vouchington-tooling 0.0.16 → 0.0.18

package/README.md

@@ -33,6 +33,16 @@ vouchington make-shard-matrix 4
 vouchington load-runner-env
 vouchington clean-workspace
 vouchington install-github-release --repo lycheeverse/lychee --version 0.24.2 --asset 'lychee-{platform}.tar.gz' --bin lychee
+vouchington run-with-timeout 120 10 docker push example
+vouchington lint-links --offline
+vouchington materialize-pr-context
+vouchington wait-for-apt-locks
+vouchington install-playwright-chromium-arm64
+vouchington ghcr-package-retention example%2Fapi
+vouchington nuget-central-version trusted.props candidate.props metadata.json out.props
+vouchington swift-semantic-equal BASE HEAD App.swift
+vouchington post-review
+vouchington stage-review-payload optional|required <source> <destination>
 ```
 
 Host-lock environment:
@@ -83,6 +93,7 @@ import { parseCsvRows, streamCsvRows } from 'vouchington-tooling/csv'
 import { readResponseBody } from 'vouchington-tooling/http-body'
 import { runAstGrepRule } from 'vouchington-tooling/ast-grep-rule'
 import { parseReviewPayload, remapReviewComments } from 'vouchington-tooling/gha-review-payload'
+import { runPostReview } from 'vouchington-tooling/gha-post-review'
 import { nextPageUrlFromLinkHeader } from 'vouchington-tooling/http-link-pagination'
 import { cmdUpload, mintPresignedControl } from 'vouchington-tooling/coverage-transport'
 import { pruneDeployedRuntimeDeps } from 'vouchington-tooling/pnpm-deploy'
@@ -92,8 +103,12 @@ import { runCiLocal } from 'vouchington-tooling/ci-local'
 import { rateLimitDelay } from 'vouchington-tooling/gha-rate-limit'
 import { parseCheckpoint } from 'vouchington-tooling/gha-pr-checkpoint'
 import { checkWorkspaceGatesPolicy } from 'vouchington-tooling/workspace-gates'
+import { validateNugetUpdate } from 'vouchington-tooling/nuget-central-version'
+import { normalizeSwiftSource } from 'vouchington-tooling/swift-semantic-equal'
+import { parseUniqueSwiftBinaryTargetChecksum } from 'vouchington-tooling/swift-source-offset'
+import { validateResolvedPinDelta } from 'vouchington-tooling/swift-resolved-pin-delta'
 ```
 
 The artifact, review-payload, HTTP body, and pagination APIs validate untrusted inputs at their
-boundaries. They do not include provider credentials, product policy, network transport, or
-repository-specific package names; consumers supply those through their own adapters.
+boundaries. Review posting lives in `gha-post-review` and talks to GitHub only through caller-supplied
+credentials (job token or a minted Claude GitHub App token).

package/dist/cli/commands/nuget-central-version.d.mts

@@ -0,0 +1 @@
+export declare function runNugetCentralVersionCommand(args: readonly string[]): number;

package/dist/cli/commands/nuget-central-version.mjs

@@ -0,0 +1,11 @@
+import { runNugetCentralVersionCli } from '../../nuget-central-version/cli.mjs';
+export function runNugetCentralVersionCommand(args) {
+    try {
+        runNugetCentralVersionCli(args);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}

package/dist/cli/commands/post-review.d.mts

@@ -0,0 +1 @@
+export declare function runPostReviewCommand(): Promise<number>;

package/dist/cli/commands/post-review.mjs

@@ -0,0 +1,4 @@
+import { runPostReviewCli } from '../../gha-post-review/cli.mjs';
+export function runPostReviewCommand() {
+    return runPostReviewCli();
+}

package/dist/cli/commands/stage-review-payload.d.mts

@@ -0,0 +1 @@
+export declare function runStageReviewPayloadCommand(args: readonly string[]): number;

package/dist/cli/commands/stage-review-payload.mjs

@@ -0,0 +1,4 @@
+import { runStageReviewPayloadCli } from '../../gha-review-payload/cli.mjs';
+export function runStageReviewPayloadCommand(args) {
+    return runStageReviewPayloadCli(args);
+}

