create-interview-cockpit 0.26.1 → 0.28.0

package/template/client/src/githubActionsLab.ts

@@ -1,5 +1,80 @@
-import type { GithubActionsLabWorkspace } from "./types";
-import type { GithubActionsLabEnvironment } from "./types";
+import type {
+  GithubActionsLabWorkspace,
+  GithubActionsLabEnvironment,
+  GithubLabOrg,
+  GithubLabBranchProtection,
+  GithubLabPullRequest,
+  GithubLabReview,
+  GithubLabCheckRun,
+  GithubLabCheckRunJob,
+  GithubLabRuleset,
+  GithubLabRulesetEnforcement,
+  GithubLabRulesetRules,
+} from "./types";
+import { rulesetFromLegacyProtection } from "./codeowners";
+
+// ─── Default GitHub Lab "org" roster ────────────────────────────────────
+//
+// The lab simulates an org called `acme` so CODEOWNERS handles like
+// `@acme/frontend` resolve to real people for the PR sim. Users can edit
+// this in the Pull Request tab.
+export const DEFAULT_GH_LAB_ORG: GithubLabOrg = {
+  slug: "acme",
+  viewerLogin: "octocat",
+  users: ["octocat", "alice", "bob", "carol"],
+  teams: [
+    {
+      slug: "frontend",
+      name: "Frontend",
+      members: ["alice"],
+    },
+    {
+      slug: "platform",
+      name: "Platform / Infra",
+      members: ["bob"],
+    },
+    {
+      slug: "docs",
+      name: "Docs",
+      members: ["carol"],
+    },
+  ],
+};
+
+export const DEFAULT_GH_LAB_BRANCH_PROTECTION: GithubLabBranchProtection = {
+  requireCodeOwnerReview: true,
+  requiredApprovingReviews: 1,
+  requiredStatusChecks: [],
+};
+
+// Default ruleset — mirrors the most common GitHub repo template:
+// "protect the default branch with a PR + review + green CI before merge".
+export const DEFAULT_GH_LAB_RULESETS: GithubLabRuleset[] = [
+  {
+    id: "default-branch-protection",
+    name: "Default branch protection",
+    enforcement: "active",
+    targetInclude: ["~DEFAULT_BRANCH"],
+    targetExclude: [],
+    bypass: [],
+    rules: {
+      pullRequest: {
+        requiredApprovingReviewCount: 1,
+        requireCodeOwnerReview: true,
+        dismissStaleReviewsOnPush: false,
+        requireLastPushApproval: false,
+      },
+      blockForcePushes: true,
+      restrictDeletions: true,
+    },
+  },
+];
+
+export const DEFAULT_GH_LAB_PULL_REQUEST: GithubLabPullRequest = {
+  changedFiles: [],
+  reviews: [],
+  title: "Draft pull request",
+};
 
 // ─── Default Lab Template ────────────────────────────────────────────────
 //
@@ -162,6 +237,38 @@ require("fs").readdirSync(".").forEach((f) => console.log("  -", f));
 # Pinning the runner image keeps installs reproducible across machines.
 -P ubuntu-latest=catthehacker/ubuntu:act-latest
 --container-architecture linux/amd64
+`,
+
+  // The CODEOWNERS file lives in .github/ (one of the three locations
+  // GitHub looks at). Open the "Pull Request" tab to see who gets
+  // auto-requested when these patterns match files in your PR.
+  ".github/CODEOWNERS": `# CODEOWNERS — auto-request reviewers when files match a pattern.
+#
+# Syntax: <pattern>   <@user> | <@org/team> | <email>
+# Rules are evaluated top-to-bottom, and the LAST matching rule wins.
+# A line with no owners explicitly clears ownership for that path.
+#
+# This lab ships with a fake "acme" org you can edit in the Pull Request
+# tab. The default users are:
+#   - octocat       (you, the PR author — cannot self-approve)
+#   - alice         (frontend lead)
+#   - bob           (platform/infra)
+#   - carol         (docs writer)
+# Teams: @acme/frontend, @acme/platform, @acme/docs
+
+# Default owner for everything not matched by a more specific rule.
