gh-stack 0.18.0 → 0.19.1

package/src/commands/merge.ts

@@ -12,18 +12,35 @@ import {
 } from "../lib/metadata.ts";
 import { ensureMetadata, ensureCleanWorkingTree, ensureValidStack } from "../lib/safety.ts";
 import { takeSnapshot } from "../lib/snapshot.ts";
-import { getBranchRefSha, getPrInfo, getPrMergeState, resyncPrHead } from "../lib/github.ts";
-import { confirmAction } from "../lib/ui.ts";
+import {
+  getBranchRefSha,
+  getCommitPatch,
+  getPrInfo,
+  getCommitFiles,
+  getPrMergeState,
+  getRepoNwo,
+  resyncPrHead,
+} from "../lib/github.ts";
+import { verifyCollapse, type CollapsedChild } from "../lib/collapse-guard.ts";
+import type { Stack } from "../types.ts";
+import { confirmAction, isAutoYes } from "../lib/ui.ts";
+import { guardRemoteContent } from "../lib/remote-guard.ts";
+import { ensureNoPendingRun } from "./restack.ts";
 import {
   planMerges,
   advanceNewBottom,
   type BranchReview,
   type MergeAction,
 } from "../lib/advance.ts";
+import { flagSetting, parseEnvBool, type Resolved } from "../lib/config.ts";
 
 const MAX_RETRIES = 12;
 const RETRY_DELAY_MS = 5000;
 
+// Waits between fetches while origin's trunk catches up to a merge GitHub has
+// already reported (one entry per retry; ~7s in all).
+const TRUNK_MERGE_WAIT_MS = [1000, 2000, 4000];
+
 // After GitHub rejects a merge with the "still recomputing" signature, back off
 // (capped) and re-poll before retrying. One entry per retry; length+1 = max
 // attempts. Bounds total transient wait per PR to ~30s.
@@ -248,7 +265,7 @@ gh-stack merge — Squash-merge a stack via GitHub
 USAGE
   gh-stack merge [--dry-run] [-d|--delete-branch] [--collapse]
   gh-stack merge --approved [--collapse] [--dry-run] [-d|--delete-branch]
-  gh-stack merge --base [--dry-run] [-d|--delete-branch]
+  gh-stack merge --base [--dry-run] [-d|--delete-branch] [--no-push|--push]
 
 DEFAULT (top-down collapse)
   Squash-merges the whole stack from top to bottom via GitHub:
@@ -268,6 +285,11 @@ DEFAULT (top-down collapse)
   Squash-merges only the bottom PR into main as its own commit, then re-roots
   the next branch onto main. One PR per run — run it again to land the next.
   Approval is enforced by GitHub branch protection, not gh-stack.
+  With --no-push (or GH_STACK_NO_PUSH=1) the PR still merges on GitHub, but
+  the re-rooted branches stay local until ${pc.green("gh-stack submit")}. The
+  \`[restack] push\` config default doesn't apply to merge. If the re-root
+  stops (a conflict, or main not showing the merge yet), finish the fix, then
+  re-run ${pc.green("gh-stack merge --base")}: it picks up the already-merged PR.
 
 --collapse (stop before main)
   With the default or --approved, stop after collapsing into the base PR
@@ -283,19 +305,37 @@ a hard failure.
 
 A snapshot is taken first; ${pc.green("gh-stack undo")} restores the prior state.
 
+Before the base PR is handed to main, merge checks that each collapsed child's
+squash commit is still in the branch it was squashed into (as an ancestor, or a
+rebased copy). If the base branch was rewritten without one (e.g. a sync that
+never pulled it), merge stops and names the PR whose changes would be lost.
+Whatever it can't establish (a GitHub or fetch failure, a shallow clone,
+content it can't compare) is UNVERIFIED, never "missing": merge asks (default
+stop, with a retry for transient failures); with --yes it stops. --base runs
+the same check when the base PR carries PRs collapsed into it earlier.
+
 OPTIONS
   -d, --delete-branch  Delete remote branches after merging
       --approved       Collapse only the approved run (from the base up)
       --base           Merge just the bottom PR into main, re-root the next
       --collapse       Stop after collapsing into the base PR (don't merge to
                        main); alias: --stop-at-base
+      --skip-collapse-check
+                       Don't verify the collapsed children's content is in
+                       the base PR (above)
+      --no-push        With --base: re-root and restack locally only (also
+                       GH_STACK_NO_PUSH=1); --push overrides the variable
       --dry-run        Show what would happen without doing anything
 `);
     return;
   }
 
