gcb-host 0.7.1 → 0.8.0

package/lib/providers/github-app.js

@@ -1,31 +1,33 @@
+import { createSign } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { getGhAction, ProviderConfigError, tokenFingerprint, } from 'gcb-core';
 /**
- * GitHub App provider: the broker mints a short-lived installation access token with
- * `node:crypto` only, so the host needs no `openssl`, no SDK and no runtime dependency.
+ * GitHub App provider: the broker mints a short-lived installation access token with `node:crypto`
+ * only, so the host needs no `openssl`, no SDK and no runtime dependency.
+ *
+ * Everything GitHub documents as a prerequisite for a successful mint is implemented explicitly,
+ * because each omission fails in a way that is painful to diagnose:
  *
- * Everything GitHub documents as a prerequisite for a successful mint is implemented
- * explicitly, because each omission fails in a way that is painful to diagnose:
- *  - `RS256` signature;
- *  - `iat` one minute in the past (clock drift);
- *  - `exp` at most ten minutes after `iat`;
- *  - `iss` set to the client ID when configured, otherwise the app ID;
- *  - the account's installation is resolved by matching `account.login` case-insensitively,
- *    which is what makes multiple owners work;
- *  - the token is scoped to exactly one repository by name (`repositories` takes the
- *    repository name, not `owner/name`) and to explicitly narrowed permissions;
- *  - a minted token is cached and reused until shortly before it expires, instead of being
- *    re-minted on every helper invocation.
+ * - `RS256` signature;
+ * - `iat` one minute in the past (clock drift);
+ * - `exp` at most ten minutes after `iat`;
+ * - `iss` set to the client ID when configured, otherwise the app ID;
+ * - The account's installation is resolved by matching `account.login` case-insensitively, which is
+ *   what makes multiple owners work;
+ * - The token is scoped to exactly one repository by name (`repositories` takes the repository name,
+ *   not `owner/name`) and to explicitly narrowed permissions;
+ * - A minted token is cached and reused until shortly before it expires, instead of being re-minted
+ *   on every helper invocation.
  *
- * Reference: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
+ * Reference:
+ * https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
  */
 import { userTokenPath } from '../config.js';
-import { repoAllowed } from '../policy.js';
-import { currentProxyKey, proxyFetch } from '../http.js';
-import { createSign } from 'node:crypto';
-import { getGhAction, ProviderConfigError, tokenFingerprint } from 'gcb-core';
-import { runGhAction } from '../gh.js';
-import { isPublicRepository as checkPublicRepository, withRepositoryResponse } from '../public-repo.js';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { refreshUserToken } from '../device-flow.js';
+import { runGhAction } from '../gh.js';
+import { currentProxyKey, proxyFetch } from '../http.js';
+import { repoAllowed } from '../policy.js';
+import { isPublicRepository as checkPublicRepository, withRepositoryResponse, } from '../public-repo.js';
 /** REST API origin. Overridable for GitHub Enterprise. */
 const DEFAULT_API = 'https://api.github.com';
 /** GitHub refuses a JWT whose `exp` is more than this many seconds after `iat`. */
@@ -35,8 +37,8 @@ const ACCESS_LEVELS = { read: 1, write: 2, admin: 3 };
 /**
  * Base64url-encode a string or buffer, without padding, as JWS requires.
  *
- * @param input - the value to encode.
- * @returns the base64url encoding.
+ * @param input - The value to encode.
+ * @returns The base64url encoding.
  */
 export function base64url(input) {
     return Buffer.from(input).toString('base64url');
@@ -44,14 +46,15 @@ export function base64url(input) {
 /**
  * Sign a GitHub App JWT.
  *
- * @param options - signing options.
- * @returns the compact JWS.
- * @throws {Error} when required inputs are missing or the lifetime exceeds GitHub's limit.
+ * @param options - Signing options.
+ * @returns The compact JWS.
+ * @throws {Error} When required inputs are missing or the lifetime exceeds GitHub's limit.
