facts.ts

// SPDX-FileCopyrightText: 2026 Emily <hello@emily.moe>
//
// SPDX-License-Identifier: MIT

import { assert, assertExists } from "@std/assert";
import { Octokit, RequestError } from "octokit";
import type { OctokitPlugin } from "@octokit/core/types";
import type { RequestParameters } from "@octokit/types";
import {
  type ActorInfoFragment,
  BasicFactsDocument,
  CommittersDocument,
  type InputMaybe,
  MergeBotMergesSinceDocument,
  PullRequestForMergeCommitDocument,
  type PullRequestInfoFragment,
  type RepositoryInfoFragment,
  type Scalars,
  type TypedDocumentString,
  UnmergedPullRequestsDocument,
} from "./graphql/graphql.ts";
import {
  type Activity,
  nixosOrgRiskPeriodEnd,
  riskPeriodStart,
  tokenRiskPeriodEnd,
} from "./axioms.ts";

export type ID = Scalars["ID"]["output"];

export type Facts = {
  readonly affectedRepositories: Map<ID, RepositoryInfoFragment>;
  readonly affectedUser: ActorInfoFragment;
  readonly webFlowUser: ActorInfoFragment;
  readonly rRyantmUser: ActorInfoFragment;
  readonly nixpkgsCIActor: ActorInfoFragment;
  readonly githubActionsActor: ActorInfoFragment;
  readonly committers: Map<ID, ActorInfoFragment>;
  readonly trustedOpenPGPPublicKeys: Map<ID, string[]>;
  readonly riskyPullRequests: Map<ID, PullRequestInfoFragment>;
  readonly riskyRepositoryActivity: Map<ID, Activity[]>;
};

export type JSONFacts = {
  readonly [Field in keyof Facts]: Facts[Field] extends Map<ID, infer V>
    ? Record<ID, V>
    : Facts[Field];
};

function toJSONFacts(facts: Facts): JSONFacts {
  const toObject: <V>(m: Map<ID, V>) => Record<ID, V> = (m) =>
    Object.fromEntries(
      m.entries().toArray().toSorted(([id1, _v1], [id2, _v2]) =>
        id1.localeCompare(id2, "en")
      ),
    );
  return {
    affectedRepositories: toObject(facts.affectedRepositories),
    affectedUser: facts.affectedUser,
    webFlowUser: facts.webFlowUser,
    rRyantmUser: facts.rRyantmUser,
    nixpkgsCIActor: facts.nixpkgsCIActor,
    githubActionsActor: facts.githubActionsActor,
    committers: toObject(facts.committers),
    trustedOpenPGPPublicKeys: toObject(facts.trustedOpenPGPPublicKeys),
    riskyPullRequests: toObject(facts.riskyPullRequests),
    riskyRepositoryActivity: toObject(facts.riskyRepositoryActivity),
  };
}

export function fromJSONFacts(facts: JSONFacts): Facts {
  return {
    affectedRepositories: new Map(Object.entries(facts.affectedRepositories)),
    affectedUser: facts.affectedUser,
    webFlowUser: facts.webFlowUser,
    rRyantmUser: facts.rRyantmUser,
    nixpkgsCIActor: facts.nixpkgsCIActor,
    githubActionsActor: facts.githubActionsActor,
    committers: new Map(Object.entries(facts.committers)),
    trustedOpenPGPPublicKeys: new Map(
      Object.entries(facts.trustedOpenPGPPublicKeys),
    ),
    riskyPullRequests: new Map(Object.entries(facts.riskyPullRequests)),
    riskyRepositoryActivity: new Map(
      Object.entries(facts.riskyRepositoryActivity),
    ),
  };
}

// Sometimes the GitHub API freaks out and returns an empty response
// with no error from the GraphQL endpoint. This hacks around that by
// pretending it’s a rate limit issue.
const retryHack: OctokitPlugin = (octokit) => {
  octokit.hook.after("request", (response, options) => {
    if (
      response.url === "https://api.github.com/graphql" &&
      response.status === 200 &&
      response.data === ""
    ) {
      // The throttling plugin matches the error message against a
      // regular expression to detect secondary rate limits, so the
      // string here is load‐bearing…
      throw new RequestError("Fake secondary rate limit", 403, {
        request: options,
        response: { ...response, status: 403 },
      });
    }
  });
};

