reposets 0.4.2 → 1.0.0

package/sync/phases/settings.js

@@ -0,0 +1,274 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { RepoCache } from "../../store/RepoCache.js";
+import { read } from "./resource.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option } from "effect";
+import { GitHubRepository, Ruleset } from "@effected/github";
+
+//#region src/sync/phases/settings.ts
+/**
+* Stands in for live state this phase cannot read.
+*
+* @remarks
+* `decide` needs three fingerprints, and GitHub exposes no read of these
+* resources comparable to what is written — the PATCH surface and the GET
+* surface differ, and some fields are not on the GET at all. So live is taken
+* to be the last applied value, and this sentinel covers the case where there
+* is no last applied value.
+*
+* It must never equal a real fingerprint. Using the desired fingerprint here
+* instead would make `FirstSync` compute `needsApply: desired !== live` as
+* `false` — and the very first sync of a repository would write nothing at all.
+*
+* The consequence, stated plainly: **this phase reports config change, not
+* drift.** A baseline that differs reads as `ConfigChanged`, never as `Drift`,
+* because there is no independent observation to attribute the difference to.
+*/
+const UNREADABLE = "\0unreadable";
+const KIND = "settings";
+/**
+* A repository has exactly one settings resource, so its drift key is fixed.
+*
+* @remarks
+* The alternative — one resource per field — would report twenty drift lines
+* for one person toggling twenty checkboxes in the UI. Settings move together
+* and are reported together.
+*/
+const NAME = "settings";
+/**
+* `security_and_analysis` fields GitHub only accepts on organization-owned
+* repositories.
+*
+* @remarks
+* Sending one to a personal repository is rejected outright, taking the whole
+* PATCH with it — so they are stripped and reported rather than attempted.
+*/
+const ORG_ONLY_SAA_FIELDS = /* @__PURE__ */ new Set([
+	"secret_scanning_delegated_alert_dismissal",
+	"secret_scanning_delegated_bypass",
+	"delegated_bypass_reviewers"
+]);
+/**
+* Settings fields only valid on organization-owned repositories.
+*
+* @remarks
+* Checkable from `ownerType` alone, which the engine already resolved — so
+* these cost nothing to gate.
+*/
+const ORG_ONLY_SETTINGS = /* @__PURE__ */ new Set();
+/**
+* Fields needing an organization owner **and** a private repository.
+*
+* @remarks
+* `allow_forking` lived in {@link ORG_ONLY_SETTINGS} and was gated on owner type
+* alone, which is half of GitHub's rule: it answers
+*
+* > Allow forks setting can only be changed on org-owned private repositories
+*
+* with a 422 that takes the **whole PATCH** with it — so one unsettable field
+* costs the repository every other setting in the same request.
+*
+* Visibility is not in the config and not in `ownerType`, so gating these means
+* asking GitHub. The read happens only when one of these fields actually
+* survives the merge, so a config that never mentions them never pays for it.
+*/
+const ORG_PRIVATE_ONLY_SETTINGS = /* @__PURE__ */ new Set(["allow_forking"]);
+/**
+* Merge every settings group the repository's group references.
+*
+* @remarks
+* Last write wins, and `security_and_analysis` is merged separately: it is a
+* nested block, so `Object.assign` across groups would replace it wholesale
+* rather than merging its fields.
+*/
+const mergeSettings = (ctx) => {
+	const refs = ctx.config.groups[ctx.group]?.settings ?? [];
+	const settings = {};
+	const saa = {};
+	let sawSaa = false;
+	for (const ref of refs) {
+		const group = ctx.config.settings[ref];
+		if (group === void 0) continue;
+		const { security_and_analysis, ...rest } = group;
+		Object.assign(settings, rest);
+		if (security_and_analysis !== void 0) {
+			sawSaa = true;
+			for (const [key, value] of Object.entries(security_and_analysis)) if (value !== void 0) saa[key] = value;
+		}
+	}
+	const skipped = [];
+	if (ctx.ownerType === "User") {
+		for (const key of ORG_PRIVATE_ONLY_SETTINGS) if (key in settings) {
+			delete settings[key];
+			skipped.push({
+				where: "setting",
+				key,
+				reason: "org-only, owner is a personal account"
+			});
+		}
+		for (const key of ORG_ONLY_SETTINGS) if (key in settings) {
+			delete settings[key];
+			skipped.push({
+				where: "setting",
+				key,
+				reason: "org-only, owner is a personal account"
+			});
+		}
+		for (const key of ORG_ONLY_SAA_FIELDS) if (key in saa) {
+			delete saa[key];
+			skipped.push({
+				where: "security_and_analysis",
+				key,
+				reason: "org-only, owner is a personal account"
+			});
+		}
+	}
+	return {
+		settings,
+		securityAndAnalysis: sawSaa && Object.keys(saa).length > 0 ? saa : void 0,
+		skipped,
+		conditional: [...ORG_PRIVATE_ONLY_SETTINGS].filter((key) => key in settings)
+	};
+};
+/**
