shared.js

// @ts-check
const { access, readFile, writeFile } = require("node:fs/promises");
const { config } = require("dotenv");
const { findLast, orderBy } = require("lodash");
const { glob } = require("glob");
const { Octokit } = require("octokit");
const { relative, resolve } = require("node:path");
const semver = require("semver");

config(); // read .env file

const octokit = new Octokit({
  auth: getGitHubToken(),
  request: {
    timeout: 10_000,
  },
});

const actionCacheFilePath = resolve(__dirname, "action-cache.json");
const repoCacheFilePath = resolve(__dirname, "repo-cache.json");
const configFilePath = resolve(__dirname, "config.json");

const nodeVersionMatcher = /node-version:[\t ]+["']?([0-9]+)["'\s]/gm;
const usesLineMatcher =
  /\buses:[\t ]+([\w-]+\/[\w-]+)(?:@([\w\.-]+))?[\t ]*(?:#[\t ]*([\w\.-]+))?/gm;

/**
 * @typedef {{sha: string, tag: string}} Action
 * @typedef {Record<string, {cachedAt: string, sha: string, tag: string, archived?: boolean} | null>} ActionCache
 * @typedef {Record<string, {files: string[], pushedAt: string, error?: string}>} RepoCache
 * @typedef {{createdAt: string, sha?: string; tagName: string}} Release
 */

/**
 * @typedef {Object} Config
 * @property {number} delayDays
 * @property {string[]} deprecatedCommands
 * @property {string?} githubOwner
 * @property {number} minNodeVersion
 * @property {Record<string, string>} minVersions
 * @property {boolean} onlyUpdateIfOlderThanMinVersion
 * @property {Record<string, string>} replaceActions
 * @property {number} releaseCutoff
 * @property {string?} rootDir
 * @property {string[]} trustedOwners
 */

/** @type {Config | null} */
let _config = null;

const logger = {
  info: (message, ...args) => console.log(`[INFO] ${message}`, ...args),
  warn: (message, ...args) => console.warn(`[WARN] ${message}`, ...args),
  error: (message, ...args) => console.error(`[ERROR] ${message}`, ...args),
};

function getGitHubToken() {
  if (!process.env.GITHUB_TOKEN) {
    logger.error("Missing GITHUB_TOKEN environment variable.");
    process.exit(1);
  }

  return process.env.GITHUB_TOKEN;
}

/**
 * @param {string} rootDir
 */
async function getScriptFiles(rootDir) {
  const filePaths = await glob(
    "{.github,deploy,actions}/**/*.{bash,js,py,ps1,sh}",
    {
      cwd: resolve(rootDir),
      ignore: ["**/node_modules/**", ".*cache", "temp"],
    }
  );
  return filePaths.map((filePath) => `${rootDir}/${filePath}`);
}

/**
 * @param {string} rootDir
 */
async function getWorkflowAndActionFiles(rootDir) {
  const filePaths = await glob(
    [".github/workflows/**/*.{yml,yaml}", "**/action.{yml,yaml}"],
    {
      cwd: resolve(rootDir),
      ignore: ["**/node_modules/**", ".*cache", "temp"],
      dot: true,
    }
  );
  return filePaths.map((filePath) => `${rootDir}/${filePath}`);
}

/**
 * @param {string} contents
 * @param {Config} config
 */
function getDeprecatedCommands(contents, config) {
  if (!config.deprecatedCommands?.length) return [];

  const deprecatedCommandMatcher = new RegExp(
    `::(${config.deprecatedCommands.join("|")})`,
    "gm"
  );

  return Array.from(contents.matchAll(deprecatedCommandMatcher)).map(
    (match) => ({
      // @ts-ignore
      line: getLineNumber(contents, match.index),
      command: match[1],
    })
  );
}