+  // A pending restack/sync may have left branches un-pushed or half-rebased;
+  // merging (or re-rooting) them now would land that stale state.
+  if (!dryRun) await ensureNoPendingRun("merge");
+
   if (baseOnly) {
-    await mergeBaseOnly(deleteFlag, dryRun);
+    await mergeBaseOnly(deleteFlag, dryRun, args);
     return;
   }
 
@@ -541,6 +581,12 @@ OPTIONS
     }
   }
 
+  // Every child is squashed into its parent now (this run or an earlier one).
+  // Before the base goes anywhere, make sure it still holds their content (#28).
+  if (!args.includes("--skip-collapse-check")) {
+    await ensureCollapseIntact(stack, rangeOrdered, baseBranch, basePr!);
+  }
+
   // ─── --collapse: stop here. Base PR holds the cumulative diff; let the
   //     user review on GitHub and re-run `gh-stack merge` to finish.
   if (collapse) {
@@ -740,6 +786,217 @@ OPTIONS
   p.outro(pc.green("Stack merge complete! Stack archived."));
 }
 
+/**
+ * Before the base PR goes to main, check every collapsed child's squash commit
+ * is still in what it was squashed into (#28). Fails closed:
+ *   - proven missing: stop (exit 2), naming the PR and how to put it back;
+ *   - unconfirmed or unverified (a lookup failed, a shallow clone, content that
+ *     can't be compared): interactive, ask (default stop, with a retry when the
+ *     cause looks transient); under --yes, stop (exit 2) and say it's
+ *     unverified, with the checks to run by hand.
+ */
+async function ensureCollapseIntact(
+  stack: Stack,
+  rangeOrdered: string[],
+  baseBranch: string,
+  basePr: number,
+): Promise<void> {
+  const children: CollapsedChild[] = [];
+  for (const branch of rangeOrdered) {
+    if (branch === baseBranch) continue;
+    const entry = stack.branches[branch]!;
+    children.push({
+      branch,
+      pr: entry.pr!,
+      parent: entry.parent,
+      parentPr: entry.parent === baseBranch ? null : (stack.branches[entry.parent]?.pr ?? null),
+    });
+  }
+  if (children.length === 0) return;
+
+  const nwo = (await getRepoNwo()) ?? "{owner}/{repo}";
+  const patchCommand = (sha: string) =>
+    `gh api -H "Accept: application/vnd.github.patch" repos/${nwo}/commits/${sha} | git am`;
+  const trunkRef = `origin/${await git.trunkBranch()}`;
+
+  for (;;) {
+    const s = p.spinner();
+    s.start(`Checking PR #${basePr} still holds every collapsed PR's changes...`);
+    const verdicts = await verifyCollapse({
+      base: baseBranch,
+      trunkRef,
+      children,
+      lookup: {
+        prResult: getPrMergeState,
+        commitPatch: getCommitPatch,
+        commitFiles: getCommitFiles,
+      },
+    });
+    const missing = verdicts.flatMap((v) => (v.status === "missing" ? [v] : []));
+    const uncertain = verdicts.flatMap((v) =>
+      v.status === "unconfirmed" || v.status === "unverified" ? [v] : [],
+    );
+    s.stop(
+      missing.length > 0
+        ? pc.red(`PR #${basePr} is missing collapsed changes`)
+        : uncertain.length > 0
+          ? pc.yellow(`Couldn't confirm PR #${basePr} holds every collapsed PR's changes`)
+          : `PR #${basePr} holds every collapsed PR's changes`,
+    );
+
+    if (missing.length > 0) {
+      console.log();
+      for (const v of missing) {
+        p.log.error(
+          `PR #${v.child.pr} (${pc.yellow(v.child.branch)})'s changes are missing from PR #${basePr}: ${v.containerLabel} (${v.container.slice(0, 8)}) has every file its squash commit ${v.mergeCommit.slice(0, 8)} touched exactly as it was before that commit.`,
+        );
+      }
+      console.log();
+      console.log(
+        `  ${pc.yellow(baseBranch)} was rewritten after the collapse (e.g. a restack or sync that never pulled the squash commit).`,
+      );
+      console.log(
+        `  Merging PR #${basePr} now would ship it without those PRs' changes. Nothing was merged to main.`,
+      );
+      console.log();
+      console.log(
+        `  Put the squash commit(s) back on ${baseBranch}, then re-run ${pc.green("gh-stack merge")}:`,
+      );
+      console.log(
+        `    ${pc.green(`git checkout ${baseBranch} && git pull --ff-only origin ${baseBranch}`)}`,
+      );
+      for (const v of missing) {
+        // An orphaned squash commit usually can't be fetched from GitHub, but
+        // its patch can: lead with what works.
+        console.log(
+          `    ${pc.green(
+            v.fetchable
+              ? `git fetch origin ${v.mergeCommit} && git cherry-pick ${v.mergeCommit}`
+              : patchCommand(v.mergeCommit),
+          )}`,
+        );
+      }
+      console.log(`    ${pc.green(`git push --force-with-lease origin ${baseBranch}`)}`);
+      console.log(
+        `  If the changes really are there in another form: ${pc.green("gh-stack merge --skip-collapse-check")}`,
+      );
+      process.exit(2);
+    }
+
+    if (uncertain.length === 0) return;
+
+    console.log();
+    for (const v of uncertain) {
+      p.log.warn(
+        `Could not confirm PR #${v.child.pr} (${pc.yellow(v.child.branch)})'s changes are in PR #${basePr} — this is UNVERIFIED, not known to be missing: ${v.reason}.`,
