looply-cli 0.5.19 → 0.5.20

package/dist/branch-delivery.js

@@ -15,12 +15,16 @@ exports.describeForeign = describeForeign;
 exports.unmergedForeign = unmergedForeign;
 exports.mergeGuard = mergeGuard;
 exports.decideChecks = decideChecks;
+exports.effectiveMode = effectiveMode;
+exports.gatesPassed = gatesPassed;
 exports.advanceDeliveries = advanceDeliveries;
 exports.makeReleaseRunner = makeReleaseRunner;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const core_1 = require("@looply/core");
+const core_2 = require("@looply/core"); // a value, beside the types above
+const heroku_cli_1 = require("./heroku-cli");
 const delivery_rules_1 = require("./delivery-rules");
 const git_driver_1 = require("./git-driver");
 const integrator_1 = require("./integrator");
@@ -127,6 +131,26 @@ rebuild = {}) {
             const r = await out(['branch', '--no-track', name, sha]).catch(() => null);
             return r !== null && r.code === 0;
         },
+        async contains(ancestor, descendant, base) {
+            if (!/^[0-9a-f]{7,40}$/.test(ancestor) || !/^[0-9a-f]{7,40}$/.test(descendant))
+                return false;
+            const commit = async (c) => {
+                const r = await out(['rev-parse', '--verify', '--quiet', `${c}^{commit}`]).catch(() => null);
+                return r !== null && r.code === 0 && /^[0-9a-f]{40}$/.test(r.stdout.trim()) ? r.stdout.trim() : null;
+            };
+            let a = await commit(ancestor);
+            let d = await commit(descendant);
+            const name = (0, delivery_rules_1.shortBranch)(base);
+            if ((a === null || d === null) && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(name) && !name.includes('..')) {
+                // Read-only for the person: it moves origin's remote-tracking copy and nothing else.
+                await out(['fetch', '--quiet', '--no-tags', delivery_rules_1.DELIVERY_REMOTE, `refs/heads/${name}:refs/remotes/${delivery_rules_1.DELIVERY_REMOTE}/${name}`]).catch(() => undefined);
+                a = a ?? (await commit(ancestor));
+                d = d ?? (await commit(descendant));
+            }
+            if (a === null || d === null)
+                return false;
+            return a === d || (await driver.isAncestor(a, d).catch(() => false));
+        },
     };
 }
 /**
@@ -352,7 +376,9 @@ function pullBody(input) {
             ? 'a person reviews and merges.'
             : input.mode === 'merge'
                 ? 'Looply merges this once the required CI checks are green.'
-                : "Looply merges this once the required CI checks are green, then runs the project's declared release step."}${input.modeCapped ? ` (${input.modeCapped}.)` : ''}`,
+                : input.mode === 'test'
+                    ? "ship to test: Looply merges this once the required CI checks are green (or, when the repository has no CI, once its own checks above passed), then deploys the test environment only. Other environments are deployed only when a person promotes it."
+                    : "Looply merges this once the required CI checks are green, then runs the project's declared release step."}${input.modeCapped ? ` (${input.modeCapped}.)` : ''}`,
     ];
     if (input.maintenance)
         lines.push('', ...maintenanceSection(input.maintenance));
@@ -408,6 +434,7 @@ async function deliverOnce(deps, input) {
         projectBase: null,
         mode: input.mode,
         ...(input.maintenance && !input.maintenance.autoMerge ? { noAutoMerge: true } : {}),
+        ...(input.checks ? { checks: { ...input.checks } } : {}),
         state: 'not-pushed',
         note: null,
         dependsOn: null,
@@ -590,13 +617,14 @@ async function deliverOnce(deps, input) {
                     : foreignText !== null
                         ? tail(foreignText)
                         : null;
+    const modeNote = input.modeNote ?? null;
     return save(deps, {
         ...entry,
         pullNumber: pull.number,
         pullRequestUrl: pull.url,
         base: pull.base || prBase,
         state,
-        note,
+        note: modeNote === null ? note : note === null ? modeNote : `${note}; ${modeNote}`.slice(0, 600),
         ...(absorbs.length > 0 ? { absorbs } : {}),
     });
 }
@@ -788,6 +816,21 @@ function decideChecks(required, checks) {
     const waiting = checks.filter((c) => c.state === 'pending').map((c) => c.name);
     return waiting.length > 0 ? { kind: 'pending', waiting } : { kind: 'green' };
 }
+/**
+ * THE MODE IN FORCE, WITH SHIP TO TEST'S SAFETY APPLIED: `test` whose settings `shipToTestRefusal`
+ * refuses is `pr`, and the reason comes with it. Every other mode is as asked.