  */
 export function signAppJwt(options) {
-    const { privateKeyPem, iss, nowMs, lifetimeSeconds = MAX_JWT_LIFETIME_SECONDS, skewSeconds = 60 } = options;
-    if (!privateKeyPem)
+    const { privateKeyPem, iss, nowMs, lifetimeSeconds = MAX_JWT_LIFETIME_SECONDS, skewSeconds = 60, } = options;
+    if (!privateKeyPem) {
         throw new Error('signAppJwt: privateKeyPem is required');
+    }
     if (iss === undefined || iss === null || iss === '') {
         throw new Error('signAppJwt: iss (client ID or app ID) is required');
     }
@@ -72,26 +75,28 @@ export function signAppJwt(options) {
 /**
  * Extract the `rel="next"` URL from a `Link` header.
  *
- * @param linkHeader - the raw header value.
- * @returns the next page URL, or null when there is none.
+ * @param linkHeader - The raw header value.
+ * @returns The next page URL, or null when there is none.
  */
 export function nextLink(linkHeader) {
-    if (typeof linkHeader !== 'string')
+    if (typeof linkHeader !== 'string') {
         return null;
+    }
     for (const part of linkHeader.split(',')) {
         const match = /<([^>]+)>\s*;\s*rel="next"/.exec(part);
         const url = match?.[1];
-        if (url)
+        if (url) {
             return url;
+        }
     }
     return null;
 }
 /**
  * Build a GitHub App provider for one host.
  *
- * @param options - provider options.
- * @returns the provider.
- * @throws {Error} when the private key or app identity is missing (fail fast).
+ * @param options - Provider options.
+ * @returns The provider.
+ * @throws {Error} When the private key or app identity is missing (fail fast).
  */
 export function createGithubAppProvider(options) {
     const { host, cfg, skewSeconds = 300, fetchImpl = proxyFetch, now = () => Date.now(), ghPath, log = () => { }, } = options;
@@ -121,8 +126,8 @@ export function createGithubAppProvider(options) {
      *
      * Deliberately not the configured `permissions`, which describe the credential git needs. A token
      * minted for those should not also be able to read CI logs, so a log read gets its own token,
-     * narrowed to `actions: read`. Whether the agent may read logs at all is then a question about the
-     * app's grant, not about anything running in the container.
+     * narrowed to `actions: read`. Whether the agent may read logs at all is then a question about
+     * the app's grant, not about anything running in the container.
      */
     const LOG_PERMISSIONS = { actions: 'read' };
     /** How much of one log to return: enough to diagnose, bounded so one response stays sane. */
@@ -132,23 +137,33 @@ export function createGithubAppProvider(options) {
      * the branches it names. Not the configured `permissions`, for the same reason a log read is not:
      * a token minted for git should not also be able to open a pull request.
      */
-    const PULL_REQUEST_PERMISSIONS = { pull_requests: 'write', contents: 'read' };
+    const PULL_REQUEST_PERMISSIONS = {
+        pull_requests: 'write',
+        contents: 'read',
+    };
     /** The result of an action that never reached the executor. */
-    const NO_RUN = { stdout: '', stderr: '', code: null, signal: null, truncated: false, timedOut: false };
+    const NO_RUN = {
+        stdout: '',
+        stderr: '',
+        code: null,
+        signal: null,
+        truncated: false,
+        timedOut: false,
+    };
     const REVOKE_WARNING = 'the action token could not be revoked; it expires on its own';
-    /** owner login (lowercased) -> installation */
+    /** Owner login (lowercased) -> installation */
     const installations = new Map();
-    /** owner/repo -> minted credential */
+    /** Owner/repo -> minted credential */
     const tokens = new Map();
     /** Cached pre-flight result, per owner: installations differ, so the answer does too. */
     const permissionsChecked = new Map();
     /**
      * Name every configured permission a grant does not cover.
      *
-     * @param granted - the permission map to check against.
-     * @param from - how to refer to that map in the message.
-     * @param absent - how to describe a permission that is missing entirely.
-     * @returns one message per problem; empty when the grant covers the configuration.