// We need our plugin to come before the stock throttling plugin
// included with the high‐level `octokit.js` wrapper library, which
// means we have to inject it ourselves rather than appending to the
// list with `Octokit.plugin()`.
const MyOctokit = class extends Octokit {
  static override plugins = [
    retryHack,
    ...Octokit.plugins,
  ];
};

async function getGitHubCliToken(): Promise<string> {
  const command = new Deno.Command("gh", { args: ["auth", "token"] });
  const { success, stdout, stderr } = await command.output();
  assert(success, `Getting token from gh(1) failed: ${stderr}`);
  return new TextDecoder().decode(stdout);
}

async function getOctokit(): Promise<Octokit> {
  return new MyOctokit({
    auth: Deno.env.get("GITHUB_TOKEN") ?? await getGitHubCliToken(),
    request: {
      retries: 10,
    },
  });
}

function execute<Result, Vars>(
  octokit: Octokit,
  query: TypedDocumentString<Result, Vars>,
  parameters: RequestParameters & Vars,
): Promise<Result> {
  return octokit.graphql(query.toString(), parameters);
}

function paginate<
  Result,
  Vars extends { readonly cursor: InputMaybe<string> },
>(
  octokit: Octokit,
  query: TypedDocumentString<Result, Vars>,
  parameters: RequestParameters & Omit<Vars, "cursor">,
): AsyncIterable<Result> {
  return octokit.graphql.paginate.iterator(query.toString(), parameters);
}

async function fetchUserIDByRESTUsername(
  { octokit, username }: { octokit: Octokit; username: string },
): Promise<ID> {
  return (await octokit.rest.users.getByUsername({ username })).data.node_id;
}

async function fetchCommitters(
  octokit: Octokit,
): Promise<Map<ID, ActorInfoFragment>> {
  return new Map(
    (await Array.fromAsync(paginate(octokit, CommittersDocument, {})))
      .values()
      .flatMap(({ organization }) => {
        const nodes = organization?.team?.members.nodes;
        assertExists(nodes);
        return nodes.map((member) => {
          assertExists(member);
          return [member.id, member];
        });
      }),
  );
}

async function fetchOpenPGPPublicKeys(
  { octokit, user: { login } }: {
    octokit: Octokit;
    user: ActorInfoFragment;
  },
): Promise<string[]> {
  const iterator = octokit.paginate.iterator(
    octokit.rest.users.listGpgKeysForUser,
    { username: login },
  );
  return (await Array.fromAsync(iterator)).flatMap(({ data }) =>
    data.map(({ raw_key }) => {
      assertExists(raw_key);
      return raw_key;
    })
  );
}

async function* fetchRiskyRepositoryActivity(
  { octokit, repository: { owner, name }, affectedUser, periodEnd }: {
    octokit: Octokit;
    repository: RepositoryInfoFragment;
    affectedUser: ActorInfoFragment;
    periodEnd: Temporal.Instant;
  },
): AsyncGenerator<Activity> {
  const iterator = octokit.paginate.iterator(
    octokit.rest.repos.listActivities,
    {
      owner: owner.login,
      repo: name,
      actor: affectedUser.login,
      per_page: 100,
    },
  );
  for await (const { data } of iterator) {
    yield* data.filter(({ timestamp }) =>
      riskPeriodStart.until(timestamp).sign >= 0 &&
      periodEnd.since(timestamp).sign > 0
    );
  }
}

async function fetchPullRequestForMergeCommit(
  { octokit, repository: { id: repositoryID }, oid }: {
    octokit: Octokit;
    repository: RepositoryInfoFragment;
    oid: string;
  },
): Promise<PullRequestInfoFragment> {
  const { node } = await execute(
    octokit,
    PullRequestForMergeCommitDocument,
    {
      repositoryID,
      oid,
    },
  );
  assert(node?.__typename === "Repository");
  assert(node.object?.__typename === "Commit");
  const { associatedPullRequests } = node.object;
  assertExists(associatedPullRequests);
  const { nodes, pageInfo } = associatedPullRequests;
  assert(!pageInfo.hasNextPage);
  const pullRequest = nodes?.[0];
  assertExists(pullRequest);
  return pullRequest;
}

async function* fetchRiskyMergeBotMergedPullRequests(
  { octokit, mergeBotActorIDs }: {
    octokit: Octokit;
    mergeBotActorIDs: Set<ID>;
  },
): AsyncGenerator<PullRequestInfoFragment> {
  const iterator = paginate(octokit, MergeBotMergesSinceDocument, {
    periodStart: riskPeriodStart.toString(),
  });
  for await (const { repository } of iterator) {
    const nodes = repository?.issue?.timelineItems.nodes;
    assertExists(nodes);
    yield* nodes.flatMap((timelineItem) => {
      assertExists(timelineItem);
      return timelineItem.__typename === "CrossReferencedEvent" &&
          timelineItem.source.__typename === "PullRequest" &&
          timelineItem.actor !== null &&
          mergeBotActorIDs.has(timelineItem.actor.id) &&
          tokenRiskPeriodEnd.since(timelineItem.source.createdAt).sign > 0
        ? [timelineItem.source]
        : [];
    });
  }
}

