reposets 0.4.2 → 1.0.0

package/sync/phases/resource.js

@@ -0,0 +1,149 @@
+import { Effect, Redacted } from "effect";
+import { readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+
+//#region src/sync/phases/resource.ts
+/**
+* Resolve one secret or variable group into named values.
+*
+* @remarks
+* The three kinds are exclusive by schema, so this branches once rather than
+* merging. Values come back {@link Redacted.Redacted} regardless of kind — a
+* variable is not secret, but a uniform return type means no call site has to
+* decide, and unwrapping stays a deliberate `Redacted.value` at the write.
+*
+* `value` entries may be a string or arbitrary JSON. A string is used as-is and
+* anything else is `JSON.stringify`d, which is what v3 did and what the config
+* schema's `string | Json` implies — GitHub stores a string either way.
+*
+* `file` paths resolve against `ctx.configDir` — the directory the config was
+* loaded from, threaded by the engine — never against the working directory. A
+* relative path resolved against `cwd` would read a different file depending on
+* where the CLI happened to be invoked, silently, and into a secret.
+*
+* A file that cannot be read is reported with its **path**, never its contents:
+* this runs on the secret-loading path, and the error is the most likely thing
+* to reach a log.
+*/
+const resolveOne = (group, label, ctx) => {
+	const entries = /* @__PURE__ */ new Map();
+	const errors = [];
+	if ("value" in group) {
+		for (const [name, value] of Object.entries(group.value)) entries.set(name, Redacted.make(typeof value === "string" ? value : JSON.stringify(value), { label: name }));
+		return {
+			entries,
+			errors
+		};
+	}
+	if ("resolved" in group) {
+		for (const [name, credentialLabel] of Object.entries(group.resolved)) {
+			const value = ctx.credentials.get(credentialLabel);
+			if (value === void 0) {
+				errors.push({
+					context: `${label}.${name}`,
+					message: `credential label '${credentialLabel}' is not defined in the active profile's [resolve] section`
+				});
+				continue;
+			}
+			entries.set(name, value);
+		}
+		return {
+			entries,
+			errors
+		};
+	}
+	for (const [name, filePath] of Object.entries(group.file)) {
+		const fullPath = isAbsolute(filePath) ? filePath : resolve(ctx.configDir, filePath);
+		try {
+			entries.set(name, Redacted.make(readFileSync(fullPath, "utf-8").trim(), { label: name }));
+		} catch (error) {
+			errors.push({
+				context: `${label}.${name}`,
+				message: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	return {
+		entries,
+		errors
+	};
+};
+/**
+* Resolve every group a scope references, later groups winning.
+*
+* @remarks
+* Last-write-wins across groups matches how every other referenced section
+* composes. A reference with no matching definition is skipped rather than
+* reported — `danglingReferences` owns cross-reference checking, and duplicating
+* it here would report one mistake twice with less context.
+*
+* @public
+*/
+const resolveGroups = (refs, definitions, ctx) => {
+	const entries = /* @__PURE__ */ new Map();
+	const errors = [];
+	for (const ref of refs) {
+		const group = definitions[ref];
+		if (group === void 0) continue;
+		const outcome = resolveOne(group, ref, ctx);
+		for (const [name, value] of outcome.entries) entries.set(name, value);
+		errors.push(...outcome.errors);
+	}
+	return {
+		entries,
+		errors
+	};
+};
+/**
+* The names a set of groups declares, without resolving any value.
+*
+* @remarks
+* `cleanup` needs to know *which* names a config declares so it can delete the
+* rest. It has no use for the values, and reading them would be actively wrong:
+* a `{ file }` group would open every secret file — on the path whose whole job
+* is deletion — and a missing file would report an error about a resource
+* cleanup was only ever going to keep.
+*
+* All three kinds carry their names as keys, so the names are available without
+* touching a filesystem or a credential.
+*
+* @public
+*/
+const declaredNames = (refs, definitions) => {
+	const names = /* @__PURE__ */ new Set();
+	for (const ref of refs) {
+		const group = definitions[ref];
+		if (group === void 0) continue;
+		const entries = "value" in group ? group.value : "resolved" in group ? group.resolved : group.file;
+		for (const name of Object.keys(entries)) names.add(name);
+	}
+	return names;
+};
+/**
+* Read something, keeping the failure's own words if it fails.
+*
+* @remarks
+* The alternative — `Effect.orElseSucceed(() => Option.none())` — discards a
+* structured `GitHubError` and leaves the call site inventing a generic string.