+ */
+function effectiveMode(asked, settings) {
+    if (asked !== 'test')
+        return { mode: asked, refused: null };
+    const refused = (0, core_2.shipToTestRefusal)({ deploy: settings.deploy, environments: settings.environments.filter((e) => !e.unnamed) });
+    return refused === null ? { mode: 'test', refused: null } : { mode: 'pr', refused: `ship to test is off: ${refused}` };
+}
+/** Looply's own gates for the delivered commit all passed — at least one, and none failed or skipped. */
+function gatesPassed(checks) {
+    const outcomes = Object.values(checks ?? {});
+    return outcomes.length > 0 && outcomes.every((o) => o === 'passed');
+}
 /**
  * States a pass may move on. `pr-open` and `checks-failed` move only on a person's approval.
  * `blocked` is re-examined on every pass: it unblocks by itself once the other goals' work it
@@ -808,7 +851,10 @@ const APPROVABLE = ['pr-open', 'waiting-checks', 'checks-failed', 'blocked'];
  */
 async function advanceDeliveries(deps) {
     for (const e of deps.store.all()) {
-        if (e.done === true || !ADVANCING.includes(e.state))
+        if (!ADVANCING.includes(e.state))
+            continue;
+        // A finished one is looked at again only for a promote it has not acted on yet.
+        if (e.done === true && !(MERGED.includes(e.state) && pendingPromotes(deps, e).length > 0))
             continue;
         try {
             await advanceOne(deps, e);
@@ -821,8 +867,11 @@ async function advanceDeliveries(deps) {
 async function advanceOne(deps, e) {
     const now = deps.now();
     const at = new Date(now).toISOString();
-    const asked = deps.mode(e.goalId);
-    const mode = e.noAutoMerge === true && (asked === 'merge' || asked === 'deploy') ? 'pr' : asked;
+    const capped = deps.mode(e.goalId);
+    const asked = e.noAutoMerge === true && (capped === 'merge' || capped === 'test' || capped === 'deploy') ? 'pr' : capped;
+    // 🔴 SHIP TO TEST'S SAFETY, asked again on every pass: settings that changed since the delivery count.
+    const safe = effectiveMode(asked, { deploy: deps.deploy(), environments: deps.environments?.() ?? [] });
+    const mode = safe.mode;
     // A person's approval, read from the goal mirror.
     if (!e.approvedAt && APPROVABLE.includes(e.state) && e.pullNumber !== null) {
         const approved = deps.shipRequested(e.goalId);
@@ -836,10 +885,11 @@ async function advanceOne(deps, e) {
         }
     }
     const approved = !!e.approvedAt;
-    const wantsMerge = approved || mode === 'merge' || mode === 'deploy';
+    const wantsMerge = approved || mode === 'merge' || mode === 'test' || mode === 'deploy';
     const wantsDeploy = approved || mode === 'deploy';
     if (e.state === 'waiting-checks' && !wantsMerge) {
-        await save(deps, { ...e, mode, state: 'pr-open', note: `delivery is now "${mode}", so Looply will not merge it; a person merges`, updatedAt: at });
+        const why = safe.refused ?? `delivery is now "${mode}"`;
+        await save(deps, { ...e, mode, state: 'pr-open', note: `${why}, so Looply will not merge it; a person merges`, updatedAt: at });
         return;
     }
     const client = e.owner !== null && e.repo !== null ? await deps.github(e.owner, e.repo) : null;
@@ -938,12 +988,26 @@ async function advanceOne(deps, e) {
                 await save(deps, { ...e, state: 'checks-failed', note: `not merged: ${verdict.failed.join(', ')} failed`, updatedAt: at });
                 return;
             }
-            // No CI at all: an automatic merge waits a little, then hands it to a person; a person's approval is the check.
+            /**
+             * No CI at all: an automatic merge waits a little for CI to show up, then hands it to a person;
+             * a person's approval is the check. Under ship to test, Looply's OWN gates for the delivered
+             * commit are the check instead — every one of them passed, or it goes to a person as before.
