(`malformed package.json at ${source.label}`)
+    }
+    const workspaces = manifest.workspaces
+    const list = Array.isArray(workspaces) ? workspaces : workspaces?.packages
+    if (workspaces !== undefined && !Array.isArray(list))
+      throw new Error('unsupported workspaces declaration in package.json')
+    if (Array.isArray(list)) {
+      for (const item of list) {
+        if (typeof item !== 'string') throw new Error('non-string workspace glob in package.json')
+        globs.push(item)
+      }
+    }
+  }
+  if (source.files.includes('pnpm-workspace.yaml')) {
+    let inPackages = false
+    for (const line of source.read('pnpm-workspace.yaml').split(/\r?\n/)) {
+      if (/^packages:\s*$/.test(line)) inPackages = true
+      else if (/^packages:\s*\S/.test(line)) {
+        // Flow style: packages: ['apps/*', 'packages/*']
+        const flow = line.match(/^packages:\s*\[(.*)\]\s*(?:#.*)?$/)
+        if (!flow) throw new Error('unsupported packages declaration in pnpm-workspace.yaml')
+        for (const part of flow[1].split(',')) {
+          const entry = part.trim()
+          if (!entry) continue
+          const item = entry.match(/^(['"]?)([^'"]+)\1$/)
+          if (!item) throw new Error(`unsupported pnpm-workspace.yaml entry: ${entry}`)
+          globs.push(item[2])
+        }
+      } else if (/^\S/.test(line)) inPackages = false
+      else if (inPackages) {
+        if (/^\s*(?:#.*)?$/.test(line)) continue
+        const item = line.match(/^\s*-\s*(['"]?)([^'"#]+?)\1\s*(?:#.*)?$/)
+        if (!item) throw new Error(`unsupported pnpm-workspace.yaml entry: ${line.trim()}`)
+        globs.push(item[2])
+      }
+    }
+  }
+  for (const glob of globs) {
+    const body = glob.startsWith('!') ? glob.slice(1) : glob
+    if (!body || UNSUPPORTED_GLOB.test(body)) throw new Error(`unsupported workspace glob: ${glob}`)
+  }
+  return globs
+}
+
+/**
+ * Workspace packages including the root. Throws when a member cannot be read or named.
+ * @param {WorkspaceSource} source
+ * @returns {WorkspacePackage[]}
+ */
+export function listWorkspacePackages(source) {
+  const globs = workspaceGlobs(source)
+  const includes = globs.filter((glob) => !glob.startsWith('!')).map(globToRegExp)
+  const excludes = globs
+    .filter((glob) => glob.startsWith('!'))
+    .map((glob) => globToRegExp(glob.slice(1)))
+  const directories = source.files
+    .filter((file) => file.endsWith('/package.json') && !file.split('/').includes('node_modules'))
+    .map((file) => file.slice(0, -'/package.json'.length))
+    .filter((dir) => includes.some((re) => re.test(dir)) && !excludes.some((re) => re.test(dir)))
+
+  /** @type {Array<{ name: string, dir: string, manifest: Record<string, any> }>} */
+  const manifests = []
+  /** @param {string} dir @param {boolean} isRoot */
+  const load = (dir, isRoot) => {
+    const path = dir ? `${dir}/package.json` : 'package.json'
+    let manifest
+    try {
+      manifest = JSON.parse(source.read(path))
+    } catch {
+      throw new Error(`malformed manifest ${path} at ${source.label}`)
+    }
+    if (typeof manifest.name === 'string' && manifest.name) {
+      manifests.push({ name: manifest.name, dir, manifest })
+    } else if (isRoot) {
+      manifests.push({ name: '//', dir, manifest })
+    } else {
+      throw new Error(`workspace package ${path} has no name`)
+    }
+  }
+  if (source.files.includes('package.json')) load('', true)
+  for (const dir of directories) load(dir, false)
+
+  const seen = new Set()
+  for (const item of manifests) {
+    if (seen.has(item.name)) throw new Error(`duplicate workspace package name: ${item.name}`)
+    seen.add(item.name)
+  }
+  return manifests.map(({ name, dir, manifest }) => ({
+    name,
+    dir,
+    dependencies: [
+      ...new Set(
+        ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'].flatMap(
+          (table) =>
+            Object.keys(manifest[table] ?? {}).filter((dep) => seen.has(dep) && dep !== name)
+        )
+      ),
+    ],
+  }))
+}
+
+/**
+ * Changed files to affected packages across base and head graphs, so deleted,
+ * renamed, and re-wired packages keep their dependents. An unowned file selects
+ * every package unless `ignore` globs (`affected_ignore`) say otherwise.