package/dist/cli/commands/swift-semantic-equal.d.mts

@@ -0,0 +1 @@
+export declare function runSwiftSemanticEqualCommand(args: readonly string[]): number;

package/dist/cli/commands/swift-semantic-equal.mjs

@@ -0,0 +1,4 @@
+import { runSwiftSemanticEqualCli } from '../../swift-semantic-equal/cli.mjs';
+export function runSwiftSemanticEqualCommand(args) {
+    return runSwiftSemanticEqualCli(args);
+}

package/dist/cli/index.mjs

@@ -9,6 +9,10 @@ import { runHttpOrigin } from './commands/http-origin.mjs';
 import { runPnpmInstallCli } from './commands/pnpm-install.mjs';
 import { runRunnerPortPolicy } from './commands/runner-port-policy.mjs';
 import { runScript } from './commands/spawn-script.mjs';
+import { runNugetCentralVersionCommand } from './commands/nuget-central-version.mjs';
+import { runPostReviewCommand } from './commands/post-review.mjs';
+import { runStageReviewPayloadCommand } from './commands/stage-review-payload.mjs';
+import { runSwiftSemanticEqualCommand } from './commands/swift-semantic-equal.mjs';
 import { runVitestBlobManifestCommand } from './commands/vitest-blob-manifest.mjs';
 import { runWithHostLock } from './commands/with-host-lock.mjs';
 import { parseCli } from './parse.mjs';
@@ -39,6 +43,15 @@ const SCRIPT_PATHS = {
     'load-runner-env': { command: 'bash', path: 'scripts/gha/load-runner-env.sh' },
     'clean-workspace': { command: 'bash', path: 'scripts/gha/clean-workspace.sh' },
     'install-github-release': { command: 'bash', path: 'scripts/gha/install-github-release.sh' },
+    'run-with-timeout': { command: 'bash', path: 'scripts/gha/run-with-timeout.sh' },
+    'lint-links': { command: 'bash', path: 'scripts/gha/lint-links.sh' },
+    'materialize-pr-context': { command: 'bash', path: 'scripts/gha/materialize-pr-context.sh' },
+    'wait-for-apt-locks': { command: 'bash', path: 'scripts/gha/wait-for-apt-locks.sh' },
+    'install-playwright-chromium-arm64': {
+        command: 'bash',
+        path: 'scripts/gha/install-playwright-chromium-arm64.sh',
+    },
+    'ghcr-package-retention': { command: 'bash', path: 'scripts/gha/ghcr-package-retention.sh' },
 };
 export function runCli(argv = process.argv) {
     const parsed = parseCli(argv);
@@ -67,6 +80,14 @@ export function runCli(argv = process.argv) {
             return runPnpmInstallCli(parsed.args);
         case 'vitest-blob-manifest':
             return runVitestBlobManifestCommand(parsed.args);
+        case 'nuget-central-version':
+            return runNugetCentralVersionCommand(parsed.args);
+        case 'swift-semantic-equal':
+            return runSwiftSemanticEqualCommand(parsed.args);
+        case 'post-review':
+            return runPostReviewCommand();
+        case 'stage-review-payload':
+            return runStageReviewPayloadCommand(parsed.args);
         case 'http-origin':
             return runHttpOrigin(parsed.field, parsed.value);
         case 'gha-artifacts-cleanup':

package/dist/cli/parse.d.mts

@@ -24,10 +24,22 @@ export type ParsedCli = {
 } | {
     kind: 'vitest-blob-manifest';
     args: string[];
+} | {
+    kind: 'nuget-central-version';
+    args: string[];
+} | {
+    kind: 'swift-semantic-equal';
+    args: string[];
+} | {
+    kind: 'post-review';
+    args: string[];
+} | {
+    kind: 'stage-review-payload';
+    args: string[];
 } | {
     kind: 'http-origin';
     field: string;
     value: string;
 } | ParsedGhaRuntimeAudit | ParsedGhaArtifactsCleanup;
-export type ScriptCommand = 'gha-output' | 'gha-needs-results' | 'download-with-diagnostics' | 'host-pressure-diagnostics' | 'allocate-browser-safe-ports' | 'diagnose-port-collision' | 'prepare-trivy-db' | 'check-cache-size' | 'make-shard-matrix' | 'load-runner-env' | 'clean-workspace' | 'install-github-release';
+export type ScriptCommand = 'gha-output' | 'gha-needs-results' | 'download-with-diagnostics' | 'host-pressure-diagnostics' | 'allocate-browser-safe-ports' | 'diagnose-port-collision' | 'prepare-trivy-db' | 'check-cache-size' | 'make-shard-matrix' | 'load-runner-env' | 'clean-workspace' | 'install-github-release' | 'run-with-timeout' | 'lint-links' | 'materialize-pr-context' | 'wait-for-apt-locks' | 'install-playwright-chromium-arm64' | 'ghcr-package-retention';
 export declare function parseCli(argv: readonly string[]): ParsedCli;