/**
 * @param {string} contents
 */
function getUntrustedInputs(contents) {
  // https://securitylab.github.com/research/github-actions-untrusted-input/
  const untrustedInputs = [
    "github.event.comment.body",
    "github.event.head_commit.author.email",
    "github.event.head_commit.author.name",
    "github.event.head_commit.message",
    "github.event.issue.body",
    "github.event.issue.title",
    "github.event.pull_request.body",
    "github.event.pull_request.head.label",
    "github.event.pull_request.head.ref",
    "github.event.pull_request.head.repo.default_branch",
    "github.event.pull_request.title",
    "github.event.review_comment.body",
    "github.event.review.body",
    "github.head_ref",
    /(github\.event\.pages\S+\.page_name)/,
    /(github\.event\.commits\S+\.(?:author\.email|author\.name|message)\b)/,
  ];

  const warnings = [];
  const lines = contents.split(/\r?\n/);

  for (let lineNum = 1; lineNum <= lines.length; lineNum++) {
    const line = lines[lineNum - 1];
    for (const input of untrustedInputs) {
      if (typeof input === "string") {
        if (line.includes(input)) {
          warnings.push({ line: lineNum, input });
        }
      } else {
        const match = line.match(input);
        if (match) {
          warnings.push({ line: lineNum, input: match[1] });
        }
      }
    }
  }

  return warnings;
}

/**
 * @param {string} filePath
 * @param {ActionCache} actionCache
 * @param {Config} config
 */
async function updateActionFile(filePath, actionCache, config) {
  logger.info(`Reading file ${filePath}...`);
  const original = await readFile(filePath, "utf-8");
  const updated = (await updateAction(original, actionCache, config)).contents;

  if (updated !== original) {
    await writeFile(filePath, updated, "utf-8");
    logger.info("Updated file.");
  } else {
    logger.info("No changes.");
  }
}

/**
 * @param {string} contents
 * @param {Config} config
 */
function updateActionNodeVersion(contents, config) {
  if (!config.minNodeVersion) return contents;

  const nodeVersionMatches = Array.from(contents.matchAll(nodeVersionMatcher));
  if (nodeVersionMatches.length === 0) return contents;

  const targetNodeVersion = Math.max(
    ...nodeVersionMatches.map((version) => parseInt(version[1])),
    config.minNodeVersion
  );

  for (let m = nodeVersionMatches.length - 1; m >= 0; m--) {
    const match = nodeVersionMatches[m];
    const nodeVersion = parseInt(match[1]);
    if (nodeVersion === targetNodeVersion) continue;

    contents =
      contents.substring(0, match.index) +
      match[0].replace(match[1], targetNodeVersion.toString()) +
      // @ts-ignore
      contents.substring(match.index + match[0].length);
  }

  return contents;
}

/**
 * @param {string} contents
 * @param {ActionCache} actionCache
 * @param {Config} config
 */
async function updateAction(contents, actionCache, config) {
  contents = updateActionNodeVersion(contents, config);

  const matches = Array.from(contents.matchAll(usesLineMatcher));
  if (matches.length === 0) {
    return { contents, warnings: [] };
  }

  /** @type {Set<[number, string]>} */
  const warnings = new Set([]);
  for (let m = matches.length - 1; m >= 0; m--) {
    const match = matches[m];
    const index = match.index;
    if (!index) continue;
    const [usesLine, action, shaOrVersion, versionComment] = match;

    if (action in config.replaceActions) {
      const lineNum = getLineNumber(contents, index);
      warnings.add([
        lineNum,
        `${action} should be replaced with ${config.replaceActions[action]}.`,
      ]);
      continue;
    }

    const [owner, repo] = action.split("/");
    if (await isRepositoryArchived(owner, repo, actionCache)) {
      const lineNum = getLineNumber(contents, index);
      warnings.add([lineNum, `${action} is archived and should be replaced.`]);
      continue;
    }

    const isTrustedOwner = config.trustedOwners.includes(action.split("/")[0]);
    if (config.onlyUpdateIfOlderThanMinVersion) {
      const minVersion = config.minVersions[action];
      if (minVersion) {
        if (/^v?[0-9]/.test(shaOrVersion)) {
          if (
            isTrustedOwner &&
            compareVersions(shaOrVersion, minVersion) >= 0
          ) {
            continue;
          }
        } else if (
          versionComment &&
          compareVersions(versionComment, minVersion) >= 0
        ) {
          continue;
        }
      }
    }

