| 1 | import { DurableObject } from "cloudflare:workers"; |
| 2 | import { normalizeCheckSources, requiredCheck } from "./required.js"; |
| 3 | import { REVIEW_APP, REVIEW_CHECK } from "../agentic/review.js"; |
| 4 | import { unsafeTreePath } from "../lib/tree-names.js"; |
| 5 | import { |
| 6 | CODE_TYPES, |
| 7 | EMPTY_TREE_OID, |
| 8 | ZERO_OID, |
| 9 | applyChanges, |
| 10 | DiffBudget, |
| 11 | diffTrees, |
| 12 | fileDiff, |
| 13 | formatUnified, |
| 14 | fromUtf8, |
| 15 | isAncestor, |
| 16 | isBinary, |
| 17 | isOid, |
| 18 | isTreeMode, |
| 19 | mergeBase, |
| 20 | parseCommit, |
| 21 | packStream, |
| 22 | parsePack, |
| 23 | parseTree, |
| 24 | planFetch, |
| 25 | peelToCommit, |
| 26 | readCommit, |
| 27 | readTree, |
| 28 | resolvePath, |
| 29 | serializeCommit, |
| 30 | walkCommits, |
| 31 | type Commit, |
| 32 | type FileChange, |
| 33 | type Signature, |
| 34 | utf8, |
| 35 | } from "@diffinery/git-core"; |
| 36 | import type { DiffineryEvent } from "@diffinery/shared"; |
| 37 | import type { Env } from "../env.js"; |
| 38 | import { |
| 39 | advertiseReceivePack, |
| 40 | advertiseUploadPackV2, |
| 41 | errorPacket, |
| 42 | handleUploadPackV2, |
| 43 | parseReceivePack, |
| 44 | reportStatus, |
| 45 | unpackFailure, |
| 46 | type RefEntry, |
| 47 | type RefResult, |
| 48 | } from "../git/protocol.js"; |
| 49 | import { fsckObjects } from "../git/fsck.js"; |
| 50 | import { scanForSecrets, secretBypassReason, type SecretHit } from "../git/secret-scan.js"; |
| 51 | import { GHOST, HttpError, isValidRefName, now } from "../lib/util.js"; |
| 52 | import { R2Sink } from "../lib/r2-sink.js"; |
| 53 | import { archivePrefix, deletePrefixes, repoPrefixes, type SpilledBody } from "../lib/storage-keys.js"; |
| 54 | import { storageRefusal } from "../lib/quotas.js"; |
| 55 | import { Actions } from "./actions.js"; |
| 56 | import { AutoMerge, isPerson } from "./auto-merge.js"; |
| 57 | import { Collab } from "./collab.js"; |
| 58 | import { Deployments } from "./deployments.js"; |
| 59 | import { triggerWorkflows } from "./extra-triggers.js"; |
| 60 | import { GitData } from "./gitdata.js"; |
| 61 | import { IMPORT_REF_PREFIX, RepoImports } from "./imports.js"; |
| 62 | import { RepoObjectStore } from "./objects.js"; |
| 63 | import { MergeQueue, QUEUE_BRANCH_PREFIX, normalizeMergeQueue } from "./queue.js"; |
| 64 | import { Releases } from "./releases.js"; |
| 65 | import { REPO_SCHEMA, migrateRepoSchema } from "./schema.js"; |
| 66 | import { Runtime } from "./runtime.js"; |
| 67 | import { TokenPolicy } from "./token-policy.js"; |
| 68 | import { searchIssues } from "./search.js"; |
| 69 | import { repoToday } from "../agentic/today-repo.js"; |
| 70 | import { Social } from "./social.js"; |
| 71 | import { Statuses } from "./statuses.js"; |
| 72 | import { atLeast, globToRegExp, type Caller, type ProtectionRules, type RepoMeta } from "./types.js"; |
| 73 | |
| 74 | const MAX_PUSH_BYTES = 100 * 1024 * 1024; |
| 75 | /** Pushed blobs this large are hashed, scanned and stored from their compressed bytes, never held inflated. */ |
| 76 | const LARGE_OBJECT_BYTES = 4 * 1024 * 1024; |
| 77 | /** A purge walks every reachable commit and tree while holding the repository: bounded so it finishes in time. */ |
| 78 | export const MAX_PURGE_OBJECTS = 300_000; |
| 79 | /** Storage key that marks a deleted repository whose R2 objects are still being deleted. */ |
| 80 | const PURGE_KEY = "purge"; |
| 81 | /** How often jobs waiting on the account's hosted-job quota are retried. */ |
| 82 | const HELD_RETRY_MS = 60_000; |
| 83 | |
| 84 | export type TreeItem = { |
| 85 | name: string; |
| 86 | path: string; |
| 87 | type: "tree" | "blob" | "commit"; |
| 88 | mode: string; |
| 89 | oid: string; |
| 90 | size?: number; |
| 91 | }; |
| 92 | |
| 93 | export type CommitInfo = { |
| 94 | sha: string; |
| 95 | tree: string; |
| 96 | parents: string[]; |
| 97 | author: Signature; |
| 98 | committer: Signature; |
| 99 | message: string; |
| 100 | signed: boolean; |
| 101 | }; |
| 102 | |
| 103 | /** |
| 104 | * One Durable Object per repository. It is the single writer for the repo's |
| 105 | * refs, Git objects, issues, pull requests, reviews, checks and workflow runs, |
| 106 | * which gives strongly consistent ref updates and merges without locks. |
| 107 | */ |
| 108 | /** How long a live-update socket lives before the page must reconnect and pass the access check again. */ |
| 109 | const LIVE_REAUTH_MS = 10 * 60 * 1000; |
| 110 | /** The close code that asks a page to reconnect at once (not a failure: no backoff, no reload). */ |
| 111 | export const LIVE_REAUTH_CODE = 4001; |
| 112 | |
| 113 | /** A row of what someone wrote (RepoDO.authoredBy): column name to value. */ |
| 114 | type AuthoredRow = Record<string, string | number | null>; |
| 115 | |
| 116 | export class RepoDO extends DurableObject<Env> { |
| 117 | readonly sql: SqlStorage; |
| 118 | store!: RepoObjectStore; |
| 119 | readonly collab: Collab; |
| 120 | readonly actions: Actions; |
| 121 | readonly queue: MergeQueue; |
| 122 | readonly autoMerge: AutoMerge; |
| 123 | readonly runtime: Runtime; |
| 124 | readonly policy: TokenPolicy; |
| 125 | private metaCache: RepoMeta | null = null; |
| 126 | |
| 127 | constructor(ctx: DurableObjectState, env: Env) { |
| 128 | super(ctx, env); |
| 129 | this.sql = ctx.storage.sql; |
| 130 | this.sql.exec(REPO_SCHEMA); |
| 131 | migrateRepoSchema(this.sql); |
| 132 | const meta = this.readMeta(); |
| 133 | if (meta) this.store = new RepoObjectStore(this.sql, env.BUCKET, meta.repoId, () => this.storageChanged()); |
| 134 | this.collab = new Collab(this); |
| 135 | this.actions = new Actions(this, env); |
| 136 | this.queue = new MergeQueue(this); |
| 137 | this.autoMerge = new AutoMerge(this, env); |
| 138 | this.runtime = new Runtime(this, env); |
| 139 | this.policy = new TokenPolicy(this); |
| 140 | } |
| 141 | |
| 142 | // ---------------------------------------------------------------- meta |
| 143 | |
| 144 | private readMeta(): RepoMeta | null { |
| 145 | const row = this.sql.exec<{ value: string }>("SELECT value FROM meta WHERE key = 'meta'").toArray()[0]; |
| 146 | this.metaCache = row ? (JSON.parse(row.value) as RepoMeta) : null; |
| 147 | return this.metaCache; |
| 148 | } |
| 149 | |
| 150 | get meta(): RepoMeta { |
| 151 | const m = this.metaCache ?? this.readMeta(); |
| 152 | if (!m) throw new HttpError(404, "repository not initialised"); |
| 153 | return m; |
| 154 | } |
| 155 | |
| 156 | async init(meta: RepoMeta): Promise<void> { |
| 157 | // A repository created now (not one whose meta is updated) starts with read-only workflow tokens. |
| 158 | if (!this.readMeta()) this.policy.initNewRepo(); |
| 159 | this.sql.exec("INSERT OR REPLACE INTO meta (key, value) VALUES ('meta', ?)", JSON.stringify(meta)); |
| 160 | this.metaCache = meta; |
| 161 | this.store = new RepoObjectStore(this.sql, this.env.BUCKET, meta.repoId, () => this.storageChanged()); |
| 162 | } |
| 163 | |
| 164 | async updateMeta(patch: Partial<RepoMeta>): Promise<RepoMeta> { |
| 165 | const next = { ...this.meta, ...patch }; |
| 166 | await this.init(next); |
| 167 | return next; |
| 168 | } |
| 169 | |
| 170 | /** |
| 171 | * Whether the repository is archived (read-only). The Worker refuses writes to an archived |
| 172 | * repository, but work this object does by itself (auto-merge, the merge queue) must ask here. |
| 173 | */ |
| 174 | async isArchived(): Promise<boolean> { |
| 175 | const known = this.meta.archived; |
| 176 | if (typeof known === "boolean") return known; |
| 177 | const row = await this.env.DB.prepare("SELECT archived FROM repos WHERE id = ?").bind(this.meta.repoId).first<{ archived: number }>(); |
| 178 | // setArchived may have run while D1 answered; what it set wins. |
| 179 | if (typeof this.meta.archived === "boolean") return this.meta.archived; |
| 180 | const archived = !!row?.archived; |
| 181 | await this.updateMeta({ archived }); |
| 182 | return archived; |
| 183 | } |
| 184 | |
| 185 | /** The repository was archived or unarchived (D1 already says so). Archiving ends auto-merge and empties the merge queues. */ |
| 186 | async setArchived(archived: boolean): Promise<void> { |
| 187 | await this.updateMeta({ archived }); |
| 188 | if (!archived) return; |
| 189 | await this.autoMerge.repositoryArchived(); |
| 190 | await this.queue.repositoryArchived(); |
| 191 | } |
| 192 | |
| 193 | /** |
| 194 | * Wipe all storage (repository deletion), then its R2 objects: git objects, LFS, release |
| 195 | * assets, caches, artifacts, logs and archives. One call can't delete more than about |
| 196 | * 450,000 objects, so the alarm keeps going until they are all gone. |
| 197 | */ |
| 198 | async destroy(): Promise<void> { |
| 199 | const repoId = this.readMeta()?.repoId; |
| 200 | await this.ctx.storage.deleteAlarm(); |
| 201 | await this.ctx.storage.deleteAll(); |
| 202 | this.metaCache = null; |
| 203 | if (!repoId) return; |
| 204 | await this.ctx.storage.put(PURGE_KEY, repoId); |
| 205 | await this.purge(repoId); |
| 206 | } |
| 207 | |
| 208 | /** Delete a deleted repository's R2 objects; returns false while some remain (the alarm retries). */ |
| 209 | private async purge(repoId: string): Promise<void> { |
| 210 | const done = await deletePrefixes(this.env.BUCKET, repoPrefixes(repoId)).catch((e) => { |
| 211 | console.error("could not delete the repository's objects", repoId, e); |
| 212 | return false; |
| 213 | }); |
| 214 | if (done) await this.ctx.storage.deleteAll(); |
| 215 | else await this.ctx.storage.setAlarm(Date.now() + 5_000); |
| 216 | } |
| 217 | |
| 218 | async stats(): Promise<{ objects: number; bytes: number; refs: number; openIssues: number; openPulls: number }> { |
| 219 | const q = (s: string) => this.sql.exec<{ n: number }>(s).one().n; |
| 220 | return { |
| 221 | objects: this.store.count(), |
| 222 | bytes: this.store.sizeBytes(), |
| 223 | refs: q("SELECT count(*) AS n FROM refs"), |
| 224 | openIssues: q("SELECT count(*) AS n FROM issues WHERE kind = 'issue' AND state = 'open'"), |
| 225 | openPulls: q("SELECT count(*) AS n FROM issues WHERE kind = 'pull' AND state = 'open'"), |
| 226 | }; |
| 227 | } |
| 228 | |
| 229 | // ---------------------------------------------------------------- deleted and exported accounts (accounts/) |
| 230 | |
| 231 | /** |
| 232 | * After an account is deleted its work here stays, attributed to the `ghost` user as on GitHub: issues and |
| 233 | * pull requests, comments, reviews, releases, statuses, deployments, events, workflow runs and reactions. |
| 234 | * Self-hosted runners it registered here (by login) are removed. Returns how many rows changed. |
| 235 | */ |
| 236 | async forgetAccounts(ids: string[], logins: string[]): Promise<number> { |
| 237 | if (!ids.length) return 0; |
| 238 | const inIds = ids.map(() => "?").join(", "); |
| 239 | let changed = 0; |
| 240 | const run = (q: string, ...b: unknown[]) => void (changed += this.sql.exec(q, ...b).rowsWritten); |
| 241 | const people: Array<[table: string, prefix: string]> = [ |
| 242 | ["issues", "author"], |
| 243 | ["comments", "author"], |
| 244 | ["reviews", "author"], |
| 245 | ["releases", "author"], |
| 246 | ["statuses", "creator"], |
| 247 | ["deployments", "creator"], |
| 248 | ["deployment_statuses", "creator"], |
| 249 | ["issue_events", "actor"], |
| 250 | ["checks", "creator"], |
| 251 | ["release_assets", "uploader"], |
| 252 | ["reactions", "user"], |
| 253 | ]; |
| 254 | for (const [table, p] of people) { |
| 255 | // Reactions are one per person: where the ghost already reacted the same way, the deleted account's goes. |
| 256 | run(`UPDATE OR IGNORE ${table} SET ${p}_id = ?, ${p}_login = ?, ${p}_kind = ? WHERE ${p}_id IN (${inIds})`, GHOST.id, GHOST.login, GHOST.kind, ...ids); |
| 257 | } |
| 258 | run(`DELETE FROM reactions WHERE user_id IN (${inIds})`, ...ids); |
| 259 | run(`UPDATE deployment_reviews SET user_id = ?, user_login = ? WHERE user_id IN (${inIds})`, GHOST.id, GHOST.login, ...ids); |
| 260 | run(`UPDATE runs SET actor = json_object('id', ?, 'login', ?, 'kind', ?) WHERE json_extract(actor, '$.id') IN (${inIds})`, GHOST.id, GHOST.login, GHOST.kind, ...ids); |
| 261 | if (logins.length) { |
| 262 | const lower = logins.map((l) => l.toLowerCase()); |
| 263 | const inLogins = lower.map(() => "?").join(", "); |
| 264 | run(`UPDATE pulls SET merged_by = ? WHERE lower(merged_by) IN (${inLogins})`, GHOST.login, ...lower); |
| 265 | run(`DELETE FROM runners WHERE lower(created_by) IN (${inLogins})`, ...lower); |
| 266 | run(`DELETE FROM runner_registrations WHERE lower(created_by) IN (${inLogins})`, ...lower); |
| 267 | } |
| 268 | return changed; |
| 269 | } |
| 270 | |
| 271 | /** What these accounts wrote here, for an account export: issues and pull requests they opened, their comments and reviews (at most `limit` of each). */ |
| 272 | async authoredBy(ids: string[], limit = 5000): Promise<{ issues: AuthoredRow[]; comments: AuthoredRow[]; reviews: AuthoredRow[] }> { |
