Restore release readiness across GitHub API quota pools

Merged
UN
3mo ago
+412-19

Summary

  • keep REST as the primary main-branch protection proof and recover REST transport or core-quota failures through GitHub's equivalent GraphQL branch-protection rule query
  • require exactly one main rule with strict updates plus CodeFactor and DeepScan; malformed, missing, ambiguous, or unavailable policy data still fails closed
  • expose the policy proof source in the machine-readable receipt and document the release contract
  • add exhaustive success and negative-control coverage for the recovery path

PM lineage

Verification

  • node scripts/run-tests.mjs test -- tests/unit/scripts/release/hosted-analysis-gate.spec.ts tests/integration/release-automation-contract.spec.ts — 89 passed
  • changed gate exact coverage — 100/100/100/100
  • node scripts/run-tests.mjs coverage — 500 files, 7,348 tests, exact 100/100/100/100
  • pnpm quality:static — passed
  • pnpm lint:eslint — passed
  • pnpm lint:duplicates — zero clones
  • live gate for ce82afe1ed9124ba71a51177b5d0d39463c5cde9 — passed

Production control

Main CI run 31869377866 and failed-job rerun 94976129763 independently reproduced a REST branch-protection read failure after every other main gate passed. The equivalent GraphQL query succeeds with the same policy data through a separate quota pool; this PR makes that transport recovery deterministic without weakening the release policy.

Summary by Sourcery

Recover main branch protection reads by falling back from GitHub REST to an equivalent GraphQL query while preserving strict release policy.

New Features:

  • Include the branch protection proof source (REST or GraphQL) in the hosted analysis gate receipt payload.

Enhancements:

  • Centralize branch protection reading into a helper that supports REST-first with GraphQL recovery and enforces a single strict main rule with required analyzer contexts.
  • Tighten failure handling for branch protection reads so malformed, missing, or ambiguous GraphQL policy data fails closed.

Documentation:

  • Update releasing documentation to describe the REST-first, GraphQL-fallback branch protection contract and strict main rule requirements.

Tests:

  • Add unit coverage for REST transport failure recovery via GraphQL and for closed-fail scenarios on invalid or ambiguous GraphQL branch protection data.

Summary by cubic

Restores release analyzer readiness when GitHub REST branch-protection reads fail by falling back to the equivalent GraphQL rule query with cursor pagination. Previously the gate aborted on REST transport or core-quota failures and the GraphQL fallback could miss duplicates; now it reads REST first, then GraphQL across all pages with strict validation while still requiring exactly one strict main rule including CodeFactor and DeepScan.

  • Review notes
    • Adds a protected readBranchProtection flow: use REST for main; on REST failure, query GraphQL branchProtectionRules with --paginate --slurp, validate pageInfo.hasNextPage and endCursor, and fail on malformed, truncated, or inconsistent pages.
    • Enforces a single exact main rule with strict status checks and both analyzer contexts across all pages; ambiguous or missing policy data fails closed.
    • Emits branch_protection.source in the gate receipt ("rest" or "graphql"); updates releasing docs.
    • Extends tests with cross-page success and negative controls; keeps exact coverage.
  • Rollout
    • No config changes. Ensure the repository has exactly one main branch protection rule with strict status checks including CodeFactor and DeepScan; otherwise the gate fails closed.