Merge branch 'Expensify:main' into fix/66381-part-3

Author: truph01

.claude/schemas/code-review-output.json

@@ -11532,26 +11532,31 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 const core = __importStar(__nccwpck_require__(2186));
+const CONST_1 = __importDefault(__nccwpck_require__(9873));
 const DeployChecklistUtils_1 = __nccwpck_require__(2141);
 const run = function () {
     return (0, DeployChecklistUtils_1.getDeployChecklist)()
         .then(({ labels, number }) => {
-        const labelsNames = labels.map((label) => {
-            if (typeof label === 'string') {
-                return '';
-            }
-            return label.name;
-        });
-        console.log(`Found deploy checklist with labels: ${JSON.stringify(labelsNames)}`);
-        core.setOutput('IS_LOCKED', labelsNames.includes('🔐 LockCashDeploys 🔐'));
+        const labelNames = (labels ?? []).map((label) => (typeof label === 'string' ? label : (label.name ?? '')));
+        const isLocked = labelNames.includes(CONST_1.default.LABELS.LOCK_DEPLOY);
+        console.log(`Found deploy checklist #${number} with labels: ${JSON.stringify(labelNames)}`);
+        core.setOutput('IS_LOCKED', isLocked);
         core.setOutput('NUMBER', number);
     })
-        .catch((err) => {
-        console.warn('No open deploy checklist found, continuing...', err);
-        core.setOutput('IS_LOCKED', false);
-        core.setOutput('NUMBER', 0);
+        .catch((error) => {
+        if (error instanceof DeployChecklistUtils_1.NoOpenDeployChecklistError) {
+            console.log(`No open deploy checklist; treating as not locked. ${error.message}`);
+            core.setOutput('IS_LOCKED', false);
+            core.setOutput('NUMBER', 0);
+            return;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        core.setFailed(`Could not resolve deploy checklist; blocking deploy: ${message}`);
     });
 };
 if (require.main === require.cache[eval('__filename')]) {
@@ -11650,13 +11655,50 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.NoOpenDeployChecklistError = void 0;
 exports.getDeployChecklist = getDeployChecklist;
 exports.getDeployChecklistData = getDeployChecklistData;
 exports.generateDeployChecklistBodyAndAssignees = generateDeployChecklistBodyAndAssignees;
 exports.parseChecklistSection = parseChecklistSection;
 const dedent_1 = __importDefault(__nccwpck_require__(6762));
 const CONST_1 = __importDefault(__nccwpck_require__(9873));
 const GithubUtils_1 = __importDefault(__nccwpck_require__(9296));
+/** Milliseconds to wait before each subsequent `listForRepo` attempt. */
+const LIST_RETRY_DELAYS_MS = [2000, 5000];
+/**
+ * HTTP statuses that indicate a definitively-permanent failure of `listForRepo` -
+ * retrying cannot help (auth, missing resource, validation). Note that `403` is
+ * intentionally absent because GitHub returns secondary-rate-limit and abuse
+ * detection responses as `403` and those should be retried with backoff.
+ */
+const NON_RETRYABLE_LIST_STATUSES = new Set([401, 404, 422]);
+/**
+ * Duck-type check for "this error is a permanent failure from `listForRepo`".
+ * We avoid `instanceof RequestError` because the bundled action ends up with
+ * multiple copies of that class (one from `@octokit/request-error` directly,
+ * one nested via `@actions/github` -> `@octokit/core`) and `instanceof`
+ * compares identity, so it can miss real errors thrown by octokit.
+ */
+function isPermanentListError(error) {
+    if (typeof error !== 'object' || error === null || !('status' in error)) {
+        return false;
+    }
+    const status = error.status;
+    return typeof status === 'number' && NON_RETRYABLE_LIST_STATUSES.has(status);
+}
+/**
+ * Thrown by `getDeployChecklist` when GitHub successfully confirms there is no open
+ * StagingDeployCash issue and the most recent checklist is closed - i.e. we're in the
+ * legitimate window between deploy cycles. Callers that need to distinguish "benign
+ * empty" from "could not resolve" should catch this specific subclass.
+ */
+class NoOpenDeployChecklistError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NoOpenDeployChecklistError';
+    }
+}
+exports.NoOpenDeployChecklistError = NoOpenDeployChecklistError;
 /**
  * Generic checklist section parser. Extracts a section from the issue body,
  * parses checkbox items within it, and returns ChecklistItems sorted by number.
