github-settings-as-code 3.1.0 → 4.0.0

package/dist/github/variables/backup.d.mts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import { listRepoVariables } from './api/index.mjs';
+import { type RepositoryVariables } from './constants.mjs';
+/**
+ * repository variable の現在値を宣言ファイルへ撮り直す。
+ *
+ * 宣言していないものも含めて live にあるものを全部書く。 backup は「いま何が
+ * あるか」を写す操作なので、 GUI で足された変数もここで宣言に入る。要らない
+ * ものは撮り直したあとに宣言から外し、 GitHub 側でも消す。
+ */
+export declare const backupVariables: (fmt?: boolean) => Promise<void>;
+/**
+ * API の配列を `settings.json` と同じ record に畳む。
+ *
+ * `created_at` / `updated_at` はここで落ちる。値が変わっていなくても動くので、
+ * 残すと宣言ファイルが毎日変わり、ドリフト検査が本当の変更を報せなくなる。
+ */
+export declare const toDeclaration: (variables: Awaited<ReturnType<typeof listRepoVariables>>) => RepositoryVariables;
+//# sourceMappingURL=backup.d.mts.map

package/dist/github/variables/backup.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.mts","sourceRoot":"","sources":["../../../src/github/variables/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAMvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SAAe,OAAO,KAAU,OAAO,CAAC,IAAI,CAcvE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,cACb,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,KACvD,mBACoE,CAAC"}

package/dist/github/variables/backup.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { formatUncommittedFiles, isDirectlyExecuted } from 'ts-repo-utils';
+import { clearJsonFilesIn } from '../clear-json-files.mjs';
+import { settingsJsonName, variablesDir } from '../constants.mjs';
+import { listRepoVariables } from './api/index.mjs';
+
+
+
+
+
+
+
+export const backupVariables = async (fmt = true) => {
+    const variables = await listRepoVariables();
+    await clearJsonFilesIn(variablesDir);
+
+    await fs.writeFile(path.resolve(variablesDir, settingsJsonName), JSON.stringify(toDeclaration(variables), undefined, 2));
+    if (fmt) {
+        await formatUncommittedFiles();
+    }
+};
+
+
+
+
+
+
+export const toDeclaration = (variables) => Object.fromEntries(variables.map(({ name, value }) => [name, value]));
+if (isDirectlyExecuted(import.meta.url)) {
+    await backupVariables();
+}
+//# sourceMappingURL=backup.mjs.map

package/dist/github/variables/backup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.mjs","sourceRoot":"","sources":["../../../src/github/variables/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,GAAG,GAAY,IAAI,EAAiB,EAAE;IAC1E,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAE5C,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAErC,mEAAmE;IACnE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CACvD,CAAC;IAEF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,SAAwD,EACnC,EAAE,CACvB,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAExE,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,eAAe,EAAE,CAAC;AAC1B,CAAC"}