| 273 | if (!ids.length || !this.readMeta()) return { issues: [], comments: [], reviews: [] }; |
| 274 | const inIds = ids.map(() => "?").join(", "); |
| 275 | const rows = (q: string) => this.sql.exec<AuthoredRow>(q, ...ids, limit).toArray(); |
| 276 | return { |
| 277 | issues: rows(`SELECT number, kind, title, body, state, state_reason, created_at, updated_at, closed_at FROM issues WHERE author_id IN (${inIds}) ORDER BY number LIMIT ?`), |
| 278 | comments: rows(`SELECT id, number, body, path, line, created_at, updated_at FROM comments WHERE author_id IN (${inIds}) ORDER BY created_at LIMIT ?`), |
| 279 | reviews: rows(`SELECT id, number, state, body, commit_id, submitted_at FROM reviews WHERE author_id IN (${inIds}) ORDER BY submitted_at LIMIT ?`), |
| 280 | }; |
| 281 | } |
| 282 | |
| 283 | /** |
| 284 | * Write a Git bundle (version 2) of the repository's branches and tags to R2 at `key`, for an account export. |
| 285 | * The pack streams out one object at a time, as a clone's does. Null for an empty repository; a bundle past |
| 286 | * `limit` bytes is refused with a 413 and nothing is kept. |
| 287 | */ |
| 288 | async writeBundle(key: string, limit: number): Promise<{ size: number; refs: number } | null> { |
| 289 | if (!this.readMeta()) return null; |
| 290 | const refs = this.refs().filter((r) => r.name.startsWith("refs/heads/") || r.name.startsWith("refs/tags/")); |
| 291 | if (!refs.length) return null; |
| 292 | const plan = await planFetch(this.store, [...new Set(refs.map((r) => r.oid))], []); |
| 293 | const head = this.getRef(this.headRef); |
| 294 | const sink = new R2Sink(this.env.BUCKET, key, "application/x-git-bundle", limit, "the repository is too large to bundle"); |
| 295 | const store = this.store; |
| 296 | async function* entries() { |
| 297 | for (const oid of plan.oids) { |
| 298 | const raw = await store.readRaw(oid); |
| 299 | if (!raw) throw new Error(`missing object ${oid}`); |
| 300 | yield { type: raw.type, size: raw.size, deflated: raw.deflated }; |
| 301 | } |
| 302 | } |
| 303 | try { |
| 304 | await sink.write(utf8(`# v2 git bundle\n${head ? `${head} HEAD\n` : ""}${refs.map((r) => `${r.oid} ${r.name}\n`).join("")}\n`)); |
| 305 | for await (const part of packStream(plan.oids.length, entries())) await sink.write(part); |
| 306 | return { size: await sink.close(), refs: refs.length }; |
| 307 | } catch (e) { |
| 308 | await sink.abort(); |
| 309 | throw e; |
| 310 | } |
| 311 | } |
| 312 | |
| 313 | /** Keep the object alive for work that finishes after the current request. */ |
| 314 | background(p: Promise<unknown>): void { |
| 315 | this.ctx.waitUntil(p.catch((e) => console.error("background task failed", e))); |
| 316 | } |
| 317 | |
| 318 | /** |
| 319 | * Set (or with null, clear) the object's single alarm. The merge queue uses it for check timeouts; |
| 320 | * while jobs wait on the account's hosted-job quota it also fires every minute to retry them. |
| 321 | */ |
| 322 | armAlarm(at: number | null): void { |
| 323 | const held = this.actions.hasAccountHeldJobs() ? Date.now() + HELD_RETRY_MS : null; |
| 324 | const next = at === null ? held : held === null ? at : Math.min(at, held); |
| 325 | this.ctx.waitUntil(next === null ? this.ctx.storage.deleteAlarm() : this.ctx.storage.setAlarm(next)); |
| 326 | } |
| 327 | |
| 328 | override async alarm(): Promise<void> { |
| 329 | const purging = await this.ctx.storage.get<string>(PURGE_KEY); |
| 330 | if (purging) return this.purge(purging); |
| 331 | await this.queue.process(); |
| 332 | if (this.actions.hasAccountHeldJobs()) { |
| 333 | await this.actions.releaseAccountHeld(); |
| 334 | // Keep the queue's own alarm if it set an earlier one. |
| 335 | const current = await this.ctx.storage.getAlarm(); |
| 336 | if (this.actions.hasAccountHeldJobs() && (current === null || current <= Date.now() || current > Date.now() + HELD_RETRY_MS)) await this.ctx.storage.setAlarm(Date.now() + HELD_RETRY_MS); |
| 337 | } |
| 338 | } |
| 339 | |
| 340 | /** Queue an event (webhooks, notifications) and show it live to open pages; `live: false` skips the pages (e.g. draft releases, which readers can't see). */ |
| 341 | emit(event: DiffineryEvent, opts?: { live?: boolean }): void { |
| 342 | this.ctx.waitUntil(this.env.EVENTS.send(event).catch((e) => console.error("event send failed", e))); |
| 343 | // Open pages only learn that something changed and fetch it with the viewer's own access: the event |
| 344 | // itself (an audit entry's detail, a dispatch's payload) is not every reader's to see. |
| 345 | if (opts?.live !== false && event.type !== "audit") this.broadcast("repo", { kind: "event", type: event.type }); |
| 346 | } |
| 347 | |
| 348 | // ---------------------------------------------------------------- purging unreachable objects |
| 349 | |
| 350 | /** Bumped by every purge; a push that started before one refuses its ref updates. */ |
| 351 | private purgeEpoch = 0; |
| 352 | |
| 353 | /** |
| 354 | * Delete every object no ref reaches, so a secret force-pushed away can't be fetched by its SHA any |
| 355 | * more (git keeps them until a gc, and so did Diffinery, forever). Also kept: the commits of open |
| 356 | * pull requests, of the merge queue and of unfinished workflow runs. Runs with every other request |
| 357 | * held, so nothing writes a ref meanwhile. |
| 358 | */ |
| 359 | async purgeUnreachable(caller: Caller): Promise<{ objects: number; bytes: number }> { |
| 360 | if (caller.kind !== "user" || caller.permissions || !atLeast(caller.role, "admin")) throw new HttpError(403, "only repository admins can purge unreachable objects"); |
| 361 | const total = this.store.count(); |
| 362 | if (total > MAX_PURGE_OBJECTS) throw new HttpError(422, `this repository has ${total} objects; purging works for up to ${MAX_PURGE_OBJECTS}. Ask a site administrator`); |
| 363 | return this.ctx.blockConcurrencyWhile(async () => { |
| 364 | const roots = [ |
| 365 | ...this.sql.exec<{ oid: string }>("SELECT oid FROM refs").toArray().map((r) => r.oid), |
| 366 | ...this.sql.exec<{ oid: string }>("SELECT head_sha AS oid FROM pulls UNION SELECT head_sha FROM merge_queue UNION SELECT group_sha FROM merge_queue WHERE group_sha IS NOT NULL UNION SELECT parent_sha FROM merge_queue WHERE parent_sha IS NOT NULL").toArray().map((r) => r.oid), |
| 367 | ...this.sql.exec<{ oid: string }>("SELECT sha AS oid FROM runs WHERE status != 'completed' UNION SELECT head_sha FROM runs WHERE status != 'completed' AND head_sha IS NOT NULL").toArray().map((r) => r.oid), |
| 368 | ]; |
| 369 | const keep = new Set<string>(); |
| 370 | const stack = [...roots]; |
| 371 | while (stack.length) { |
| 372 | const oid = stack.pop()!; |
| 373 | if (keep.has(oid)) continue; |
| 374 | const row = this.sql.exec<{ type: number }>("SELECT type FROM objects WHERE oid = ?", oid).toArray()[0]; |
| 375 | if (!row) continue; |
| 376 | keep.add(oid); |
| 377 | const type = CODE_TYPES[row.type]; |
| 378 | if (type === "blob") continue; |
| 379 | const obj = await this.store.read(oid); |
| 380 | if (!obj) continue; |
| 381 | if (type === "commit") { |
| 382 | const c = parseCommit(obj.content); |
| 383 | stack.push(c.tree, ...c.parents); |
| 384 | } else if (type === "tree") { |
| 385 | // A gitlink (160000) names a commit in another repository. |
| 386 | for (const e of parseTree(obj.content)) if (e.mode !== "160000") stack.push(e.oid); |
| 387 | } else if (type === "tag") { |
| 388 | const target = /^object ([0-9a-f]{40})/.exec(fromUtf8(obj.content))?.[1]; |
| 389 | if (target) stack.push(target); |
| 390 | } |
| 391 | } |
| 392 | const doomed = this.sql.exec<{ oid: string; r2: number; size: number }>("SELECT oid, r2, size FROM objects").toArray().filter((r) => !keep.has(r.oid)); |
| 393 | for (let i = 0; i < doomed.length; i += 100) { |
| 394 | const chunk = doomed.slice(i, i + 100).map((r) => r.oid); |
| 395 | this.sql.exec(`DELETE FROM objects WHERE oid IN (${chunk.map(() => "?").join(",")})`, ...chunk); |
| 396 | } |
| 397 | this.store.forget(); |
| 398 | this.store.recount(); |
| 399 | this.storageChanged(); |
| 400 | this.purgeEpoch++; |
| 401 | const r2 = doomed.filter((r) => r.r2).map((r) => this.store.r2KeyOf(r.oid)); |
| 402 | for (let i = 0; i < r2.length; i += 1000) await this.env.BUCKET.delete(r2.slice(i, i + 1000)); |
| 403 | // Cached zipballs and tarballs are rebuilt from what's left on the next download. |
| 404 | await deletePrefixes(this.env.BUCKET, [archivePrefix(this.meta.repoId)], 50); |
| 405 | return { objects: doomed.length, bytes: doomed.reduce((n, r) => n + r.size, 0) }; |
| 406 | }); |
| 407 | } |
| 408 | |
| 409 | // ---------------------------------------------------------------- storage (the owner's storage quota, lib/quotas.ts) |
| 410 | |
| 411 | /** The report to D1 waiting to run, and the last one started: reports run one at a time. */ |
| 412 | private storageNext: Promise<void> | null = null; |
| 413 | private storageLast: Promise<void> = Promise.resolve(); |
| 414 | |
| 415 | /** Bytes the repository stores for its owner: git objects, Git LFS objects and release assets. */ |
| 416 | async storageBytes(): Promise<number> { |
| 417 | await this.listLfs(); |
| 418 | const q = (s: string) => this.sql.exec<{ n: number }>(s).one().n; |
| 419 | return this.store.sizeBytes() + q("SELECT coalesce(sum(size), 0) AS n FROM lfs_objects") + q("SELECT coalesce(sum(size), 0) AS n FROM release_assets"); |
| 420 | } |
| 421 | |
| 422 | /** |
| 423 | * Tell D1 what the repository stores now (repo_storage), where the owner's quota adds it up. Calls |
| 424 | * made while a report waits to run share it; one made while a report is under way gets the next. |
| 425 | */ |
| 426 | reportStorage(): Promise<void> { |
| 427 | this.storageNext ??= this.storageLast.then(async () => { |
| 428 | this.storageNext = null; |
| 429 | const bytes = await this.storageBytes(); |
| 430 | await this.env.DB.prepare("INSERT INTO repo_storage (repo_id, bytes, updated_at) VALUES (?, ?, ?) ON CONFLICT(repo_id) DO UPDATE SET bytes = excluded.bytes, updated_at = excluded.updated_at") |
| 431 | .bind(this.meta.repoId, bytes, now()) |
| 432 | .run(); |
| 433 | }); |
| 434 | const next = this.storageNext; |
| 435 | this.storageLast = next.catch(() => {}); |
| 436 | return next; |
| 437 | } |
| 438 | |
| 439 | /** What the repository stores changed: report it in the background. */ |
| 440 | storageChanged(): void { |
| 441 | this.background(this.reportStorage()); |
| 442 | } |
| 443 | |
| 444 | /** Why storing `adding` more bytes here must be refused (past the owner's storage quota), or null. */ |
| 445 | async storageRefusal(adding = 0): Promise<string | null> { |
| 446 | const m = this.meta; |
| 447 | return storageRefusal(this.env, m.ownerId, m.owner, adding, { repoId: m.repoId, bytes: await this.storageBytes() }); |
| 448 | } |
| 449 | |
| 450 | /** Refuse storing `adding` more bytes past the owner's storage quota. */ |
| 451 | async checkStorage(adding = 0): Promise<void> { |
| 452 | const refused = await this.storageRefusal(adding); |
| 453 | if (refused) throw new HttpError(403, refused); |
| 454 | } |
| 455 | |
| 456 | /** A Git LFS object was stored in R2 (http/git.ts). */ |
| 457 | recordLfs(oid: string, size: number): void { |
| 458 | if (this.sql.exec("INSERT OR IGNORE INTO lfs_objects (oid, size) VALUES (?, ?) RETURNING oid", oid, size).toArray().length) this.storageChanged(); |
| 459 | } |
| 460 | |
| 461 | /** Git LFS objects stored before lfs_objects existed: listed from R2, once. */ |
| 462 | private async listLfs(): Promise<void> { |
| 463 | if (this.sql.exec("SELECT 1 FROM counters WHERE name = 'lfs_listed'").toArray().length) return; |
| 464 | let cursor: string | undefined; |
| 465 | do { |
| 466 | const page = await this.env.BUCKET.list({ prefix: `repos/${this.meta.repoId}/lfs/`, cursor, limit: 1000 }); |
| 467 | for (const o of page.objects) this.sql.exec("INSERT OR IGNORE INTO lfs_objects (oid, size) VALUES (?, ?)", o.key.slice(o.key.lastIndexOf("/") + 1), o.size); |
| 468 | cursor = page.truncated ? page.cursor : undefined; |
| 469 | } while (cursor); |
| 470 | this.sql.exec("INSERT OR IGNORE INTO counters (name, value) VALUES ('lfs_listed', 1)"); |
| 471 | } |
| 472 | |
| 473 | // ---------------------------------------------------------------- refs |
| 474 | |
| 475 | refs(prefix = "refs/"): RefEntry[] { |
| 476 | return this.sql.exec<RefEntry>("SELECT name, oid FROM refs WHERE name >= ? AND name < ? ORDER BY name", prefix, `${prefix}`).toArray(); |
| 477 | } |
| 478 | |
| 479 | getRef(name: string): string | null { |
| 480 | return this.sql.exec<{ oid: string }>("SELECT oid FROM refs WHERE name = ?", name).toArray()[0]?.oid ?? null; |
| 481 | } |
| 482 | |
| 483 | /** Compare-and-swap a ref. `expected` = ZERO_OID means "must not exist". */ |
| 484 | casRef(name: string, expected: string | null, next: string | null): boolean { |
| 485 | const current = this.getRef(name); |
| 486 | if (expected !== null && (current ?? ZERO_OID) !== expected) return false; |