+     * @param granted - The permission map to check against.
+     * @param from - How to refer to that map in the message.
+     * @param absent - How to describe a permission that is missing entirely.
+     * @returns One message per problem; empty when the grant covers the configuration.
      */
     function missingPermissions(wantedPermissions, granted, from, absent) {
         const problems = [];
@@ -168,10 +183,10 @@ export function createGithubAppProvider(options) {
      * Call the REST API with a freshly signed app JWT.
      *
      * @param method - HTTP method.
-     * @param url - absolute URL.
-     * @param body - optional JSON body.
-     * @returns the parsed body and the Link header.
-     * @throws {Error} for a non-2xx response.
+     * @param url - Absolute URL.
+     * @param body - Optional JSON body.
+     * @returns The parsed body and the Link header.
+     * @throws {Error} For a non-2xx response.
      */
     async function call(method, url, body) {
         const jwt = signAppJwt({ privateKeyPem: keyPem, iss, nowMs: now() });
@@ -181,8 +196,9 @@ export function createGithubAppProvider(options) {
             'x-github-api-version': apiVersion,
             'user-agent': 'gcb',
         };
-        if (body)
+        if (body) {
             headers['content-type'] = 'application/json';
+        }
         const response = await fetchImpl(url, {
             method,
             headers,
@@ -212,10 +228,10 @@ export function createGithubAppProvider(options) {
      * authorization — fetch drops the header across origins, which is what GitHub intends.
      *
      * @param method - HTTP method.
-     * @param url - absolute URL.
-     * @param token - the installation token to authenticate with.
-     * @returns the status and the body text.
-     * @throws {Error} for a non-2xx response.
+     * @param url - Absolute URL.
+     * @param token - The installation token to authenticate with.
+     * @returns The status and the body text.
+     * @throws {Error} For a non-2xx response.
      */
     async function callWithToken(method, url, token, body) {
         const headers = {
@@ -224,8 +240,9 @@ export function createGithubAppProvider(options) {
             'x-github-api-version': apiVersion,
             'user-agent': 'gcb',
         };
-        if (body)
+        if (body) {
             headers['content-type'] = 'application/json';
+        }
         const response = await fetchImpl(url, {
             method,
             headers,
@@ -240,8 +257,9 @@ export function createGithubAppProvider(options) {
             // cannot make it, because a caller that re-wraps this to name a permission wraps it in the same class.
             const detail = text.replace(/\s+/g, ' ').trim().slice(0, 400);
             const failure = new ProviderConfigError(`GitHub API ${method} ${url.replace(api, '')} answered ${response.status} for that request`);
-            if (detail !== '')
+            if (detail !== '') {
                 Object.assign(failure, { hostDetail: detail });
+            }
             throw failure;
         }
         return { status: response.status, text };
@@ -249,15 +267,16 @@ export function createGithubAppProvider(options) {
     /**
      * Resolve the installation id for an account, cached per owner.
      *
-     * @param owner - the repository owner as it appeared in the path.
-     * @returns the installation id.
-     * @throws {Error} when this app is not installed for that account.
+     * @param owner - The repository owner as it appeared in the path.
+     * @returns The installation id.
+     * @throws {Error} When this app is not installed for that account.
      */
     async function resolveInstallationId(owner) {
         const key = owner.toLowerCase();
         const cached = installations.get(key);
-        if (cached && cached.expiresAt > now())
+        if (cached && cached.expiresAt > now()) {
             return cached.id;
+        }
         let url = `${api}/app/installations?per_page=100`;
         for (let page = 0; page < 10 && url; page += 1) {
             const { json, link } = await call('GET', url);
@@ -265,7 +284,9 @@ export function createGithubAppProvider(options) {
                 for (const entry of json) {
                     const installation = entry;
                     const login = installation.account?.login;
-                    if (typeof login === 'string' && login.toLowerCase() === key && typeof installation.id === 'number') {
+                    if (typeof login === 'string' &&
+                        login.toLowerCase() === key &&
+                        typeof installation.id === 'number') {
                         installations.set(key, { id: installation.id, expiresAt: now() + installationTtlMs });
                         return installation.id;
                     }
@@ -278,30 +299,33 @@ export function createGithubAppProvider(options) {
     /**
      * Confirm both grants cover every permission the token request will ask for.