package/dist/github/variables/constants.d.mts

@@ -0,0 +1,65 @@
+import * as t from 'ts-fortress';
+/**
+ * `repo-settings/variables/settings.json` の型。
+ *
+ * Settings > Secrets and variables > Actions > Variables に対応する
+ * (`GET|POST /repos/{owner}/{repo}/actions/variables`,
+ * `PATCH /repos/{owner}/{repo}/actions/variables/{name}`)。
+ *
+ * 変数名をキー、値を値にした素の record にしてある。 API が返す配列
+ * (`{ name, value, created_at, updated_at }[]`) をそのまま写さないのは、
+ * `created_at` / `updated_at` が値の変化なしに動くためで、宣言に入れると
+ * 毎日ドリフトとして出てしまう。ここで持つのは宣言できるものだけ。
+ *
+ * **ここに秘密を書かないこと。** repository variable は API でも Actions の
+ * ログでも平文で読める。秘密は secret 側で、そちらはこのツールの管理外にある。
+ */
+export declare const RepositoryVariables: Readonly<{
+    typeName: string;
+    defaultValue: {
+        readonly [x: string]: string;
+    };
+    is: (a: unknown) => a is {
+        readonly [x: string]: string;
+    };
+    assertIs: (a: unknown) => asserts a is {
+        readonly [x: string]: string;
+    };
+    cast: (a: unknown) => {
+        readonly [x: string]: string;
+    };
+    fill: (a: unknown) => {
+        readonly [x: string]: string;
+    };
+    prune: <B extends {
+        readonly [x: string]: string;
+    }>(a: B) => {
+        readonly [x: string]: string;
+    };
+    validate: (a: unknown) => t.Result<{
+        readonly [x: string]: string;
+    }, readonly Readonly<{
+        path: readonly string[];
+        actualValue: unknown;
+        expectedType: string;
+        typeName: string;
+        details?: t.ValidationErrorDetails | undefined;
+    }>[]>;
+    optional?: true;
+}>;
+export type RepositoryVariables = t.TypeOf<typeof RepositoryVariables>;
+/**
+ * GitHub が受け付けない変数名を、送る前にすべて挙げて落とす。
+ *
+ * 名前は `PATCH .../actions/variables/{name}` のパスに入る。 octokit が URL
+ * エンコードするので注入にはならないが、弾かれる名前は 422 になり、それが
+ * 起きるのは**何本か書き込んだ後**である。 environments の `assertConsistent`
+ * と同じ理由でここに置いてある — 1 本目を送る前に全部の名前を見ておけば、
+ * この種の間違いで中途半端に適用された状態にはならない。
+ *
+ * 規則は GitHub の documentation のとおり: 英数字と `_` のみ、先頭に数字は
+ * 不可、`GITHUB_` 始まりは予約。名前の大文字小文字は区別されないので、
+ * 予約接頭辞の判定も区別しない。
+ */
+export declare const assertVariableNamesAreValid: (variables: RepositoryVariables) => void;
+//# sourceMappingURL=constants.d.mts.map

package/dist/github/variables/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/variables/constants.mts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE9B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,cAC3B,mBAAmB,KAC7B,IAeF,CAAC"}

package/dist/github/variables/constants.mjs

@@ -0,0 +1,48 @@
+import { Arr } from 'ts-data-forge';
+import * as t from 'ts-fortress';
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export const RepositoryVariables = t.keyValueRecord(t.string(), t.string(), {
+    typeName: 'RepositoryVariables',
+});
+
+
+
+
+
+
+
+
+
+
+
+
+
+export const assertVariableNamesAreValid = (variables) => {
+    const offenders = Object.keys(variables).filter((name) => !isValidVariableName(name));
+    if (Arr.isNonEmpty(offenders)) {
+        throw new Error([
+            `repository variable の名前として使えないものがあります: ${offenders
+                .map((name) => JSON.stringify(name))
+                .join(', ')}。`,
+            '英数字と "_" のみが使え、先頭に数字は置けず、"GITHUB_" 始まりは予約されています。',
+        ].join('\n'));
+    }
+};
+
+const variableNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const isValidVariableName = (name) => variableNamePattern.test(name) && !name.toUpperCase().startsWith('GITHUB_');
+//# sourceMappingURL=constants.mjs.map

package/dist/github/variables/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/variables/constants.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;IAC1E,QAAQ,EAAE,qBAAqB;CAChC,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,SAA8B,EACxB,EAAE;IACR,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAC7C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CACrC,CAAC;IAEF,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb;YACE,0CAA0C,SAAS;iBAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;iBACnC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChB,kDAAkD;SACnD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAExD,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE,CACpD,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC"}

package/dist/github/variables/index.d.mts

@@ -1,3 +1,5 @@
 export * from './api/index.mjs';
 export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
 //# sourceMappingURL=index.d.mts.map

package/dist/github/variables/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/variables/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/variables/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist/github/variables/index.mjs

@@ -1,3 +1,5 @@
 export * from './api/index.mjs';
 export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
 //# sourceMappingURL=index.mjs.map

package/dist/github/variables/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/variables/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/variables/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.d.mts

@@ -0,0 +1,10 @@
+import { VulnerabilityAlertsSettings } from '../constants.mjs';
+/**
+ * Dependabot alerts が有効かどうかを取得する。
+ *
+ * このエンドポイントは body を返さない: 有効なら 204、無効なら 404。
+ * octokit は 404 を例外にするので、それを `enabled: false` として扱う。
+ * 「無効」と「読めなかった」は区別する必要があるため、 404 以外は投げ直す。
+ */
+export declare const getVulnerabilityAlerts: () => Promise<VulnerabilityAlertsSettings>;
+//# sourceMappingURL=get-vulnerability-alerts.d.mts.map