| 487 | if (next === null || next === ZERO_OID) this.sql.exec("DELETE FROM refs WHERE name = ?", name); |
| 488 | else this.sql.exec("INSERT OR REPLACE INTO refs (name, oid) VALUES (?, ?)", name, next); |
| 489 | return true; |
| 490 | } |
| 491 | |
| 492 | get headRef(): string { |
| 493 | return `refs/heads/${this.meta.defaultBranch}`; |
| 494 | } |
| 495 | |
| 496 | /** Resolve a branch, tag, full ref, HEAD or (abbreviated) SHA to a commit SHA. */ |
| 497 | async resolve(rev: string | undefined | null): Promise<string | null> { |
| 498 | const r = rev && rev.length ? rev : "HEAD"; |
| 499 | let oid: string | null = null; |
| 500 | if (r === "HEAD") oid = this.getRef(this.headRef); |
| 501 | else if (isOid(r)) oid = this.store.has(r) ? r : null; |
| 502 | else if (r.startsWith("refs/")) oid = this.getRef(r); |
| 503 | else oid = this.getRef(`refs/heads/${r}`) ?? this.getRef(`refs/tags/${r}`); |
| 504 | if (!oid && /^[0-9a-f]{7,39}$/.test(r)) { |
| 505 | const rows = this.sql.exec<{ oid: string }>("SELECT oid FROM objects WHERE oid >= ? AND oid < ? LIMIT 2", r, `${r}g`).toArray(); |
| 506 | if (rows.length === 1) oid = rows[0]!.oid; |
| 507 | } |
| 508 | if (!oid) return null; |
| 509 | return peelToCommit(this.store, oid); |
| 510 | } |
| 511 | |
| 512 | async branches(): Promise<Array<{ name: string; sha: string; protected: boolean; isDefault: boolean }>> { |
| 513 | return this.refs("refs/heads/").map((r) => { |
| 514 | const name = r.name.slice(11); |
| 515 | return { name, sha: r.oid, protected: !!this.protectionFor(name), isDefault: name === this.meta.defaultBranch }; |
| 516 | }); |
| 517 | } |
| 518 | |
| 519 | async tags(): Promise<Array<{ name: string; sha: string; target: string }>> { |
| 520 | const out = []; |
| 521 | for (const r of this.refs("refs/tags/")) out.push({ name: r.name.slice(10), sha: r.oid, target: await peelToCommit(this.store, r.oid).catch(() => r.oid) }); |
| 522 | return out; |
| 523 | } |
| 524 | |
| 525 | // ---------------------------------------------------------------- git smart HTTP |
| 526 | |
| 527 | async gitInfoRefs(service: "git-upload-pack" | "git-receive-pack"): Promise<Uint8Array> { |
| 528 | if (service === "git-upload-pack") return advertiseUploadPackV2(); |
| 529 | // Like GitHub, pull request refs are hidden from pushes (so `git push --mirror` leaves them alone). |
| 530 | return advertiseReceivePack(this.refs().filter((r) => !r.name.startsWith("refs/pull/"))); |
| 531 | } |
| 532 | |
| 533 | /** The response streams: the pack is read and sent one object at a time, as the client takes it. */ |
| 534 | async gitUploadPack(body: Uint8Array): Promise<ReadableStream<Uint8Array>> { |
| 535 | const { readable, writable } = new IdentityTransformStream(); |
| 536 | const writer = writable.getWriter(); |
| 537 | let started = false; |
| 538 | const sink = (b: Uint8Array) => ((started = true), writer.write(b)); |
| 539 | const ctx = { store: this.store, refs: this.refs(), headTarget: this.headRef }; |
| 540 | void handleUploadPackV2(body, ctx, sink) |
| 541 | .catch((e) => (started ? undefined : writer.write(errorPacket((e as Error).message)))) |
| 542 | .then( |
| 543 | () => writer.close(), |
| 544 | () => writer.abort(), |
| 545 | ) |
| 546 | .catch(() => {}); // the client went away |
| 547 | return readable; |
| 548 | } |
| 549 | |
| 550 | /** A push the Worker staged in R2, read into one buffer of its exact size (and then deleted). */ |
| 551 | private async readSpilledPush(b: SpilledBody): Promise<Uint8Array> { |
| 552 | try { |
| 553 | const obj = await this.env.BUCKET.get(b.spilled); |
| 554 | if (!obj) throw new Error("the push's data is missing; push again"); |
| 555 | const out = new Uint8Array(obj.size); |
| 556 | let at = 0; |
| 557 | const reader = obj.body.getReader(); |
| 558 | for (;;) { |
| 559 | const { done, value } = await reader.read(); |
| 560 | if (done) break; |
| 561 | if (at + value.length > out.length) throw new Error("the push's data is longer than announced; push again"); |
| 562 | out.set(value, at); |
| 563 | at += value.length; |
| 564 | } |
| 565 | if (at !== out.length) throw new Error("the push's data is shorter than announced; push again"); |
| 566 | return out; |
| 567 | } finally { |
| 568 | await this.env.BUCKET.delete(b.spilled).catch(() => {}); |
| 569 | } |
| 570 | } |
| 571 | |
| 572 | /** `moved`: the push came in under an old name (a transfer or rename), so say where the repository lives now, like GitHub. */ |
| 573 | async gitReceivePack(input: Uint8Array | SpilledBody, caller: Caller, o: { moved?: boolean } = {}): Promise<Uint8Array> { |
| 574 | const size = input instanceof Uint8Array ? input.length : input.size; |
| 575 | if (size > MAX_PUSH_BYTES) { |
| 576 | if (!(input instanceof Uint8Array)) await this.env.BUCKET.delete(input.spilled).catch(() => {}); |
| 577 | const req = { commands: [], capabilities: new Set<string>(), pushOptions: [], pack: null }; |
| 578 | return reportStatus(req, "push exceeds 100 MB; split it into smaller pushes", []); |
| 579 | } |
| 580 | const body = input instanceof Uint8Array ? input : await this.readSpilledPush(input); |
| 581 | const req = parseReceivePack(body); |
| 582 | // A purge of unreachable objects that ran while this push was in flight may have deleted objects |
| 583 | // the push counted on the repository having: refuse rather than point a ref at them. |
| 584 | const epoch = this.purgeEpoch; |
| 585 | // `git push -o diffinery-import` from a GitHub import's own token: no workflows, webhooks, |
| 586 | // pull request syncs or notifications (see apps/diffinery/src/imports). |
| 587 | const importMode = !!caller.importId && req.pushOptions.some((o) => o.trim() === "diffinery-import"); |
| 588 | // H2: while an import holds the repository, only that import may push. Everything else waits |
| 589 | // until the import finalises, so protection, guardrails, CI and webhooks are never bypassed. |
| 590 | const lockHolder = this.importLockHolder(); |
| 591 | if (lockHolder && (!importMode || caller.importId !== lockHolder)) { |
| 592 | const denied = req.commands.map((c) => ({ ref: c.ref, ok: false as const, reason: "repository is locked by an import in progress" })); |
| 593 | return reportStatus(req, "repository is locked by an import in progress", denied); |
| 594 | } |
| 595 | const messages: string[] = o.moved ? ["This repository moved. Please use the new location:", ` ${this.env.PUBLIC_URL}/${this.meta.owner}/${this.meta.name}.git`] : []; |
| 596 | let unpackError: string | null = null; |
| 597 | // Like git's quarantine: nothing from the pack is stored until push protection passes, |
| 598 | // so a blocked push leaves no objects behind for a retry to build on. |
| 599 | let objects: Awaited<ReturnType<typeof parsePack>> = []; |
| 600 | if (req.pack && req.pack.length > 0) { |
| 601 | try { |
| 602 | objects = await parsePack(req.pack, (oid) => this.store.read(oid), { largeObjectBytes: LARGE_OBJECT_BYTES }); |
| 603 | } catch (e) { |
| 604 | unpackError = unpackFailure(e); |
| 605 | } |
| 606 | } |
| 607 | // Commit and tag messages are scanned too, not only files. |
| 608 | // The objects themselves, not copies: a large blob is scanned from its compressed bytes. |
| 609 | const newBlobs = objects.filter((o) => o.type === "blob" || o.type === "commit" || o.type === "tag"); |
| 610 | const results: RefResult[] = []; |
| 611 | if (unpackError) { |
| 612 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "unpacker error" }); |
| 613 | return reportStatus(req, unpackError, results); |
| 614 | } |
| 615 | // Like GitHub's receive.fsckObjects: no tree a git client would refuse, or that writes outside the work tree. |
| 616 | const bad = fsckObjects(objects); |
| 617 | if (bad) { |
| 618 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "fsck failed" }); |
| 619 | return reportStatus(req, `fsck error: ${bad}`, results, [`Push refused: ${bad}`]); |
| 620 | } |
| 621 | |
| 622 | const marked: SecretHit[] = []; |
| 623 | const leaks = scanForSecrets(newBlobs, marked); |
| 624 | // A file can opt out with `diffinery:allow-secret`; that it did is on the record. |
| 625 | if (marked.length) this.emit({ type: "audit", action: "push.secret_marked", actor: caller, target: `${this.meta.owner}/${this.meta.name}`, detail: { kinds: [...new Set(marked.map((l) => l.kind))], blobs: marked.slice(0, 50).map((l) => l.oid), refs: req.commands.map((c) => c.ref) }, at: now() }); |
| 626 | if (leaks.length) { |
| 627 | const kinds = leaks.map((l) => l.kind); |
| 628 | const target = `${this.meta.owner}/${this.meta.name}`; |
| 629 | // Like GitHub's push protection bypass: a human repository admin may push anyway by |
| 630 | // giving a reason (`git push -o allow-secrets=<reason>`), and every bypass is audited. |
| 631 | const reason = secretBypassReason(req.pushOptions); |
| 632 | if (reason && caller.role === "admin" && caller.kind === "user") { |
| 633 | messages.push(`Push protection bypassed by ${caller.login}: ${reason}`); |
| 634 | for (const l of leaks.slice(0, 10)) messages.push(` ${l.kind} in blob ${l.oid.slice(0, 10)}`); |
| 635 | this.emit({ type: "audit", action: "push.secret_bypassed", actor: caller, target, detail: { kinds, reason, refs: req.commands.map((c) => c.ref), ...(importMode ? { import: caller.importId, blobs: leaks.slice(0, 50).map((l) => l.oid) } : {}) }, at: now() }); |
| 636 | if (importMode) this.importsModule.recordFindings(leaks); |
| 637 | } else { |
| 638 | messages.push("Push blocked: possible secrets detected."); |
| 639 | for (const l of leaks.slice(0, 10)) messages.push(` ${l.kind} in blob ${l.oid.slice(0, 10)}`); |
| 640 | messages.push("Remove the secret from your commits, or rotate it and contact an admin."); |
| 641 | if (reason) messages.push("Only repository admins (people, not agents) can bypass push protection."); |
| 642 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "secret detected (push protection)" }); |
| 643 | this.emit({ type: "audit", action: "push.blocked_secret", actor: caller, target, detail: { kinds, refs: req.commands.map((c) => c.ref) }, at: now() }); |
| 644 | return reportStatus(req, null, results, messages); |
| 645 | } |
| 646 | } |
| 647 | |
| 648 | // Past the owner's storage quota nothing new is stored; a push that only deletes or moves refs still works. |
| 649 | const full = objects.some((o) => !this.store.has(o.oid)) ? await this.storageRefusal(req.pack?.length ?? 0) : null; |
| 650 | if (full) { |
| 651 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "storage limit reached" }); |
| 652 | return reportStatus(req, null, results, [...messages, `Push refused: ${full}`]); |
| 653 | } |
| 654 | |
| 655 | try { |
| 656 | for (const o of objects) { |
| 657 | if (o.deflated) await this.store.writeDeflated(o.oid, o.type, o.size!, o.deflated); |
| 658 | else await this.store.writeKnown(o.oid, o.type, o.content); |
| 659 | } |
| 660 | } catch (e) { |
| 661 | for (const c of req.commands) results.push({ ref: c.ref, ok: false, reason: "unpacker error" }); |
| 662 | return reportStatus(req, unpackFailure(e), results); |
| 663 | } |
| 664 | |
| 665 | // Validate every command before applying any, so `atomic` is honoured. |
| 666 | const checks: Array<RefResult & { cmd: (typeof req.commands)[number] }> = []; |
| 667 | for (const cmd of req.commands) checks.push({ cmd, ...(await this.checkRefUpdate(cmd.ref, cmd.oldOid, cmd.newOid, caller, importMode)) }); |
| 668 | const atomic = req.capabilities.has("atomic"); |
| 669 | const anyFailed = checks.some((c) => !c.ok); |
| 670 | let imported = 0; |
| 671 | for (const c of checks) { |
| 672 | if (!c.ok) { |
| 673 | results.push({ ref: c.ref, ok: false, reason: c.reason }); |
| 674 | continue; |
| 675 | } |
| 676 | if (atomic && anyFailed) { |
| 677 | results.push({ ref: c.ref, ok: false, reason: "atomic transaction failed" }); |
| 678 | continue; |
| 679 | } |
| 680 | if (epoch !== this.purgeEpoch) { |
| 681 | results.push({ ref: c.ref, ok: false, reason: "the repository's unreachable objects were purged during this push; push again" }); |
| 682 | continue; |
| 683 | } |
| 684 | const applied = this.casRef(c.cmd.ref, c.cmd.oldOid, c.cmd.newOid); |
| 685 | results.push(applied ? { ref: c.ref, ok: true } : { ref: c.ref, ok: false, reason: "fetch first (stale info)" }); |
| 686 | if (applied && importMode) { |
| 687 | imported++; |
| 688 | // Record provenance so a later push may move this ref only if the import still owns it. |
| 689 | if (c.cmd.newOid === ZERO_OID) this.sql.exec("DELETE FROM import_refs WHERE ref = ?", c.cmd.ref); |
| 690 | else this.importsModule.recordImportRef(c.cmd.ref, c.cmd.newOid, caller.importId!); |
| 691 | } else if (applied) await this.afterRefUpdate(c.cmd.ref, c.cmd.oldOid, c.cmd.newOid, caller, messages); |
| 692 | } |
| 693 | // One audit entry per import push instead of push events. |
| 694 | if (imported) this.emit({ type: "audit", action: "import.push", actor: caller, target: `${this.meta.owner}/${this.meta.name}`, detail: { import: caller.importId, refs: imported }, at: now() }); |