    const latest = await getLastestRelease(owner, repo, actionCache, config);
    if (!latest) {
      const lineNum = getLineNumber(contents, index);
      warnings.add([lineNum, `${action} has no published releases.`]);
      continue;
    }

    const replacement = isTrustedOwner
      ? `uses: ${action}@${getMajorVersion(latest.tag)}` // Use major if a trusted owner
      : `uses: ${action}@${latest.sha} # ${latest.tag}`; // Use sha if an untrusted owner
    if (replacement === usesLine) continue;

    contents =
      contents.substring(0, index) +
      replacement +
      contents.substring(index + usesLine.length);
  }

  const deprecatedCommands = getDeprecatedCommands(contents, config);
  for (const deprecatedCommand of deprecatedCommands) {
    warnings.add([
      deprecatedCommand.line,
      `${deprecatedCommand.command} command is deprecated.`,
    ]);
  }

  const untrustedInputs = getUntrustedInputs(contents);
  for (const untrustedInput of untrustedInputs) {
    warnings.add([
      untrustedInput.line,
      `${untrustedInput.input} is untrusted input.`,
    ]);
  }

  const orderedWarnings = orderBy(Array.from(warnings), (w) => w[0]).map(
    (w) => `Line ${w[0]}: ${w[1]}`
  );
  for (const warning of orderedWarnings) {
    logger.warn(warning);
  }

  return {
    contents,
    warnings: orderedWarnings,
  };

  /**
   * @param {string} tag
   */
  function getMajorVersion(tag) {
    return `${tag[0] === "v" ? "v" : ""}${semver.coerce(tag)?.major}`;
  }
}

/**
 * @param {string} owner
 * @param {string} repo
 * @param {ActionCache} actionCache
 * @returns {Promise<boolean>}
 */
async function isRepositoryArchived(owner, repo, actionCache) {
  const action = `${owner}/${repo}`;
  if (action in actionCache) {
    return actionCache[action]?.archived === true;
  }

  const response = await octokit.rest.repos.get({ owner, repo });
  if (response.status !== 200) {
    throw Error(`${owner}/${repo} - ${response.status}`);
  }

  if (!response.data.archived) return false;

  actionCache[`${owner}/${repo}`] = {
    cachedAt: new Date().toISOString(),
    archived: true,
    sha: "",
    tag: "",
  };
  return true;
}

/**
 * @param {string} owner
 * @param {string} repo
 * @returns {Promise<Release[]>}}
 */
async function getReleases(owner, repo) {
  const response = await octokit.rest.repos.listReleases({ owner, repo });
  const releases = response.data.map((r) => ({
    createdAt: r.created_at,
    tagName: r.tag_name,
  }));
  if (releases.length === 0) return [];
  return releases.sort((a, b) => {
    // Multiply by -1 for reverse sort
    return compareVersions(a.tagName, b.tagName) * -1;
  });
}

/**
 * @param {string} owner
 * @param {string} repo
 * @param {Config} config
 * @returns {Promise<Release[]>}}
 */
async function getReleaseTags(owner, repo, config) {
  const response = await octokit.rest.repos.listTags({ owner, repo });
  const tags = response.data.filter((tag) => /^v?[0-9]/.test(tag.name));

  const releaseTags = [];
  if (tags.length > 0 && config.releaseCutoff) {
    for (const tag of tags) {
      const tagResponse = await octokit.rest.repos.getCommit({
        owner,
        repo,
        ref: tag.commit.sha,
      });
      const tagDetails = tagResponse.data;
      const createdAt = tagDetails.commit.committer?.date;
      if (!createdAt) {
        continue;
      }
      releaseTags.push({
        createdAt,
        sha: tag.commit.sha,
        tagName: tag.name,
      });
      if (new Date(createdAt).getTime() <= config.releaseCutoff) break;
    }
  }

  if (releaseTags.length === 0) return [];
  return releaseTags.sort((a, b) => {
    // Multiply by -1 for reverse sort
    return compareVersions(a.tagName, b.tagName) * -1;
  });
}

