Skip to content

ghas-setup: 既存 config lookup の --slurp+--jq 併用エラーを修正 #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mackato merged 1 commit into from
Jun 3, 2026
Merged

ghas-setup: 既存 config lookup の --slurp+--jq 併用エラーを修正 #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 96 additions & 0 deletions devbox.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,54 @@
}
}
},
"gh@2": {
"last_modified": "2026-05-21T08:15:18Z",
"resolved": "github:NixOS/nixpkgs/4a29d733e8a7d5b824c3d8c958a946a9867b3eb2#gh",
"source": "devbox-search",
"version": "2.92.0",
"systems": {
"aarch64-darwin": {
"outputs": [
{
"name": "out",
"path": "/nix/store/2wapk3dm2magc0lq8rx8yd5pam3xlacw-gh-2.92.0",
"default": true
}
],
"store_path": "/nix/store/2wapk3dm2magc0lq8rx8yd5pam3xlacw-gh-2.92.0"
},
"aarch64-linux": {
"outputs": [
{
"name": "out",
"path": "/nix/store/63sx2manc3ny8l4zzppcvz9292vi3044-gh-2.92.0",
"default": true
}
],
"store_path": "/nix/store/63sx2manc3ny8l4zzppcvz9292vi3044-gh-2.92.0"
},
"x86_64-darwin": {
"outputs": [
{
"name": "out",
"path": "/nix/store/arfkhrr2bcmdrg6ncgnk6vaqx6qfv3vl-gh-2.92.0",
"default": true
}
],
"store_path": "/nix/store/arfkhrr2bcmdrg6ncgnk6vaqx6qfv3vl-gh-2.92.0"
},
"x86_64-linux": {
"outputs": [
{
"name": "out",
"path": "/nix/store/d0r9xzcpv8xcjds6z1w03wyqi6iv30af-gh-2.92.0",
"default": true
}
],
"store_path": "/nix/store/d0r9xzcpv8xcjds6z1w03wyqi6iv30af-gh-2.92.0"
}
}
},
"git@2": {
"last_modified": "2026-05-21T08:15:18Z",
"resolved": "github:NixOS/nixpkgs/4a29d733e8a7d5b824c3d8c958a946a9867b3eb2#git",
Expand Down Expand Up @@ -496,6 +544,54 @@
"store_path": "/nix/store/v5wmprihi3ywkh9ksdvwgiixrxj29r66-statix-0-unstable-2026-05-14"
}
}
},
"yq-go@4": {
"last_modified": "2026-05-21T08:15:18Z",
"resolved": "github:NixOS/nixpkgs/4a29d733e8a7d5b824c3d8c958a946a9867b3eb2#yq-go",
"source": "devbox-search",
"version": "4.53.2",
"systems": {
"aarch64-darwin": {
"outputs": [
{
"name": "out",
"path": "/nix/store/ffkx6855qiv6004asmckjqwcq6dvc32q-yq-go-4.53.2",
"default": true
}
],
"store_path": "/nix/store/ffkx6855qiv6004asmckjqwcq6dvc32q-yq-go-4.53.2"
},
"aarch64-linux": {
"outputs": [
{
"name": "out",
"path": "/nix/store/3hsajqhhm8m9nx306jh09m1qz4idwmxk-yq-go-4.53.2",
"default": true
}
],
"store_path": "/nix/store/3hsajqhhm8m9nx306jh09m1qz4idwmxk-yq-go-4.53.2"
},
"x86_64-darwin": {
"outputs": [
{
"name": "out",
"path": "/nix/store/mh9wimc8ddgqag0ma18izcd08bkldk1a-yq-go-4.53.2",
"default": true
}
],
"store_path": "/nix/store/mh9wimc8ddgqag0ma18izcd08bkldk1a-yq-go-4.53.2"
},
"x86_64-linux": {
"outputs": [
{
"name": "out",
"path": "/nix/store/pibhm258wp416plqdaxym4z6lis8ksla-yq-go-4.53.2",
"default": true
}
],
"store_path": "/nix/store/pibhm258wp416plqdaxym4z6lis8ksla-yq-go-4.53.2"
}
}
}
}
}
13 changes: 7 additions & 6 deletions pkgs/ghas-setup/ghas-setup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,12 +108,13 @@ gh auth status -h github.com 2>&1 | grep -q "admin:org" || {
echo "==> $ORG org の code security configuration を有効化します"