| 695 | return reportStatus(req, null, results, messages); |
| 696 | } |
| 697 | |
| 698 | /** As on GitHub: a rule naming the branch exactly wins; otherwise the oldest matching pattern. */ |
| 699 | protectionFor(branch: string): ProtectionRules | null { |
| 700 | const rows = this.sql.exec<{ pattern: string; rules: string }>("SELECT pattern, rules FROM protections ORDER BY rowid").toArray(); |
| 701 | const row = rows.find((r) => r.pattern === branch) ?? rows.find((r) => globToRegExp(r.pattern).test(branch)); |
| 702 | return row ? (JSON.parse(row.rules) as ProtectionRules) : null; |
| 703 | } |
| 704 | |
| 705 | /** |
| 706 | * Server-side rules for a ref update: permissions, protection, fast-forward, agent guardrails. |
| 707 | * `importMode`: a GitHub import filling the repository it created, which is the only writer |
| 708 | * until it finishes, so branch rules (copied from GitHub at its end) don't apply to it. |
| 709 | */ |
| 710 | async checkRefUpdate(ref: string, oldOid: string, newOid: string, caller: Caller, importMode = false): Promise<RefResult> { |
| 711 | if (!isValidRefName(ref)) return { ref, ok: false, reason: "invalid ref name" }; |
| 712 | if (!atLeast(caller.role, "write")) return { ref, ok: false, reason: "permission denied" }; |
| 713 | const deleting = newOid === ZERO_OID; |
| 714 | if (ref.startsWith("refs/pull/")) return { ref, ok: false, reason: "refs/pull/ is managed by Diffinery for pull requests" }; |
| 715 | if (ref.startsWith(`refs/heads/${QUEUE_BRANCH_PREFIX}`)) return { ref, ok: false, reason: "merge queue branches are read-only" }; |
| 716 | if (!deleting && !this.store.has(newOid)) return { ref, ok: false, reason: "missing objects" }; |
| 717 | if (ref.startsWith(IMPORT_REF_PREFIX) && !importMode) return { ref, ok: false, reason: `${IMPORT_REF_PREFIX} is reserved for GitHub imports` }; |
| 718 | if (importMode) { |
| 719 | if (!/^refs\/(heads|tags|diffinery-import)\//.test(ref)) return { ref, ok: false, reason: "imports write branches and tags only" }; |
| 720 | // H2: create a ref, or move one this import previously wrote — never a ref adopted since. |
| 721 | const current = this.getRef(ref); |
| 722 | if (current && !deleting) { |
| 723 | const owned = this.importsModule.importRefOid(ref, caller.importId!); |
| 724 | if (owned !== current) return { ref, ok: false, reason: "import may not overwrite a ref it did not write" }; |
| 725 | } |
| 726 | return { ref, ok: true }; |
| 727 | } |
| 728 | // A workflow's GITHUB_TOKEN never adds or changes workflow files (GitHub's `workflows` permission). |
| 729 | const workflowEdit = await this.policy.refuseWorkflowEdit(caller, oldOid, newOid); |
| 730 | if (workflowEdit) return { ref, ok: false, reason: workflowEdit }; |
| 731 | if (!ref.startsWith("refs/heads/")) { |
| 732 | if (ref.startsWith("refs/tags/") && oldOid !== ZERO_OID && !atLeast(caller.role, "maintain")) return { ref, ok: false, reason: "only maintainers may move tags" }; |
| 733 | return { ref, ok: true }; |
| 734 | } |
| 735 | const branch = ref.slice(11); |
| 736 | const rules = this.protectionFor(branch); |
| 737 | const isDefault = branch === this.meta.defaultBranch; |
| 738 | if (caller.kind === "agent" && (isDefault || rules) && !rules?.agentsMayPush) { |
| 739 | return { ref, ok: false, reason: "agents may not push to protected or default branches; open a pull request" }; |
| 740 | } |
| 741 | if (deleting && isDefault) return { ref, ok: false, reason: "cannot delete the default branch" }; |
| 742 | if (!rules) return { ref, ok: true }; |
| 743 | const bypass = caller.role === "admin" && !rules.enforceAdmins; |
| 744 | if (bypass) return { ref, ok: true }; |
| 745 | if (deleting) return rules.allowDeletion ? { ref, ok: true } : { ref, ok: false, reason: "protected branch: deletion not allowed" }; |
| 746 | if (rules.requirePullRequest) return { ref, ok: false, reason: "protected branch: changes must be made through a pull request" }; |
| 747 | // As on GitHub, required checks gate direct pushes too: the commit must already have passed them. |
| 748 | for (const name of rules.requiredChecks ?? []) { |
| 749 | const c = requiredCheck(name, [...this.collab.checks(newOid), ...this.statuses.asChecks(newOid)], rules.requiredCheckSources?.[name]); |
| 750 | if (c.state !== "success") { |
| 751 | const why = c.state === "missing" ? "has not run" : c.state === "pending" ? "has not finished" : `ended with ${c.conclusion}`; |
| 752 | return { ref, ok: false, reason: `protected branch: required check '${name}' ${why} on ${newOid.slice(0, 7)}; push to another branch and open a pull request` }; |
| 753 | } |
| 754 | } |
| 755 | if (oldOid !== ZERO_OID && !rules.allowForcePush && !(await isAncestor(this.store, oldOid, newOid))) { |
| 756 | return { ref, ok: false, reason: "protected branch: force push not allowed" }; |
| 757 | } |
| 758 | if (rules.requireLinearHistory) { |
| 759 | const fresh = await walkCommits(this.store, [newOid], { stop: new Set(oldOid === ZERO_OID ? [] : [oldOid]), limit: 1000 }); |
| 760 | if (fresh.some((c) => c.commit.parents.length > 1)) return { ref, ok: false, reason: "protected branch: merge commits not allowed (linear history)" }; |
| 761 | } |
| 762 | return { ref, ok: true }; |
| 763 | } |
| 764 | |
| 765 | /** Side effects after a ref moved: events, PR sync, workflow triggers. */ |
| 766 | async afterRefUpdate(ref: string, oldOid: string, newOid: string, caller: Caller, messages: string[] = []): Promise<void> { |
| 767 | const at = now(); |
| 768 | const forced = oldOid !== ZERO_OID && newOid !== ZERO_OID && !(await isAncestor(this.store, oldOid, newOid)); |
| 769 | const ev: DiffineryEvent = { |
| 770 | type: "push", |
| 771 | repoId: this.meta.repoId, |
| 772 | owner: this.meta.owner, |
| 773 | repo: this.meta.name, |
| 774 | ref, |
| 775 | before: oldOid, |
| 776 | after: newOid, |
| 777 | actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, |
| 778 | forced, |
| 779 | created: oldOid === ZERO_OID, |
| 780 | deleted: newOid === ZERO_OID, |
| 781 | at, |
| 782 | }; |
| 783 | this.emit(ev); |
| 784 | this.policy.recordPush(ref, newOid, caller); |
| 785 | this.deploys.noteRefUpdate(ref, newOid, caller); |
| 786 | if (ref.startsWith("refs/heads/") && newOid !== ZERO_OID) { |
| 787 | const branch = ref.slice(11); |
| 788 | const synced = await this.collab.syncPullsForBranch(branch, newOid, caller); |
| 789 | for (const n of synced) messages.push(`Updated pull request #${n}: ${this.env.PUBLIC_URL}/${this.meta.owner}/${this.meta.name}/pull/${n}`); |
| 790 | if (oldOid === ZERO_OID && branch !== this.meta.defaultBranch && synced.length === 0) { |
| 791 | messages.push(`Create a pull request for '${branch}':`); |
| 792 | messages.push(` ${this.env.PUBLIC_URL}/${this.meta.owner}/${this.meta.name}/compare/${encodeURIComponent(branch)}`); |
| 793 | } |
| 794 | } |
| 795 | if (newOid !== ZERO_OID) await this.actions.onPush(ev, caller).catch((e) => messages.push(`Workflow trigger error: ${(e as Error).message}`)); |
| 796 | // A base branch that moved (outside the queue, or by it) needs its merge groups checked, |
| 797 | // and pull requests into it waiting to auto-merge may now be up to date. |
| 798 | if (ref.startsWith("refs/heads/") && this.queue.hasEntries(ref.slice(11))) this.queue.schedule(ref.slice(11)); |
| 799 | if (ref.startsWith("refs/heads/") && newOid !== ZERO_OID) this.autoMerge.schedule({ base: ref.slice(11) }); |
| 800 | } |
| 801 | |
| 802 | // ---------------------------------------------------------------- browsing |
| 803 | |
| 804 | async commitInfo(sha: string): Promise<CommitInfo> { |
| 805 | const c = await readCommit(this.store, sha); |
| 806 | return toInfo(sha, c); |
| 807 | } |
| 808 | |
| 809 | async tree(rev: string, path = ""): Promise<{ sha: string; items: TreeItem[] } | null> { |
| 810 | const sha = await this.resolve(rev); |
| 811 | if (!sha) return null; |
| 812 | const c = await readCommit(this.store, sha); |
| 813 | const entry = await resolvePath(this.store, c.tree, path); |
| 814 | if (!entry || !isTreeMode(entry.mode)) return null; |
| 815 | const items: TreeItem[] = []; |
| 816 | for (const e of await readTree(this.store, entry.oid)) { |
| 817 | const type = isTreeMode(e.mode) ? "tree" : e.mode === "160000" ? "commit" : "blob"; |
| 818 | const raw = type === "blob" ? this.sql.exec<{ size: number }>("SELECT size FROM objects WHERE oid = ?", e.oid).toArray()[0] : undefined; |
| 819 | items.push({ name: e.name, path: path ? `${path}/${e.name}` : e.name, type, mode: e.mode, oid: e.oid, size: raw?.size }); |
| 820 | } |
| 821 | items.sort((a, b) => (a.type === b.type ? a.name.localeCompare(b.name) : a.type === "tree" ? -1 : 1)); |
| 822 | return { sha, items }; |
| 823 | } |
| 824 | |
| 825 | async blob(rev: string, path: string): Promise<{ sha: string; oid: string; mode: string; size: number; binary: boolean; content: Uint8Array } | null> { |
| 826 | const sha = await this.resolve(rev); |
| 827 | if (!sha) return null; |
| 828 | const c = await readCommit(this.store, sha); |
| 829 | const entry = await resolvePath(this.store, c.tree, path); |
| 830 | if (!entry || isTreeMode(entry.mode)) return null; |
| 831 | const o = await this.store.read(entry.oid); |
| 832 | if (!o) return null; |
| 833 | return { sha, oid: entry.oid, mode: entry.mode, size: o.content.length, binary: isBinary(o.content), content: o.content }; |
| 834 | } |
| 835 | |
| 836 | async log(rev: string, opts: { path?: string; limit?: number; skip?: number } = {}): Promise<CommitInfo[]> { |
| 837 | const sha = await this.resolve(rev); |
| 838 | if (!sha) return []; |
| 839 | const limit = Math.min(opts.limit ?? 30, 100); |
| 840 | const skip = opts.skip ?? 0; |
| 841 | if (!opts.path) { |
| 842 | const commits = await walkCommits(this.store, [sha], { limit: limit + skip }); |
| 843 | return commits.slice(skip).map((c) => toInfo(c.oid, c.commit)); |
| 844 | } |
| 845 | // Path history: commits whose tree entry at `path` differs from their first parent's. |
| 846 | const out: CommitInfo[] = []; |
| 847 | let skipped = 0; |
| 848 | for (const c of await walkCommits(this.store, [sha], { limit: 2000 })) { |
| 849 | const mine = await resolvePath(this.store, c.commit.tree, opts.path); |
| 850 | const parent = c.commit.parents[0] ? await readCommit(this.store, c.commit.parents[0]).catch(() => null) : null; |
| 851 | const theirs = parent ? await resolvePath(this.store, parent.tree, opts.path) : null; |
| 852 | if ((mine?.oid ?? null) === (theirs?.oid ?? null)) continue; |
| 853 | if (skipped++ < skip) continue; |
| 854 | out.push(toInfo(c.oid, c.commit)); |
| 855 | if (out.length >= limit) break; |
| 856 | } |
| 857 | return out; |
| 858 | } |
| 859 | |
| 860 | /** Diff between two commits (or a commit and its first parent). */ |
| 861 | async diff(baseSha: string | null, headSha: string, opts: { patch?: boolean; maxFiles?: number } = {}) { |
| 862 | const head = await readCommit(this.store, headSha); |
| 863 | const baseTree = baseSha ? (await readCommit(this.store, baseSha)).tree : null; |
| 864 | const changes = await diffTrees(this.store, baseTree, head.tree); |
| 865 | const max = opts.maxFiles ?? 300; |
| 866 | const files = []; |
| 867 | const budget = new DiffBudget(); |
| 868 | for (const ch of changes.slice(0, max)) { |
| 869 | const d = await fileDiff(this.store, ch, 3, budget); |
| 870 | files.push({ ...d, patch: opts.patch === false ? undefined : formatUnified(d) }); |
| 871 | } |
| 872 | return { |
| 873 | files, |
| 874 | totalFiles: changes.length, |
| 875 | additions: files.reduce((s, f) => s + f.additions, 0), |
| 876 | deletions: files.reduce((s, f) => s + f.deletions, 0), |
| 877 | truncated: changes.length > max, |
| 878 | }; |
| 879 | } |
| 880 | |
| 881 | async commitWithDiff(rev: string) { |
| 882 | const sha = await this.resolve(rev); |
| 883 | if (!sha) throw new HttpError(404, "commit not found"); |
| 884 | const info = await this.commitInfo(sha); |
| 885 | return { ...info, ...(await this.diff(info.parents[0] ?? null, sha)) }; |
| 886 | } |
| 887 | |
| 888 | async compare(base: string, head: string) { |
| 889 | const b = await this.resolve(base); |
| 890 | const h = await this.resolve(head); |
| 891 | if (!b || !h) throw new HttpError(404, "unknown base or head"); |
| 892 | const mb = await mergeBase(this.store, b, h); |
| 893 | const commits = (await walkCommits(this.store, [h], { stop: new Set(mb ? (await walkCommits(this.store, [mb], { limit: 100000 })).map((c) => c.oid) : []), limit: 250 })).map((c) => toInfo(c.oid, c.commit)); |
| 894 | const ahead = commits.length; |
| 895 | const behind = mb ? (await walkCommits(this.store, [b], { stop: new Set([mb]), limit: 1000 })).filter((c) => c.oid !== mb).length : 0; |
| 896 | return { baseSha: b, headSha: h, mergeBase: mb, aheadBy: ahead, behindBy: behind, commits: commits.reverse(), ...(await this.diff(mb, h)) }; |
| 897 | } |
| 898 | |
| 899 | /** |
| 900 | * Push protection for commits made without a Git client: the same scan as `git push`, so the |
