anodizer_core/git/
github_api.rs

1use anyhow::{Context as _, Result, bail};
2use std::process::Command;
3
4use super::git_output;
5use super::remote::detect_github_repo;
6use super::tags::create_and_push_tag;
7
8/// GET a GitHub API endpoint via the `gh` CLI (single request, no pagination).
9///
10/// Returns the parsed JSON response. Useful for endpoints that return a single
11/// object (e.g. the Compare API) rather than a paginated array.
12pub fn gh_api_get(endpoint: &str, token: Option<&str>) -> Result<serde_json::Value> {
13    let mut cmd = Command::new("gh");
14    cmd.args(["api", endpoint]);
15    if let Some(tok) = token {
16        cmd.env("GITHUB_TOKEN", tok);
17    }
18    let output = cmd
19        .stdout(std::process::Stdio::piped())
20        .stderr(std::process::Stdio::piped())
21        .output()
22        .context("failed to spawn gh CLI")?;
23    if !output.status.success() {
24        let stderr_raw = String::from_utf8_lossy(&output.stderr);
25        let raw = format!("gh api GET {} failed: {}", endpoint, stderr_raw.trim());
26        bail!("{}", redact_gh_stderr(&raw, token));
27    }
28    let stdout = String::from_utf8_lossy(&output.stdout);
29    serde_json::from_str(&stdout).context("failed to parse gh api response")
30}
31
32/// Redact secrets from `gh` CLI stderr before interpolating into a bail
33/// message. `token` is the `GITHUB_TOKEN` value passed to the
34/// subprocess; if the user-supplied token leaks (e.g. via a verbose `gh`
35/// error that echoes the auth header), it is replaced with `$GITHUB_TOKEN`
36/// regardless of whether the value matches the `redact::is_secret`
37/// heuristics. Also strips inline URL credentials and any other secret
38/// env-var values reachable from the parent process env.
39fn redact_gh_stderr(stderr: &str, token: Option<&str>) -> String {
40    let stripped = crate::redact::redact_url_credentials(stderr);
41    let mut env: Vec<(String, String)> = std::env::vars().collect();
42    if let Some(tok) = token
43        && !tok.is_empty()
44    {
45        env.push(("GITHUB_TOKEN".to_string(), tok.to_string()));
46    }
47    crate::redact::string(&stripped, &env)
48}
49
50/// GET a GitHub API endpoint via the `gh` CLI, with pagination.
51///
52/// Returns a JSON array of all pages concatenated. The caller is responsible for
53/// ensuring that `gh` is installed and authenticated.
54pub fn gh_api_get_paginated(endpoint: &str, token: Option<&str>) -> Result<Vec<serde_json::Value>> {
55    let mut cmd = Command::new("gh");
56    cmd.args(["api", "--paginate", endpoint]);
57    if let Some(tok) = token {
58        cmd.env("GITHUB_TOKEN", tok);
59    }
60    let output = cmd
61        .stdout(std::process::Stdio::piped())
62        .stderr(std::process::Stdio::piped())
63        .output()
64        .context("failed to spawn gh CLI")?;
65
66    if !output.status.success() {
67        let stderr_raw = String::from_utf8_lossy(&output.stderr);
68        let raw = format!("gh api GET {} failed: {}", endpoint, stderr_raw.trim());
69        bail!("{}", redact_gh_stderr(&raw, token));
70    }
71
72    let stdout = String::from_utf8_lossy(&output.stdout);
73
74    // Try parsing the entire response first before falling back to splitting.
75    // This avoids the split_inclusive(']') approach corrupting non-array responses.
76    if let Ok(serde_json::Value::Array(arr)) = serde_json::from_str::<serde_json::Value>(&stdout) {
77        return Ok(arr);
78    }
79    if let Ok(val) = serde_json::from_str::<serde_json::Value>(&stdout) {
80        // Single object response (e.g. non-list endpoint) — wrap in a vec.
81        return Ok(vec![val]);
82    }
83
84    // Whole-parse failed — gh --paginate may return multiple JSON arrays
85    // concatenated (e.g. `[...][...]`). Split on `]` boundaries and parse each chunk.
86    let mut all_items = Vec::new();
87    for chunk in stdout.split_inclusive(']') {
88        let trimmed = chunk.trim();
89        if trimmed.is_empty() {
90            continue;
91        }
92        if let Ok(serde_json::Value::Array(arr)) =
93            serde_json::from_str::<serde_json::Value>(trimmed)
94        {
95            all_items.extend(arr);
96        } else if let Ok(val) = serde_json::from_str::<serde_json::Value>(trimmed) {
97            all_items.push(val);
98        } else {
99            // Log unparseable chunks so corrupt data doesn't go unnoticed.
