github-settings-as-code 3.0.0 → 3.0.2

package/src/cmd/repo-settings.mts

@@ -1,46 +1,47 @@
 #!/usr/bin/env node
 
+import dedent from 'dedent';
 import 'dotenv/config';
 import * as util from 'node:util';
 import { Arr } from 'ts-data-forge';
 import { type ReadonlyRecord } from 'ts-type-forge';
 
-const HELP = `
-Usage: repo-settings <command> [target] [options]
-
-GitHub の repository 設定を JSON ファイルで管理する。
-
-Commands:
-  apply [target]     ローカルの設定ファイルを GitHub に反映する
-  backup [target]    GitHub の現在値をローカルの bk/ に保存する
-
-Targets:
-  all                すべて（既定）
-  repository         repo-settings/repository-settings/settings.json
-  rulesets           repo-settings/rulesets/*.json
-  variables          repository variables （ apply のみ ）
-  actions            repo-settings/actions-settings/settings.json
-  pages              repo-settings/pages/settings.json
-
-Options:
-      --owner <owner>   対象の owner
-      --repo <repo>     対象の repository 名
-  -h, --help            このヘルプを表示する
-
-owner / repo は「コマンドライン引数 → 環境変数 OWNER / REPO_NAME →
-git remote origin → package.json の name 」の順で解決される。
-通常は git remote から決まるため、どちらの指定も不要。
-
-認証は「環境変数 GITHUB_APP_TOKEN / GH_TOKEN / PERSONAL_ACCESS_TOKEN →
-gh CLI （ gh auth token ）」の順で解決される。ローカルでは gh auth login
-だけで動く。
-
-Examples:
-  repo-settings apply
-  repo-settings apply rulesets
-  repo-settings backup
-  repo-settings apply --owner noshiro-pf --repo ts-repo-utils
-`.trim();
+const HELP = dedent`
+  Usage: repo-settings <command> [target] [options]
+
+  GitHub の repository 設定を JSON ファイルで管理する。
+
+  Commands:
+    apply [target]     ローカルの設定ファイルを GitHub に反映する
+    backup [target]    GitHub の現在値をローカルの bk/ に保存する
+
+  Targets:
+    all                すべて（既定）
+    repository         repo-settings/repository-settings/settings.json
+    rulesets           repo-settings/rulesets/*.json
+    variables          repository variables （ apply のみ ）
+    actions            repo-settings/actions-settings/settings.json
+    pages              repo-settings/pages/settings.json
+
+  Options:
+        --owner <owner>   対象の owner
+        --repo <repo>     対象の repository 名
+    -h, --help            このヘルプを表示する
+
+  owner / repo は「コマンドライン引数 → 環境変数 OWNER / REPO_NAME →
+  git remote origin → package.json の name 」の順で解決される。
+  通常は git remote から決まるため、どちらの指定も不要。
+
+  認証は「環境変数 GITHUB_APP_TOKEN / GH_TOKEN / PERSONAL_ACCESS_TOKEN →
+  gh CLI （ gh auth token ）」の順で解決される。ローカルでは gh auth login
+  だけで動く。
+
+  Examples:
+    repo-settings apply
+    repo-settings apply rulesets
+    repo-settings backup
+    repo-settings apply --owner noshiro-pf --repo ts-repo-utils
+`;
 
 const COMMANDS = ['apply', 'backup'] as const;
 

package/src/github/actions-settings/api/get-actions-settings.mts

@@ -21,7 +21,6 @@ export const getActionsSettings = async (): Promise<ActionsSettings> => {
     { owner: OWNER, repo: REPO, headers: octokitHeaders },
   );
 
-  // eslint-disable-next-line unicorn/no-array-fill-with-reference-type
   return ActionsSettings.fill({
     enabled: permissions.data.enabled,
     allowed_actions: permissions.data.allowed_actions,

package/src/github/actions-settings/apply.mts

@@ -2,7 +2,7 @@
 import 'dotenv/config';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
-import { validationErrorsToMessages } from 'ts-fortress';
+import * as t from 'ts-fortress';
 import {
   formatUncommittedFiles,
   isDirectlyExecuted,
@@ -51,7 +51,7 @@ const readSettings = async (): Promise<ActionsSettings> => {
 
   if (Result.isErr(validationResult)) {
     throw new Error(
-      validationErrorsToMessages(validationResult.value).join('\n'),
+      t.validationErrorsToMessages(validationResult.value).join('\n'),
     );
   }
 

package/src/github/pages/api/get-pages-settings.mts

@@ -19,7 +19,6 @@ export const getPagesSettings = async (): Promise<
       { owner: OWNER, repo: REPO, headers: octokitHeaders },
     );
 