| 901 | * web editor, the contents and commits APIs and MCP cannot be used to slip a credential in. |
| 902 | */ |
| 903 | private protectCommit(changes: readonly FileChange[], allowSecrets: string | undefined, caller: Caller, message = ""): void { |
| 904 | const blobs = changes.filter((ch) => !ch.delete && ch.content).map((ch) => ({ oid: ch.path, content: ch.content! })); |
| 905 | if (message) blobs.push({ oid: "(commit message)", content: utf8(message) }); |
| 906 | const marked: SecretHit[] = []; |
| 907 | const leaks = scanForSecrets(blobs, marked); |
| 908 | const target = `${this.meta.owner}/${this.meta.name}`; |
| 909 | if (marked.length) this.emit({ type: "audit", action: "api.secret_marked", actor: caller, target, detail: { kinds: [...new Set(marked.map((l) => l.kind))], paths: [...new Set(marked.map((l) => l.oid))].slice(0, 10) }, at: now() }); |
| 910 | if (!leaks.length) return; |
| 911 | const kinds = [...new Set(leaks.map((l) => l.kind))]; |
| 912 | const paths = [...new Set(leaks.map((l) => l.oid))].slice(0, 10); |
| 913 | const reason = allowSecrets?.trim().slice(0, 200); |
| 914 | if (reason && caller.role === "admin" && caller.kind === "user") { |
| 915 | this.emit({ type: "audit", action: "api.secret_bypassed", actor: caller, target, detail: { kinds, paths, reason }, at: now() }); |
| 916 | return; |
| 917 | } |
| 918 | this.emit({ type: "audit", action: "api.blocked_secret", actor: caller, target, detail: { kinds, paths }, at: now() }); |
| 919 | const hint = reason ? " Only repository admins (people, not agents) can bypass push protection." : ""; |
| 920 | throw new HttpError(422, `push protection: possible secret detected (${kinds.join(", ")}) in ${paths.join(", ")}. Remove it, or rotate it and ask an admin.${hint}`); |
| 921 | } |
| 922 | |
| 923 | /** |
| 924 | * Create a commit from file changes without a Git client (used by the web |
| 925 | * editor, the REST contents API and AI agents through MCP). |
| 926 | */ |
| 927 | async commitFiles(input: { |
| 928 | branch: string; |
| 929 | message: string; |
| 930 | changes: FileChange[]; |
| 931 | expectedHeadSha?: string; |
| 932 | createBranchFrom?: string; |
| 933 | author?: { name: string; email: string }; |
| 934 | committer?: { name: string; email: string }; |
| 935 | /** A human admin's reason for committing a detected secret anyway (like `git push -o allow-secrets=`). */ |
| 936 | allowSecrets?: string; |
| 937 | }, caller: Caller): Promise<{ sha: string; branch: string }> { |
| 938 | const ref = `refs/heads/${input.branch}`; |
| 939 | let parent = this.getRef(ref); |
| 940 | if (!parent) { |
| 941 | if (input.createBranchFrom) parent = await this.resolve(input.createBranchFrom); |
| 942 | else if (this.refs("refs/heads/").length > 0) throw new HttpError(404, `branch ${input.branch} not found`); |
| 943 | } |
| 944 | if (input.expectedHeadSha && parent !== input.expectedHeadSha) throw new HttpError(409, "branch moved; refresh and retry", { currentSha: parent }); |
| 945 | for (const ch of input.changes) { |
| 946 | const why = ch.delete ? null : unsafeTreePath(ch.path); |
| 947 | if (why) throw new HttpError(422, `invalid path ${JSON.stringify(ch.path)}: ${why}`); |
| 948 | } |
| 949 | const adding = input.changes.reduce((n, ch) => n + (ch.content?.length ?? 0), 0); |
| 950 | if (adding) await this.checkStorage(adding); |
| 951 | this.protectCommit(input.changes, input.allowSecrets, caller, input.message); |
| 952 | const baseTree = parent ? (await readCommit(this.store, parent)).tree : null; |
| 953 | const tree = await applyChanges(this.store, baseTree, input.changes); |
| 954 | const ts = Math.floor(Date.now() / 1000); |
| 955 | const committer = input.committer |
| 956 | ? { ...input.committer, timestamp: ts, timezone: "+0000" } |
| 957 | : { name: caller.login, email: `${caller.login}@users.noreply.diffinery.com`, timestamp: ts, timezone: "+0000" }; |
| 958 | const author = input.author ? { ...input.author, timestamp: ts, timezone: "+0000" } : committer; |
| 959 | const extra: [string, string][] = caller.kind === "agent" ? [["diffinery-agent", `${caller.login}${caller.onBehalfOf ? ` on-behalf-of ${caller.onBehalfOf}` : ""}`]] : []; |
| 960 | const sha = await this.store.write( |
| 961 | "commit", |
| 962 | serializeCommit({ tree: tree === EMPTY_TREE_OID ? tree : tree, parents: parent ? [parent] : [], author, committer, message: input.message.endsWith("\n") ? input.message : `${input.message}\n`, extraHeaders: extra }), |
| 963 | ); |
| 964 | const old = parent && this.getRef(ref) ? parent : ZERO_OID; |
| 965 | const check = await this.checkRefUpdate(ref, old, sha, caller); |
| 966 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 967 | if (!this.casRef(ref, old, sha)) throw new HttpError(409, "branch moved; refresh and retry"); |
| 968 | await this.afterRefUpdate(ref, old, sha, caller); |
| 969 | return { sha, branch: input.branch }; |
| 970 | } |
| 971 | |
| 972 | async createRef(ref: string, sha: string, caller: Caller): Promise<void> { |
| 973 | if (!this.store.has(sha)) throw new HttpError(422, "object does not exist"); |
| 974 | const check = await this.checkRefUpdate(ref, ZERO_OID, sha, caller); |
| 975 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 976 | if (!this.casRef(ref, ZERO_OID, sha)) throw new HttpError(422, "reference already exists"); |
| 977 | await this.afterRefUpdate(ref, ZERO_OID, sha, caller); |
| 978 | } |
| 979 | |
| 980 | async updateRef(ref: string, sha: string, force: boolean, caller: Caller): Promise<void> { |
| 981 | const old = this.getRef(ref); |
| 982 | if (!old) throw new HttpError(404, "reference not found"); |
| 983 | if (!force && !(await isAncestor(this.store, old, sha))) throw new HttpError(422, "update is not a fast-forward"); |
| 984 | const check = await this.checkRefUpdate(ref, old, sha, caller); |
| 985 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 986 | if (!this.casRef(ref, old, sha)) throw new HttpError(409, "reference moved"); |
| 987 | await this.afterRefUpdate(ref, old, sha, caller); |
| 988 | } |
| 989 | |
| 990 | async deleteRef(ref: string, caller: Caller): Promise<void> { |
| 991 | const old = this.getRef(ref); |
| 992 | if (!old) throw new HttpError(404, "reference not found"); |
| 993 | const check = await this.checkRefUpdate(ref, old, ZERO_OID, caller); |
| 994 | if (!check.ok) throw new HttpError(403, check.reason ?? "rejected"); |
| 995 | this.casRef(ref, old, null); |
| 996 | await this.afterRefUpdate(ref, old, ZERO_OID, caller); |
| 997 | } |
| 998 | |
| 999 | // ---------------------------------------------------------------- protections |
| 1000 | |
| 1001 | listProtections(): Array<{ pattern: string; rules: ProtectionRules }> { |
| 1002 | return this.sql.exec<{ pattern: string; rules: string }>("SELECT pattern, rules FROM protections ORDER BY pattern").toArray().map((r) => ({ pattern: r.pattern, rules: JSON.parse(r.rules) })); |
| 1003 | } |
| 1004 | |
| 1005 | /** |
| 1006 | * Create, replace or (with null) delete a rule. Only people who administer the repository change |
| 1007 | * branch protection: never agents, never a workflow's token. Turning `allowAgentAutoMerge` or |
| 1008 | * `agentAutoMergeWithoutApproval` on or off is audited on its own, since they let agents land changes. |
| 1009 | */ |
| 1010 | setProtection(pattern: string, rules: ProtectionRules | null, caller: Caller): void { |
| 1011 | if (!isPerson(caller) || caller.role !== "admin") throw new HttpError(403, caller.kind === "agent" ? "agents cannot change branch protection" : "only people who administer the repository can change branch protection"); |
| 1012 | if (rules?.mergeQueue) { |
| 1013 | const asked = typeof rules.mergeQueue === "object" ? rules.mergeQueue.method : undefined; |
| 1014 | const mergeQueue = normalizeMergeQueue(rules.mergeQueue); |
| 1015 | // A queue that makes merge commits could never merge into a branch that refuses them. |
| 1016 | if (rules.requireLinearHistory && mergeQueue.method === "merge") { |
| 1017 | if (asked !== undefined) throw new HttpError(422, "this branch requires linear history, so its merge queue must squash or rebase (mergeQueue.method), not create merge commits"); |
| 1018 | mergeQueue.method = "squash"; |
| 1019 | } |
| 1020 | rules = { ...rules, mergeQueue }; |
| 1021 | } |
| 1022 | if (rules?.requiredCheckSources) rules = { ...rules, requiredCheckSources: normalizeCheckSources(rules.requiredCheckSources) }; |
| 1023 | // A required "Agent review" means Diffinery's own check (agentic/review.ts), not one anyone with write access could post. |
| 1024 | if (rules?.requiredChecks?.includes(REVIEW_CHECK) && !rules.requiredCheckSources?.[REVIEW_CHECK]) rules = { ...rules, requiredCheckSources: { ...rules.requiredCheckSources, [REVIEW_CHECK]: REVIEW_APP } }; |
| 1025 | if (rules && rules.allowAgentAutoMerge !== undefined && typeof rules.allowAgentAutoMerge !== "boolean") throw new HttpError(422, "allowAgentAutoMerge must be a boolean"); |
| 1026 | if (rules && rules.agentAutoMergeWithoutApproval !== undefined && typeof rules.agentAutoMergeWithoutApproval !== "boolean") throw new HttpError(422, "agentAutoMergeWithoutApproval must be a boolean"); |
| 1027 | if (rules?.agentAutoMergeWithoutApproval && !rules.allowAgentAutoMerge) throw new HttpError(422, "agentAutoMergeWithoutApproval needs allowAgentAutoMerge: it only applies to what Diffinery lands for agents"); |
| 1028 | if (rules && !rules.allowAgentAutoMerge) { |
| 1029 | const { allowAgentAutoMerge: _, agentAutoMergeWithoutApproval: _w, ...rest } = rules; |
| 1030 | rules = rest; |
| 1031 | } |
| 1032 | if (rules && !rules.agentAutoMergeWithoutApproval) { |
| 1033 | const { agentAutoMergeWithoutApproval: _, ...rest } = rules; |
| 1034 | rules = rest; |
| 1035 | } |
| 1036 | const before = this.sql.exec<{ rules: string }>("SELECT rules FROM protections WHERE pattern = ?", pattern).toArray()[0]; |
| 1037 | const old = before ? (JSON.parse(before.rules) as ProtectionRules) : null; |
| 1038 | const was = !!old?.allowAgentAutoMerge; |
| 1039 | const waived = !!old?.agentAutoMergeWithoutApproval; |
| 1040 | if (rules) this.sql.exec("INSERT INTO protections (pattern, rules) VALUES (?, ?) ON CONFLICT(pattern) DO UPDATE SET rules = excluded.rules", pattern, JSON.stringify(rules)); |
| 1041 | else this.sql.exec("DELETE FROM protections WHERE pattern = ?", pattern); |
| 1042 | if (was !== !!rules?.allowAgentAutoMerge) { |
| 1043 | const m = this.meta; |
| 1044 | this.emit({ type: "audit", action: "repo.protection.agent_auto_merge", actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, target: `${m.owner}/${m.name}`, detail: { pattern, enabled: !!rules?.allowAgentAutoMerge, requiredChecks: rules?.requiredChecks ?? [] }, at: now() }); |
| 1045 | } |
| 1046 | if (waived !== !!rules?.agentAutoMergeWithoutApproval) { |
| 1047 | const m = this.meta; |
| 1048 | this.emit({ type: "audit", action: "repo.protection.agent_approval_waiver", actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, target: `${m.owner}/${m.name}`, detail: { pattern, enabled: !!rules?.agentAutoMergeWithoutApproval, requiredChecks: rules?.requiredChecks ?? [] }, at: now() }); |
| 1049 | } |
| 1050 | // Turning a queue off (or changing its checks) affects what is queued, and what may auto-merge. |
| 1051 | this.queue.schedule(); |
| 1052 | this.autoMerge.schedule(); |
| 1053 | } |
| 1054 | |
| 1055 | // ---------------------------------------------------------------- RPC passthroughs (collab + actions) |
| 1056 | // Workers RPC only exposes methods on the class itself, so the sub-modules are wrapped here. |
| 1057 | |
| 1058 | issues(...a: Parameters<Collab["list"]>) { |
| 1059 | return this.collab.list(...a); |
| 1060 | } |
| 1061 | issue(...a: Parameters<Collab["get"]>) { |
| 1062 | return this.collab.get(...a); |
| 1063 | } |
| 1064 | createIssue(...a: Parameters<Collab["createIssue"]>) { |
| 1065 | return this.collab.createIssue(...a); |
| 1066 | } |
| 1067 | updateIssue(...a: Parameters<Collab["update"]>) { |
| 1068 | return this.collab.update(...a); |
| 1069 | } |
| 1070 | setPullDraft(...a: Parameters<Collab["setDraft"]>) { |
| 1071 | return this.collab.setDraft(...a); |
| 1072 | } |
| 1073 | addComment(...a: Parameters<Collab["addComment"]>) { |
| 1074 | return this.collab.addComment(...a); |
| 1075 | } |
| 1076 | editComment(...a: Parameters<Collab["editComment"]>) { |
| 1077 | return this.collab.editComment(...a); |
| 1078 | } |
| 1079 | createPull(...a: Parameters<Collab["createPull"]>) { |
| 1080 | return this.collab.createPull(...a); |
| 1081 | } |
| 1082 | pullFiles(...a: Parameters<Collab["pullFiles"]>) { |
| 1083 | return this.collab.pullFiles(...a); |
| 1084 | } |
| 1085 | pullCommits(...a: Parameters<Collab["pullCommits"]>) { |
| 1086 | return this.collab.pullCommits(...a); |
| 1087 | } |
| 1088 | submitReview(...a: Parameters<Collab["submitReview"]>) { |
| 1089 | return this.collab.submitReview(...a); |
| 1090 | } |
| 1091 | resolveThread(...a: Parameters<Collab["resolveThread"]>) { |
| 1092 | return this.collab.resolveThread(...a); |
| 1093 | } |
