Introduce an option to use the GitHub API to commit changes, for GPG (#391)

* Create tags on GitHub using API

To allow for signed tags to be created,
rather than use the git CLI to push tags,
manually push each tag using the GitHub API,
which will sign the tag using the built-in GitHub GPG key.

* Use ghcommit to push changes

To allow for all commits to be signed,
use the GitHub API to push changes.

* Add changeset version

* Allow tag publish to fail, assume it was manually published

* Add to changeset

* Update @s0/ghcommit

* Update ghcommit to fix missing ref bug

* Make using GitHub API Optional

Change this to a minor version bump,
with a new feature that allows for using the
GitHub API to create tags and commits.

* Use a strategy pattern for GitHub API vs CLI usage

* refactor git interactions

* fix mock thing

* usechangesets pkg

* switch to `commitMode`

---------

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

src/git.ts

@@ -0,0 +1,106 @@
+import * as core from "@actions/core";
+import { exec, getExecOutput } from "@actions/exec";
+import * as github from "@actions/github";
+import { commitChangesFromRepo } from "@changesets/ghcommit/git";
+import { Octokit } from "./octokit";
+
+const push = async (branch: string, { force }: { force?: boolean } = {}) => {
+  await exec(
+    "git",
+    ["push", "origin", `HEAD:${branch}`, force && "--force"].filter<string>(
+      Boolean as any
+    )
+  );
+};
+
+const switchToMaybeExistingBranch = async (branch: string) => {
+  let { stderr } = await getExecOutput("git", ["checkout", branch], {
+    ignoreReturnCode: true,
+  });
+  let isCreatingBranch = !stderr
+    .toString()
+    .includes(`Switched to a new branch '${branch}'`);
+  if (isCreatingBranch) {
+    await exec("git", ["checkout", "-b", branch]);
+  }
+};
+
+const reset = async (
+  pathSpec: string,
+  mode: "hard" | "soft" | "mixed" = "hard"
+) => {
+  await exec("git", ["reset", `--${mode}`, pathSpec]);
+};
+
+const commitAll = async (message: string) => {
+  await exec("git", ["add", "."]);
+  await exec("git", ["commit", "-m", message]);
+};
+
+const checkIfClean = async (): Promise<boolean> => {
+  const { stdout } = await getExecOutput("git", ["status", "--porcelain"]);
+  return !stdout.length;
+};
+
+export class Git {
+  octokit;
+  constructor(octokit?: Octokit) {
+    this.octokit = octokit;
+  }
+
+  async setupUser() {
+    if (this.octokit) {
+      return;
+    }
+    await exec("git", ["config", "user.name", `"github-actions[bot]"`]);
+    await exec("git", [
+      "config",
+      "user.email",
+      `"41898282+github-actions[bot]@users.noreply.github.com"`,
+    ]);
+  }
+
+  async pushTag(tag: string) {
+    if (this.octokit) {
+      return this.octokit.rest.git
+        .createRef({
+          ...github.context.repo,
+          ref: `refs/tags/${tag}`,
+          sha: github.context.sha,
+        })
+        .catch((err) => {
+          // Assuming tag was manually pushed in custom publish script
+          core.warning(`Failed to create tag ${tag}: ${err.message}`);
+        });
+    }
+    await exec("git", ["push", "origin", tag]);
+  }
+
+  async prepareBranch(branch: string) {
+    if (this.octokit) {
+      // Preparing a new local branch is not necessary when using the API
+      return;
+    }
+    await switchToMaybeExistingBranch(branch);
+    await reset(github.context.sha);
+  }
+
+  async pushChanges({ branch, message }: { branch: string; message: string }) {
+    if (this.octokit) {
+      return commitChangesFromRepo({
+        octokit: this.octokit,
+        ...github.context.repo,
+        branch,
+        message,
+        base: {
+          commit: github.context.sha,
+        },
+        force: true,
+      });
+    }
+    if (!(await checkIfClean())) {
+      await commitAll(message);
+    }
+    await push(branch, { force: true });
+  }
+}