      *
-     * Two checks, because there are two ceilings. The app's permissions are what the app may ask for at
-     * all; the **installation's** are what it actually has, and a permission can be granted on the app
-     * while an installation has not approved the update. Checking only the app passes in that case and
-     * then fails at the token request, where the message is GitHub's and so cannot be handed to the
-     * container — which is how a permission problem became "see the broker log".
+     * Two checks, because there are two ceilings. The app's permissions are what the app may ask for
+     * at all; the **installation's** are what it actually has, and a permission can be granted on the
+     * app while an installation has not approved the update. Checking only the app passes in that
+     * case and then fails at the token request, where the message is GitHub's and so cannot be handed
+     * to the container — which is how a permission problem became "see the broker log".
      *
      * Cached per owner, since installations differ; a failed check is not cached, so fixing the
      * settings does not require restarting the broker.
      *
-     * @param owner - the account whose installation will be asked for a token.
-     * @returns resolves when the configured permissions are a subset of both grants.
-     * @throws {ProviderConfigError} naming each permission that is missing or granted at a lower level.
+     * @param owner - The account whose installation will be asked for a token.
+     * @returns Resolves when the configured permissions are a subset of both grants.
+     * @throws {ProviderConfigError} Naming each permission that is missing or granted at a lower
+     *   level.
      */
     function ensurePermissions(owner, wantedPermissions = permissions) {
-        if (!checkPermissions)
+        if (!checkPermissions) {
             return Promise.resolve();
+        }
         // Keyed by both, because a log read checks a different set than a credential does.
         const key = `${owner.toLowerCase()}|${currentProxyKey()}|${Object.entries(wantedPermissions)
             .sort(([left], [right]) => left.localeCompare(right))
             .map(([name, level]) => `${name}=${level}`)
             .join(',')}`;
         const cached = permissionsChecked.get(key);
-        if (cached)
+        if (cached) {
             return cached;
+        }
         const pending = (async () => {
             const { json } = await call('GET', `${api}/app`);
             const appGranted = json?.permissions ?? {};
@@ -330,10 +354,10 @@ export function createGithubAppProvider(options) {
      * review", which `mergeable_state: blocked` alone cannot. Both are repository-scoped, so the
      * allowlist binds them.
      *
-     * @param request - which pull request.
-     * @param token - the installation token.
-     * @param collection - the repository's pull request route.
-     * @returns the number, URL, state and a short report.
+     * @param request - Which pull request.
+     * @param token - The installation token.
+     * @param collection - The repository's pull request route.
+     * @returns The number, URL, state and a short report.
      */
     async function readPullRequestStatus(request, token, collection) {
         const { text } = await callWithToken('GET', `${collection}/${request.number}`, token);
@@ -397,11 +421,10 @@ export function createGithubAppProvider(options) {
      *
      * Only person-relevant actions may use it; GitHub will not author a pull request as a person for
      * an app, refuses to resolve a review thread for one, and a reply must be attributable to the
-     * person answering.
-     * The refresh token lives beside the private key, and GitHub rotates it on every use, so the new
-     * one is written back — keeping the old would work once and then stop.
+     * person answering. The refresh token lives beside the private key, and GitHub rotates it on
+     * every use, so the new one is written back — keeping the old would work once and then stop.
      *
-     * @returns the user token, or `undefined` when nobody has authorized one.
+     * @returns The user token, or `undefined` when nobody has authorized one.