+      );
+    }
+    console.log();
+    console.log("  Check by hand before merging:");
+    console.log(
+      `    ${pc.green(`gh pr diff ${basePr} --name-only`)}   ${pc.dim("(the base PR's files)")}`,
+    );
+    for (const v of uncertain) {
+      console.log(
+        `    ${pc.green(`gh pr diff ${v.child.pr} --name-only`)}   ${pc.dim(`(PR #${v.child.pr}'s files: each should be in #${basePr})`)}`,
+      );
+      if (v.status === "unconfirmed") {
+        console.log(
+          `      ${pc.dim(`if they aren't, put its squash commit back on ${baseBranch}:`)} ${pc.green(patchCommand(v.mergeCommit))}`,
+        );
+      }
+    }
+    console.log(`  If they're all there: ${pc.green("gh-stack merge --skip-collapse-check")}`);
+
+    if (isAutoYes()) {
+      p.cancel(
+        `Stopped before merging PR #${basePr}: its collapsed content is unverified, and --yes never merges on a guess. Nothing was merged to main.`,
+      );
+      process.exit(2);
+    }
+    const transient = uncertain.some((v) => v.transient);
+    const choice = await p.select({
+      message: `Merge PR #${basePr} without confirming those changes are in it?`,
+      initialValue: "stop",
+      options: [
+        ...(transient
+          ? [{ value: "retry", label: "Retry the check", hint: "a GitHub or network read failed" }]
+          : []),
+        { value: "stop", label: "Stop — merge nothing" },
+        { value: "merge", label: "Merge anyway" },
+      ],
+    });
+    if (p.isCancel(choice) || choice === "stop") {
+      p.cancel(`Stopped before merging PR #${basePr}. Nothing was merged to main.`);
+      process.exit(2);
+    }
+    if (choice === "merge") return;
+  }
+}
+
+/**
+ * The children collapsed into `base` by an earlier `merge --collapse`: walking
+ * up from the base, each branch whose PR merged into its stack parent (itself
+ * the base or collapsed). `unknown` is the first branch whose PR couldn't be
+ * read, when that stopped the walk.
+ */
+async function collapsedChildren(
+  stack: Stack,
+  ordered: string[],
+  base: string,
+): Promise<{ collapsed: string[]; unknown: string | null }> {
+  const collapsed: string[] = [];
+  const into = new Set([base]);
+  for (const branch of ordered) {
+    const entry = stack.branches[branch];
+    if (branch === base || !entry?.pr || !into.has(entry.parent)) continue;
+    const state = await getPrMergeState(entry.pr);
+    if (!state) return { collapsed, unknown: branch };
+    if (state.state === "MERGED" && state.baseRefName === entry.parent) {
+      collapsed.push(branch);
+      into.add(branch);
+    }
+  }
+  return { collapsed, unknown: null };
+}
+
+/**
+ * Fetch the trunk and confirm it holds PR `prNumber`'s merge commit (#51).
+ * The re-root rebases onto `origin/<trunk>`; a trunk fetched before the squash
+ * landed puts the next branch on a main without the merged PR's changes, so
+ * its PR shows them deleted. Not ok when the merge commit can't be confirmed
+ * on the trunk, and the caller must stop rather than re-root.
+ */
+async function fetchTrunkWithMerge(
+  trunk: string,
+  prNumber: number,
+): Promise<{ ok: boolean; mergeCommit: string | null }> {
+  let mergeCommit: string | null = null;
+  for (let attempt = 0; ; attempt++) {
+    mergeCommit ??= (await getPrMergeState(prNumber))?.mergeCommit ?? null;
+    await $`git fetch origin ${trunk}`.nothrow().quiet();
+    if (mergeCommit && (await git.isAncestor(mergeCommit, `origin/${trunk}`))) {
+      return { ok: true, mergeCommit };
+    }
+    if (attempt >= TRUNK_MERGE_WAIT_MS.length) return { ok: false, mergeCommit };
+    await Bun.sleep(TRUNK_MERGE_WAIT_MS[attempt]!);
+  }
+}
+
+/**
+ * Whether `merge --base` pushes the branches it re-roots and restacks:
+ * `--push`/`--no-push`, else GH_STACK_NO_PUSH (#51). The squash itself always
+ * lands on GitHub. The `[restack] push` config default deliberately doesn't
+ * apply: a repo default for restack shouldn't change what a merge publishes.
+ */
+function resolveMergePush(args: string[]): Resolved {
+  const flag = flagSetting("restack.push", args);
+  if (flag) return flag;
+  const noPush = parseEnvBool("GH_STACK_NO_PUSH", process.env.GH_STACK_NO_PUSH);
+  if (noPush === undefined) return { value: true, source: "default" };
+  return { value: !noPush, source: "env", origin: "GH_STACK_NO_PUSH" };
+}
+
 /**
  * `gh-stack merge --base` — squash-merge ONLY the bottom PR into main, then
  * re-root the next branch onto main (replaying just its own commits, via
@@ -747,7 +1004,7 @@ OPTIONS
  * next. Approval is NOT checked here; GitHub branch protection enforces it.
  * A base PR already merged outside gh-stack is detected and advanced past.
  */
-async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void> {
+async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean, args: string[]): Promise<void> {
   // We rebase the surviving branches, so the same pre-flight guards as restack.
   if (await git.isRebaseInProgress()) {
     p.cancel(
@@ -766,7 +1023,17 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
   }
 