src/gitUtils.ts

@@ -1,63 +0,0 @@
-import { exec, getExecOutput } from "@actions/exec";
-
-export const setupUser = async () => {
-  await exec("git", [
-    "config",
-    "user.name",
-    `"github-actions[bot]"`,
-  ]);
-  await exec("git", [
-    "config",
-    "user.email",
-    `"41898282+github-actions[bot]@users.noreply.github.com"`,
-  ]);
-};
-
-export const pullBranch = async (branch: string) => {
-  await exec("git", ["pull", "origin", branch]);
-};
-
-export const push = async (
-  branch: string,
-  { force }: { force?: boolean } = {}
-) => {
-  await exec(
-    "git",
-    ["push", "origin", `HEAD:${branch}`, force && "--force"].filter<string>(
-      Boolean as any
-    )
-  );
-};
-
-export const pushTags = async () => {
-  await exec("git", ["push", "origin", "--tags"]);
-};
-
-export const switchToMaybeExistingBranch = async (branch: string) => {
-  let { stderr } = await getExecOutput("git", ["checkout", branch], {
-    ignoreReturnCode: true,
-  });
-  let isCreatingBranch = !stderr
-    .toString()
-    .includes(`Switched to a new branch '${branch}'`);
-  if (isCreatingBranch) {
-    await exec("git", ["checkout", "-b", branch]);
-  }
-};
-
-export const reset = async (
-  pathSpec: string,
-  mode: "hard" | "soft" | "mixed" = "hard"
-) => {
-  await exec("git", ["reset", `--${mode}`, pathSpec]);
-};
-
-export const commitAll = async (message: string) => {
-  await exec("git", ["add", "."]);
-  await exec("git", ["commit", "-m", message]);
-};
-
-export const checkIfClean = async (): Promise<boolean> => {
-  const { stdout } = await getExecOutput("git", ["status", "--porcelain"]);
-  return !stdout.length;
-};

src/index.ts

@@ -1,8 +1,9 @@
 import * as core from "@actions/core";
 import fs from "fs-extra";
-import * as gitUtils from "./gitUtils";
-import { runPublish, runVersion } from "./run";
+import { Git } from "./git";
+import { setupOctokit } from "./octokit";
 import readChangesetState from "./readChangesetState";
+import { runPublish, runVersion } from "./run";
 
 const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
@@ -20,11 +21,19 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
     process.chdir(inputCwd);
   }
 
+  const octokit = setupOctokit(githubToken);
+  const commitMode = getOptionalInput("commitMode") ?? "git-cli";
+  if (commitMode !== "git-cli" && commitMode !== "github-api") {
+    core.setFailed(`Invalid commit mode: ${commitMode}`);
+    return;
+  }
+  const git = new Git(commitMode === "github-api" ? octokit : undefined);
+
   let setupGitUser = core.getBooleanInput("setupGitUser");
 
   if (setupGitUser) {
     core.info("setting git user");
-    await gitUtils.setupUser();
+    await git.setupUser();
   }
 
   core.info("setting GitHub credentials");
@@ -48,7 +57,9 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
   switch (true) {
     case !hasChangesets && !hasPublishScript:
-      core.info("No changesets present or were removed by merging release PR. Not publishing because no publish script found.");
+      core.info(
+        "No changesets present or were removed by merging release PR. Not publishing because no publish script found."
+      );
       return;
     case !hasChangesets && hasPublishScript: {
       core.info(
@@ -86,7 +97,8 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
 
       const result = await runPublish({
         script: publishScript,
-        githubToken,
+        git,
+        octokit,
         createGithubReleases: core.getBooleanInput("createGithubReleases"),
       });
 
@@ -102,10 +114,12 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
     case hasChangesets && !hasNonEmptyChangesets:
       core.info("All changesets are empty; not creating PR");
       return;
-    case hasChangesets:
+    case hasChangesets: {
+      const octokit = setupOctokit(githubToken);
       const { pullRequestNumber } = await runVersion({
         script: getOptionalInput("version"),
-        githubToken,
+        git,
+        octokit,
         prTitle: getOptionalInput("title"),
         commitMessage: getOptionalInput("commit"),
         hasPublishScript,
@@ -115,6 +129,7 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
       core.setOutput("pullRequestNumber", String(pullRequestNumber));
 
       return;
+    }
   }
 })().catch((err) => {
   core.error(err);

src/octokit.ts

@@ -0,0 +1,39 @@
+import * as core from "@actions/core";
+import { GitHub, getOctokitOptions } from "@actions/github/lib/utils";
+import { throttling } from "@octokit/plugin-throttling";
+
+export const setupOctokit = (githubToken: string) => {
+  return new (GitHub.plugin(throttling))(
+    getOctokitOptions(githubToken, {
+      throttle: {
+        onRateLimit: (retryAfter, options: any, octokit, retryCount) => {
+          core.warning(
+            `Request quota exhausted for request ${options.method} ${options.url}`
+          );
+
+          if (retryCount <= 2) {
+            core.info(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+        onSecondaryRateLimit: (
+          retryAfter,
+          options: any,
+          octokit,
+          retryCount
+        ) => {
+          core.warning(
+            `SecondaryRateLimit detected for request ${options.method} ${options.url}`
+          );
+
+          if (retryCount <= 2) {
+            core.info(`Retrying after ${retryAfter} seconds!`);
+            return true;
+          }
+        },
+      },
+    })
+  );
+};
+
+export type Octokit = ReturnType<typeof setupOctokit>;

