Merge branch 'main' into rachit367/fix-search-context-crash

Author: brendan-kellam

.agents/skills/gh-stack/SKILL.md

@@ -0,0 +1,114 @@
+name: Check Prisma Migrations
+description: >-
+  Verify Prisma migrations apply cleanly in order and reproduce schema.prisma
+  (drift check), and that no new migration predates the latest on the base
+  branch (ordering check). Designed to be embedded in an existing job so its
+  failure turns that job's status red.
+
+inputs:
+  base-ref:
+    description: >-
+      Base git ref to diff migrations against (e.g. a PR's base branch). When
+      set, the action skips work on PRs that don't touch migrations and runs the
+      ordering check. When empty (release builds), the drift check always runs
+      and the ordering check is skipped.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Detect Prisma changes
+      id: detect
+      shell: bash
+      run: |
+        if [ -z "${{ inputs.base-ref }}" ]; then
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "No base-ref provided — running drift check unconditionally."
+          exit 0
+        fi
+        git fetch --no-tags --depth=1 origin "+refs/heads/${{ inputs.base-ref }}:refs/remotes/origin/${{ inputs.base-ref }}"
+        if git diff --name-only "origin/${{ inputs.base-ref }}" HEAD | grep -q '^packages/db/prisma/'; then
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          echo "Prisma changes detected — running migration checks."
+        else
+          echo "changed=false" >> "$GITHUB_OUTPUT"
+          echo "No Prisma changes — skipping migration checks."
+        fi
+
+    - name: Start Postgres
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      run: |
+        docker run -d --name prisma-check-pg \
+          -e POSTGRES_USER=postgres \
+          -e POSTGRES_PASSWORD=postgres \
+          -e POSTGRES_DB=sourcebot \
+          -p 5432:5432 postgres:16
+        for i in $(seq 1 30); do
+          if docker exec prisma-check-pg pg_isready -U postgres -q; then
+            echo "Postgres ready."
+            exit 0
+          fi
+          sleep 2
+        done
+        echo "Postgres failed to become ready." && exit 1
+
+    - name: Use Node.js
+      if: steps.detect.outputs.changed == 'true'
+      uses: actions/setup-node@v4
+      with:
+        node-version: "20.x"
+
+    - name: Install
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      run: yarn install --frozen-lockfile
+
+    # Check 1: migrations apply cleanly in order AND reproduce schema.prisma.
+    # `migrate deploy` fails if a migration is broken or applies out of sequence;
+    # `migrate diff` exits 2 when the applied history drifts from the schema.
+    - name: Apply migrations
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      working-directory: packages/db
+      env:
+        DATABASE_URL: postgresql://postgres:postgres@localhost:5432/sourcebot
+      run: yarn prisma migrate deploy
+
+    - name: Check for schema drift
+      if: steps.detect.outputs.changed == 'true'
+      shell: bash
+      working-directory: packages/db
+      env:
+        DATABASE_URL: postgresql://postgres:postgres@localhost:5432/sourcebot
+      run: |
+        yarn prisma migrate diff \
+          --from-url "$DATABASE_URL" \
+          --to-schema-datamodel prisma/schema.prisma \
+          --exit-code \
+        && echo "✅ No drift: migrations reproduce schema.prisma" \
+        || (echo "❌ schema.prisma has changes not captured in a migration. Run: yarn dev:prisma:migrate:dev --name <name>" && exit 1)
+
+    # Check 2 (PRs only): no new migration predates the latest on the base branch.
+    - name: Check migration ordering
+      if: steps.detect.outputs.changed == 'true' && inputs.base-ref != ''
+      shell: bash
+      run: |
+        MIG_DIR=packages/db/prisma/migrations
+        BASE="origin/${{ inputs.base-ref }}"
+        LATEST_ON_BASE=$(git ls-tree -r --name-only "$BASE" -- "$MIG_DIR" \
+          | sed -n "s#$MIG_DIR/\([0-9]\{14\}\)_.*#\1#p" | sort | tail -1)
+        echo "Latest migration on ${{ inputs.base-ref }}: ${LATEST_ON_BASE:-<none>}"
+        NEW=$(comm -23 \
+          <(ls "$MIG_DIR" | sed -n 's/^\([0-9]\{14\}\)_.*/\1/p' | sort -u) \
+          <(git ls-tree -r --name-only "$BASE" -- "$MIG_DIR" | sed -n "s#$MIG_DIR/\([0-9]\{14\}\)_.*#\1#p" | sort -u))
+        FAIL=0
+        for ts in $NEW; do
+          if [ -n "$LATEST_ON_BASE" ] && [ "$ts" -lt "$LATEST_ON_BASE" ]; then
+            echo "❌ New migration $ts predates latest migration on ${{ inputs.base-ref }} ($LATEST_ON_BASE). Rename it with a current timestamp."
+            FAIL=1
+          fi
+        done
+        [ "$FAIL" -eq 0 ] && echo "✅ Migration ordering OK"
+        exit $FAIL