| 1094 | mergeability(...a: Parameters<Collab["mergeability"]>) { |
| 1095 | return this.collab.mergeability(...a); |
| 1096 | } |
| 1097 | mergePull(...a: Parameters<Collab["merge"]>) { |
| 1098 | return this.collab.merge(...a); |
| 1099 | } |
| 1100 | requestReviewers(...a: Parameters<Collab["requestReviewers"]>) { |
| 1101 | return this.collab.requestReviewers(...a); |
| 1102 | } |
| 1103 | labels(...a: Parameters<Collab["labels"]>) { |
| 1104 | return this.collab.labels(...a); |
| 1105 | } |
| 1106 | setLabel(...a: Parameters<Collab["setLabel"]>) { |
| 1107 | return this.collab.setLabel(...a); |
| 1108 | } |
| 1109 | checks(...a: Parameters<Collab["checks"]>) { |
| 1110 | return this.collab.checks(...a); |
| 1111 | } |
| 1112 | upsertCheck(...a: Parameters<Collab["upsertCheck"]>) { |
| 1113 | return this.collab.upsertCheck(...a); |
| 1114 | } |
| 1115 | webhooks(...a: Parameters<Collab["webhooks"]>) { |
| 1116 | return this.collab.webhooks(...a); |
| 1117 | } |
| 1118 | createWebhook(url: string, events: string[], secret?: string) { |
| 1119 | return this.collab.createWebhook(url, events, secret, new URL(this.env.PUBLIC_URL).hostname); |
| 1120 | } |
| 1121 | deleteWebhook(...a: Parameters<Collab["deleteWebhook"]>) { |
| 1122 | return this.collab.deleteWebhook(...a); |
| 1123 | } |
| 1124 | recordDelivery(...a: Parameters<Collab["recordDelivery"]>) { |
| 1125 | return this.collab.recordDelivery(...a); |
| 1126 | } |
| 1127 | |
| 1128 | enqueuePull(...a: Parameters<MergeQueue["enqueue"]>) { |
| 1129 | return this.queue.enqueue(...a); |
| 1130 | } |
| 1131 | dequeuePull(...a: Parameters<MergeQueue["dequeue"]>) { |
| 1132 | return this.queue.dequeue(...a); |
| 1133 | } |
| 1134 | mergeQueue(...a: Parameters<MergeQueue["list"]>) { |
| 1135 | return this.queue.list(...a); |
| 1136 | } |
| 1137 | mergeQueueSettings(...a: Parameters<MergeQueue["settings"]>) { |
| 1138 | return this.queue.settings(...a); |
| 1139 | } |
| 1140 | enableAutoMerge(...a: Parameters<AutoMerge["enable"]>) { |
| 1141 | return this.autoMerge.enable(...a); |
| 1142 | } |
| 1143 | disableAutoMerge(...a: Parameters<AutoMerge["disable"]>) { |
| 1144 | return this.autoMerge.disable(...a); |
| 1145 | } |
| 1146 | |
| 1147 | runs(...a: Parameters<Actions["listRuns"]>) { |
| 1148 | return this.actions.listRuns(...a); |
| 1149 | } |
| 1150 | run(...a: Parameters<Actions["getRun"]>) { |
| 1151 | return this.actions.getRun(...a); |
| 1152 | } |
| 1153 | runJobs(...a: Parameters<Actions["jobs"]>) { |
| 1154 | return this.actions.jobs(...a); |
| 1155 | } |
| 1156 | claimJobAsRunner(...a: Parameters<Actions["claimJobAsRunner"]>) { |
| 1157 | return this.actions.claimJobAsRunner(...a); |
| 1158 | } |
| 1159 | runnerRegistrationToken(...a: Parameters<Actions["runnerRegistrationToken"]>) { |
| 1160 | return this.actions.runnerRegistrationToken(...a); |
| 1161 | } |
| 1162 | registerRunner(...a: Parameters<Actions["registerRunner"]>) { |
| 1163 | return this.actions.registerRunner(...a); |
| 1164 | } |
| 1165 | runners(...a: Parameters<Actions["runners"]>) { |
| 1166 | return this.actions.runners(...a); |
| 1167 | } |
| 1168 | deleteRunner(...a: Parameters<Actions["deleteRunner"]>) { |
| 1169 | return this.actions.deleteRunner(...a); |
| 1170 | } |
| 1171 | jobStatus(jobId: string): string { |
| 1172 | return this.actions.getJob(jobId).status; |
| 1173 | } |
| 1174 | job(...a: Parameters<Actions["getJob"]>) { |
| 1175 | return this.actions.getJob(...a); |
| 1176 | } |
| 1177 | jobLogs(...a: Parameters<Actions["logs"]>) { |
| 1178 | return this.actions.logs(...a); |
| 1179 | } |
| 1180 | cancelRun(...a: Parameters<Actions["cancel"]>) { |
| 1181 | return this.actions.cancel(...a); |
| 1182 | } |
| 1183 | rerun(...a: Parameters<Actions["rerun"]>) { |
| 1184 | return this.actions.rerun(...a); |
| 1185 | } |
| 1186 | dispatchWorkflow(...a: Parameters<Actions["dispatch"]>) { |
| 1187 | return this.actions.dispatch(...a); |
| 1188 | } |
| 1189 | scheduleTick(...a: Parameters<Actions["schedule"]>) { |
| 1190 | return this.actions.schedule(...a); |
| 1191 | } |
| 1192 | onPullRequestEvent(...a: Parameters<Actions["onPullRequest"]>) { |
| 1193 | return this.actions.onPullRequest(...a); |
| 1194 | } |
| 1195 | workflows(...a: Parameters<Actions["listWorkflows"]>) { |
| 1196 | return this.actions.listWorkflows(...a); |
| 1197 | } |
| 1198 | runPlan(...a: Parameters<Actions["plan"]>) { |
| 1199 | return this.actions.plan(...a); |
| 1200 | } |
| 1201 | startJobKey(...a: Parameters<Actions["startJobKey"]>) { |
| 1202 | return this.actions.startJobKey(...a); |
| 1203 | } |
| 1204 | jobGate(...a: Parameters<Actions["jobGate"]>) { |
| 1205 | return this.actions.jobGate(...a); |
| 1206 | } |
| 1207 | pendingDeployments(...a: Parameters<Actions["pendingDeployments"]>) { |
| 1208 | return this.actions.pendingDeployments(...a); |
| 1209 | } |
| 1210 | reviewDeployments(...a: Parameters<Actions["reviewDeployments"]>) { |
| 1211 | return this.actions.reviewDeployments(...a); |
| 1212 | } |
| 1213 | deploymentReviews(...a: Parameters<Actions["deploymentReviews"]>) { |
| 1214 | return this.actions.deploymentReviews(...a); |
| 1215 | } |
| 1216 | jobTimedOut(...a: Parameters<Actions["jobTimedOut"]>) { |
| 1217 | return this.actions.jobTimedOut(...a); |
| 1218 | } |
| 1219 | finishRun(...a: Parameters<Actions["finishRun"]>) { |
| 1220 | return this.actions.finishRun(...a); |
| 1221 | } |
| 1222 | oidcClaims(...a: Parameters<Actions["oidcClaims"]>) { |
| 1223 | return this.actions.oidcClaims(...a); |
| 1224 | } |
| 1225 | runnerSpec(...a: Parameters<Actions["runnerSpec"]>) { |
| 1226 | return this.actions.runnerSpec(...a); |
| 1227 | } |
| 1228 | runnerLogs(...a: Parameters<Actions["runnerLogs"]>) { |
| 1229 | return this.actions.runnerLogs(...a); |
| 1230 | } |
| 1231 | runnerStep(...a: Parameters<Actions["runnerStep"]>) { |
| 1232 | return this.actions.runnerStep(...a); |
| 1233 | } |
| 1234 | runnerComplete(...a: Parameters<Actions["runnerComplete"]>) { |
| 1235 | return this.actions.runnerComplete(...a); |
| 1236 | } |
| 1237 | packagesPermission(...a: Parameters<Actions["packagesPermission"]>) { |
| 1238 | return this.actions.packagesPermission(...a); |
| 1239 | } |
| 1240 | runnerAuth(...a: Parameters<Actions["runnerAuth"]>) { |
| 1241 | return this.actions.runnerAuth(...a); |
| 1242 | } |
| 1243 | containerStopped(...a: Parameters<Actions["containerStopped"]>) { |
| 1244 | return this.actions.containerStopped(...a); |
| 1245 | } |
| 1246 | relaunchJob(...a: Parameters<Actions["relaunchJob"]>) { |
| 1247 | return this.actions.relaunchJob(...a); |
| 1248 | } |
| 1249 | setSecret(...a: Parameters<Actions["setSecret"]>) { |
| 1250 | return this.actions.setSecret(...a); |
| 1251 | } |
| 1252 | deleteSecret(...a: Parameters<Actions["deleteSecret"]>) { |
| 1253 | return this.actions.deleteSecret(...a); |
| 1254 | } |
| 1255 | secretNames(...a: Parameters<Actions["secretNames"]>) { |
| 1256 | return this.actions.secretNames(...a); |
| 1257 | } |
| 1258 | setVariable(...a: Parameters<Actions["setVariable"]>) { |
| 1259 | return this.actions.setVariable(...a); |
| 1260 | } |
| 1261 | variables(...a: Parameters<Actions["variables"]>) { |
| 1262 | return this.actions.variables(...a); |
| 1263 | } |
| 1264 | cacheLookup(...a: Parameters<Actions["cacheLookup"]>) { |
| 1265 | return this.actions.cacheLookup(...a); |
| 1266 | } |
| 1267 | cacheSaved(...a: Parameters<Actions["cacheSaved"]>) { |
| 1268 | return this.actions.cacheSaved(...a); |
| 1269 | } |
| 1270 | artifactUploadKeys(...a: Parameters<Actions["artifactUploadKeys"]>) { |
| 1271 | return this.actions.artifactUploadKeys(...a); |
| 1272 | } |
| 1273 | artifactSaved(...a: Parameters<Actions["artifactSaved"]>) { |
| 1274 | return this.actions.artifactSaved(...a); |
| 1275 | } |
| 1276 | artifacts(...a: Parameters<Actions["artifacts"]>) { |
| 1277 | return this.actions.artifacts(...a); |
| 1278 | } |
| 1279 | createSandbox(...a: Parameters<Actions["createSandbox"]>) { |
| 1280 | return this.actions.createSandbox(...a); |
| 1281 | } |
| 1282 | sandbox(...a: Parameters<Actions["getSandbox"]>) { |
| 1283 | return this.actions.getSandbox(...a); |
| 1284 | } |
| 1285 | closeSandbox(...a: Parameters<Actions["closeSandbox"]>) { |
| 1286 | return this.actions.closeSandbox(...a); |
| 1287 | } |
| 1288 | closeTaskSandbox(...a: Parameters<Actions["closeTaskSandbox"]>) { |
| 1289 | return this.actions.closeTaskSandbox(...a); |
| 1290 | } |
| 1291 | /** A kill switch was turned on (lib/killswitch.ts): stop what runs here now. */ |
| 1292 | stopActions(...a: Parameters<Actions["stopActions"]>) { |
| 1293 | return this.actions.stopActions(...a); |
| 1294 | } |
| 1295 | |
| 1296 | plannedRunError(runId: string, message: string) { |
| 1297 | return this.actions.plannedError(runId, message); |
| 1298 | } |
| 1299 | cacheSaveKeys(...a: Parameters<Actions["cacheSaveKeys"]>) { |
| 1300 | return this.actions.cacheSaveKeys(...a); |
| 1301 | } |
| 1302 | cacheReadKeys(...a: Parameters<Actions["cacheReadKeys"]>) { |
| 1303 | return this.actions.cacheReadKeys(...a); |
| 1304 | } |
| 1305 | artifactKeysFor(...a: Parameters<Actions["artifactKeysFor"]>) { |
| 1306 | return this.actions.artifactKeysFor(...a); |
| 1307 | } |
| 1308 | artifactQuota() { |
| 1309 | return this.runtime.artifactQuota; |
| 1310 | } |
| 1311 | |
| 1312 | // ---------------------------------------------------------------- RPC passthroughs (Actions runtime services) |
| 1313 | // The cache and artifact services of repo/runtime.ts, called by http/actions-runtime.ts |
| 1314 | // with the job named by a runtime token, and by the REST caches/artifacts routes. |
| 1315 | |
| 1316 | rtJob(...a: Parameters<Runtime["job"]>) { |
| 1317 | return this.runtime.job(...a); |
| 1318 | } |
| 1319 | rtGrantFor(...a: Parameters<Runtime["grantFor"]>) { |
| 1320 | return this.runtime.grantFor(...a); |
| 1321 | } |
| 1322 | rtCacheLookup(...a: Parameters<Runtime["cacheLookup"]>) { |
| 1323 | return this.runtime.cacheLookup(...a); |
| 1324 | } |
| 1325 | rtCacheReserve(...a: Parameters<Runtime["cacheReserve"]>) { |
| 1326 | return this.runtime.cacheReserve(...a); |
| 1327 | } |
| 1328 | rtCacheReservation(...a: Parameters<Runtime["cacheReservation"]>) { |
| 1329 | return this.runtime.cacheReservation(...a); |
| 1330 | } |
| 1331 | rtCacheWritable(...a: Parameters<Runtime["cacheWritable"]>) { |
| 1332 | return this.runtime.cacheWritable(...a); |
| 1333 | } |
| 1334 | rtCacheCommit(...a: Parameters<Runtime["cacheCommit"]>) { |
| 1335 | return this.runtime.cacheCommit(...a); |
| 1336 | } |
| 1337 | rtCacheGet(...a: Parameters<Runtime["cacheGet"]>) { |
| 1338 | return this.runtime.cacheGet(...a); |
| 1339 | } |
| 1340 | rtListCaches(...a: Parameters<Runtime["listCaches"]>) { |
| 1341 | return this.runtime.listCaches(...a); |
| 1342 | } |
| 1343 | rtDeleteCaches(...a: Parameters<Runtime["deleteCaches"]>) { |
| 1344 | return this.runtime.deleteCaches(...a); |
| 1345 | } |
| 1346 | rtCacheUsage(...a: Parameters<Runtime["cacheUsage"]>) { |
| 1347 | return this.runtime.cacheUsage(...a); |
| 1348 | } |
| 1349 | rtArtifactCreate(...a: Parameters<Runtime["artifactCreate"]>) { |
| 1350 | return this.runtime.artifactCreate(...a); |
| 1351 | } |
| 1352 | rtArtifactUpload(...a: Parameters<Runtime["artifactUpload"]>) { |
| 1353 | return this.runtime.artifactUpload(...a); |
| 1354 | } |
| 1355 | rtArtifactWritable(...a: Parameters<Runtime["artifactWritable"]>) { |
| 1356 | return this.runtime.artifactWritable(...a); |
| 1357 | } |
| 1358 | rtArtifactFinalize(...a: Parameters<Runtime["artifactFinalize"]>) { |
| 1359 | return this.runtime.artifactFinalize(...a); |
| 1360 | } |
| 1361 | rtArtifactGet(...a: Parameters<Runtime["artifactGet"]>) { |
| 1362 | return this.runtime.artifactGet(...a); |
| 1363 | } |
| 1364 | rtJobArtifacts(...a: Parameters<Runtime["jobArtifacts"]>) { |
| 1365 | return this.runtime.jobArtifacts(...a); |
| 1366 | } |
| 1367 | rtRunArtifacts(...a: Parameters<Runtime["runArtifacts"]>) { |
| 1368 | return this.runtime.runArtifacts(...a); |
| 1369 | } |
| 1370 | rtRepoArtifacts(...a: Parameters<Runtime["repoArtifacts"]>) { |
| 1371 | return this.runtime.repoArtifacts(...a); |
| 1372 | } |
| 1373 | rtArtifactDelete(...a: Parameters<Runtime["artifactDelete"]>) { |
| 1374 | return this.runtime.artifactDelete(...a); |
| 1375 | } |
| 1376 | rtArtifactDeleteByName(...a: Parameters<Runtime["artifactDeleteByName"]>) { |
| 1377 | return this.runtime.artifactDeleteByName(...a); |
| 1378 | } |
| 1379 | workflowSettings() { |
| 1380 | return this.policy.settings(); |
| 1381 | } |
| 1382 | setWorkflowSettings(...a: Parameters<TokenPolicy["setSettings"]>) { |
| 1383 | return this.policy.setSettings(...a); |
| 1384 | } |
| 1385 | rtStage(...a: Parameters<Runtime["stage"]>) { |
| 1386 | return this.runtime.stage(...a); |
| 1387 | } |
| 1388 | rtUnstage(...a: Parameters<Runtime["unstage"]>) { |
| 1389 | return this.runtime.unstage(...a); |
| 1390 | } |
| 1391 | rtCheckCommitSize(...a: Parameters<Runtime["checkCommitSize"]>) { |
