coderifts 6.0.2 → 6.1.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 6.1.0
+
+### Added
+
+- **enforce --check now reads GitHub rulesets.** The evaluator existed with zero production call sites: a ruleset-governed repository reported required_check NOT_VERIFIED while its merges were gated. Rulesets are readable where classic protection is not (200 vs 401), so required_check can now reach VERIFIED on an unreadable classic response.
+
 ## 6.0.2
 
 ### Fixed

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "6.0.2",
+      version: "6.1.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -254196,7 +254196,9 @@ var require_github_enforcement = __commonJS({
     });
     function verifiedRequiresBinding(layer2) {
       if (!layer2 || layer2.status !== STATUS.VERIFIED) return true;
-      if (layer2.id === "required_check") return layer2.reason_code === REASON.ISSUER_BOUND;
+      if (layer2.id === "required_check") {
+        return layer2.reason_code === REASON.ISSUER_BOUND || layer2.reason_code === REASON.RULESET_ISSUER_BOUND;
+      }
       if (layer2.id === "workflow_contract_gate" || layer2.id === "workflow_deploy_gate") {
         return layer2.reason_code === REASON.ACTIVE_JOB;
       }
@@ -254648,15 +254650,48 @@ var require_github_enforcement = __commonJS({
       environmentRead,
       environmentName,
       local,
-      auth
+      auth,
+      rulesetsRead = null,
+      branch = null
     } = {}) {
       const layers = [];
       const localFiles = local || { contractGateFiles: [], deployGateFiles: [] };
+      const rulesetVerdict = evaluateRuleset(rulesetsRead, branch);
+      const rulesetUpgrade = (classicLayerFields) => {
+        if (rulesetVerdict.status !== STATUS.VERIFIED) return null;
+        return {
+          status: STATUS.VERIFIED,
+          reason: `${rulesetVerdict.reason} Classic branch protection did not establish this: ${classicLayerFields.reason}`,
+          reason_code: rulesetVerdict.reason_code,
+          endpoint: "GET /repos/{owner}/{repo}/rulesets",
+          app_id: rulesetVerdict.app_id,
+          ruleset_names: rulesetVerdict.ruleset_names,
+          surfaces_inspected: ["classic_branch_protection", "rulesets"]
+        };
+      };
+      const pushRequiredCheck = (classicFields) => {
+        const up = rulesetUpgrade(classicFields);
+        layers.push(layer("required_check", up ? up.status : classicFields.status, {
+          ...up || classicFields,
+          ruleset_status: rulesetVerdict.status,
+          ruleset_reason_code: rulesetVerdict.reason_code,
+          surfaces_inspected: [
+            "classic_branch_protection",
+            rulesetsRead == null ? "rulesets:unread" : "rulesets"
+          ]
+        }));
+      };
       const noAuth = !auth || auth.source === "none" || !auth.ok;
       const prot = protectionRead || null;
       if (noAuth && !prot) {
         const why = auth && auth.reason || NO_TOKEN_INSTRUCTION;
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({
+          status: STATUS.UNVERIFIABLE,
+          reason: why,
+          endpoint: null,
+          missing_scope: APP_INSTALLATION.missing_scope
+        });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, {
             reason: why,
             endpoint: null,
@@ -254665,13 +254700,21 @@ var require_github_enforcement = __commonJS({
         }
       } else if (!prot) {
         const why = "branch protection was not queried";
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({ status: STATUS.UNVERIFIABLE, reason: why, endpoint: null });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, { reason: why, endpoint: null }));
         }
       } else if (prot.status === 403) {
         const why = "GitHub HTTP 403 \u2014 missing scope administration:read (branch protection). Grant Administration: Read on the token, or use a repo-admin token.";
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({
+          status: STATUS.UNVERIFIABLE,
+          reason: why,
+          endpoint,
+          missing_scope: "administration:read",
+          http_status: 403
+        });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, {
             reason: why,
             endpoint,
@@ -254681,11 +254724,12 @@ var require_github_enforcement = __commonJS({
         }
       } else if (prot.status === 404) {
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
-        layers.push(layer("required_check", STATUS.NOT_VERIFIED, {
+        pushRequiredCheck({
+          status: STATUS.NOT_VERIFIED,
           reason: `classic branch protection is absent \u2014 required check "${CHECK_NAME}" is not required`,
           endpoint,
           http_status: 404
-        }));
+        });
         layers.push(layer("enforce_admins", STATUS.NOT_VERIFIED, {
           reason: "classic branch protection is absent \u2014 administrators are unrestricted",