+* A real run showed why that matters: a 403 from a mis-scoped token, a 404 for
+* a deleted repository and a network failure all printed "could not read
+* current state", which tells a user nothing about what to do. `GitHubError`
+* already carries `kind`, `status` and `reason`, and its `message` renders
+* them; this keeps that instead of throwing it away.
+*
+* @public
+*/
+const read = (effect) => effect.pipe(Effect.map((value) => ({ value })), Effect.catch((error) => Effect.succeed({ failed: error.message ?? String(error) })));
+/**
+* Wrap an operation so a failure becomes a reportable error rather than a
+* failed run.
+*
+* @public
+*/
+const capture = (context, effect) => effect.pipe(Effect.as(void 0), Effect.catch((error) => Effect.succeed({
+	context,
+	message: error.message ?? String(error)
+})));
+
+//#endregion
+export { capture, declaredNames, read, resolveGroups };

package/sync/phases/rulesets.js

@@ -0,0 +1,186 @@
+import { buildRulesetPayload } from "../../schemas/ruleset.js";
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { RepoCache } from "../../store/RepoCache.js";
+import { capture, read } from "./resource.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option, Redacted } from "effect";
+import { Ruleset } from "@effected/github";
+
+//#region src/sync/phases/rulesets.ts
+const KIND = "ruleset";
+/** Stands in for a ruleset that is not on the repository at all. */
+const ABSENT = " absent";
+/**
+* Substitute `{ resolved }` references with credential values, in place.
+*
+* @remarks
+* A ruleset can carry `{ resolved: "LABEL" }` wherever a numeric id is wanted —
+* an integration id on a status check, a repository id on a required workflow.
+* The substitution walks the decoded ruleset because the references can appear
+* at any depth, and the shape is a discriminated union rather than a flat
+* record.
+*
+* Values come from `ctx.credentials` and are numeric ids, not secrets. They are
+* unwrapped here because they end up in the API payload as numbers; nothing
+* secret should be reachable this way, and a config that puts one there has
+* mis-declared it.
+*/
+const substituteResolved = (node, ctx, missing) => {
+	if (Array.isArray(node)) return node.map((item) => substituteResolved(item, ctx, missing));
+	if (typeof node !== "object" || node === null) return node;
+	const record = node;
+	const label = record.resolved;
+	if (typeof label === "string" && Object.keys(record).length === 1) {
+		const value = ctx.credentials.get(label);
+		if (value === void 0) {
+			missing.add(label);
+			return node;
+		}
+		const text = Redacted.value(value);
+		const asNumber = Number(text);
+		return text.trim() === "" || Number.isNaN(asNumber) ? text : asNumber;
+	}
+	const out = {};
+	for (const [key, child] of Object.entries(record)) out[key] = substituteResolved(child, ctx, missing);
+	return out;
+};
+/**
+* Repository rulesets.
+*
+* @remarks
+* Drift here is **presence-level**, not value-level, and the reason is worth
+* stating because it differs from both neighbours. `GET /rulesets` returns
+* *summaries* — name, id, source type — not the rules themselves; the full
+* configuration needs `GET /rulesets/{id}`, one request per ruleset per
+* repository. So a deleted ruleset is detected and restored, and one edited in
+* the UI is not.
+*
+* That is a cost decision rather than an API limit, unlike `secrets` where no
+* value exists to read. Lifting it means a read per ruleset; worth doing if
+* ruleset drift turns out to matter in practice, and cheap to change here since
+* only `livePrint` would move.
+*
+* **A renamed ruleset creates a second one rather than renaming the first.**
+* GitHub identifies a ruleset by a numeric id assigned at creation, and the
+* config has only a name — so `syncRuleset` matches on name and cannot tell a
+* rename from a new ruleset. That is v3's behaviour, ported deliberately; the
+* `cleanup` phase is what removes the orphan. Fixing it properly needs the
+* applied-state table to remember the id, which is a design change rather than
+* a port.