/**
 * @param {string} owner
 * @param {string} repo
 * @param {ActionCache} actionCache
 * @param {Config} config
 * @returns {Promise<Action | null>}}
 */
async function getLastestRelease(owner, repo, actionCache, config) {
  const action = `${owner}/${repo}`;
  if (actionCache[action]?.sha && actionCache[action]?.tag) {
    return actionCache[action];
  }

  const minVersion = config.minVersions[action];
  let releases = await getReleases(owner, repo);
  if (releases.length === 0) {
    releases = await getReleaseTags(owner, repo, config);
  }
  let latest = releases.find(
    (release) => new Date(release.createdAt).getTime() <= config.releaseCutoff
  );
  if (minVersion) {
    if (!latest?.tagName || compareVersions(latest.tagName, minVersion) < 0) {
      latest = findLast(
        releases,
        (release) => compareVersions(release.tagName, minVersion) >= 0
      );
      if (latest) {
        logger.info(
          `Action ${action} updated to ${latest.tagName} even though ` +
            `the release is not ${config.delayDays} days old. Modify ` +
            `${relative(__dirname, configFilePath)} if this is incorrect.`
        );
      }
    }
  } else {
    logger.warn(`${action} does not have a minimum version configured.`);
  }

  if (!latest) return null;

  const sha = latest.sha ?? (await getShaForTag(owner, repo, latest.tagName));
  if (!sha) {
    actionCache[action] = null;
    return null;
  }

  actionCache[action] = {
    cachedAt: new Date().toISOString(),
    sha: sha,
    tag: latest.tagName,
  };
  return actionCache[action];
}

/**
 * @param {string} owner
 * @param {string} repo
 * @param {string} tagName
 * @returns {Promise<string?>}
 */
async function getShaForTag(owner, repo, tagName) {
  const query = `{
    repository(name: "${repo}", owner: "${owner}") {
      release(tagName: "${tagName}") {
        tagCommit {
          commitUrl
        }
      }
    }
  }`;

  const result = await octokit.graphql(query);
  return result.repository.release.tagCommit.commitUrl.split("/").at(-1);
}

/**
 * @returns {Promise<ActionCache>}
 */
async function readActionCache() {
  try {
    const expiration = new Date().getTime() - 86_400_000; // 1 day ago
    const contents = await readFile(actionCacheFilePath, "utf-8");
    const actionCache = JSON.parse(contents);
    for (const action in actionCache) {
      if (actionCache[action].archived) continue;
      if (new Date(actionCache[action].cachedAt).getTime() < expiration) {
        delete actionCache[action];
      }
    }
    return actionCache;
  } catch (error) {
    return {};
  }
}

/**
 * @param {ActionCache} actionCache
 */
async function writeActionCache(actionCache) {
  // Sort the keys so the config file is more human readable
  const sorted = {};
  const keys = orderBy(Object.keys(actionCache));
  for (const key of keys) {
    sorted[key] = actionCache[key];
  }

  const contents = JSON.stringify(sorted, null, "  ");
  try {
    if (contents === (await readFile(actionCacheFilePath, "utf-8"))) return;
  } catch {}
  await writeFile(actionCacheFilePath, contents, "utf-8");
}

/**
 * @returns {Promise<RepoCache>}
 */
async function readRepoCache() {
  try {
    const contents = await readFile(repoCacheFilePath, "utf-8");
    return JSON.parse(contents);
  } catch (error) {
    return {};
  }
}

/**
 * @param {RepoCache} cache
 */
async function writeRepoCache(cache) {
  // Sort the keys so the config file is more human readable
  const sorted = {};
  const keys = orderBy(Object.keys(cache));
  for (const key of keys) {
    sorted[key] = cache[key];
  }

  const contents = JSON.stringify(sorted, null, "  ");
  await writeFile(repoCacheFilePath, contents, "utf-8");
}

