Implement GitHub webhook handlers

To update dependency or repository information in an efficient way,
Towtruck should listen to GitHub events rather than polling for updates.
Towtruck needs to listen to the following events:

- `pull_request.opened` and `pull_request.closed` to update the list of
  open pull requests
- `issues.opened` and `issues.closed` to update the list of open issues
- `push` and `issues.edited` to update the list of dependencies
- `dependabot_alert` to update the list of vulnerabilities
- `repository` to update basic information about repositories

webhooks/alerts.js

@@ -0,0 +1,31 @@
+import { TowtruckDatabase } from "../db/index.js";
+import { getDependabotAlertsForRepo } from "../utils/githubApi/fetchDependabotAlerts.js";
+
+/**
+ * @typedef {import("./index.js").Event<T>} Event<T>
+ * @template {string} T
+ */
+
+/**
+ * @param {Event<"dependabot_alert">} event
+ * @param {TowtruckDatabase} db
+ */
+export const handleEvent = async ({ payload, octokit }, db) => {
+  const alerts = await getDependabotAlertsForRepo({
+    octokit,
+    repository: payload.repository,
+  });
+
+  db.saveToRepository(payload.repository.name, "dependabotAlerts", alerts);
+};
+
+/**
+ * Handles the `"dependabot_alert"` webhook event.
+ * @param {Event<"dependabot_alert">} event
+ */
+export const onDependabotAlert = async (event) => {
+  console.log(
+    `Dependabot alert #${event.payload.alert.number} in ${event.payload.repository.name} updated: ${event.payload.action}`,
+  );
+  handleEvent(event, new TowtruckDatabase());
+};

webhooks/alerts.test.js

@@ -0,0 +1,87 @@
+import { describe, it } from "node:test";
+import expect from "node:assert";
+import { handleEvent } from "./alerts.js";
+
+const db = {
+  saveToRepository: () => {},
+};
+
+const octokit = {
+  request: async () => {
+    return Promise.resolve({});
+  },
+};
+
+describe("handleEvent", () => {
+  it("should update the Dependabot alert information in the database for the repository", async (t) => {
+    const responses = {
+      "/repos/{owner}/{repo}/dependabot/alerts": {
+        data: [
+          {
+            state: "open",
+            security_vulnerability: {
+              severity: "critical",
+            },
+          },
+          {
+            state: "open",
+            security_vulnerability: {
+              severity: "high",
+            },
+          },
+          {
+            state: "open",
+            security_vulnerability: {
+              severity: "medium",
+            },
+          },
+          {
+            state: "open",
+            security_vulnerability: {
+              severity: "low",
+            },
+          },
+        ],
+      },
+    };
+
+    t.mock.method(octokit, "request", async (url) =>
+      Promise.resolve(responses[url]),
+    );
+    t.mock.method(db, "saveToRepository");
+
+    const payload = {
+      repository: {
+        name: "repo",
+        owner: {
+          login: "dxw",
+        },
+      },
+    };
+
+    const event = {
+      payload,
+      octokit,
+    };
+
+    const expected = {
+      criticalSeverityAlerts: 1,
+      highSeverityAlerts: 1,
+      mediumSeverityAlerts: 1,
+      lowSeverityAlerts: 1,
+      totalOpenAlerts: 4,
+    };
+
+    await handleEvent(event, db);
+
+    expect.strictEqual(octokit.request.mock.callCount(), 1);
+
+    expect.strictEqual(db.saveToRepository.mock.callCount(), 1);
+
+    expect.deepStrictEqual(db.saveToRepository.mock.calls[0].arguments, [
+      payload.repository.name,
+      "dependabotAlerts",
+      expected,
+    ]);
+  });
+});