+*                               @octocat
+
+# Frontend code is owned by the frontend team.
+/scripts/                       @acme/frontend
+*.js                            @acme/frontend
+
+# CI / actions config is owned by the platform team.
+/.github/                       @acme/platform
+/.github/workflows/             @acme/platform @bob
+
+# Docs are reviewed by the docs writer.
+*.md                            @acme/docs @carol
 `,
 };
 
@@ -384,11 +491,14 @@ li {
 
 export const DEFAULT_GHA_LAB: GithubActionsLabWorkspace = {
   version: 1,
-  label: "GitHub Actions Playground",
+  label: "GitHub Lab Playground",
   activeFile: ".github/workflows/ci.yml",
   defaultEvent: "push",
   defaultWorkflow: ".github/workflows/ci.yml",
   files: DEFAULT_FILES,
+  ghOrg: DEFAULT_GH_LAB_ORG,
+  rulesets: DEFAULT_GH_LAB_RULESETS,
+  pullRequest: DEFAULT_GH_LAB_PULL_REQUEST,
 };
 
 export const REACT_VITE_TYPESCRIPT_GHA_LAB: GithubActionsLabWorkspace = {
@@ -452,6 +562,28 @@ export function cloneGhaLabWorkspace(
     ? source.activeFile
     : (Object.keys(sourceFiles)[0] ?? ".github/workflows/ci.yml");
   const environment = cloneGhaLabEnvironment(source.environment);
+  const ghOrg = cloneGhLabOrg(source.ghOrg);
+  const pullRequest = cloneGhLabPullRequest(source.pullRequest, sourceFiles);
+  // Branches default to ["main"]; we always keep the default branch in the
+  // list, and dedupe/sanitize any user-added names so a saved lab can't
+  // smuggle in empty strings or non-string junk.
+  const rawBranches = Array.isArray(source.branches)
+    ? source.branches.filter(
+        (b): b is string => typeof b === "string" && !!b.trim(),
+      )
+    : [];
+  const defaultBranch =
+    typeof source.defaultBranch === "string" && source.defaultBranch.trim()
+      ? source.defaultBranch.trim()
+      : "main";
+  const branches = Array.from(new Set([defaultBranch, ...rawBranches]));
+  // Migrate legacy branchProtection → a synthetic ruleset so saved labs
+  // from before the rulesets era keep their merge gating.
+  const rulesets = cloneGhLabRulesets(
+    source.rulesets,
+    source.branchProtection,
+    defaultBranch,
+  );
 
   return {
     version: 1,
@@ -471,6 +603,313 @@ export function cloneGhaLabWorkspace(
       ? { includeRunHistoryInContext: true }
       : {}),
     ...(environment ? { environment } : {}),
+    ...(ghOrg ? { ghOrg } : {}),
+    ...(pullRequest ? { pullRequest } : {}),
+    branches,
+    defaultBranch,
+    rulesets,
+  };
+}
+
+// ─── GitHub Lab roster / PR helpers ────────────────────────────────────
+
+function cloneGhLabOrg(org?: GithubLabOrg): GithubLabOrg | undefined {
+  if (!org || typeof org !== "object") return undefined;
+  const users = Array.isArray(org.users)
+    ? Array.from(
+        new Set(
+          org.users.filter(
+            (u): u is string => typeof u === "string" && !!u.trim(),
+          ),
+        ),
+      )
+    : [];
+  const teams = Array.isArray(org.teams)
+    ? org.teams
+        .filter((t) => t && typeof t.slug === "string" && t.slug.trim())
+        .map((t) => ({
+          slug: t.slug,
+          ...(typeof t.name === "string" && t.name ? { name: t.name } : {}),
+          members: Array.isArray(t.members)
+            ? Array.from(
+                new Set(
+                  t.members.filter(
+                    (m): m is string => typeof m === "string" && !!m.trim(),
+                  ),
+                ),
+              )
