forge-workflow 0.1.0-beta.7 → 0.1.0-beta.8

package/lib/github-context.js

@@ -1,12 +1,16 @@
 'use strict';
 
 const { execFileSync } = require('node:child_process');
+const { isManagedCredentialHelperValue, isOwnedCredentialHelperValue, isUsableCredentialHelperValue } = require('./github-router');
+const { resolveRealGh } = require('./native-gh');
 
 const ACCOUNT_KEY = 'github.account';
+const AUTO_KEY = 'github.auto';
+const CREDENTIAL_HELPER_KEY = 'credential.https://github.com.helper';
 const HOST = 'github.com';
 const LOGIN_RE = /^(?=.{1,39}$)[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
-const GITHUB_ENV_NAMES = new Set(['gh_token', 'github_token', 'gh_host', 'gh_repo']);
-const GITHUB_SECRET_ENV_NAMES = new Set(['gh_token', 'github_token']);
+const GITHUB_ENV_NAMES = new Set(['gh_token', 'github_token', 'gh_enterprise_token', 'github_enterprise_token', 'gh_host', 'gh_repo']);
+const GITHUB_SECRET_ENV_NAMES = new Set(['gh_token', 'github_token', 'gh_enterprise_token', 'github_enterprise_token']);
 
 class GithubContextError extends Error {
   constructor(code, message) {
@@ -29,16 +33,17 @@ function safeLogin(login) {
 }
 
 function runnerFor(options) {
-  return options.runner || options._runner || options._exec || options.execFileSync || defaultRunner;
-}
-
-function defaultRunner(command, args, options = {}) {
-  return execFileSync(command, args, {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    windowsHide: true,
-    ...options,
-  });
+  const injected = options.runner || options._runner || options._exec;
+  if (injected) return injected;
+  const execute = options.execFileSync || execFileSync;
+  const resolve = options.resolveRealGh || resolveRealGh;
+  return (command, args, runOptions = {}) => {
+    const executable = command === 'gh' ? resolve({ env: runOptions.env }) : command;
+    if (!executable) throw Object.assign(new Error('GitHub CLI was not found.'), { code: 'ENOENT' });
+    return execute(executable, args, {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, ...runOptions,
+    });
+  };
 }
 
 function errorText(error) {
@@ -86,35 +91,50 @@ function gitConfig(projectRoot, args, options, absentIsOkay = false) {
       windowsHide: true,
     });
   } catch (error) {
-    if (absentIsOkay && (error?.status === 1 || /key does not contain|not found|no such key/i.test(errorText(error)))) {
-      return '';
+    if (absentIsOkay && (error?.status === 1 || /key does not contain|not found|no such key|not a git repository|--local can only be used/i.test(errorText(error)))) {
+      return null;
     }
     throw safeCommandFailure('GIT_CONFIG_FAILED', 'Unable to read this clone-local GitHub account binding.');
   }
 }
 
-function readGithubAccount(projectRoot, options = {}) {
-  const output = gitConfig(projectRoot, ['--get', ACCOUNT_KEY], options, true);
-  const value = output == null ? '' : output.toString().trim();
-  return value || null;
+function readLocalValues(projectRoot, key, options = {}) {
+  const output = gitConfig(projectRoot, ['--get-all', key], options, true);
+  if (output == null) return [];
+  return output.toString().replace(/\r?\n$/, '').split(/\r?\n/);
 }
 
-function writeGithubAccount(projectRoot, login, options = {}) {
-  if (!validateGithubLogin(login)) {
-    throw safeCommandFailure('INVALID_GITHUB_LOGIN', 'GitHub login must be 1-39 letters, numbers, or internal hyphens.');
-  }
+function runGitConfig(projectRoot, args, options, message) {
   try {
-    runnerFor(options)('git', ['config', '--local', '--replace-all', ACCOUNT_KEY, login], {
+    return runnerFor(options)('git', ['config', '--local', ...args], {
       cwd: projectRoot,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true,
     });
-  } catch (_error) {
-    throw safeCommandFailure('GIT_CONFIG_FAILED', 'Unable to write the clone-local GitHub account binding.');
+  } catch {
+    throw safeCommandFailure('GIT_CONFIG_FAILED', message);
   }
 }
 
+function readGithubAccount(projectRoot, options = {}) {
+  const values = readLocalValues(projectRoot, ACCOUNT_KEY, options);
+  if (values.length === 0) return null;
+  if (values.length !== 1) {
+    throw safeCommandFailure('INVALID_GITHUB_LOGIN', 'The clone-local github.account value must be unique.');
+  }
+  const value = values[0].trim();
+  return value || null;
+}
+
+function writeGithubAccount(projectRoot, login, options = {}) {
+  if (!validateGithubLogin(login)) {
+    throw safeCommandFailure('INVALID_GITHUB_LOGIN', 'GitHub login must be 1-39 letters, numbers, or internal hyphens.');
+  }
+  runGitConfig(projectRoot, ['--replace-all', ACCOUNT_KEY, login], options,
+    'Unable to write the clone-local GitHub account binding.');
+}
+
 function unsetGithubAccount(projectRoot, options = {}) {
   try {
     runnerFor(options)('git', ['config', '--local', '--unset-all', ACCOUNT_KEY], {
@@ -129,6 +149,91 @@ function unsetGithubAccount(projectRoot, options = {}) {
   }
 }
 