@@ -11692,24 +11734,75 @@ function getDeployChecklistDeployBlockers(issue) {
 function getDeployChecklistInternalQA(issue) {
     return parseChecklistSection(issue.body, /Internal QA:\*\*\r?\n((?:- \[[ x]].*\r?\n)+)/, new RegExp(`- \\[([ x])]\\s(${CONST_1.default.PULL_REQUEST_REGEX.source})`, 'g'), (url) => url.split('-').at(0)?.trim() ?? '');
 }
+/**
+ * Calls `issues.listForRepo` with simple retry-on-throw. Retries 1 + `LIST_RETRY_DELAYS_MS.length`
+ * times total, sleeping the corresponding delay between attempts. Empty results are NOT retried -
+ * the caller must decide whether an empty list is legitimate. Permanent statuses listed in
+ * `NON_RETRYABLE_LIST_STATUSES` short-circuit and re-throw on the first attempt.
+ */
+async function listForRepoWithRetry(params) {
+    let lastError;
+    const maxAttempts = LIST_RETRY_DELAYS_MS.length + 1;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            const { data } = await GithubUtils_1.default.octokit.issues.listForRepo(params);
+            return data;
+        }
+        catch (error) {
+            lastError = error;
+            if (isPermanentListError(error)) {
+                console.warn(`listForRepo failed with permanent status ${error.status}; not retrying`, error);
+                throw error;
+            }
+            const delay = LIST_RETRY_DELAYS_MS.at(attempt - 1);
+            if (delay === undefined) {
+                throw error;
+            }
+            console.warn(`listForRepo attempt ${attempt}/${maxAttempts} failed; retrying in ${delay}ms`, error);
+            await new Promise((resolve) => {
+                setTimeout(resolve, delay);
+            });
+        }
+    }
+    throw lastError;
+}
 async function getDeployChecklist() {
-    const { data } = await GithubUtils_1.default.octokit.issues.listForRepo({
+    const openIssues = await listForRepoWithRetry({
         owner: CONST_1.default.GITHUB_OWNER,
         repo: CONST_1.default.APP_REPO,
         labels: CONST_1.default.LABELS.STAGING_DEPLOY,
         state: 'open',
     });
-    if (!data.length) {
-        throw new Error(`Unable to find ${CONST_1.default.LABELS.STAGING_DEPLOY} issue.`);
+    if (openIssues.length > 1) {
+        throw new Error(`Found more than one open ${CONST_1.default.LABELS.STAGING_DEPLOY} issue: #${openIssues.map((issue) => issue.number).join(', #')}.`);
+    }
+    if (openIssues.length === 1) {
+        const issue = openIssues.at(0);
+        if (!issue) {
+            throw new Error(`Found an undefined ${CONST_1.default.LABELS.STAGING_DEPLOY} issue.`);
+        }
+        return getDeployChecklistData(issue);
     }
-    if (data.length > 1) {
-        throw new Error(`Found more than one ${CONST_1.default.LABELS.STAGING_DEPLOY} issue.`);
+    // The filtered open list was empty. Cross-check against state:'all' to tell
+    // a legitimate between-cycles window apart from an API inconsistency. Any open
+    // issue anywhere in the response - not just the most recent - blocks the deploy,
+    // so a stale older issue that got reopened cannot slip through.
+    const allIssues = await listForRepoWithRetry({
+        owner: CONST_1.default.GITHUB_OWNER,
+        repo: CONST_1.default.APP_REPO,
+        labels: CONST_1.default.LABELS.STAGING_DEPLOY,
+        state: 'all',
+    });
+    if (allIssues.length === 0) {
+        // The label has been in continuous use; an empty state:'all' result is pathological.
+        throw new Error(`No ${CONST_1.default.LABELS.STAGING_DEPLOY} issues found at all (state:'all' returned empty). Refusing to deploy.`);
     }
-    const issue = data.at(0);
-    if (!issue) {
-        throw new Error(`Found an undefined ${CONST_1.default.LABELS.STAGING_DEPLOY} issue.`);
+    const openIssuesInAll = allIssues.filter((issue) => issue.state === 'open');
+    if (openIssuesInAll.length > 0) {
+        throw new Error(`Inconsistent GitHub response: state:open returned empty but state:all reports open ${CONST_1.default.LABELS.STAGING_DEPLOY} issue(s) #${openIssuesInAll.map((issue) => issue.number).join(', #')}. Refusing to deploy.`);
     }
-    return getDeployChecklistData(issue);
+    const mostRecent = allIssues.at(0);
+    throw new NoOpenDeployChecklistError(`No open ${CONST_1.default.LABELS.STAGING_DEPLOY} issue (most recent #${mostRecent?.number} is closed).`);
 }
 function getDeployChecklistData(issue) {
     try {