+* Repository settings, over REST and the GraphQL mutation.
+*
+* @remarks
+* The whole settings block is one drift resource — see {@link NAME}.
+*
+* Delegated-bypass reviewers are config-level `{ team }` or `{ role }` names
+* that GitHub wants as numeric `reviewer_id`. Resolution happens here, before
+* the fingerprint is taken, so the fingerprint covers what was actually sent: a
+* team renamed under the same id must not read as drift, and a team pointing at
+* a different id must.
+*
+* @public
+*/
+const settingsPhase = Effect.gen(function* () {
+	const settingsClient = yield* GitHubRepository;
+	const rulesets = yield* Ruleset;
+	const cache = yield* RepoCache;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	/** Turn `{ team }` / `{ role }` reviewer entries into `{ reviewer_id, reviewer_type }`. */
+	const resolveReviewers = (ctx, reviewers) => Effect.gen(function* () {
+		const resolved = [];
+		const errors = [];
+		for (const reviewer of reviewers) {
+			const entry = {};
+			if (typeof reviewer.team === "string") {
+				const slug = reviewer.team;
+				const id = yield* cache.teamId(ctx.owner, slug, rulesets.teamId(slug)).pipe(Effect.map(Option.some), Effect.orElseSucceed(() => Option.none()));
+				if (Option.isNone(id)) {
+					errors.push({
+						context: `resolve team '${slug}'`,
+						message: "could not resolve team slug"
+					});
+					continue;
+				}
+				entry.reviewer_id = id.value;
+				entry.reviewer_type = "TEAM";
+			} else if (typeof reviewer.role === "string") {
+				const name = reviewer.role;
+				const id = yield* rulesets.roleId(name).pipe(Effect.map(Option.some), Effect.orElseSucceed(() => Option.none()));
+				if (Option.isNone(id)) {
+					errors.push({
+						context: `resolve role '${name}'`,
+						message: "could not resolve organization role"
+					});
+					continue;
+				}
+				entry.reviewer_id = id.value;
+				entry.reviewer_type = "ROLE";
+			} else continue;
+			if (reviewer.mode !== void 0) entry.mode = reviewer.mode;
+			resolved.push(entry);
+		}
+		return {
+			resolved,
+			errors
+		};
+	});
+	const run = (ctx) => Effect.gen(function* () {
+		const merged = mergeSettings(ctx);
+		const errors = [];
+		const desired = { ...merged.settings };
+		const skipped = [...merged.skipped];
+		if (merged.conditional.length > 0) {
+			const repository = yield* read(cache.repoPrivate(ctx.owner, ctx.repo, settingsClient.settings));
+			if ("failed" in repository) errors.push({
+				context: "settings",
+				message: `could not read repository visibility: ${repository.failed}`
+			});
+			else if (!repository.value) for (const key of merged.conditional) {
+				delete desired[key];
+				skipped.push({
+					where: "setting",
+					key,
+					reason: "org-owned private repositories only; this one is public"
+				});
+			}
+		}
+		for (const { where, key, reason } of skipped) yield* logger.syncOperation("skip", where, key, `(${reason})`);
+		if (merged.securityAndAnalysis !== void 0) {
+			const saa = { ...merged.securityAndAnalysis };
+			const reviewers = saa.delegated_bypass_reviewers;
+			if (Array.isArray(reviewers)) {
+				const outcome = yield* resolveReviewers(ctx, reviewers);
+				errors.push(...outcome.errors);
+				saa.delegated_bypass_reviewers = outcome.resolved;
+			}
+			if (Object.keys(saa).length > 0) desired.security_and_analysis = saa;
+		}
+		if (Object.keys(desired).length === 0) return {
+			changes: [],
+			errors
+		};
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		const baseline = Option.map(lookup(baselines, KIND, NAME), (record) => record.fingerprint);
+		const desiredPrint = fingerprint(desired);
+		const decision = decide(desiredPrint, Option.getOrElse(baseline, () => UNREADABLE), baseline);
+		if (isDrift(decision)) yield* logger.driftDetected(KIND, NAME, decision);
+		if (!needsApply(decision)) return {
+			changes: [],
+			errors
+		};
+		let sent;
+		if (!ctx.dryRun) {
+			const outcome = yield* settingsClient.applySettings(desired).pipe(Effect.map((applied) => ({ applied })), Effect.catch((error) => Effect.succeed({ failed: error.message ?? String(error) })));
+			if ("failed" in outcome) return {
+				changes: [],
+				errors: [...errors, {
+					context: KIND,
+					message: outcome.failed
+				}]
+			};
+			sent = [...outcome.applied.rest, ...outcome.applied.graphql];
+			yield* applied.record({
+				repo: ctx.slug,
+				kind: KIND,
+				name: NAME
+			}, desiredPrint, ctx.runId).pipe(Effect.ignore);
+		}
+		yield* logger.settingsApplied(sent ?? Object.keys(desired));
+		return {
+			changes: [{
+				repo: ctx.slug,
+				kind: KIND,
+				name: NAME,
+				action: isDrift(decision) ? "drift-overwritten" : "updated"
+			}],
+			errors
+		};
+	});
+	return {
+		name: "settings",
+		appliesTo: (ctx) => (ctx.config.groups[ctx.group]?.settings?.length ?? 0) > 0,
+		run
+	};
+});
+
+//#endregion
+export { settingsPhase };