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-vulnerability-alerts.d.mts","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/get-vulnerability-alerts.mts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,QACvB,OAAO,CAAC,2BAA2B,CAgB5C,CAAC"}

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.mjs

@@ -0,0 +1,25 @@
+import { hasKey, isRecord } from 'ts-data-forge';
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+import { VulnerabilityAlertsSettings } from '../constants.mjs';
+
+
+
+
+
+
+
+export const getVulnerabilityAlerts = async () => {
+    try {
+
+        await octokit.request('GET /repos/{owner}/{repo}/vulnerability-alerts', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+        return VulnerabilityAlertsSettings.fill({ enabled: true });
+    }
+    catch (error) {
+        if (isRecord(error) && hasKey(error, 'status') && error.status === 404) {
+            return VulnerabilityAlertsSettings.fill({ enabled: false });
+        }
+        throw error;
+    }
+};
+//# sourceMappingURL=get-vulnerability-alerts.mjs.map

package/dist/github/vulnerability-alerts/api/get-vulnerability-alerts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-vulnerability-alerts.mjs","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/get-vulnerability-alerts.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,KAAK,IAA0C,EAAE;IAC/C,IAAI,CAAC;QACH,sGAAsG;QACtG,MAAM,OAAO,CAAC,OAAO,CACnB,gDAAuE,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;QAEF,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvE,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/api/index.d.mts

@@ -0,0 +1,3 @@
+export * from './get-vulnerability-alerts.mjs';
+export * from './set-vulnerability-alerts.mjs';
+//# sourceMappingURL=index.d.mts.map

package/dist/github/vulnerability-alerts/api/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/index.mts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/github/vulnerability-alerts/api/index.mjs

@@ -0,0 +1,3 @@
+export * from './get-vulnerability-alerts.mjs';
+export * from './set-vulnerability-alerts.mjs';
+//# sourceMappingURL=index.mjs.map

package/dist/github/vulnerability-alerts/api/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/index.mts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.d.mts

@@ -0,0 +1,10 @@
+import { type VulnerabilityAlertsSettings } from '../constants.mjs';
+/**
+ * Dependabot alerts を JSON の内容に合わせる。
+ *
+ * 有効化と無効化で別メソッドなので、書き込みは 1 回で済むように分岐する。
+ * `enabled: false` はきちんと無効化する — 宣言が現状に合わせて黙るなら、
+ * ファイルを読んでも何が有効なのか分からなくなる。
+ */
+export declare const setVulnerabilityAlerts: (settings: VulnerabilityAlertsSettings) => Promise<void>;
+//# sourceMappingURL=set-vulnerability-alerts.d.mts.map

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-vulnerability-alerts.d.mts","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/set-vulnerability-alerts.mts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,aACvB,2BAA2B,KACpC,OAAO,CAAC,IAAI,CAgBd,CAAC"}

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.mjs

@@ -0,0 +1,19 @@
+import { octokitHeaders, OWNER, REPO } from '../../constants.mjs';
+import { octokit } from '../../octokit.mjs';
+
+
+
+
+
+
+
+export const setVulnerabilityAlerts = async (settings) => {
+    if (settings.enabled) {
+
+        await octokit.request('PUT /repos/{owner}/{repo}/vulnerability-alerts', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+        return;
+    }
+
+    await octokit.request('DELETE /repos/{owner}/{repo}/vulnerability-alerts', { owner: OWNER, repo: REPO, headers: octokitHeaders });
+};
+//# sourceMappingURL=set-vulnerability-alerts.mjs.map

package/dist/github/vulnerability-alerts/api/set-vulnerability-alerts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-vulnerability-alerts.mjs","sourceRoot":"","sources":["../../../../src/github/vulnerability-alerts/api/set-vulnerability-alerts.mts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,QAAqC,EACtB,EAAE;IACjB,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,uEAAuE;QACvE,MAAM,OAAO,CAAC,OAAO,CACnB,gDAAuE,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;QAEF,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,CAAC,OAAO,CACnB,mDAA0E,EAC1E,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CACtD,CAAC;AACJ,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/apply.d.mts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+/**
+ * `repo-settings/vulnerability-alerts/settings.json` を Dependabot alerts に反映する。
+ *
+ * 設定ファイルを置いていない repository では何もしない。 pages と同じ理由 —
+ * この package は他の repository からも使われるので、ファイルの不在を
+ * 「無効にせよ」と読むと、宣言していない設定を勝手に落としてしまう。
+ */
+export declare const applyVulnerabilityAlerts: () => Promise<void>;
+//# sourceMappingURL=apply.d.mts.map