/**
 * @param {Partial<Config>} overrides
 * @returns {Promise<Config>}
 */
async function configure(overrides = {}) {
  if (!_config) {
    const contents = await readFile(configFilePath, "utf-8");
    const config = JSON.parse(contents);

    if (config.rootDir) {
      configureRootDir(config.rootDir);
    }

    const releaseDelay = 86_400_000 * (config.delayDays ?? 0);
    const releaseCutoff = new Date().getTime() - releaseDelay;
    const deprecatedCommands = config.deprecatedCommands
      ? config.deprecatedCommands.map((cmd) =>
          cmd.startsWith("::") ? cmd.substring(2) : cmd
        )
      : [];

    _config = {
      delayDays: config.delayDays ?? 0,
      deprecatedCommands,
      githubOwner: config.githubOwner,
      minNodeVersion: config.minNodeVersion,
      minVersions: config.minVersions ?? {},
      onlyUpdateIfOlderThanMinVersion: config.onlyUpdateIfOlderThanMinVersion,
      releaseCutoff: releaseCutoff,
      replaceActions: config.replaceActions ?? {},
      rootDir: config.rootDir,
      trustedOwners: config.trustedOwners ?? [],
      ...(overrides ?? {}),
    };
  }
  return _config;
}

/**
 * @param {string} rootDir
 */
async function configureRootDir(rootDir) {
  // if (!rootDir) {
  //   logger.error('Must provide "rootDir" path in config.json file.');
  //   process.exit(1);
  // }

  try {
    await access(rootDir);
  } catch (error) {
    logger.error(
      `${error.message}. Create the directory or change the "rootDir" path in config.json.`
    );
    process.exit(1);
  }
}

/**
 *
 * @param {number} ms
 * @returns {Promise<void>}
 */
function sleep(ms) {
  return new Promise((resolve) => {
    setTimeout(() => {
      resolve();
    }, ms);
  });
}

/**
 * Compare versions where minor or patch may not be defined.
 * Returns -1 if versionA < versionB,
 * 0 if versionA == versionB
 * 1 if versionA > versionB
 * @param {string} versionA
 * @param {string} versionB
 * @returns {-1 | 0 | 1}
 */
function compareVersions(versionA, versionB) {
  if (versionA === versionB) return 0;

  const [majorA, minorA, patchA] = splitVersion(versionA);
  if (!majorA === undefined) throw new Error(`Invalid version "${versionA}"`);

  const [majorB, minorB, patchB] = splitVersion(versionB);
  if (!majorB === undefined) throw new Error(`Invalid version "${versionB}"`);

  // Compare major versions
  if (majorA < majorB) return -1; // A < B
  if (majorA > majorB) return 1; // A > B

  // Major versions match so compare minor versions
  if (minorA === undefined || minorB === undefined) {
    return 0; // Assume equality if minor not defined
  }
  if (minorA < minorB) return -1; // A < B
  if (minorA > minorB) return 1; // A > B

  // Major and minor versions match so compare patch versions
  if (patchA === undefined || patchB === undefined) {
    return 0; // Assume equality if patch not defined
  }
  if (patchA < patchB) return -1; // A < B
  if (patchA > patchB) return 1; // A > B

  return 0; // Versions match major.minor.patch

  /**
   * @param {string} version
   */
  function splitVersion(version) {
    return (
      version
        .match(/([0-9\.]+)/)?.[1]
        .split(".")
        .map((v) => parseInt(v)) ?? []
    );
  }
}
/**
 * @param {string} contents
 * @param {number} index
 */
function getLineNumber(contents, index) {
  return contents.substring(0, index).split("\n").length;
}

module.exports = {
  logger,
  nodeVersionMatcher,
  octokit,
  usesLineMatcher,
  getDeprecatedCommands,
  getShaForTag,
  getScriptFiles,
  getWorkflowAndActionFiles,
  readActionCache,
  configure,
  readRepoCache,
  updateAction,
  updateActionFile,
  writeActionCache,
  writeRepoCache,
};