      */
     async function personalToken() {
         while (renewingPersonToken !== undefined) {
@@ -418,32 +441,42 @@ export function createGithubAppProvider(options) {
             return await pending;
         }
         finally {
-            if (renewingPersonToken === pending)
+            if (renewingPersonToken === pending) {
                 renewingPersonToken = undefined;
+            }
         }
     }
     /** The authorized person's token, falling back to the per-owner token for this owner. */
     async function personTokenFor(owner) {
         const personal = await personalToken();
-        if (personal !== undefined)
+        if (personal !== undefined) {
             return personal;
+        }
         const file = cfg.userTokens?.[owner];
-        if (file === undefined)
+        if (file === undefined) {
             return undefined;
+        }
         const token = readFileSync(file, 'utf8').trim();
         return token === '' ? undefined : token;
     }
     async function renewPersonToken() {
-        if (cfg.clientId === undefined || cfg.privateKeyPath === undefined)
+        if (cfg.clientId === undefined || cfg.privateKeyPath === undefined) {
             return undefined;
+        }
         const path = userTokenPath(cfg.privateKeyPath);
-        if (!existsSync(path))
+        if (!existsSync(path)) {
             return undefined;
+        }
         const now = Date.now();
         // The file is the only thing that says who the broker may act as, so it is read before the cache is
         // trusted: running `authorize` again — the documented way to change that person, and the only one —
         // has to take effect now rather than when the cached token happens to expire.
         const held = readFileSync(path, 'utf8').trim();
+        if (held === '') {
+            // A pre-created mount file is a placeholder until `authorize` writes it; treat it as absent
+            // rather than trying to renew an empty refresh token.
+            return undefined;
+        }
         if (cachedPersonToken !== undefined &&
             cachedPersonToken.until > now + 60_000 &&
             cachedPersonToken.source === held) {
@@ -456,7 +489,7 @@ export function createGithubAppProvider(options) {
         catch (error) {
             // This is the one place a renewal failure is explained: the caller is an action that failed,
             // and "fetch failed" on its own names neither the host nor the reason.
-            throw new Error(`could not renew the authorized token from ${path}: ${error.message}${describeCause(error)}`);
+            throw new Error(`could not renew the authorized token from ${path}: ${error.message}${describeCause(error)}`, { cause: error });
         }
         if (next.refreshToken !== undefined) {
             try {
@@ -466,7 +499,7 @@ export function createGithubAppProvider(options) {
                 // GitHub invalidated the token on disk the moment it answered, so this is not transient and not
                 // recoverable: the next renewal reads a dead token. Nothing else in the log would say so.
                 throw new Error(`could not store the new refresh token in ${path}: ${error.message}; the previous ` +
-                    'one is no longer valid, so run authorize again');
+                    'one is no longer valid, so run authorize again', { cause: error });
             }
         }
         cachedPersonToken = {
@@ -479,11 +512,11 @@ export function createGithubAppProvider(options) {
     /**
      * One more sentence about a failure, when there is one worth having.
      *
-     * `fetch failed` is the whole message undici gives for a connection problem and it names nothing useful;
-     * the reason is on `cause`. This is for the host log, so it is allowed to carry detail.
+     * `fetch failed` is the whole message undici gives for a connection problem and it names nothing
+     * useful; the reason is on `cause`. This is for the host log, so it is allowed to carry detail.
      *
-     * @param error - whatever was thrown.
-     * @returns an empty string, or ` (the reason)`.
+     * @param error - Whatever was thrown.
+     * @returns An empty string, or ` (the reason)`.
      */
     function describeCause(error) {
         const cause = error?.cause?.message;
@@ -492,28 +525,30 @@ export function createGithubAppProvider(options) {
     /**
      * The pull request number in the URL GitHub returns for a pull request.
      *
-     * A review comment carries the pull request it belongs to as `pull_request_url`, which is how a comment
-     * id — one for the whole repository, not one per pull request — is tied back to the pull request named
-     * on the command line.
+     * A review comment carries the pull request it belongs to as `pull_request_url`, which is how a
+     * comment id — one for the whole repository, not one per pull request — is tied back to the pull
+     * request named on the command line.
      *
-     * @param value - an `.../pulls/{number}` URL, as GitHub returns it.
-     * @returns the number, or undefined when the value names none.