package/sync/phases/variables.js

@@ -0,0 +1,132 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { capture, resolveGroups } from "./resource.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option, Redacted } from "effect";
+import { RepositoryVariable } from "@effected/github";
+
+//#region src/sync/phases/variables.ts
+const KIND = "variable";
+/**
+* Stands in for a variable that is not on the repository at all.
+*
+* @remarks
+* Absence is a live state like any other, and it needs a fingerprint distinct
+* from every real value so `decide` can compare against it. Without it, a
+* variable someone deleted out of band would compare equal to whatever we last
+* applied and never be restored.
+*/
+const ABSENT = "\0absent";
+/** An environment-scoped variable is named `env/name` so the two never collide. */
+const resourceName = (name, environment) => environment === void 0 ? name : `${environment}/${name}`;
+/**
+* Repository and environment variables.
+*
+* @remarks
+* Unlike secrets, variables are readable — `listVariables` returns what is
+* actually on the repository — so this phase does **real** three-way drift
+* detection rather than the config-change-only comparison `settings` is limited
+* to. Someone editing a variable in the UI is reported as drift and overwritten;
+* someone deleting one is reported and restored.
+*
+* The listing carries values, not just names — variables are not secret, so
+* GitHub returns them — which makes this a full three-way comparison at no
+* extra request: an *edited* variable is as detectable as a deleted one. That
+* is the real difference from `secrets`, where no projection change could help
+* because GitHub never returns a secret value at any endpoint.
+*
+* Values arrive {@link Redacted.Redacted} from the shared resolver even though
+* variables are not secret, so `Redacted.value` appears exactly once per write
+* and never near a log line.
+*
+* @public
+*/
+const variablesPhase = Effect.gen(function* () {
+	const variables = yield* RepositoryVariable;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	const run = (ctx) => Effect.gen(function* () {
+		const scopes = ctx.config.groups[ctx.group]?.variables;
+		if (scopes === void 0) return {
+			changes: [],
+			errors: []
+		};
+		const changes = [];
+		const errors = [];
+		const actions = resolveGroups(scopes.actions ?? [], ctx.config.variables, ctx);
+		errors.push(...actions.errors);
+		/** Every environment's resolved entries, by environment name. */
+		const byEnvironment = /* @__PURE__ */ new Map();
+		for (const [environment, refs] of Object.entries(scopes.environments ?? {})) {
+			const resolved = resolveGroups(refs, ctx.config.variables, ctx);
+			errors.push(...resolved.errors);
+			byEnvironment.set(environment, resolved.entries);
+		}
+		if (actions.entries.size === 0 && byEnvironment.size === 0) return {
+			changes,
+			errors
+		};
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		/** What is currently on the repository, name to value, for one scope. */
+		const liveValues = (environment) => (environment === void 0 ? variables.list() : variables.listForEnvironment(environment)).pipe(Effect.map((list) => Option.some(new Map(list.map((entry) => [entry.name, entry.value])))), Effect.orElseSucceed(() => Option.none()));
+		const syncScope = (entries, environment) => Effect.gen(function* () {
+			if (entries.size === 0) return;
+			const live = yield* liveValues(environment);
+			if (Option.isNone(live)) {
+				errors.push({
+					context: environment === void 0 ? "list variables" : `list variables (env: ${environment})`,
+					message: "could not read current variables"
+				});
+				return;
+			}
+			for (const [name, value] of entries) {
+				const resource = resourceName(name, environment);
+				const desiredPrint = fingerprint(Redacted.value(value));
+				const baseline = Option.map(lookup(baselines, KIND, resource), (record) => record.fingerprint);
+				const liveValue = live.value.get(name);
+				const livePrint = liveValue === void 0 ? fingerprint(ABSENT) : fingerprint(liveValue);
+				const decision = decide(desiredPrint, livePrint, baseline);
+				if (isDrift(decision)) yield* logger.driftDetected(KIND, resource, decision);
+				if (!needsApply(decision)) continue;
+				if (!ctx.dryRun) {
+					const failure = yield* capture(`variable ${resource}`, environment === void 0 ? variables.set(name, Redacted.value(value)) : variables.setForEnvironment(environment, name, Redacted.value(value)));
+					if (failure !== void 0) {
+						errors.push(failure);
+						continue;
+					}
+					yield* applied.record({
+						repo: ctx.slug,
+						kind: KIND,
+						name: resource
+					}, desiredPrint, ctx.runId).pipe(Effect.ignore);
+				}
+				yield* logger.syncOperation("sync", KIND, name, environment === void 0 ? void 0 : `(env: ${environment})`);
+				changes.push({
+					repo: ctx.slug,
+					kind: KIND,
+					name: resource,
+					action: isDrift(decision) ? "drift-overwritten" : "updated"
+				});
+			}
+		});
+		yield* syncScope(actions.entries);
+		for (const [environment, entries] of byEnvironment) yield* syncScope(entries, environment);
+		return {
+			changes,
+			errors
+		};
+	});
+	return {
+		name: "variables",
+		appliesTo: (ctx) => {
+			const scopes = ctx.config.groups[ctx.group]?.variables;
+			if (scopes === void 0) return false;
+			return (scopes.actions?.length ?? 0) > 0 || Object.keys(scopes.environments ?? {}).length > 0;
+		},
+		run
+	};
+});
+
+//#endregion
+export { variablesPhase };