+ * @param {WorkspacePackage[][]} graphs Head graph first.
+ * @param {string[]} changedFiles Repo-relative, forward slashes.
+ * @param {string[]} [ignore] Repo-relative globs of unowned files to skip.
+ * @returns {{ all: boolean, packages: string[], reason: string }}
+ */
+export function affectedFromChangedFiles(graphs, changedFiles, ignore = []) {
+  const ignored = ignore.map(globToRegExp)
+  const everything = [...new Set(graphs.flat().map((item) => item.name))].toSorted()
+  const direct = new Set()
+  for (const file of changedFiles) {
+    const owners = new Set()
+    for (const graph of graphs) {
+      const owner = graph
+        .filter((item) => item.dir !== '' && file.startsWith(`${item.dir}/`))
+        .toSorted((a, b) => b.dir.length - a.dir.length)[0]
+      if (owner) owners.add(owner.name)
+    }
+    if (owners.size > 0) {
+      for (const name of owners) direct.add(name)
+    } else if (!ignored.some((re) => re.test(file))) {
+      return { all: true, packages: everything, reason: `shared or unowned file changed: ${file}` }
+    }
+  }
+
+  const dependents = new Map()
+  for (const item of graphs.flat())
+    for (const dep of item.dependencies) {
+      if (!dependents.has(dep)) dependents.set(dep, new Set())
+      dependents.get(dep).add(item.name)
+    }
+  const affected = new Set(direct)
+  const queue = [...direct]
+  while (queue.length) {
+    for (const next of dependents.get(queue.pop()) ?? []) {
+      if (!affected.has(next)) {
+        affected.add(next)
+        queue.push(next)
+      }
+    }
+  }
+  return { all: false, packages: [...affected].toSorted(), reason: 'git diff and workspace graphs' }
+}
+
+/**
+ * `vp run` arguments selecting the given packages (the root is `-w`).
+ * @param {WorkspacePackage[]} packages
+ * @param {string[]} names
+ */
+export function vitePlusFilterArgs(packages, names) {
+  /** @type {string[]} */
+  const args = []
+  for (const name of names) {
+    const item = packages.find((candidate) => candidate.name === name)
+    if (item?.dir === '') args.push('-w')
+    else if (SAFE_PACKAGE_NAME.test(name)) args.push('--filter', name)
+    else throw new Error(`unsafe package name for --filter: ${name}`)
+  }
+  return args
+}
+
+/**
+ * @param {string} root @param {string} base @param {string} head
+ * @returns {string[]}
+ */
+function gitChangedFiles(root, base, head) {
+  assertRef(base, 'base')
+  assertRef(head, 'head')
+  const output = git(root, ['diff', '--name-only', '--no-renames', '-z', `${base}...${head}`, '--'])
+  return output.split('\0').filter(Boolean)
+}
+
+/**
+ * @param {string} root @param {string} base @param {string} head
+ * @param {(command: string, args: string[], cwd: string) => string} run
+ * @returns {string[]} affected package names
+ */
+function turboAffected(root, base, head, run) {
+  assertRef(base, 'base')
+  assertRef(head, 'head')
+  const local = join(root, 'node_modules/.bin/turbo')
+  const output = run(
+    existsSync(local) ? local : 'turbo',
+    ['query', 'affected', '--packages', `--base=${base}`, `--head=${head}`, '--no-update-notifier'],
+    root
+  )
+  const result = JSON.parse(output)
+  const items = result?.data?.affectedPackages?.items ?? result?.data?.affectedTasks?.items
+  if (!Array.isArray(items)) throw new Error('Turbo affected query returned no package/task items')
+  return [
+    ...new Set(
+      items
+        .map(
+          (/** @type {any} */ item) =>
+            item?.name ?? item?.package?.name ?? String(item?.fullName ?? '').split('#')[0]
+        )
+        .filter(Boolean)
+    ),
+  ].toSorted()
+}
+
+/** @type {(command: string, args: string[], cwd: string) => string} */
+const defaultRun = (command, args, cwd) =>
+  execFileSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: 64 * 1024 * 1024,
+  })
+
+/** @param {unknown} error */
+const describe = (error) => (error instanceof Error ? error.message.split('\n')[0] : String(error))
+
+/**
+ * Packages affected between two refs. Turbo uses `turbo query affected`; Vite+
+ * has no such query, so git and the workspace graphs at both refs decide.