-    // eslint-disable-next-line unicorn/no-array-fill-with-reference-type
     return PagesSettings.fill({ build_type: response.data.build_type });
   } catch (error) {
     if (isRecord(error) && hasKey(error, 'status') && error.status === 404) {

package/src/github/pages/apply.mts

@@ -2,7 +2,7 @@
 import 'dotenv/config';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
-import { validationErrorsToMessages } from 'ts-fortress';
+import * as t from 'ts-fortress';
 import {
   formatUncommittedFiles,
   isDirectlyExecuted,
@@ -61,7 +61,7 @@ const readSettings = async (settingsPath: string): Promise<PagesSettings> => {
 
   if (Result.isErr(validationResult)) {
     throw new Error(
-      validationErrorsToMessages(validationResult.value).join('\n'),
+      t.validationErrorsToMessages(validationResult.value).join('\n'),
     );
   }
 

package/src/github/repository/api/get-repository.mts

@@ -1,5 +1,5 @@
 import { GetRepositoryResponse, type EndpointKeys } from 'octokit-safe-types';
-import { validationErrorsToMessages } from 'ts-fortress';
+import * as t from 'ts-fortress';
 import { Result } from 'ts-repo-utils';
 import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
 import { octokit } from '../../octokit.mjs';
@@ -20,7 +20,7 @@ export const getRepositorySettings =
       const res = GetRepositoryResponse.validate(getRepositoryResult.data);
 
       if (Result.isErr(res)) {
-        console.warn(validationErrorsToMessages(res.value));
+        console.warn(t.validationErrorsToMessages(res.value));
       }
     }
 

package/src/github/repository/api/update-repository.mts

@@ -2,6 +2,7 @@ import {
   type EndpointKeys,
   type UpdateRepositoryRequest,
 } from 'octokit-safe-types';
+import { castDeepMutable } from 'ts-data-forge';
 import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
 import { octokit } from '../../octokit.mjs';
 
@@ -16,6 +17,8 @@ export const updateRepository = async ({
     has_issues,
     has_projects,
     has_wiki,
+    has_pull_requests,
+    pull_request_creation_policy,
     is_template,
     default_branch,
     allow_squash_merge,
@@ -47,10 +50,12 @@ export const updateRepository = async ({
     homepage,
     private: private_,
     visibility,
-    security_and_analysis,
+    security_and_analysis: castDeepMutable(security_and_analysis),
     has_issues,
     has_projects,
     has_wiki,
+    has_pull_requests,
+    pull_request_creation_policy,
     is_template,
     default_branch,
     allow_squash_merge,

package/src/github/repository/apply.mts

@@ -4,7 +4,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { type UpdateRepositoryRequest } from 'octokit-safe-types';
 import { Obj } from 'ts-data-forge';
-import { validationErrorsToMessages } from 'ts-fortress';
+import * as t from 'ts-fortress';
 import {
   formatUncommittedFiles,
   isDirectlyExecuted,
@@ -95,7 +95,7 @@ const readSettings = async (): Promise<RepositoryPicked> => {
 
   if (Result.isErr(validationResult)) {
     throw new Error(
-      validationErrorsToMessages(validationResult.value).join('\n'),
+      t.validationErrorsToMessages(validationResult.value).join('\n'),
     );
   }
 

package/src/github/ruleset/api/get-all-rulesets.mts

@@ -5,7 +5,7 @@ import {
   type OctokitResponse,
 } from 'octokit-safe-types';
 import { expectType } from 'ts-data-forge';
-import { validationErrorsToMessages } from 'ts-fortress';
+import * as t from 'ts-fortress';
 import { Result } from 'ts-repo-utils';
 import { type DeepReadonly } from 'ts-type-forge';
 import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
@@ -64,7 +64,7 @@ export const getAllRulesets = async (): Promise<GetAllRulesetsResponse> => {
     const res = GetAllRulesetsResponse.validate(getAllRulesetsResponse.data);
 
     if (Result.isErr(res)) {
-      console.warn(validationErrorsToMessages(res.value));
+      console.warn(t.validationErrorsToMessages(res.value));
     }
   }
 

package/src/github/ruleset/api/get-ruleset.mts

@@ -1,5 +1,5 @@
 import { GetRulesetResponse, type EndpointKeys } from 'octokit-safe-types';
-import { validationErrorsToMessages } from 'ts-fortress';
+import * as t from 'ts-fortress';
 import { Result } from 'ts-repo-utils';
 import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
 import { octokit } from '../../octokit.mjs';
@@ -22,7 +22,7 @@ export const getRuleset = async (
     const res = GetRulesetResponse.validate(getRulesetResult.data);
 
     if (Result.isErr(res)) {
-      console.warn(validationErrorsToMessages(res.value));
+      console.warn(t.validationErrorsToMessages(res.value));
     }
   }
 