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.58.9"
+      "packageVersion": "7.58.12"
     }
   ]
 }

package/bin/reposets.d.ts

@@ -1 +0,0 @@
-export { };

package/errors.js

@@ -1,12 +0,0 @@
-import { Data } from "effect";
-
-//#region src/errors.ts
-/* v8 ignore start -- TaggedError class declarations, covered via errors.test.ts */
-var ResolveError = class extends Data.TaggedError("ResolveError") {};
-var OnePasswordError = class extends Data.TaggedError("OnePasswordError") {};
-var GitHubApiError = class extends Data.TaggedError("GitHubApiError") {};
-var SyncError = class extends Data.TaggedError("SyncError") {};
-/* v8 ignore stop */
-
-//#endregion
-export { GitHubApiError, OnePasswordError, ResolveError, SyncError };

package/lib/crypto.js

@@ -1,27 +0,0 @@
-import { blake2b } from "blakejs";
-import nacl from "tweetnacl";
-
-//#region src/lib/crypto.ts
-/**
-* Encrypt a secret using libsodium's sealed box algorithm.
-* Implementation based on tweetsodium using tweetnacl + blakejs.
-*
-* The sealed box format is: ephemeral_public_key (32 bytes) || ciphertext
-*/
-function encryptSecret(publicKey, secretValue) {
-	const messageBytes = Buffer.from(secretValue);
-	const publicKeyBytes = Buffer.from(publicKey, "base64");
-	const ephemeralKeyPair = nacl.box.keyPair();
-	const nonceInput = new Uint8Array(64);
-	nonceInput.set(ephemeralKeyPair.publicKey);
-	nonceInput.set(publicKeyBytes, 32);
-	const nonce = blake2b(nonceInput, void 0, 24);
-	const ciphertext = nacl.box(messageBytes, nonce, publicKeyBytes, ephemeralKeyPair.secretKey);
-	const sealed = new Uint8Array(ephemeralKeyPair.publicKey.length + ciphertext.length);
-	sealed.set(ephemeralKeyPair.publicKey);
-	sealed.set(ciphertext, ephemeralKeyPair.publicKey.length);
-	return Buffer.from(sealed).toString("base64");
-}
-
-//#endregion
-export { encryptSecret };