Add release immutability support to repository plugin

Author: Copilot

docs/github-settings/1. repository-settings.md

@@ -44,6 +44,8 @@ repository:
   security:
     enableVulnerabilityAlerts: true
     enableAutomatedSecurityFixes: true
+  releases:
+    immutable: true
 ```
 
 ## Repository API Spec
@@ -414,5 +416,27 @@ repository:
 ...
 ```
 
+</td></tr>
+<tr><td>
+<p><code>releases</code><span style="color:gray;">&emsp;<i>object</i>&emsp;</span></p>
+<p>Settings for releases in this repository.</p>
+
+<details><summary>Properties of <code>releases</code></summary>
+
+<br>
+<p>&emsp;<code>immutable</code><span style="color:gray;">&emsp;<i>boolean</i>&emsp;</span></p>
+<p>&emsp;&emsp;Either <code>true</code> to enable release immutability (disallow assets and tags from being modified once a release is published), or <code>false</code> to disable it.</p>
+<p>&emsp;&emsp;See <a href="https://docs.github.com/en/rest/repos/repos#enable-immutable-releases">Enable immutable releases</a> for more information.</p>
+</details>
+
+</td><td style="vertical-align:top">
+
+```yaml
+repository:
+  releases:
+    immutable: true
+...
+```
+
 </td></tr>
 </table>

docs/sample-settings/settings.yml

@@ -24,6 +24,11 @@ repository:
     enableVulnerabilityAlerts: true
     enableAutomatedSecurityFixes: true
 
+  # Settings for release immutability
+  # See https://docs.github.com/en/rest/repos/repos#enable-immutable-releases
+  releases:
+    immutable: true
+
   # Either `true` to make the repository private, or `false` to make it public.
   # If this value is changed and if org members cannot change the visibility of repos
   # it would result in an error when updating a repo

lib/plugins/repository.js

@@ -37,7 +37,8 @@ const ignorableFields = [
   'force_create',
   'auto_init',
   'repo',
-  'archived'
+  'archived',
+  'releases'
 ]
 
 module.exports = class Repository extends ErrorStash {
@@ -48,6 +49,7 @@ module.exports = class Repository extends ErrorStash {
     this.settings = Object.assign({ mediaType: { previews: ['nebula-preview'] } }, settings, repo)
     this.topics = this.settings.topics
     this.security = this.settings.security
+    this.releases = this.settings.releases
     this.repo = repo
     this.log = log
     this.nop = nop
@@ -56,6 +58,7 @@ module.exports = class Repository extends ErrorStash {
     delete this.settings.topics
     delete this.settings.force
     delete this.settings.template
+    delete this.settings.releases
   }
 
   sync () {
@@ -109,8 +112,12 @@ module.exports = class Repository extends ErrorStash {
           promises.push(updateRepoPromise.then(() => {
             return this.updateAutomatedSecurityFixes(resp.data, resArray)
           }))
+          promises.push(updateRepoPromise.then(() => {
+            return this.updateReleaseImmutability(resp.data, resArray)
+          }))
         } else {
           promises.push(this.updateSecurity(resp.data, resArray))
+          promises.push(this.updateReleaseImmutability(resp.data, resArray))
         }
         if (this.nop) {
           return Promise.resolve(resArray)
@@ -315,4 +322,34 @@ module.exports = class Repository extends ErrorStash {
       }
     }
   }
+
+  updateReleaseImmutability (repoData, resArray) {
+    if (this.releases?.immutable === true || this.releases?.immutable === false) {
+      const parms = {
+        owner: repoData.owner.login,
+        repo: repoData.name
+      }
+      if (this.releases.immutable === true) {
+        this.log.debug(`Enabling release immutability for owner: ${repoData.owner.login} and repo ${repoData.name}`)
+        if (this.nop) {
+          resArray.push(new NopCommand(this.constructor.name, this.repo, this.github.request.endpoint('PUT /repos/{owner}/{repo}/releases/immutability', parms), 'Enabling release immutability'))
+          return Promise.resolve(resArray)
+        }
+        return this.github.request('PUT /repos/{owner}/{repo}/releases/immutability', parms)
+      } else {
+        this.log.debug(`Disabling release immutability for owner: ${repoData.owner.login} and repo ${repoData.name}`)
+        if (this.nop) {
+          resArray.push(new NopCommand(this.constructor.name, this.repo, this.github.request.endpoint('DELETE /repos/{owner}/{repo}/releases/immutability', parms), 'Disabling release immutability'))
+          return Promise.resolve(resArray)
+        }
+        return this.github.request('DELETE /repos/{owner}/{repo}/releases/immutability', parms)
+      }
+    } else {
+      this.log.debug(`no need to update release immutability for ${repoData.name}`)
+      if (this.nop) {
+        return Promise.resolve([])
+      }
+      return Promise.resolve()
+    }
+  }
 }

test/unit/lib/plugins/repository.test.js

@@ -6,14 +6,18 @@ describe('Repository', () => {
       repos: {
         get: jest.fn().mockResolvedValue({
           data: {
-            topics: []
+            topics: [],
+            owner: { login: 'bkeepers' },
+            name: 'test'
           }
         }),
         update: jest.fn().mockResolvedValue(),
         replaceAllTopics: jest.fn().mockResolvedValue()
       }
-    }
+    },
+    request: jest.fn().mockResolvedValue()
   }
+  github.request.endpoint = jest.fn().mockReturnValue({})
   const log = jest.fn()
   log.debug = jest.fn()
   log.error = jest.fn()
@@ -60,7 +64,7 @@ describe('Repository', () => {
       })
     })
 
-    it.only('syncs topics', () => {
+    it('syncs topics', () => {
       const plugin = configure({
         topics: ['foo', 'bar']
       })
@@ -76,5 +80,44 @@ describe('Repository', () => {
         })
       })
     })
+
+    it('enables release immutability', () => {
+      const plugin = configure({
+        releases: { immutable: true }
+      })
+
+      return plugin.sync().then(() => {
+        expect(github.request).toHaveBeenCalledWith(
+          'PUT /repos/{owner}/{repo}/releases/immutability',
+          { owner: 'bkeepers', repo: 'test' }
+        )
+      })
+    })
+
+    it('disables release immutability', () => {
+      const plugin = configure({
+        releases: { immutable: false }
+      })
+
+      return plugin.sync().then(() => {
+        expect(github.request).toHaveBeenCalledWith(
+          'DELETE /repos/{owner}/{repo}/releases/immutability',
+          { owner: 'bkeepers', repo: 'test' }
+        )
+      })
+    })
+
+    it('does not call release immutability API when releases setting is absent', () => {
+      const plugin = configure({
+        name: 'test'
+      })
+
+      return plugin.sync().then(() => {
+        expect(github.request).not.toHaveBeenCalledWith(
+          expect.stringMatching(/releases\/immutability/),
+          expect.anything()
+        )
+      })
+    })
   })
 })