webhooks/dependencies.js

@@ -0,0 +1,64 @@
+import { TowtruckDatabase } from "../db/index.js";
+import {
+  fetchAllDependencyLifetimes,
+  saveAllDependencyLifetimes,
+} from "../utils/endOfLifeDateApi/fetchAllDependencyEolInfo.js";
+import { EndOfLifeDateApiClient } from "../utils/endOfLifeDateApi/index.js";
+import { getDependenciesForRepo } from "../utils/renovate/dependencyDashboard.js";
+
+/**
+ * @typedef {import("./index.js").Event<T>} Event<T>
+ * @template {string} T
+ */
+
+/**
+ * @param {Event<"push" | "issues.edited">} event
+ * @param {TowtruckDatabase} db
+ * @param {EndOfLifeDateApiClient} apiClient
+ */
+export const handleEvent = async ({ payload, octokit }, db, apiClient) => {
+  const dependencies = await getDependenciesForRepo({
+    octokit,
+    repository: payload.repository,
+  });
+
+  db.saveToRepository(payload.repository.name, "dependencies", dependencies);
+
+  const allLifetimes = await fetchAllDependencyLifetimes(db, apiClient);
+  await saveAllDependencyLifetimes(allLifetimes, db);
+};
+
+/**
+ * Handles the `"push"` webhook event.
+ * @param {Event<"push">} event
+ */
+export const onPush = async (event) => {
+  console.log(`Push to ${event.payload.repository.name}: ${event.payload.ref}`);
+  if (event.payload.ref === "refs/heads/main") {
+    return await handleEvent(
+      event,
+      new TowtruckDatabase(),
+      new EndOfLifeDateApiClient(),
+    );
+  }
+};
+
+/**
+ * Handles the `"issues.edited"` webhook event.
+ * @param {Event<"issues.edited">} event
+ */
+export const onIssueEdited = async (event) => {
+  console.log(
+    `Issue #${event.payload.issue.number} updated in ${event.payload.repository.name}: ${event.payload.issue.title}`,
+  );
+  if (
+    event.payload.issue.user.login === "renovate[bot]" &&
+    event.payload.issue.pull_request === undefined
+  ) {
+    return await handleEvent(
+      event,
+      new TowtruckDatabase(),
+      new EndOfLifeDateApiClient(),
+    );
+  }
+};