package/dist/cli/parse.mjs

@@ -13,6 +13,12 @@ const SCRIPT_COMMANDS = new Set([
     'load-runner-env',
     'clean-workspace',
     'install-github-release',
+    'run-with-timeout',
+    'lint-links',
+    'materialize-pr-context',
+    'wait-for-apt-locks',
+    'install-playwright-chromium-arm64',
+    'ghcr-package-retention',
 ]);
 export function parseCli(argv) {
     const args = argv.slice(2);
@@ -31,6 +37,14 @@ export function parseCli(argv) {
         return { kind: 'pnpm-install', args: rest };
     if (command === 'vitest-blob-manifest')
         return { kind: 'vitest-blob-manifest', args: rest };
+    if (command === 'nuget-central-version')
+        return { kind: 'nuget-central-version', args: rest };
+    if (command === 'swift-semantic-equal')
+        return { kind: 'swift-semantic-equal', args: rest };
+    if (command === 'post-review')
+        return { kind: 'post-review', args: rest };
+    if (command === 'stage-review-payload')
+        return { kind: 'stage-review-payload', args: rest };
     if (command === 'http-origin')
         return parseHttpOrigin(rest);
     if (command === 'gha-artifacts-cleanup')

package/dist/cli/usage.d.mts

@@ -1,2 +1,2 @@
-export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\nhost-pressure-diagnostics\nallocate-browser-safe-ports [count] [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name\n";
+export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n  post-review                   Post one COMMENT review from a staged payload file\n  stage-review-payload          Validate a review payload file into a staging directory\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\nhost-pressure-diagnostics\nallocate-browser-safe-ports [count] [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\npost-review\nstage-review-payload optional|required <source> <destination>\n";
 export declare function printUsage(stream?: NodeJS.WritableStream): void;

package/dist/cli/usage.mjs

@@ -20,6 +20,16 @@ Commands:
   load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards
   clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate
   install-github-release        Download a checksum-verified GitHub Release binary
+  run-with-timeout              Run a command with GNU timeout or a Perl fallback
+  lint-links                    Two-pass lychee: internal links fail, external warn
+  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl
+  wait-for-apt-locks            Wait until apt/dpkg lock files are free
+  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json
+  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN
+  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta
+  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace
+  post-review                   Post one COMMENT review from a staged payload file
+  stage-review-payload          Validate a review payload file into a staging directory
 
 Options:
   -h, --help       Show this help
@@ -61,7 +71,17 @@ check-cache-size <path> <max-bytes> <label>
 make-shard-matrix <total>
 load-runner-env
 clean-workspace
-install-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name
+install-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]
+run-with-timeout <timeout-seconds> <kill-after-seconds> <command...>
+lint-links [--offline] [--config PATH] [--glob PATTERN] [files...]
+materialize-pr-context
+wait-for-apt-locks
+install-playwright-chromium-arm64 [name:archive...]
+ghcr-package-retention <url-encoded-package>...
+nuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>
+swift-semantic-equal <base> <head> <file.swift>
+post-review
+stage-review-payload optional|required <source> <destination>
 `;
 export function printUsage(stream = process.stdout) {
     stream.write(USAGE);

