chrisns / repomanager / 25020033950 / 1

85%

master: 85%

push

github

Make planRepoUpdate, planFiles, planBranchProtection diff against actual

Three of the four planner functions never read the repo state — they
emitted their change every run regardless of whether the work was
already done. That's why ticking a consent issue applied successfully,
and the next 10-minute cron tick proposed exactly the same three items
again on the same repo. Only `planRulesets` actually diffed.

- planBranchProtection now fetches the existing protection and compares
  required_status_checks (handling the post-deprecation `checks` shape
  alongside `contexts`), required_linear_history, enforce_admins, and
  the `null` markers we use for restrictions / required_pull_request_reviews.
- planRepoUpdate fetches the full repo and compares each desired key
  with subset semantics (server-side extras like security_and_analysis
  are ignored).
- planFiles fetches every desired file from the default branch and
  base64-decodes to compare against the templated content; missing or
  differing files trigger a single `files:pr` change as before.

All three fail open: a fetch error is treated as drift rather than a
silent skip. The deploy stays gated by READ_ONLY=true until we've seen
a cron tick log "no drift" for the previously-looping repos.

334 of 441 branches covered (75.74%)

Branch coverage included in aggregate %.

594 of 649 relevant lines covered (91.53%)

14.07 hits per line