+             */
+            let noCiNote = null;
             if (verdict.kind === 'none' && !approved) {
                 if (age < exports.NO_CHECKS_GRACE_MS)
                     return;
-                await save(deps, { ...e, state: 'pr-open', note: 'not merged: no CI checks report on this pull request, so a person merges it', updatedAt: at });
-                return;
+                // The gates ran on the delivered commit: a head that moved, or a `-solo` rebuild, is not what they judged.
+                const sameCommit = (pull.headSha === '' || pull.headSha === e.sha) && !e.rebuiltFrom;
+                const gatesHold = mode === 'test' && gatesPassed(e.checks) && sameCommit;
+                if (!gatesHold) {
+                    const why = mode === 'test'
+                        ? `not merged: no CI checks report on this pull request, and ${sameCommit ? "Looply's own checks for it did not all pass" : "Looply's own checks ran on a different commit than its head"}, so a person merges it`
+                        : 'not merged: no CI checks report on this pull request, so a person merges it';
+                    await save(deps, { ...e, state: 'pr-open', note: why, updatedAt: at });
+                    return;
+                }
+                noCiNote = `merged on Looply's own checks (${Object.keys(e.checks ?? {}).join(', ')} passed); the repository reports no CI`;
             }
             if (verdict.kind === 'pending') {
                 if (age > exports.CHECKS_PATIENCE_MS) {
@@ -957,7 +1021,7 @@ async function advanceOne(deps, e) {
                 return;
             }
             deps.log(`deliver : merged ${e.pullRequestUrl} into ${pull.base}`);
-            e = { ...e, state: 'merged', mergeSha: merged.sha ?? null, note: null, updatedAt: at };
+            e = { ...e, state: 'merged', mergeSha: merged.sha ?? null, note: noCiNote, updatedAt: at };
             await save(deps, e);
         }
     }
@@ -967,6 +1031,8 @@ async function advanceOne(deps, e) {
 /* ────────────────────────────────────────── where the merge got to ── */
 /** How long a merged commit's deploys are followed for, so one done outside Looply is still seen. */
 exports.FOLLOW_DEPLOYS_MS = 14 * 24 * 60 * 60_000;
+/** The states of a delivery whose work is in the base. */
+const MERGED = ['merged', 'deployed', 'deploy-failed'];
 /** The environments to deploy, in order; the single `deploy` (or, under `deploy`, a declared release step) when none are named. */
 function plansFor(deps, mode) {
     const named = deps.environments?.() ?? [];
@@ -978,19 +1044,38 @@ function plansFor(deps, mode) {
         return [];
     return [{ name: d.kind === 'push' ? d.remote : 'default', deploy: d, unnamed: true }];
 }
+/**
+ * The commit a merged delivery's deploys are about: the merge commit, else — a pull request a
+ * person merged where GitHub named no merge commit — its head, which the base now contains.
+ */
+function subjectOf(e) {
+    return e.mergeSha ?? (/^[0-9a-f]{40}$/.test(e.sha) ? e.sha : null);
+}
+/** The promote requests on the goal that this delivery has not acted on yet. */
+function pendingPromotes(deps, e) {
+    const asked = deps.promoteRequests?.(e.goalId) ?? [];
+    const done = e.promoted ?? {};
+    return asked.filter((r) => done[r.environment.toLowerCase()] === undefined);
+}
 /**
  * 🔴 WHERE A MERGED COMMIT IS, TOLD TRUTHFULLY, PER ENVIRONMENT.
  *
  * The first time it is seen merged, every environment gets a row and Looply runs its OWN deploy
- * steps, in order (only under `deploy` or "Approve and ship"; a failure stops the ones after it):
- *   - `push`  → deployed when the git push exited 0 (a push to Heroku returns only after the release);
+ * steps, in order (under `deploy` or "Approve and ship" every one; under ship to test ONLY the test
+ * environment; a failure stops the ones after it):
+ *   - `push`  → deployed when the git push exited 0 — to a Heroku app (`herokuApp`), only once the
+ *               app's newest release is, or contains, the commit; until then unconfirmed;
  *   - `run`   → deployed when the project's declared release step exited 0;
  *   - `merge-deploys` → UNCONFIRMED: the merge should deploy it, but a merge is not a deploy;
  *   - `none`  → waiting: nothing here deploys it.
- * Then, every pass, GitHub's Deployments for the merge commit are read, and an environment of the
- * same name (any, for the one unnamed environment) that GitHub says is `success` is `deployed`,
- * `failure`/`error` is `failed`, still running is `deploying` — which is how a Heroku or Netlify
- * deploy, or one a person ran by hand, is seen. Nothing else ever makes a row `deployed`.
