Merge pull request #9 from thoughtbot/nc/octokit

Use Octokit instead of calling `gh`

Author: neilvcarvalho

.github/workflows/integration.yml

@@ -54,7 +54,7 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           dry-run: "true"
-          working-directory: /tmp/test-app
+          rails-root: /tmp/test-app
 
       - name: Assert all outdated packages appear in dry-run output
         run: |

.tool-versions

@@ -1 +1 @@
-ruby 4.0.1
+ruby 4.0.5

Gemfile

@@ -1,9 +1,12 @@
 source "https://rubygems.org"
 ruby ">= 3.2"
 
+gem "octokit"
+
 group :development, :test do
   gem "rake"
   gem "minitest"
+  gem "minitest-mock", "~> 5.27"
 end
 
 group :development do

Gemfile.lock

@@ -1,19 +1,35 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     drb (2.2.3)
+    faraday (2.14.2)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.2)
+      net-http (~> 0.5)
     json (2.19.5)
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
+    logger (1.7.0)
     minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
+    minitest-mock (5.27.0)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    octokit (10.0.0)
+      faraday (>= 1, < 3)
+      sawyer (~> 0.9)
     parallel (1.28.0)
     parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
+    public_suffix (7.0.5)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
@@ -37,6 +53,9 @@ GEM
       rubocop (>= 1.75.0, < 2.0)
       rubocop-ast (>= 1.47.1, < 2.0)
     ruby-progressbar (1.13.0)
+    sawyer (0.9.3)
+      addressable (>= 2.3.5)
+      faraday (>= 0.17.3, < 3)
     standard (1.54.0)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.0)
@@ -54,26 +73,37 @@ GEM
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
     unicode-emoji (4.2.0)
+    uri (1.1.1)
 
 PLATFORMS
   arm64-darwin-25
   ruby
 
 DEPENDENCIES
   minitest
+  minitest-mock (~> 5.27)
+  octokit
   rake
   standardrb
 
 CHECKSUMS
+  addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
   ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
   drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
+  faraday (2.14.2) sha256=73ccb9994a9e8648f010e32eca2ae82e41c57860aa10932cda29418b9e0223ad
+  faraday-net_http (3.4.2) sha256=f147758260d3526939bf57ecf911682f94926a3666502e24c69992765875906c
   json (2.19.5) sha256=218a18553e4801d579ca7e0f5bc72bafd776d7397238a1fb4e74db5b0a812c59
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
   minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1
+  minitest-mock (5.27.0) sha256=7040ed7185417a966920987eaa6eaf1be4ea1fc5b25bb03ff4703f98564a55b0
+  net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
+  octokit (10.0.0) sha256=82e99a539b7637b7e905e6d277bb0c1a4bed56735935cc33db6da7eae49a24e8
   parallel (1.28.0) sha256=33e6de1484baf2524792d178b0913fc8eb94c628d6cfe45599ad4458c638c970
   parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
+  public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
   rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
@@ -82,12 +112,14 @@ CHECKSUMS
   rubocop-ast (1.49.1) sha256=4412f3ee70f6fe4546cc489548e0f6fcf76cafcfa80fa03af67098ffed755035
   rubocop-performance (1.26.1) sha256=cd19b936ff196df85829d264b522fd4f98b6c89ad271fa52744a8c11b8f71834
   ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
+  sawyer (0.9.3) sha256=0d0f19298408047037638639fe62f4794483fb04320269169bd41af2bdcf5e41
   standard (1.54.0) sha256=7a4b08f83d9893083c8f03bc486f0feeb6a84d48233b40829c03ef4767ea0100
   standard-custom (1.0.2) sha256=424adc84179a074f1a2a309bb9cf7cd6bfdb2b6541f20c6bf9436c0ba22a652b
   standard-performance (1.9.0) sha256=49483d31be448292951d80e5e67cdcb576c2502103c7b40aec6f1b6e9c88e3f2
   standardrb (1.0.1) sha256=7a1328be429f4e97a97e357e2446f3509e80164a59ff00bc6a4daa78e3351f2c
   unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
+  uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
 
 RUBY VERSION
   ruby 4.0.1

README.md

@@ -20,7 +20,7 @@ Another option is to use a dedicated GitHub token for this action, which can be
 set as a secret in the repository's settings. This token should have the `repo`
 scope enabled.
 