+function readGithubAuto(projectRoot, options = {}) {
+  const values = readLocalValues(projectRoot, AUTO_KEY, options);
+  if (values.length === 0) return false;
+  if (values.length !== 1) return null;
+  const value = values[0].toLowerCase();
+  if (value === 'true') return true;
+  if (value === 'false') return false;
+  return null;
+}
+
+function ownsCredentialHelper(value, options) {
+  return (options.isOwnedCredentialHelper || isOwnedCredentialHelperValue)(value);
+}
+
+function hasGithubAutoCredentialHelper(projectRoot, options = {}) {
+  const helpers = readLocalValues(projectRoot, CREDENTIAL_HELPER_KEY, options);
+  return helpers.length === 2 && helpers[0] === ''
+    && (options.isOwnedCredentialHelper || isUsableCredentialHelperValue)(helpers[1], options);
+}
+
+function isForgeCredentialHelper(value, options) {
+  return ownsCredentialHelper(value, options)
+    || (options.isManagedCredentialHelper || isManagedCredentialHelperValue)(value, options);
+}
+
+function restoreLocalValues(projectRoot, snapshots, options) {
+  for (const [key, values] of snapshots) {
+    try {
+      unsetLocalKey(projectRoot, key, options);
+      for (const value of values) runnerFor(options)('git', ['config', '--local', '--add', key, value], { cwd: projectRoot, stdio: 'ignore' });
+    } catch { /* best effort rollback */ }
+  }
+}
+
+function unsetLocalKey(projectRoot, key, options) {
+  try {
+    runnerFor(options)('git', ['config', '--local', '--unset-all', key], {
+      cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
+    });
+  } catch (error) {
+    if (error?.status === 5 || error?.status === 1 || /key does not contain|not found|no such key/i.test(errorText(error))) return;
+    throw error;
+  }
+}
+
+function assertGithubAutoAvailable(projectRoot, options = {}) {
+  const helpers = readLocalValues(projectRoot, CREDENTIAL_HELPER_KEY, options);
+  const replaceable = helpers.length === 2 && helpers[0] === ''
+    && isForgeCredentialHelper(helpers[1], options);
+  if (helpers.length && !replaceable) {
+    throw safeCommandFailure('GIT_CREDENTIAL_HELPER_CONFLICT', 'A clone-local GitHub credential helper is already configured.');
+  }
+}
+
+function enableGithubAuto(projectRoot, options = {}) {
+  assertGithubAutoAvailable(projectRoot, options);
+  const helperValue = options.credentialHelperValue;
+  if (!ownsCredentialHelper(helperValue || '', options)) {
+    throw safeCommandFailure('GIT_CONFIG_FAILED', 'Forge did not provide a valid credential helper command.');
+  }
+  const previousHelpers = readLocalValues(projectRoot, CREDENTIAL_HELPER_KEY, options);
+  const previousAuto = readLocalValues(projectRoot, AUTO_KEY, options);
+  try {
+    runGitConfig(projectRoot, ['--replace-all', CREDENTIAL_HELPER_KEY, ''], options, 'Unable to enable automatic GitHub routing.');
+    runGitConfig(projectRoot, ['--add', CREDENTIAL_HELPER_KEY, helperValue], options, 'Unable to enable automatic GitHub routing.');
+    runGitConfig(projectRoot, ['--replace-all', AUTO_KEY, 'true'], options, 'Unable to enable automatic GitHub routing.');
+  } catch (error) {
+    restoreLocalValues(projectRoot, [[CREDENTIAL_HELPER_KEY, previousHelpers], [AUTO_KEY, previousAuto]], options);
+    throw error;
+  }
+}
+
+function disableGithubAuto(projectRoot, options = {}) {
+  const helpers = readLocalValues(projectRoot, CREDENTIAL_HELPER_KEY, options);
+  const previousAuto = readLocalValues(projectRoot, AUTO_KEY, options);
+  const owned = helpers.length === 2 && helpers[0] === '' && isForgeCredentialHelper(helpers[1], options);
+  const keys = [AUTO_KEY, ...(owned ? [CREDENTIAL_HELPER_KEY] : [])];
+  try {
+    for (const key of keys) unsetLocalKey(projectRoot, key, options);
+  } catch {
+    restoreLocalValues(projectRoot, [[AUTO_KEY, previousAuto], [CREDENTIAL_HELPER_KEY, helpers]], options);
+    throw safeCommandFailure('GIT_CONFIG_FAILED', 'Unable to disable automatic GitHub routing.');
+  }
+}
+
 function withoutGithubEnvironment(environment) {
   const result = {};
   for (const [key, value] of Object.entries(environment || {})) {
@@ -177,6 +282,20 @@ function retrieveGithubToken(login, options) {
   return token;
 }
 
