parche-cli 0.1.1 → 0.5.1

package/src/sdk-diff/upgrades.js

@@ -0,0 +1,107 @@
+// `parche scan --upgrades` y `parche diff`: para cada SDK de npm que el repo usa, compara la versión
+// instalada con la última publicada y dice qué operaciones del repo cambian o desaparecen.
+import fs from 'node:fs';
+import path from 'node:path';
+import { extractSurface } from './surface.js';
+import { diffSurfaces, affectedOperations, unverifiedOperations, dedupeChanges } from './compare.js';
+import { compareVersions } from './registry.js';
+
+const readJson = (p) => {
+  try {
+    return JSON.parse(fs.readFileSync(p, 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+// Versión instalada: node_modules → package-lock.json → la base del rango declarado ("^3.2.1" → 3.2.1).
+// Si la base no existe en el registry, la más alta de la misma versión mayor. → { version, from } | null
+export function installedVersion(root, pkg, declared, meta) {
+  const nm = readJson(path.join(root, 'node_modules', pkg, 'package.json'));
+  if (nm?.version) return { version: nm.version, from: 'node_modules' };
+  const lock = readJson(path.join(root, 'package-lock.json'));
+  const locked = lock?.packages?.[`node_modules/${pkg}`]?.version || lock?.dependencies?.[pkg]?.version;
+  if (locked) return { version: locked, from: 'package-lock.json' };
+  const m = String(declared || '').match(/(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!m) return null;
+  const base = `${m[1]}.${m[2] || 0}.${m[3] || 0}`;
+  if (!meta || meta.versions[base]) return { version: base, from: 'package.json' };
+  const sameMajor = Object.keys(meta.versions).filter((v) => v.split('.')[0] === m[1] && !v.includes('-')).sort(compareVersions);
+  return sameMajor.length ? { version: sameMajor[sameMajor.length - 1], from: 'package.json' } : null;
+}
+
+// "latest", "4" o "4.1" → la versión exacta más alta que corresponde, según el registry.
+export function resolveSpec(meta, spec) {
+  if (spec === 'latest') return meta['dist-tags']?.latest || null;
+  if (meta.versions[spec]) return spec;
+  const matches = Object.keys(meta.versions).filter((v) => !v.includes('-') && v.startsWith(`${spec}.`)).sort(compareVersions);
+  return matches.length ? matches[matches.length - 1] : null;
+}
+
+// Diff completo entre dos versiones de un paquete (acepta "latest" y versiones parciales).
+export async function diffVersions(registry, pkg, fromSpec, toSpec) {
+  const meta = await registry.metadata(pkg);
+  const from = resolveSpec(meta, fromSpec);
+  const to = resolveSpec(meta, toSpec);
+  if (!from || !to) return { pkg, from: fromSpec, to: toSpec, error: `${pkg}: no existe la versión ${!from ? fromSpec : toSpec} en el registry.` };
+  const [ta, tb] = await Promise.all([registry.types(pkg, from), registry.types(pkg, to)]);
+  if (!ta || !tb) return { pkg, from, to, error: `No hay tipos (.d.ts) para ${!ta ? from : to}: no se puede comparar.` };
+  const sa = extractSurface({ files: ta.files, entry: ta.entry, pkgName: pkg });
+  const sb = extractSurface({ files: tb.files, entry: tb.entry, pkgName: pkg });
+  const all = diffSurfaces(sa, sb);
+  // changes: para mostrar (sin repetidos); allChanges: para cruzar con lo que usa el repo.
+  return { pkg, from, to, typesFrom: ta.source, typesTo: tb.source, before: sa, changes: dedupeChanges(all), allChanges: all };
+}
+
+// Para cada SDK de npm del inventario que tiene operaciones: versión instalada vs última.
+export async function checkUpgrades(inventory, root, registry) {
+  const results = [];
+  const sdks = inventory.apis.filter((a) => a.kind === 'sdk' && a.ecosystem === 'npm' && a.operations.length);
+  for (const api of sdks) {
+    const base = { package: api.package, provider: api.provider };
+    try {
+      const meta = await registry.metadata(api.package);
+      const latest = meta['dist-tags']?.latest;
+      const installed = installedVersion(root, api.package, api.version, meta);
+      if (!latest || !installed) {
+        results.push({ ...base, status: 'sin-version', installed: installed?.version || null, latest: latest || null });
+        continue;
+      }
+      if (compareVersions(installed.version, latest) >= 0) {
+        results.push({ ...base, status: 'al-dia', installed: installed.version, latest });
+        continue;
+      }
+      const d = await diffVersions(registry, api.package, installed.version, latest);
+      if (d.error) {
+        results.push({ ...base, status: 'sin-tipos', installed: installed.version, latest, error: d.error });
+        continue;
+      }
+      const ops = api.operations.map((o) => o.op);
+      const affected = affectedOperations(d.allChanges, ops, d.before).map((a) => ({
+        ...a, locations: api.operations.find((o) => o.op === a.op).locations,
+      }));
+      const unverified = unverifiedOperations(ops, d.before);
+      const status = affected.length ? 'afectado' : unverified.length === ops.length ? 'sin-verificar' : 'sin-impacto';
+      results.push({ ...base, status, installed: installed.version, installedFrom: installed.from, latest,
+        totalChanges: d.changes.length, affected, unverified });
+    } catch (err) {
+      const notPublished = /respondió 404/.test(err.message);
+      results.push({ ...base, status: notPublished ? 'no-publicado' : 'error',
+        error: notPublished ? `${api.package} no está publicado en el registry de npm (¿paquete privado o interno?).` : err.message });
+    }
+  }
+  return results;
+}
+
+// Hallazgos detect-only (en castellano) para el reporte.
+export function upgradeFindings(results) {
+  const findings = [];
+  for (const r of results.filter((x) => x.status === 'afectado')) {
+    for (const a of r.affected) {
+      const where = a.locations[0];
+      findings.push({ pack: 'sdk.upgrades', file: where.file, line: where.line, status: 'detect-only',
+        message: `${r.package} ${r.installed} → ${r.latest}: ${a.changes.map((c) => c.message).join(' ')}` });
+    }
+  }
+  return findings;
+}