+            : [],
+        }))
+    : [];
+  return {
+    slug: typeof org.slug === "string" && org.slug.trim() ? org.slug : "acme",
+    viewerLogin:
+      typeof org.viewerLogin === "string" && org.viewerLogin.trim()
+        ? org.viewerLogin
+        : users[0] || "octocat",
+    users,
+    teams,
+  };
+}
+
+function cloneGhLabBranchProtection(
+  bp?: GithubLabBranchProtection,
+): GithubLabBranchProtection | undefined {
+  if (!bp || typeof bp !== "object") return undefined;
+  const requiredStatusChecks = Array.isArray(bp.requiredStatusChecks)
+    ? Array.from(
+        new Set(
+          bp.requiredStatusChecks.filter(
+            (n): n is string => typeof n === "string" && !!n.trim(),
+          ),
+        ),
+      )
+    : [];
+  return {
+    requireCodeOwnerReview: !!bp.requireCodeOwnerReview,
+    requiredApprovingReviews: Math.max(
+      0,
+      Math.floor(Number(bp.requiredApprovingReviews) || 0),
+    ),
+    ...(requiredStatusChecks.length ? { requiredStatusChecks } : {}),
+  };
+}
+
+// ─── Rulesets clone + migration ────────────────────────────────────────
+//
+// Saved labs may carry: (a) the modern `rulesets` array, (b) the legacy
+// `branchProtection` object, or (c) neither. We preserve user-authored
+// rulesets when present, otherwise synthesize one from branchProtection
+// (so labs from before the rulesets era keep their merge gating), and
+// fall back to the default ruleset otherwise.
+
+const RULESET_ENFORCEMENTS: ReadonlyArray<GithubLabRulesetEnforcement> = [
+  "active",
+  "evaluate",
+  "disabled",
+];
+
+function cloneStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return Array.from(
+    new Set(
+      value.filter((v): v is string => typeof v === "string" && !!v.trim()),
+    ),
+  );
+}
+
+function cloneGhLabRulesetRules(rules: unknown): GithubLabRulesetRules {
+  if (!rules || typeof rules !== "object") return {};
+  const r = rules as Partial<GithubLabRulesetRules>;
+  const out: GithubLabRulesetRules = {};
+  if (r.restrictCreations) out.restrictCreations = true;
+  if (r.restrictUpdates) out.restrictUpdates = true;
+  if (r.restrictDeletions) out.restrictDeletions = true;
+  if (r.requireLinearHistory) out.requireLinearHistory = true;
+  if (r.requireSignedCommits) out.requireSignedCommits = true;
+  if (r.blockForcePushes) out.blockForcePushes = true;
+  if (r.requireCodeQuality) out.requireCodeQuality = true;
+  if (r.pullRequest && typeof r.pullRequest === "object") {
+    out.pullRequest = {
+      requiredApprovingReviewCount: Math.max(
+        0,
+        Math.floor(Number(r.pullRequest.requiredApprovingReviewCount) || 0),
+      ),
+      requireCodeOwnerReview: !!r.pullRequest.requireCodeOwnerReview,
+      dismissStaleReviewsOnPush: !!r.pullRequest.dismissStaleReviewsOnPush,
+      requireLastPushApproval: !!r.pullRequest.requireLastPushApproval,
+    };
+  }
+  if (r.statusChecks && typeof r.statusChecks === "object") {
+    const checks = cloneStringArray(r.statusChecks.checks);
+    if (checks.length || r.statusChecks.strict) {
+      out.statusChecks = { checks, strict: !!r.statusChecks.strict };
+    }
+  }
+  if (r.requireDeployments && typeof r.requireDeployments === "object") {
+    const environments = cloneStringArray(r.requireDeployments.environments);
+    if (environments.length) {
+      out.requireDeployments = { environments };
+    }
+  }
+  if (r.requireCodeScanning && typeof r.requireCodeScanning === "object") {
