mandrel-platform 0.17.2 → 0.19.0

package/scripts/check-pin-drift.mjs

@@ -85,7 +85,23 @@
 
 import { readFileSync, appendFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { execFileSync } from "node:child_process";
+
+import {
+  defaultGhRunner,
+  ghApiJson,
+  isNotFound,
+} from "./lib/gh-json.mjs";
+import {
+  compareSemver,
+  parseDurationMs,
+  parseSemver,
+} from "./lib/semver-duration.mjs";
+
+// Re-export the extracted seams so existing importers (platform-repair.mjs,
+// the test suite) keep their `check-pin-drift.mjs` import paths. The canonical
+// homes are scripts/lib/gh-json.mjs and scripts/lib/semver-duration.mjs
+// (Story #198).
+export { compareSemver, parseDurationMs, parseSemver, defaultGhRunner };
 
 // ---------------------------------------------------------------------------
 // Arg parsing
@@ -318,79 +334,6 @@ export function classifyConsumer(pins, latestReleaseSha) {
   };
 }
 
-/**
- * Extract a comparable `x.y.z` semver core from a release tag or version spec.
- * The platform tags releases as `mandrel-platform-v<semver>`; consumer specs
- * may carry a range prefix (`^0.11.3`, `~0.11.3`). Returns the dotted triple
- * or null when no numeric semver core is present (`workspace:*`, `latest`, a
- * git URL).
- *
- * @param {unknown} value
- * @returns {string | null}
- */
-export function parseSemver(value) {
-  if (typeof value !== "string") return null;
-  const m = /(\d+)\.(\d+)\.(\d+)/.exec(value);
-  return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
-}
-
-/**
- * Compare two `x.y.z` semver cores. Returns -1 when a < b, 0 when equal, 1
- * when a > b. Inputs MUST already be normalized dotted triples (see
- * `parseSemver`).
- *
- * @param {string} a
- * @param {string} b
- * @returns {-1 | 0 | 1}
- */
-export function compareSemver(a, b) {
-  const pa = a.split(".").map(Number);
-  const pb = b.split(".").map(Number);
-  for (let i = 0; i < 3; i += 1) {
-    if (pa[i] !== pb[i]) return pa[i] < pb[i] ? -1 : 1;
-  }
-  return 0;
-}
-
-/**
- * Parse a Renovate-style `minimumReleaseAge` duration into milliseconds. The
- * preset uses human strings like `"3 days"`, `"36 hours"`, `"1 week"`; this
- * accepts an integer (or float) count followed by a unit (the same units
- * Renovate's `ms`-backed parser accepts). Returns null for an unparseable or
- * non-positive value so the caller can fall back to "no hold window".
- *
- * @param {unknown} value
- * @returns {number | null}  Window length in ms, or null.
- */
-export function parseDurationMs(value) {
-  if (typeof value === "number" && Number.isFinite(value) && value > 0) {
-    // Bare number is interpreted as days (the preset's unit of record).
-    return value * 24 * 60 * 60 * 1000;
-  }
-  if (typeof value !== "string") return null;
-  const m = /^\s*(\d+(?:\.\d+)?)\s*([a-z]+)\s*$/i.exec(value.trim());
-  if (!m) return null;
-  const count = Number.parseFloat(m[1]);
-  if (!Number.isFinite(count) || count <= 0) return null;
-  const unit = m[2].toLowerCase();
-  const units = {
-    minute: 60 * 1000,
-    minutes: 60 * 1000,
-    min: 60 * 1000,
-    mins: 60 * 1000,
-    hour: 60 * 60 * 1000,
-    hours: 60 * 60 * 1000,
-    hr: 60 * 60 * 1000,
-    hrs: 60 * 60 * 1000,
-    day: 24 * 60 * 60 * 1000,
-    days: 24 * 60 * 60 * 1000,
-    week: 7 * 24 * 60 * 60 * 1000,
-    weeks: 7 * 24 * 60 * 60 * 1000,
-  };
-  const factor = units[unit];
-  return factor ? count * factor : null;
-}
-
 /**
  * Is the latest platform release still inside the `minimumReleaseAge` hold
  * window? During this window Renovate has not yet raised the bump PR, so EVERY
@@ -756,33 +699,12 @@ export function renderReport(report) {
 }
 
 // ---------------------------------------------------------------------------
-// GitHub access (via gh CLI) — thin, injectable seam for testing
+// GitHub access — the injectable `gh` seam lives in scripts/lib/gh-json.mjs
+// (Story #198). `ghApiJson` surfaces the HTTP status on any error; the
+// per-consumer fetchers below swallow ONLY a 404 into an "absent" sentinel and
+// rethrow every other error so the strict gate fails CLOSED.
 // ---------------------------------------------------------------------------
 