+ * Anything unprovable is conservative (`all: true`).
+ * @param {string} root
+ * @param {{ base: string, head: string, tool?: string, run?: (command: string, args: string[], cwd: string) => string }} options
+ * @returns {AffectedResult}
+ */
+export function affectedPackages(root, options) {
+  const config = readConfig(join(root, '.github/code-foundry.yml'))
+  const requested = options.tool && options.tool !== 'auto' ? options.tool : undefined
+  const resolution = resolveMonorepoTool(
+    root,
+    requested ? { ...config, monorepo_tool: requested } : config
+  )
+  const { base, head } = options
+
+  /** @param {Partial<AffectedResult> & { reason: string }} partial @returns {AffectedResult} */
+  const result = (partial) => ({
+    tool: resolution.tool,
+    base,
+    head,
+    all: false,
+    conservative: false,
+    changedFiles: 0,
+    packages: [],
+    removedPackages: [],
+    filterArgs: [],
+    ...partial,
+  })
+  /** @param {string} reason @param {string[]} [names] */
+  const conservative = (reason, names = []) =>
+    result({ all: true, conservative: true, reason, packages: names })
+
+  if (resolution.tool === 'none')
+    return conservative(
+      `no task runner configured (${resolution.reason}); treating all packages as affected`
+    )
+
+  if (resolution.tool === 'turbo') {
+    // Turbo owns its own graph; this module's workspace parsing is never a
+    // prerequisite for the Turbo path.
+    try {
+      return result({
+        reason: 'turbo query affected',
+        packages: turboAffected(root, base, head, options.run ?? defaultRun),
+      })
+    } catch (error) {
+      return conservative(
+        `affected selection failed (${describe(error)}); treating all packages as affected`
+      )
+    }
+  }
+
+  /** @type {string[]} */
+  let headNames = []
+  try {
+    assertRef(base, 'base')
+    assertRef(head, 'head')
+    const headPackages = listWorkspacePackages(gitWorkspaceSource(root, head))
+    headNames = headPackages.map((item) => item.name).toSorted()
+    // One merge-base serves both the historical graph and the diff, so
+    // divergent branches are compared against their real common ancestor.
+    const mergeBase = git(root, ['merge-base', base, head]).trim()
+    const basePackages = listWorkspacePackages(gitWorkspaceSource(root, mergeBase))
+    const files = gitChangedFiles(root, mergeBase, head)
+    const selection = affectedFromChangedFiles(
+      [headPackages, basePackages],
+      files,
+      listValue(config.affected_ignore ?? '')
+    )
+    const existing = selection.packages.filter((name) => headNames.includes(name))
+    const removed = selection.packages.filter((name) => !headNames.includes(name))
+    return result({
+      mergeBase,
+      reason: selection.reason,
+      changedFiles: files.length,
+      all: selection.all,
+      packages: selection.all ? headNames : existing,
+      removedPackages: selection.all ? [] : removed,
+      // An empty selection must stay empty: callers skip the run instead of
+      // passing no filters, which would run every package.
+      filterArgs: selection.all ? [] : vitePlusFilterArgs(headPackages, existing),
+    })
+  } catch (error) {
+    return conservative(
+      `affected selection failed (${describe(error)}); treating all packages as affected`,
+      headNames
+    )
+  }
+}

package/.github/actions/attest-artifact/action.yml

@@ -1,56 +0,0 @@
-name: Attest verified build artifacts
-description: Generate checksums and signed provenance for explicitly selected build outputs.
-inputs:
-  artifacts:
-    description: 'JSON array of nonempty regular artifact files relative to the workspace.'
-    required: true
-outputs:
-  manifest-path:
-    description: Path to the generated SHA-256 JSON manifest.
-    value: ${{ steps.manifest.outputs.manifest-path }}
-  bundle-path:
-    description: Path to the signed provenance bundle.
-    value: ${{ steps.attest.outputs.bundle-path }}
-  attestation-url:
-    description: URL of the published attestation.