+    out.requireCodeScanning = {
+      tools: cloneStringArray(r.requireCodeScanning.tools),
+    };
+  }
+  return out;
+}
+
+function cloneGhLabRuleset(input: unknown): GithubLabRuleset | undefined {
+  if (!input || typeof input !== "object") return undefined;
+  const obj = input as Partial<GithubLabRuleset>;
+  const targetInclude = cloneStringArray(obj.targetInclude);
+  if (targetInclude.length === 0) return undefined;
+  const enforcement = RULESET_ENFORCEMENTS.includes(
+    obj.enforcement as GithubLabRulesetEnforcement,
+  )
+    ? (obj.enforcement as GithubLabRulesetEnforcement)
+    : "active";
+  return {
+    id:
+      typeof obj.id === "string" && obj.id
+        ? obj.id
+        : `rs_${Math.random().toString(36).slice(2, 10)}`,
+    name:
+      typeof obj.name === "string" && obj.name.trim()
+        ? obj.name.trim()
+        : "Untitled ruleset",
+    enforcement,
+    targetInclude,
+    targetExclude: cloneStringArray(obj.targetExclude),
+    bypass: cloneStringArray(obj.bypass),
+    rules: cloneGhLabRulesetRules(obj.rules),
+  };
+}
+
+function cloneGhLabRulesets(
+  rulesets: unknown,
+  legacyProtection: GithubLabBranchProtection | undefined,
+  defaultBranch: string,
+): GithubLabRuleset[] {
+  if (Array.isArray(rulesets)) {
+    const cleaned = rulesets
+      .map(cloneGhLabRuleset)
+      .filter((r): r is GithubLabRuleset => !!r);
+    if (cleaned.length > 0) return cleaned;
+  }
+  // No rulesets persisted — try migrating classic branchProtection.
+  const migrated = rulesetFromLegacyProtection(legacyProtection, defaultBranch);
+  if (migrated) return [migrated];
+  // Brand-new lab with no protection at all → use the template ruleset.
+  return DEFAULT_GH_LAB_RULESETS.map((r) => ({
+    ...r,
+    targetInclude: [...r.targetInclude],
+    targetExclude: [...r.targetExclude],
+    bypass: [...r.bypass],
+    rules: cloneGhLabRulesetRules(r.rules),
+  }));
+}
+
+const REVIEW_STATES: ReadonlyArray<GithubLabReview["state"]> = [
+  "approved",
+  "changes_requested",
+  "commented",
+];
+
+function cloneGhLabReview(r: unknown): GithubLabReview | undefined {
+  if (!r || typeof r !== "object") return undefined;
+  const obj = r as Partial<GithubLabReview>;
+  if (typeof obj.author !== "string" || !obj.author.trim()) return undefined;
+  if (!REVIEW_STATES.includes(obj.state as GithubLabReview["state"])) {
+    return undefined;
+  }
+  return {
+    id:
+      typeof obj.id === "string" && obj.id
+        ? obj.id
+        : `rev_${Math.random().toString(36).slice(2, 10)}`,
+    author: obj.author,
+    state: obj.state as GithubLabReview["state"],
+    createdAt:
+      typeof obj.createdAt === "string" && obj.createdAt
+        ? obj.createdAt
+        : new Date().toISOString(),
+    ...(typeof obj.body === "string" && obj.body.trim()
+      ? { body: obj.body }
+      : {}),
+  };
+}
+
+const CHECK_STATUSES: ReadonlyArray<GithubLabCheckRunJob["status"]> = [
+  "queued",
+  "running",
+  "success",
+  "failed",
+  "cancelled",
+  "skipped",
+];
+
+function cloneGhLabCheckRun(
+  run: GithubLabCheckRun | undefined,
+): GithubLabCheckRun | undefined {
+  if (!run || typeof run !== "object") return undefined;
+  const jobs = Array.isArray(run.jobs)
+    ? run.jobs.flatMap((j) => {
+        if (!j || typeof j !== "object") return [];
+        const name = (j as Partial<GithubLabCheckRunJob>).name;
+        const status = (j as Partial<GithubLabCheckRunJob>).status;
