| 1 | import { DurableObject } from "cloudflare:workers"; |
| 2 | import { normalizeCheckSources, requiredCheck } from "./required.js"; |
| 3 | import { REVIEW_APP, REVIEW_CHECK } from "../agentic/review.js"; |
| 4 | import { unsafeTreePath } from "../lib/tree-names.js"; |
| 5 | import { |
| 6 | CODE_TYPES, |
| 7 | EMPTY_TREE_OID, |
| 8 | ZERO_OID, |
| 9 | applyChanges, |
| 10 | DiffBudget, |
| 11 | diffTrees, |
| 12 | fileDiff, |
| 13 | formatUnified, |
| 14 | fromUtf8, |
| 15 | isAncestor, |
| 16 | isBinary, |
| 17 | isOid, |
| 18 | isTreeMode, |
| 19 | mergeBase, |
| 20 | parseCommit, |
| 21 | packStream, |
| 22 | parsePack, |
| 23 | parseTree, |
| 24 | planFetch, |
| 25 | peelToCommit, |
| 26 | readCommit, |
| 27 | readTree, |
| 28 | resolvePath, |
| 29 | TooMuchMemory, |
| 30 | MAX_HELD_BYTES, |
| 31 | serializeCommit, |
| 32 | walkCommits, |
| 33 | type Commit, |
| 34 | type FileChange, |
| 35 | type Signature, |
| 36 | utf8, |
| 37 | } from "@diffinery/git-core"; |
| 38 | import type { DiffineryEvent } from "@diffinery/shared"; |
| 39 | import type { Env } from "../env.js"; |
| 40 | import { |
| 41 | advertiseReceivePack, |
| 42 | advertiseUploadPackV2, |
| 43 | errorPacket, |
| 44 | handleUploadPackV2, |
| 45 | parseReceivePack, |
| 46 | reportStatus, |
| 47 | type ReceiveRequest, |
| 48 | resetByDeploy, |
| 49 | unpackFailure, |
| 50 | type RefEntry, |
| 51 | type RefResult, |
| 52 | } from "../git/protocol.js"; |
| 53 | import { memorySource, packedContents, readStagedHead, repositoryBases, stagedContents, streamedContents, type PushContents } from "../git/push-contents.js"; |
| 54 | import { scanForSecrets, secretBypassReason, type SecretHit } from "../git/secret-scan.js"; |
| 55 | import { Directory } from "../lib/directory.js"; |
| 56 | import { GHOST, HttpError, isValidRefName, noreplyEmail, now } from "../lib/util.js"; |
| 57 | import { R2Sink } from "../lib/r2-sink.js"; |
| 58 | import { archivePrefix, deletePrefixes, pushBodyKey, repoPrefixes, type SpilledBody } from "../lib/storage-keys.js"; |
| 59 | import { MemoryPool, type Lease } from "../lib/memory-pool.js"; |
| 60 | import { storageRefusal } from "../lib/quotas.js"; |
| 61 | import { Actions } from "./actions.js"; |
| 62 | import { AutoMerge, isPerson } from "./auto-merge.js"; |
| 63 | import { Collab } from "./collab.js"; |
| 64 | import { Deployments } from "./deployments.js"; |
| 65 | import { triggerWorkflows } from "./extra-triggers.js"; |
| 66 | import { GitData } from "./gitdata.js"; |
| 67 | import { IMPORT_REF_PREFIX, RepoImports } from "./imports.js"; |
| 68 | import { RepoObjectStore } from "./objects.js"; |
| 69 | import { MergeQueue, QUEUE_BRANCH_PREFIX, normalizeMergeQueue } from "./queue.js"; |
| 70 | import { Releases } from "./releases.js"; |
| 71 | import { REPO_SCHEMA, migrateRepoSchema } from "./schema.js"; |
| 72 | import { Runtime } from "./runtime.js"; |
| 73 | import { TokenPolicy } from "./token-policy.js"; |
| 74 | import { searchIssues } from "./search.js"; |
| 75 | import { MERGE_CHECKS_PER_SUMMARY, needsMergeCheck, repoToday } from "../agentic/today-repo.js"; |
| 76 | import { Social } from "./social.js"; |
| 77 | import { Statuses } from "./statuses.js"; |
| 78 | import { MAX_LOG_DEPTH, atLeast, globToRegExp, type AutoMergeAgent, type Caller, type ProtectionRules, type ProtectionRulesInput, type RepoMeta } from "./types.js"; |
| 79 | |
| 80 | const MAX_PUSH_BYTES = 100 * 1024 * 1024; |
| 81 | /** Agents one branch rule may auto-merge pull requests from (ProtectionRules.autoMergeAgents). */ |
| 82 | const MAX_AUTO_MERGE_AGENTS = 20; |
| 83 | /** Pushed blobs this large are hashed, scanned and stored from their compressed bytes, never held inflated. */ |
| 84 | const LARGE_OBJECT_BYTES = 4 * 1024 * 1024; |
| 85 | /** |
| 86 | * What pushes may hold at once in this object while they unpack: one push may hold MAX_HELD_BYTES, besides |
| 87 | * a body of up to 16 MiB passed in memory (http/git.ts IN_MEMORY_PUSH), and the object has 128 MB. Without |
| 88 | * it, two large pushes unpacking at once could go past that, and the reset drops every request in flight |
| 89 | * here, other pushes and fetches included. Each push reserves what it may hold and waits its turn. |
| 90 | */ |
| 91 | const PUSH_MEMORY_BYTES = MAX_HELD_BYTES + 16 * 1024 * 1024; |
| 92 | /** A push with a body this small unpacks within SMALL_PUSH_HELD, beside others; one that needs more waits for a full share. */ |
| 93 | const SMALL_PUSH_BYTES = 1024 * 1024; |
| 94 | const SMALL_PUSH_HELD = 8 * 1024 * 1024; |
| 95 | /** A purge walks every reachable commit and tree while holding the repository: bounded so it finishes in time. */ |
| 96 | export const MAX_PURGE_OBJECTS = 300_000; |
| 97 | /** Storage key that marks a deleted repository whose R2 objects are still being deleted. */ |
| 98 | const PURGE_KEY = "purge"; |
| 99 | /** How often jobs waiting on the account's hosted-job quota are retried. */ |
| 100 | const HELD_RETRY_MS = 60_000; |
| 101 | |
| 102 | export type TreeItem = { |
| 103 | name: string; |
| 104 | path: string; |
| 105 | type: "tree" | "blob" | "commit"; |
| 106 | mode: string; |
| 107 | oid: string; |
| 108 | size?: number; |
| 109 | }; |
| 110 | |
| 111 | export type CommitInfo = { |
| 112 | sha: string; |
| 113 | tree: string; |
| 114 | parents: string[]; |
| 115 | author: Signature; |
| 116 | committer: Signature; |
| 117 | message: string; |
| 118 | signed: boolean; |
| 119 | }; |
| 120 | |
| 121 | /** |
| 122 | * One Durable Object per repository. It is the single writer for the repo's |
| 123 | * refs, Git objects, issues, pull requests, reviews, checks and workflow runs, |
| 124 | * which gives strongly consistent ref updates and merges without locks. |
| 125 | */ |
| 126 | /** How long a live-update socket lives before the page must reconnect and pass the access check again. */ |
| 127 | const LIVE_REAUTH_MS = 10 * 60 * 1000; |
| 128 | /** The close code that asks a page to reconnect at once (not a failure: no backoff, no reload). */ |
| 129 | export const LIVE_REAUTH_CODE = 4001; |
| 130 | |
| 131 | /** A row of what someone wrote (RepoDO.authoredBy): column name to value. */ |
| 132 | type AuthoredRow = Record<string, string | number | null>; |
| 133 | |
| 134 | export class RepoDO extends DurableObject<Env> { |
| 135 | readonly sql: SqlStorage; |
| 136 | store!: RepoObjectStore; |
| 137 | readonly collab: Collab; |
| 138 | readonly actions: Actions; |
| 139 | readonly queue: MergeQueue; |
| 140 | readonly autoMerge: AutoMerge; |
| 141 | readonly runtime: Runtime; |
| 142 | readonly policy: TokenPolicy; |
| 143 | private metaCache: RepoMeta | null = null; |
| 144 | |
| 145 | constructor(ctx: DurableObjectState, env: Env) { |
| 146 | super(ctx, env); |
| 147 | this.sql = ctx.storage.sql; |
| 148 | this.sql.exec(REPO_SCHEMA); |
| 149 | migrateRepoSchema(this.sql); |
| 150 | const meta = this.readMeta(); |
| 151 | if (meta) this.store = new RepoObjectStore(this.sql, env.BUCKET, meta.repoId, () => this.storageChanged()); |
| 152 | this.collab = new Collab(this, env); |
| 153 | this.actions = new Actions(this, env); |
| 154 | this.queue = new MergeQueue(this); |
| 155 | this.autoMerge = new AutoMerge(this, env); |
| 156 | this.runtime = new Runtime(this, env); |
| 157 | this.policy = new TokenPolicy(this); |
| 158 | } |
| 159 | |
| 160 | // ---------------------------------------------------------------- meta |
| 161 | |
| 162 | private readMeta(): RepoMeta | null { |
| 163 | const row = this.sql.exec<{ value: string }>("SELECT value FROM meta WHERE key = 'meta'").toArray()[0]; |
| 164 | this.metaCache = row ? (JSON.parse(row.value) as RepoMeta) : null; |
| 165 | return this.metaCache; |
| 166 | } |
| 167 | |
| 168 | /** The noreply address of an account's commits made here (lib/util.ts noreplyEmail). */ |
| 169 | noreply(login: string): string { |
| 170 | return noreplyEmail(this.env.PUBLIC_URL, login); |
| 171 | } |
| 172 | |
| 173 | get meta(): RepoMeta { |
| 174 | const m = this.metaCache ?? this.readMeta(); |
| 175 | if (!m) throw new HttpError(404, "repository not initialised"); |
| 176 | return m; |
| 177 | } |
| 178 | |
| 179 | async init(meta: RepoMeta): Promise<void> { |
| 180 | // A repository created now (not one whose meta is updated) starts with read-only workflow tokens. |
| 181 | if (!this.readMeta()) this.policy.initNewRepo(); |
| 182 | this.sql.exec("INSERT OR REPLACE INTO meta (key, value) VALUES ('meta', ?)", JSON.stringify(meta)); |
| 183 | this.metaCache = meta; |
| 184 | this.store = new RepoObjectStore(this.sql, this.env.BUCKET, meta.repoId, () => this.storageChanged()); |
| 185 | } |
| 186 | |
| 187 | async updateMeta(patch: Partial<RepoMeta>): Promise<RepoMeta> { |
| 188 | const next = { ...this.meta, ...patch }; |
| 189 | await this.init(next); |
| 190 | return next; |
| 191 | } |
| 192 | |
| 193 | /** |
| 194 | * Whether the repository is archived (read-only). The Worker refuses writes to an archived |
| 195 | * repository, but work this object does by itself (auto-merge, the merge queue) must ask here. |
| 196 | */ |
| 197 | async isArchived(): Promise<boolean> { |
| 198 | const known = this.meta.archived; |
| 199 | if (typeof known === "boolean") return known; |
| 200 | const row = await this.env.DB.prepare("SELECT archived FROM repos WHERE id = ?").bind(this.meta.repoId).first<{ archived: number }>(); |
| 201 | // setArchived may have run while D1 answered; what it set wins. |
| 202 | if (typeof this.meta.archived === "boolean") return this.meta.archived; |
| 203 | const archived = !!row?.archived; |
| 204 | await this.updateMeta({ archived }); |
| 205 | return archived; |
| 206 | } |
| 207 | |
| 208 | /** The repository was archived or unarchived (D1 already says so). Archiving ends auto-merge and empties the merge queues. */ |
| 209 | async setArchived(archived: boolean): Promise<void> { |
| 210 | await this.updateMeta({ archived }); |
| 211 | if (!archived) return; |
| 212 | await this.autoMerge.repositoryArchived(); |
| 213 | await this.queue.repositoryArchived(); |
| 214 | } |
| 215 | |
| 216 | /** |
| 217 | * Wipe all storage (repository deletion), then its R2 objects: git objects, LFS, release |
| 218 | * assets, caches, artifacts, logs and archives. One call can't delete more than about |
| 219 | * 450,000 objects, so the alarm keeps going until they are all gone. |
| 220 | */ |
| 221 | async destroy(): Promise<void> { |
| 222 | const repoId = this.readMeta()?.repoId; |
| 223 | await this.ctx.storage.deleteAlarm(); |
| 224 | await this.ctx.storage.deleteAll(); |
| 225 | this.metaCache = null; |
| 226 | if (!repoId) return; |
| 227 | await this.ctx.storage.put(PURGE_KEY, repoId); |
| 228 | await this.purge(repoId); |
| 229 | } |
| 230 | |
| 231 | /** Delete a deleted repository's R2 objects; returns false while some remain (the alarm retries). */ |
| 232 | private async purge(repoId: string): Promise<void> { |
| 233 | const done = await deletePrefixes(this.env.BUCKET, repoPrefixes(repoId)).catch((e) => { |
| 234 | console.error("could not delete the repository's objects", repoId, e); |
| 235 | return false; |
| 236 | }); |
| 237 | if (done) await this.ctx.storage.deleteAll(); |
| 238 | else await this.ctx.storage.setAlarm(Date.now() + 5_000); |
| 239 | } |
| 240 | |
| 241 | async stats(): Promise<{ objects: number; bytes: number; refs: number; openIssues: number; openPulls: number }> { |
| 242 | const q = (s: string) => this.sql.exec<{ n: number }>(s).one().n; |
| 243 | return { |
| 244 | objects: this.store.count(), |
| 245 | bytes: this.store.sizeBytes(), |
| 246 | refs: q("SELECT count(*) AS n FROM refs"), |
| 247 | openIssues: q("SELECT count(*) AS n FROM issues WHERE kind = 'issue' AND state = 'open'"), |
| 248 | openPulls: q("SELECT count(*) AS n FROM issues WHERE kind = 'pull' AND state = 'open'"), |
| 249 | }; |
| 250 | } |
| 251 | |
| 252 | // ---------------------------------------------------------------- deleted and exported accounts (accounts/) |
| 253 | |
| 254 | /** |
| 255 | * After an account is deleted its work here stays, attributed to the `ghost` user as on GitHub: issues and |
| 256 | * pull requests, comments, reviews, releases, statuses, deployments, events, workflow runs and reactions. |
| 257 | * Self-hosted runners it registered here (by login) are removed. Returns how many rows changed. |
| 258 | */ |
| 259 | async forgetAccounts(ids: string[], logins: string[]): Promise<number> { |
| 260 | if (!ids.length) return 0; |
| 261 | const inIds = ids.map(() => "?").join(", "); |
| 262 | let changed = 0; |
| 263 | const run = (q: string, ...b: unknown[]) => void (changed += this.sql.exec(q, ...b).rowsWritten); |
| 264 | const people: Array<[table: string, prefix: string]> = [ |
| 265 | ["issues", "author"], |
| 266 | ["comments", "author"], |
| 267 | ["reviews", "author"], |
| 268 | ["releases", "author"], |
| 269 | ["statuses", "creator"], |
| 270 | ["deployments", "creator"], |
| 271 | ["deployment_statuses", "creator"], |
| 272 | ["issue_events", "actor"], |
| 273 | ["checks", "creator"], |
| 274 | ["release_assets", "uploader"], |
| 275 | ["reactions", "user"], |
| 276 | ]; |
| 277 | for (const [table, p] of people) { |
| 278 | // Reactions are one per person: where the ghost already reacted the same way, the deleted account's goes. |
| 279 | run(`UPDATE OR IGNORE ${table} SET ${p}_id = ?, ${p}_login = ?, ${p}_kind = ? WHERE ${p}_id IN (${inIds})`, GHOST.id, GHOST.login, GHOST.kind, ...ids); |
| 280 | } |
| 281 | run(`DELETE FROM reactions WHERE user_id IN (${inIds})`, ...ids); |
| 282 | run(`UPDATE deployment_reviews SET user_id = ?, user_login = ? WHERE user_id IN (${inIds})`, GHOST.id, GHOST.login, ...ids); |
| 283 | run(`UPDATE runs SET actor = json_object('id', ?, 'login', ?, 'kind', ?) WHERE json_extract(actor, '$.id') IN (${inIds})`, GHOST.id, GHOST.login, GHOST.kind, ...ids); |
| 284 | if (logins.length) { |
| 285 | const lower = logins.map((l) => l.toLowerCase()); |
| 286 | const inLogins = lower.map(() => "?").join(", "); |
| 287 | run(`UPDATE pulls SET merged_by = ? WHERE lower(merged_by) IN (${inLogins})`, GHOST.login, ...lower); |
| 288 | run(`DELETE FROM runners WHERE lower(created_by) IN (${inLogins})`, ...lower); |
| 289 | run(`DELETE FROM runner_registrations WHERE lower(created_by) IN (${inLogins})`, ...lower); |
| 290 | } |
| 291 | return changed; |
| 292 | } |
| 293 | |
| 294 | /** What these accounts wrote here, for an account export: issues and pull requests they opened, their comments and reviews (at most `limit` of each). */ |
| 295 | async authoredBy(ids: string[], limit = 5000): Promise<{ issues: AuthoredRow[]; comments: AuthoredRow[]; reviews: AuthoredRow[] }> { |
| 296 | if (!ids.length || !this.readMeta()) return { issues: [], comments: [], reviews: [] }; |
| 297 | const inIds = ids.map(() => "?").join(", "); |
