Add resolver that generates lockfile patch GitHub PRs #1132
Conversation
This is a GraphQL resolver that, when called with a vulnerability and package, will generate a GitHub Pull Request to the lockfile. Current Limitations: - Only works for a single package at a time (batch PRs will come later) - Isn't wired up to the front-end - The GraphQL resolver is untested (but it should work)
lunatrace/bsl/backend/src/graphql-yoga/resolvers/create-pull-request-for-vulnerability.ts
Show resolved
Hide resolved
| .replace(/yarn\.lock$/, '') | ||
| .replace(/package-lock\.json$/, ''); | ||
|
|
||
| await checkProjectIsAuthorized(projectId, ctx); |
There was a problem hiding this comment.
can you leave a comment that this will throw on error? I find it confusing to have a line of code whose side effect is not clear.
There was a problem hiding this comment.
I renamed the function so that this is consistent everywhere in the repo.
|
|
||
| const newPackageSlug = args.new_package_slug; | ||
| if (!newPackageSlug) { | ||
| throw new GraphQLYogaError('No new package slug provided'); |
There was a problem hiding this comment.
We could probably DRY up this to just be a param checking function that takes an array of property names as strings. I bet we could throw that in utils and call it a day.
Just a thought, not like an urgent change obv
| repo, | ||
| normalizedPackageManifestPath, | ||
| // TODO: Make this less hacky and brittle | ||
| packageManifestPath.endsWith('package-lock.json') ? 'npm' : 'yarn', |
There was a problem hiding this comment.
This is probably not a safe check. I think we should expand this into a function that throws if it doesnt look npm-y or yarn-y.
Pnpm exists, and so on and so forth. Bun too! haha
| pullRequestUrl: pullRequestResult.pullRequestUrl, | ||
| }; | ||
| } catch (error) { | ||
| // TODO: temporary error handler until i figure out how to deal with global errors in yoga which seems maybe impossible |
There was a problem hiding this comment.
It's impossible unless we drop yoga for apollo, or at least, difficult, i tried. we need to go to apollo anyway because yoga is just a sucky wrapper around apollo.
Apollo stinks but it at least has that part working.
You may as well wrap this unknown error in a nice graphqlError because yoga will catch it anyway, and return something nebulous to the client. So you might as well just throw new "GraphQLYogaError("An Unknown error occurred while attempting to update dependencies") I have it set up so those will render out to the user in an alert.
That way it at least looks better on the client
This is a GraphQL resolver that, when called with a vulnerability and package, will generate a GitHub Pull Request to the lockfile.
Current Limitations:
Fixes #1030