.github/actions/check-prisma-migrations/action.yml

@@ -0,0 +1,22 @@
+def finding_id($prefix):
+  if ((.title // "") | startswith($prefix + " ")) then
+    (.title | ltrimstr($prefix + " ") | split(": "))
+    | if length > 1 then .[0] else "" end
+  else
+    ""
+  end;
+
+($findings[0].cves | map(.cveId)) as $currentIds
+| map(
+    . + { findingId: finding_id($prefix) }
+    | .findingId as $findingId
+    | if .findingId == "" then
+        . + { action: "ignore" }
+      elif ($skipCodeql and (.findingId | startswith("codeql:"))) then
+        . + { action: "ignore" }
+      elif ($currentIds | index($findingId)) != null then
+        . + { action: "keep" }
+      else
+        . + { action: "close" }
+      end
+  )

.github/scripts/classify-vulnerability-issues.jq

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ -z "${LINEAR_API_KEY:-}" ]]; then
+  echo "LINEAR_API_KEY is required" >&2
+  exit 1
+fi
+
+payload=$(cat)
+configured_attempts="${LINEAR_GRAPHQL_ATTEMPTS:-4}"
+retry_delay="${LINEAR_GRAPHQL_RETRY_DELAY_SECONDS:-2}"
+endpoint="${LINEAR_GRAPHQL_ENDPOINT:-https://api.linear.app/graphql}"
+is_mutation=$(jq -r '(.query // "") | test("^\\s*mutation(?:\\s|\\(|\\{)")' <<<"$payload")
+
+# Retrying a mutation after an ambiguous transport failure can replay a write
+# that Linear already committed. Queries are safe to retry; mutations fail
+# visibly after one attempt and rely on the workflow's reconciliation pass.
+if [[ "$is_mutation" == "true" ]]; then
+  attempts=1
+else
+  attempts="$configured_attempts"
+fi
+
+for ((attempt = 1; attempt <= attempts; attempt++)); do
+  response_file=$(mktemp)
+  http_code=""
+
+  if http_code=$(curl \
+    --silent \
+    --show-error \
+    --output "$response_file" \
+    --write-out '%{http_code}' \
+    --connect-timeout 10 \
+    --max-time 45 \
+    -X POST "$endpoint" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: $LINEAR_API_KEY" \
+    -d "$payload"); then
+    response=$(<"$response_file")
+    rm -f "$response_file"
+
+    if [[ "$http_code" =~ ^2[0-9][0-9]$ ]] && jq -e . >/dev/null 2>&1 <<<"$response"; then
+      printf '%s' "$response"
+      exit 0
+    fi
+
+    if [[ "$http_code" =~ ^(408|429|5[0-9][0-9])$ ]]; then
+      echo "Linear GraphQL returned transient HTTP $http_code (attempt $attempt/$attempts)." >&2
+    elif jq -e . >/dev/null 2>&1 <<<"$response"; then
+      # Preserve structured non-retryable errors so the workflow can report
+      # the GraphQL response rather than replacing it with a transport error.
+      printf '%s' "$response"
+      exit 0
+    else
+      echo "Linear GraphQL returned a non-JSON response (HTTP $http_code, attempt $attempt/$attempts)." >&2
+    fi
+  else
+    curl_status=$?
+    response=$(<"$response_file")
+    rm -f "$response_file"
+    echo "Linear GraphQL request failed (curl $curl_status, HTTP ${http_code:-unknown}, attempt $attempt/$attempts)." >&2
+  fi
+
+  if ((attempt < attempts)); then
+    sleep "$retry_delay"
+  fi
+done
+
+echo "Linear GraphQL did not return a valid JSON response after $attempts attempts." >&2
+exit 1

.github/scripts/linear-graphql-request.sh

@@ -0,0 +1,32 @@
+def finding_id($prefix):
+  if ((.title // "") | startswith($prefix + " ")) then
+    (.title | ltrimstr($prefix + " ") | split(": "))
+    | if length > 1 then .[0] else "" end
+  else
+    ""
+  end;
+
+[
+  .data.issues.nodes[]?
+  | select(finding_id($prefix) == $findingId)
+] as $matches
+| ($matches | map(select(.state.type != "completed" and .state.type != "canceled" and .state.type != "duplicate")) | .[0]) as $open
+| ($matches | map(select(.state.type == "completed" or .state.type == "canceled")) | .[0]) as $reopenable
+| ($open // $reopenable // $matches[0]) as $chosen
+| if $chosen == null then
+    {
+      linearIssueExists: false,
+      linearIssueId: "",
+      linearIssueIdentifier: "",
+      linearIssueUrl: "",
+      linearIssueClosed: false
+    }
+  else
+    {
+      linearIssueExists: true,
+      linearIssueId: $chosen.id,
+      linearIssueIdentifier: $chosen.identifier,
+      linearIssueUrl: $chosen.url,
+      linearIssueClosed: (($chosen.state.type == "completed") or ($chosen.state.type == "canceled"))
+    }
+  end