async function* fetchRiskyUnmergedPullRequests(
  { octokit, repository: { id: repositoryID } }: {
    octokit: Octokit;
    repository: RepositoryInfoFragment;
  },
): AsyncGenerator<PullRequestInfoFragment> {
  const iterator = paginate(octokit, UnmergedPullRequestsDocument, {
    repositoryID,
  });
  for await (const { node } of iterator) {
    assert(node?.__typename === "Repository");
    const nodes = node?.pullRequests.nodes;
    assertExists(nodes);
    for (const pullRequest of nodes) {
      assertExists(pullRequest);
      if (riskPeriodStart.until(pullRequest.updatedAt).sign < 0) {
        return;
      }
      if (tokenRiskPeriodEnd.since(pullRequest.createdAt).sign > 0) {
        yield pullRequest;
      }
    }
  }
}

class Progress {
  #stderr: WritableStreamDefaultWriter<Uint8Array> = Deno.stderr.writable
    .getWriter();
  #encoder: TextEncoder = new TextEncoder();
  #progress: number = 0;

  async update(newProgress: number): Promise<void> {
    this.#progress = Math.max(this.#progress, newProgress);
    await this.#stderr.ready;
    await this.#stderr.write(
      this.#encoder.encode(
        "\r\x1B[K" + "█".repeat(Math.floor(this.#progress * 80)) + "\r",
      ),
    );
  }

  async finish(): Promise<void> {
    await this.#stderr.ready;
    await this.#stderr.write(this.#encoder.encode("\r\x1B[K"));
    await this.#stderr.ready;
    this.#stderr.releaseLock();
  }
}

async function collectParallelWithProgress<T>(
  promises: Promise<T>[],
): Promise<T[]> {
  const progress = new Progress();
  const results = await Promise.all(promises.map(async (promise, i) => {
    const result = await promise;
    await progress.update(i / promises.length);
    return result;
  }));
  await progress.finish();
  return results;
}

async function collectPullRequestsParallel<T extends PullRequestInfoFragment>(
  promises: Promise<T>[],
): Promise<Map<ID, T>> {
  return new Map(
    await collectParallelWithProgress(promises.map(async (promise) => {
      const pullRequest = await promise;
      return [pullRequest.id, pullRequest] as const;
    })),
  );
}

async function collectPullRequestsSequential<T extends PullRequestInfoFragment>(
  { periodStart, periodEnd, pullRequests }: {
    periodStart: Temporal.Instant;
    periodEnd: Temporal.Instant;
    pullRequests: AsyncIterable<T>;
  },
): Promise<Map<ID, T>> {
  const map = new Map();
  const progress = new Progress();
  const periodDuration = periodEnd.since(periodStart).total("seconds");
  for await (const pullRequest of pullRequests) {
    map.set(pullRequest.id, pullRequest);
    await progress.update(
      periodEnd.since(pullRequest.updatedAt).total("seconds") / periodDuration,
    );
  }
  await progress.finish();
  return map;
}

async function fetchFacts(octokit: Octokit): Promise<Facts> {
  console.log("Fetching basic information");
  const nixpkgsCIActorID = await fetchUserIDByRESTUsername({
    octokit,
    username: "nixpkgs-ci[bot]",
  });
  const githubActionsActorID = await fetchUserIDByRESTUsername({
    octokit,
    username: "github-actions[bot]",
  });
  const {
    nixpkgsRepository,
    nixosHardwareRepository,
    nixosWeeklyRepository,
    nixIdeaRepository,
    nixPillsRepository,
    affectedUser,
    webFlowUser,
    rRyantmUser,
    nixpkgsCIActor,
    githubActionsActor,
  } = await execute(octokit, BasicFactsDocument, {
    nixpkgsCIActorID,
    githubActionsActorID,
  });
  assertExists(nixpkgsRepository);
  assertExists(nixosHardwareRepository);
  assertExists(nixosWeeklyRepository);
  assertExists(nixIdeaRepository);
  assertExists(nixPillsRepository);
  assertExists(affectedUser);
  assertExists(webFlowUser);
  assertExists(rRyantmUser);
  assert(nixpkgsCIActor?.__typename === "Bot");
  assert(githubActionsActor?.__typename === "Bot");