+function createGithubTokenContext(projectRoot, options = {}) {
+  const account = (options.readAccount || readGithubAccount)(projectRoot, options);
+  if (!validateGithubLogin(account)) {
+    throw safeCommandFailure('GITHUB_NOT_AUTHENTICATED', 'No selected GitHub account is available.');
+  }
+  const baseEnv = { ...(options.baseEnv || options.env || process.env) };
+  const token = retrieveGithubToken(account, { ...options, baseEnv });
+  return createPublicContext(publicStatus('selected', account, null), token, baseEnv, options);
+}
+
+function writeGithubCredential(projectRoot, write, options = {}) {
+  createGithubTokenContext(projectRoot, options).writeCredential(write);
+}
+
 function loginFromOutput(output) {
   const text = output == null ? '' : output.toString().trim();
   if (!text) return null;
@@ -270,9 +389,16 @@ function createPublicContext(status, token, baseEnv, options) {
       throw safeGithubCommandFailure(error);
     }
   };
+  const writeCredential = (write) => {
+    if (status.state === 'unbound' || typeof write !== 'function') {
+      throw safeCommandFailure('GITHUB_NOT_AUTHENTICATED', 'No selected GitHub account is available.');
+    }
+    write(`username=${status.account}\npassword=${token}\n\n`);
+  };
   Object.defineProperties(context, {
     runChild: { value: runChild, enumerable: false },
     runGh: { value: runGh, enumerable: false },
+    writeCredential: { value: writeCredential, enumerable: false },
     getStatus: { value: () => ({ ...status }), enumerable: false },
   });
   return context;
@@ -296,12 +422,21 @@ function createGithubContext(projectRoot, options = {}) {
 
 module.exports = {
   ACCOUNT_KEY,
+  AUTO_KEY,
+  CREDENTIAL_HELPER_KEY,
   GithubContextError,
+  assertGithubAutoAvailable,
   createGithubContext,
+  createGithubTokenContext,
+  disableGithubAuto,
+  enableGithubAuto,
+  hasGithubAutoCredentialHelper,
   prepareGithubAccount,
   prepareGithubContext: createGithubContext,
   readGithubAccount,
+  readGithubAuto,
   resolveGithubLogin,
+  writeGithubCredential,
   unsetGithubAccount,
   validateGithubLogin,
   writeGithubAccount,

package/lib/github-credential.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const { readGithubAuto, writeGithubCredential } = require('./github-context');
+const { assertGithubRouterCloneRegistered } = require('./github-router');
+
+function parseRequest(input) {
+  if (typeof input !== 'string' || input.length > 64 * 1024) return null;
+  const request = Object.create(null);
+  for (const line of input.split(/\r?\n/)) {
+    if (!line) break;
+    const separator = line.indexOf('=');
+    if (separator < 1) return null;
+    request[line.slice(0, separator)] = line.slice(separator + 1);
+  }
+  return request;
+}
+
+function runCredentialHelper(operation, options = {}) {
+  if (!['get', 'store', 'erase'].includes(operation)) return 1;
+  if (operation !== 'get') return 0;
+  const request = parseRequest(options.input || '');
+  const host = request?.host?.toLowerCase();
+  if (request?.protocol !== 'https' || (host !== 'github.com' && host !== 'github.com:443')) return 0;
+  const projectRoot = options.projectRoot || process.cwd();
+  const write = options.write || (value => process.stdout.write(value));
+  const writeError = options.writeError || (value => process.stderr.write(value));
+  try {
+    const automatic = (options.readAuto || readGithubAuto)(projectRoot, options);
+    if (automatic === false) return 0;
+    if (automatic !== true) throw new Error('Automatic GitHub routing configuration is invalid.');
+    if (!options.createContext || options.assertRegistered) {
+      (options.assertRegistered || assertGithubRouterCloneRegistered)(projectRoot, options);
+    }
+    if (options.createContext) {
+      options.createContext(projectRoot, options).writeCredential(write);
+    } else {
+      writeGithubCredential(projectRoot, write, options);
+    }
+    return 0;
+  } catch {
+    write('quit=true\n\n');
+    writeError('Forge could not resolve this clone\'s GitHub account. Run forge github status.\n');
+    return 1;
+  }
+}
+
+module.exports = { parseRequest, runCredentialHelper };