Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions scripts/migration-pr-readiness.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -205,11 +205,19 @@ async function main() {
const env = process.env
requireFact(env.GITHUB_TOKEN, 'read-only metadata token required')
const request = async (url, token, options = {}) => {
const res = await fetch(url, { ...options, headers: { Accept: 'application/vnd.github+json', Authorization: `Bearer ${token}`, ...options.headers }, redirect: 'error', signal: AbortSignal.timeout(15000) })
requireFact(res.ok, `proof read HTTP ${res.status}`)
const text = await res.text()
requireFact(text.length < 16 * 1024 * 1024, 'oversized proof response')
return JSON.parse(text)
// A transient network error (fetch failed, a stalled body) is retried; our own rule refusals never are.
for (let attempt = 1; ; attempt++) {
try {
const res = await fetch(url, { ...options, headers: { Accept: 'application/vnd.github+json', Authorization: `Bearer ${token}`, ...options.headers }, redirect: 'error', signal: AbortSignal.timeout(30000) })
requireFact(res.ok, `proof read HTTP ${res.status}`)
const text = await res.text()
requireFact(text.length < 16 * 1024 * 1024, 'oversized proof response')
return JSON.parse(text)
} catch (error) {
if (error?.safe === true || attempt >= 3) throw error
await new Promise(resolve => setTimeout(resolve, attempt * 2000))
}
}
}
const collectorArgs = {
env, collectorSha256: hashBytes(readFileSync(process.argv[1])), event: JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, 'utf8')),
Expand Down
2 changes: 1 addition & 1 deletion scripts/publish-migration-readiness.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ const files = ['scripts/migration-pr-readiness.mjs', 'scripts/publish-migration-
export function describeFailure(error) {
if (error?.safe === true) return `rule refused: ${error.message}`
const part = value => ((typeof value === 'string' || typeof value === 'number') && /^[A-Za-z0-9_.:-]{1,40}$/.test(String(value)) ? String(value) : '?')
return `error ${part(error?.name)} code=${part(error?.code)} status=${part(error?.status)} stage=${part(error?.stage)}`
return `error ${part(error?.name)} code=${part(error?.code ?? error?.cause?.code)} status=${part(error?.status)} stage=${part(error?.stage)}`
}
export async function publishReadiness({ env, event, api, git, publisherSha256, evaluate }) {
requireFact(env.GITHUB_ACTIONS === 'true' && env.GITHUB_EVENT_NAME === 'pull_request_target' && env.GITHUB_REPOSITORY === repo && env.GITHUB_WORKFLOW_REF === `${repo}/.github/workflows/migration-readiness.yml@refs/heads/main`, 'trusted workflow required')
Expand Down
Loading