  const affectedRepositories = new Map(
    [
      nixpkgsRepository,
      nixosHardwareRepository,
      nixosWeeklyRepository,
      nixIdeaRepository,
      nixPillsRepository,
    ].values().map((repository) => [repository.id, repository]),
  );

  console.log("Fetching trusted OpenPGP public keys");
  const trustedOpenPGPPublicKeys = new Map(
    await Promise.all(
      [webFlowUser, affectedUser].map(async (user) =>
        [user.id, await fetchOpenPGPPublicKeys({ octokit, user })] as const
      ),
    ),
  );

  console.log("Fetching Nixpkgs committers");
  const committers = await fetchCommitters(octokit);

  console.log("Fetching affected NixOS organization repository activity");
  const riskyAffectedRepositoryActivity = new Map(
    await Array.fromAsync(
      affectedRepositories.entries().map(async ([id, repository]) => [
        id,
        await Array.fromAsync(fetchRiskyRepositoryActivity({
          octokit,
          repository,
          affectedUser,
          periodEnd: nixosOrgRiskPeriodEnd,
        })),
      ]),
    ),
  );

  console.log("Fetching directly merged pull requests");
  const riskyDirectlyMergedPullRequests = await collectPullRequestsParallel(
    riskyAffectedRepositoryActivity.entries().flatMap(
      ([id, riskyActivities]) => {
        const repository = affectedRepositories.get(id);
        assertExists(repository);
        return riskyActivities.values().filter(({ activity_type }) =>
          activity_type === "pr_merge"
        ).map(({ after }) =>
          fetchPullRequestForMergeCommit({
            octokit,
            repository,
            oid: after,
          })
        );
      },
    ).toArray(),
  );

  console.log("Fetching merge bot merged pull requests");
  const nixpkgsMergeBotActorID = await fetchUserIDByRESTUsername({
    octokit,
    username: "nixpkgs-merge-bot[bot]",
  });
  const riskyMergeBotMergedPullRequests = await collectPullRequestsSequential({
    periodStart: riskPeriodStart,
    periodEnd: tokenRiskPeriodEnd,
    pullRequests: fetchRiskyMergeBotMergedPullRequests({
      octokit,
      mergeBotActorIDs: new Set([nixpkgsCIActor.id, nixpkgsMergeBotActorID]),
    }),
  });

  console.log("Fetching unmerged pull requests");
  const riskyUnmergedPullRequests = await collectPullRequestsSequential(
    {
      periodStart: riskPeriodStart,
      periodEnd: tokenRiskPeriodEnd,
      pullRequests: (async function* () {
        for (const repository of affectedRepositories.values()) {
          yield* fetchRiskyUnmergedPullRequests({ octokit, repository });
        }
      })(),
    },
  );

  const riskyPullRequests = new Map([
    ...riskyDirectlyMergedPullRequests.entries(),
    ...riskyMergeBotMergedPullRequests.entries(),
    ...riskyUnmergedPullRequests.entries(),
  ]);

  console.log("Fetching pull request repository activity");
  const riskyPullRequestRepositories: Map<ID, RepositoryInfoFragment> = new Map(
    riskyPullRequests.values().flatMap(({ headRepository }) =>
      headRepository === null || affectedRepositories.has(headRepository.id)
        ? []
        : [[headRepository.id, headRepository]]
    ),
  );
  const riskyRepositoryActivity = new Map([
    ...riskyAffectedRepositoryActivity.entries(),
    ...await collectParallelWithProgress(
      riskyPullRequestRepositories.entries().map(async ([id, repository]) =>
        [
          id,
          await Array.fromAsync(fetchRiskyRepositoryActivity({
            octokit,
            repository,
            affectedUser,
            periodEnd: tokenRiskPeriodEnd,
          })),
        ] as const
      ).toArray(),
    ),
  ]);

  return {
    affectedRepositories,
    affectedUser,
    webFlowUser,
    rRyantmUser,
    nixpkgsCIActor,
    githubActionsActor,
    committers,
    trustedOpenPGPPublicKeys,
    riskyPullRequests,
    riskyRepositoryActivity,
  };
}

if (import.meta.main) {
  const octokit = await getOctokit();
  const facts = await fetchFacts(octokit);
  const json = JSON.stringify(toJSONFacts(facts));
  await Deno.writeTextFile("facts.json", json + "\n");
}