tutanus 0.13.0 → 0.13.2

package/dist/app/github/app/issues-handler.js

@@ -0,0 +1,85 @@
+import { GithubWebhookMensagens } from '../../../core/messages/index.js';
+import { statsStore } from '../dashboard/stats-store.js';
+import { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';
+const TRIGGER_TOKEN = '@tutanus scan';
+const MAX_DETALHES = 10;
+export async function processarIssues(app, payload) {
+    const { repository, issue, installation, action } = payload;
+    if (action !== 'opened')
+        return;
+    if (!installation?.id)
+        return;
+    const issueBody = (issue.body || '').toLowerCase();
+    if (!issueBody.includes(TRIGGER_TOKEN))
+        return;
+    const owner = repository.owner.login;
+    const repo = repository.name;
+    const issueNumber = issue.number;
+    const octokit = await app.getInstallationOctokit(installation.id);
+    try {
+        const { data: repoInfo } = await octokit.request('GET /repos/{owner}/{repo}', { owner, repo });
+        const defaultBranch = repoInfo.default_branch;
+        const workflows = await buscarWorkflows(octokit, owner, repo, defaultBranch);
+        if (workflows.length === 0) {
+            await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+                owner,
+                repo,
+                issue_number: issueNumber,
+                body: GithubWebhookMensagens.nenhumWorkflowRepo
+            });
+            return;
+        }
+        const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(octokit, owner, repo, defaultBranch, workflows);
+        statsStore.recordAnalysis({
+            repository: `${owner}/${repo}`,
+            event: 'issues',
+            score: scoreGeral,
+            workflowsCount: workflows.length,
+            occurrencesCount: ocorrencias.length
+        });
+        const comment = renderIssuesComment(scoreGeral, workflowsInfo, ocorrencias);
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: issueNumber,
+            body: comment
+        });
+    }
+    catch (err) {
+        const error = err;
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: issueNumber,
+            body: GithubWebhookMensagens.erroScan(error.message)
+        });
+    }
+}
+function renderIssuesComment(scoreGeral, workflowsInfo, ocorrencias) {
+    let comment = `## Tutanus - Scan Sob Demanda\n\n**Score Geral:** ${scoreGeral}/100\n\n`;
+    for (const wf of workflowsInfo) {
+        const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';
+        comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100, ${wf.ocorrencias} ocorrências)\n`;
+    }
+    if (ocorrencias.length > 0) {
+        const erros = ocorrencias.filter(o => o.nivel === 'erro');
+        const avisos = ocorrencias.filter(o => o.nivel === 'aviso');
+        if (erros.length > 0) {
+            comment += `\n#### Erros (${erros.length})\n\n`;
+            for (const o of erros.slice(0, MAX_DETALHES)) {
+                comment += `- \`${o.relPath}:${o.linha || 1}\` - ${o.mensagem}\n`;
+            }
+        }
+        if (avisos.length > 0) {
+            comment += `\n#### Avisos (${avisos.length})\n\n`;
+            for (const o of avisos.slice(0, MAX_DETALHES)) {
+                comment += `- \`${o.relPath}:${o.linha || 1}\` - ${o.mensagem}\n`;
+            }
+        }
+    }
+    else {
+        comment += `\nNenhum problema encontrado. Workflows em bom estado!\n`;
+    }
+    return comment;
+}
+//# sourceMappingURL=issues-handler.js.map