+*
+* @public
+*/
+const rulesetsPhase = Effect.gen(function* () {
+	const rulesets = yield* Ruleset;
+	const cache = yield* RepoCache;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	/** Resolve `{ team }` bypass actors to numeric ids, through the cache. */
+	const resolveBypassActors = (ctx, ruleset) => Effect.gen(function* () {
+		const actors = ruleset.bypass_actors;
+		if (actors === void 0) return {
+			ruleset,
+			errors: []
+		};
+		const errors = [];
+		const resolved = [];
+		for (const actor of actors) {
+			const id = actor.actor_id;
+			if (typeof id === "object" && id !== null && "resolved" in id) {
+				const slug = String(id.resolved);
+				const outcome = yield* read(cache.teamId(ctx.owner, slug, rulesets.teamId(slug)));
+				if ("failed" in outcome) {
+					errors.push({
+						context: `resolve team '${slug}'`,
+						message: outcome.failed
+					});
+					continue;
+				}
+				resolved.push({
+					...actor,
+					actor_id: outcome.value
+				});
+				continue;
+			}
+			resolved.push(actor);
+		}
+		return {
+			ruleset: {
+				...ruleset,
+				bypass_actors: resolved
+			},
+			errors
+		};
+	});
+	const run = (ctx) => Effect.gen(function* () {
+		const refs = ctx.config.groups[ctx.group]?.rulesets ?? [];
+		if (refs.length === 0) return {
+			changes: [],
+			errors: []
+		};
+		const changes = [];
+		const errors = [];
+		const listing = yield* read(rulesets.list());
+		if ("failed" in listing) return {
+			changes,
+			errors: [{
+				context: "list rulesets",
+				message: listing.failed
+			}]
+		};
+		const live = new Map(listing.value.filter((entry) => entry.source_type !== "Organization").map((entry) => [entry.name, entry]));
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		for (const ref of refs) {
+			const configured = ctx.config.rulesets[ref];
+			if (configured === void 0) continue;
+			const missing = /* @__PURE__ */ new Set();
+			const substituted = substituteResolved(configured, ctx, missing);
+			for (const label of missing) errors.push({
+				context: `ruleset ${configured.name}`,
+				message: `credential label '${label}' is not defined in the active profile's [resolve] section`
+			});
+			const withActors = yield* resolveBypassActors(ctx, substituted);
+			errors.push(...withActors.errors);
+			const payload = buildRulesetPayload(withActors.ruleset);
+			const desiredPrint = fingerprint(payload);
+			const baseline = Option.map(lookup(baselines, KIND, payload.name), (record) => record.fingerprint);
+			const livePrint = live.has(payload.name) ? Option.getOrElse(baseline, () => fingerprint(ABSENT)) : fingerprint(ABSENT);
+			const decision = decide(desiredPrint, livePrint, baseline);
+			if (isDrift(decision)) yield* logger.driftDetected(KIND, payload.name, decision);
+			if (!needsApply(decision)) continue;
+			if (!ctx.dryRun) {
+				const failure = yield* capture(`ruleset ${payload.name}`, rulesets.upsert(payload));
+				if (failure !== void 0) {
+					errors.push(failure);
+					continue;
+				}
+				yield* applied.record({
+					repo: ctx.slug,
+					kind: KIND,
+					name: payload.name
+				}, desiredPrint, ctx.runId).pipe(Effect.ignore);
+			}
+			yield* logger.syncOperation("sync", KIND, payload.name);
+			changes.push({
+				repo: ctx.slug,
+				kind: KIND,
+				name: payload.name,
+				action: isDrift(decision) ? "drift-overwritten" : "updated"
+			});
+		}
+		return {
+			changes,
+			errors
+		};
+	});
+	return {
+		name: "rulesets",
+		appliesTo: (ctx) => (ctx.config.groups[ctx.group]?.rulesets?.length ?? 0) > 0,
+		run
+	};
+});
+
+//#endregion
+export { rulesetsPhase };

package/sync/phases/secrets.js

@@ -0,0 +1,138 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { capture, resolveGroups } from "./resource.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option, Redacted } from "effect";
+import { RepositorySecret } from "@effected/github";
+
+//#region src/sync/phases/secrets.ts
+const KIND = "secret";
+/** The three repository-level stores, each with its own keys and its own paths. */
+const SCOPES = [
+	"actions",
+	"dependabot",
+	"codespaces"
+];
+/**
+* Stands in for a secret that is not on the repository at all.
+*
+* @remarks
+* Absence needs a fingerprint distinct from every real value, so a secret
+* someone deleted out of band compares unequal to what we last applied and gets
+* restored rather than silently matching.
+*/
+const ABSENT = "\0absent";
+/** A scoped secret's drift key. Environment secrets are namespaced by environment. */
+const resourceName = (scope, name) => `${scope}/${name}`;
+/**
+* Repository and environment secrets.