package/src/verify.js

@@ -3,6 +3,55 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { parseCheck } from './ast.js';
+import { isPhp } from './php.js';
+
+const readJson = (root, name) => {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(root, name), 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+// Tests que corresponden a los archivos modificados: `npm test` para JS/TS; para PHP,
+// `composer test` o, si no hay script, vendor/bin/phpunit. Si no hay ninguno, queda el chequeo de sintaxis.
+export function testCommands(root, changedFiles) {
+  const cmds = [];
+  const pkg = readJson(root, 'package.json');
+  if (changedFiles.some((f) => !isPhp(f)) && pkg?.scripts?.test) {
+    cmds.push({ label: 'npm test', cmd: 'npm', args: ['test', '--silent'] });
+  }
+  if (changedFiles.some(isPhp)) {
+    const composer = readJson(root, 'composer.json');
+    if (composer?.scripts?.test) cmds.push({ label: 'composer test', cmd: 'composer', args: ['test'] });
+    else if (fs.existsSync(path.join(root, 'vendor', 'bin', 'phpunit'))) {
+      cmds.push({ label: 'vendor/bin/phpunit', cmd: path.join('vendor', 'bin', 'phpunit'), args: [] });
+    }
+  }
+  return cmds;
+}
+
+// Workflows del repo que corren en cada pull request: si Parche no corrió los tests, el PR dice dónde se corren.
+// `on: [push, pull_request]`, `on:` + `pull_request:` o `- pull_request`. No cuenta pull_request_target:
+// corre el código de la rama base, no el del PR.
+const ON_PULL_REQUEST = /^\s*(['"]?on['"]?\s*:.*\bpull_request\b|-?\s*pull_request\b\s*(:|#|$))/m;
+
+export function prWorkflows(root) {
+  const dir = path.join(root, '.github', 'workflows');
+  let names = [];
+  try {
+    names = fs.readdirSync(dir).filter((f) => /\.ya?ml$/i.test(f)).sort();
+  } catch {
+    return [];
+  }
+  return names.filter((f) => {
+    try {
+      return ON_PULL_REQUEST.test(fs.readFileSync(path.join(dir, f), 'utf8'));
+    } catch {
+      return false;
+    }
+  }).map((f) => `.github/workflows/${f}`);
+}
 
 export function verify(root, changedFiles, { runTests = false } = {}) {
   const errors = [];
@@ -15,16 +64,23 @@ export function verify(root, changedFiles, { runTests = false } = {}) {
   }
   const result = { parse: { ok: errors.length === 0, errors } };
   if (runTests) {
-    const pkgPath = path.join(root, 'package.json');
-    const pkg = fs.existsSync(pkgPath) ? JSON.parse(fs.readFileSync(pkgPath, 'utf8')) : {};
-    if (!pkg.scripts || !pkg.scripts.test) {
-      result.tests = { ok: true, skipped: true };
+    const cmds = testCommands(root, changedFiles);
+    if (!cmds.length) {
+      result.tests = { ok: true, skipped: true, commands: [] };
     } else {
-      // En Windows npm es npm.cmd y Node solo lo ejecuta a través de un shell.
-      const r = spawnSync('npm', ['test', '--silent'], { cwd: root, encoding: 'utf8', timeout: 300000, shell: process.platform === 'win32' });
-      const output = (r.stdout || '') + (r.stderr || '') + (r.error ? `\n${r.error.message}` : '');
-      result.tests = { ok: r.status === 0, output: output.slice(-2000) };
+      let ok = true;
+      let output = '';
+      for (const c of cmds) {
+        // En Windows npm, composer y phpunit son .cmd/.bat y Node solo los ejecuta a través de un shell.
+        const r = spawnSync(c.cmd, c.args, { cwd: root, encoding: 'utf8', timeout: 300000, shell: process.platform === 'win32' });
+        output += `$ ${c.label}\n${r.stdout || ''}${r.stderr || ''}${r.error ? `\n${r.error.message}` : ''}\n`;
+        if (r.status !== 0) { ok = false; break; }
+      }
+      result.tests = { ok, commands: cmds.map((c) => c.label), output: output.slice(-2000) };
     }
+  } else {
+    // Sin --verify, Parche no ejecuta código del repo (por ejemplo, en un repo de terceros): se dice, no se oculta.
+    result.tests = { ok: true, notRun: true, ci: prWorkflows(root) };
   }
   result.ok = result.parse.ok && (!result.tests || result.tests.ok);
   return result;