100            eprintln!(
101                "warning: gh_api_get_paginated: failed to parse JSON chunk (len={}): {:?}",
102                trimmed.len(),
103                &trimmed[..trimmed.len().min(200)]
104            );
105        }
106    }
107    Ok(all_items)
108}
109
110/// POST a JSON body to a GitHub API endpoint via the `gh` CLI.
111///
112/// Returns the parsed JSON response on success. The caller is responsible for
113/// ensuring that `gh` is installed and authenticated.
114fn gh_api_post(endpoint: &str, body: &serde_json::Value) -> Result<serde_json::Value> {
115    use std::io::Write;
116
117    let body_str = serde_json::to_string(body)?;
118
119    let mut child = Command::new("gh")
120        .args(["api", "--method", "POST", endpoint, "--input", "-"])
121        .stdin(std::process::Stdio::piped())
122        .stdout(std::process::Stdio::piped())
123        .stderr(std::process::Stdio::piped())
124        .spawn()
125        .context("failed to spawn gh CLI")?;
126
127    if let Some(ref mut stdin) = child.stdin {
128        stdin.write_all(body_str.as_bytes())?;
129    }
130    child.stdin.take(); // close stdin
131
132    let output = child.wait_with_output()?;
133    if !output.status.success() {
134        let stderr_raw = String::from_utf8_lossy(&output.stderr);
135        // `gh_api_post` does not currently accept a token argument, but
136        // routing through `redact_process_env` still covers any token
137        // exported as `GITHUB_TOKEN` / `GH_TOKEN` in the parent env, plus
138        // inline URL credentials. Redact the full bail string so an
139        // endpoint containing a secret-shaped path segment is also covered.
140        let raw = format!("gh api POST {} failed: {}", endpoint, stderr_raw.trim());
141        bail!("{}", crate::redact::redact_process_env(&raw));
142    }
143
144    let response: serde_json::Value = serde_json::from_slice(&output.stdout)
145        .with_context(|| format!("failed to parse GitHub API response from {}", endpoint))?;
146    Ok(response)
147}
148
149/// Create a tag via the GitHub API (using the `gh` CLI).
150///
151/// This avoids the need for local git push access. Requires the `gh` CLI to be
152/// installed and authenticated (`gh auth login`). The GitHub API creates a
153/// lightweight tag object pointing at the HEAD commit on the default branch.
154///
155/// Falls back to [`create_and_push_tag`] if `gh` is not available.
156pub fn create_tag_via_github_api(
157    tag: &str,
158    message: &str,
159    dry_run: bool,
160    log: &crate::log::StageLogger,
161    strict: bool,
162) -> Result<()> {
163    if dry_run {
164        log.status(&format!(
165            "(dry-run) would create tag via GitHub API: {} (\"{}\")",
166            tag, message
167        ));
168        return Ok(());
169    }
170
171    // Detect owner/repo from the origin remote.
172    let (owner, repo) = detect_github_repo()?;
173
174    // Get the current HEAD SHA to point the tag at.
175    let sha = git_output(&["rev-parse", "HEAD"])?;
176
177    // Step 1: Create the tag object
178    let body = serde_json::json!({
179        "tag": tag,
180        "message": message,
181        "object": sha,
182        "type": "commit",
183        "tagger": {
184            "name": git_output(&["config", "user.name"]).unwrap_or_else(|_| "anodizer".to_string()),
185            "email": git_output(&["config", "user.email"]).unwrap_or_else(|_| "anodizer@users.noreply.github.com".to_string()),
186            "date": chrono::Utc::now().to_rfc3339(),
187        }
188    });
189
190    let tag_endpoint = format!("/repos/{owner}/{repo}/git/tags");
191    let response = match gh_api_post(&tag_endpoint, &body) {
192        Ok(resp) => resp,
193        Err(e) => {
194            if e.to_string().contains("failed to spawn gh CLI") {
195                if strict {
196                    anyhow::bail!(
197                        "gh CLI not found, cannot create tag via GitHub API (strict mode)"
198                    );
199                }
200                log.warn("gh CLI not found, falling back to local git tag + push");
201                return create_and_push_tag(tag, message, dry_run, log, strict);
202            }
203            return Err(e);
204        }
205    };
206
207    let tag_sha = response["sha"]
208        .as_str()
209        .ok_or_else(|| anyhow::anyhow!("GitHub API response missing 'sha' field"))?;
210
211    // Step 2: Create the ref pointing to the tag object
212    let ref_body = serde_json::json!({
213        "ref": format!("refs/tags/{}", tag),
214        "sha": tag_sha,
215    });
216
217    let ref_endpoint = format!("/repos/{owner}/{repo}/git/refs");
218    gh_api_post(&ref_endpoint, &ref_body)?;
219
220    Ok(())
221}
anodizer_core/git/github_api.rs

anodizer_core/git/
github_api.rs