| 298 | const rows = (q: string) => this.sql.exec<AuthoredRow>(q, ...ids, limit).toArray(); |
| 299 | return { |
| 300 | issues: rows(`SELECT number, kind, title, body, state, state_reason, created_at, updated_at, closed_at FROM issues WHERE author_id IN (${inIds}) ORDER BY number LIMIT ?`), |
| 301 | comments: rows(`SELECT id, number, body, path, line, created_at, updated_at FROM comments WHERE author_id IN (${inIds}) ORDER BY created_at LIMIT ?`), |
| 302 | reviews: rows(`SELECT id, number, state, body, commit_id, submitted_at FROM reviews WHERE author_id IN (${inIds}) ORDER BY submitted_at LIMIT ?`), |
| 303 | }; |
| 304 | } |
| 305 | |
| 306 | /** |
| 307 | * Write a Git bundle (version 2) of the repository's branches and tags to R2 at `key`, for an account export. |
| 308 | * The pack streams out one object at a time, as a clone's does. Null for an empty repository; a bundle past |
| 309 | * `limit` bytes is refused with a 413 and nothing is kept. |
| 310 | */ |
| 311 | async writeBundle(key: string, limit: number): Promise<{ size: number; refs: number } | null> { |
| 312 | if (!this.readMeta()) return null; |
| 313 | const refs = this.refs().filter((r) => r.name.startsWith("refs/heads/") || r.name.startsWith("refs/tags/")); |
| 314 | if (!refs.length) return null; |
| 315 | const plan = await planFetch(this.store, [...new Set(refs.map((r) => r.oid))], []); |
| 316 | const head = this.getRef(this.headRef); |
| 317 | const sink = new R2Sink(this.env.BUCKET, key, "application/x-git-bundle", limit, "the repository is too large to bundle"); |
| 318 | const store = this.store; |
| 319 | async function* entries() { |
| 320 | for await (const raw of store.readRawAll(plan.oids)) yield { type: raw.type, size: raw.size, deflated: raw.deflated }; |
| 321 | } |
| 322 | try { |
| 323 | await sink.write(utf8(`# v2 git bundle\n${head ? `${head} HEAD\n` : ""}${refs.map((r) => `${r.oid} ${r.name}\n`).join("")}\n`)); |
| 324 | for await (const part of packStream(plan.oids.length, entries())) await sink.write(part); |
| 325 | return { size: await sink.close(), refs: refs.length }; |
| 326 | } catch (e) { |
| 327 | await sink.abort(); |
| 328 | throw e; |
| 329 | } |
| 330 | } |
| 331 | |
| 332 | /** Keep the object alive for work that finishes after the current request. */ |
| 333 | background(p: Promise<unknown>): void { |
| 334 | this.ctx.waitUntil(p.catch((e) => console.error("background task failed", e))); |
| 335 | } |
| 336 | |
| 337 | /** |
| 338 | * Set (or with null, clear) the object's single alarm. The merge queue uses it for check timeouts; |
| 339 | * while jobs wait on the account's hosted-job quota it also fires every minute to retry them, and it |
| 340 | * fires at the earliest running job's deadline (Actions.enforceJobDeadlines). |
| 341 | */ |
| 342 | armAlarm(at: number | null): void { |
| 343 | const next = this.earliest(at, this.actions.hasAccountHeldJobs() ? Date.now() + HELD_RETRY_MS : null, this.actions.nextJobDeadline(), this.actions.nextStuckRunCheck(), this.actions.nextImageRetry()); |
| 344 | this.ctx.waitUntil(next === null ? this.ctx.storage.deleteAlarm() : this.ctx.storage.setAlarm(next)); |
| 345 | } |
| 346 | |
| 347 | /** Make sure the alarm fires by `at`, keeping an earlier one. */ |
| 348 | alarmBy(at: number): void { |
| 349 | this.ctx.waitUntil( |
| 350 | (async () => { |
| 351 | const current = await this.ctx.storage.getAlarm(); |
| 352 | if (current === null || current > at) await this.ctx.storage.setAlarm(at); |
| 353 | })(), |
| 354 | ); |
| 355 | } |
| 356 | |
| 357 | private earliest(...times: Array<number | null>): number | null { |
| 358 | const set = times.filter((t): t is number => t !== null); |
| 359 | return set.length ? Math.min(...set) : null; |
| 360 | } |
| 361 | |
| 362 | override async alarm(): Promise<void> { |
| 363 | const purging = await this.ctx.storage.get<string>(PURGE_KEY); |
| 364 | if (purging) return this.purge(purging); |
| 365 | await this.queue.process(); |
| 366 | if (this.actions.hasAccountHeldJobs()) await this.actions.releaseAccountHeld(); |
| 367 | await this.actions.relaunchImageHeld(); |
| 368 | await this.actions.enforceJobDeadlines(); |
| 369 | await this.actions.repairStuckRuns(); |
| 370 | // Wake up again for held jobs, rollout waits, running jobs' deadlines and stuck runs, keeping the queue's own alarm if it set an earlier one. |
| 371 | const want = this.earliest(this.actions.hasAccountHeldJobs() ? Date.now() + HELD_RETRY_MS : null, this.actions.nextJobDeadline(), this.actions.nextStuckRunCheck(), this.actions.nextImageRetry()); |
| 372 | if (want !== null) { |
| 373 | const current = await this.ctx.storage.getAlarm(); |
| 374 | if (current === null || current <= Date.now() || current > want) await this.ctx.storage.setAlarm(want); |
| 375 | } |
| 376 | } |
| 377 | |
| 378 | /** Queue an event (webhooks, notifications) and show it live to open pages; `live: false` skips the pages (e.g. draft releases, which readers can't see). */ |
| 379 | emit(event: DiffineryEvent, opts?: { live?: boolean }): void { |
| 380 | this.ctx.waitUntil(this.env.EVENTS.send(event).catch((e) => console.error("event send failed", e))); |
| 381 | // Open pages only learn that something changed and fetch it with the viewer's own access: the event |
| 382 | // itself (an audit entry's detail, a dispatch's payload) is not every reader's to see. |
| 383 | if (opts?.live !== false && event.type !== "audit") this.broadcast("repo", { kind: "event", type: event.type }); |
| 384 | } |
| 385 | |
| 386 | // ---------------------------------------------------------------- purging unreachable objects |
| 387 | |
| 388 | /** Bumped by every purge; a push that started before one refuses its ref updates. */ |
| 389 | private purgeEpoch = 0; |
| 390 | |
| 391 | /** |
| 392 | * Delete every object no ref reaches, so a secret force-pushed away can't be fetched by its SHA any |
| 393 | * more (git keeps them until a gc, and so did Diffinery, forever). Also kept: the commits of open |
| 394 | * pull requests, of the merge queue and of unfinished workflow runs. Runs with every other request |
| 395 | * held, so nothing writes a ref meanwhile. |
| 396 | */ |
| 397 | async purgeUnreachable(caller: Caller): Promise<{ objects: number; bytes: number }> { |
| 398 | if (caller.kind !== "user" || caller.permissions || !atLeast(caller.role, "admin")) throw new HttpError(403, "only repository admins can purge unreachable objects"); |
| 399 | const total = this.store.count(); |
| 400 | if (total > MAX_PURGE_OBJECTS) throw new HttpError(422, `this repository has ${total} objects; purging works for up to ${MAX_PURGE_OBJECTS}. Ask a site administrator`); |
| 401 | return this.ctx.blockConcurrencyWhile(async () => { |
| 402 | const roots = [ |
| 403 | ...this.sql.exec<{ oid: string }>("SELECT oid FROM refs").toArray().map((r) => r.oid), |
| 404 | ...this.sql.exec<{ oid: string }>("SELECT head_sha AS oid FROM pulls UNION SELECT head_sha FROM merge_queue UNION SELECT group_sha FROM merge_queue WHERE group_sha IS NOT NULL UNION SELECT parent_sha FROM merge_queue WHERE parent_sha IS NOT NULL").toArray().map((r) => r.oid), |
| 405 | ...this.sql.exec<{ oid: string }>("SELECT sha AS oid FROM runs WHERE status != 'completed' UNION SELECT head_sha FROM runs WHERE status != 'completed' AND head_sha IS NOT NULL").toArray().map((r) => r.oid), |
| 406 | ]; |
| 407 | const keep = new Set<string>(); |
| 408 | const stack = [...roots]; |
| 409 | while (stack.length) { |
| 410 | const oid = stack.pop()!; |
| 411 | if (keep.has(oid)) continue; |
| 412 | const row = this.sql.exec<{ type: number }>("SELECT type FROM objects WHERE oid = ?", oid).toArray()[0]; |
| 413 | if (!row) continue; |
| 414 | keep.add(oid); |
| 415 | const type = CODE_TYPES[row.type]; |
| 416 | if (type === "blob") continue; |
| 417 | const obj = await this.store.read(oid); |
| 418 | if (!obj) continue; |
| 419 | if (type === "commit") { |
| 420 | const c = parseCommit(obj.content); |
| 421 | stack.push(c.tree, ...c.parents); |
| 422 | } else if (type === "tree") { |
| 423 | // A gitlink (160000) names a commit in another repository. |
| 424 | for (const e of parseTree(obj.content)) if (e.mode !== "160000") stack.push(e.oid); |
| 425 | } else if (type === "tag") { |
| 426 | const target = /^object ([0-9a-f]{40})/.exec(fromUtf8(obj.content))?.[1]; |
| 427 | if (target) stack.push(target); |
| 428 | } |
| 429 | } |
| 430 | const doomed = this.sql.exec<{ oid: string; r2: number; size: number }>("SELECT oid, r2, size FROM objects").toArray().filter((r) => !keep.has(r.oid)); |
| 431 | for (let i = 0; i < doomed.length; i += 100) { |
| 432 | const chunk = doomed.slice(i, i + 100).map((r) => r.oid); |
| 433 | this.sql.exec(`DELETE FROM objects WHERE oid IN (${chunk.map(() => "?").join(",")})`, ...chunk); |
| 434 | } |
| 435 | this.store.forget(); |
| 436 | this.store.recount(); |
| 437 | this.storageChanged(); |
| 438 | this.purgeEpoch++; |
| 439 | const r2 = doomed.filter((r) => r.r2).map((r) => this.store.r2KeyOf(r.oid)); |
| 440 | for (let i = 0; i < r2.length; i += 1000) await this.env.BUCKET.delete(r2.slice(i, i + 1000)); |
| 441 | // Cached zipballs and tarballs are rebuilt from what's left on the next download. |
| 442 | await deletePrefixes(this.env.BUCKET, [archivePrefix(this.meta.repoId)], 50); |
| 443 | return { objects: doomed.length, bytes: doomed.reduce((n, r) => n + r.size, 0) }; |
| 444 | }); |
| 445 | } |
| 446 | |
| 447 | // ---------------------------------------------------------------- storage (the owner's storage quota, lib/quotas.ts) |
| 448 | |
| 449 | /** The report to D1 waiting to run, and the last one started: reports run one at a time. */ |
| 450 | private storageNext: Promise<void> | null = null; |
| 451 | private storageLast: Promise<void> = Promise.resolve(); |
| 452 | |
| 453 | /** Bytes the repository stores for its owner: git objects, Git LFS objects and release assets. */ |
| 454 | async storageBytes(): Promise<number> { |
| 455 | await this.listLfs(); |
| 456 | const q = (s: string) => this.sql.exec<{ n: number }>(s).one().n; |
| 457 | return this.store.sizeBytes() + q("SELECT coalesce(sum(size), 0) AS n FROM lfs_objects") + q("SELECT coalesce(sum(size), 0) AS n FROM release_assets"); |
| 458 | } |
| 459 | |
| 460 | /** |
| 461 | * Tell D1 what the repository stores now (repo_storage), where the owner's quota adds it up. Calls |
| 462 | * made while a report waits to run share it; one made while a report is under way gets the next. |
| 463 | */ |
| 464 | reportStorage(): Promise<void> { |
| 465 | this.storageNext ??= this.storageLast.then(async () => { |
| 466 | this.storageNext = null; |
| 467 | const bytes = await this.storageBytes(); |
| 468 | await this.env.DB.prepare("INSERT INTO repo_storage (repo_id, bytes, updated_at) VALUES (?, ?, ?) ON CONFLICT(repo_id) DO UPDATE SET bytes = excluded.bytes, updated_at = excluded.updated_at") |
| 469 | .bind(this.meta.repoId, bytes, now()) |
| 470 | .run(); |
| 471 | }); |
| 472 | const next = this.storageNext; |
| 473 | this.storageLast = next.catch(() => {}); |
| 474 | return next; |
| 475 | } |
| 476 | |
| 477 | /** What the repository stores changed: report it in the background. */ |
| 478 | storageChanged(): void { |
| 479 | this.background(this.reportStorage()); |
| 480 | } |
| 481 | |
| 482 | /** Why storing `adding` more bytes here must be refused (past the owner's storage quota), or null. */ |
| 483 | async storageRefusal(adding = 0): Promise<string | null> { |
| 484 | const m = this.meta; |
| 485 | return storageRefusal(this.env, m.ownerId, m.owner, adding, { repoId: m.repoId, bytes: await this.storageBytes() }); |
| 486 | } |
| 487 | |
| 488 | /** Refuse storing `adding` more bytes past the owner's storage quota. */ |
| 489 | async checkStorage(adding = 0): Promise<void> { |
| 490 | const refused = await this.storageRefusal(adding); |
| 491 | if (refused) throw new HttpError(403, refused); |
| 492 | } |
| 493 | |
| 494 | /** A Git LFS object was stored in R2 (http/git.ts). */ |
| 495 | recordLfs(oid: string, size: number): void { |
| 496 | if (this.sql.exec("INSERT OR IGNORE INTO lfs_objects (oid, size) VALUES (?, ?) RETURNING oid", oid, size).toArray().length) this.storageChanged(); |
| 497 | } |
| 498 | |
| 499 | /** Git LFS objects stored before lfs_objects existed: listed from R2, once. */ |
| 500 | private async listLfs(): Promise<void> { |
| 501 | if (this.sql.exec("SELECT 1 FROM counters WHERE name = 'lfs_listed'").toArray().length) return; |
| 502 | let cursor: string | undefined; |
| 503 | do { |
| 504 | const page = await this.env.BUCKET.list({ prefix: `repos/${this.meta.repoId}/lfs/`, cursor, limit: 1000 }); |
| 505 | for (const o of page.objects) this.sql.exec("INSERT OR IGNORE INTO lfs_objects (oid, size) VALUES (?, ?)", o.key.slice(o.key.lastIndexOf("/") + 1), o.size); |
| 506 | cursor = page.truncated ? page.cursor : undefined; |
| 507 | } while (cursor); |
| 508 | this.sql.exec("INSERT OR IGNORE INTO counters (name, value) VALUES ('lfs_listed', 1)"); |
| 509 | } |
| 510 | |
| 511 | // ---------------------------------------------------------------- refs |
| 512 | |
| 513 | refs(prefix = "refs/"): RefEntry[] { |
| 514 | return this.sql.exec<RefEntry>("SELECT name, oid FROM refs WHERE name >= ? AND name < ? ORDER BY name", prefix, `${prefix}`).toArray(); |
| 515 | } |
| 516 | |
| 517 | getRef(name: string): string | null { |
| 518 | return this.sql.exec<{ oid: string }>("SELECT oid FROM refs WHERE name = ?", name).toArray()[0]?.oid ?? null; |
| 519 | } |
| 520 | |
| 521 | /** Compare-and-swap a ref. `expected` = ZERO_OID means "must not exist". */ |
| 522 | casRef(name: string, expected: string | null, next: string | null): boolean { |
| 523 | const current = this.getRef(name); |
| 524 | if (expected !== null && (current ?? ZERO_OID) !== expected) return false; |
| 525 | if (next === null || next === ZERO_OID) this.sql.exec("DELETE FROM refs WHERE name = ?", name); |
| 526 | else this.sql.exec("INSERT OR REPLACE INTO refs (name, oid) VALUES (?, ?)", name, next); |
| 527 | return true; |
| 528 | } |
| 529 | |
| 530 | get headRef(): string { |
| 531 | return `refs/heads/${this.meta.defaultBranch}`; |
| 532 | } |
| 533 | |
| 534 | /** Resolve a branch, tag, full ref, HEAD or (abbreviated) SHA to a commit SHA. */ |
| 535 | async resolve(rev: string | undefined | null): Promise<string | null> { |
| 536 | const r = rev && rev.length ? rev : "HEAD"; |
| 537 | let oid: string | null = null; |
| 538 | if (r === "HEAD") oid = this.getRef(this.headRef); |
| 539 | else if (isOid(r)) oid = this.store.has(r) ? r : null; |
| 540 | else if (r.startsWith("refs/")) oid = this.getRef(r); |
| 541 | else oid = this.getRef(`refs/heads/${r}`) ?? this.getRef(`refs/tags/${r}`); |
| 542 | if (!oid && /^[0-9a-f]{7,39}$/.test(r)) { |