+     * @param value - An `.../pulls/{number}` URL, as GitHub returns it.
+     * @returns The number, or undefined when the value names none.
      */
     function pullRequestNumber(value) {
-        if (typeof value !== 'string')
+        if (typeof value !== 'string') {
             return undefined;
+        }
         const match = /\/pulls\/(\d+)\/?$/.exec(value);
-        if (match?.[1] === undefined)
+        if (match?.[1] === undefined) {
             return undefined;
+        }
         const number = Number(match[1]);
         return Number.isInteger(number) && number > 0 ? number : undefined;
     }
     /**
      * The installation ID GitHub reports for a specific repository.
      *
-     * @param owner - the repository owner.
-     * @param repo - the repository name.
-     * @returns the installation id, or undefined when the app is not installed there.
+     * @param owner - The repository owner.
+     * @param repo - The repository name.
+     * @returns The installation id, or undefined when the app is not installed there.
      */
     async function repositoryInstallation(owner, repo) {
         const jwt = signAppJwt({ privateKeyPem: keyPem, iss, nowMs: now() });
@@ -526,14 +561,17 @@ export function createGithubAppProvider(options) {
                 'user-agent': 'gcb',
             },
         });
-        if (response.status === 404)
+        if (response.status === 404) {
             return undefined;
+        }
         if (!response.ok) {
             const text = await response.text();
             throw new Error(`GitHub API GET /repos/${owner}/${repo}/installation failed with ${response.status}: ${text.slice(0, 200)}`);
         }
         const body = JSON.parse(await response.text());
-        return typeof body?.id === 'number' && Number.isInteger(body.id) && body.id > 0 ? body.id : undefined;
+        return typeof body?.id === 'number' && Number.isInteger(body.id) && body.id > 0
+            ? body.id
+            : undefined;
     }
     return {
         name: 'github-app',
@@ -550,8 +588,9 @@ export function createGithubAppProvider(options) {
                 if (cached?.id !== installationId) {
                     installations.set(key, { id: installationId, expiresAt: now() + installationTtlMs });
                     for (const permissionKey of permissionsChecked.keys()) {
-                        if (permissionKey.startsWith(`${key}|`))
+                        if (permissionKey.startsWith(`${key}|`)) {
                             permissionsChecked.delete(permissionKey);
+                        }
                     }
                 }
             }
@@ -579,8 +618,9 @@ export function createGithubAppProvider(options) {
                     minted = true;
                 }
                 catch (error) {
-                    if (error instanceof ProviderConfigError)
+                    if (error instanceof ProviderConfigError) {
                         throw error;
+                    }
                     throw new ProviderConfigError('the app needs an installation on this repository to read it with a metadata-only token');
                 }
             }
@@ -653,7 +693,11 @@ export function createGithubAppProvider(options) {
                     }
                 }
             }
-            return { ...result, tokenFingerprint: tokenFingerprint(token), ...(warning === undefined ? {} : { warning }) };
+            return {
+                ...result,
+                tokenFingerprint: tokenFingerprint(token),
+                ...(warning === undefined ? {} : { warning }),
+            };
         },
         async getCredential(request) {
             const cached = tokens.get(request.full);
@@ -682,8 +726,9 @@ export function createGithubAppProvider(options) {
         /** Check a public fork with no credential; only confirmed fork relationships pass. */
         async isForkOf(owner, repo, bases) {
             return withRepositoryResponse(fetchImpl, api, `${owner}/${repo}`, { apiVersion, label: 'fork' }, async (response) => {
-                if (!response.ok)
+                if (!response.ok) {
                     return false;
+                }
                 const text = await response.text();
                 let body;
                 try {
@@ -692,11 +737,13 @@ export function createGithubAppProvider(options) {
                 catch {
                     return false;
                 }
-                if (body?.fork !== true)
+                if (body?.fork !== true) {
                     return false;
+                }
                 for (const candidate of [body.parent?.full_name, body.source?.full_name]) {
-                    if (typeof candidate === 'string' && repoAllowed(bases, candidate))
+                    if (typeof candidate === 'string' && repoAllowed(bases, candidate)) {
                         return true;
+                    }
                 }
                 return false;
             });
@@ -713,8 +760,8 @@ export function createGithubAppProvider(options) {
          * repository could name any job this app can see — and it is the one that answers "Must have
          * admin rights", which is a permission this broker should never want.