# 既存 configuration を name で lookup（冪等化のため）。configuration が 30 件（既定 per_page）を
# 超えても取りこぼさないよう --paginate で全件取得する。--slurp で全ページを 1 つの配列にまとめ、
# jq 側で最初の一致 id を取り出す（`| head -n1` だと pagination 途中で stdout が閉じ、gh が SIGPIPE
# で非 0 終了して set -o pipefail がスクリプト全体を落としうるため使わない）。
# name は config 由来の文字列なので jq 式に直埋めせず env 経由で渡す（" や \ を含んでも壊れない）。
CONFIG_ID=$(GHAS_CONFIG_NAME="$CONFIG_NAME" gh api --paginate --slurp "/orgs/$ORG/code-security/configurations" \
--jq '[.[][] | select(.name == env.GHAS_CONFIG_NAME) | .id] | .[0] // ""')
# 超えても取りこぼさないよう --paginate で全ページ取得し、--jq をページごとに適用して一致 id を出す
# （--slurp は --jq と併用不可なため使わない）。出力は `head` でパイプ切断せずコマンド置換で全量
# 受け取り、複数行になっても先頭行のみ採用する（パイプ切断による SIGPIPE + set -o pipefail での
# 誤失敗を避ける）。name は config 由来なので jq 式に直埋めせず env 経由で渡す（" や \ でも壊れない）。
CONFIG_ID=$(GHAS_CONFIG_NAME="$CONFIG_NAME" gh api --paginate "/orgs/$ORG/code-security/configurations" \
--jq '.[] | select(.name == env.GHAS_CONFIG_NAME) | .id')
CONFIG_ID=${CONFIG_ID%%$'\n'*}

if [ -z "$CONFIG_ID" ]; then
echo " - configuration を新規作成: $CONFIG_NAME"
Expand Down
22 changes: 18 additions & 4 deletions pkgs/ghas-setup/tests/ghas-setup.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,12 @@ EOF
}

# gh をスタブする。呼び出し引数を $GH_LOG に記録し、種別ごとに想定 stdout を返す:
# - auth status : "admin:org" を出力（scope 判定の grep 用）/ exit 0
# - api（--slurp あり） : 既存 lookup。$1（""=新規, それ以外=既存 id）を返す
# - auth status : "admin:org" を出力（scope 判定の grep 用）/ exit 0
# - api（--paginate=lookup） : 既存 lookup。$1（""=新規, それ以外=既存 id）を返す
# - api（POST で末尾が /configurations）: 新規作成。固定 id 123 を返す
# - その他 api : 読み戻し等。{} を返す
# - その他 api : 読み戻し等。{} を返す
# 併せて実 gh の制約「--slurp は --jq と併用不可」を再現し、両指定なら非 0 終了する
# （この組み合わせの regression を検知するため）。
make_gh_stub() {
STUB_DIR="$BASE/stubbin"
GH_LOG="$BASE/gh-calls.log"
Expand All @@ -58,7 +60,19 @@ echo "\$*" >> "$GH_LOG"
case "\$1" in
auth) echo "admin:org"; exit 0 ;;
api)
for a in "\$@"; do [ "\$a" = "--slurp" ] && { printf '%s' "$1"; exit 0; }; done
has_slurp=0; has_jq=0; has_paginate=0
for a in "\$@"; do
case "\$a" in
--slurp) has_slurp=1 ;;
--jq|-q) has_jq=1 ;;
--paginate) has_paginate=1 ;;
esac
done
if [ "\$has_slurp" = 1 ] && [ "\$has_jq" = 1 ]; then
echo "the \`--slurp\` option is not supported with \`--jq\` or \`--template\`" >&2
exit 1
fi
[ "\$has_paginate" = 1 ] && { printf '%s' "$1"; exit 0; }
case "\$*" in
*"--method POST"*"/code-security/configurations "*) printf '123'; exit 0 ;;
esac
Expand Down