| 543 | const rows = this.sql.exec<{ oid: string }>("SELECT oid FROM objects WHERE oid >= ? AND oid < ? LIMIT 2", r, `${r}g`).toArray(); |
| 544 | if (rows.length === 1) oid = rows[0]!.oid; |
| 545 | } |
| 546 | if (!oid) return null; |
| 547 | return peelToCommit(this.store, oid); |
| 548 | } |
| 549 | |
| 550 | async branches(): Promise<Array<{ name: string; sha: string; protected: boolean; isDefault: boolean }>> { |
| 551 | return this.refs("refs/heads/").map((r) => { |
| 552 | const name = r.name.slice(11); |
| 553 | return { name, sha: r.oid, protected: !!this.protectionFor(name), isDefault: name === this.meta.defaultBranch }; |
| 554 | }); |
| 555 | } |
| 556 | |
| 557 | async tags(): Promise<Array<{ name: string; sha: string; target: string }>> { |
| 558 | const out = []; |
| 559 | for (const r of this.refs("refs/tags/")) out.push({ name: r.name.slice(10), sha: r.oid, target: await peelToCommit(this.store, r.oid).catch(() => r.oid) }); |
| 560 | return out; |
| 561 | } |
| 562 | |
| 563 | // ---------------------------------------------------------------- git smart HTTP |
| 564 | |
| 565 | async gitInfoRefs(service: "git-upload-pack" | "git-receive-pack"): Promise<Uint8Array> { |
| 566 | if (service === "git-upload-pack") return advertiseUploadPackV2(); |
| 567 | // Like GitHub, pull request refs are hidden from pushes (so `git push --mirror` leaves them alone). |
| 568 | return advertiseReceivePack(this.refs().filter((r) => !r.name.startsWith("refs/pull/"))); |
| 569 | } |
| 570 | |
| 571 | /** The response streams: the pack is read and sent one object at a time, as the client takes it. */ |
| 572 | async gitUploadPack(body: Uint8Array): Promise<ReadableStream<Uint8Array>> { |
| 573 | const { readable, writable } = new IdentityTransformStream(); |
| 574 | const writer = writable.getWriter(); |
| 575 | let started = false; |
| 576 | const sink = (b: Uint8Array) => ((started = true), writer.write(b)); |
| 577 | const ctx = { store: this.store, refs: this.refs(), headTarget: this.headRef }; |
| 578 | void handleUploadPackV2(body, ctx, sink) |
| 579 | .catch((e) => (started ? undefined : writer.write(errorPacket((e as Error).message)))) |
| 580 | .then( |
| 581 | () => writer.close(), |
| 582 | () => writer.abort(), |
| 583 | ) |
| 584 | .catch(() => {}); // the client went away |
| 585 | return readable; |
| 586 | } |
| 587 | |
| 588 | /** |
| 589 | * `moved`: the push came in under an old name (a transfer or rename), so say where the repository |
| 590 | * lives now, like GitHub. `retry`: the Worker hands over a push a deploy cut off (http/git.ts |
| 591 | * receiveWithRetry), which may already have moved some refs. A body staged in R2 is the Worker's |
| 592 | * to delete: deleted here, a push cut off after this point would find it gone on its retry. |
| 593 | */ |
| 594 | async gitReceivePack(input: Uint8Array | SpilledBody, caller: Caller, o: { moved?: boolean; retry?: boolean } = {}): Promise<Uint8Array> { |
| 595 | const size = input instanceof Uint8Array ? input.length : input.size; |
| 596 | const held = size <= SMALL_PUSH_BYTES ? SMALL_PUSH_HELD : MAX_HELD_BYTES; |
| 597 | // A large body that has to wait goes to R2 meanwhile, so pushes waiting their turn don't hold their bodies. |
| 598 | let staged: string | null = null; |
| 599 | if (input instanceof Uint8Array && size > SMALL_PUSH_BYTES && !this.pushMemory.fits(size + held)) { |
| 600 | staged = pushBodyKey(this.meta.repoId); |
| 601 | await this.env.BUCKET.put(staged, input); |
| 602 | input = { spilled: staged, size }; |
| 603 | } |
| 604 | const body = input instanceof Uint8Array ? size : 0; |
| 605 | const lease = await this.pushMemory.take(body + held); |
| 606 | try { |
| 607 | return await this.receivePack(input, caller, o, { held, grow: () => lease.grow(body + MAX_HELD_BYTES) }); |
| 608 | } finally { |
| 609 | lease.release(); |
| 610 | if (staged) await this.env.BUCKET.delete(staged).catch(() => {}); |
| 611 | } |
| 612 | } |
| 613 | |
| 614 | /** What pushes in flight here hold while they unpack (see PUSH_MEMORY_BYTES). */ |
| 615 | private readonly pushMemory = new MemoryPool(PUSH_MEMORY_BYTES); |
| 616 | |
| 617 | /** `memory`: what this push may hold while it unpacks, and how to wait for a full share when a small push needs more. */ |
| 618 | private async receivePack(input: Uint8Array | SpilledBody, caller: Caller, o: { moved?: boolean; retry?: boolean }, memory: { held: number; grow: () => Promise<void> }): Promise<Uint8Array> { |
| 619 | const size = input instanceof Uint8Array ? input.length : input.size; |
| 620 | if (size > MAX_PUSH_BYTES) { |
| 621 | const req = { commands: [], capabilities: new Set<string>(), pushOptions: [], pack: null }; |
| 622 | return reportStatus(req, "push exceeds 100 MB; split it into smaller pushes", []); |
| 623 | } |
| 624 | // A push the Worker staged in R2 (over 16 MB) is read in ranges, never whole: its objects are |
| 625 | // unpacked one at a time (git/push-contents.ts), so its size doesn't decide the memory it takes. |
| 626 | let req: ReceiveRequest; |
| 627 | let packAt = 0; |
| 628 | if (input instanceof Uint8Array) req = parseReceivePack(input); |
| 629 | else { |
| 630 | try { |
| 631 | const head = await readStagedHead(this.env.BUCKET, input.spilled, input.size); |
| 632 | req = head.req; |
| 633 | packAt = head.packOffset; |
| 634 | } catch (e) { |
| 635 | // A deploy that stops this object mid-push is the Worker's to retry (http/git.ts receiveWithRetry). |
| 636 | if (resetByDeploy(e)) throw e; |
| 637 | return reportStatus({ commands: [], capabilities: new Set<string>(), pushOptions: [], pack: null }, unpackFailure(e), []); |
| 638 | } |
| 639 | } |
| 640 | // A purge of unreachable objects that ran while this push was in flight may have deleted objects |
| 641 | // the push counted on the repository having: refuse rather than point a ref at them. |
| 642 | const epoch = this.purgeEpoch; |
| 643 | // `git push -o diffinery-import` from a GitHub import's own token: no workflows, webhooks, |
| 644 | // pull request syncs or notifications (see apps/diffinery/src/imports). |
| 645 | const importMode = !!caller.importId && req.pushOptions.some((o) => o.trim() === "diffinery-import"); |
| 646 | // H2: while an import holds the repository, only that import may push. Everything else waits |
| 647 | // until the import finalises, so protection, guardrails, CI and webhooks are never bypassed. |
| 648 | const lockHolder = this.importLockHolder(); |
| 649 | if (lockHolder && (!importMode || caller.importId !== lockHolder)) { |
| 650 | const denied = req.commands.map((c) => ({ ref: c.ref, ok: false as const, reason: "repository is locked by an import in progress" })); |
| 651 | return reportStatus(req, "repository is locked by an import in progress", denied); |
| 652 | } |
| 653 | const messages: string[] = o.moved ? ["This repository moved. Please use the new location:", ` ${this.env.PUBLIC_URL}/${this.meta.owner}/${this.meta.name}.git`] : []; |
| 654 | let unpackError: string | null = null; |
| 655 | // Like git's quarantine: nothing from the pack is stored until push protection passes, |
| 656 | // so a blocked push leaves no objects behind for a retry to build on. |
| 657 | let contents: PushContents = packedContents(this.store, [], 0); |
| 658 | const unpack = async (maxHeldBytes: number): Promise<PushContents> => { |
| 659 | const opts = { largeObjectBytes: LARGE_OBJECT_BYTES, maxHeldBytes }; |
| 660 | if (!(input instanceof Uint8Array)) return packAt < input.size ? stagedContents(this.store, this.env.BUCKET, input.spilled, packAt, input.size - packAt, opts) : contents; |
| 661 | const pack = req.pack; |
| 662 | if (!pack?.length) return contents; |
| 663 | return parsePack(pack, repositoryBases(this.store), opts).then( |
| 664 | (objects) => packedContents(this.store, objects, pack.length), |
| 665 | // Parsed whole, a pack holds every object at once: one that can't, such as a long history |
| 666 | // of a large file, is unpacked in pieces instead, holding only the objects in use. |
| 667 | (e: unknown) => { |
| 668 | if (!(e instanceof TooMuchMemory)) throw e; |
| 669 | return streamedContents(this.store, memorySource(pack), opts); |
| 670 | }, |
| 671 | ); |
| 672 | }; |
| 673 | try { |
| 674 | try { |
| 675 | contents = await unpack(memory.held); |
| 676 | } catch (e) { |
| 677 | // A small push that needs more than its small share waits for a full one. |
| 678 | if (!(e instanceof TooMuchMemory) || memory.held >= MAX_HELD_BYTES) throw e; |
| 679 | await memory.grow(); |
| 680 | contents = await unpack(MAX_HELD_BYTES); |
| 681 | } |
| 682 | } catch (e) { |
| 683 | if (resetByDeploy(e)) throw e; |
| 684 | unpackError = unpackFailure(e); |
| 685 | } |
| 686 | const results: RefResult[] = []; |
| 687 | if (unpackError) { |
| 688 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "unpacker error" }); |
| 689 | return reportStatus(req, unpackError, results); |
| 690 | } |
| 691 | // Like GitHub's receive.fsckObjects: no tree a git client would refuse, or that writes outside the work tree. |
| 692 | const bad = contents.fsck(); |
| 693 | if (bad) { |
| 694 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "fsck failed" }); |
| 695 | return reportStatus(req, `fsck error: ${bad}`, results, [`Push refused: ${bad}`]); |
| 696 | } |
| 697 | |
| 698 | const marked: SecretHit[] = []; |
| 699 | // Commit and tag messages are scanned too, not only files. |
| 700 | const leaks = contents.scan(marked); |
| 701 | // A file can opt out with `diffinery:allow-secret`; that it did is on the record. |
| 702 | if (marked.length) this.emit({ type: "audit", action: "push.secret_marked", actor: caller, target: `${this.meta.owner}/${this.meta.name}`, detail: { kinds: [...new Set(marked.map((l) => l.kind))], blobs: marked.slice(0, 50).map((l) => l.oid), refs: req.commands.map((c) => c.ref) }, at: now() }); |
| 703 | if (leaks.length) { |
| 704 | const kinds = leaks.map((l) => l.kind); |
| 705 | const target = `${this.meta.owner}/${this.meta.name}`; |
| 706 | // Like GitHub's push protection bypass: a human repository admin may push anyway by |
| 707 | // giving a reason (`git push -o allow-secrets=<reason>`), and every bypass is audited. |
| 708 | const reason = secretBypassReason(req.pushOptions); |
| 709 | if (reason && caller.role === "admin" && caller.kind === "user") { |
| 710 | messages.push(`Push protection bypassed by ${caller.login}: ${reason}`); |
| 711 | for (const l of leaks.slice(0, 10)) messages.push(` ${l.kind} in blob ${l.oid.slice(0, 10)}`); |
| 712 | this.emit({ type: "audit", action: "push.secret_bypassed", actor: caller, target, detail: { kinds, reason, refs: req.commands.map((c) => c.ref), ...(importMode ? { import: caller.importId, blobs: leaks.slice(0, 50).map((l) => l.oid) } : {}) }, at: now() }); |
| 713 | if (importMode) this.importsModule.recordFindings(leaks); |
| 714 | } else { |
| 715 | messages.push("Push blocked: possible secrets detected."); |
| 716 | for (const l of leaks.slice(0, 10)) messages.push(` ${l.kind} in blob ${l.oid.slice(0, 10)}`); |
| 717 | messages.push("Remove the secret from your commits, or rotate it and contact an admin."); |
| 718 | if (reason) messages.push("Only repository admins (people, not agents) can bypass push protection."); |
| 719 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "secret detected (push protection)" }); |
| 720 | this.emit({ type: "audit", action: "push.blocked_secret", actor: caller, target, detail: { kinds, refs: req.commands.map((c) => c.ref) }, at: now() }); |
| 721 | return reportStatus(req, null, results, messages); |
| 722 | } |
| 723 | } |
| 724 | |
| 725 | // Past the owner's storage quota nothing new is stored; a push that only deletes or moves refs still works. |
| 726 | const full = contents.anyNew() ? await this.storageRefusal(contents.bytes) : null; |
| 727 | if (full) { |
| 728 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "storage limit reached" }); |
| 729 | return reportStatus(req, null, results, [...messages, `Push refused: ${full}`]); |
| 730 | } |
| 731 | |
| 732 | try { |
| 733 | await contents.write(); |
| 734 | } catch (e) { |
| 735 | if (resetByDeploy(e)) throw e; |
| 736 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "unpacker error" }); |
| 737 | return reportStatus(req, unpackFailure(e), results); |
| 738 | } |
| 739 | |
| 740 | // Validate every command before applying any, so `atomic` is honoured. |
| 741 | const checks: Array<RefResult & { cmd: (typeof req.commands)[number] }> = []; |
| 742 | for (const cmd of req.commands) checks.push({ cmd, ...(await this.checkRefUpdate(cmd.ref, cmd.oldOid, cmd.newOid, caller, importMode)) }); |
| 743 | const atomic = req.capabilities.has("atomic"); |
| 744 | const anyFailed = checks.some((c) => !c.ok); |
| 745 | let imported = 0; |
| 746 | for (const c of checks) { |
| 747 | if (!c.ok) { |
| 748 | results.push({ ref: c.ref, ok: false, reason: c.reason }); |
| 749 | continue; |
| 750 | } |
| 751 | if (atomic && anyFailed) { |
| 752 | results.push({ ref: c.ref, ok: false, reason: "atomic transaction failed" }); |
| 753 | continue; |
| 754 | } |
| 755 | if (epoch !== this.purgeEpoch) { |
| 756 | results.push({ ref: c.ref, ok: false, reason: "the repository's unreachable objects were purged during this push; push again" }); |
| 757 | continue; |
| 758 | } |
| 759 | // On a retry, a ref the cut-off attempt already moved is where the push wants it: that is a |
| 760 | // success, not stale info. Its push event goes out (again), as the cut-off attempt may have |
| 761 | // stopped before sending it: a missing one would leave a pull request without its checks. |
| 762 | const applied = this.casRef(c.cmd.ref, c.cmd.oldOid, c.cmd.newOid) || (!!o.retry && (this.getRef(c.cmd.ref) ?? ZERO_OID) === c.cmd.newOid); |
| 763 | results.push(applied ? { ref: c.ref, ok: true } : { ref: c.ref, ok: false, reason: "fetch first (stale info)" }); |
| 764 | if (applied && importMode) { |
| 765 | imported++; |
| 766 | // Record provenance so a later push may move this ref only if the import still owns it. |
| 767 | if (c.cmd.newOid === ZERO_OID) this.sql.exec("DELETE FROM import_refs WHERE ref = ?", c.cmd.ref); |
| 768 | else this.importsModule.recordImportRef(c.cmd.ref, c.cmd.newOid, caller.importId!); |
| 769 | } else if (applied) await this.afterRefUpdate(c.cmd.ref, c.cmd.oldOid, c.cmd.newOid, caller, messages); |
| 770 | } |
| 771 | // One audit entry per import push instead of push events. |
| 772 | if (imported) this.emit({ type: "audit", action: "import.push", actor: caller, target: `${this.meta.owner}/${this.meta.name}`, detail: { import: caller.importId, refs: imported }, at: now() }); |
| 773 | return reportStatus(req, null, results, messages); |
| 774 | } |
| 775 | |
| 776 | /** As on GitHub: a rule naming the branch exactly wins; otherwise the oldest matching pattern. */ |
| 777 | protectionFor(branch: string): ProtectionRules | null { |