package/src/github/ruleset/schema.test.mts

@@ -0,0 +1,164 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { Arr, Obj, Result } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+import { RulesetPicked, rulesetKeysToPick } from './constants.mjs';
+
+/**
+ * The rulesets this repository declares, read from where `repo-settings apply`
+ * reads them.
+ *
+ * The real files rather than copies of them: what is worth knowing is that the
+ * payloads actually committed here parse. `apply` throws outright when one does
+ * not, and by then it is running against GitHub.
+ */
+const rulesetsDir = path.resolve(
+  import.meta.dirname,
+  '../../../../../repo-settings/rulesets',
+);
+
+const readJsonFilesIn = async (
+  dir: string,
+): Promise<readonly (readonly [string, unknown])[]> => {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+
+  return Promise.all(
+    entries
+      .filter((entry) => entry.isFile() && entry.name.endsWith('.json'))
+      .map(async (entry) => {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        const content = await fs.readFile(
+          path.resolve(dir, entry.name),
+          'utf8',
+        );
+
+        return [entry.name, JSON.parse(content)] as const;
+      }),
+  );
+};
+
+/**
+ * The file name on success, and the name with what went wrong on failure.
+ *
+ * Compared against the bare name rather than asserted on directly, because
+ * `assert.isTrue` here takes no message argument — this way a failure still
+ * prints which file it was and what the validator objected to.
+ */
+const outcomeOf = (
+  name: string,
+  result: ReturnType<typeof RulesetPicked.validate>,
+): string =>
+  Result.isErr(result)
+    ? (`${name}: ${t.validationErrorsToMessages(result.value).join('\n')}` as const)
+    : name;
+
+const validRuleset = {
+  id: 1,
+  name: 'x',
+  target: 'branch',
+  enforcement: 'active',
+  bypass_actors: [],
+  conditions: { ref_name: { include: [], exclude: [] } },
+  rules: [{ type: 'deletion' }],
+} as const;
+
+describe('the ruleset schema', () => {
+  test('accepts every ruleset this repository declares', async () => {
+    const files = await readJsonFilesIn(rulesetsDir);
+
+    assert.isTrue(Arr.isNonEmpty(files));
+
+    for (const [name, content] of files) {
+      assert.deepStrictEqual(
+        outcomeOf(name, RulesetPicked.validate(content)),
+        name,
+      );
+    }
+  });
+
+  test('accepts every backed-up ruleset', async () => {
+    const files = await readJsonFilesIn(path.resolve(rulesetsDir, './bk'));
+
+    assert.isTrue(Arr.isNonEmpty(files));
+
+    for (const [name, content] of files) {
+      assert.deepStrictEqual(
+        outcomeOf(name, RulesetPicked.validate(content)),
+        name,
+      );
+    }
+  });
+
+  test('accepts the fields GitHub adds to what apply sends back', async () => {
+    const files = await readJsonFilesIn(rulesetsDir);
+
+    assert.isTrue(Arr.isNonEmpty(files));
+
+    const declared = RulesetPicked.validate(files[0][1]);
+
+    assert.deepStrictEqual(outcomeOf(files[0][0], declared), files[0][0]);
+
+    if (Result.isOk(declared)) {
+      // `getRuleset` hands the whole API response to this type, and a response
+      // carries more than the seven fields that go back out again.
+      const result = RulesetPicked.validate({
+        ...declared.value,
+        source: 'noshiro-pf/mono',
+        source_type: 'Repository',
+        node_id: 'RRS_lACqUmVwb3NpdG9yeQ',
+      });
+
+      assert.isTrue(Result.isOk(result));
+    }
+  });
+
+  test('accepts a ruleset built from values GitHub does use', () => {
+    // The control for the two rejections below: without it they could be
+    // passing for some reason other than the field under test.
+    assert.isTrue(Result.isOk(RulesetPicked.validate(validRuleset)));
+  });
+
+  test('rejects an enforcement value GitHub does not use', () => {
+    const result = RulesetPicked.validate({
+      ...validRuleset,
+      enforcement: 'enabled',
+    });
+
+    assert.isTrue(Result.isErr(result));
+  });
+
+  test('rejects a rule type GitHub does not define', () => {
+    const result = RulesetPicked.validate({
+      ...validRuleset,
+      rules: [{ type: 'no_such_rule' }],
+    });
+
+    assert.isTrue(Result.isErr(result));
+  });
+
+  test('narrows to the seven fields apply sends, which is what backup writes', () => {
+    // Validation is a check rather than a filter, so `Obj.pick` is the step
+    // that narrows — this mirrors what `backupRulesets` does to a response
+    // before writing it.
+    const picked = Obj.pick(
+      {
+        ...validRuleset,
+        source: 'noshiro-pf/mono',
+        source_type: 'Repository',
+        node_id: 'RRS_lACqUmVwb3NpdG9yeQ',
+      },
+      rulesetKeysToPick,
+    );
+
+    assert.deepStrictEqual(Object.keys(picked).toSorted(), [
+      'bypass_actors',
+      'conditions',
+      'enforcement',
+      'id',
+      'name',
+      'rules',
+      'target',
+    ]);
+  });
+});

package/src/github/variables/apply.mts

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+
+// cspell:ignore lilpi
 import 'dotenv/config';
 import { isDirectlyExecuted } from 'ts-repo-utils';
 import {