           endpoint,
@@ -254699,7 +254743,13 @@ var require_github_enforcement = __commonJS({
       } else if (prot.status >= 400 || prot.status === 0) {
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
         const why = `GitHub HTTP ${prot.status || 0} reading branch protection \u2014 cannot verify`;
-        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+        pushRequiredCheck({
+          status: STATUS.UNVERIFIABLE,
+          reason: redactSecrets(why),
+          endpoint,
+          http_status: prot.status
+        });
+        for (const id of ["enforce_admins", "strict_status_checks"]) {
           layers.push(layer(id, STATUS.UNVERIFIABLE, {
             reason: redactSecrets(why),
             endpoint,
@@ -254710,14 +254760,15 @@ var require_github_enforcement = __commonJS({
         const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
         const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
         const required = evaluateRequiredCheck(protection);
-        layers.push(layer("required_check", required.status, {
+        pushRequiredCheck({
+          status: required.status,
           reason: required.reason,
           reason_code: required.reason_code,
           endpoint,
           required_contexts: required.required_contexts,
           app_id: required.app_id,
           ...required.expected_app_id != null ? { expected_app_id: required.expected_app_id } : {}
-        }));
+        });
         const admins = enforceAdminsEnabled(protection);
         layers.push(layer("enforce_admins", admins ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
           reason: admins ? "enforce_admins.enabled is true \u2014 administrators cannot bypass required checks" : "enforce_admins.enabled is false \u2014 repository administrators can bypass required checks",
@@ -254885,11 +254936,27 @@ var require_github_enforcement = __commonJS({
       const protPath = resolvedBranch ? `repos/${owner}/${repo}/branches/${encodeURIComponent(resolvedBranch)}/protection` : protectionPath;
       const protectionRead = client && protPath ? await client.get(protPath) : null;
       const environmentRead = client && envPath ? await client.get(envPath) : null;
+      let rulesetsRead = null;
+      if (client) {
+        const list = await client.get(`repos/${owner}/${repo}/rulesets`);
+        if (list && list.status === 200 && Array.isArray(list.body)) {
+          const detailed = [];
+          let anyDetailFailed = false;
+          for (const rs of list.body) {
+            if (!rs || rs.id == null) continue;
+            const one = await client.get(`repos/${owner}/${repo}/rulesets/${rs.id}`);
+            if (one && one.status === 200 && one.body) detailed.push(one.body);
+            else anyDetailFailed = true;
+          }
+          rulesetsRead = anyDetailFailed ? null : detailed;
+        }
+      }
       return {
         branch: resolvedBranch,
         repoRead,
         protectionRead,
-        environmentRead
+        environmentRead,
+        rulesetsRead
       };
     }
     module2.exports = {
@@ -255853,6 +255920,7 @@ var require_enforce_check = __commonJS({
       let branch = options.branch ? String(options.branch).trim() : null;
       let protectionRead = null;
       let environmentRead = null;
+      let rulesetsRead = null;
       if (auth.ok) {
         const client = deps.githubClient || createGitHubHttpClient({
           token: auth.token,
@@ -255868,13 +255936,18 @@ var require_enforce_check = __commonJS({
         branch = queried.branch || branch;
         protectionRead = queried.protectionRead;
         environmentRead = queried.environmentRead;
+        rulesetsRead = queried.rulesetsRead;
       }
       const evaluated = evaluateLayers({
         protectionRead,
         environmentRead,
         environmentName,
         local,
-        auth
+        auth,
+        // roadmap 1052a — the ruleset surface, which reads without a credential and can establish
+        // required_check where classic branch protection is unreadable.
+        rulesetsRead,
+        branch
       });
       const report = {
         command: "enforce --check",
@@ -255894,7 +255967,9 @@ var require_enforce_check = __commonJS({
         // response or to our grading of it.
         responses: {
           protection: responseDigest(protectionRead),
-          environment: responseDigest(environmentRead)
+          environment: responseDigest(environmentRead),
+          // null here means NOT READ, which is different from an empty ruleset list.
+          rulesets: rulesetsRead == null ? null : { count: rulesetsRead.length }
         },
         ...evaluated
       };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "6.0.2",
+  "version": "6.1.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",