+ * A person's PROMOTE to another environment deploys the commit there, once, on the next pass —
+ * the only way a non-test environment is ever deployed under ship to test.
+ * Then, every pass, an environment that is not settled is looked up: GitHub's Deployments of the
+ * commit (an environment of the same name — any, for the one unnamed environment — `success` is
+ * `deployed`, `failure`/`error` is `failed`, still running is `deploying`); GitHub's newest
+ * successful deployment of that environment when it is of a LATER commit that contains this one;
+ * and a Heroku app's newest release, by the same rule. That is how a Heroku or Netlify deploy, or one
+ * a person ran by hand, is seen. Nothing else ever makes a row `deployed`.
  *
  * The delivery is `done` once every environment is deployed or failed, or 14 days after the merge;
  * a pass that changes nothing records nothing. No environment configured: done at the merge, and
@@ -1001,18 +1086,34 @@ async function followDeploys(deps, api, e, wantsDeploy, mode) {
     const at = new Date(nowMs).toISOString();
     let x = { ...e, mergedAt: e.mergedAt ?? at };
     const plans = plansFor(deps, mode);
-    if (x.environments === undefined) {
-        if (plans.length === 0) {
-            await save(deps, { ...x, done: true, deploy: { kind: 'none', ok: true, detail: 'merged; nothing is configured to deploy' }, updatedAt: at });
-            return;
-        }
-        x = await deployAll(deps, x, plans, wantsDeploy, at);
+    if (x.environments === undefined && plans.length === 0) {
+        // A promote has nowhere to go: acted on (nothing), so it is not asked about again.
+        const promoted = { ...(x.promoted ?? {}) };
+        for (const r of pendingPromotes(deps, x))
+            promoted[r.environment.toLowerCase()] = r.requestedAt;
+        await save(deps, {
+            ...x,
+            done: true,
+            deploy: { kind: 'none', ok: true, detail: 'merged; nothing is configured to deploy' },
+            ...(Object.keys(promoted).length > 0 ? { promoted } : {}),
+            updatedAt: at,
+        });
+        return;
     }
-    const sha = x.mergeSha ?? null;
-    if (api?.deploymentsFor && sha !== null) {
-        const found = await api.deploymentsFor(sha).catch(() => null);
-        if (found !== null)
-            x = { ...x, environments: (x.environments ?? []).map((row) => fromGitHub(row, plans, found)) };
+    // The environments whose Heroku releases this pass's own deploys already read: not read twice.
+    const asked = new Set();
+    if (x.environments === undefined)
+        x = await deployAll(deps, x, plans, wantsDeploy, mode, at, asked);
+    x = await promoteAll(deps, x, plans, at, asked);
+    const sha = subjectOf(x);
+    const base = x.projectBase ?? x.base ?? '';
+    if (sha !== null) {
+        if (api?.deploymentsFor) {
+            const found = await api.deploymentsFor(sha).catch(() => null);
+            if (found !== null)
+                x = { ...x, environments: (x.environments ?? []).map((row) => fromGitHub(row, plans, found)) };
+        }
+        x = await laterDeploys(deps, api, x, plans, sha, base, at, asked);
     }
     const rows = x.environments ?? [];
     const settled = rows.every((r) => r.state === 'deployed' || r.state === 'failed');
@@ -1028,67 +1129,40 @@ async function followDeploys(deps, api, e, wantsDeploy, mode) {
     if (!same)
         await save(deps, { ...x, updatedAt: at });
 }
+/** One environment's row as Looply's own step for it left it. */
+function envRow(p, sha, at, state, detail, when = null) {
+    return {
+        name: p.name,
+        test: p.test === true,
+        state,
+        sha,
+        at: state === 'waiting' ? null : (when ?? at),
+        url: p.url ?? null,
+        detail: detail.slice(0, 600),
+    };
+}
 /** Run Looply's own deploy step for each environment, in order, and make every row. */
-async function deployAll(deps, e, plans, wantsDeploy, at) {
-    const base = e.projectBase ?? '';
-    const sha = e.mergeSha ?? null;
+async function deployAll(deps, e, plans, wantsDeploy, mode, at, asked) {
+    const sha = subjectOf(e);
     const rows = [];
     let stoppedBy = null;
     for (const p of plans) {
-        const row = (state, detail) => ({
-            name: p.name,
-            test: p.test === true,
-            state,
-            sha,
-            at: state === 'waiting' ? null : at,
-            url: p.url ?? null,
-            detail: detail.slice(0, 600),
-        });
         const d = p.deploy;
         if (stoppedBy !== null) {
-            rows.push(row('waiting', `not deployed: the deploy to ${stoppedBy} failed first`));
-            continue;
-        }
-        if (d.kind === 'none') {
-            rows.push(row('waiting', `no deploy step is configured for ${p.name}`));
+            rows.push(envRow(p, sha, at, 'waiting', `not deployed: the deploy to ${stoppedBy} failed first`));
             continue;
         }
-        if (d.kind === 'merge-deploys') {
-            rows.push(row('unconfirmed', `merged into ${base}, which should deploy it; not confirmed yet`));
+        // 🔴 SHIP TO TEST deploys the test environment and nothing else — not even on an approval.