package/dist/app/github/app/issues-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issues-handler.js","sourceRoot":"","sources":["../../../../src/app/github/app/issues-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAMxD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAQ,EAAE,OAAsB;IACpE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC5D,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO;IAChC,IAAI,CAAC,YAAY,EAAE,EAAE;QAAE,OAAO;IAC9B,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO;IAE/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;gBACjF,KAAK;gBACL,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,IAAI,EAAE,sBAAsB,CAAC,kBAAkB;aAChD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAC/C,CAAC;QACF,UAAU,CAAC,cAAc,CAAC;YACxB,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;YAC9B,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,gBAAgB,EAAE,WAAW,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAY,CAAC;QAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,IAAI,EAAE,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,aAA0E,EAC1E,WAAyB;IAEzB,IAAI,OAAO,GAAG,qDAAqD,UAAU,UAAU,CAAC;IACxF,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,OAAO,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,WAAW,iBAAiB,CAAC;IAClG,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,iBAAiB,KAAK,CAAC,MAAM,OAAO,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,kBAAkB,MAAM,CAAC,MAAM,OAAO,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,0DAA0D,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { GithubWebhookMensagens } from '@core/messages';\nimport type { App } from '@octokit/app';\n\nimport type { Ocorrencia } from '@';\n\nimport type { IssuesPayload } from '../../../types/github/app.js';\nimport { statsStore } from '../dashboard/stats-store.js';\nimport { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';\n\nconst TRIGGER_TOKEN = '@tutanus scan';\nconst MAX_DETALHES = 10;\n\nexport async function processarIssues(app: App, payload: IssuesPayload): Promise<void> {\n  const { repository, issue, installation, action } = payload;\n  if (action !== 'opened') return;\n  if (!installation?.id) return;\n  const issueBody = (issue.body || '').toLowerCase();\n  if (!issueBody.includes(TRIGGER_TOKEN)) return;\n\n  const owner = repository.owner.login;\n  const repo = repository.name;\n  const issueNumber = issue.number;\n  const octokit = await app.getInstallationOctokit(installation.id);\n\n  try {\n    const { data: repoInfo } = await octokit.request('GET /repos/{owner}/{repo}', { owner, repo });\n    const defaultBranch = repoInfo.default_branch;\n    const workflows = await buscarWorkflows(octokit, owner, repo, defaultBranch);\n    if (workflows.length === 0) {\n      await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n        owner,\n        repo,\n        issue_number: issueNumber,\n        body: GithubWebhookMensagens.nenhumWorkflowRepo\n      });\n      return;\n    }\n\n    const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(\n      octokit, owner, repo, defaultBranch, workflows\n    );\n    statsStore.recordAnalysis({\n      repository: `${owner}/${repo}`,\n      event: 'issues',\n      score: scoreGeral,\n      workflowsCount: workflows.length,\n      occurrencesCount: ocorrencias.length\n    });\n\n    const comment = renderIssuesComment(scoreGeral, workflowsInfo, ocorrencias);\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: issueNumber,\n      body: comment\n    });\n  } catch (err: unknown) {\n    const error = err as Error;\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: issueNumber,\n      body: GithubWebhookMensagens.erroScan(error.message)\n    });\n  }\n}\n\nfunction renderIssuesComment(\n  scoreGeral: number,\n  workflowsInfo: Array<{ nome: string; score: number; ocorrencias: number }>,\n  ocorrencias: Ocorrencia[]\n): string {\n  let comment = `## Tutanus - Scan Sob Demanda\\n\\n**Score Geral:** ${scoreGeral}/100\\n\\n`;\n  for (const wf of workflowsInfo) {\n    const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';\n    comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100, ${wf.ocorrencias} ocorrências)\\n`;\n  }\n  if (ocorrencias.length > 0) {\n    const erros = ocorrencias.filter(o => o.nivel === 'erro');\n    const avisos = ocorrencias.filter(o => o.nivel === 'aviso');\n    if (erros.length > 0) {\n      comment += `\\n#### Erros (${erros.length})\\n\\n`;\n      for (const o of erros.slice(0, MAX_DETALHES)) {\n        comment += `- \\`${o.relPath}:${o.linha || 1}\\` - ${o.mensagem}\\n`;\n      }\n    }\n    if (avisos.length > 0) {\n      comment += `\\n#### Avisos (${avisos.length})\\n\\n`;\n      for (const o of avisos.slice(0, MAX_DETALHES)) {\n        comment += `- \\`${o.relPath}:${o.linha || 1}\\` - ${o.mensagem}\\n`;\n      }\n    }\n  } else {\n    comment += `\\nNenhum problema encontrado. Workflows em bom estado!\\n`;\n  }\n  return comment;\n}\n"]}

package/dist/app/github/app/octokit.d.ts

@@ -0,0 +1,14 @@
+import type { App } from '@octokit/app';
+import type { RepositoryBase } from '../../../types/github/app.js';
+export type OctokitInstance = Awaited<ReturnType<InstanceType<typeof App>['getInstallationOctokit']>>;
+export declare const HTTP_OK = 200;
+export declare const HTTP_BAD_REQUEST = 400;
+export declare const HTTP_NOT_FOUND = 404;
+export declare const HTTP_INTERNAL_ERROR = 500;
+export declare function repoBase(repo: {
+    owner: {
+        login?: string | null;
+    } | null;
+    name: string;
+}): RepositoryBase;
+//# sourceMappingURL=octokit.d.ts.map

package/dist/app/github/app/octokit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"octokit.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/octokit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;AAEtG,eAAO,MAAM,OAAO,MAAM,CAAC;AAC3B,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAC7B,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,cAAc,CAEjB"}

package/dist/app/github/app/octokit.js

@@ -0,0 +1,8 @@
+export const HTTP_OK = 200;
+export const HTTP_BAD_REQUEST = 400;
+export const HTTP_NOT_FOUND = 404;
+export const HTTP_INTERNAL_ERROR = 500;
+export function repoBase(repo) {
+    return { owner: { login: repo.owner?.login ?? '' }, name: repo.name };
+}
+//# sourceMappingURL=octokit.js.map

package/dist/app/github/app/octokit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"octokit.js","sourceRoot":"","sources":["../../../../src/app/github/app/octokit.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,MAAM,UAAU,QAAQ,CAAC,IAGxB;IACC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport type { App } from '@octokit/app';\n\nimport type { RepositoryBase } from '../../../types/github/app.js';\n\nexport type OctokitInstance = Awaited<ReturnType<InstanceType<typeof App>['getInstallationOctokit']>>;\n\nexport const HTTP_OK = 200;\nexport const HTTP_BAD_REQUEST = 400;\nexport const HTTP_NOT_FOUND = 404;\nexport const HTTP_INTERNAL_ERROR = 500;\n\nexport function repoBase(repo: {\n  owner: { login?: string | null } | null;\n  name: string;\n}): RepositoryBase {\n  return { owner: { login: repo.owner?.login ?? '' }, name: repo.name };\n}\n"]}

package/dist/app/github/app/pr-review-handler.d.ts

@@ -0,0 +1,4 @@
+import type { App } from '@octokit/app';
+import type { PullRequestReviewPayload } from '../../../types/github/app.js';
+export declare function processarPullRequestReview(app: App, payload: PullRequestReviewPayload): Promise<void>;
+//# sourceMappingURL=pr-review-handler.d.ts.map

package/dist/app/github/app/pr-review-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-review-handler.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/pr-review-handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAO7E,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/app/github/app/pr-review-handler.js

