chrisns / repomanager / 24274401663

85%

push

github

Modernize stack + checkbox consent workflow (#1555)

* Modernize stack and add checkbox consent workflow

Fix silent branch-protection bugs, migrate to Repository Rulesets, introduce
a webhook-driven task-list consent issue for high-risk changes, and replace
Serverless v3 + Octokit v20 with SAM + the Octokit meta package on Node 22.

- handler.js: fix allSettled wrapper bug, drop private-repo gate, guard NPE
  on required_status_checks, deep-merge configs, stop reopening closed
  templated-files PRs
- src/planner.js + src/applier.js: typed diff, per-change try/catch, dry-run
- src/consent.js: renderPlan / upsertConsentIssue / markItemsApplied / parse
  task-list checkboxes with stable HTML-comment markers
- src/config-schema.js: zod RepoConfig; invalid configs open a tracking issue
- Rulesets: new 'rulesets' key using repos.createRepoRuleset / updateRepoRuleset
- Low-risk toggles (vuln alerts, secret scanning, etc.) apply automatically;
  high-risk (rulesets, BP, repo flags, templated files) require a ticked box
- Serverless v3 -> SAM template.yaml, Node 18 -> Node 22, arm64
- Webhook Lambda wired up for issues.edited / push / installation events
- 47 Jest tests, 91% line coverage, enforced via coverageThreshold

* Neutralise hyphens in consent-issue marker ids (CodeQL js/bad-tag-filter)

The original encodeId only rewrote literal `-->` and left the equally-valid
HTML5 comment end `--!>` (and bare `--`) untouched. CodeQL flagged this.

Percent-encode the id with encodeURIComponent and additionally swap `-` for
`%2D` so no hyphen pair can appear inside the embedded `<!-- repomanager:... -->`
comment at all. Parsers decode the id back on the way out.

Regression test fuzzes several hyphenated ids and asserts every emitted
HTML comment interior is free of `--`.

Also:
- ignore `.aws-sam/` in jest testPathIgnorePatterns and .gitignore so the
  SAM build artifact directory isn't treated as a duplicate test tree

126 of 178 branches covered (70.79%)

Branch coverage included in aggregate %.

338 of 370 new or added lines in 6 files covered. (91.35%)

341 of 374 relevant lines covered (91.18%)

7.82 hits per line