+*
+* @remarks
+* **Drift here is presence-only, and unlike `variables` that is not a
+* limitation we can lift.** GitHub never returns a secret's value from any
+* endpoint — that is the point of a secret store — so a secret edited in the UI
+* is indistinguishable from one we wrote ourselves. What is detectable is a
+* secret that has been *deleted*: it vanishes from the listing, compares
+* unequal to the baseline, and is restored.
+*
+* That makes the live comparison here deliberately different from the one in
+* `variables`: a present secret is taken to match the baseline, because there
+* is nothing else to compare it against. `variables` used to do the same thing
+* and it was a bug there — the value was available and being discarded. It is
+* not available here. **Do not "fix" this to match.**
+*
+* Values stay {@link Redacted.Redacted} the whole way through. `Redacted.value`
+* appears exactly once per write, at the call that encrypts, and the sealed box
+* is what crosses the wire — the plaintext never reaches a log line, an error,
+* or the journal, which records only names.
+*
+* @public
+*/
+const secretsPhase = Effect.gen(function* () {
+	const secrets = yield* RepositorySecret;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	const run = (ctx) => Effect.gen(function* () {
+		const scopes = ctx.config.groups[ctx.group]?.secrets;
+		if (scopes === void 0) return {
+			changes: [],
+			errors: []
+		};
+		const changes = [];
+		const errors = [];
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		/**
+		* Sync one store.
+		*
+		* @param environment - absent for a repository-level scope, present for
+		* an environment's own secret store.
+		*/
+		const syncStore = (entries, scope, environment) => Effect.gen(function* () {
+			if (entries.size === 0) return;
+			const label = environment === void 0 ? scope : `env:${environment}`;
+			const live = yield* (environment === void 0 ? secrets.list(scope) : secrets.listForEnvironment(environment)).pipe(Effect.map((list) => Option.some(new Set(list.map((entry) => entry.name)))), Effect.orElseSucceed(() => Option.none()));
+			if (Option.isNone(live)) {
+				errors.push({
+					context: `list secrets (${label})`,
+					message: "could not read current secrets"
+				});
+				return;
+			}
+			for (const [name, value] of entries) {
+				const resource = resourceName(label, name);
+				const desiredPrint = fingerprint(Redacted.value(value));
+				const baseline = Option.map(lookup(baselines, KIND, resource), (record) => record.fingerprint);
+				const livePrint = live.value.has(name) ? Option.getOrElse(baseline, () => fingerprint(ABSENT)) : fingerprint(ABSENT);
+				const decision = decide(desiredPrint, livePrint, baseline);
+				if (isDrift(decision)) yield* logger.driftDetected(KIND, resource, decision);
+				if (!needsApply(decision)) continue;
+				if (!ctx.dryRun) {
+					const failure = yield* capture(`secret ${name} (${label})`, environment === void 0 ? secrets.set(name, value, scope) : secrets.setForEnvironment(environment, name, value));
+					if (failure !== void 0) {
+						errors.push(failure);
+						continue;
+					}
+					yield* applied.record({
+						repo: ctx.slug,
+						kind: KIND,
+						name: resource
+					}, desiredPrint, ctx.runId).pipe(Effect.ignore);
+				}
+				yield* logger.syncOperation("sync", KIND, name, `(${label})`);
+				changes.push({
+					repo: ctx.slug,
+					kind: KIND,
+					name: resource,
+					action: isDrift(decision) ? "drift-overwritten" : "updated"
+				});
+			}
+		});
+		for (const scope of SCOPES) {
+			const resolved = resolveGroups(scopes[scope] ?? [], ctx.config.secrets, ctx);
+			errors.push(...resolved.errors);
+			yield* syncStore(resolved.entries, scope, void 0);
+		}
+		for (const [environment, refs] of Object.entries(scopes.environments ?? {})) {
+			const resolved = resolveGroups(refs, ctx.config.secrets, ctx);
+			errors.push(...resolved.errors);
+			yield* syncStore(resolved.entries, "actions", environment);
+		}
+		return {
+			changes,
+			errors
+		};
+	});
+	return {
+		name: "secrets",
+		appliesTo: (ctx) => {
+			const scopes = ctx.config.groups[ctx.group]?.secrets;
+			if (scopes === void 0) return false;
+			return SCOPES.some((scope) => (scopes[scope]?.length ?? 0) > 0) || Object.keys(scopes.environments ?? {}).length > 0;
+		},
+		run
+	};
+});
+
+//#endregion
+export { secretsPhase };

package/sync/phases/security.js

@@ -0,0 +1,129 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option } from "effect";
+import { RepositorySecurity } from "@effected/github";
+
+//#region src/sync/phases/security.ts
+const KIND = "security";
+/** The three toggles, and the merged config field each reads. */
+const TOGGLES = [
+	"vulnerability_alerts",
+	"automated_security_fixes",
+	"private_vulnerability_reporting"
+];
+/**
+* Merge the security groups a repository's group references.