@@ -0,0 +1,81 @@
+import { GithubWebhookMensagens } from '../../../core/messages/index.js';
+import { statsStore } from '../dashboard/stats-store.js';
+import { MAX_ANNOTATIONS } from './check-run-builder.js';
+import { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';
+const TRIGGER_TOKEN = '@tutanus analyze';
+export async function processarPullRequestReview(app, payload) {
+    const { repository, pull_request, review, installation, action } = payload;
+    if (action !== 'submitted' || review.state !== 'commented')
+        return;
+    if (!installation?.id)
+        return;
+    const owner = repository.owner.login;
+    const repo = repository.name;
+    const headSha = pull_request.head.sha;
+    const prNumber = pull_request.number;
+    const reviewBody = (review.body || '').toLowerCase();
+    if (!reviewBody.includes(TRIGGER_TOKEN))
+        return;
+    const octokit = await app.getInstallationOctokit(installation.id);
+    try {
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: prNumber,
+            body: '[BUSCA] **Tutanus** iniciando análise dos workflows...'
+        });
+        const workflows = await buscarWorkflows(octokit, owner, repo, headSha);
+        if (workflows.length === 0) {
+            await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+                owner,
+                repo,
+                issue_number: prNumber,
+                body: GithubWebhookMensagens.nenhumWorkflow
+            });
+            return;
+        }
+        const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(octokit, owner, repo, headSha, workflows);
+        statsStore.recordAnalysis({
+            repository: `${owner}/${repo}`,
+            event: 'pull_request_review',
+            score: scoreGeral,
+            workflowsCount: workflows.length,
+            occurrencesCount: ocorrencias.length
+        });
+        const comment = renderReviewComment(scoreGeral, workflowsInfo, ocorrencias);
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: prNumber,
+            body: comment
+        });
+    }
+    catch (err) {
+        const error = err;
+        await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
+            owner,
+            repo,
+            issue_number: prNumber,
+            body: `Erro na análise: \`${error.message}\``
+        });
+    }
+}
+function renderReviewComment(scoreGeral, workflowsInfo, ocorrencias) {
+    let comment = `## Tutanus - Análise Sob Demanda\n\n`;
+    comment += `**Score Geral:** ${scoreGeral}/100\n\n`;
+    for (const wf of workflowsInfo) {
+        const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';
+        comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100)\n`;
+    }
+    if (ocorrencias.length > 0) {
+        comment += `\n### Ocorrências (${ocorrencias.length})\n\n`;
+        for (const o of ocorrencias.slice(0, MAX_ANNOTATIONS)) {
+            comment += `- **${o.nivel?.toUpperCase() || 'INFO'}**: \`${o.relPath}:${o.linha || 1}\` - ${o.mensagem}\n`;
+        }
+    }
+    else {
+        comment += `\nNenhuma ocorrência encontrada.\n`;
+    }
+    return comment;
+}
+//# sourceMappingURL=pr-review-handler.js.map