          *
-         * @param request - the job to read.
-         * @returns the log text, bounded.
+         * @param request - The job to read.
+         * @returns The log text, bounded.
          */
         async getJobLog(request) {
             await ensurePermissions(request.owner, LOG_PERMISSIONS);
@@ -738,8 +785,9 @@ export function createGithubAppProvider(options) {
                 // while a job is still running.
                 throw new ProviderConfigError(`${error.message}; the job has to exist in that repository, and a run that is still in progress has no log yet`);
             }
-            if (text.length <= LOG_LIMIT_CHARS)
+            if (text.length <= LOG_LIMIT_CHARS) {
                 return { text, truncated: false };
+            }
             return {
                 text: `${text.slice(0, LOG_LIMIT_CHARS)}\n… log truncated at ${LOG_LIMIT_CHARS} characters\n`,
                 truncated: true,
@@ -751,8 +799,8 @@ export function createGithubAppProvider(options) {
          * The same shape as a log read: its own token, narrowed to what the operation needs, and the
          * repository-scoped route, so the allowlist binds it by construction.
          *
-         * @param request - the branches and the text.
-         * @returns the number and the URL GitHub answered with.
+         * @param request - The branches and the text.
+         * @returns The number and the URL GitHub answered with.
          */
         async pullRequest(request) {
             if (request.action === 'fork') {
@@ -791,7 +839,9 @@ export function createGithubAppProvider(options) {
             // `--status` also reads /actions/runs, which is checked against actions: read. Pre-flighting
             // pull_requests alone passed a grant that could not make that call, which is the opposite of what a
             // pre-flight is for.
-            const wanted = request.action === 'status' ? { ...PULL_REQUEST_PERMISSIONS, actions: 'read' } : PULL_REQUEST_PERMISSIONS;
+            const wanted = request.action === 'status'
+                ? { ...PULL_REQUEST_PERMISSIONS, actions: 'read' }
+                : PULL_REQUEST_PERMISSIONS;
             // One variable, so every branch below holds a token without having to ask which kind it is.
             let token;
             if (actingToken === undefined) {
@@ -832,7 +882,9 @@ export function createGithubAppProvider(options) {
                     belongsTo.toLowerCase() !== `${request.owner}/${request.repo}`.toLowerCase()) {
                     // A plain Error on purpose: this is the host log's business, not the container's.
                     throw new Error(`refusing to resolve ${request.threadId}: it is not a review thread of ${request.owner}/${request.repo}` +
-                        (typeof belongsTo === 'string' ? ` (it belongs to ${belongsTo})` : ' (or it could not be read)'));
+                        (typeof belongsTo === 'string'
+                            ? ` (it belongs to ${belongsTo})`
+                            : ' (or it could not be read)'));
                 }
                 const { text: raw } = await callWithToken('POST', `${api}/graphql`, token, {
                     query: 'mutation($threadId:ID!){resolveReviewThread(input:{threadId:$threadId}){thread{isResolved}}}',
@@ -856,7 +908,9 @@ export function createGithubAppProvider(options) {
                 return {
                     number: request.number ?? 0,
                     url: '',
-                    status: state.data?.resolveReviewThread?.thread?.isResolved === true ? 'resolved' : 'still open',
+                    status: state.data?.resolveReviewThread?.thread?.isResolved === true
+                        ? 'resolved'
+                        : 'still open',
                 };
             }
             if (request.action === 'reply') {
@@ -871,7 +925,9 @@ export function createGithubAppProvider(options) {
                 // none: the number to report is the one the comment itself names, read back from the answer
                 // rather than echoed from the request. The repository in the path is what the allowlist binds.