package/dist/github/vulnerability-alerts/apply.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAiBvB;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,IAAI,CAsB7D,CAAC"}

package/dist/github/vulnerability-alerts/apply.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as t from 'ts-fortress';
+import { formatUncommittedFiles, isDirectlyExecuted, pathExists, Result, } from 'ts-repo-utils';
+import { settingsJsonName, vulnerabilityAlertsDir } from '../constants.mjs';
+import { getVulnerabilityAlerts, setVulnerabilityAlerts, } from './api/index.mjs';
+import { VulnerabilityAlertsSettings } from './constants.mjs';
+
+
+
+
+
+
+
+export const applyVulnerabilityAlerts = async () => {
+    const settingsPath = path.resolve(vulnerabilityAlertsDir, settingsJsonName);
+    if (!(await pathExists(settingsPath))) {
+        return;
+    }
+    const settings = await readSettings(settingsPath);
+    await setVulnerabilityAlerts(settings);
+
+    {
+        const applied = await getVulnerabilityAlerts();
+        const str = JSON.stringify(applied, undefined, 2);
+
+        await fs.writeFile(settingsPath, str);
+        await formatUncommittedFiles();
+    }
+};
+const readSettings = async (settingsPath) => {
+
+    const settingsText = await fs.readFile(settingsPath, { encoding: 'utf8' });
+    const validationResult = VulnerabilityAlertsSettings.validate(JSON.parse(settingsText));
+    if (Result.isErr(validationResult)) {
+        throw new Error(t.validationErrorsToMessages(validationResult.value).join('\n'));
+    }
+    return validationResult.value;
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await applyVulnerabilityAlerts();
+}
+//# sourceMappingURL=apply.mjs.map

package/dist/github/vulnerability-alerts/apply.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/apply.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,UAAU,EACV,MAAM,GACP,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,IAAmB,EAAE;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;IAE5E,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAElD,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAEvC,0BAA0B;IAC1B,CAAC;QACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;QAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAElD,mEAAmE;QACnE,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAEtC,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EACxB,YAAoB,EACkB,EAAE;IACxC,mEAAmE;IACnE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAE3E,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,CAC3D,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CACzB,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,CAAC,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,CAAC;AAChC,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,wBAAwB,EAAE,CAAC;AACnC,CAAC"}

package/dist/github/vulnerability-alerts/backup.d.mts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+/** Dependabot alerts の現在値を宣言ファイルへ撮り直す。 */
+export declare const backupVulnerabilityAlerts: (fmt?: boolean) => Promise<void>;
+//# sourceMappingURL=backup.d.mts.map

package/dist/github/vulnerability-alerts/backup.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AAQvB,0CAA0C;AAC1C,eAAO,MAAM,yBAAyB,SAC/B,OAAO,KACX,OAAO,CAAC,IAAI,CAcd,CAAC"}

package/dist/github/vulnerability-alerts/backup.mjs

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import 'dotenv/config';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { formatUncommittedFiles, isDirectlyExecuted } from 'ts-repo-utils';
+import { clearJsonFilesIn } from '../clear-json-files.mjs';
+import { settingsJsonName, vulnerabilityAlertsDir } from '../constants.mjs';
+import { getVulnerabilityAlerts } from './api/index.mjs';
+
+export const backupVulnerabilityAlerts = async (fmt = true) => {
+    const settings = await getVulnerabilityAlerts();
+    await clearJsonFilesIn(vulnerabilityAlertsDir);
+
+    await fs.writeFile(path.resolve(vulnerabilityAlertsDir, settingsJsonName), JSON.stringify(settings, undefined, 2));
+    if (fmt) {
+        await formatUncommittedFiles();
+    }
+};
+if (isDirectlyExecuted(import.meta.url)) {
+    await backupVulnerabilityAlerts();
+}
+//# sourceMappingURL=backup.mjs.map