+        const mine = d.kind === 'push' || d.kind === 'run';
+        if (mine && mode === 'test' && p.test !== true) {
+            rows.push(envRow(p, sha, at, 'waiting', `ship to test deploys only the test environment; ${p.name} is deployed when a person promotes it`));
             continue;
         }
-        if (!wantsDeploy) {
-            rows.push(row('waiting', `Looply deploys only under "deploy" or after "Approve and ship"`));
+        if (mine && mode !== 'test' && !wantsDeploy) {
+            rows.push(envRow(p, sha, at, 'waiting', `Looply deploys only under "deploy" or after "Approve and ship"`));
             continue;
         }
-        if (d.kind === 'push') {
-            if (sha === null) {
-                rows.push(row('failed', 'merged, but GitHub did not say which commit the merge made, so nothing was pushed to deploy'));
-            }
-            else {
-                deps.log(`deliver : deploying ${sha.slice(0, 12)} to ${d.remote} ${d.branch} (${p.name})`);
-                const r = await deps.deployPush(d.remote, d.branch, sha, base);
-                rows.push(r.ok ? row('deployed', `pushed ${sha.slice(0, 12)} to ${d.branch} on ${d.remote}`) : row('failed', `pushing to ${d.remote} ${d.branch} failed: ${r.because}`));
-            }
-        }
-        else {
-            const command = deps.release();
-            if (command === null) {
-                rows.push(row('failed', 'merged; not deployed — no release step is declared (deliver.release in .looply/config.yaml)'));
-            }
-            else {
-                deps.log(`deliver : running the declared release step for ${e.goalId} (${p.name})`);
-                const r = await deps.runRelease(command, {
-                    LOOPLY_GOAL_ID: e.goalId,
-                    LOOPLY_BRANCH: e.branch,
-                    LOOPLY_BASE_BRANCH: base,
-                    LOOPLY_MERGED_SHA: sha ?? '',
-                    LOOPLY_PULL_REQUEST_URL: e.pullRequestUrl ?? '',
-                    LOOPLY_ENVIRONMENT: p.name,
-                });
-                rows.push(r.code === 0 ? row('deployed', 'the declared release step finished') : row('failed', `the release step exited ${r.code}: ${r.tail.slice(-300)}`));
-            }
-        }
+        rows.push(await deployOne(deps, e, p, sha, at, asked));
         if (rows[rows.length - 1].state === 'failed')
             stoppedBy = p.name;
     }
@@ -1097,6 +1171,157 @@ async function deployAll(deps, e, plans, wantsDeploy, at) {
     const leadPlan = plans[rows.indexOf(lead)];
     return { ...e, environments: rows, deploy: { kind: leadPlan.deploy.kind, ok: lead.state !== 'failed', detail: lead.detail ?? '' } };
 }
+/** A person's promotes not acted on yet: each environment is deployed once, and its row replaced. */
+async function promoteAll(deps, e, plans, at, asked) {
+    const pending = pendingPromotes(deps, e);
+    if (pending.length === 0)
+        return e;
+    const promoted = { ...(e.promoted ?? {}) };
+    const rows = [...(e.environments ?? [])];
+    const sha = subjectOf(e);
+    for (const r of pending) {
+        const key = r.environment.toLowerCase();
+        promoted[key] = r.requestedAt;
+        const p = plans.find((pl) => pl.unnamed !== true && pl.name.toLowerCase() === key);
+        if (p === undefined) {
+            deps.log(`deliver : ${e.goalId}: promote to ${r.environment} not acted on — no environment has that name`);
+            continue;
+        }
+        if (p.test === true) {
+            deps.log(`deliver : ${e.goalId}: promote to ${p.name} not acted on — it is the test environment`);
+            continue;
+        }
+        const i = rows.findIndex((row) => row.name.toLowerCase() === key);