package/dist/gha-post-review/claude-token.d.mts

@@ -0,0 +1,25 @@
+export declare const CLAUDE_OIDC_AUDIENCE = "claude-code-github-action";
+export declare const CLAUDE_APP_TOKEN_EXCHANGE_URL = "https://api.anthropic.com/api/github/github-app-token-exchange";
+export declare const CLAUDE_POSTER_PERMISSIONS: {
+    readonly contents: 'read';
+    readonly pull_requests: 'write';
+};
+export declare const GITHUB_INSTALLATION_TOKEN_URL = "https://api.github.com/installation/token";
+export type FetchLike = (url: string, init: RequestInit) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export type ClaudeTokenIo = {
+    getOidcToken(): Promise<string>;
+    fetch: FetchLike;
+    mask(token: string): void;
+};
+export declare function oidcTokenRequest(env: NodeJS.ProcessEnv): {
+    url: string;
+    token: string;
+};
+export declare function mintClaudeAppToken(io: ClaudeTokenIo): Promise<string>;
+export declare function revokeClaudeAppToken(token: string, io: Pick<ClaudeTokenIo, 'fetch'>): Promise<void>;
+export declare function withClaudeAppToken<T>(io: ClaudeTokenIo, fn: (token: string) => T | Promise<T>): Promise<T>;
+export declare function createActionsClaudeTokenIo(env?: NodeJS.ProcessEnv, fetchImpl?: FetchLike): ClaudeTokenIo;

package/dist/gha-post-review/claude-token.mjs

@@ -0,0 +1,107 @@
+import { ReviewPayloadError as PostReviewError } from '../gha-review-payload/index.mjs';
+export const CLAUDE_OIDC_AUDIENCE = 'claude-code-github-action';
+export const CLAUDE_APP_TOKEN_EXCHANGE_URL = 'https://api.anthropic.com/api/github/github-app-token-exchange';
+// Anthropic rejects the exchange unless custom permissions include contents
+// (read or write), even when the token is only used to POST /reviews.
+export const CLAUDE_POSTER_PERMISSIONS = {
+    contents: 'read',
+    pull_requests: 'write',
+};
+export const GITHUB_INSTALLATION_TOKEN_URL = 'https://api.github.com/installation/token';
+export function oidcTokenRequest(env) {
+    const base = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const token = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!base || !token) {
+        throw new PostReviewError('OIDC token request env is missing.');
+    }
+    const separator = base.includes('?') ? '&' : '?';
+    return {
+        url: `${base}${separator}audience=${encodeURIComponent(CLAUDE_OIDC_AUDIENCE)}`,
+        token,
+    };
+}
+function readToken(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return '';
+    const record = payload;
+    const token = record.token ?? record.app_token ?? record.value;
+    return typeof token === 'string' ? token : '';
+}
+function readErrorMessage(payload) {
+    if (payload === null || typeof payload !== 'object')
+        return '';
+    const record = payload;
+    if (typeof record.message === 'string' && record.message.length > 0)
+        return record.message;
+    const nested = record.error;
+    if (nested !== null && typeof nested === 'object') {
+        const message = nested.message;
+        if (typeof message === 'string')
+            return message;
+    }
+    return '';
+}
+function exchangeErrorMessage(status, payload) {
+    const detail = readErrorMessage(payload);
+    const suffix = detail.length > 0 ? `: ${detail}` : '';
+    return `Claude App token exchange failed (HTTP ${status})${suffix}.`;
+}
+export async function mintClaudeAppToken(io) {
+    const oidcToken = await io.getOidcToken();
+    const response = await io.fetch(CLAUDE_APP_TOKEN_EXCHANGE_URL, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${oidcToken}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ permissions: CLAUDE_POSTER_PERMISSIONS }),
+    });
+    if (!response.ok) {
+        throw new PostReviewError(exchangeErrorMessage(response.status, await response.json().catch(() => null)));
+    }
+    const appToken = readToken(await response.json());
+    if (appToken.length === 0) {
+        throw new PostReviewError('Claude App token exchange returned no token.');
+    }
+    io.mask(appToken);
+    return appToken;
+}
+export async function revokeClaudeAppToken(token, io) {
+    await io.fetch(GITHUB_INSTALLATION_TOKEN_URL, {
+        method: 'DELETE',
+        headers: {
+            Accept: 'application/vnd.github+json',
+            Authorization: `Bearer ${token}`,
+        },
+    });
+}
+export async function withClaudeAppToken(io, fn) {
+    const token = await mintClaudeAppToken(io);
+    try {
+        return await fn(token);
+    }
+    finally {
+        await revokeClaudeAppToken(token, io);
+    }
+}
+export function createActionsClaudeTokenIo(env = process.env, fetchImpl = fetch) {
+    return {
+        async getOidcToken() {
+            const request = oidcTokenRequest(env);
+            const response = await fetchImpl(request.url, {
+                headers: { Authorization: `Bearer ${request.token}` },
+            });
+            if (!response.ok) {
+                throw new PostReviewError(`OIDC token request failed (HTTP ${response.status}).`);
+            }
+            const jwt = readToken(await response.json());
+            if (jwt.length === 0)
+                throw new PostReviewError('OIDC token request returned no token.');
+            return jwt;
+        },
+        fetch: fetchImpl,
+        mask(token) {
+            process.stdout.write(`::add-mask::${token}\n`);
+        },
+    };
+}