   const stack = meta.stacks[stackName]!;
-  await ensureValidStack(meta, stackName);
+  const base = stackBase(stack);
+  // The bottom branch may be gone locally once its PR merged: --delete-branch
+  // deletes it, and a re-run then only finishes the re-root (#51).
+  const root = Object.keys(stack.branches).find((b) => stack.branches[b]!.parent === base);
+  const rootPr = root ? stack.branches[root]!.pr : undefined;
+  const rootGone =
+    root != null &&
+    rootPr != null &&
+    !(await git.localBranchExists(root)) &&
+    (await getPrMergeState(rootPr))?.state === "MERGED";
+  await ensureValidStack(meta, stackName, { allowMissing: rootGone ? [root] : [] });
   const ordered = getOrderedBranches(stack);
   if (ordered.length === 0) {
     p.cancel("No branches in this stack");
@@ -775,7 +1042,6 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
 
   // Like top-down merge: a split stack rooted off another stack can't drain to
   // main until it's re-rooted. Require a trunk base.
-  const base = stackBase(stack);
   if (base !== "main" && base !== "master") {
     p.cancel(
       `${pc.yellow(stackName)} is based on ${pc.yellow(base)}, not main — can't merge yet.\n\n` +
@@ -786,6 +1052,7 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
   }
   const trunk = base;
   const targetRef = `origin/${trunk}`;
+  const push = resolveMergePush(args).value;
 
   p.intro(pc.cyan("Merge Base PR (via GitHub)"));
   p.log.info(`Stack: ${pc.yellow(stackName)}`);
@@ -819,6 +1086,11 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
     console.log(
       `    ${pc.dim(`then re-root ${nextChild} onto ${trunk} — the rest stays a stack`)}`,
     );
+    if (!push) {
+      console.log(
+        `    ${pc.dim(`(--no-push: re-rooted branches stay local; ${pc.green("gh-stack submit")} publishes them)`)}`,
+      );
+    }
   }
   console.log();
 
@@ -837,14 +1109,58 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
     process.exit(0);
   }
 