package/dist/app/github/app/pr-review-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr-review-handler.js","sourceRoot":"","sources":["../../../../src/app/github/app/pr-review-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAIxD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAQ,EACR,OAAiC;IAEjC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO;IACnE,IAAI,CAAC,YAAY,EAAE,EAAE;QAAE,OAAO;IAE9B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC;IACrC,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO;IAEhD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,wDAAwD;SAC/D,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;gBACjF,KAAK;gBACL,IAAI;gBACJ,YAAY,EAAE,QAAQ;gBACtB,IAAI,EAAE,sBAAsB,CAAC,cAAc;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CACzC,CAAC;QACF,UAAU,CAAC,cAAc,CAAC;YACxB,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;YAC9B,KAAK,EAAE,qBAAqB;YAC5B,KAAK,EAAE,UAAU;YACjB,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,gBAAgB,EAAE,WAAW,CAAC,MAAM;SACrC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAY,CAAC;QAC3B,MAAM,OAAO,CAAC,OAAO,CAAC,2DAA2D,EAAE;YACjF,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,QAAQ;YACtB,IAAI,EAAE,sBAAsB,KAAK,CAAC,OAAO,IAAI;SAC9C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,aAAqD,EACrD,WAAyF;IAEzF,IAAI,OAAO,GAAG,sCAAsC,CAAC;IACrD,OAAO,IAAI,oBAAoB,UAAU,UAAU,CAAC;IACpD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,OAAO,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,KAAK,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,sBAAsB,WAAW,CAAC,MAAM,OAAO,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,MAAM,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,IAAI,CAAC;QAC7G,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,oCAAoC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { GithubWebhookMensagens } from '@core/messages';\nimport type { App } from '@octokit/app';\n\nimport type { PullRequestReviewPayload } from '../../../types/github/app.js';\nimport { statsStore } from '../dashboard/stats-store.js';\nimport { MAX_ANNOTATIONS } from './check-run-builder.js';\nimport { analisarWorkflows, buscarWorkflows } from './workflow-reader.js';\n\nconst TRIGGER_TOKEN = '@tutanus analyze';\n\nexport async function processarPullRequestReview(\n  app: App,\n  payload: PullRequestReviewPayload\n): Promise<void> {\n  const { repository, pull_request, review, installation, action } = payload;\n  if (action !== 'submitted' || review.state !== 'commented') return;\n  if (!installation?.id) return;\n\n  const owner = repository.owner.login;\n  const repo = repository.name;\n  const headSha = pull_request.head.sha;\n  const prNumber = pull_request.number;\n  const reviewBody = (review.body || '').toLowerCase();\n  if (!reviewBody.includes(TRIGGER_TOKEN)) return;\n\n  const octokit = await app.getInstallationOctokit(installation.id);\n  try {\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: prNumber,\n      body: '[BUSCA] **Tutanus** iniciando análise dos workflows...'\n    });\n\n    const workflows = await buscarWorkflows(octokit, owner, repo, headSha);\n    if (workflows.length === 0) {\n      await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n        owner,\n        repo,\n        issue_number: prNumber,\n        body: GithubWebhookMensagens.nenhumWorkflow\n      });\n      return;\n    }\n\n    const { ocorrencias, scoreGeral, workflowsInfo } = await analisarWorkflows(\n      octokit, owner, repo, headSha, workflows\n    );\n    statsStore.recordAnalysis({\n      repository: `${owner}/${repo}`,\n      event: 'pull_request_review',\n      score: scoreGeral,\n      workflowsCount: workflows.length,\n      occurrencesCount: ocorrencias.length\n    });\n\n    const comment = renderReviewComment(scoreGeral, workflowsInfo, ocorrencias);\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: prNumber,\n      body: comment\n    });\n  } catch (err: unknown) {\n    const error = err as Error;\n    await octokit.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {\n      owner,\n      repo,\n      issue_number: prNumber,\n      body: `Erro na análise: \\`${error.message}\\``\n    });\n  }\n}\n\nfunction renderReviewComment(\n  scoreGeral: number,\n  workflowsInfo: Array<{ nome: string; score: number }>,\n  ocorrencias: Array<{ relPath: string; linha?: number; nivel?: string; mensagem: string }>\n): string {\n  let comment = `## Tutanus - Análise Sob Demanda\\n\\n`;\n  comment += `**Score Geral:** ${scoreGeral}/100\\n\\n`;\n  for (const wf of workflowsInfo) {\n    const icon = wf.score >= 80 ? '[OK]' : wf.score >= 50 ? '[AVISO]' : '[ERRO]';\n    comment += `- ${icon} **${wf.nome}** (Score: ${wf.score}/100)\\n`;\n  }\n  if (ocorrencias.length > 0) {\n    comment += `\\n### Ocorrências (${ocorrencias.length})\\n\\n`;\n    for (const o of ocorrencias.slice(0, MAX_ANNOTATIONS)) {\n      comment += `- **${o.nivel?.toUpperCase() || 'INFO'}**: \\`${o.relPath}:${o.linha || 1}\\` - ${o.mensagem}\\n`;\n    }\n  } else {\n    comment += `\\nNenhuma ocorrência encontrada.\\n`;\n  }\n  return comment;\n}\n"]}

package/dist/app/github/app/repo-downloader.d.ts

@@ -0,0 +1,8 @@
+import type { App } from '@octokit/app';
+import type { RepoDownloadResult } from '../../../types/github/app.js';
+export declare function getInstallationToken(app: App, installationId: number): Promise<string>;
+export declare function downloadRepo(app: App, installationId: number, owner: string, repo: string, ref: string): Promise<RepoDownloadResult>;
+export declare function escreverAskpassScript(): string;
+export declare function limparAskpassScript(caminho: string): void;
+export declare function cloneRepo(app: App, installationId: number, owner: string, repo: string, ref: string): Promise<RepoDownloadResult>;
+//# sourceMappingURL=repo-downloader.d.ts.map

package/dist/app/github/app/repo-downloader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-downloader.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/repo-downloader.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA0BvE,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK5F;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CA6D7B;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAK9C;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzD;AAoBD,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CA0C7B"}