package/dist/gha-post-review/cli.d.mts

@@ -0,0 +1 @@
+export declare function runPostReviewCli(env?: NodeJS.ProcessEnv): Promise<number>;

package/dist/gha-post-review/cli.mjs

@@ -0,0 +1,22 @@
+import { fileURLToPath } from 'node:url';
+import { writePostedOutput, postReviewFromEnv } from './github.mjs';
+export async function runPostReviewCli(env = process.env) {
+    try {
+        const result = await postReviewFromEnv(env);
+        writePostedOutput(result.posted, env.GITHUB_OUTPUT);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+/* v8 ignore next 12 */
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    runPostReviewCli().then((code) => {
+        process.exitCode = code;
+    }, (error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/gha-post-review/github.d.mts

@@ -0,0 +1,20 @@
+import { execFileSync } from 'node:child_process';
+import { type PostResult, type PostReviewIo, type SanitizedReview } from './post.mts';
+export type GhExec = (args: readonly string[], options?: {
+    input?: string;
+    env?: NodeJS.ProcessEnv;
+}) => string;
+export declare function createGhExec(exec?: typeof execFileSync): GhExec;
+export declare function postWithGh(repository: string, prNumber: string, payload: SanitizedReview, token: string, exec: GhExec): PostResult;
+export declare function writePostedOutput(posted: boolean, outputPath?: string | undefined): void;
+export declare function createGhPostReviewIo(options: {
+    repository: string;
+    prNumber: string;
+    payloadPath: string;
+    payloadBytes: Buffer;
+    token: string;
+    exec: GhExec;
+}): PostReviewIo;
+export declare function postReviewFromEnv(env?: NodeJS.ProcessEnv, exec?: GhExec, claudeIo?: import("./claude-token.mts").ClaudeTokenIo): Promise<{
+    posted: boolean;
+}>;

