📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/tools/scripts/pr_preflight.cjs

@@ -5,10 +5,13 @@ const path = require("path");
 const { spawnSync } = require("child_process");
 const sanitizeFilename = require("sanitize-filename");
 
+const { resolveBlobSizes } = require("../lib/git-blob-sizes");
 const { findProjectRoot } = require("../lib/project-root");
 const { parseRawDiff } = require("../lib/git-raw-diff");
 const {
+  classifyChangeRecords,
   classifyChangedFiles,
+  classifyShadowImpact,
   getDirectDerivedChanges,
   hasIssueLink,
   hasQualityChecklist,
@@ -19,10 +22,12 @@ const {
 
 function parseArgs(argv) {
   const args = {
+    repo: null,
     base: null,
     head: "HEAD",
     eventPath: null,
     checkPolicy: false,
+    checkForkSafety: false,
     noRun: false,
     writeGithubOutput: false,
     writeStepSummary: false,
@@ -31,7 +36,10 @@ function parseArgs(argv) {
 
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
-    if (arg === "--base") {
+    if (arg === "--repo") {
+      args.repo = argv[index + 1] || null;
+      index += 1;
+    } else if (arg === "--base") {
       args.base = argv[index + 1];
       index += 1;
     } else if (arg === "--head") {
@@ -42,6 +50,8 @@ function parseArgs(argv) {
       index += 1;
     } else if (arg === "--check-policy") {
       args.checkPolicy = true;
+    } else if (arg === "--check-fork-safety") {
+      args.checkForkSafety = true;
     } else if (arg === "--no-run") {
       args.noRun = true;
     } else if (arg === "--write-github-output") {
@@ -163,14 +173,39 @@ function changedFilesFromRecords(records) {
     .map(normalizeRepoPath))];
 }
 
-function loadPullRequestBody(eventPath) {
+function loadPullRequestEvent(eventPath) {
   if (!eventPath) {
     return null;
   }
 
   const rawEvent = fs.readFileSync(safeUserPath(eventPath), "utf8");
-  const event = JSON.parse(rawEvent);
-  return event.pull_request?.body || "";
+  return JSON.parse(rawEvent).pull_request || null;
+}
+
+function evaluateForkSafety(projectRoot, changeRecords, pullRequest) {
+  if (!pullRequest) {
+    return { applicable: false, approvalSafe: true, reasons: [], requiresHumanReview: false };
+  }
+  const headRepository = String(pullRequest?.head?.repo?.full_name || "").toLowerCase();
+  const baseRepository = String(pullRequest?.base?.repo?.full_name || "").toLowerCase();
+  if (!headRepository || !baseRepository) {
+    return {
+      applicable: true,
+      approvalSafe: false,
+      reasons: ["pull_request_repository_identity_unavailable"],
+      requiresHumanReview: false,
+    };
+  }
+  if (headRepository === baseRepository) {
+    return { applicable: false, approvalSafe: true, reasons: [], requiresHumanReview: false };
+  }
+
+  const preliminary = classifyChangeRecords(changeRecords, { requireBlobSizes: false });
+  if (!preliminary.approvalSafe) {
+    return { applicable: true, ...preliminary };
+  }
+  const blobSizes = resolveBlobSizes(projectRoot, changeRecords);
+  return { applicable: true, ...classifyChangeRecords(changeRecords, { blobSizes }) };
 }
 
 function appendGithubOutput(result) {
@@ -188,6 +223,11 @@ function appendGithubOutput(result) {
     `changed_files_count=${String(result.changedFiles.length)}`,
     `has_quality_checklist=${String(result.prBody.hasQualityChecklist)}`,
     `has_issue_link=${String(result.prBody.hasIssueLink)}`,
+    `fork_safety_applicable=${String(result.forkSafety.applicable)}`,
+    `fork_approval_safe=${String(result.forkSafety.approvalSafe)}`,
+    `fork_safety_reasons=${JSON.stringify(result.forkSafety.reasons)}`,
+    `impact_profile=${result.shadowImpact.profile}`,
+    `impact_reasons=${JSON.stringify(result.shadowImpact.reasons)}`,
   ];
 
   fs.appendFileSync(outputPath, `${lines.join("\n")}\n`, "utf8");
@@ -214,6 +254,8 @@ function appendStepSummary(result) {
     `- \`validate:references\` required: ${result.requiresReferencesValidation ? "yes" : "no"}`,
     `- PR template checklist: ${result.prBody.hasQualityChecklist ? "present" : "missing"}`,
     `- Issue auto-close link: ${result.prBody.hasIssueLink ? "detected" : "not detected"}`,
+    `- Fork approval safety: ${result.forkSafety.applicable ? (result.forkSafety.approvalSafe ? "safe" : "blocked") : "not applicable"}`,
+    `- Shadow impact profile: \`${result.shadowImpact.profile}\` (observational only; no test is skipped)`,
     "",
     "> Generated drift is reported separately in the artifact preview job and remains informational on pull requests.",
   ];
@@ -223,14 +265,17 @@ function appendStepSummary(result) {
 
 function main() {
   const args = parseArgs(process.argv.slice(2));
-  const projectRoot = findProjectRoot(__dirname);
+  const projectRoot = args.repo ? path.resolve(args.repo) : findProjectRoot(__dirname);
   const contract = loadWorkflowContract(__dirname);
   const baseRef = args.base || resolveBaseRef(projectRoot);
   const changeRecords = getChangeRecords(projectRoot, baseRef, args.head);
   const changedFiles = changedFilesFromRecords(changeRecords);
   const classification = classifyChangedFiles(changedFiles, contract);
   const directDerivedChanges = getDirectDerivedChanges(changedFiles, contract);
-  const pullRequestBody = loadPullRequestBody(args.eventPath);
+  const pullRequest = loadPullRequestEvent(args.eventPath);
+  const pullRequestBody = pullRequest?.body ?? null;
+  const forkSafety = evaluateForkSafety(projectRoot, changeRecords, pullRequest);
+  const shadowImpact = classifyShadowImpact(changeRecords, contract);
 
   const result = {
     baseRef,
@@ -241,6 +286,8 @@ function main() {
     primaryCategory: classification.primaryCategory,
     directDerivedChanges,
     requiresReferencesValidation: requiresReferencesValidation(changedFiles, contract),
+    forkSafety,
+    shadowImpact,
     prBody: {
       available: pullRequestBody !== null,
       hasQualityChecklist: hasQualityChecklist(pullRequestBody),
@@ -284,6 +331,11 @@ function main() {
     }
   }
 
+  if (args.checkForkSafety && forkSafety.applicable && !forkSafety.approvalSafe) {
+    console.error(`Fork PR is not approval-safe: ${forkSafety.reasons.slice(0, 12).join(", ") || "unclassified diff"}.`);
+    process.exit(1);
+  }
+
   if (!args.noRun) {
     runCommand("npm", ["run", "validate"], projectRoot);
 
@@ -299,4 +351,11 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { changedFilesFromRecords, getChangeRecords, getChangedFiles, parseArgs };
+module.exports = {
+  changedFilesFromRecords,
+  evaluateForkSafety,
+  getChangeRecords,
+  getChangedFiles,
+  loadPullRequestEvent,
+  parseArgs,
+};