                 const endpoint = `${api}/repos/${request.owner}/${request.repo}/pulls/comments/${String(request.commentId ?? 0)}`;
-                const { text: edited } = await callWithToken('PATCH', endpoint, token, { body: request.body ?? '' });
+                const { text: edited } = await callWithToken('PATCH', endpoint, token, {
+                    body: request.body ?? '',
+                });
                 let changed = null;
                 try {
                     changed = JSON.parse(edited);
@@ -916,7 +972,9 @@ export function createGithubAppProvider(options) {
                 if (!Array.isArray(threads.nodes)) {
                     throw new Error('GitHub did not answer with reviewThreads.nodes');
                 }
-                if (typeof threads.totalCount !== 'number' || !Number.isInteger(threads.totalCount) || threads.totalCount < 0) {
+                if (typeof threads.totalCount !== 'number' ||
+                    !Number.isInteger(threads.totalCount) ||
+                    threads.totalCount < 0) {
                     throw new Error('GitHub did not answer with reviewThreads.totalCount');
                 }
                 if (threads.totalCount > 0 && threads.nodes.length === 0) {
@@ -955,18 +1013,21 @@ export function createGithubAppProvider(options) {
                                 inFence = !inFence;
                                 continue;
                             }
-                            if (inFence)
+                            if (inFence) {
                                 continue;
-                            if (/^(🏁|🔎|⚙️|🌐|💡|💬|🔗|Repository:|Length of output:|Proposed fix$|---$|_?\s*[🔒📐🎯🩺🟡🟠])/u.test(line))
+                            }
+                            if (/^(🏁|🔎|⚙️|🌐|💡|💬|🔗|Repository:|Length of output:|Proposed fix$|---$|_?\s*[🔒📐🎯🩺🟡🟠])/u.test(line)) {
                                 continue;
+                            }
                             kept.push(line.replace(/<\/?[a-z][^>]*>/gi, '').trim());
                         }
-                        const visible = kept.filter((line) => line !== '');
+                        const visible = kept.filter(line => line !== '');
                         const shown = visible.slice(0, 14);
                         const more = visible.length > shown.length ? ` (+${visible.length - shown.length} more lines)` : '';
                         report.push(`    ${String(comment.databaseId ?? '')} @${String(comment.author?.login ?? '?')}:${more}`);
-                        for (const line of shown)
+                        for (const line of shown) {
                             report.push(`      ${line.slice(0, 300)}`);
+                        }
                     }
                 }
                 // A page is not the whole list. Saying which it is is the difference between a report and a guess.
@@ -1023,7 +1084,13 @@ export function createGithubAppProvider(options) {
             let text;
             const method = 'POST';
             const url = collection;
-            const body = { title: request.title, body: request.body, head: request.head, base: request.base, draft: request.draft === true };
+            const body = {
+                title: request.title,
+                body: request.body,
+                head: request.head,
+                base: request.base,
+                draft: request.draft === true,
+            };
             try {
                 // as theirs, which is what automated reviewers recognise. The token itself is as wide as that person —
                 // it carries the app permissions and could push and merge — and what is narrow is this code: it is
@@ -1032,6 +1099,7 @@ export function createGithubAppProvider(options) {
                 // installation token is refused for. A token per owner is the older, narrower way and is still
                 // used when there is one; the authorized token answers for every owner at once.
                 // Resolved above, where it also decided whether the app had to be asked at all.
+                ;
                 ({ text } = await callWithToken(method, url, actingToken ?? token, body));
             }
             catch (error) {
@@ -1039,8 +1107,9 @@ export function createGithubAppProvider(options) {
                 // the failure carried any, is carried across rather than put in the message the pusher sees.
                 const wrapped = new ProviderConfigError(`${error.message}${describeCause(error)}; this needs the pull_requests: write permission on both the app and this installation`);
                 const detail = error.hostDetail;
-                if (detail !== undefined)
+                if (detail !== undefined) {
                     Object.assign(wrapped, { hostDetail: detail });
+                }
                 throw wrapped;
             }
             let parsed = null;