package/dist/gha-post-review/github.mjs

@@ -0,0 +1,77 @@
+import { execFileSync } from 'node:child_process';
+import { appendFileSync, rmSync } from 'node:fs';
+import { parseReviewFilesJson } from '../gha-review-payload/index.mjs';
+import { ReviewPayloadError } from '../gha-review-payload/index.mjs';
+import { createActionsClaudeTokenIo, withClaudeAppToken } from './claude-token.mjs';
+import { runPostReview } from './post.mjs';
+import { requireEnv, resolveReviewPostToken } from './token.mjs';
+import { readRegularReviewPayload } from '../gha-review-payload/index.mjs';
+export function createGhExec(exec = execFileSync) {
+    return (args, options) => exec('gh', [...args], {
+        encoding: 'utf8',
+        input: options?.input,
+        env: options?.env ?? process.env,
+    }).trim();
+}
+export function postWithGh(repository, prNumber, payload, token, exec) {
+    try {
+        exec(['api', '--method', 'POST', `repos/${repository}/pulls/${prNumber}/reviews`, '--input', '-'], {
+            input: JSON.stringify(payload),
+            env: { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token },
+        });
+        return { ok: true, status: 201, body: '' };
+    }
+    catch (error) {
+        const err = error;
+        const text = `${err.stdout ?? ''}${err.stderr ?? ''}${err.message ?? ''}`;
+        const status = Number(/HTTP\s+(\d{3})/u.exec(text)?.[1] ?? 0);
+        return { ok: false, status, body: text };
+    }
+}
+export function writePostedOutput(posted, outputPath = process.env.GITHUB_OUTPUT) {
+    if (!outputPath)
+        return;
+    appendFileSync(outputPath, `posted=${posted ? 'true' : 'false'}\n`);
+}
+export function createGhPostReviewIo(options) {
+    const { repository, prNumber, payloadBytes, token, exec } = options;
+    return {
+        readFile() {
+            return payloadBytes;
+        },
+        removeFile(path) {
+            rmSync(path, { force: true });
+        },
+        getHeadSha() {
+            const sha = exec(['api', `repos/${repository}/pulls/${prNumber}`, '--jq', '.head.sha']);
+            if (!/^[0-9a-f]{40}$/u.test(sha)) {
+                throw new ReviewPayloadError(`Could not resolve PR head SHA (got "${sha}").`);
+            }
+            return sha;
+        },
+        listPullFiles() {
+            return parseReviewFilesJson(exec(['api', '--paginate', `repos/${repository}/pulls/${prNumber}/files?per_page=100`]));
+        },
+        postReview(payload) {
+            return postWithGh(repository, prNumber, payload, token, exec);
+        },
+    };
+}
+export async function postReviewFromEnv(env = process.env, exec = createGhExec(), claudeIo = createActionsClaudeTokenIo(env)) {
+    const repository = requireEnv('GITHUB_REPOSITORY', env);
+    const prNumber = requireEnv('PR_NUMBER', env);
+    const payloadPath = requireEnv('CODE_REVIEW_PAYLOAD_PATH', env);
+    const payloadBytes = readRegularReviewPayload(payloadPath, 'required');
+    const postWithToken = (token) => runPostReview(payloadPath, createGhPostReviewIo({
+        repository,
+        prNumber,
+        payloadPath,
+        payloadBytes,
+        token,
+        exec,
+    }));
+    const token = resolveReviewPostToken(env);
+    if (token.source === 'github-token')
+        return postWithToken(token.token);
+    return await withClaudeAppToken(claudeIo, postWithToken);
+}

package/dist/gha-post-review/index.d.mts

@@ -0,0 +1,9 @@
+export { MAX_COMMENTS, MAX_PAYLOAD_BYTES, PostReviewError, runPostReview } from './post.mts';
+export type { PostResult, PostReviewIo, PullFile, ReviewComment, SanitizedReview } from './post.mts';
+export { requireEnv, resolveReviewPostToken } from './token.mts';
+export type { ReviewPostToken } from './token.mts';
+export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from './claude-token.mts';
+export type { ClaudeTokenIo, FetchLike } from './claude-token.mts';
+export { createGhExec, createGhPostReviewIo, postReviewFromEnv, postWithGh, writePostedOutput, } from './github.mts';
+export type { GhExec } from './github.mts';
+export { runPostReviewCli } from './cli.mts';

package/dist/gha-post-review/index.mjs

@@ -0,0 +1,5 @@
+export { MAX_COMMENTS, MAX_PAYLOAD_BYTES, PostReviewError, runPostReview } from './post.mjs';
+export { requireEnv, resolveReviewPostToken } from './token.mjs';
+export { CLAUDE_APP_TOKEN_EXCHANGE_URL, CLAUDE_OIDC_AUDIENCE, CLAUDE_POSTER_PERMISSIONS, GITHUB_INSTALLATION_TOKEN_URL, createActionsClaudeTokenIo, mintClaudeAppToken, oidcTokenRequest, revokeClaudeAppToken, withClaudeAppToken, } from './claude-token.mjs';
+export { createGhExec, createGhPostReviewIo, postReviewFromEnv, postWithGh, writePostedOutput, } from './github.mjs';
+export { runPostReviewCli } from './cli.mjs';

package/dist/gha-post-review/post.d.mts

@@ -0,0 +1,18 @@
+import { type ReviewFile, type SanitizedReview } from '../gha-review-payload/index.mts';
+export { MAX_REVIEW_COMMENTS as MAX_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES as MAX_PAYLOAD_BYTES, ReviewPayloadError as PostReviewError, type ReviewComment, type SanitizedReview, } from '../gha-review-payload/index.mts';
+export type PullFile = ReviewFile;
+export type PostResult = {
+    ok: boolean;
+    status: number;
+    body: string;
+};
+export type PostReviewIo = {
+    readFile(path: string): Buffer;
+    removeFile(path: string): void;
+    getHeadSha(): string;
+    listPullFiles(): PullFile[];
+    postReview(payload: SanitizedReview): PostResult;
+};
+export declare function runPostReview(payloadPath: string, io: PostReviewIo): {
+    posted: boolean;
+};