| 1392 | return this.runtime.checkCommitSize(...a); |
| 1393 | } |
| 1394 | rtCacheMissing(...a: Parameters<Runtime["cacheMissing"]>) { |
| 1395 | return this.runtime.cacheMissing(...a); |
| 1396 | } |
| 1397 | rtComposeStep(...a: Parameters<Runtime["composeStep"]>) { |
| 1398 | return this.runtime.composeStep(...a); |
| 1399 | } |
| 1400 | |
| 1401 | // ---------------------------------------------------------------- RPC passthroughs (GitHub-compatible extras) |
| 1402 | // Releases, commit statuses, deployments and environments, issue sub-resources |
| 1403 | // (labels, reactions, events, locking), the Git data API, search and misc. |
| 1404 | // The modules are created on first use. |
| 1405 | |
| 1406 | private extras: { releases?: Releases; statuses?: Statuses; deploys?: Deployments; social?: Social; gitdata?: GitData } = {}; |
| 1407 | get releases(): Releases { |
| 1408 | return (this.extras.releases ??= new Releases(this, this.env)); |
| 1409 | } |
| 1410 | get statuses(): Statuses { |
| 1411 | return (this.extras.statuses ??= new Statuses(this)); |
| 1412 | } |
| 1413 | get deploys(): Deployments { |
| 1414 | return (this.extras.deploys ??= new Deployments(this, this.env)); |
| 1415 | } |
| 1416 | get social(): Social { |
| 1417 | return (this.extras.social ??= new Social(this)); |
| 1418 | } |
| 1419 | get gitdata(): GitData { |
| 1420 | return (this.extras.gitdata ??= new GitData(this, this.env)); |
| 1421 | } |
| 1422 | |
| 1423 | listReleases(...a: Parameters<Releases["list"]>) { |
| 1424 | return this.releases.list(...a); |
| 1425 | } |
| 1426 | getRelease(...a: Parameters<Releases["get"]>) { |
| 1427 | return this.releases.get(...a); |
| 1428 | } |
| 1429 | releaseByTag(...a: Parameters<Releases["byTag"]>) { |
| 1430 | return this.releases.byTag(...a); |
| 1431 | } |
| 1432 | latestRelease() { |
| 1433 | return this.releases.latest(); |
| 1434 | } |
| 1435 | releaseSummary(...a: Parameters<Releases["summary"]>) { |
| 1436 | return this.releases.summary(...a); |
| 1437 | } |
| 1438 | createRelease(...a: Parameters<Releases["create"]>) { |
| 1439 | return this.releases.create(...a); |
| 1440 | } |
| 1441 | updateRelease(...a: Parameters<Releases["update"]>) { |
| 1442 | return this.releases.update(...a); |
| 1443 | } |
| 1444 | deleteRelease(...a: Parameters<Releases["remove"]>) { |
| 1445 | return this.releases.remove(...a); |
| 1446 | } |
| 1447 | generateReleaseNotes(...a: Parameters<Releases["generateNotes"]>) { |
| 1448 | return this.releases.generateNotes(...a); |
| 1449 | } |
| 1450 | releaseAssets(...a: Parameters<Releases["assets"]>) { |
| 1451 | return this.releases.assets(...a); |
| 1452 | } |
| 1453 | releaseAsset(...a: Parameters<Releases["asset"]>) { |
| 1454 | return this.releases.asset(...a); |
| 1455 | } |
| 1456 | updateReleaseAsset(...a: Parameters<Releases["updateAsset"]>) { |
| 1457 | return this.releases.updateAsset(...a); |
| 1458 | } |
| 1459 | deleteReleaseAsset(...a: Parameters<Releases["deleteAsset"]>) { |
| 1460 | return this.releases.deleteAsset(...a); |
| 1461 | } |
| 1462 | startReleaseAsset(...a: Parameters<Releases["startAsset"]>) { |
| 1463 | return this.releases.startAsset(...a); |
| 1464 | } |
| 1465 | finishReleaseAsset(...a: Parameters<Releases["finishAsset"]>) { |
| 1466 | return this.releases.finishAsset(...a); |
| 1467 | } |
| 1468 | abortReleaseAsset(...a: Parameters<Releases["abortAsset"]>) { |
| 1469 | return this.releases.abortAsset(...a); |
| 1470 | } |
| 1471 | releaseDownload(...a: Parameters<Releases["download"]>) { |
| 1472 | return this.releases.download(...a); |
| 1473 | } |
| 1474 | /** For the GitHub importer: a release with its original dates and author (no tag, events or workflows). */ |
| 1475 | importRelease(...a: Parameters<Releases["importRelease"]>) { |
| 1476 | return this.releases.importRelease(...a); |
| 1477 | } |
| 1478 | /** For the GitHub importer: an asset copied from a public https URL, or from an R2 key under this repository's prefix. */ |
| 1479 | importReleaseAsset(...a: Parameters<Releases["importAsset"]>) { |
| 1480 | return this.releases.importAsset(...a); |
| 1481 | } |
| 1482 | |
| 1483 | createStatus(...a: Parameters<Statuses["create"]>) { |
| 1484 | return this.statuses.create(...a); |
| 1485 | } |
| 1486 | commitStatuses(...a: Parameters<Statuses["list"]>) { |
| 1487 | return this.statuses.list(...a); |
| 1488 | } |
| 1489 | combinedStatus(...a: Parameters<Statuses["combined"]>) { |
| 1490 | return this.statuses.combined(...a); |
| 1491 | } |
| 1492 | /** Check runs and commit statuses together, as pull request and commit pages show them. */ |
| 1493 | checksAndStatuses(sha: string) { |
| 1494 | return [...this.collab.checks(sha), ...this.statuses.asChecks(sha)]; |
| 1495 | } |
| 1496 | |
| 1497 | /** This repository's part of the Today view (agentic/today.ts): open pull requests and what landed or failed since `since`. */ |
| 1498 | todaySummary(since: string) { |
| 1499 | return repoToday(this.sql, (sha) => this.checksAndStatuses(sha), since); |
| 1500 | } |
| 1501 | |
| 1502 | createDeployment(...a: Parameters<Deployments["create"]>) { |
| 1503 | return this.deploys.create(...a); |
| 1504 | } |
| 1505 | deployments(...a: Parameters<Deployments["list"]>) { |
| 1506 | return this.deploys.list(...a); |
| 1507 | } |
| 1508 | deployment(...a: Parameters<Deployments["get"]>) { |
| 1509 | return this.deploys.get(...a); |
| 1510 | } |
| 1511 | deleteDeployment(...a: Parameters<Deployments["remove"]>) { |
| 1512 | return this.deploys.remove(...a); |
| 1513 | } |
| 1514 | createDeploymentStatus(...a: Parameters<Deployments["createStatus"]>) { |
| 1515 | return this.deploys.createStatus(...a); |
| 1516 | } |
| 1517 | deploymentStatuses(...a: Parameters<Deployments["statuses"]>) { |
| 1518 | return this.deploys.statuses(...a); |
| 1519 | } |
| 1520 | deploymentStatus(...a: Parameters<Deployments["status"]>) { |
| 1521 | return this.deploys.status(...a); |
| 1522 | } |
| 1523 | environments() { |
| 1524 | return this.deploys.environments(); |
| 1525 | } |
| 1526 | environment(...a: Parameters<Deployments["environment"]>) { |
| 1527 | return this.deploys.environment(...a); |
| 1528 | } |
| 1529 | upsertEnvironment(...a: Parameters<Deployments["upsertEnvironment"]>) { |
| 1530 | return this.deploys.upsertEnvironment(...a); |
| 1531 | } |
| 1532 | deleteEnvironment(...a: Parameters<Deployments["deleteEnvironment"]>) { |
| 1533 | return this.deploys.deleteEnvironment(...a); |
| 1534 | } |
| 1535 | addEnvironmentBranchPattern(...a: Parameters<Deployments["addBranchPattern"]>) { |
| 1536 | return this.deploys.addBranchPattern(...a); |
| 1537 | } |
| 1538 | removeEnvironmentBranchPattern(...a: Parameters<Deployments["removeBranchPattern"]>) { |
| 1539 | return this.deploys.removeBranchPattern(...a); |
| 1540 | } |
| 1541 | setEnvironmentSecret(...a: Parameters<Deployments["setSecret"]>) { |
| 1542 | return this.deploys.setSecret(...a); |
| 1543 | } |
| 1544 | deleteEnvironmentSecret(...a: Parameters<Deployments["deleteSecret"]>) { |
| 1545 | return this.deploys.deleteSecret(...a); |
| 1546 | } |
| 1547 | environmentSecretNames(...a: Parameters<Deployments["secretNames"]>) { |
| 1548 | return this.deploys.secretNames(...a); |
| 1549 | } |
| 1550 | setEnvironmentVariable(...a: Parameters<Deployments["setVariable"]>) { |
| 1551 | return this.deploys.setVariable(...a); |
| 1552 | } |
| 1553 | environmentVariables(...a: Parameters<Deployments["variables"]>) { |
| 1554 | return this.deploys.variables(...a); |
| 1555 | } |
| 1556 | |
| 1557 | /** What the GitHub JSON builders need for a set of issues: label rows, reaction counts and lock reasons. */ |
| 1558 | issueExtras(numbers: number[], subjects: string[] = []) { |
| 1559 | const lockReasons: Record<number, string | null> = {}; |
| 1560 | for (const n of numbers) lockReasons[n] = this.social.lockReason(n); |
| 1561 | return { labels: this.social.labelRows(), reactions: this.social.reactionCounts([...numbers.map((n) => `issue:${n}`), ...subjects]), lockReasons }; |
| 1562 | } |
| 1563 | issueEvents(...a: Parameters<Social["events"]>) { |
| 1564 | return this.social.events(...a); |
| 1565 | } |
| 1566 | repoIssueEvents(...a: Parameters<Social["repoEvents"]>) { |
| 1567 | return this.social.repoEvents(...a); |
| 1568 | } |
| 1569 | issueEvent(...a: Parameters<Social["event"]>) { |
| 1570 | return this.social.event(...a); |
| 1571 | } |
| 1572 | issueTimeline(...a: Parameters<Social["timeline"]>) { |
| 1573 | return this.social.timeline(...a); |
| 1574 | } |
| 1575 | labelRows() { |
| 1576 | return this.social.labelRows(); |
| 1577 | } |
| 1578 | label(...a: Parameters<Social["label"]>) { |
| 1579 | return this.social.label(...a); |
| 1580 | } |
| 1581 | createLabel(...a: Parameters<Social["createLabel"]>) { |
| 1582 | return this.social.createLabel(...a); |
| 1583 | } |
| 1584 | updateLabel(...a: Parameters<Social["updateLabel"]>) { |
| 1585 | return this.social.updateLabel(...a); |
| 1586 | } |
| 1587 | deleteLabel(...a: Parameters<Social["deleteLabel"]>) { |
| 1588 | return this.social.deleteLabel(...a); |
| 1589 | } |
| 1590 | issueLabels(...a: Parameters<Social["issueLabels"]>) { |
| 1591 | return this.social.issueLabels(...a); |
| 1592 | } |
| 1593 | addIssueLabels(...a: Parameters<Social["addLabels"]>) { |
| 1594 | return this.social.addLabels(...a); |
| 1595 | } |
| 1596 | setIssueLabels(...a: Parameters<Social["setLabels"]>) { |
| 1597 | return this.social.setLabels(...a); |
| 1598 | } |
| 1599 | removeIssueLabel(...a: Parameters<Social["removeLabel"]>) { |
| 1600 | return this.social.removeLabel(...a); |
| 1601 | } |
| 1602 | assignIssue(...a: Parameters<Social["assign"]>) { |
| 1603 | return this.social.assign(...a); |
| 1604 | } |
| 1605 | lockIssue(...a: Parameters<Social["lock"]>) { |
| 1606 | return this.social.lock(...a); |
| 1607 | } |
| 1608 | unlockIssue(...a: Parameters<Social["unlock"]>) { |
| 1609 | return this.social.unlock(...a); |
| 1610 | } |
| 1611 | comment(...a: Parameters<Social["comment"]>) { |
| 1612 | return this.social.comment(...a); |
| 1613 | } |
| 1614 | deleteComment(...a: Parameters<Social["deleteComment"]>) { |
| 1615 | return this.social.deleteComment(...a); |
| 1616 | } |
| 1617 | repoComments(...a: Parameters<Social["repoComments"]>) { |
| 1618 | return this.social.repoComments(...a); |
| 1619 | } |
| 1620 | createReviewComment(...a: Parameters<Social["createReviewComment"]>) { |
| 1621 | return this.social.createReviewComment(...a); |
| 1622 | } |
| 1623 | review(...a: Parameters<Social["review"]>) { |
| 1624 | return this.social.review(...a); |
| 1625 | } |
| 1626 | dismissReview(...a: Parameters<Social["dismissReview"]>) { |
| 1627 | return this.social.dismissReview(...a); |
| 1628 | } |
| 1629 | removeReviewers(...a: Parameters<Social["removeReviewers"]>) { |
| 1630 | return this.social.removeReviewers(...a); |
| 1631 | } |
| 1632 | updatePullBranch(...a: Parameters<Social["updateBranch"]>) { |
| 1633 | return this.social.updateBranch(...a); |
| 1634 | } |
| 1635 | pullsForCommit(...a: Parameters<Social["pullsForCommit"]>) { |
| 1636 | return this.social.pullsForCommit(...a); |
| 1637 | } |
| 1638 | reactions(...a: Parameters<Social["reactions"]>) { |
| 1639 | return this.social.reactions(...a); |
| 1640 | } |
| 1641 | react(...a: Parameters<Social["react"]>) { |
| 1642 | return this.social.react(...a); |
| 1643 | } |
| 1644 | unreact(...a: Parameters<Social["unreact"]>) { |
| 1645 | return this.social.unreact(...a); |
| 1646 | } |
| 1647 | searchIssues(query: Parameters<typeof searchIssues>[1], limit: number) { |
| 1648 | return searchIssues(this, query, limit); |
| 1649 | } |
| 1650 | /** The issues for one page of search hits, in the order given (missing numbers are skipped). */ |
| 1651 | issuesByNumber(numbers: number[]) { |
| 1652 | return numbers.slice(0, 100).flatMap((n) => { |
| 1653 | try { |
| 1654 | return [this.collab.get(n).issue]; |
| 1655 | } catch { |
| 1656 | return []; |
| 1657 | } |
| 1658 | }); |
| 1659 | } |
| 1660 | |
| 1661 | objectType(...a: Parameters<GitData["objectType"]>) { |
| 1662 | return this.gitdata.objectType(...a); |
| 1663 | } |
| 1664 | refsWithTypes(...a: Parameters<GitData["refsWithTypes"]>) { |
| 1665 | return this.gitdata.refsWithTypes(...a); |
| 1666 | } |
| 1667 | createBlob(content: Uint8Array, caller: Caller) { |
| 1668 | return this.gitdata.createBlob(content, caller); |
| 1669 | } |
| 1670 | getBlob(...a: Parameters<GitData["getBlob"]>) { |
| 1671 | return this.gitdata.getBlob(...a); |
| 1672 | } |
| 1673 | createTree(...a: Parameters<GitData["createTree"]>) { |
| 1674 | return this.gitdata.createTree(...a); |
| 1675 | } |
| 1676 | getTree(...a: Parameters<GitData["getTree"]>) { |
| 1677 | return this.gitdata.getTree(...a); |
| 1678 | } |
| 1679 | createGitCommit(...a: Parameters<GitData["createCommit"]>) { |
| 1680 | return this.gitdata.createCommit(...a); |
| 1681 | } |
| 1682 | gitCommit(...a: Parameters<GitData["gitCommit"]>) { |
| 1683 | return this.gitdata.gitCommit(...a); |
| 1684 | } |