-/**
- * Run `gh api <path>` and parse the JSON response.
- *
- * @param {string} apiPath  e.g. "repos/owner/repo/releases/latest".
- * @param {(args: string[]) => string} runGh  Injectable runner (default execFileSync gh).
- * @returns {unknown}
- */
-function ghApiJson(apiPath, runGh) {
-  const raw = runGh(["api", apiPath, "-H", "Accept: application/vnd.github+json"]);
-  return JSON.parse(raw);
-}
-
-/**
- * Default gh runner — shells out to the `gh` CLI.
- * @param {string[]} args
- * @returns {string}
- */
-export function defaultGhRunner(args) {
-  return execFileSync("gh", args, {
-    encoding: "utf-8",
-    maxBuffer: 32 * 1024 * 1024,
-  });
-}
-
 /**
  * Resolve the latest platform release tag, the commit SHA that tag points at,
  * and the release `published_at` timestamp (used to evaluate the
@@ -798,8 +720,15 @@ export function resolveLatestRelease(platformRepo, runGh) {
   let release;
   try {
     release = ghApiJson(`repos/${platformRepo}/releases/latest`, runGh);
-  } catch {
-    return { tag: null, sha: null, publishedAt: null };
+  } catch (err) {
+    // A genuine 404 means the platform repo has no published release yet — a
+    // legitimate "no lag baseline" state, so return nulls. Every other error
+    // (5xx / 403 rate-limit / transport) must propagate so the strict gate
+    // fails CLOSED rather than silently classifying the whole fleet as
+    // lagState "unknown" (drift=false). Mirrors the per-consumer fetchers'
+    // fail-closed contract in scripts/lib/gh-json.mjs.
+    if (isNotFound(err)) return { tag: null, sha: null, publishedAt: null };
+    throw err;
   }
   const tag = release && typeof release.tag_name === "string" ? release.tag_name : null;
   const publishedAt =
@@ -820,8 +749,12 @@ export function resolveLatestRelease(platformRepo, runGh) {
       sha = tagObj?.object?.sha ?? sha;
     }
     return { tag, sha: sha ? sha.toLowerCase() : null, publishedAt };
-  } catch {
-    return { tag, sha: null, publishedAt };
+  } catch (err) {
+    // Same fail-closed contract as the release fetch above: a 404 (tag
+    // vanished) degrades to sha:null, but a transient/auth error propagates
+    // so the strict gate fails closed instead of suppressing lag detection.
+    if (isNotFound(err)) return { tag, sha: null, publishedAt };
+    throw err;
   }
 }
 
@@ -842,8 +775,13 @@ export function fetchConsumerWorkflows(repo, branch, runGh) {
       `repos/${repo}/contents/.github/workflows?ref=${encodeURIComponent(branch)}`,
       runGh,
     );
-  } catch {
-    return [];
+  } catch (err) {
+    // A 404 genuinely means the consumer has no `.github/workflows/` dir —
+    // return "no files". Any OTHER error (403 / 429 / 5xx / transport) must
+    // fail CLOSED: rethrow so buildReport records an `error` row for this
+    // consumer instead of silently reading it as "no pins → no drift".
+    if (isNotFound(err)) return [];
+    throw err;
   }
   if (!Array.isArray(listing)) return [];
   const files = [];
@@ -860,7 +798,10 @@ export function fetchConsumerWorkflows(repo, branch, runGh) {
         if (blob?.encoding === "base64" && typeof blob.content === "string") {
           text = Buffer.from(blob.content, "base64").toString("utf-8");
         }
-      } catch {
+      } catch (err) {
+        // Same fail-closed rule for the per-file blob fetch: a missing blob
+        // (404) yields empty text; any other failure propagates.
+        if (!isNotFound(err)) throw err;
         text = "";
       }
     }
@@ -888,8 +829,13 @@ export function fetchConsumerPackageJson(repo, branch, runGh) {
       `repos/${repo}/contents/package.json?ref=${encodeURIComponent(branch)}`,
       runGh,
     );
-  } catch {
-    return null;
+  } catch (err) {
+    // A 404 is the legitimate "no package.json / doesn't adopt the npm config
+    // package" case → treat as absent (null). Any OTHER error must fail
+    // CLOSED: rethrow so buildReport records an `error` row rather than
+    // silently reading the consumer as "npm absent → no drift".
+    if (isNotFound(err)) return null;
+    throw err;
   }
   if (obj && obj.encoding === "base64" && typeof obj.content === "string") {
     return Buffer.from(obj.content, "base64").toString("utf-8");
@@ -910,8 +856,13 @@ export function resolveBranch(consumer, runGh) {
   try {
     const repoMeta = ghApiJson(`repos/${consumer.repo}`, runGh);
     return repoMeta?.default_branch || "main";
-  } catch {
-    return "main";
+  } catch (err) {
+    // A 404 means the repo (or our access to it) is genuinely gone — fall back
+    // to "main" as before. Any OTHER error (403 / 429 / 5xx / transport) must
+    // fail CLOSED: rethrow so buildReport records an `error` row instead of
+    // guessing a branch and silently reporting "no drift".
+    if (isNotFound(err)) return "main";
+    throw err;
   }
 }
 