package/dist/github/vulnerability-alerts/backup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/backup.mts"],"names":[],"mappings":";AACA,OAAO,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAC5C,GAAG,GAAY,IAAI,EACJ,EAAE;IACjB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAEhD,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAE/C,mEAAmE;IACnE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,gBAAgB,CAAC,EACtD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CACvC,CAAC;IAEF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,kBAAkB,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,MAAM,yBAAyB,EAAE,CAAC;AACpC,CAAC"}

package/dist/github/vulnerability-alerts/constants.d.mts

@@ -0,0 +1,72 @@
+import * as t from 'ts-fortress';
+/**
+ * `repo-settings/vulnerability-alerts/settings.json` の型。
+ *
+ * Settings > Advanced Security > Dependabot alerts に対応する。
+ *
+ * `security_and_analysis` とは別の API
+ * (`GET|PUT|DELETE /repos/{owner}/{repo}/vulnerability-alerts`) で、
+ * 値も JSON body ではなく 204 / 404 で返ってくる。そのため
+ * `repository-settings/settings.json` には載せられず、 pages と同じく
+ * 独立した設定ファイルにしている。
+ *
+ * `repository-settings/settings.json` の `dependabot_security_updates` は
+ * これとは別物 — あちらは「脆弱な依存を直す PR を自動で作るか」で、
+ * この repository では `pnpm-update` が lockfile を持っているため無効のまま。
+ * ここで管理するのは「既知の脆弱性を知らせるか」だけ。
+ */
+export declare const VulnerabilityAlertsSettings: Readonly<{
+    typeName: string;
+    defaultValue: Readonly<{
+        enabled: boolean;
+    }>;
+    is: (a: unknown) => a is Readonly<{
+        enabled: boolean;
+    }>;
+    assertIs: (a: unknown) => asserts a is Readonly<{
+        enabled: boolean;
+    }>;
+    cast: (a: unknown) => Readonly<{
+        enabled: boolean;
+    }>;
+    fill: (a: unknown) => Readonly<{
+        enabled: boolean;
+    }>;
+    prune: <B extends Readonly<{
+        enabled: boolean;
+    }>>(a: B) => Readonly<{
+        enabled: boolean;
+    }>;
+    validate: (a: unknown) => t.Result<Readonly<{
+        enabled: boolean;
+    }>, readonly Readonly<{
+        path: readonly string[];
+        actualValue: unknown;
+        expectedType: string;
+        typeName: string;
+        details?: t.ValidationErrorDetails | undefined;
+    }>[]>;
+    optional?: true;
+}> & Readonly<{
+    shape: {
+        readonly enabled: Readonly<{
+            typeName: string;
+            defaultValue: boolean;
+            is: (a: unknown) => a is boolean;
+            assertIs: (a: unknown) => asserts a is boolean;
+            cast: (a: unknown) => boolean;
+            fill: (a: unknown) => boolean;
+            prune: <B extends boolean>(a: B) => boolean;
+            validate: (a: unknown) => t.Result<boolean, readonly Readonly<{
+                path: readonly string[];
+                actualValue: unknown;
+                expectedType: string;
+                typeName: string;
+                details?: t.ValidationErrorDetails | undefined;
+            }>[]>;
+            optional?: true;
+        }>;
+    };
+}>;
+export type VulnerabilityAlertsSettings = t.TypeOf<typeof VulnerabilityAlertsSettings>;
+//# sourceMappingURL=constants.d.mts.map

package/dist/github/vulnerability-alerts/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEtC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,2BAA2B,CACnC,CAAC"}

package/dist/github/vulnerability-alerts/constants.mjs

@@ -0,0 +1,21 @@
+import * as t from 'ts-fortress';
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export const VulnerabilityAlertsSettings = t.record({
+    enabled: t.boolean(false),
+});
+//# sourceMappingURL=constants.mjs.map

package/dist/github/vulnerability-alerts/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1B,CAAC,CAAC"}

package/dist/github/vulnerability-alerts/index.d.mts

@@ -0,0 +1,5 @@
+export * from './api/index.mjs';
+export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+//# sourceMappingURL=index.d.mts.map

package/dist/github/vulnerability-alerts/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/dist/github/vulnerability-alerts/index.mjs

@@ -0,0 +1,5 @@
+export * from './api/index.mjs';
+export * from './apply.mjs';
+export * from './backup.mjs';
+export * from './constants.mjs';
+//# sourceMappingURL=index.mjs.map

package/dist/github/vulnerability-alerts/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/index.mts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}