package/dist/app/github/app/repo-downloader.js

@@ -0,0 +1,156 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { messages } from '../../../core/messages/index.js';
+const HTTP_REDIRECT = 302;
+const { GithubRepoDownloaderMensagens } = messages;
+const OWNER_REPO_RE = /^[a-zA-Z0-9_.-]+$/;
+const REF_RE = /^[a-zA-Z0-9_.\-/]+$/;
+function validarInput(valor, regex, nome) {
+    if (!regex.test(valor)) {
+        throw new Error(messages.ExcecoesMensagens.inputInvalido(nome));
+    }
+}
+function validarRedirectUrl(url) {
+    const parsed = new URL(url);
+    if (!parsed.hostname.endsWith('.github.com') && parsed.hostname !== 'github.com') {
+        throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);
+    }
+    if (!parsed.protocol.startsWith('https')) {
+        throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);
+    }
+    return parsed;
+}
+export async function getInstallationToken(app, installationId) {
+    const { data } = await app.octokit.request('POST /app/installations/{installation_id}/access_tokens', {
+        installation_id: installationId
+    });
+    return data.token;
+}
+export async function downloadRepo(app, installationId, owner, repo, ref) {
+    validarInput(owner, OWNER_REPO_RE, 'owner');
+    validarInput(repo, OWNER_REPO_RE, 'repo');
+    validarInput(ref, REF_RE, 'ref');
+    const tempDir = mkdtempSync(join(tmpdir(), 'tutanus-repo-'));
+    const zipPath = join(tempDir, 'repo.zip');
+    try {
+        const octokit = await app.getInstallationOctokit(installationId);
+        const response = await octokit.request('GET /repos/{owner}/{repo}/zipball/{ref}', {
+            owner,
+            repo,
+            ref,
+            request: { redirect: 'manual' }
+        });
+        let zipBuffer;
+        if (response.status === HTTP_REDIRECT && response.headers.location) {
+            const redirectUrl = validarRedirectUrl(response.headers.location);
+            const token = await getInstallationToken(app, installationId);
+            const zipResponse = await fetch(redirectUrl, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            if (!zipResponse.ok) {
+                throw new Error(GithubRepoDownloaderMensagens.falhaBaixarZipball(zipResponse.status));
+            }
+            zipBuffer = Buffer.from(await zipResponse.arrayBuffer());
+        }
+        else if (Buffer.isBuffer(response.data)) {
+            zipBuffer = response.data;
+        }
+        else {
+            throw new Error(GithubRepoDownloaderMensagens.respostaInesperada);
+        }
+        writeFileSync(zipPath, zipBuffer);
+        execFileSync('unzip', ['-q', zipPath, '-d', tempDir], { stdio: 'pipe' });
+        rmSync(zipPath);
+        validarSemPathTraversal(tempDir);
+        const entries = readdirSync(tempDir);
+        const repoDirName = entries?.find(e => e !== 'repo.zip') ?? '';
+        if (!repoDirName) {
+            throw new Error(GithubRepoDownloaderMensagens.nenhumDiretorioEncontrado);
+        }
+        return {
+            tempDir,
+            repoDir: join(tempDir, repoDirName),
+            cleanup: () => {
+                try {
+                    rmSync(tempDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
+        };
+    }
+    catch (err) {
+        rmSync(tempDir, { recursive: true, force: true });
+        throw err;
+    }
+}
+export function escreverAskpassScript() {
+    const tmpScript = join(tmpdir(), `tutanus-askpass-${Date.now()}.sh`);
+    writeFileSync(tmpScript, '#!/bin/sh\necho "$TUTANUS_GIT_TOKEN"');
+    chmodSync(tmpScript, 0o500);
+    return tmpScript;
+}
+export function limparAskpassScript(caminho) {
+    try {
+        rmSync(caminho);
+    }
+    catch { }
+}
+function validarSemPathTraversal(dir) {
+    const pilha = [dir];
+    while (pilha.length > 0) {
+        const atual = pilha.pop();
+        if (!atual)
+            continue;
+        for (const entry of readdirSync(atual)) {
+            const caminhoCompleto = join(atual, entry);
+            if (!caminhoCompleto.startsWith(dir)) {
+                rmSync(dir, { recursive: true, force: true });
+                throw new Error(GithubRepoDownloaderMensagens.pathTraversalDetectado);
+            }
+            if (statSync(caminhoCompleto).isDirectory()) {
+                pilha.push(caminhoCompleto);
+            }
+        }
+    }
+}
+export async function cloneRepo(app, installationId, owner, repo, ref) {
+    validarInput(owner, OWNER_REPO_RE, 'owner');
+    validarInput(repo, OWNER_REPO_RE, 'repo');
+    validarInput(ref, REF_RE, 'ref');
+    const tempDir = mkdtempSync(join(tmpdir(), 'tutanus-repo-'));
+    const repoDir = join(tempDir, 'repo');
+    const token = await getInstallationToken(app, installationId);
+    const askpassScript = escreverAskpassScript();
+    try {
+        execFileSync('git', ['clone', '--depth', '1', '--branch', ref,
+            `https://github.com/${owner}/${repo}.git`, repoDir], {
+            stdio: 'pipe',
+            timeout: 120000,
+            env: {
+                ...process.env,
+                TUTANUS_GIT_TOKEN: token,
+                GIT_ASKPASS: askpassScript,
+                GIT_TERMINAL_PROMPT: '0'
+            }
+        });
+        return {
+            tempDir,
+            repoDir,
+            cleanup: () => {
+                limparAskpassScript(askpassScript);
+                try {
+                    rmSync(tempDir, { recursive: true, force: true });
+                }
+                catch { }
+            }
+        };
+    }
+    catch (err) {
+        limparAskpassScript(askpassScript);
+        rmSync(tempDir, { recursive: true, force: true });
+        throw err;
+    }
+}
+//# sourceMappingURL=repo-downloader.js.map