| 778 | return this.protectionRuleFor(branch)?.rules ?? null; |
| 779 | } |
| 780 | |
| 781 | /** The rule that applies to `branch`, with its pattern: an exact name first, else the first matching pattern. */ |
| 782 | protectionRuleFor(branch: string): { pattern: string; rules: ProtectionRules } | null { |
| 783 | const rows = this.sql.exec<{ pattern: string; rules: string }>("SELECT pattern, rules FROM protections ORDER BY rowid").toArray(); |
| 784 | const row = rows.find((r) => r.pattern === branch) ?? rows.find((r) => globToRegExp(r.pattern).test(branch)); |
| 785 | return row ? { pattern: row.pattern, rules: JSON.parse(row.rules) as ProtectionRules } : null; |
| 786 | } |
| 787 | |
| 788 | /** |
| 789 | * Server-side rules for a ref update: permissions, protection, fast-forward, agent guardrails. |
| 790 | * `importMode`: a GitHub import filling the repository it created, which is the only writer |
| 791 | * until it finishes, so branch rules (copied from GitHub at its end) don't apply to it. |
| 792 | */ |
| 793 | async checkRefUpdate(ref: string, oldOid: string, newOid: string, caller: Caller, importMode = false): Promise<RefResult> { |
| 794 | if (!isValidRefName(ref)) return { ref, ok: false, reason: "invalid ref name" }; |
| 795 | if (!atLeast(caller.role, "write")) return { ref, ok: false, reason: "permission denied" }; |
| 796 | const deleting = newOid === ZERO_OID; |
| 797 | if (ref.startsWith("refs/pull/")) return { ref, ok: false, reason: "refs/pull/ is managed by Diffinery for pull requests" }; |
| 798 | if (ref.startsWith(`refs/heads/${QUEUE_BRANCH_PREFIX}`)) return { ref, ok: false, reason: "merge queue branches are read-only" }; |
| 799 | if (!deleting && !this.store.has(newOid)) return { ref, ok: false, reason: "missing objects" }; |
| 800 | if (ref.startsWith(IMPORT_REF_PREFIX) && !importMode) return { ref, ok: false, reason: `${IMPORT_REF_PREFIX} is reserved for GitHub imports` }; |
| 801 | if (importMode) { |
| 802 | if (!/^refs\/(heads|tags|diffinery-import)\//.test(ref)) return { ref, ok: false, reason: "imports write branches and tags only" }; |
| 803 | // H2: create a ref, or move one this import previously wrote — never a ref adopted since. |
| 804 | const current = this.getRef(ref); |
| 805 | if (current && !deleting) { |
| 806 | const owned = this.importsModule.importRefOid(ref, caller.importId!); |
| 807 | if (owned !== current) return { ref, ok: false, reason: "import may not overwrite a ref it did not write" }; |
| 808 | } |
| 809 | return { ref, ok: true }; |
| 810 | } |
| 811 | // A workflow's GITHUB_TOKEN never adds or changes workflow files (GitHub's `workflows` permission). |
| 812 | const workflowEdit = await this.policy.refuseWorkflowEdit(caller, oldOid, newOid); |
| 813 | if (workflowEdit) return { ref, ok: false, reason: workflowEdit }; |
| 814 | if (!ref.startsWith("refs/heads/")) { |
| 815 | if (ref.startsWith("refs/tags/") && oldOid !== ZERO_OID && !atLeast(caller.role, "maintain")) return { ref, ok: false, reason: "only maintainers may move tags" }; |
| 816 | return { ref, ok: true }; |
| 817 | } |
| 818 | const branch = ref.slice(11); |
| 819 | const rules = this.protectionFor(branch); |
| 820 | const isDefault = branch === this.meta.defaultBranch; |
| 821 | // An empty repository's first commit: an agent that created a repository (or was given an empty one) may |
| 822 | // start its default branch, as GitHub's auto_init would; from then on it works through pull requests. |
| 823 | // A protection rule covering the branch still applies, and the commit may not add workflow files: those reach |
| 824 | // the default branch only through a pull request a person merges, as with auto-merge. |
| 825 | const seeding = caller.kind === "agent" && isDefault && !rules && oldOid === ZERO_OID && !this.sql.exec("SELECT 1 FROM refs WHERE name LIKE 'refs/heads/%' LIMIT 1").toArray().length; |
| 826 | if (seeding) { |
| 827 | const workflow = await this.policy.changedWorkflow(ZERO_OID, newOid); |
| 828 | if (workflow) return { ref, ok: false, reason: `an agent's first commit to an empty repository can't add workflow file \`${workflow}\`; push it without workflows, then add them in a pull request a person merges` }; |
| 829 | } |
| 830 | if (caller.kind === "agent" && (isDefault || rules) && !rules?.agentsMayPush && !seeding) { |
| 831 | return { ref, ok: false, reason: "agents may not push to protected or default branches; open a pull request" }; |
| 832 | } |
| 833 | if (deleting && isDefault) return { ref, ok: false, reason: "cannot delete the default branch" }; |
| 834 | if (!rules) return { ref, ok: true }; |
| 835 | const bypass = caller.role === "admin" && !rules.enforceAdmins; |
| 836 | if (bypass) return { ref, ok: true }; |
| 837 | if (deleting) return rules.allowDeletion ? { ref, ok: true } : { ref, ok: false, reason: "protected branch: deletion not allowed" }; |
| 838 | if (rules.requirePullRequest) return { ref, ok: false, reason: "protected branch: changes must be made through a pull request" }; |
| 839 | // As on GitHub, required checks gate direct pushes too: the commit must already have passed them. |
| 840 | for (const name of rules.requiredChecks ?? []) { |
| 841 | const c = requiredCheck(name, [...this.collab.checks(newOid), ...this.statuses.asChecks(newOid)], rules.requiredCheckSources?.[name]); |
| 842 | if (c.state !== "success") { |
| 843 | const why = c.state === "missing" ? "has not run" : c.state === "pending" ? "has not finished" : `ended with ${c.conclusion}`; |
| 844 | return { ref, ok: false, reason: `protected branch: required check '${name}' ${why} on ${newOid.slice(0, 7)}; push to another branch and open a pull request` }; |
| 845 | } |
| 846 | } |
| 847 | if (oldOid !== ZERO_OID && !rules.allowForcePush && !(await isAncestor(this.store, oldOid, newOid))) { |
| 848 | return { ref, ok: false, reason: "protected branch: force push not allowed" }; |
| 849 | } |
| 850 | if (rules.requireLinearHistory) { |
| 851 | const fresh = await walkCommits(this.store, [newOid], { stop: new Set(oldOid === ZERO_OID ? [] : [oldOid]), limit: 1000 }); |
| 852 | if (fresh.some((c) => c.commit.parents.length > 1)) return { ref, ok: false, reason: "protected branch: merge commits not allowed (linear history)" }; |
| 853 | } |
| 854 | return { ref, ok: true }; |
| 855 | } |
| 856 | |
| 857 | /** Side effects after a ref moved: events, PR sync, workflow triggers. */ |
| 858 | async afterRefUpdate(ref: string, oldOid: string, newOid: string, caller: Caller, messages: string[] = []): Promise<void> { |
| 859 | const at = now(); |
| 860 | const forced = oldOid !== ZERO_OID && newOid !== ZERO_OID && !(await isAncestor(this.store, oldOid, newOid)); |
| 861 | const ev: DiffineryEvent = { |
| 862 | type: "push", |
| 863 | repoId: this.meta.repoId, |
| 864 | owner: this.meta.owner, |
| 865 | repo: this.meta.name, |
| 866 | ref, |
| 867 | before: oldOid, |
| 868 | after: newOid, |
| 869 | actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, |
| 870 | forced, |
| 871 | created: oldOid === ZERO_OID, |
| 872 | deleted: newOid === ZERO_OID, |
| 873 | at, |
| 874 | }; |
| 875 | this.emit(ev); |
| 876 | this.policy.recordPush(ref, newOid, caller); |
| 877 | await this.policy.trackAgentCommits(ref, oldOid, newOid, caller).catch((e) => console.error("could not record an agent's commits", ref, e)); |
| 878 | this.deploys.noteRefUpdate(ref, newOid, caller); |
| 879 | if (ref.startsWith("refs/heads/") && newOid !== ZERO_OID) { |
| 880 | const branch = ref.slice(11); |
| 881 | const synced = await this.collab.syncPullsForBranch(branch, newOid, caller); |
| 882 | for (const n of synced) messages.push(`Updated pull request #${n}: ${this.env.PUBLIC_URL}/${this.meta.owner}/${this.meta.name}/pull/${n}`); |
| 883 | if (oldOid === ZERO_OID && branch !== this.meta.defaultBranch && synced.length === 0) { |
| 884 | messages.push(`Create a pull request for '${branch}':`); |
| 885 | messages.push(` ${this.env.PUBLIC_URL}/${this.meta.owner}/${this.meta.name}/compare/${encodeURIComponent(branch)}`); |
| 886 | } |
| 887 | } |
| 888 | if (newOid !== ZERO_OID) await this.actions.onPush(ev, caller).catch((e) => messages.push(`Workflow trigger error: ${(e as Error).message}`)); |
| 889 | // A base branch that moved (outside the queue, or by it) needs its merge groups checked, |
| 890 | // and pull requests into it waiting to auto-merge may now be up to date. |
| 891 | if (ref.startsWith("refs/heads/") && this.queue.hasEntries(ref.slice(11))) this.queue.schedule(ref.slice(11)); |
| 892 | if (ref.startsWith("refs/heads/") && newOid !== ZERO_OID) this.autoMerge.schedule({ base: ref.slice(11) }); |
| 893 | } |
| 894 | |
| 895 | // ---------------------------------------------------------------- browsing |
| 896 | |
| 897 | async commitInfo(sha: string): Promise<CommitInfo> { |
| 898 | const c = await readCommit(this.store, sha); |
| 899 | return toInfo(sha, c); |
| 900 | } |
| 901 | |
| 902 | async tree(rev: string, path = ""): Promise<{ sha: string; items: TreeItem[] } | null> { |
| 903 | const sha = await this.resolve(rev); |
| 904 | if (!sha) return null; |
| 905 | const c = await readCommit(this.store, sha); |
| 906 | const entry = await resolvePath(this.store, c.tree, path); |
| 907 | if (!entry || !isTreeMode(entry.mode)) return null; |
| 908 | const items: TreeItem[] = []; |
| 909 | for (const e of await readTree(this.store, entry.oid)) { |
| 910 | const type = isTreeMode(e.mode) ? "tree" : e.mode === "160000" ? "commit" : "blob"; |
| 911 | const raw = type === "blob" ? this.sql.exec<{ size: number }>("SELECT size FROM objects WHERE oid = ?", e.oid).toArray()[0] : undefined; |
| 912 | items.push({ name: e.name, path: path ? `${path}/${e.name}` : e.name, type, mode: e.mode, oid: e.oid, size: raw?.size }); |
| 913 | } |
| 914 | items.sort((a, b) => (a.type === b.type ? a.name.localeCompare(b.name) : a.type === "tree" ? -1 : 1)); |
| 915 | return { sha, items }; |
| 916 | } |
| 917 | |
| 918 | async blob(rev: string, path: string): Promise<{ sha: string; oid: string; mode: string; size: number; binary: boolean; content: Uint8Array } | null> { |
| 919 | const sha = await this.resolve(rev); |
| 920 | if (!sha) return null; |
| 921 | const c = await readCommit(this.store, sha); |
| 922 | const entry = await resolvePath(this.store, c.tree, path); |
| 923 | if (!entry || isTreeMode(entry.mode)) return null; |
| 924 | const o = await this.store.read(entry.oid); |
| 925 | if (!o) return null; |
| 926 | return { sha, oid: entry.oid, mode: entry.mode, size: o.content.length, binary: isBinary(o.content), content: o.content }; |
| 927 | } |
| 928 | |
| 929 | async log(rev: string, opts: { path?: string; limit?: number; skip?: number } = {}): Promise<CommitInfo[]> { |
| 930 | const sha = await this.resolve(rev); |
| 931 | if (!sha) return []; |
| 932 | const limit = Math.min(opts.limit ?? 30, 100); |
| 933 | const skip = Math.max(opts.skip ?? 0, 0); |
| 934 | if (!opts.path) { |
| 935 | // Paging past MAX_LOG_DEPTH lists nothing rather than walking the whole history for one page. |
| 936 | if (skip >= MAX_LOG_DEPTH) return []; |
| 937 | const commits = await walkCommits(this.store, [sha], { limit: Math.min(limit + skip, MAX_LOG_DEPTH) }); |
| 938 | return commits.slice(skip).map((c) => toInfo(c.oid, c.commit)); |
| 939 | } |
| 940 | // Path history: commits whose tree entry at `path` differs from their first parent's. |
| 941 | const out: CommitInfo[] = []; |
| 942 | let skipped = 0; |
| 943 | for (const c of await walkCommits(this.store, [sha], { limit: 2000 })) { |
| 944 | const mine = await resolvePath(this.store, c.commit.tree, opts.path); |
| 945 | const parent = c.commit.parents[0] ? await readCommit(this.store, c.commit.parents[0]).catch(() => null) : null; |
| 946 | const theirs = parent ? await resolvePath(this.store, parent.tree, opts.path) : null; |
| 947 | if ((mine?.oid ?? null) === (theirs?.oid ?? null)) continue; |
| 948 | if (skipped++ < skip) continue; |
| 949 | out.push(toInfo(c.oid, c.commit)); |
| 950 | if (out.length >= limit) break; |
| 951 | } |
| 952 | return out; |
| 953 | } |
| 954 | |
| 955 | /** Diff between two commits (or a commit and its first parent). */ |
| 956 | async diff(baseSha: string | null, headSha: string, opts: { patch?: boolean; maxFiles?: number } = {}) { |
| 957 | const head = await readCommit(this.store, headSha); |
| 958 | const baseTree = baseSha ? (await readCommit(this.store, baseSha)).tree : null; |
| 959 | const changes = await diffTrees(this.store, baseTree, head.tree); |
| 960 | const max = opts.maxFiles ?? 300; |
| 961 | const files = []; |
| 962 | const budget = new DiffBudget(); |
| 963 | for (const ch of changes.slice(0, max)) { |
| 964 | const d = await fileDiff(this.store, ch, 3, budget); |
| 965 | files.push({ ...d, patch: opts.patch === false ? undefined : formatUnified(d) }); |
| 966 | } |
| 967 | return { |
| 968 | files, |
| 969 | totalFiles: changes.length, |
| 970 | additions: files.reduce((s, f) => s + f.additions, 0), |
| 971 | deletions: files.reduce((s, f) => s + f.deletions, 0), |
| 972 | truncated: changes.length > max, |
| 973 | }; |
| 974 | } |
| 975 | |
| 976 | async commitWithDiff(rev: string) { |
| 977 | const sha = await this.resolve(rev); |
| 978 | if (!sha) throw new HttpError(404, "commit not found"); |
| 979 | const info = await this.commitInfo(sha); |
| 980 | return { ...info, ...(await this.diff(info.parents[0] ?? null, sha)) }; |
| 981 | } |
| 982 | |
| 983 | async compare(base: string, head: string) { |
| 984 | const b = await this.resolve(base); |
| 985 | const h = await this.resolve(head); |
| 986 | if (!b || !h) throw new HttpError(404, "unknown base or head"); |
| 987 | const mb = await mergeBase(this.store, b, h); |
| 988 | const commits = (await walkCommits(this.store, [h], { stop: new Set(mb ? (await walkCommits(this.store, [mb], { limit: 100000 })).map((c) => c.oid) : []), limit: 250 })).map((c) => toInfo(c.oid, c.commit)); |
| 989 | const ahead = commits.length; |
| 990 | const behind = mb ? (await walkCommits(this.store, [b], { stop: new Set([mb]), limit: 1000 })).filter((c) => c.oid !== mb).length : 0; |
| 991 | return { baseSha: b, headSha: h, mergeBase: mb, aheadBy: ahead, behindBy: behind, commits: commits.reverse(), ...(await this.diff(mb, h)) }; |
| 992 | } |
| 993 | |
| 994 | /** |
| 995 | * Push protection for commits made without a Git client: the same scan as `git push`, so the |
| 996 | * web editor, the contents and commits APIs and MCP cannot be used to slip a credential in. |
| 997 | */ |
| 998 | private protectCommit(changes: readonly FileChange[], allowSecrets: string | undefined, caller: Caller, message = ""): void { |
| 999 | const blobs = changes.filter((ch) => !ch.delete && ch.content).map((ch) => ({ oid: ch.path, content: ch.content! })); |