+        if (typeof name !== "string" || !name.trim()) return [];
+        if (
+          !CHECK_STATUSES.includes(status as GithubLabCheckRunJob["status"])
+        ) {
+          return [];
+        }
+        const durationMs = (j as Partial<GithubLabCheckRunJob>).durationMs;
+        return [
+          {
+            name,
+            status: status as GithubLabCheckRunJob["status"],
+            ...(typeof durationMs === "number" && Number.isFinite(durationMs)
+              ? { durationMs }
+              : {}),
+          } satisfies GithubLabCheckRunJob,
+        ];
+      })
+    : [];
+  if (jobs.length === 0) return undefined;
+  return {
+    completedAt:
+      typeof run.completedAt === "string" && run.completedAt
+        ? run.completedAt
+        : new Date().toISOString(),
+    ...(typeof run.workflow === "string" && run.workflow
+      ? { workflow: run.workflow }
+      : {}),
+    jobs,
+  };
+}
+
+function cloneGhLabPullRequest(
+  pr: GithubLabPullRequest | undefined,
+  files: Record<string, string>,
+): GithubLabPullRequest | undefined {
+  if (!pr || typeof pr !== "object") return undefined;
+  const changedFiles = Array.isArray(pr.changedFiles)
+    ? Array.from(
+        new Set(
+          pr.changedFiles.filter(
+            (p): p is string =>
+              typeof p === "string" &&
+              Object.prototype.hasOwnProperty.call(files, p),
+          ),
+        ),
+      )
+    : [];
+  const reviews: GithubLabReview[] = Array.isArray(pr.reviews)
+    ? pr.reviews
+        .map((r) => cloneGhLabReview(r))
+        .filter((r): r is GithubLabReview => !!r)
+    : [];
+  // Back-compat: pre-reviews labs only stored `approvals: string[]`. Promote
+  // those into synthetic "approved" reviews so they keep blocking merge.
+  if (reviews.length === 0 && Array.isArray(pr.approvals)) {
+    for (const login of pr.approvals) {
+      if (typeof login !== "string" || !login.trim()) continue;
+      reviews.push({
+        id: `legacy_${login}`,
+        author: login,
+        state: "approved",
+        createdAt: new Date(0).toISOString(),
+      });
+    }
+  }
+  const lastCheckRun = cloneGhLabCheckRun(pr.lastCheckRun);
+  return {
+    changedFiles,
+    reviews,
+    ...(lastCheckRun ? { lastCheckRun } : {}),
+    ...(typeof pr.title === "string" && pr.title ? { title: pr.title } : {}),
   };
 }
 
@@ -558,6 +997,25 @@ export function parseGhaLabWorkspace(
       ...(parsed.environment && typeof parsed.environment === "object"
         ? { environment: parsed.environment as GithubActionsLabEnvironment }
         : {}),
+      ...(parsed.ghOrg && typeof parsed.ghOrg === "object"
+        ? { ghOrg: parsed.ghOrg as GithubLabOrg }
+        : {}),
+      ...(parsed.branchProtection && typeof parsed.branchProtection === "object"
+        ? {
+            branchProtection:
+              parsed.branchProtection as GithubLabBranchProtection,
+          }
+        : {}),
+      ...(Array.isArray(parsed.rulesets)
+        ? { rulesets: parsed.rulesets as GithubLabRuleset[] }
+        : {}),
+      ...(parsed.pullRequest && typeof parsed.pullRequest === "object"
+        ? { pullRequest: parsed.pullRequest as GithubLabPullRequest }
+        : {}),
+      ...(Array.isArray(parsed.branches) ? { branches: parsed.branches } : {}),
+      ...(typeof parsed.defaultBranch === "string"
+        ? { defaultBranch: parsed.defaultBranch }
+        : {}),
     });
   } catch {
     return null;