+        if (i >= 0 && rows[i].state === 'deployed')
+            continue;
+        deps.log(`deliver : promoting ${sha?.slice(0, 12) ?? e.goalId} to ${p.name} (asked by ${r.requestedBy} at ${r.requestedAt})`);
+        const row = await deployOne(deps, e, p, sha, at, asked);
+        const said = { ...row, detail: `promoted by ${r.requestedBy}: ${row.detail ?? row.state}`.slice(0, 600) };
+        if (i >= 0)
+            rows[i] = said;
+        else
+            rows.push(said);
+    }
+    return { ...e, environments: rows, promoted };
+}
+/** Looply's own deploy step for ONE environment, and the row it leaves. */
+async function deployOne(deps, e, p, sha, at, asked) {
+    const base = e.projectBase ?? '';
+    const row = (state, detail, when = null) => envRow(p, sha, at, state, detail, when);
+    const d = p.deploy;
+    if (d.kind === 'none')
+        return row('waiting', `no deploy step is configured for ${p.name}`);
+    if (d.kind === 'merge-deploys')
+        return row('unconfirmed', `merged into ${base}, which should deploy it; not confirmed yet`);
+    if (d.kind === 'push') {
+        if (sha === null)
+            return row('failed', 'merged, but GitHub did not say which commit the merge made, so nothing was pushed to deploy');
+        // 🔴 THE HEROKU LOGIN: the push goes nowhere unless the CLI is signed in as the account named.
+        if (d.herokuAccount !== undefined) {
+            const who = deps.heroku
+                ? await deps.heroku.whoami().catch((err) => ({ ok: false, because: err.message }))
+                : { ok: false, because: 'the Heroku CLI is not available to Looply here' };
+            if (!who.ok)
+                return row('failed', `not pushed: could not tell which account the Heroku CLI is signed in as (${who.because})`);
+            if (who.account.toLowerCase() !== d.herokuAccount.toLowerCase())
+                return row('failed', `not pushed: Heroku CLI is signed in as ${who.account}, not ${d.herokuAccount}`);
+        }
+        deps.log(`deliver : deploying ${sha.slice(0, 12)} to ${d.remote} ${d.branch} (${p.name})`);
+        const r = await deps.deployPush(d.remote, d.branch, sha, base);
+        if (!r.ok)
+            return row('failed', `pushing to ${d.remote} ${d.branch} failed: ${r.because}`);
+        const pushed = `pushed ${sha.slice(0, 12)} to ${d.branch} on ${d.remote}`;
+        if (d.herokuApp === undefined)
+            return row('deployed', pushed);
+        asked.add(p.name);
+        const c = await herokuRelease(deps, d.herokuApp, sha, base);
+        return c.state === 'deployed' ? row('deployed', `${pushed}; ${c.detail}`, c.at) : row(c.state, `${pushed}, but ${c.detail}`, c.at);
+    }
+    const command = deps.release();
+    if (command === null)
+        return row('failed', 'merged; not deployed — no release step is declared (deliver.release in .looply/config.yaml)');
+    deps.log(`deliver : running the declared release step for ${e.goalId} (${p.name})`);
+    const r = await deps.runRelease(command, {
+        LOOPLY_GOAL_ID: e.goalId,
+        LOOPLY_BRANCH: e.branch,
+        LOOPLY_BASE_BRANCH: base,
+        LOOPLY_MERGED_SHA: sha ?? '',
+        LOOPLY_PULL_REQUEST_URL: e.pullRequestUrl ?? '',
+        LOOPLY_ENVIRONMENT: p.name,
+    });
+    return r.code === 0 ? row('deployed', 'the declared release step finished') : row('failed', `the release step exited ${r.code}: ${r.tail.slice(-300)}`);
+}
+/**
+ * IS THIS COMMIT WHAT A HEROKU APP RUNS? Its newest release (`heroku releases -a <app> -n 1 --json`,
+ * never `releases:info`) names a commit — its slug's, else the `Deploy <sha>` of its description.