| 1000 | if (message) blobs.push({ oid: "(commit message)", content: utf8(message) }); |
| 1001 | const marked: SecretHit[] = []; |
| 1002 | const leaks = scanForSecrets(blobs, marked); |
| 1003 | const target = `${this.meta.owner}/${this.meta.name}`; |
| 1004 | if (marked.length) this.emit({ type: "audit", action: "api.secret_marked", actor: caller, target, detail: { kinds: [...new Set(marked.map((l) => l.kind))], paths: [...new Set(marked.map((l) => l.oid))].slice(0, 10) }, at: now() }); |
| 1005 | if (!leaks.length) return; |
| 1006 | const kinds = [...new Set(leaks.map((l) => l.kind))]; |
| 1007 | const paths = [...new Set(leaks.map((l) => l.oid))].slice(0, 10); |
| 1008 | const reason = allowSecrets?.trim().slice(0, 200); |
| 1009 | if (reason && caller.role === "admin" && caller.kind === "user") { |
| 1010 | this.emit({ type: "audit", action: "api.secret_bypassed", actor: caller, target, detail: { kinds, paths, reason }, at: now() }); |
| 1011 | return; |
| 1012 | } |
| 1013 | this.emit({ type: "audit", action: "api.blocked_secret", actor: caller, target, detail: { kinds, paths }, at: now() }); |
| 1014 | const hint = reason ? " Only repository admins (people, not agents) can bypass push protection." : ""; |
| 1015 | throw new HttpError(422, `push protection: possible secret detected (${kinds.join(", ")}) in ${paths.join(", ")}. Remove it, or rotate it and ask an admin.${hint}`); |
| 1016 | } |
| 1017 | |
| 1018 | /** |
| 1019 | * Create a commit from file changes without a Git client (used by the web |
| 1020 | * editor, the REST contents API and AI agents through MCP). |
| 1021 | */ |
| 1022 | async commitFiles(input: { |
| 1023 | branch: string; |
| 1024 | message: string; |
| 1025 | changes: FileChange[]; |
| 1026 | expectedHeadSha?: string; |
| 1027 | createBranchFrom?: string; |
| 1028 | author?: { name: string; email: string }; |
| 1029 | committer?: { name: string; email: string }; |
| 1030 | /** A human admin's reason for committing a detected secret anyway (like `git push -o allow-secrets=`). */ |
| 1031 | allowSecrets?: string; |
| 1032 | }, caller: Caller): Promise<{ sha: string; branch: string }> { |
| 1033 | const ref = `refs/heads/${input.branch}`; |
| 1034 | let parent = this.getRef(ref); |
| 1035 | if (!parent) { |
| 1036 | if (input.createBranchFrom) parent = await this.resolve(input.createBranchFrom); |
| 1037 | else if (this.refs("refs/heads/").length > 0) throw new HttpError(404, `branch ${input.branch} not found`); |
| 1038 | } |
| 1039 | if (input.expectedHeadSha && parent !== input.expectedHeadSha) throw new HttpError(409, "branch moved; refresh and retry", { currentSha: parent }); |
| 1040 | for (const ch of input.changes) { |
| 1041 | const why = ch.delete ? null : unsafeTreePath(ch.path); |
| 1042 | if (why) throw new HttpError(422, `invalid path ${JSON.stringify(ch.path)}: ${why}`); |
| 1043 | } |
| 1044 | const adding = input.changes.reduce((n, ch) => n + (ch.content?.length ?? 0), 0); |
| 1045 | if (adding) await this.checkStorage(adding); |
| 1046 | this.protectCommit(input.changes, input.allowSecrets, caller, input.message); |
| 1047 | const baseTree = parent ? (await readCommit(this.store, parent)).tree : null; |
| 1048 | const tree = await applyChanges(this.store, baseTree, input.changes); |
| 1049 | const ts = Math.floor(Date.now() / 1000); |
| 1050 | const committer = input.committer |
| 1051 | ? { ...input.committer, timestamp: ts, timezone: "+0000" } |
| 1052 | : { name: caller.login, email: this.noreply(caller.login), timestamp: ts, timezone: "+0000" }; |
| 1053 | const author = input.author ? { ...input.author, timestamp: ts, timezone: "+0000" } : committer; |
| 1054 | const extra: [string, string][] = caller.kind === "agent" ? [["diffinery-agent", `${caller.login}${caller.onBehalfOf ? ` on-behalf-of ${caller.onBehalfOf}` : ""}`]] : []; |
| 1055 | const sha = await this.store.write( |
| 1056 | "commit", |
| 1057 | serializeCommit({ tree: tree === EMPTY_TREE_OID ? tree : tree, parents: parent ? [parent] : [], author, committer, message: input.message.endsWith("\n") ? input.message : `${input.message}\n`, extraHeaders: extra }), |
| 1058 | ); |
| 1059 | const old = parent && this.getRef(ref) ? parent : ZERO_OID; |
| 1060 | const check = await this.checkRefUpdate(ref, old, sha, caller); |
| 1061 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 1062 | if (!this.casRef(ref, old, sha)) throw new HttpError(409, "branch moved; refresh and retry"); |
| 1063 | await this.afterRefUpdate(ref, old, sha, caller); |
| 1064 | return { sha, branch: input.branch }; |
| 1065 | } |
| 1066 | |
| 1067 | async createRef(ref: string, sha: string, caller: Caller): Promise<void> { |
| 1068 | if (!this.store.has(sha)) throw new HttpError(422, "object does not exist"); |
| 1069 | const check = await this.checkRefUpdate(ref, ZERO_OID, sha, caller); |
| 1070 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 1071 | if (!this.casRef(ref, ZERO_OID, sha)) throw new HttpError(422, "reference already exists"); |
| 1072 | await this.afterRefUpdate(ref, ZERO_OID, sha, caller); |
| 1073 | } |
| 1074 | |
| 1075 | async updateRef(ref: string, sha: string, force: boolean, caller: Caller): Promise<void> { |
| 1076 | const old = this.getRef(ref); |
| 1077 | if (!old) throw new HttpError(404, "reference not found"); |
| 1078 | if (!force && !(await isAncestor(this.store, old, sha))) throw new HttpError(422, "update is not a fast-forward"); |
| 1079 | const check = await this.checkRefUpdate(ref, old, sha, caller); |
| 1080 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 1081 | if (!this.casRef(ref, old, sha)) throw new HttpError(409, "reference moved"); |
| 1082 | await this.afterRefUpdate(ref, old, sha, caller); |
| 1083 | } |
| 1084 | |
| 1085 | async deleteRef(ref: string, caller: Caller): Promise<void> { |
| 1086 | const old = this.getRef(ref); |
| 1087 | if (!old) throw new HttpError(404, "reference not found"); |
| 1088 | const check = await this.checkRefUpdate(ref, old, ZERO_OID, caller); |
| 1089 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 1090 | this.casRef(ref, old, null); |
| 1091 | await this.afterRefUpdate(ref, old, ZERO_OID, caller); |
| 1092 | } |
| 1093 | |
| 1094 | // ---------------------------------------------------------------- protections |
| 1095 | |
| 1096 | /** |
| 1097 | * What Settings → Merge on green (web/merge-on-green.tsx) suggests: the checks reported on the heads of the |
| 1098 | * latest pull requests, which are the names a required check must match, and the agents that opened pull |
| 1099 | * requests here. `latest`: the check ran on each of the last three pull requests that had checks, so |
| 1100 | * requiring it won't hold up a pull request whose workflows skip it. Reports by agents never count. |
| 1101 | */ |
| 1102 | mergeOnGreenHints(): { pulls: number; checks: Array<{ name: string; pulls: number; latest: boolean }>; agents: Array<{ id: string; login: string }> } { |
| 1103 | const heads = this.sql.exec<{ head_sha: string }>("SELECT head_sha FROM pulls ORDER BY number DESC LIMIT 20").toArray(); |
| 1104 | const count = new Map<string, number>(); |
| 1105 | const recent: Array<Set<string>> = []; |
| 1106 | let pulls = 0; |
| 1107 | for (const h of heads) { |
| 1108 | const names = new Set([...this.collab.checks(h.head_sha), ...this.statuses.asChecks(h.head_sha)].filter((c) => c.creatorKind !== "agent").map((c) => c.name)); |
| 1109 | if (!names.size) continue; |
| 1110 | pulls++; |
| 1111 | if (recent.length < 3) recent.push(names); |
| 1112 | for (const n of names) count.set(n, (count.get(n) ?? 0) + 1); |
| 1113 | } |
| 1114 | const checks = [...count] |
| 1115 | .map(([name, n]) => ({ name, pulls: n, latest: recent.every((r) => r.has(name)) })) |
| 1116 | .sort((a, b) => Number(b.latest) - Number(a.latest) || b.pulls - a.pulls || a.name.localeCompare(b.name)) |
| 1117 | .slice(0, 50); |
| 1118 | const agents: Array<{ id: string; login: string }> = []; |
| 1119 | for (const a of this.sql.exec<{ author_id: string; author_login: string }>("SELECT author_id, author_login FROM issues WHERE kind = 'pull' AND author_kind = 'agent' ORDER BY number DESC LIMIT 200").toArray()) { |
| 1120 | if (agents.length >= 20) break; |
| 1121 | if (!agents.some((x) => x.id === a.author_id)) agents.push({ id: a.author_id, login: a.author_login }); |
| 1122 | } |
| 1123 | return { pulls, checks, agents }; |
| 1124 | } |
| 1125 | |
| 1126 | listProtections(): Array<{ pattern: string; rules: ProtectionRules }> { |
| 1127 | return this.sql.exec<{ pattern: string; rules: string }>("SELECT pattern, rules FROM protections ORDER BY pattern").toArray().map((r) => ({ pattern: r.pattern, rules: JSON.parse(r.rules) })); |
| 1128 | } |
| 1129 | |
| 1130 | /** |
| 1131 | * Create, replace or (with null) delete a rule. Only people who administer the repository change |
| 1132 | * branch protection: never agents, never a workflow's token. Turning `allowAgentAutoMerge`, |
| 1133 | * `agentAutoMergeWithoutApproval` or `autoMergeAgents` on or off is audited on its own, since they let |
| 1134 | * agents land changes. |
| 1135 | */ |
| 1136 | async setProtection(pattern: string, input: ProtectionRulesInput | null, caller: Caller): Promise<void> { |
| 1137 | if (!isPerson(caller) || caller.role !== "admin") throw new HttpError(403, caller.kind === "agent" ? "agents cannot change branch protection" : "only people who administer the repository can change branch protection"); |
| 1138 | let rules = input ? await this.resolveAutoMergeAgents(input) : null; |
| 1139 | if (rules?.mergeQueue) { |
| 1140 | const asked = typeof rules.mergeQueue === "object" ? rules.mergeQueue.method : undefined; |
| 1141 | const mergeQueue = normalizeMergeQueue(rules.mergeQueue); |
| 1142 | // A queue that makes merge commits could never merge into a branch that refuses them. |
| 1143 | if (rules.requireLinearHistory && mergeQueue.method === "merge") { |
| 1144 | if (asked !== undefined) throw new HttpError(422, "this branch requires linear history, so its merge queue must squash or rebase (mergeQueue.method), not create merge commits"); |
| 1145 | mergeQueue.method = "squash"; |
| 1146 | } |
| 1147 | rules = { ...rules, mergeQueue }; |
| 1148 | } |
| 1149 | if (rules?.requiredCheckSources) rules = { ...rules, requiredCheckSources: normalizeCheckSources(rules.requiredCheckSources) }; |
| 1150 | // A required "Agent review" means Diffinery's own check (agentic/review.ts), not one anyone with write access could post. |
| 1151 | if (rules?.requiredChecks?.includes(REVIEW_CHECK) && !rules.requiredCheckSources?.[REVIEW_CHECK]) rules = { ...rules, requiredCheckSources: { ...rules.requiredCheckSources, [REVIEW_CHECK]: REVIEW_APP } }; |
| 1152 | if (rules && rules.allowAgentAutoMerge !== undefined && typeof rules.allowAgentAutoMerge !== "boolean") throw new HttpError(422, "allowAgentAutoMerge must be a boolean"); |
| 1153 | if (rules && rules.agentAutoMergeWithoutApproval !== undefined && typeof rules.agentAutoMergeWithoutApproval !== "boolean") throw new HttpError(422, "agentAutoMergeWithoutApproval must be a boolean"); |
| 1154 | if (rules?.agentAutoMergeWithoutApproval && !rules.allowAgentAutoMerge) throw new HttpError(422, "agentAutoMergeWithoutApproval needs allowAgentAutoMerge: it only applies to what Diffinery lands for agents"); |
| 1155 | if (rules?.autoMergeAgents?.length && !rules.allowAgentAutoMerge) throw new HttpError(422, "autoMergeAgents needs allowAgentAutoMerge: Diffinery turns on auto-merge as those agents, under the same rules as their own"); |
| 1156 | if (rules?.autoMergeMethod !== undefined && !(["merge", "squash", "rebase"] as const).includes(rules.autoMergeMethod)) throw new HttpError(422, "autoMergeMethod must be merge, squash or rebase"); |
| 1157 | if (rules?.autoMergeMethod === "merge" && rules.requireLinearHistory) throw new HttpError(422, "this branch requires linear history, so autoMergeMethod must be squash or rebase"); |
| 1158 | if (rules && !rules.allowAgentAutoMerge) { |
| 1159 | const { allowAgentAutoMerge: _, agentAutoMergeWithoutApproval: _w, autoMergeAgents: _a, autoMergeMethod: _m, ...rest } = rules; |
| 1160 | rules = rest; |
| 1161 | } |
| 1162 | if (rules && !rules.agentAutoMergeWithoutApproval) { |
| 1163 | const { agentAutoMergeWithoutApproval: _, ...rest } = rules; |
| 1164 | rules = rest; |
| 1165 | } |
| 1166 | if (rules && !rules.autoMergeAgents?.length) { |
| 1167 | const { autoMergeAgents: _, autoMergeMethod: _m, ...rest } = rules; |
| 1168 | rules = rest; |
| 1169 | } |
| 1170 | const before = this.sql.exec<{ rules: string }>("SELECT rules FROM protections WHERE pattern = ?", pattern).toArray()[0]; |
| 1171 | const old = before ? (JSON.parse(before.rules) as ProtectionRules) : null; |
| 1172 | const was = !!old?.allowAgentAutoMerge; |
| 1173 | const waived = !!old?.agentAutoMergeWithoutApproval; |
| 1174 | const agentsKey = (r: ProtectionRules | null) => (r?.autoMergeAgents?.length ? `${r.autoMergeAgents.map((a) => a.id).join(",")}|${r.autoMergeMethod ?? ""}` : ""); |
| 1175 | if (rules) this.sql.exec("INSERT INTO protections (pattern, rules) VALUES (?, ?) ON CONFLICT(pattern) DO UPDATE SET rules = excluded.rules", pattern, JSON.stringify(rules)); |
| 1176 | else this.sql.exec("DELETE FROM protections WHERE pattern = ?", pattern); |
| 1177 | if (was !== !!rules?.allowAgentAutoMerge) { |
| 1178 | const m = this.meta; |
| 1179 | this.emit({ type: "audit", action: "repo.protection.agent_auto_merge", actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, target: `${m.owner}/${m.name}`, detail: { pattern, enabled: !!rules?.allowAgentAutoMerge, requiredChecks: rules?.requiredChecks ?? [] }, at: now() }); |
| 1180 | } |
| 1181 | if (waived !== !!rules?.agentAutoMergeWithoutApproval) { |
| 1182 | const m = this.meta; |
| 1183 | this.emit({ type: "audit", action: "repo.protection.agent_approval_waiver", actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, target: `${m.owner}/${m.name}`, detail: { pattern, enabled: !!rules?.agentAutoMergeWithoutApproval, requiredChecks: rules?.requiredChecks ?? [] }, at: now() }); |
| 1184 | } |
| 1185 | if (agentsKey(old) !== agentsKey(rules)) { |
| 1186 | const m = this.meta; |
| 1187 | this.emit({ |
| 1188 | type: "audit", |
| 1189 | action: "repo.protection.agent_auto_merge_rule", |
| 1190 | actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, |
| 1191 | target: `${m.owner}/${m.name}`, |
| 1192 | detail: { pattern, enabled: !!rules?.autoMergeAgents?.length, agents: (rules?.autoMergeAgents ?? []).map((a) => a.login), method: rules?.autoMergeMethod ?? null, withoutApproval: !!rules?.agentAutoMergeWithoutApproval, requiredChecks: rules?.requiredChecks ?? [] }, |
| 1193 | at: now(), |
| 1194 | }); |
| 1195 | } |
| 1196 | // Turning a queue off (or changing its checks) affects what is queued, and what may auto-merge. |
| 1197 | this.queue.schedule(); |