src/run.test.ts

@@ -1,10 +1,10 @@
+import { Changeset } from "@changesets/types";
+import writeChangeset from "@changesets/write";
 import fixturez from "fixturez";
-import * as github from "@actions/github";
-import * as githubUtils from "@actions/github/lib/utils";
 import fs from "fs-extra";
 import path from "path";
-import writeChangeset from "@changesets/write";
-import { Changeset } from "@changesets/types";
+import { Git } from "./git";
+import { setupOctokit } from "./octokit";
 import { runVersion } from "./run";
 
 jest.mock("@actions/github", () => ({
@@ -18,19 +18,20 @@ jest.mock("@actions/github", () => ({
   },
 }));
 jest.mock("@actions/github/lib/utils", () => ({
-    GitHub: {
-        plugin: () => {
-            // function necessary to be used as constructor
-            return function() {
-                return {
-                    rest: mockedGithubMethods,
-                }
-            }
-        },
+  GitHub: {
+    plugin: () => {
+      // function necessary to be used as constructor
+      return function () {
+        return {
+          rest: mockedGithubMethods,
+        };
+      };
     },
-    getOctokitOptions: jest.fn(),
+  },
+  getOctokitOptions: jest.fn(),
 }));
-jest.mock("./gitUtils");
+jest.mock("./git");
+jest.mock("@changesets/ghcommit/git");
 
 let mockedGithubMethods = {
   pulls: {
@@ -89,7 +90,8 @@ describe("version", () => {
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      git: new Git(),
       cwd,
     });
 
@@ -122,7 +124,8 @@ describe("version", () => {
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      git: new Git(),
       cwd,
     });
 
@@ -155,7 +158,8 @@ describe("version", () => {
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      git: new Git(),
       cwd,
     });
 
@@ -208,7 +212,8 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      git: new Git(),
       cwd,
       prBodyMaxCharacters: 1000,
     });
@@ -265,7 +270,8 @@ fluminis divesque vulnere aquis parce lapsis rabie si visa fulmineis.
     );
 
     await runVersion({
-      githubToken: "@@GITHUB_TOKEN",
+      octokit: setupOctokit("@@GITHUB_TOKEN"),
+      git: new Git(),
       cwd,
       prBodyMaxCharacters: 500,
     });

src/run.ts

@@ -1,22 +1,21 @@
-import { exec, getExecOutput } from "@actions/exec";
-import { GitHub, getOctokitOptions } from "@actions/github/lib/utils";
-import * as github from "@actions/github";
 import * as core from "@actions/core";
-import fs from "fs-extra";
-import { getPackages, Package } from "@manypkg/get-packages";
-import path from "path";
-import * as semver from "semver";
+import { exec, getExecOutput } from "@actions/exec";
+import * as github from "@actions/github";
 import { PreState } from "@changesets/types";
-import {
-  getChangelogEntry,
-  getChangedPackages,
-  sortTheThings,
-  getVersionsByDirectory,
-} from "./utils";
-import * as gitUtils from "./gitUtils";
-import readChangesetState from "./readChangesetState";
+import { Package, getPackages } from "@manypkg/get-packages";
+import fs from "fs-extra";
+import path from "path";
 import resolveFrom from "resolve-from";
-import { throttling } from "@octokit/plugin-throttling";
+import * as semver from "semver";
+import { Git } from "./git";
+import { Octokit } from "./octokit";
+import readChangesetState from "./readChangesetState";
+import {
+  getChangedPackages,
+  getChangelogEntry,
+  getVersionsByDirectory,
+  sortTheThings,
+} from "./utils";
 
 // GitHub Issues/PRs messages have a max size limit on the
 // message body payload.
@@ -24,42 +23,8 @@ import { throttling } from "@octokit/plugin-throttling";
 // To avoid that, we ensure to cap the message to 60k chars.
 const MAX_CHARACTERS_PER_MESSAGE = 60000;
 