-Then, add a workflow file:
+Then, add a workflow file that sets up your Rails environment and runs the action:
 
 ```yaml
 # .github/workflows/importmap-updates.yml
@@ -38,7 +38,11 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
       - uses: thoughtbot/importmap-update@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

action.yml

@@ -11,7 +11,7 @@ inputs:
     required: false
     default: ".github/importmap-updates.yml"
   github-token:
-    description: "Token used by gh to list, open, edit, and close PRs."
+    description: "Token used by Octokit to list, open, edit, and close PRs."
     required: true
   base-branch:
     description: "Branch to base PRs against."
@@ -32,30 +32,27 @@ inputs:
     description: "Git author email for commits."
     required: false
     default: "github-actions[bot]@users.noreply.github.com"
-  working-directory:
+  rails-root:
     description: "Directory containing the Rails app to run against. Useful when the app lives in a subdirectory or for integration testing."
     required: false
     default: "."
 
 runs:
   using: "composite"
   steps:
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        bundler-cache: true
-        ruby-version: ${{ inputs.ruby-version }}
-
     - name: Run importmap-update
       shell: bash
-      working-directory: ${{ inputs.working-directory }}
+      working-directory: ${{ github.action_path }}
       env:
-        GH_TOKEN:                 ${{ inputs.github-token }}
+        BUNDLE_GEMFILE:           ${{ github.action_path }}/Gemfile
+        RAILS_ROOT:               ${{ inputs.rails-root }}
         GITHUB_TOKEN:             ${{ inputs.github-token }}
         GITHUB_REPOSITORY:        ${{ github.repository }}
         INPUT_CONFIG_FILE:        ${{ inputs.config-file }}
         IMPORTMAP_BASE_BRANCH:    ${{ inputs.base-branch }}
         IMPORTMAP_DRY_RUN:        ${{ inputs.dry-run }}
         IMPORTMAP_AUTHOR_NAME:    ${{ inputs.author-name }}
         IMPORTMAP_AUTHOR_EMAIL:   ${{ inputs.author-email }}
-      run: ${{ github.action_path }}/exe/importmap-update 2>&1 | tee "${IMPORTMAP_RUN_LOG:-/dev/null}"
+      run: |
+        bundle install
+        bundle exec exe/importmap-update 2>&1 | tee "${IMPORTMAP_RUN_LOG:-/dev/null}"

exe/importmap-update

@@ -17,7 +17,7 @@
 #   INPUT_CONFIG_FILE          Path to the YAML config (default
 #                              .github/importmap-updates.yml).
 #   GITHUB_REPOSITORY          OWNER/REPO of the consuming repo.
-#   GITHUB_TOKEN / GH_TOKEN    Auth for gh (the action.yml passes this in).
+#   GITHUB_TOKEN / GH_TOKEN    Auth token passed to Octokit (action.yml passes this in).
 #   IMPORTMAP_BASE_BRANCH      Base branch for PRs (default `main`).
 #   IMPORTMAP_DRY_RUN          Set to "true" for a no-side-effects run.
 #   IMPORTMAP_AUTHOR_NAME      Git author name for commits.
@@ -31,7 +31,7 @@ require "config"
 require "planner"
 require "reconciler"
 require "executor"
-require "gh_client"
+require "github_client"
 require "git_client"
 require "commands"
 require "parsers/outdated_parser"
@@ -156,8 +156,14 @@ when :run
     exit 2
   end
 
-  runner = Importmap::Update::Commands::ShellRunner.new
-  gh = Importmap::Update::GhClient.new(repo: repo, runner: runner)
+  token = ENV["GITHUB_TOKEN"] || ENV["GH_TOKEN"]
+  if token.nil? || token.empty?
+    warn "GITHUB_TOKEN (or GH_TOKEN) is not set; refusing to run."
+    exit 2
+  end
+
+  runner = Importmap::Update::Commands::ShellRunner.new(cwd: ENV.fetch("RAILS_ROOT", "."))
+  gh = Importmap::Update::GitHubClient.new(repo: repo, token: token)
   git = Importmap::Update::GitClient.new(
     runner: runner,
     author_name: ENV.fetch("IMPORTMAP_AUTHOR_NAME", "github-actions[bot]"),

lib/commands.rb

@@ -47,8 +47,10 @@ def initialize(cwd: nil, env: nil)
         def run(*argv)
           opts = {}
           opts[:chdir] = @cwd if @cwd
-          stdout, stderr, status = Open3.capture3(@env, *argv, **opts)
-          Result.new(stdout: stdout, stderr: stderr, exit_code: status.exitstatus)
+          Bundler.with_unbundled_env do
+            stdout, stderr, status = Open3.capture3(@env, *argv, opts)
+            Result.new(stdout: stdout, stderr: stderr, exit_code: status.exitstatus)
+          end
         end
 
         # Raises on non-zero exit. Use when you have no recovery strategy

lib/executor.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "commands"
-require_relative "gh_client"
+require_relative "github_client"
 require_relative "git_client"
 require_relative "metadata"