| 1198 | this.autoMerge.schedule(); |
| 1199 | } |
| 1200 | |
| 1201 | /** `autoMergeAgents` names agent accounts, by login or as stored ({ id, login }); store them by id, with the login as it is now. */ |
| 1202 | private async resolveAutoMergeAgents(input: ProtectionRulesInput): Promise<ProtectionRules> { |
| 1203 | const { autoMergeAgents: names, ...rest } = input; |
| 1204 | if (names === undefined || names === null) return rest; |
| 1205 | if (!Array.isArray(names)) throw new HttpError(422, "autoMergeAgents must be a list of agent logins"); |
| 1206 | if (names.length > MAX_AUTO_MERGE_AGENTS) throw new HttpError(422, `autoMergeAgents can name at most ${MAX_AUTO_MERGE_AGENTS} agents`); |
| 1207 | const dir = new Directory(this.env); |
| 1208 | const agents: AutoMergeAgent[] = []; |
| 1209 | for (const n of names) { |
| 1210 | const login = typeof n === "string" ? n.trim().replace(/^@/, "") : n && typeof n === "object" && typeof n.login === "string" ? n.login : null; |
| 1211 | if (!login) throw new HttpError(422, "autoMergeAgents must be a list of agent logins"); |
| 1212 | const account = typeof n === "object" && typeof n.id === "string" ? ((await dir.account(n.id)) ?? (await dir.accountByLogin(login))) : await dir.accountByLogin(login); |
| 1213 | if (!account) throw new HttpError(422, `autoMergeAgents: there is no account named ${login}`); |
| 1214 | if (account.kind !== "agent") throw new HttpError(422, `autoMergeAgents: ${account.login} is not an agent; only agents' pull requests can be auto-merged by a rule`); |
| 1215 | if (!agents.some((a) => a.id === account.id)) agents.push({ id: account.id, login: account.login }); |
| 1216 | } |
| 1217 | return agents.length ? { ...rest, autoMergeAgents: agents } : rest; |
| 1218 | } |
| 1219 | |
| 1220 | // ---------------------------------------------------------------- RPC passthroughs (collab + actions) |
| 1221 | // Workers RPC only exposes methods on the class itself, so the sub-modules are wrapped here. |
| 1222 | |
| 1223 | issues(...a: Parameters<Collab["list"]>) { |
| 1224 | return this.collab.list(...a); |
| 1225 | } |
| 1226 | issue(...a: Parameters<Collab["get"]>) { |
| 1227 | return this.collab.get(...a); |
| 1228 | } |
| 1229 | createIssue(...a: Parameters<Collab["createIssue"]>) { |
| 1230 | return this.collab.createIssue(...a); |
| 1231 | } |
| 1232 | updateIssue(...a: Parameters<Collab["update"]>) { |
| 1233 | return this.collab.update(...a); |
| 1234 | } |
| 1235 | setPullDraft(...a: Parameters<Collab["setDraft"]>) { |
| 1236 | return this.collab.setDraft(...a); |
| 1237 | } |
| 1238 | addComment(...a: Parameters<Collab["addComment"]>) { |
| 1239 | return this.collab.addComment(...a); |
| 1240 | } |
| 1241 | editComment(...a: Parameters<Collab["editComment"]>) { |
| 1242 | return this.collab.editComment(...a); |
| 1243 | } |
| 1244 | minimizeComment(...a: Parameters<Collab["minimizeComment"]>) { |
| 1245 | return this.collab.minimizeComment(...a); |
| 1246 | } |
| 1247 | createPull(...a: Parameters<Collab["createPull"]>) { |
| 1248 | return this.collab.createPull(...a); |
| 1249 | } |
| 1250 | pullFiles(...a: Parameters<Collab["pullFiles"]>) { |
| 1251 | return this.collab.pullFiles(...a); |
| 1252 | } |
| 1253 | pullCommits(...a: Parameters<Collab["pullCommits"]>) { |
| 1254 | return this.collab.pullCommits(...a); |
| 1255 | } |
| 1256 | pullStats(...a: Parameters<Collab["pullStats"]>) { |
| 1257 | return this.collab.pullStats(...a); |
| 1258 | } |
| 1259 | reviewState(...a: Parameters<Collab["reviewState"]>) { |
| 1260 | return this.collab.reviewState(...a); |
| 1261 | } |
| 1262 | submitReview(...a: Parameters<Collab["submitReview"]>) { |
| 1263 | return this.collab.submitReview(...a); |
| 1264 | } |
| 1265 | resolveThread(...a: Parameters<Collab["resolveThread"]>) { |
| 1266 | return this.collab.resolveThread(...a); |
| 1267 | } |
| 1268 | mergeability(...a: Parameters<Collab["mergeability"]>) { |
| 1269 | return this.collab.mergeability(...a); |
| 1270 | } |
| 1271 | mergePull(...a: Parameters<Collab["merge"]>) { |
| 1272 | return this.collab.merge(...a); |
| 1273 | } |
| 1274 | requestReviewers(...a: Parameters<Collab["requestReviewers"]>) { |
| 1275 | return this.collab.requestReviewers(...a); |
| 1276 | } |
| 1277 | labels(...a: Parameters<Collab["labels"]>) { |
| 1278 | return this.collab.labels(...a); |
| 1279 | } |
| 1280 | setLabel(...a: Parameters<Collab["setLabel"]>) { |
| 1281 | return this.collab.setLabel(...a); |
| 1282 | } |
| 1283 | checks(...a: Parameters<Collab["checks"]>) { |
| 1284 | return this.collab.checks(...a); |
| 1285 | } |
| 1286 | upsertCheck(...a: Parameters<Collab["upsertCheck"]>) { |
| 1287 | return this.collab.upsertCheck(...a); |
| 1288 | } |
| 1289 | webhooks(...a: Parameters<Collab["webhooks"]>) { |
| 1290 | return this.collab.webhooks(...a); |
| 1291 | } |
| 1292 | deliverableWebhooks(...a: Parameters<Collab["deliverableWebhooks"]>) { |
| 1293 | return this.collab.deliverableWebhooks(...a); |
| 1294 | } |
| 1295 | createWebhook(url: string, events: string[], secret?: string) { |
| 1296 | return this.collab.createWebhook(url, events, secret, new URL(this.env.PUBLIC_URL).hostname); |
| 1297 | } |
| 1298 | deleteWebhook(...a: Parameters<Collab["deleteWebhook"]>) { |
| 1299 | return this.collab.deleteWebhook(...a); |
| 1300 | } |
| 1301 | recordDelivery(...a: Parameters<Collab["recordDelivery"]>) { |
| 1302 | return this.collab.recordDelivery(...a); |
| 1303 | } |
| 1304 | |
| 1305 | enqueuePull(...a: Parameters<MergeQueue["enqueue"]>) { |
| 1306 | return this.queue.enqueue(...a); |
| 1307 | } |
| 1308 | dequeuePull(...a: Parameters<MergeQueue["dequeue"]>) { |
| 1309 | return this.queue.dequeue(...a); |
| 1310 | } |
| 1311 | mergeQueue(...a: Parameters<MergeQueue["list"]>) { |
| 1312 | return this.queue.list(...a); |
| 1313 | } |
| 1314 | mergeQueueSettings(...a: Parameters<MergeQueue["settings"]>) { |
| 1315 | return this.queue.settings(...a); |
| 1316 | } |
| 1317 | /** A caller's own auto-merge; only the server turns one on for a branch rule (AutoMerge.applyRule). */ |
| 1318 | enableAutoMerge(number: number, input: Parameters<AutoMerge["enable"]>[1], caller: Caller) { |
| 1319 | return this.autoMerge.enable(number, input, caller); |
| 1320 | } |
| 1321 | disableAutoMerge(...a: Parameters<AutoMerge["disable"]>) { |
| 1322 | return this.autoMerge.disable(...a); |
| 1323 | } |
| 1324 | |
| 1325 | runs(...a: Parameters<Actions["listRuns"]>) { |
| 1326 | return this.actions.listRuns(...a); |
| 1327 | } |
| 1328 | run(...a: Parameters<Actions["getRun"]>) { |
| 1329 | return this.actions.getRun(...a); |
| 1330 | } |
| 1331 | runJobs(...a: Parameters<Actions["jobs"]>) { |
| 1332 | return this.actions.jobs(...a); |
| 1333 | } |
| 1334 | claimJobAsRunner(...a: Parameters<Actions["claimJobAsRunner"]>) { |
| 1335 | return this.actions.claimJobAsRunner(...a); |
| 1336 | } |
| 1337 | runnerRegistrationToken(...a: Parameters<Actions["runnerRegistrationToken"]>) { |
| 1338 | return this.actions.runnerRegistrationToken(...a); |
| 1339 | } |
| 1340 | registerRunner(...a: Parameters<Actions["registerRunner"]>) { |
| 1341 | return this.actions.registerRunner(...a); |
| 1342 | } |
| 1343 | runners(...a: Parameters<Actions["runners"]>) { |
| 1344 | return this.actions.runners(...a); |
| 1345 | } |
| 1346 | deleteRunner(...a: Parameters<Actions["deleteRunner"]>) { |
| 1347 | return this.actions.deleteRunner(...a); |
| 1348 | } |
| 1349 | jobStatus(jobId: string): string { |
| 1350 | return this.actions.getJob(jobId).status; |
| 1351 | } |
| 1352 | job(...a: Parameters<Actions["getJob"]>) { |
| 1353 | return this.actions.getJob(...a); |
| 1354 | } |
| 1355 | jobLogs(...a: Parameters<Actions["logs"]>) { |
| 1356 | return this.actions.logs(...a); |
| 1357 | } |
| 1358 | cancelRun(...a: Parameters<Actions["cancel"]>) { |
| 1359 | return this.actions.cancel(...a); |
| 1360 | } |
| 1361 | deleteRunLogs(...a: Parameters<Actions["deleteLogs"]>) { |
| 1362 | return this.actions.deleteLogs(...a); |
| 1363 | } |
| 1364 | rerun(...a: Parameters<Actions["rerun"]>) { |
| 1365 | return this.actions.rerun(...a); |
| 1366 | } |
| 1367 | rerunJob(...a: Parameters<Actions["rerunJob"]>) { |
| 1368 | return this.actions.rerunJob(...a); |
| 1369 | } |
| 1370 | dispatchWorkflow(...a: Parameters<Actions["dispatch"]>) { |
| 1371 | return this.actions.dispatch(...a); |
| 1372 | } |
| 1373 | scheduleTick(...a: Parameters<Actions["schedule"]>) { |
| 1374 | return this.actions.schedule(...a); |
| 1375 | } |
| 1376 | onPullRequestEvent(...a: Parameters<Actions["onPullRequest"]>) { |
| 1377 | return this.actions.onPullRequest(...a); |
| 1378 | } |
| 1379 | workflows(...a: Parameters<Actions["listWorkflows"]>) { |
| 1380 | return this.actions.listWorkflows(...a); |
| 1381 | } |
| 1382 | runPlan(...a: Parameters<Actions["plan"]>) { |
| 1383 | return this.actions.plan(...a); |
| 1384 | } |
| 1385 | startJobKey(...a: Parameters<Actions["startJobKey"]>) { |
| 1386 | return this.actions.startJobKey(...a); |
| 1387 | } |
| 1388 | jobGate(...a: Parameters<Actions["jobGate"]>) { |
| 1389 | return this.actions.jobGate(...a); |
| 1390 | } |
| 1391 | pendingDeployments(...a: Parameters<Actions["pendingDeployments"]>) { |
| 1392 | return this.actions.pendingDeployments(...a); |
| 1393 | } |
| 1394 | reviewDeployments(...a: Parameters<Actions["reviewDeployments"]>) { |
| 1395 | return this.actions.reviewDeployments(...a); |
| 1396 | } |
| 1397 | deploymentReviews(...a: Parameters<Actions["deploymentReviews"]>) { |
| 1398 | return this.actions.deploymentReviews(...a); |
| 1399 | } |
| 1400 | jobTimedOut(...a: Parameters<Actions["jobTimedOut"]>) { |
| 1401 | return this.actions.jobTimedOut(...a); |
| 1402 | } |
| 1403 | finishRun(...a: Parameters<Actions["finishRun"]>) { |
| 1404 | return this.actions.finishRun(...a); |
| 1405 | } |
| 1406 | oidcClaims(...a: Parameters<Actions["oidcClaims"]>) { |
| 1407 | return this.actions.oidcClaims(...a); |
| 1408 | } |
| 1409 | runnerSpec(...a: Parameters<Actions["runnerSpec"]>) { |
| 1410 | return this.actions.runnerSpec(...a); |
| 1411 | } |
| 1412 | runnerLogs(...a: Parameters<Actions["runnerLogs"]>) { |
| 1413 | return this.actions.runnerLogs(...a); |
| 1414 | } |
| 1415 | runnerStep(...a: Parameters<Actions["runnerStep"]>) { |
| 1416 | return this.actions.runnerStep(...a); |
| 1417 | } |
| 1418 | runnerComplete(...a: Parameters<Actions["runnerComplete"]>) { |
| 1419 | return this.actions.runnerComplete(...a); |
| 1420 | } |
| 1421 | packagesPermission(...a: Parameters<Actions["packagesPermission"]>) { |
| 1422 | return this.actions.packagesPermission(...a); |
| 1423 | } |
| 1424 | runnerAuth(...a: Parameters<Actions["runnerAuth"]>) { |
| 1425 | return this.actions.runnerAuth(...a); |
| 1426 | } |
| 1427 | containerStopped(...a: Parameters<Actions["containerStopped"]>) { |
| 1428 | return this.actions.containerStopped(...a); |
| 1429 | } |
| 1430 | relaunchJob(...a: Parameters<Actions["relaunchJob"]>) { |
| 1431 | return this.actions.relaunchJob(...a); |
| 1432 | } |
| 1433 | setSecret(...a: Parameters<Actions["setSecret"]>) { |
| 1434 | return this.actions.setSecret(...a); |
| 1435 | } |
| 1436 | deleteSecret(...a: Parameters<Actions["deleteSecret"]>) { |
| 1437 | return this.actions.deleteSecret(...a); |
| 1438 | } |
| 1439 | secretNames(...a: Parameters<Actions["secretNames"]>) { |
| 1440 | return this.actions.secretNames(...a); |
| 1441 | } |
| 1442 | setVariable(...a: Parameters<Actions["setVariable"]>) { |
| 1443 | return this.actions.setVariable(...a); |
| 1444 | } |
| 1445 | variables(...a: Parameters<Actions["variables"]>) { |
| 1446 | return this.actions.variables(...a); |
| 1447 | } |
| 1448 | cacheLookup(...a: Parameters<Actions["cacheLookup"]>) { |
| 1449 | return this.actions.cacheLookup(...a); |
| 1450 | } |
| 1451 | cacheSaved(...a: Parameters<Actions["cacheSaved"]>) { |
| 1452 | return this.actions.cacheSaved(...a); |
| 1453 | } |
| 1454 | artifactUploadKeys(...a: Parameters<Actions["artifactUploadKeys"]>) { |
| 1455 | return this.actions.artifactUploadKeys(...a); |
| 1456 | } |
| 1457 | artifactSaved(...a: Parameters<Actions["artifactSaved"]>) { |
| 1458 | return this.actions.artifactSaved(...a); |
| 1459 | } |
| 1460 | artifacts(...a: Parameters<Actions["artifacts"]>) { |
| 1461 | return this.actions.artifacts(...a); |
| 1462 | } |
| 1463 | createSandbox(...a: Parameters<Actions["createSandbox"]>) { |
| 1464 | return this.actions.createSandbox(...a); |
| 1465 | } |
| 1466 | sandbox(...a: Parameters<Actions["getSandbox"]>) { |
| 1467 | return this.actions.getSandbox(...a); |
| 1468 | } |
| 1469 | closeSandbox(...a: Parameters<Actions["closeSandbox"]>) { |
| 1470 | return this.actions.closeSandbox(...a); |
| 1471 | } |
| 1472 | closeTaskSandbox(...a: Parameters<Actions["closeTaskSandbox"]>) { |
| 1473 | return this.actions.closeTaskSandbox(...a); |
| 1474 | } |
| 1475 | /** A kill switch was turned on (lib/killswitch.ts): stop what runs here now. */ |
| 1476 | stopActions(...a: Parameters<Actions["stopActions"]>) { |
| 1477 | return this.actions.stopActions(...a); |
| 1478 | } |
| 1479 | |
| 1480 | plannedRunError(runId: string, message: string) { |
| 1481 | return this.actions.plannedError(runId, message); |
| 1482 | } |
| 1483 | cacheSaveKeys(...a: Parameters<Actions["cacheSaveKeys"]>) { |
| 1484 | return this.actions.cacheSaveKeys(...a); |
| 1485 | } |
| 1486 | cacheReadKeys(...a: Parameters<Actions["cacheReadKeys"]>) { |
| 1487 | return this.actions.cacheReadKeys(...a); |
| 1488 | } |
| 1489 | artifactKeysFor(...a: Parameters<Actions["artifactKeysFor"]>) { |
| 1490 | return this.actions.artifactKeysFor(...a); |
| 1491 | } |
| 1492 | artifactQuota() { |
| 1493 | return this.runtime.artifactQuota; |
| 1494 | } |
| 1495 | |
| 1496 | // ---------------------------------------------------------------- RPC passthroughs (Actions runtime services) |
| 1497 | // The cache and artifact services of repo/runtime.ts, called by http/actions-runtime.ts |
| 1498 | // with the job named by a runtime token, and by the REST caches/artifacts routes. |
| 1499 | |
| 1500 | rtJob(...a: Parameters<Runtime["job"]>) { |
| 1501 | return this.runtime.job(...a); |
| 1502 | } |
| 1503 | rtGrantFor(...a: Parameters<Runtime["grantFor"]>) { |
| 1504 | return this.runtime.grantFor(...a); |
| 1505 | } |
| 1506 | rtCacheLookup(...a: Parameters<Runtime["cacheLookup"]>) { |
| 1507 | return this.runtime.cacheLookup(...a); |
| 1508 | } |
| 1509 | rtCacheReserve(...a: Parameters<Runtime["cacheReserve"]>) { |
| 1510 | return this.runtime.cacheReserve(...a); |
| 1511 | } |
| 1512 | rtCacheReservation(...a: Parameters<Runtime["cacheReservation"]>) { |
| 1513 | return this.runtime.cacheReservation(...a); |
| 1514 | } |
| 1515 | rtCacheWritable(...a: Parameters<Runtime["cacheWritable"]>) { |
| 1516 | return this.runtime.cacheWritable(...a); |
| 1517 | } |