webhooks/dependencies.test.js

@@ -0,0 +1,172 @@
+import { describe, it } from "node:test";
+import expect from "node:assert";
+import { handleEvent } from "./dependencies.js";
+import { Dependency } from "../model/Dependency.js";
+
+const db = {
+  transaction: (fn) => {
+    return (arg) => fn(arg);
+  },
+  saveToRepository: () => {},
+  saveToDependency: () => {},
+  getAllRepositories: () => {},
+};
+
+const octokit = {
+  request: async () => {
+    return Promise.resolve({});
+  },
+};
+
+const apiClient = {
+  getAllCycles: (dependency) => ({ dependency, cycles: [] }),
+};
+
+describe("handleEvent", () => {
+  it("should update the dependency information in the database for the repository", async (t) => {
+    const responses = {
+      "https://some.api/issues": {
+        data: [
+          {
+            user: {
+              login: "renovate[bot]",
+            },
+            body: "## Detected dependencies\n\n- `foobar 1.2.3`\n- `libquux 0.1.1-alpha` \n\n---",
+          },
+        ],
+      },
+    };
+
+    const repository = {
+      name: "repo",
+      owner: {
+        login: "dxw",
+      },
+      issues_url: "https://some.api/issues",
+    };
+
+    const repositories = {
+      repo: {
+        repository,
+        dependencies: [],
+      },
+    };
+
+    t.mock.method(octokit, "request", async (url) =>
+      Promise.resolve(responses[url]),
+    );
+    t.mock.method(db, "saveToRepository");
+    t.mock.method(db, "getAllRepositories", () => repositories);
+
+    const payload = {
+      repository,
+    };
+
+    const event = {
+      payload,
+      octokit,
+    };
+
+    const expected = [
+      new Dependency("foobar", "1.2.3"),
+      new Dependency("libquux", "0.1.1-alpha"),
+    ];
+
+    await handleEvent(event, db, apiClient);
+
+    expect.strictEqual(octokit.request.mock.callCount(), 1);
+
+    expect.strictEqual(db.saveToRepository.mock.callCount(), 1);
+
+    expect.deepStrictEqual(db.saveToRepository.mock.calls[0].arguments, [
+      payload.repository.name,
+      "dependencies",
+      expected,
+    ]);
+  });
+
+  it("should update the lifetime information stored in the database", async (t) => {
+    const responses = {
+      "https://some.api/issues": {
+        data: [
+          {
+            user: {
+              login: "renovate[bot]",
+            },
+            body: "## Detected dependencies\n\n- `foobar 1.2.3`\n- `libquux 0.1.1-alpha` \n\n---",
+          },
+        ],
+      },
+    };
+
+    const repository = {
+      name: "repo",
+      owner: {
+        login: "dxw",
+      },
+      issues_url: "https://some.api/issues",
+    };
+
+    const repositories = {
+      repo: {
+        repository,
+        dependencies: [new Dependency("foobar", "1.2.3")],
+      },
+    };
+
+    const cycles = {
+      foobar: [
+        {
+          cycle: "1.2",
+          latestVersion: "1.2.3",
+          releaseDate: "2024-01-01",
+        },
+      ],
+    };
+
+    t.mock.method(octokit, "request", async (url) =>
+      Promise.resolve(responses[url]),
+    );
+    t.mock.method(db, "transaction");
+    t.mock.method(db, "saveToDependency");
+    t.mock.method(db, "getAllRepositories", () => repositories);
+    t.mock.method(apiClient, "getAllCycles", (dependency) => {
+      if (cycles[dependency]) {
+        return { dependency, cycles: cycles[dependency] };
+      } else {
+        return { message: "Product not found" };
+      }
+    });
+
+    const expected = [
+      {
+        dependency: "foobar",
+        lifetimes: {
+          dependency: "foobar",
+          cycles: cycles.foobar,
+        },
+      },
+    ];
+
+    const payload = {
+      repository,
+    };
+
+    const event = {
+      payload,
+      octokit,
+    };
+
+    await handleEvent(event, db, apiClient);
+
+    expect.strictEqual(apiClient.getAllCycles.mock.callCount(), 1);
+
+    expect.strictEqual(db.saveToDependency.mock.callCount(), 1);
+
+    expect.deepStrictEqual(db.saveToDependency.mock.calls[0].arguments, [
+      expected[0].dependency,
+      "lifetimes",
+      expected[0].lifetimes,
+    ]);
+  });
+});

webhooks/index.js

@@ -0,0 +1,38 @@
+import { createNodeMiddleware } from "@octokit/app";
+import { OctokitApp } from "../octokitApp.js";
+import { onPullRequestClosed, onPullRequestOpened } from "./pullRequests.js";
+import { onIssueClosed, onIssueOpened } from "./issues.js";
+import { onIssueEdited, onPush } from "./dependencies.js";
+import { onDependabotAlert } from "./alerts.js";
+import { onRepository } from "./repository.js";
+
+/**
+ * @typedef {import("@octokit/webhooks/dist-types/index").EmitterWebhookEvent<T>} EmitterWebhookEvent<T>
+ * @template {string} T
+ */
+
+/**
+ * @typedef {import("@octokit/core/dist-types/index").Octokit} Octokit
+ */
+
+/**
+ * @typedef {EmitterWebhookEvent<T> & { octokit: Octokit; }} Event<T>
+ * @template {string} T
+ */
+
+const registerWebhook = OctokitApp.app.webhooks.on;
+
+registerWebhook("pull_request.opened", onPullRequestOpened);
+registerWebhook("pull_request.closed", onPullRequestClosed);
+
+registerWebhook("issues.opened", onIssueOpened);
+registerWebhook("issues.closed", onIssueClosed);
+
+registerWebhook("push", onPush);
+registerWebhook("issues.edited", onIssueEdited);
+
+registerWebhook("dependabot_alert", onDependabotAlert);
+
+registerWebhook("repository", onRepository);
+
+export const handleWebhooks = createNodeMiddleware(OctokitApp.app);