+  // #28: a base PR that carries PRs collapsed into it by an earlier
+  // `merge --collapse` must still hold their content before it goes to main.
+  // Collapsed children are found from GitHub (merged PRs whose base was their
+  // stack parent); a lookup that fails is uncertainty, and fails closed.
+  let collapsed: string[] = [];
+  if (baseAction === "merge" && !args.includes("--skip-collapse-check")) {
+    const found = await collapsedChildren(stack, ordered, baseBranch);
+    if (found.unknown) {
+      p.log.warn(
+        `Couldn't tell whether PR #${basePr} carries PRs collapsed into it: ${found.unknown}'s PR couldn't be read from GitHub.`,
+      );
+      console.log(
+        `  Check by hand: ${pc.green(`gh pr view ${stack.branches[found.unknown]!.pr} --json state,baseRefName`)}`,
+      );
+      console.log(
+        `  Then re-run, or skip the check: ${pc.green("gh-stack merge --base --skip-collapse-check")}`,
+      );
+      if (isAutoYes()) {
+        p.cancel(
+          `Stopped before merging PR #${basePr} (--yes never merges on a guess). Nothing was merged.`,
+        );
+        process.exit(2);
+      }
+      const go = await p.confirm({ message: `Merge PR #${basePr} anyway?`, initialValue: false });
+      if (p.isCancel(go) || !go) {
+        p.cancel(`Stopped before merging PR #${basePr}. Nothing was merged.`);
+        process.exit(2);
+      }
+    }
+    collapsed = found.collapsed;
+    if (collapsed.length > 0) {
+      await ensureCollapseIntact(stack, [baseBranch, ...collapsed], baseBranch, basePr);
+    }
+  }
+
+  // The branches this run rewrites and force-pushes (the next child here, the
+  // rest in the restack below) must not drop commits only origin has.
+  // Collapsed children are left out: their origin copies hold the squash
+  // commits of PRs merged into them, which aren't the user's to pull.
+  const overwrite = args.includes("--overwrite-remote");
+  const verified = await guardRemoteContent(
+    meta,
+    ordered.slice(1).filter((b) => !collapsed.includes(b)),
+    { command: "merge --base", overwrite, dryRun: false },
+  );
+
   // Snapshot first — this records every branch's pre-merge tip, which both the
   // fork-point resolver and `gh-stack undo` rely on.
   await takeSnapshot(meta, stackName, "merge-base");
   // Keep a copy of the original topology to archive if the stack fully drains.
   const originalStack = structuredClone(stack);
 
-  await $`git fetch origin ${trunk}`.quiet();
-
   for (let i = 0; i < plan.steps.length; i++) {
     const step = plan.steps[i]!;
     const mergedBranch = step.branch;
@@ -897,6 +1213,25 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
     }
 
     if (child) {
+      // Re-root onto the trunk as it is now, with the merge in it (#51).
+      const trunkState = await fetchTrunkWithMerge(trunk, step.pr!);
+      if (!trunkState.ok) {
+        console.log();
+        p.log.error(
+          `PR #${step.pr} is merged, but ${targetRef} doesn't show ${
+            trunkState.mergeCommit
+              ? `its merge commit ${trunkState.mergeCommit.slice(0, 8)}`
+              : "its merge commit (GitHub didn't say which it is)"
+          } yet.`,
+        );
+        console.log(
+          `  Stopped before re-rooting ${pc.yellow(child)}: a ${trunk} without the merge would drop its changes from the stack.`,
+        );
+        console.log(`  Once ${trunk} has it, finish with:`);
+        console.log(`    ${pc.green("gh-stack merge --base")}`);
+        process.exit(2);
+      }
+
       const res = await advanceNewBottom({
         meta,
         stackName,
@@ -905,15 +1240,17 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
         childPr,
         targetRef,
         recordedBase: trunk,
+        push,
+        expect: verified.get(child),
       });
       if (!res.ok) {
         console.log();
         if (res.reason === "conflict") {
           p.log.error(`Rebase conflict re-rooting ${pc.yellow(child)} onto ${trunk}.`);
-          console.log(`  Resolve the conflict, then:`);
+          console.log(`  Resolve the conflict, then finish with:`);
           console.log(`    ${pc.green("git rebase --continue")}`);
           console.log(
-            `    ${pc.green("gh-stack restack")}   ${pc.dim("(restacks the rest of the tail)")}`,
+            `    ${pc.green("gh-stack merge --base")}   ${pc.dim(`(pushes ${child}, retargets its PR, restacks the rest)`)}`,
           );
           console.log();
           console.log(
@@ -973,7 +1310,10 @@ async function mergeBaseOnly(deleteFlag: boolean, dryRun: boolean): Promise<void
   if (await git.localBranchExists(newBottom)) {
     await git.checkout(newBottom);
     const { default: restack } = await import("./restack.ts");
-    await restack([]);
+    // Push unless this run is local-only (--no-push / GH_STACK_NO_PUSH): the
+    // tail must match the re-root above. An explicit flag also means the
+    // `[restack] push` config isn't read mid-merge.
+    await restack([push ? "--push" : "--no-push", ...(overwrite ? ["--overwrite-remote"] : [])]);
   }
 
   p.outro(