package/scripts/check-pin-drift.test.mjs

@@ -35,8 +35,10 @@ import {
   parseDurationMs,
   parseSemver,
   renderReport,
+  resolveLatestRelease,
   runCli,
 } from "./check-pin-drift.mjs";
+import { httpStatusOf, isNotFound } from "./lib/gh-json.mjs";
 
 // ---------------------------------------------------------------------------
 // parseSemver
@@ -384,9 +386,29 @@ function pkgJson(version) {
   return { name: "consumer", devDependencies };
 }
 
+/**
+ * Build an error shaped like the one `execFileSync('gh', …)` throws when
+ * `gh api` exits non-zero: the HTTP status is carried in the `(HTTP <code>)`
+ * marker `gh` writes to stderr. This is exactly what the fail-closed seam
+ * (`httpStatusOf` / `isNotFound` in scripts/lib/gh-json.mjs) parses.
+ *
+ * @param {number} status  HTTP status code (e.g. 404, 500).
+ * @param {string} [label]  Human label gh prints before the marker.
+ * @returns {Error}
+ */
+function ghHttpError(status, label = "Error") {
+  const err = new Error(`Command failed: gh api …\ngh: ${label} (HTTP ${status})`);
+  // execFileSync surfaces the CLI's stderr on `.stderr`; the status parser
+  // reads it there first.
+  err.stderr = `gh: ${label} (HTTP ${status})\n`;
+  return err;
+}
+
 /**
  * Build an injectable gh runner from a per-repo fixture map:
  *   { "owner/repo": { workflowSha, npm: string | null | "throw" } }
+ * `npm: "throw"` simulates a 404 on the package.json fetch (the legitimate
+ * "consumer has no package.json" case → treated as absent).
  */
 function makeRunGh(fixtures) {
   return (args) => {
@@ -407,7 +429,8 @@ function makeRunGh(fixtures) {
         ]);
       }
       if (path === `repos/${repo}/contents/package.json?ref=main`) {
-        if (cfg.npm === "throw") throw new Error("404 Not Found");
+        // A 404 on package.json is the "no npm config package" case → absent.
+        if (cfg.npm === "throw") throw ghHttpError(404, "Not Found");
         return JSON.stringify({ encoding: "base64", content: b64(pkgJson(cfg.npm)) });
       }
     }
@@ -548,13 +571,20 @@ test("buildReport: a stale pin literal beyond uses: is drift (Story #110)", () =
   assert.match(text, /STALE PIN LITERAL/);
 });
 
-test("fetchConsumerPackageJson returns null when the file is missing", () => {
+test("fetchConsumerPackageJson returns null when the file is missing (404)", () => {
   const runGh = () => {
-    throw new Error("404");
+    throw ghHttpError(404, "Not Found");
   };
   assert.equal(fetchConsumerPackageJson("o/x", "main", runGh), null);
 });
 
+test("fetchConsumerPackageJson rethrows a non-404 error (fail closed)", () => {
+  const runGh = () => {
+    throw ghHttpError(500, "Server Error");
+  };
+  assert.throws(() => fetchConsumerPackageJson("o/x", "main", runGh), /HTTP 500/);
+});
+
 // ---------------------------------------------------------------------------
 // CLI: --json, --strict, exit codes
 // ---------------------------------------------------------------------------
@@ -610,6 +640,148 @@ test("runCli --strict exits 1 when drift is present", () => {
   }
 });
 