package/dist/app/github/app/repo-downloader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-downloader.js","sourceRoot":"","sources":["../../../../src/app/github/app/repo-downloader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK1C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,EAAE,6BAA6B,EAAE,GAAG,QAAQ,CAAC;AAGnD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC;AAErC,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY;IAC9D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAQ,EAAE,cAAsB;IACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,yDAAyD,EAAE;QACpG,eAAe,EAAE,cAAc;KAChC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAQ,EACR,cAAsB,EACtB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,yCAAyC,EAAE;YAChF,KAAK;YACL,IAAI;YACJ,GAAG;YACH,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,SAAiB,CAAC;QACtB,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACxF,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QAED,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAGlC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,CAAC;QAGhB,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,yBAAyB,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YACnC,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,CAAC;oBAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrE,aAAa,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;IACjE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,sBAAsB,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,cAAsB,EACtB,KAAa,EACb,IAAY,EACZ,GAAW;IAEX,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAG9D,MAAM,aAAa,GAAG,qBAAqB,EAAE,CAAC;IAE9C,IAAI,CAAC;QACH,YAAY,CACV,KAAK,EACL,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG;YACvC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,OAAO,CAAC,EACrD;YACE,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,MAAM;YACf,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,iBAAiB,EAAE,KAAK;gBACxB,WAAW,EAAE,aAAa;gBAC1B,mBAAmB,EAAE,GAAG;aACzB;SACF,CACF,CAAC;QAEF,OAAO;YACL,OAAO;YACP,OAAO;YACP,OAAO,EAAE,GAAG,EAAE;gBACZ,mBAAmB,CAAC,aAAa,CAAC,CAAC;gBACnC,IAAI,CAAC;oBAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { execFileSync } from 'node:child_process';\nimport { chmodSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\n\nimport { messages } from '@core/messages';\nimport type { App } from '@octokit/app';\n\nimport type { RepoDownloadResult } from '../../../types/github/app.js';\n\nconst HTTP_REDIRECT = 302;\nconst { GithubRepoDownloaderMensagens } = messages;\n\n// Expressões para validar owner/repo/ref - apenas caracteres seguros\nconst OWNER_REPO_RE = /^[a-zA-Z0-9_.-]+$/;\nconst REF_RE = /^[a-zA-Z0-9_.\\-/]+$/;\n\nfunction validarInput(valor: string, regex: RegExp, nome: string): void {\n  if (!regex.test(valor)) {\n    throw new Error(messages.ExcecoesMensagens.inputInvalido(nome));\n  }\n}\n\nfunction validarRedirectUrl(url: string): URL {\n  const parsed = new URL(url);\n  if (!parsed.hostname.endsWith('.github.com') && parsed.hostname !== 'github.com') {\n    throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);\n  }\n  if (!parsed.protocol.startsWith('https')) {\n    throw new Error(GithubRepoDownloaderMensagens.redirectInvalido);\n  }\n  return parsed;\n}\n\nexport async function getInstallationToken(app: App, installationId: number): Promise<string> {\n  const { data } = await app.octokit.request('POST /app/installations/{installation_id}/access_tokens', {\n    installation_id: installationId\n  });\n  return data.token;\n}\n\nexport async function downloadRepo(\n  app: App,\n  installationId: number,\n  owner: string,\n  repo: string,\n  ref: string\n): Promise<RepoDownloadResult> {\n  validarInput(owner, OWNER_REPO_RE, 'owner');\n  validarInput(repo, OWNER_REPO_RE, 'repo');\n  validarInput(ref, REF_RE, 'ref');\n\n  const tempDir = mkdtempSync(join(tmpdir(), 'tutanus-repo-'));\n  const zipPath = join(tempDir, 'repo.zip');\n\n  try {\n    const octokit = await app.getInstallationOctokit(installationId);\n\n    const response = await octokit.request('GET /repos/{owner}/{repo}/zipball/{ref}', {\n      owner,\n      repo,\n      ref,\n      request: { redirect: 'manual' }\n    });\n\n    let zipBuffer: Buffer;\n    if (response.status === HTTP_REDIRECT && response.headers.location) {\n      const redirectUrl = validarRedirectUrl(response.headers.location);\n      const token = await getInstallationToken(app, installationId);\n      const zipResponse = await fetch(redirectUrl, {\n        headers: { Authorization: `Bearer ${token}` }\n      });\n      if (!zipResponse.ok) {\n        throw new Error(GithubRepoDownloaderMensagens.falhaBaixarZipball(zipResponse.status));\n      }\n      zipBuffer = Buffer.from(await zipResponse.arrayBuffer());\n    } else if (Buffer.isBuffer(response.data)) {\n      zipBuffer = response.data;\n    } else {\n      throw new Error(GithubRepoDownloaderMensagens.respostaInesperada);\n    }\n\n    writeFileSync(zipPath, zipBuffer);\n\n    // Extrai o zip usando Node.js child_process com argument array (sem shell)\n    execFileSync('unzip', ['-q', zipPath, '-d', tempDir], { stdio: 'pipe' });\n    rmSync(zipPath);\n\n    // Valida que nenhum entry do zip escapou do diretório (Zip Slip protection)\n    validarSemPathTraversal(tempDir);\n\n    const entries = readdirSync(tempDir);\n    const repoDirName = entries?.find(e => e !== 'repo.zip') ?? '';\n    if (!repoDirName) {\n      throw new Error(GithubRepoDownloaderMensagens.nenhumDiretorioEncontrado);\n    }\n\n    return {\n      tempDir,\n      repoDir: join(tempDir, repoDirName),\n      cleanup: () => {\n        try { rmSync(tempDir, { recursive: true, force: true }); } catch { }\n      }\n    };\n  } catch (err) {\n    rmSync(tempDir, { recursive: true, force: true });\n    throw err;\n  }\n}\n\nexport function escreverAskpassScript(): string {\n  const tmpScript = join(tmpdir(), `tutanus-askpass-${Date.now()}.sh`);\n  writeFileSync(tmpScript, '#!/bin/sh\\necho \"$TUTANUS_GIT_TOKEN\"');\n  chmodSync(tmpScript, 0o500);\n  return tmpScript;\n}\n\nexport function limparAskpassScript(caminho: string): void {\n  try { rmSync(caminho); } catch { }\n}\n\nfunction validarSemPathTraversal(dir: string): void {\n  const pilha = [dir];\n  while (pilha.length > 0) {\n    const atual = pilha.pop();\n    if (!atual) continue;\n    for (const entry of readdirSync(atual)) {\n      const caminhoCompleto = join(atual, entry);\n      if (!caminhoCompleto.startsWith(dir)) {\n        rmSync(dir, { recursive: true, force: true });\n        throw new Error(GithubRepoDownloaderMensagens.pathTraversalDetectado);\n      }\n      if (statSync(caminhoCompleto).isDirectory()) {\n        pilha.push(caminhoCompleto);\n      }\n    }\n  }\n}\n\nexport async function cloneRepo(\n  app: App,\n  installationId: number,\n  owner: string,\n  repo: string,\n  ref: string\n): Promise<RepoDownloadResult> {\n  validarInput(owner, OWNER_REPO_RE, 'owner');\n  validarInput(repo, OWNER_REPO_RE, 'repo');\n  validarInput(ref, REF_RE, 'ref');\n\n  const tempDir = mkdtempSync(join(tmpdir(), 'tutanus-repo-'));\n  const repoDir = join(tempDir, 'repo');\n  const token = await getInstallationToken(app, installationId);\n\n  // Usa GIT_ASKPASS em vez de token na URL para evitar vazamento em process listing\n  const askpassScript = escreverAskpassScript();\n\n  try {\n    execFileSync(\n      'git',\n      ['clone', '--depth', '1', '--branch', ref,\n        `https://github.com/${owner}/${repo}.git`, repoDir],\n      {\n        stdio: 'pipe',\n        timeout: 120000,\n        env: {\n          ...process.env,\n          TUTANUS_GIT_TOKEN: token,\n          GIT_ASKPASS: askpassScript,\n          GIT_TERMINAL_PROMPT: '0'\n        }\n      }\n    );\n\n    return {\n      tempDir,\n      repoDir,\n      cleanup: () => {\n        limparAskpassScript(askpassScript);\n        try { rmSync(tempDir, { recursive: true, force: true }); } catch { }\n      }\n    };\n  } catch (err) {\n    limparAskpassScript(askpassScript);\n    rmSync(tempDir, { recursive: true, force: true });\n    throw err;\n  }\n}\n"]}