-const setupOctokit = (githubToken: string) => {
-  return new (GitHub.plugin(throttling))(
-    getOctokitOptions(githubToken, {
-      throttle: {
-        onRateLimit: (retryAfter, options: any, octokit, retryCount) => {
-          core.warning(
-            `Request quota exhausted for request ${options.method} ${options.url}`
-          );
-
-          if (retryCount <= 2) {
-            core.info(`Retrying after ${retryAfter} seconds!`);
-            return true;
-          }
-        },
-        onSecondaryRateLimit: (
-          retryAfter,
-          options: any,
-          octokit,
-          retryCount
-        ) => {
-          core.warning(
-            `SecondaryRateLimit detected for request ${options.method} ${options.url}`
-          );
-
-          if (retryCount <= 2) {
-            core.info(`Retrying after ${retryAfter} seconds!`);
-            return true;
-          }
-        },
-      },
-    })
-  );
-};
-
 const createRelease = async (
-  octokit: ReturnType<typeof setupOctokit>,
+  octokit: Octokit,
   { pkg, tagName }: { pkg: Package; tagName: string }
 ) => {
   try {
@@ -98,8 +63,9 @@ const createRelease = async (
 
 type PublishOptions = {
   script: string;
-  githubToken: string;
+  octokit: Octokit;
   createGithubReleases: boolean;
+  git: Git;
   cwd?: string;
 };
 
@@ -116,12 +82,11 @@ type PublishResult =
 
 export async function runPublish({
   script,
-  githubToken,
+  git,
+  octokit,
   createGithubReleases,
   cwd = process.cwd(),
 }: PublishOptions): Promise<PublishResult> {
-  const octokit = setupOctokit(githubToken);
-
   let [publishCommand, ...publishArgs] = script.split(/\s+/);
 
   let changesetPublishOutput = await getExecOutput(
@@ -130,8 +95,6 @@ export async function runPublish({
     { cwd }
   );
 
-  await gitUtils.pushTags();
-
   let { packages, tool } = await getPackages(cwd);
   let releasedPackages: Package[] = [];
 
@@ -157,12 +120,11 @@ export async function runPublish({
 
     if (createGithubReleases) {
       await Promise.all(
-        releasedPackages.map((pkg) =>
-          createRelease(octokit, {
-            pkg,
-            tagName: `${pkg.packageJson.name}@${pkg.packageJson.version}`,
-          })
-        )
+        releasedPackages.map(async (pkg) => {
+          const tagName = `${pkg.packageJson.name}@${pkg.packageJson.version}`;
+          await git.pushTag(tagName);
+          await createRelease(octokit, { pkg, tagName });
+        })
       );
     }
   } else {
@@ -181,10 +143,9 @@ export async function runPublish({
       if (match) {
         releasedPackages.push(pkg);
         if (createGithubReleases) {
-          await createRelease(octokit, {
-            pkg,
-            tagName: `v${pkg.packageJson.version}`,
-          });
+          const tagName = `v${pkg.packageJson.version}`;
+          await git.pushTag(tagName);
+          await createRelease(octokit, { pkg, tagName });
         }
         break;
       }
@@ -293,7 +254,8 @@ export async function getVersionPrBody({
 
 type VersionOptions = {
   script?: string;
-  githubToken: string;
+  git: Git;
+  octokit: Octokit;
   cwd?: string;
   prTitle?: string;
   commitMessage?: string;
@@ -308,23 +270,20 @@ type RunVersionResult = {
 
 export async function runVersion({
   script,
-  githubToken,
+  git,
+  octokit,
   cwd = process.cwd(),
   prTitle = "Version Packages",
   commitMessage = "Version Packages",
   hasPublishScript = false,
   prBodyMaxCharacters = MAX_CHARACTERS_PER_MESSAGE,
-  branch,
+  branch = github.context.ref.replace("refs/heads/", ""),
 }: VersionOptions): Promise<RunVersionResult> {
-  const octokit = setupOctokit(githubToken);
-
-  branch = branch ?? github.context.ref.replace("refs/heads/", "");
   let versionBranch = `changeset-release/${branch}`;
 
   let { preState } = await readChangesetState(cwd);
 
-  await gitUtils.switchToMaybeExistingBranch(versionBranch);
-  await gitUtils.reset(github.context.sha);
+  await git.prepareBranch(versionBranch);
 
   let versionsByDirectory = await getVersionsByDirectory(cwd);
 
@@ -366,16 +325,11 @@ export async function runVersion({
   );
 
   const finalPrTitle = `${prTitle}${!!preState ? ` (${preState.tag})` : ""}`;
+  const finalCommitMessage = `${commitMessage}${
+    !!preState ? ` (${preState.tag})` : ""
+  }`;
 
-  // project with `commit: true` setting could have already committed files
-  if (!(await gitUtils.checkIfClean())) {
-    const finalCommitMessage = `${commitMessage}${
-      !!preState ? ` (${preState.tag})` : ""
-    }`;
-    await gitUtils.commitAll(finalCommitMessage);
-  }
-
-  await gitUtils.push(versionBranch, { force: true });
+  await git.pushChanges({ branch: versionBranch, message: finalCommitMessage });
 
   let existingPullRequests = await existingPullRequestsPromise;
   core.info(JSON.stringify(existingPullRequests.data, null, 2));