+// ---------------------------------------------------------------------------
+// Fail-closed on a non-404 gh error (Story #198) — the fail-open the strict
+// gate must not have. Historically EVERY gh error was swallowed into an
+// "absent" sentinel, so a 500/403/network blip read as "no drift" and
+// `--strict` exited 0. The seam now surfaces the HTTP status: only a 404 is
+// swallowed; every other error propagates to an `error` row.
+// ---------------------------------------------------------------------------
+
+const ERROR_CONFIG = {
+  platformRepo: PLATFORM,
+  consumers: [{ name: "flaky", repo: "o/flaky", branch: "main" }],
+};
+
+/**
+ * A gh runner whose workflow-listing call fails. `status` selects the HTTP
+ * code so a single helper drives both the 404 (swallow → absent) and non-404
+ * (rethrow → error row) cases.
+ */
+function makeFailingRunGh(status) {
+  return (args) => {
+    const path = args[1];
+    if (path === `repos/${PLATFORM}/releases/latest`) {
+      return JSON.stringify({ tag_name: TAG });
+    }
+    if (path === `repos/${PLATFORM}/git/ref/tags/${TAG}`) {
+      return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
+    }
+    if (path === "repos/o/flaky/contents/.github/workflows?ref=main") {
+      throw ghHttpError(status, status === 404 ? "Not Found" : "Server Error");
+    }
+    if (path === "repos/o/flaky/contents/package.json?ref=main") {
+      return JSON.stringify({ encoding: "base64", content: b64(pkgJson("1.4.0")) });
+    }
+    throw new Error(`unexpected gh api path: ${path}`);
+  };
+}
+
+test("httpStatusOf / isNotFound parse the HTTP status out of a gh error", () => {
+  assert.equal(httpStatusOf(ghHttpError(404)), 404);
+  assert.equal(httpStatusOf(ghHttpError(500)), 500);
+  assert.equal(isNotFound(ghHttpError(404)), true);
+  assert.equal(isNotFound(ghHttpError(500)), false);
+  // A bare error with no parseable status is NOT a 404 → must fail closed.
+  assert.equal(httpStatusOf(new Error("socket hang up")), null);
+  assert.equal(isNotFound(new Error("socket hang up")), false);
+});
+
+test("buildReport: a non-404 gh error yields an `error` row (fail closed)", () => {
+  const report = buildReport(ERROR_CONFIG, makeFailingRunGh(500));
+  const r = byName(report, "flaky");
+  assert.notEqual(r.error, undefined);
+  assert.match(r.error, /HTTP 500/);
+  assert.equal(r.drift, false); // drift itself is false…
+  // …but hasDrift counts the error row, so the report is NOT clean.
+  assert.equal(hasDrift(report), true);
+});
+
+test("buildReport: a 404-shaped gh error is classified no-pins, drift false", () => {
+  const report = buildReport(ERROR_CONFIG, makeFailingRunGh(404));
+  const r = byName(report, "flaky");
+  assert.equal(r.error, undefined);
+  assert.equal(r.verdict.lagState, "no-pins");
+  assert.equal(r.drift, false);
+  assert.equal(hasDrift(report), false);
+});
+
+test("resolveLatestRelease rethrows a non-404 error on releases/latest (fail closed)", () => {
+  // A transient 5xx/403 on the platform's own release resolution must NOT be
+  // swallowed into sha:null — that would classify the whole fleet as lagState
+  // "unknown" (drift=false) and silently pass the strict gate.
+  const runGh = (args) => {
+    if (args[1] === `repos/${PLATFORM}/releases/latest`) {
+      throw ghHttpError(500, "Server Error");
+    }
+    throw new Error(`unexpected gh api path: ${args[1]}`);
+  };
+  assert.throws(() => resolveLatestRelease(PLATFORM, runGh), /HTTP 500/);
+});
+
+test("resolveLatestRelease returns nulls on a 404 (repo has no release yet)", () => {
+  const runGh = (args) => {
+    if (args[1] === `repos/${PLATFORM}/releases/latest`) {
+      throw ghHttpError(404, "Not Found");
+    }
+    throw new Error(`unexpected gh api path: ${args[1]}`);
+  };
+  assert.deepEqual(resolveLatestRelease(PLATFORM, runGh), {
+    tag: null,
+    sha: null,
+    publishedAt: null,
+  });
+});
+
+test("resolveLatestRelease rethrows a non-404 error on the tag→sha deref (fail closed)", () => {
+  const runGh = (args) => {
+    if (args[1] === `repos/${PLATFORM}/releases/latest`) {
+      return JSON.stringify({ tag_name: TAG });
+    }
+    if (args[1] === `repos/${PLATFORM}/git/ref/tags/${TAG}`) {
+      throw ghHttpError(503, "Service Unavailable");
+    }
+    throw new Error(`unexpected gh api path: ${args[1]}`);
+  };
+  assert.throws(() => resolveLatestRelease(PLATFORM, runGh), /HTTP 503/);
+});
+
+test("runCli --strict exits non-zero on a non-404 gh error (fail closed)", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-failclosed-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(ERROR_CONFIG));
+  try {
+    const code = runCli({
+      argv: ["--config", p, "--strict"],
+      runGh: makeFailingRunGh(500),
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 1);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});
+
+test("runCli --strict exits 0 on a 404-shaped gh error (genuine absence)", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-404-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(ERROR_CONFIG));
+  try {
+    const code = runCli({
+      argv: ["--config", p, "--strict"],
+      runGh: makeFailingRunGh(404),
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 0);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // minimumReleaseAge hold window — the false-positive guard (Story #107)
 // ---------------------------------------------------------------------------