package/dist/gha-post-review/post.mjs

@@ -0,0 +1,27 @@
+import { ReviewPayloadError, bodyOnlyReviewFallback, indexReviewFiles, parseReviewPayload, remapReviewComments, } from '../gha-review-payload/index.mjs';
+export { MAX_REVIEW_COMMENTS as MAX_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES as MAX_PAYLOAD_BYTES, ReviewPayloadError as PostReviewError, } from '../gha-review-payload/index.mjs';
+export function runPostReview(payloadPath, io) {
+    try {
+        let review = parseReviewPayload(io.readFile(payloadPath), io.getHeadSha());
+        try {
+            review = remapReviewComments(review, indexReviewFiles(io.listPullFiles()));
+        }
+        catch {
+            // Keep the parsed review when the PR file list is unavailable.
+        }
+        const first = io.postReview(review);
+        if (first.ok)
+            return { posted: true };
+        if (first.status !== 422) {
+            throw new ReviewPayloadError(`GitHub review POST failed (HTTP ${first.status}).`);
+        }
+        const retry = io.postReview(bodyOnlyReviewFallback(review, first.status));
+        if (!retry.ok) {
+            throw new ReviewPayloadError(`GitHub review POST retry failed (HTTP ${retry.status}).`);
+        }
+        return { posted: true };
+    }
+    finally {
+        io.removeFile(payloadPath);
+    }
+}

package/dist/gha-post-review/token.d.mts

@@ -0,0 +1,8 @@
+export type ReviewPostToken = {
+    source: 'github-token';
+    token: string;
+} | {
+    source: 'claude-app';
+};
+export declare function resolveReviewPostToken(env?: NodeJS.ProcessEnv): ReviewPostToken;
+export declare function requireEnv(name: string, env?: NodeJS.ProcessEnv): string;

package/dist/gha-post-review/token.mjs

@@ -0,0 +1,20 @@
+import { ReviewPayloadError } from '../gha-review-payload/index.mjs';
+export function resolveReviewPostToken(env = process.env) {
+    const source = env.CODE_REVIEW_TOKEN_SOURCE || 'claude-app';
+    if (source === 'github-token') {
+        const token = env.GH_TOKEN || env.GITHUB_TOKEN;
+        if (!token)
+            throw new ReviewPayloadError('GH_TOKEN or GITHUB_TOKEN is required.');
+        return { source, token };
+    }
+    if (source !== 'claude-app') {
+        throw new ReviewPayloadError(`Unknown CODE_REVIEW_TOKEN_SOURCE "${source}".`);
+    }
+    return { source: 'claude-app' };
+}
+export function requireEnv(name, env = process.env) {
+    const value = env[name];
+    if (!value)
+        throw new ReviewPayloadError(`${name} is required.`);
+    return value;
+}

package/dist/gha-review-payload/cli.d.mts

@@ -0,0 +1 @@
+export declare function runStageReviewPayloadCli(args: readonly string[]): number;

package/dist/gha-review-payload/cli.mjs

@@ -0,0 +1,24 @@
+import { fileURLToPath } from 'node:url';
+import { ReviewPayloadError } from './payload.mjs';
+import { stageReviewPayload, writeStagedOutput } from './file.mjs';
+export function runStageReviewPayloadCli(args) {
+    try {
+        const [requirement, source, destination] = args;
+        if (requirement !== 'optional' && requirement !== 'required') {
+            throw new ReviewPayloadError('payload requirement must be optional or required.');
+        }
+        if (!source || !destination || args.length !== 3) {
+            throw new ReviewPayloadError('Usage: vouchington stage-review-payload optional|required <source> <destination>');
+        }
+        writeStagedOutput('staged', stageReviewPayload(source, destination, requirement) ? 'true' : 'false');
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}
+/* v8 ignore next 3 */
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    process.exitCode = runStageReviewPayloadCli(process.argv.slice(2));
+}