-    value: ${{ steps.attest.outputs.attestation-url }}
-runs:
-  using: composite
-  steps:
-    - name: Select and hash build outputs
-      id: manifest
-      shell: bash
-      env:
-        ARTIFACTS: ${{ inputs.artifacts }}
-      run: |
-        set -euo pipefail
-        [[ "$GITHUB_EVENT_NAME" != pull_request && "$GITHUB_EVENT_NAME" != pull_request_target ]]
-        node --input-type=module <<'NODE'
-        import { appendFileSync, mkdtempSync, writeFileSync } from 'node:fs'
-        import { join, resolve } from 'node:path'
-        import { pathToFileURL } from 'node:url'
-        const helper = pathToFileURL(resolve(process.env.GITHUB_ACTION_PATH, '../../../src/commands/release-integrity.mjs'))
-        const { assetManifest } = await import(helper.href)
-        const files = JSON.parse(process.env.ARTIFACTS)
-        if (!Array.isArray(files) || files.some(file => typeof file !== 'string')) throw new Error('artifacts must be a JSON string array')
-        const manifest = assetManifest(process.env.GITHUB_WORKSPACE, files)
-        const directory = mkdtempSync(join(process.env.RUNNER_TEMP, 'foundry-attestation-'))
-        const manifestPath = join(directory, 'manifest.json')
-        const sumsPath = join(directory, 'SHA256SUMS')
-        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n')
-        writeFileSync(sumsPath, manifest.checksums)
-        appendFileSync(process.env.GITHUB_OUTPUT, `manifest-path=${manifestPath}\nchecksums-path=${sumsPath}\n`)
-        NODE
-    - name: Sign build provenance
-      id: attest
-      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
-      with:
-        subject-checksums: ${{ steps.manifest.outputs.checksums-path }}
-    - name: Verify artifacts were not changed during signing
-      shell: bash
-      env:
-        CHECKSUMS_PATH: ${{ steps.manifest.outputs.checksums-path }}
-      run: |
-        set -euo pipefail
-        cd "$GITHUB_WORKSPACE"
-        sha256sum --check "$CHECKSUMS_PATH"

package/.github/actions/cache/action.yml

@@ -1,47 +0,0 @@
-name: Repository Cache
-description: Restore a cache and optionally enable the post-job save performed by actions/cache.
-
-inputs:
-  path:
-    description: Cache paths.
-    required: true
-  key:
-    description: Primary cache key.
-    required: true
-  restore-keys:
-    description: Optional newline-delimited restore keys.
-    required: false
-    default: ''
-  save:
-    description: Enable cache saving after the job completes.
-    required: false
-    default: 'true'
-
-outputs:
-  cache-hit:
-    description: Whether an exact cache was restored.
-    value: ${{ steps.cache.outputs.cache-hit || steps.restore.outputs.cache-hit }}
-
-runs:
-  using: composite
-  steps:
-    # Caches are restored on every event but saved on push only: scheduled
-    # and dispatched runs share the default branch with untrusted
-    # runtime-ref checkouts, so letting them save would allow cache
-    # poisoning. Push events require write access and stay trusted.
-    - name: Restore cache
-      id: restore
-      if: inputs.save != 'true' || github.event_name != 'push'
-      uses: actions/cache/restore@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        restore-keys: ${{ inputs.restore-keys }}
-    - name: Restore and save cache
-      id: cache
-      if: inputs.save == 'true' && github.event_name == 'push'
-      uses: actions/cache@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        restore-keys: ${{ inputs.restore-keys }}

package/.github/actions/codeql/action.yml

@@ -1,33 +0,0 @@
-name: CodeQL Analyze
-description: Initialize and analyze one CodeQL language using the repository baseline.
-
-inputs:
-  language:
-    description: CodeQL language identifier.
-    required: true
-  build-mode:
-    description: CodeQL build mode.
-    required: false
-    default: none
-  category:
-    description: CodeQL analysis category.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Initialize
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ inputs.language }}
-        build-mode: ${{ inputs.build-mode }}
-    - name: Analyze
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: ${{ inputs.category }}
-        # Pin pull-request uploads to the contributor's head SHA/ref so a
-        # moving merge ref cannot race the required code-scanning context.
-        ref: ${{ github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }}
-        sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        upload-database: false
-        wait-for-processing: false