| 1518 | rtCacheCommit(...a: Parameters<Runtime["cacheCommit"]>) { |
| 1519 | return this.runtime.cacheCommit(...a); |
| 1520 | } |
| 1521 | rtCacheGet(...a: Parameters<Runtime["cacheGet"]>) { |
| 1522 | return this.runtime.cacheGet(...a); |
| 1523 | } |
| 1524 | rtListCaches(...a: Parameters<Runtime["listCaches"]>) { |
| 1525 | return this.runtime.listCaches(...a); |
| 1526 | } |
| 1527 | rtDeleteCaches(...a: Parameters<Runtime["deleteCaches"]>) { |
| 1528 | return this.runtime.deleteCaches(...a); |
| 1529 | } |
| 1530 | rtCacheUsage(...a: Parameters<Runtime["cacheUsage"]>) { |
| 1531 | return this.runtime.cacheUsage(...a); |
| 1532 | } |
| 1533 | rtArtifactCreate(...a: Parameters<Runtime["artifactCreate"]>) { |
| 1534 | return this.runtime.artifactCreate(...a); |
| 1535 | } |
| 1536 | rtArtifactUpload(...a: Parameters<Runtime["artifactUpload"]>) { |
| 1537 | return this.runtime.artifactUpload(...a); |
| 1538 | } |
| 1539 | rtArtifactWritable(...a: Parameters<Runtime["artifactWritable"]>) { |
| 1540 | return this.runtime.artifactWritable(...a); |
| 1541 | } |
| 1542 | rtArtifactFinalize(...a: Parameters<Runtime["artifactFinalize"]>) { |
| 1543 | return this.runtime.artifactFinalize(...a); |
| 1544 | } |
| 1545 | rtArtifactGet(...a: Parameters<Runtime["artifactGet"]>) { |
| 1546 | return this.runtime.artifactGet(...a); |
| 1547 | } |
| 1548 | rtJobArtifacts(...a: Parameters<Runtime["jobArtifacts"]>) { |
| 1549 | return this.runtime.jobArtifacts(...a); |
| 1550 | } |
| 1551 | rtRunArtifacts(...a: Parameters<Runtime["runArtifacts"]>) { |
| 1552 | return this.runtime.runArtifacts(...a); |
| 1553 | } |
| 1554 | rtRepoArtifacts(...a: Parameters<Runtime["repoArtifacts"]>) { |
| 1555 | return this.runtime.repoArtifacts(...a); |
| 1556 | } |
| 1557 | rtArtifactDelete(...a: Parameters<Runtime["artifactDelete"]>) { |
| 1558 | return this.runtime.artifactDelete(...a); |
| 1559 | } |
| 1560 | rtArtifactDeleteByName(...a: Parameters<Runtime["artifactDeleteByName"]>) { |
| 1561 | return this.runtime.artifactDeleteByName(...a); |
| 1562 | } |
| 1563 | workflowSettings() { |
| 1564 | return this.policy.settings(); |
| 1565 | } |
| 1566 | setWorkflowSettings(...a: Parameters<TokenPolicy["setSettings"]>) { |
| 1567 | return this.policy.setSettings(...a); |
| 1568 | } |
| 1569 | rtStage(...a: Parameters<Runtime["stage"]>) { |
| 1570 | return this.runtime.stage(...a); |
| 1571 | } |
| 1572 | rtUnstage(...a: Parameters<Runtime["unstage"]>) { |
| 1573 | return this.runtime.unstage(...a); |
| 1574 | } |
| 1575 | rtCheckCommitSize(...a: Parameters<Runtime["checkCommitSize"]>) { |
| 1576 | return this.runtime.checkCommitSize(...a); |
| 1577 | } |
| 1578 | rtCacheMissing(...a: Parameters<Runtime["cacheMissing"]>) { |
| 1579 | return this.runtime.cacheMissing(...a); |
| 1580 | } |
| 1581 | rtComposeStep(...a: Parameters<Runtime["composeStep"]>) { |
| 1582 | return this.runtime.composeStep(...a); |
| 1583 | } |
| 1584 | |
| 1585 | // ---------------------------------------------------------------- RPC passthroughs (GitHub-compatible extras) |
| 1586 | // Releases, commit statuses, deployments and environments, issue sub-resources |
| 1587 | // (labels, reactions, events, locking), the Git data API, search and misc. |
| 1588 | // The modules are created on first use. |
| 1589 | |
| 1590 | private extras: { releases?: Releases; statuses?: Statuses; deploys?: Deployments; social?: Social; gitdata?: GitData } = {}; |
| 1591 | get releases(): Releases { |
| 1592 | return (this.extras.releases ??= new Releases(this, this.env)); |
| 1593 | } |
| 1594 | get statuses(): Statuses { |
| 1595 | return (this.extras.statuses ??= new Statuses(this)); |
| 1596 | } |
| 1597 | get deploys(): Deployments { |
| 1598 | return (this.extras.deploys ??= new Deployments(this, this.env)); |
| 1599 | } |
| 1600 | get social(): Social { |
| 1601 | return (this.extras.social ??= new Social(this)); |
| 1602 | } |
| 1603 | get gitdata(): GitData { |
| 1604 | return (this.extras.gitdata ??= new GitData(this, this.env)); |
| 1605 | } |
| 1606 | |
| 1607 | listReleases(...a: Parameters<Releases["list"]>) { |
| 1608 | return this.releases.list(...a); |
| 1609 | } |
| 1610 | getRelease(...a: Parameters<Releases["get"]>) { |
| 1611 | return this.releases.get(...a); |
| 1612 | } |
| 1613 | releaseByTag(...a: Parameters<Releases["byTag"]>) { |
| 1614 | return this.releases.byTag(...a); |
| 1615 | } |
| 1616 | latestRelease() { |
| 1617 | return this.releases.latest(); |
| 1618 | } |
| 1619 | releaseSummary(...a: Parameters<Releases["summary"]>) { |
| 1620 | return this.releases.summary(...a); |
| 1621 | } |
| 1622 | createRelease(...a: Parameters<Releases["create"]>) { |
| 1623 | return this.releases.create(...a); |
| 1624 | } |
| 1625 | updateRelease(...a: Parameters<Releases["update"]>) { |
| 1626 | return this.releases.update(...a); |
| 1627 | } |
| 1628 | deleteRelease(...a: Parameters<Releases["remove"]>) { |
| 1629 | return this.releases.remove(...a); |
| 1630 | } |
| 1631 | generateReleaseNotes(...a: Parameters<Releases["generateNotes"]>) { |
| 1632 | return this.releases.generateNotes(...a); |
| 1633 | } |
| 1634 | releaseAssets(...a: Parameters<Releases["assets"]>) { |
| 1635 | return this.releases.assets(...a); |
| 1636 | } |
| 1637 | releaseAsset(...a: Parameters<Releases["asset"]>) { |
| 1638 | return this.releases.asset(...a); |
| 1639 | } |
| 1640 | updateReleaseAsset(...a: Parameters<Releases["updateAsset"]>) { |
| 1641 | return this.releases.updateAsset(...a); |
| 1642 | } |
| 1643 | deleteReleaseAsset(...a: Parameters<Releases["deleteAsset"]>) { |
| 1644 | return this.releases.deleteAsset(...a); |
| 1645 | } |
| 1646 | startReleaseAsset(...a: Parameters<Releases["startAsset"]>) { |
| 1647 | return this.releases.startAsset(...a); |
| 1648 | } |
| 1649 | finishReleaseAsset(...a: Parameters<Releases["finishAsset"]>) { |
| 1650 | return this.releases.finishAsset(...a); |
| 1651 | } |
| 1652 | abortReleaseAsset(...a: Parameters<Releases["abortAsset"]>) { |
| 1653 | return this.releases.abortAsset(...a); |
| 1654 | } |
| 1655 | releaseDownload(...a: Parameters<Releases["download"]>) { |
| 1656 | return this.releases.download(...a); |
| 1657 | } |
| 1658 | /** For the GitHub importer: a release with its original dates and author (no tag, events or workflows). */ |
| 1659 | importRelease(...a: Parameters<Releases["importRelease"]>) { |
| 1660 | return this.releases.importRelease(...a); |
| 1661 | } |
| 1662 | /** For the GitHub importer: an asset copied from a public https URL, or from an R2 key under this repository's prefix. */ |
| 1663 | importReleaseAsset(...a: Parameters<Releases["importAsset"]>) { |
| 1664 | return this.releases.importAsset(...a); |
| 1665 | } |
| 1666 | |
| 1667 | createStatus(...a: Parameters<Statuses["create"]>) { |
| 1668 | return this.statuses.create(...a); |
| 1669 | } |
| 1670 | commitStatuses(...a: Parameters<Statuses["list"]>) { |
| 1671 | return this.statuses.list(...a); |
| 1672 | } |
| 1673 | combinedStatus(...a: Parameters<Statuses["combined"]>) { |
| 1674 | return this.statuses.combined(...a); |
| 1675 | } |
| 1676 | /** Check runs and commit statuses together, as pull request and commit pages show them. */ |
| 1677 | checksAndStatuses(sha: string) { |
| 1678 | return [...this.collab.checks(sha), ...this.statuses.asChecks(sha)]; |
| 1679 | } |
| 1680 | |
| 1681 | /** This repository's part of the Today view (agentic/today.ts): open pull requests and what landed or failed since `since`. */ |
| 1682 | /** Pull requests whose mergeability a Today summary is checking in the background. */ |
| 1683 | private todayMergeChecks = new Set<number>(); |
| 1684 | |
| 1685 | todaySummary(since: string) { |
| 1686 | const summary = repoToday(this.sql, (sha) => this.checksAndStatuses(sha), since); |
| 1687 | // After answering, find out whether agents' pull requests that may be waiting for a person conflict |
| 1688 | // or are already in their base, so the next Today leaves those out of "needs you". |
| 1689 | const unchecked = summary.pulls.filter((p) => needsMergeCheck(p) && !this.todayMergeChecks.has(p.number)).slice(0, MERGE_CHECKS_PER_SUMMARY); |
| 1690 | for (const p of unchecked) this.todayMergeChecks.add(p.number); |
| 1691 | if (unchecked.length) |
| 1692 | this.background( |
| 1693 | (async () => { |
| 1694 | for (const p of unchecked) { |
| 1695 | await this.collab.mergeability(p.number).catch((e) => console.error("today: mergeability check failed", p.number, e)); |
| 1696 | this.todayMergeChecks.delete(p.number); |
| 1697 | } |
| 1698 | })(), |
| 1699 | ); |
| 1700 | return summary; |
| 1701 | } |
| 1702 | |
| 1703 | createDeployment(...a: Parameters<Deployments["create"]>) { |
| 1704 | return this.deploys.create(...a); |
| 1705 | } |
| 1706 | deployments(...a: Parameters<Deployments["list"]>) { |
| 1707 | return this.deploys.list(...a); |
| 1708 | } |
| 1709 | deployment(...a: Parameters<Deployments["get"]>) { |
| 1710 | return this.deploys.get(...a); |
| 1711 | } |
| 1712 | deleteDeployment(...a: Parameters<Deployments["remove"]>) { |
| 1713 | return this.deploys.remove(...a); |
| 1714 | } |
| 1715 | createDeploymentStatus(...a: Parameters<Deployments["createStatus"]>) { |
| 1716 | return this.deploys.createStatus(...a); |
| 1717 | } |
| 1718 | deploymentStatuses(...a: Parameters<Deployments["statuses"]>) { |
| 1719 | return this.deploys.statuses(...a); |
| 1720 | } |
| 1721 | deploymentStatus(...a: Parameters<Deployments["status"]>) { |
| 1722 | return this.deploys.status(...a); |
| 1723 | } |
| 1724 | environments() { |
| 1725 | return this.deploys.environments(); |
| 1726 | } |
| 1727 | environment(...a: Parameters<Deployments["environment"]>) { |
| 1728 | return this.deploys.environment(...a); |
| 1729 | } |
| 1730 | upsertEnvironment(...a: Parameters<Deployments["upsertEnvironment"]>) { |
| 1731 | return this.deploys.upsertEnvironment(...a); |
| 1732 | } |
| 1733 | deleteEnvironment(...a: Parameters<Deployments["deleteEnvironment"]>) { |
| 1734 | return this.deploys.deleteEnvironment(...a); |
| 1735 | } |
| 1736 | addEnvironmentBranchPattern(...a: Parameters<Deployments["addBranchPattern"]>) { |
| 1737 | return this.deploys.addBranchPattern(...a); |
| 1738 | } |
| 1739 | removeEnvironmentBranchPattern(...a: Parameters<Deployments["removeBranchPattern"]>) { |
| 1740 | return this.deploys.removeBranchPattern(...a); |
| 1741 | } |
| 1742 | setEnvironmentSecret(...a: Parameters<Deployments["setSecret"]>) { |
| 1743 | return this.deploys.setSecret(...a); |
| 1744 | } |
| 1745 | deleteEnvironmentSecret(...a: Parameters<Deployments["deleteSecret"]>) { |
| 1746 | return this.deploys.deleteSecret(...a); |
| 1747 | } |
| 1748 | environmentSecretNames(...a: Parameters<Deployments["secretNames"]>) { |
| 1749 | return this.deploys.secretNames(...a); |
| 1750 | } |
| 1751 | setEnvironmentVariable(...a: Parameters<Deployments["setVariable"]>) { |
| 1752 | return this.deploys.setVariable(...a); |
| 1753 | } |
| 1754 | environmentVariables(...a: Parameters<Deployments["variables"]>) { |
| 1755 | return this.deploys.variables(...a); |
| 1756 | } |
| 1757 | |
| 1758 | /** What the GitHub JSON builders need for a set of issues: label rows, reaction counts and lock reasons. */ |
| 1759 | issueExtras(numbers: number[], subjects: string[] = []) { |
| 1760 | const lockReasons: Record<number, string | null> = {}; |
| 1761 | for (const n of numbers) lockReasons[n] = this.social.lockReason(n); |
| 1762 | return { labels: this.social.labelRows(), reactions: this.social.reactionCounts([...numbers.map((n) => `issue:${n}`), ...subjects]), lockReasons }; |
| 1763 | } |
| 1764 | issueEvents(...a: Parameters<Social["events"]>) { |
| 1765 | return this.social.events(...a); |
| 1766 | } |
| 1767 | repoIssueEvents(...a: Parameters<Social["repoEvents"]>) { |
| 1768 | return this.social.repoEvents(...a); |
| 1769 | } |
| 1770 | issueEvent(...a: Parameters<Social["event"]>) { |
| 1771 | return this.social.event(...a); |
| 1772 | } |
| 1773 | issueTimeline(...a: Parameters<Social["timeline"]>) { |
| 1774 | return this.social.timeline(...a); |
| 1775 | } |
| 1776 | labelRows() { |
| 1777 | return this.social.labelRows(); |
| 1778 | } |
| 1779 | label(...a: Parameters<Social["label"]>) { |
| 1780 | return this.social.label(...a); |
| 1781 | } |
| 1782 | createLabel(...a: Parameters<Social["createLabel"]>) { |
| 1783 | return this.social.createLabel(...a); |
| 1784 | } |
| 1785 | updateLabel(...a: Parameters<Social["updateLabel"]>) { |
| 1786 | return this.social.updateLabel(...a); |
| 1787 | } |
| 1788 | deleteLabel(...a: Parameters<Social["deleteLabel"]>) { |
| 1789 | return this.social.deleteLabel(...a); |
| 1790 | } |
| 1791 | issueLabels(...a: Parameters<Social["issueLabels"]>) { |
| 1792 | return this.social.issueLabels(...a); |
| 1793 | } |
| 1794 | addIssueLabels(...a: Parameters<Social["addLabels"]>) { |
| 1795 | return this.social.addLabels(...a); |
| 1796 | } |
| 1797 | setIssueLabels(...a: Parameters<Social["setLabels"]>) { |
| 1798 | return this.social.setLabels(...a); |
| 1799 | } |
| 1800 | removeIssueLabel(...a: Parameters<Social["removeLabel"]>) { |
| 1801 | return this.social.removeLabel(...a); |
| 1802 | } |
| 1803 | assignIssue(...a: Parameters<Social["assign"]>) { |
| 1804 | return this.social.assign(...a); |
| 1805 | } |
| 1806 | lockIssue(...a: Parameters<Social["lock"]>) { |
| 1807 | return this.social.lock(...a); |
| 1808 | } |
| 1809 | unlockIssue(...a: Parameters<Social["unlock"]>) { |
| 1810 | return this.social.unlock(...a); |
| 1811 | } |
| 1812 | comment(...a: Parameters<Social["comment"]>) { |
| 1813 | return this.social.comment(...a); |
| 1814 | } |
| 1815 | deleteComment(...a: Parameters<Social["deleteComment"]>) { |
| 1816 | return this.social.deleteComment(...a); |
| 1817 | } |
| 1818 | repoComments(...a: Parameters<Social["repoComments"]>) { |
| 1819 | return this.social.repoComments(...a); |
| 1820 | } |
| 1821 | createReviewComment(...a: Parameters<Social["createReviewComment"]>) { |
| 1822 | return this.social.createReviewComment(...a); |
| 1823 | } |
| 1824 | review(...a: Parameters<Social["review"]>) { |
| 1825 | return this.social.review(...a); |
| 1826 | } |
| 1827 | dismissReview(...a: Parameters<Social["dismissReview"]>) { |
| 1828 | return this.social.dismissReview(...a); |
| 1829 | } |
| 1830 | removeReviewers(...a: Parameters<Social["removeReviewers"]>) { |
| 1831 | return this.social.removeReviewers(...a); |
| 1832 | } |
| 1833 | updatePullBranch(...a: Parameters<Social["updateBranch"]>) { |
| 1834 | return this.social.updateBranch(...a); |
| 1835 | } |
| 1836 | pullsForCommit(...a: Parameters<Social["pullsForCommit"]>) { |
| 1837 | return this.social.pullsForCommit(...a); |
| 1838 | } |
| 1839 | reactions(...a: Parameters<Social["reactions"]>) { |
| 1840 | return this.social.reactions(...a); |
| 1841 | } |