+ * That commit IS this one, or CONTAINS it (a later release carries it): `deployed`. A release of this
+ * very commit that failed: `failed`. Anything else, or Heroku not answering: `unconfirmed`.
+ */
+async function herokuRelease(deps, app, sha, base) {
+    const unconfirmed = (detail) => ({ state: 'unconfirmed', at: null, detail });
+    if (!deps.heroku)
+        return unconfirmed(`the Heroku CLI is not available to read ${app}'s releases`);
+    const r = await deps.heroku.latestRelease(app).catch((err) => ({ ok: false, because: err.message }));
+    if (!r.ok)
+        return unconfirmed(`Heroku's releases of ${app} could not be read (${r.because})`);
+    if (r.release === null)
+        return unconfirmed(`${app} has no release yet`);
+    const rel = r.release;
+    const v = rel.version === null ? 'its newest release' : `v${rel.version}`;
+    const named = (0, heroku_cli_1.releaseCommit)(rel);
+    const exact = rel.description.includes(sha.slice(0, 7)) || (named !== null && (sha.startsWith(named) || named.startsWith(sha)));
+    const later = !exact && named !== null && deps.git.contains !== undefined && (await deps.git.contains(sha, named, base).catch(() => false));
+    const of = `Heroku release ${v} of ${app}${named === null ? '' : ` (${named.slice(0, 8)})`}`;
+    if (!exact && !later) {
+        return unconfirmed(named === null ? `${app}'s newest release (${v}: "${rel.description}") does not name a commit` : `${of} does not contain ${sha.slice(0, 12)} yet`);
+    }
+    if (rel.status === 'failed')
+        return exact ? { state: 'failed', at: rel.at, detail: `${of} failed` } : unconfirmed(`${of} contains it, but failed`);
+    if (rel.status === 'pending')
+        return { state: 'deploying', at: rel.at, detail: `${of} is in progress` };
+    return { state: 'deployed', at: rel.at, detail: `${of} ${exact ? 'is' : 'contains'} this commit` };
+}
+/**
+ * DEPLOYS OF A LATER COMMIT THAT CONTAINS THIS ONE. A ticket merged by hand into one commit, or a
+ * deploy of main a little later, carries this commit without being it: GitHub's newest successful
+ * deployment of a named environment, and a Heroku app's newest release, count when they contain it.
+ */
+async function laterDeploys(deps, api, e, plans, sha, base, at, asked) {
+    const open = (r) => r.state !== 'deployed' && r.state !== 'failed';
+    const rows = [...(e.environments ?? [])];
+    if (!rows.some(open))
+        return e;
+    if (api?.latestDeployments && deps.git.contains !== undefined) {
+        const latest = await api.latestDeployments().catch(() => null);
+        for (const [i, row] of rows.entries()) {
+            const plan = plans.find((p) => p.name === row.name);
+            if (!open(row) || latest === null || plan === undefined || plan.unnamed === true)
+                continue;
+            const d = latest.find((x) => x.environment.toLowerCase() === row.name.toLowerCase());
+            if (d === undefined || d.state !== 'success' || d.sha === sha || !(await deps.git.contains(sha, d.sha, base).catch(() => false)))
+                continue;
+            rows[i] = {
+                ...row,
+                state: 'deployed',
+                at: Number.isNaN(Date.parse(d.at)) ? at : new Date(d.at).toISOString(),
+                url: d.url ?? row.url,
+                detail: `GitHub reports ${d.sha.slice(0, 12)}, which contains this commit, deployed to ${d.environment}${d.description ? `: ${d.description}` : ''}`.slice(0, 600),
+            };
+        }
+    }
+    for (const [i, row] of rows.entries()) {
+        const plan = plans.find((p) => p.name === row.name);
+        const d = plan?.deploy;
+        // A row this pass's own push already asked Heroku about is not asked again.
+        if (!open(row) || d?.kind !== 'push' || d.herokuApp === undefined || asked.has(row.name))
+            continue;
+        const c = await herokuRelease(deps, d.herokuApp, sha, base);
+        if (c.state === 'unconfirmed')
+            continue;
+        rows[i] = { ...row, state: c.state, at: c.at ?? at, detail: c.detail.slice(0, 600) };
+    }
+    return { ...e, environments: rows };
+}
 /** GitHub's word on one environment, when it has one and the row is not already settled. */
 function fromGitHub(row, plans, found) {
     if (row.state === 'deployed' || row.state === 'failed')