package/dist/app/github/app/server.d.ts

@@ -0,0 +1,3 @@
+import type { ServidorAppOptions } from '../../../types/index.js';
+export declare function iniciarServidorApp(opts: ServidorAppOptions): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/app/github/app/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/server.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,GAAG,CAAC;AAc5C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E1E"}

package/dist/app/github/app/server.js

@@ -0,0 +1,85 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { messages } from '../../../core/messages/index.js';
+import { App } from '@octokit/app';
+import express from 'express';
+import { createDashboardRouter } from '../dashboard/index.js';
+import { createIsolationMiddleware } from '../middleware/isolamento.js';
+import { createSecurityMiddleware } from '../middleware/seguranca.js';
+import { createWebhookHandler } from './webhook-handler.js';
+const log = messages.log;
+const { GithubAppMensagens } = messages;
+const HTTP_OK = 200;
+const FRONTEND_DIR = join(process.cwd(), 'out');
+const OCTOKIT_TIMEOUT = parseInt(process.env.TUTANUS_OCTOKIT_TIMEOUT_MS ?? '30000', 10);
+export function iniciarServidorApp(opts) {
+    const app = express();
+    app.set('x-powered-by', false);
+    app.use(express.json({
+        limit: '16kb',
+        verify: (req, _res, buf) => {
+            req.rawBody = buf;
+        }
+    }));
+    app.use(express.urlencoded({ extended: false, limit: '8kb' }));
+    app.use(createSecurityMiddleware());
+    app.use('/api/github', createIsolationMiddleware());
+    const appOctokit = new App({
+        appId: opts.appId,
+        privateKey: opts.privateKey,
+        webhooks: { secret: opts.webhookSecret },
+        request: { timeout: OCTOKIT_TIMEOUT }
+    });
+    const webhookHandler = createWebhookHandler(appOctokit);
+    app.post('/api/github/webhooks', webhookHandler);
+    app.use('/api/github', createDashboardRouter(appOctokit));
+    app.get('/ping', (_req, res) => {
+        res.status(HTTP_OK).send('pong');
+    });
+    if (existsSync(FRONTEND_DIR)) {
+        app.use(express.static(FRONTEND_DIR, {
+            dotfiles: 'deny',
+            index: false,
+            setHeaders: (res) => {
+                res.setHeader('X-Content-Type-Options', 'nosniff');
+                res.setHeader('X-Frame-Options', 'DENY');
+            }
+        }));
+        app.get('/{*path}', (_req, res) => {
+            const indexPath = join(FRONTEND_DIR, 'index.html');
+            if (existsSync(indexPath)) {
+                res.sendFile(indexPath, {
+                    headers: {
+                        'X-Content-Type-Options': 'nosniff',
+                        'X-Frame-Options': 'DENY'
+                    }
+                });
+            }
+            else {
+                res.status(200).type('html').send('Tutanus API rodando.');
+            }
+        });
+    }
+    else {
+        app.get('/', (_req, res) => {
+            res.type('html').send('Tutanus API rodando. Landing nao encontrada (rode npm run build para gerar out/).');
+        });
+    }
+    return new Promise((resolve, reject) => {
+        try {
+            app.listen(opts.port, () => {
+                log.sucesso(GithubAppMensagens.servidorRodando(opts.port));
+                log.info(GithubAppMensagens.webhooksEndpoint(opts.port));
+                log.info(GithubAppMensagens.healthEndpoint(opts.port));
+                log.info(GithubAppMensagens.dashboardEndpoint(opts.port));
+                log.info(GithubAppMensagens.statsEndpoint(opts.port));
+                resolve();
+            });
+        }
+        catch (err) {
+            log.erro(GithubAppMensagens.erroIniciarServidor(err instanceof Error ? err.message : String(err)));
+            reject(err);
+        }
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/app/github/app/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/app/github/app/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;AACzB,MAAM,EAAE,kBAAkB,EAAE,GAAG,QAAQ,CAAC;AAExC,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;AAChD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AAExF,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,CAAC,GAA2C,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAChE,GAA4B,CAAC,OAAO,GAAG,GAAG,CAAC;QAC9C,CAAC;KACF,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAE/D,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAEpD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE;QACxC,OAAO,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;KACtC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;IAEjD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;IAE1D,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE;YACnC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;gBAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;gBACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3C,CAAC;SACF,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;oBACtB,OAAO,EAAE;wBACP,wBAAwB,EAAE,SAAS;wBACnC,iBAAiB,EAAE,MAAM;qBAC1B;iBACF,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACzB,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["// SPDX-License-Identifier: MIT\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { messages } from '@core/messages';\nimport { App } from '@octokit/app';\nimport express from 'express';\n\nimport type { ServidorAppOptions } from '@';\n\nimport { createDashboardRouter } from '../dashboard/index.js';\nimport { createIsolationMiddleware } from '../middleware/isolamento.js';\nimport { createSecurityMiddleware } from '../middleware/seguranca.js';\nimport { createWebhookHandler } from './webhook-handler.js';\n\nconst log = messages.log;\nconst { GithubAppMensagens } = messages;\n\nconst HTTP_OK = 200;\nconst FRONTEND_DIR = join(process.cwd(), 'out');\nconst OCTOKIT_TIMEOUT = parseInt(process.env.TUTANUS_OCTOKIT_TIMEOUT_MS ?? '30000', 10);\n\nexport function iniciarServidorApp(opts: ServidorAppOptions): Promise<void> {\n  const app = express();\n\n  app.set('x-powered-by', false);\n\n  app.use(express.json({\n    limit: '16kb',\n    verify: (req: express.Request & { rawBody?: Buffer }, _res, buf) => {\n      (req as { rawBody?: Buffer }).rawBody = buf;\n    }\n  }));\n\n  app.use(express.urlencoded({ extended: false, limit: '8kb' }));\n\n  app.use(createSecurityMiddleware());\n\n  app.use('/api/github', createIsolationMiddleware());\n\n  const appOctokit = new App({\n    appId: opts.appId,\n    privateKey: opts.privateKey,\n    webhooks: { secret: opts.webhookSecret },\n    request: { timeout: OCTOKIT_TIMEOUT }\n  });\n\n  const webhookHandler = createWebhookHandler(appOctokit);\n\n  app.post('/api/github/webhooks', webhookHandler);\n\n  app.use('/api/github', createDashboardRouter(appOctokit));\n\n  app.get('/ping', (_req, res) => {\n    res.status(HTTP_OK).send('pong');\n  });\n\n  if (existsSync(FRONTEND_DIR)) {\n    app.use(express.static(FRONTEND_DIR, {\n      dotfiles: 'deny',\n      index: false,\n      setHeaders: (res) => {\n        res.setHeader('X-Content-Type-Options', 'nosniff');\n        res.setHeader('X-Frame-Options', 'DENY');\n      }\n    }));\n    app.get('/{*path}', (_req, res) => {\n      const indexPath = join(FRONTEND_DIR, 'index.html');\n      if (existsSync(indexPath)) {\n        res.sendFile(indexPath, {\n          headers: {\n            'X-Content-Type-Options': 'nosniff',\n            'X-Frame-Options': 'DENY'\n          }\n        });\n      } else {\n        res.status(200).type('html').send('Tutanus API rodando.');\n      }\n    });\n  } else {\n    app.get('/', (_req, res) => {\n      res.type('html').send('Tutanus API rodando. Landing nao encontrada (rode npm run build para gerar out/).');\n    });\n  }\n\n  return new Promise<void>((resolve, reject) => {\n    try {\n      app.listen(opts.port, () => {\n        log.sucesso(GithubAppMensagens.servidorRodando(opts.port));\n        log.info(GithubAppMensagens.webhooksEndpoint(opts.port));\n        log.info(GithubAppMensagens.healthEndpoint(opts.port));\n        log.info(GithubAppMensagens.dashboardEndpoint(opts.port));\n        log.info(GithubAppMensagens.statsEndpoint(opts.port));\n        resolve();\n      });\n    } catch (err) {\n      log.erro(GithubAppMensagens.erroIniciarServidor(err instanceof Error ? err.message : String(err)));\n      reject(err);\n    }\n  });\n}\n"]}

package/dist/app/github/app/setup-routes.d.ts

@@ -0,0 +1,5 @@
+import type { App } from '@octokit/app';
+import { type Request, Router } from 'express';
+export declare function createSetupRouter(app: App): Router;
+export declare function buildSetupUrl(req?: Request): string;
+//# sourceMappingURL=setup-routes.d.ts.map

package/dist/app/github/app/setup-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-routes.d.ts","sourceRoot":"","sources":["../../../../src/app/github/app/setup-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAiB,MAAM,EAAE,MAAM,SAAS,CAAC;AAc9D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CA6DlD;AAED,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAYnD"}