| 1842 | react(...a: Parameters<Social["react"]>) { |
| 1843 | return this.social.react(...a); |
| 1844 | } |
| 1845 | unreact(...a: Parameters<Social["unreact"]>) { |
| 1846 | return this.social.unreact(...a); |
| 1847 | } |
| 1848 | searchIssues(query: Parameters<typeof searchIssues>[1], limit: number) { |
| 1849 | return searchIssues(this, query, limit); |
| 1850 | } |
| 1851 | /** The issues for one page of search hits, in the order given (missing numbers are skipped). */ |
| 1852 | issuesByNumber(numbers: number[], hide?: string[]) { |
| 1853 | return numbers.slice(0, 100).flatMap((n) => { |
| 1854 | try { |
| 1855 | return [this.collab.get(n, hide).issue]; |
| 1856 | } catch { |
| 1857 | return []; |
| 1858 | } |
| 1859 | }); |
| 1860 | } |
| 1861 | |
| 1862 | objectType(...a: Parameters<GitData["objectType"]>) { |
| 1863 | return this.gitdata.objectType(...a); |
| 1864 | } |
| 1865 | refsWithTypes(...a: Parameters<GitData["refsWithTypes"]>) { |
| 1866 | return this.gitdata.refsWithTypes(...a); |
| 1867 | } |
| 1868 | createBlob(content: Uint8Array, caller: Caller) { |
| 1869 | return this.gitdata.createBlob(content, caller); |
| 1870 | } |
| 1871 | getBlob(...a: Parameters<GitData["getBlob"]>) { |
| 1872 | return this.gitdata.getBlob(...a); |
| 1873 | } |
| 1874 | createTree(...a: Parameters<GitData["createTree"]>) { |
| 1875 | return this.gitdata.createTree(...a); |
| 1876 | } |
| 1877 | getTree(...a: Parameters<GitData["getTree"]>) { |
| 1878 | return this.gitdata.getTree(...a); |
| 1879 | } |
| 1880 | createGitCommit(...a: Parameters<GitData["createCommit"]>) { |
| 1881 | return this.gitdata.createCommit(...a); |
| 1882 | } |
| 1883 | gitCommit(...a: Parameters<GitData["gitCommit"]>) { |
| 1884 | return this.gitdata.gitCommit(...a); |
| 1885 | } |
| 1886 | createGitTag(...a: Parameters<GitData["createTag"]>) { |
| 1887 | return this.gitdata.createTag(...a); |
| 1888 | } |
| 1889 | gitTag(...a: Parameters<GitData["getTag"]>) { |
| 1890 | return this.gitdata.getTag(...a); |
| 1891 | } |
| 1892 | putContents(...a: Parameters<GitData["putContents"]>) { |
| 1893 | return this.gitdata.putContents(...a); |
| 1894 | } |
| 1895 | deleteContents(...a: Parameters<GitData["deleteContents"]>) { |
| 1896 | return this.gitdata.deleteContents(...a); |
| 1897 | } |
| 1898 | readme(...a: Parameters<GitData["readme"]>) { |
| 1899 | return this.gitdata.readme(...a); |
| 1900 | } |
| 1901 | mergeBranches(...a: Parameters<GitData["merge"]>) { |
| 1902 | return this.gitdata.merge(...a); |
| 1903 | } |
| 1904 | languages() { |
| 1905 | return this.gitdata.languages(); |
| 1906 | } |
| 1907 | archiveKey(...a: Parameters<GitData["archiveKey"]>) { |
| 1908 | return this.gitdata.archiveKey(...a); |
| 1909 | } |
| 1910 | buildArchive(...a: Parameters<GitData["buildArchive"]>) { |
| 1911 | return this.gitdata.buildArchive(...a); |
| 1912 | } |
| 1913 | runLogsZip(...a: Parameters<GitData["runLogsZip"]>) { |
| 1914 | return this.gitdata.runLogsZip(...a); |
| 1915 | } |
| 1916 | runAttemptId(...a: Parameters<GitData["runAttemptId"]>) { |
| 1917 | return this.gitdata.runAttemptId(...a); |
| 1918 | } |
| 1919 | checkRun(...a: Parameters<GitData["check"]>) { |
| 1920 | return this.gitdata.check(...a); |
| 1921 | } |
| 1922 | updateCheckRun(...a: Parameters<GitData["updateCheck"]>) { |
| 1923 | return this.gitdata.updateCheck(...a); |
| 1924 | } |
| 1925 | checkSuites(...a: Parameters<GitData["checkSuites"]>) { |
| 1926 | return this.gitdata.checkSuites(...a); |
| 1927 | } |
| 1928 | checkSuite(...a: Parameters<GitData["checkSuite"]>) { |
| 1929 | return this.gitdata.checkSuite(...a); |
| 1930 | } |
| 1931 | |
| 1932 | /** repository_dispatch: an external event that starts workflows listening for its `event_type`. */ |
| 1933 | async repositoryDispatch(eventType: string, clientPayload: Record<string, unknown>, caller: Caller): Promise<void> { |
| 1934 | if (!atLeast(caller.role, "write")) throw new HttpError(403, "write access is required to dispatch events"); |
| 1935 | const sha = this.getRef(this.headRef); |
| 1936 | if (!sha) throw new HttpError(422, "the repository is empty"); |
| 1937 | // Suspended Actions refuse the dispatch with the reason (triggerWorkflows would swallow it). |
| 1938 | await this.actions.refuseIfBlocked("run"); |
| 1939 | const m = this.meta; |
| 1940 | const payload = { action: eventType, branch: m.defaultBranch, client_payload: clientPayload }; |
| 1941 | this.emit({ type: "repository_dispatch", action: eventType, repoId: m.repoId, owner: m.owner, repo: m.name, payload: JSON.parse(JSON.stringify(payload)), actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, at: now() }); |
| 1942 | await triggerWorkflows(this, { name: "repository_dispatch", action: eventType, ref: this.headRef, sha, payload, title: eventType }, caller); |
| 1943 | } |
| 1944 | |
| 1945 | // ---------------------------------------------------------------- RPC passthroughs: GitHub imports and milestones (repo/imports.ts) |
| 1946 | |
| 1947 | private importsCache?: RepoImports; |
| 1948 | private get importsModule(): RepoImports { |
| 1949 | return (this.importsCache ??= new RepoImports(this.sql)); |
| 1950 | } |
| 1951 | |
| 1952 | /** The import that currently holds this repository, or null. Other writes are refused meanwhile (loadRepo, gitReceivePack). */ |
| 1953 | importLockHolder(): string | null { |
| 1954 | return this.sql.exec<{ value: string }>("SELECT value FROM meta WHERE key = 'import_lock'").toArray()[0]?.value ?? null; |
| 1955 | } |
| 1956 | |
| 1957 | /** |
| 1958 | * Claim the repository for an import. Refuses if another import holds it, or if the repo |
| 1959 | * already holds any ref, issue, comment, milestone, protection or release this import did not write |
| 1960 | * (so a retry never adopts content people added in the meantime — H2). |
| 1961 | */ |
| 1962 | importBegin(importId: string): void { |
| 1963 | const holder = this.importLockHolder(); |
| 1964 | if (holder && holder !== importId) throw new HttpError(409, "another import is in progress for this repository"); |
| 1965 | // A ref not written by this import, or any foreign row, means the repo was adopted since. |
| 1966 | for (const r of this.refs()) { |
| 1967 | if (r.name.startsWith("refs/diffinery-import/")) continue; |
| 1968 | if (this.importsModule.importRefOid(r.name, importId) === null) { |
| 1969 | if (holder !== importId) throw new HttpError(409, "repository already holds content not written by this import; start a new import"); |
| 1970 | } |
| 1971 | } |
| 1972 | if (this.importsModule.hasForeignContent(importId)) throw new HttpError(409, "repository already holds content not written by this import; start a new import"); |
| 1973 | this.sql.exec("INSERT OR REPLACE INTO meta (key, value) VALUES ('import_lock', ?)", importId); |
| 1974 | } |
| 1975 | |
| 1976 | /** Release the import lock (on finalize, fail or cancel). */ |
| 1977 | importEnd(importId: string): void { |
| 1978 | if (this.importLockHolder() === importId) this.sql.exec("DELETE FROM meta WHERE key = 'import_lock'"); |
| 1979 | } |
| 1980 | |
| 1981 | importProtection(pattern: string, rules: ProtectionRules | null, importId: string) { |
| 1982 | // What agents may do is a person's decision here, never something an import brings in. |
| 1983 | if (rules) { |
| 1984 | const { allowAgentAutoMerge: _a, agentAutoMergeWithoutApproval: _w, autoMergeAgents: _g, autoMergeMethod: _gm, agentsMayPush: _p, agentsMayMerge: _m, ...rest } = rules; |
| 1985 | rules = rest; |
| 1986 | } |
| 1987 | if (rules?.mergeQueue) rules = { ...rules, mergeQueue: normalizeMergeQueue(rules.mergeQueue) }; |
| 1988 | if (rules?.requiredCheckSources) rules = { ...rules, requiredCheckSources: normalizeCheckSources(rules.requiredCheckSources) }; |
| 1989 | if (rules) this.importsModule.protection(pattern, JSON.stringify(rules), importId); |
| 1990 | } |
| 1991 | importLabels(...a: Parameters<RepoImports["labels"]>) { |
| 1992 | return this.importsModule.labels(...a); |
| 1993 | } |
| 1994 | importMilestones(...a: Parameters<RepoImports["milestones"]>) { |
| 1995 | return this.importsModule.milestones(...a); |
| 1996 | } |
| 1997 | importIssues(...a: Parameters<RepoImports["issues"]>) { |
| 1998 | return this.importsModule.issues(...a); |
| 1999 | } |
| 2000 | importComments(...a: Parameters<RepoImports["comments"]>) { |
| 2001 | return this.importsModule.comments(...a); |
| 2002 | } |
| 2003 | importReviews(...a: Parameters<RepoImports["reviews"]>) { |
| 2004 | return this.importsModule.reviews(...a); |
| 2005 | } |
| 2006 | importSetMergedBy(...a: Parameters<RepoImports["setMergedBy"]>) { |
| 2007 | return this.importsModule.setMergedBy(...a); |
| 2008 | } |
| 2009 | importPullNumbers(...a: Parameters<RepoImports["pullNumbers"]>) { |
| 2010 | return this.importsModule.pullNumbers(...a); |
| 2011 | } |
| 2012 | importCounts() { |
| 2013 | return this.importsModule.counts(); |
| 2014 | } |
| 2015 | importFindings() { |
| 2016 | return this.importsModule.findings(); |
| 2017 | } |
| 2018 | /** |
| 2019 | * Point `refs/pull/N/head` at each imported pull request's head commit (the server owns |
| 2020 | * refs/pull/*; the agent pushed the commits to refs/diffinery-import/pull/N). Heads whose |
| 2021 | * commits never arrived (e.g. deleted forks) are reported, not fatal. |
| 2022 | */ |
| 2023 | importPullRefs(importId?: string): { created: number; missing: number[] } { |
| 2024 | const missing: number[] = []; |
| 2025 | let created = 0; |
| 2026 | for (const p of this.importsModule.pullHeads()) { |
| 2027 | const ref = `refs/pull/${p.number}/head`; |
| 2028 | if (!/^[0-9a-f]{40}$/.test(p.headSha) || !this.store.has(p.headSha)) { |
| 2029 | missing.push(p.number); |
| 2030 | continue; |
| 2031 | } |
| 2032 | const current = this.getRef(ref); |
| 2033 | // Record provenance so a retry does not mistake refs/pull/*/head for content people adopted. |
| 2034 | if (importId) this.importsModule.recordImportRef(ref, p.headSha, importId); |
| 2035 | if (current === p.headSha) continue; |
| 2036 | if (this.casRef(ref, current, p.headSha)) created++; |
| 2037 | } |
| 2038 | return { created, missing }; |
| 2039 | } |
| 2040 | /** Remove the import's own refs once refs/pull/N/head keep the pull request commits reachable. */ |
| 2041 | importDropTempRefs(importId?: string): number { |
| 2042 | const refs = this.refs(IMPORT_REF_PREFIX); |
| 2043 | for (const r of refs) this.casRef(r.name, r.oid, null); |
| 2044 | if (importId) this.importsModule.dropImportRefs(importId); |
| 2045 | return refs.length; |
| 2046 | } |
| 2047 | setOrgVariables(...a: Parameters<RepoImports["setOrgVariables"]>) { |
| 2048 | return this.importsModule.setOrgVariables(...a); |
| 2049 | } |
| 2050 | issueMilestoneOf(number: number) { |
| 2051 | return this.importsModule.milestoneOf(number); |
| 2052 | } |
| 2053 | /** Check names that workflow jobs on the default branch report, keyed by job name (GitHub names checks by job). */ |
| 2054 | async importCheckNames(): Promise<Record<string, string[]>> { |
| 2055 | const sha = await this.resolve("HEAD"); |
| 2056 | const out: Record<string, string[]> = {}; |
| 2057 | if (!sha) return out; |
| 2058 | for (const w of await this.actions.loadWorkflows(sha)) { |
| 2059 | if (!w.workflow) continue; |
| 2060 | const wf = w.workflow.name ?? w.path.split("/").pop()!; |
| 2061 | for (const [key, job] of Object.entries(w.workflow.jobs)) { |
| 2062 | const name = (job as { name?: unknown }).name; |
| 2063 | for (const n of new Set([key, typeof name === "string" ? name : key])) (out[n] ??= []).push(`${wf} / ${typeof name === "string" && !name.includes("${{") ? name : key}`); |
| 2064 | } |
| 2065 | } |
| 2066 | return out; |
| 2067 | } |
| 2068 | milestones(...a: Parameters<RepoImports["listMilestones"]>) { |
| 2069 | return this.importsModule.listMilestones(...a); |
| 2070 | } |
| 2071 | milestone(...a: Parameters<RepoImports["milestone"]>) { |
| 2072 | return this.importsModule.milestone(...a); |
| 2073 | } |
| 2074 | saveMilestone(...a: Parameters<RepoImports["saveMilestone"]>) { |
| 2075 | return this.importsModule.saveMilestone(...a); |
| 2076 | } |
| 2077 | setIssueMilestone(...a: Parameters<RepoImports["setIssueMilestone"]>) { |
| 2078 | return this.importsModule.setIssueMilestone(...a); |
| 2079 | } |
| 2080 | |
| 2081 | // ---------------------------------------------------------------- live updates (WebSockets with hibernation) |
| 2082 | |
| 2083 | override async fetch(request: Request): Promise<Response> { |
| 2084 | if (request.headers.get("Upgrade") !== "websocket") return new Response("expected websocket", { status: 426 }); |
| 2085 | const topics = (new URL(request.url).searchParams.get("topics") ?? "repo").split(",").filter((t) => /^[a-z]+(:[A-Za-z0-9_-]+)?$/.test(t)).slice(0, 10); |
| 2086 | const pair = new WebSocketPair(); |
| 2087 | this.ctx.acceptWebSocket(pair[1], topics.length ? topics : ["repo"]); |
| 2088 | // Access is checked when a page connects; reconnecting checks it again, so someone who lost access |
| 2089 | // (removed, or the repository made private) stops getting updates within LIVE_REAUTH_MS. |
| 2090 | pair[1].serializeAttachment({ until: Date.now() + LIVE_REAUTH_MS }); |
| 2091 | return new Response(null, { status: 101, webSocket: pair[0] }); |
| 2092 | } |
| 2093 | |
| 2094 | /** Close a socket whose access check is too old; the page reconnects, and the Worker checks access again. */ |
| 2095 | private expired(ws: WebSocket): boolean { |
| 2096 | const a = ws.deserializeAttachment() as { until?: number } | null; |
| 2097 | if (a?.until && a.until > Date.now()) return false; |
| 2098 | try { |
| 2099 | ws.close(LIVE_REAUTH_CODE, "reconnect"); |
| 2100 | } catch { |
| 2101 | /* already closed */ |
| 2102 | } |
| 2103 | return true; |
| 2104 | } |
| 2105 | |
| 2106 | override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> { |
| 2107 | if (this.expired(ws)) return; |
| 2108 | if (message === "ping") ws.send("pong"); |
| 2109 | } |
| 2110 | |
| 2111 | override async webSocketClose(ws: WebSocket, code: number): Promise<void> { |
| 2112 | try { |
| 2113 | ws.close(code, "bye"); |
| 2114 | } catch { |
| 2115 | /* already closed */ |
| 2116 | } |
| 2117 | } |
| 2118 | |
| 2119 | broadcast(topic: string, data: unknown): void { |
| 2120 | const msg = JSON.stringify({ topic, data }); |
| 2121 | for (const ws of this.ctx.getWebSockets(topic)) { |
| 2122 | if (this.expired(ws)) continue; |
| 2123 | try { |
| 2124 | ws.send(msg); |
| 2125 | } catch { |
| 2126 | /* client went away */ |
| 2127 | } |
| 2128 | } |
| 2129 | } |
| 2130 | } |
| 2131 | |
| 2132 | export function toInfo(sha: string, c: Commit): CommitInfo { |
| 2133 | return { sha, tree: c.tree, parents: c.parents, author: c.author, committer: c.committer, message: c.message, signed: !!c.gpgsig }; |
| 2134 | } |
| 2135 | |
| 2136 | export { fromUtf8 }; |