.claude/scripts/addPrReaction.sh

@@ -1,23 +1,25 @@
 import * as core from '@actions/core';
-import {getDeployChecklist} from '@github/libs/DeployChecklistUtils';
+import CONST from '@github/libs/CONST';
+import {getDeployChecklist, NoOpenDeployChecklistError} from '@github/libs/DeployChecklistUtils';
 
 const run = function (): Promise<void> {
     return getDeployChecklist()
         .then(({labels, number}) => {
-            const labelsNames = labels.map((label) => {
-                if (typeof label === 'string') {
-                    return '';
-                }
-                return label.name;
-            });
-            console.log(`Found deploy checklist with labels: ${JSON.stringify(labelsNames)}`);
-            core.setOutput('IS_LOCKED', labelsNames.includes('🔐 LockCashDeploys 🔐'));
+            const labelNames = (labels ?? []).map((label) => (typeof label === 'string' ? label : (label.name ?? '')));
+            const isLocked = labelNames.includes(CONST.LABELS.LOCK_DEPLOY);
+            console.log(`Found deploy checklist #${number} with labels: ${JSON.stringify(labelNames)}`);
+            core.setOutput('IS_LOCKED', isLocked);
             core.setOutput('NUMBER', number);
         })
-        .catch((err) => {
-            console.warn('No open deploy checklist found, continuing...', err);
-            core.setOutput('IS_LOCKED', false);
-            core.setOutput('NUMBER', 0);
+        .catch((error: unknown) => {
+            if (error instanceof NoOpenDeployChecklistError) {
+                console.log(`No open deploy checklist; treating as not locked. ${error.message}`);
+                core.setOutput('IS_LOCKED', false);
+                core.setOutput('NUMBER', 0);
+                return;
+            }
+            const message = error instanceof Error ? error.message : String(error);
+            core.setFailed(`Could not resolve deploy checklist; blocking deploy: ${message}`);
         });
 };
 

.claude/scripts/createInlineComment.sh

@@ -1,5 +1,5 @@
-name: "Mark Pull Requests as Deployed"
-description: "Mark pull requests as deployed on production or staging"
+name: "postOrReplaceComment"
+description: "Post a test build or custom pull request comment, hiding the previous matching comment"
 inputs:
     REPO:
         description: "Repository to place a comment. Can be App or Mobile-Expensify"
@@ -31,6 +31,12 @@ inputs:
     WEB_LINK:
         description: "Link for the web build"
         required: false
+    COMMENT_BODY:
+        description: "Custom comment body. When provided, posts this comment instead of the test build message"
+        required: false
+    COMMENT_PREFIX:
+        description: "Prefix used to find and hide the previous matching comment"
+        required: true
 runs:
     using: "node24"
     main: "./index.js"