| 1685 | createGitTag(...a: Parameters<GitData["createTag"]>) { |
| 1686 | return this.gitdata.createTag(...a); |
| 1687 | } |
| 1688 | gitTag(...a: Parameters<GitData["getTag"]>) { |
| 1689 | return this.gitdata.getTag(...a); |
| 1690 | } |
| 1691 | putContents(...a: Parameters<GitData["putContents"]>) { |
| 1692 | return this.gitdata.putContents(...a); |
| 1693 | } |
| 1694 | deleteContents(...a: Parameters<GitData["deleteContents"]>) { |
| 1695 | return this.gitdata.deleteContents(...a); |
| 1696 | } |
| 1697 | readme(...a: Parameters<GitData["readme"]>) { |
| 1698 | return this.gitdata.readme(...a); |
| 1699 | } |
| 1700 | mergeBranches(...a: Parameters<GitData["merge"]>) { |
| 1701 | return this.gitdata.merge(...a); |
| 1702 | } |
| 1703 | languages() { |
| 1704 | return this.gitdata.languages(); |
| 1705 | } |
| 1706 | archiveKey(...a: Parameters<GitData["archiveKey"]>) { |
| 1707 | return this.gitdata.archiveKey(...a); |
| 1708 | } |
| 1709 | buildArchive(...a: Parameters<GitData["buildArchive"]>) { |
| 1710 | return this.gitdata.buildArchive(...a); |
| 1711 | } |
| 1712 | runLogsZip(...a: Parameters<GitData["runLogsZip"]>) { |
| 1713 | return this.gitdata.runLogsZip(...a); |
| 1714 | } |
| 1715 | runAttemptId(...a: Parameters<GitData["runAttemptId"]>) { |
| 1716 | return this.gitdata.runAttemptId(...a); |
| 1717 | } |
| 1718 | checkRun(...a: Parameters<GitData["check"]>) { |
| 1719 | return this.gitdata.check(...a); |
| 1720 | } |
| 1721 | updateCheckRun(...a: Parameters<GitData["updateCheck"]>) { |
| 1722 | return this.gitdata.updateCheck(...a); |
| 1723 | } |
| 1724 | checkSuites(...a: Parameters<GitData["checkSuites"]>) { |
| 1725 | return this.gitdata.checkSuites(...a); |
| 1726 | } |
| 1727 | checkSuite(...a: Parameters<GitData["checkSuite"]>) { |
| 1728 | return this.gitdata.checkSuite(...a); |
| 1729 | } |
| 1730 | |
| 1731 | /** repository_dispatch: an external event that starts workflows listening for its `event_type`. */ |
| 1732 | async repositoryDispatch(eventType: string, clientPayload: Record<string, unknown>, caller: Caller): Promise<void> { |
| 1733 | if (!atLeast(caller.role, "write")) throw new HttpError(403, "write access is required to dispatch events"); |
| 1734 | const sha = this.getRef(this.headRef); |
| 1735 | if (!sha) throw new HttpError(422, "the repository is empty"); |
| 1736 | // Suspended Actions refuse the dispatch with the reason (triggerWorkflows would swallow it). |
| 1737 | await this.actions.refuseIfBlocked("run"); |
| 1738 | const m = this.meta; |
| 1739 | const payload = { action: eventType, branch: m.defaultBranch, client_payload: clientPayload }; |
| 1740 | this.emit({ type: "repository_dispatch", action: eventType, repoId: m.repoId, owner: m.owner, repo: m.name, payload: JSON.parse(JSON.stringify(payload)), actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf }, at: now() }); |
| 1741 | await triggerWorkflows(this, { name: "repository_dispatch", action: eventType, ref: this.headRef, sha, payload, title: eventType }, caller); |
| 1742 | } |
| 1743 | |
| 1744 | // ---------------------------------------------------------------- RPC passthroughs: GitHub imports and milestones (repo/imports.ts) |
| 1745 | |
| 1746 | private importsCache?: RepoImports; |
| 1747 | private get importsModule(): RepoImports { |
| 1748 | return (this.importsCache ??= new RepoImports(this.sql)); |
| 1749 | } |
| 1750 | |
| 1751 | /** The import that currently holds this repository, or null. Other writes are refused meanwhile (loadRepo, gitReceivePack). */ |
| 1752 | importLockHolder(): string | null { |
| 1753 | return this.sql.exec<{ value: string }>("SELECT value FROM meta WHERE key = 'import_lock'").toArray()[0]?.value ?? null; |
| 1754 | } |
| 1755 | |
| 1756 | /** |
| 1757 | * Claim the repository for an import. Refuses if another import holds it, or if the repo |
| 1758 | * already holds any ref, issue, comment, milestone, protection or release this import did not write |
| 1759 | * (so a retry never adopts content people added in the meantime — H2). |
| 1760 | */ |
| 1761 | importBegin(importId: string): void { |
| 1762 | const holder = this.importLockHolder(); |
| 1763 | if (holder && holder !== importId) throw new HttpError(409, "another import is in progress for this repository"); |
| 1764 | // A ref not written by this import, or any foreign row, means the repo was adopted since. |
| 1765 | for (const r of this.refs()) { |
| 1766 | if (r.name.startsWith("refs/diffinery-import/")) continue; |
| 1767 | if (this.importsModule.importRefOid(r.name, importId) === null) { |
| 1768 | if (holder !== importId) throw new HttpError(409, "repository already holds content not written by this import; start a new import"); |
| 1769 | } |
| 1770 | } |
| 1771 | if (this.importsModule.hasForeignContent(importId)) throw new HttpError(409, "repository already holds content not written by this import; start a new import"); |
| 1772 | this.sql.exec("INSERT OR REPLACE INTO meta (key, value) VALUES ('import_lock', ?)", importId); |
| 1773 | } |
| 1774 | |
| 1775 | /** Release the import lock (on finalize, fail or cancel). */ |
| 1776 | importEnd(importId: string): void { |
| 1777 | if (this.importLockHolder() === importId) this.sql.exec("DELETE FROM meta WHERE key = 'import_lock'"); |
| 1778 | } |
| 1779 | |
| 1780 | importProtection(pattern: string, rules: ProtectionRules | null, importId: string) { |
| 1781 | // What agents may do is a person's decision here, never something an import brings in. |
| 1782 | if (rules) { |
| 1783 | const { allowAgentAutoMerge: _a, agentAutoMergeWithoutApproval: _w, agentsMayPush: _p, agentsMayMerge: _m, ...rest } = rules; |
| 1784 | rules = rest; |
| 1785 | } |
| 1786 | if (rules?.mergeQueue) rules = { ...rules, mergeQueue: normalizeMergeQueue(rules.mergeQueue) }; |
| 1787 | if (rules?.requiredCheckSources) rules = { ...rules, requiredCheckSources: normalizeCheckSources(rules.requiredCheckSources) }; |
| 1788 | if (rules) this.importsModule.protection(pattern, JSON.stringify(rules), importId); |
| 1789 | } |
| 1790 | importLabels(...a: Parameters<RepoImports["labels"]>) { |
| 1791 | return this.importsModule.labels(...a); |
| 1792 | } |
| 1793 | importMilestones(...a: Parameters<RepoImports["milestones"]>) { |
| 1794 | return this.importsModule.milestones(...a); |
| 1795 | } |
| 1796 | importIssues(...a: Parameters<RepoImports["issues"]>) { |
| 1797 | return this.importsModule.issues(...a); |
| 1798 | } |
| 1799 | importComments(...a: Parameters<RepoImports["comments"]>) { |
| 1800 | return this.importsModule.comments(...a); |
| 1801 | } |
| 1802 | importReviews(...a: Parameters<RepoImports["reviews"]>) { |
| 1803 | return this.importsModule.reviews(...a); |
| 1804 | } |
| 1805 | importSetMergedBy(...a: Parameters<RepoImports["setMergedBy"]>) { |
| 1806 | return this.importsModule.setMergedBy(...a); |
| 1807 | } |
| 1808 | importPullNumbers(...a: Parameters<RepoImports["pullNumbers"]>) { |
| 1809 | return this.importsModule.pullNumbers(...a); |
| 1810 | } |
| 1811 | importCounts() { |
| 1812 | return this.importsModule.counts(); |
| 1813 | } |
| 1814 | importFindings() { |
| 1815 | return this.importsModule.findings(); |
| 1816 | } |
| 1817 | /** |
| 1818 | * Point `refs/pull/N/head` at each imported pull request's head commit (the server owns |
| 1819 | * refs/pull/*; the agent pushed the commits to refs/diffinery-import/pull/N). Heads whose |
| 1820 | * commits never arrived (e.g. deleted forks) are reported, not fatal. |
| 1821 | */ |
| 1822 | importPullRefs(importId?: string): { created: number; missing: number[] } { |
| 1823 | const missing: number[] = []; |
| 1824 | let created = 0; |
| 1825 | for (const p of this.importsModule.pullHeads()) { |
| 1826 | const ref = `refs/pull/${p.number}/head`; |
| 1827 | if (!/^[0-9a-f]{40}$/.test(p.headSha) || !this.store.has(p.headSha)) { |
| 1828 | missing.push(p.number); |
| 1829 | continue; |
| 1830 | } |
| 1831 | const current = this.getRef(ref); |
| 1832 | // Record provenance so a retry does not mistake refs/pull/*/head for content people adopted. |
| 1833 | if (importId) this.importsModule.recordImportRef(ref, p.headSha, importId); |
| 1834 | if (current === p.headSha) continue; |
| 1835 | if (this.casRef(ref, current, p.headSha)) created++; |
| 1836 | } |
| 1837 | return { created, missing }; |
| 1838 | } |
| 1839 | /** Remove the import's own refs once refs/pull/N/head keep the pull request commits reachable. */ |
| 1840 | importDropTempRefs(importId?: string): number { |
| 1841 | const refs = this.refs(IMPORT_REF_PREFIX); |
| 1842 | for (const r of refs) this.casRef(r.name, r.oid, null); |
| 1843 | if (importId) this.importsModule.dropImportRefs(importId); |
| 1844 | return refs.length; |
| 1845 | } |
| 1846 | setOrgVariables(...a: Parameters<RepoImports["setOrgVariables"]>) { |
| 1847 | return this.importsModule.setOrgVariables(...a); |
| 1848 | } |
| 1849 | issueMilestoneOf(number: number) { |
| 1850 | return this.importsModule.milestoneOf(number); |
| 1851 | } |
| 1852 | /** Check names that workflow jobs on the default branch report, keyed by job name (GitHub names checks by job). */ |
| 1853 | async importCheckNames(): Promise<Record<string, string[]>> { |
| 1854 | const sha = await this.resolve("HEAD"); |
| 1855 | const out: Record<string, string[]> = {}; |
| 1856 | if (!sha) return out; |
| 1857 | for (const w of await this.actions.loadWorkflows(sha)) { |
| 1858 | if (!w.workflow) continue; |
| 1859 | const wf = w.workflow.name ?? w.path.split("/").pop()!; |
| 1860 | for (const [key, job] of Object.entries(w.workflow.jobs)) { |
| 1861 | const name = (job as { name?: unknown }).name; |
| 1862 | for (const n of new Set([key, typeof name === "string" ? name : key])) (out[n] ??= []).push(`${wf} / ${typeof name === "string" && !name.includes("${{") ? name : key}`); |
| 1863 | } |
| 1864 | } |
| 1865 | return out; |
| 1866 | } |
| 1867 | milestones(...a: Parameters<RepoImports["listMilestones"]>) { |
| 1868 | return this.importsModule.listMilestones(...a); |
| 1869 | } |
| 1870 | milestone(...a: Parameters<RepoImports["milestone"]>) { |
| 1871 | return this.importsModule.milestone(...a); |
| 1872 | } |
| 1873 | saveMilestone(...a: Parameters<RepoImports["saveMilestone"]>) { |
| 1874 | return this.importsModule.saveMilestone(...a); |
| 1875 | } |
| 1876 | setIssueMilestone(...a: Parameters<RepoImports["setIssueMilestone"]>) { |
| 1877 | return this.importsModule.setIssueMilestone(...a); |
| 1878 | } |
| 1879 | |
| 1880 | // ---------------------------------------------------------------- live updates (WebSockets with hibernation) |
| 1881 | |
| 1882 | override async fetch(request: Request): Promise<Response> { |
| 1883 | if (request.headers.get("Upgrade") !== "websocket") return new Response("expected websocket", { status: 426 }); |
| 1884 | const topics = (new URL(request.url).searchParams.get("topics") ?? "repo").split(",").filter((t) => /^[a-z]+(:[A-Za-z0-9_-]+)?$/.test(t)).slice(0, 10); |
| 1885 | const pair = new WebSocketPair(); |
| 1886 | this.ctx.acceptWebSocket(pair[1], topics.length ? topics : ["repo"]); |
| 1887 | // Access is checked when a page connects; reconnecting checks it again, so someone who lost access |
| 1888 | // (removed, or the repository made private) stops getting updates within LIVE_REAUTH_MS. |
| 1889 | pair[1].serializeAttachment({ until: Date.now() + LIVE_REAUTH_MS }); |
| 1890 | return new Response(null, { status: 101, webSocket: pair[0] }); |
| 1891 | } |
| 1892 | |
| 1893 | /** Close a socket whose access check is too old; the page reconnects, and the Worker checks access again. */ |
| 1894 | private expired(ws: WebSocket): boolean { |
| 1895 | const a = ws.deserializeAttachment() as { until?: number } | null; |
| 1896 | if (a?.until && a.until > Date.now()) return false; |
| 1897 | try { |
| 1898 | ws.close(LIVE_REAUTH_CODE, "reconnect"); |
| 1899 | } catch { |
| 1900 | /* already closed */ |
| 1901 | } |
| 1902 | return true; |
| 1903 | } |
| 1904 | |
| 1905 | override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> { |
| 1906 | if (this.expired(ws)) return; |
| 1907 | if (message === "ping") ws.send("pong"); |
| 1908 | } |
| 1909 | |
| 1910 | override async webSocketClose(ws: WebSocket, code: number): Promise<void> { |
| 1911 | try { |
| 1912 | ws.close(code, "bye"); |
| 1913 | } catch { |
| 1914 | /* already closed */ |
| 1915 | } |
| 1916 | } |
| 1917 | |
| 1918 | broadcast(topic: string, data: unknown): void { |
| 1919 | const msg = JSON.stringify({ topic, data }); |
| 1920 | for (const ws of this.ctx.getWebSockets(topic)) { |
| 1921 | if (this.expired(ws)) continue; |
| 1922 | try { |
| 1923 | ws.send(msg); |
| 1924 | } catch { |
| 1925 | /* client went away */ |
| 1926 | } |
| 1927 | } |
| 1928 | } |
| 1929 | } |
| 1930 | |
| 1931 | export function toInfo(sha: string, c: Commit): CommitInfo { |
| 1932 | return { sha, tree: c.tree, parents: c.parents, author: c.author, committer: c.committer, message: c.message, signed: !!c.gpgsig }; |
| 1933 | } |
| 1934 | |
| 1935 | export { fromUtf8 }; |