+*
+* @remarks
+* Later groups win, matching how every other `[settings.*]`-style section
+* composes. An absent field is not `false` — it means "leave alone", which is
+* why this returns a partial record rather than defaulting.
+*/
+const mergeSecurity = (ctx) => {
+	const refs = ctx.config.groups[ctx.group]?.security ?? [];
+	const merged = {};
+	for (const ref of refs) {
+		const group = ctx.config.security[ref];
+		if (group === void 0) continue;
+		for (const toggle of TOGGLES) {
+			const value = group[toggle];
+			if (value !== void 0) merged[toggle] = value;
+		}
+	}
+	return merged;
+};
+/**
+* GitHub rejects automated fixes without alerts.
+*
+* @remarks
+* Caught before any write rather than after the first one fails: applying
+* `automated_security_fixes` first would leave the repository half-configured
+* and the error attributed to the wrong toggle.
+*/
+const contradicts = (merged) => merged.automated_security_fixes === true && merged.vulnerability_alerts === false;
+/**
+* Repository security toggles: vulnerability alerts, automated fixes, private
+* vulnerability reporting.
+*
+* @remarks
+* Each toggle is a separate resource for drift purposes, so someone flipping
+* private vulnerability reporting in the UI is reported as that, not as
+* "security changed".
+*
+* @public
+*/
+const securityPhase = Effect.gen(function* () {
+	const security = yield* RepositorySecurity;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	const read = (toggle) => {
+		return (toggle === "vulnerability_alerts" ? security.vulnerabilityAlerts() : toggle === "automated_security_fixes" ? security.automatedSecurityFixes() : security.privateVulnerabilityReporting()).pipe(Effect.map(Option.some), Effect.orElseSucceed(() => Option.none()));
+	};
+	const write = (toggle, value) => {
+		return (toggle === "vulnerability_alerts" ? security.setVulnerabilityAlerts(value) : toggle === "automated_security_fixes" ? security.setAutomatedSecurityFixes(value) : security.setPrivateVulnerabilityReporting(value)).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(error.message ?? String(error)))));
+	};
+	const run = (ctx) => Effect.gen(function* () {
+		const merged = mergeSecurity(ctx);
+		if (contradicts(merged)) return {
+			changes: [],
+			errors: [{
+				context: "security merge",
+				message: "automated_security_fixes = true requires vulnerability_alerts to be enabled (or omitted); skipping security sync"
+			}]
+		};
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		const changes = [];
+		const errors = [];
+		for (const toggle of TOGGLES) {
+			const desired = merged[toggle];
+			if (desired === void 0) continue;
+			const live = yield* read(toggle);
+			if (Option.isNone(live)) {
+				errors.push({
+					context: `get ${toggle}`,
+					message: "could not read current state"
+				});
+				continue;
+			}
+			const decision = decide(fingerprint(desired), fingerprint(live.value), Option.map(lookup(baselines, KIND, toggle), (record) => record.fingerprint));
+			if (isDrift(decision)) yield* logger.driftDetected(KIND, toggle, decision);
+			if (!needsApply(decision)) continue;
+			if (!ctx.dryRun) {
+				const failure = yield* write(toggle, desired);
+				if (Option.isSome(failure)) {
+					errors.push({
+						context: toggle,
+						message: failure.value
+					});
+					continue;
+				}
+				yield* applied.record({
+					repo: ctx.slug,
+					kind: KIND,
+					name: toggle
+				}, fingerprint(desired), ctx.runId).pipe(Effect.ignore);
+			}
+			yield* logger.syncOperation("sync", KIND, toggle, desired ? "enable" : "disable");
+			changes.push({
+				repo: ctx.slug,
+				kind: KIND,
+				name: toggle,
+				action: isDrift(decision) ? "drift-overwritten" : "updated"
+			});
+		}
+		return {
+			changes,
+			errors
+		};
+	});
+	return {
+		name: "security",
+		appliesTo: (ctx) => (ctx.config.groups[ctx.group]?.security?.length ?? 0) > 0,
+		run
+	};
+});
+
+//#endregion
+export { securityPhase };