Apply all review comments from PR #1: TypeScript migration, token consolidation, style fixes by Copilot · Pull Request #2 · Open-Source-Bazaar/contributor-trust-action

Copilot · 2026-08-31T15:56:34Z

Addresses all unresolved review comments from the initial PR review. Changes span configuration hygiene, breaking API simplification, and a full TypeScript migration.

Configuration & CI

Upgrade actions/checkout and actions/setup-node to @v7; add npm install step to CI
action.yml: merge github-token + organization-token into a single github-token (caller controls permission level); native boolean default values (no more string literals)
fail-on-high-risk now throws Error instead of setting process.exitCode; description updated accordingly
README.md: YAML native list style for types:; example updated to reflect single token

TypeScript migration

src/analyze.mjs → src/analyze.ts, test/analyze.test.mjs → test/analyze.test.ts
New src/utility.ts — all GitHub API helpers (github, resolveTarget, syncRepositoryState, renderComment, writeSummary, output) extracted from dist/index.mjs
New src/index.ts — main orchestration logic, previously living only in the bundle
dist/index.mjs rebuilt via esbuild; tsx added for running TypeScript tests with node --test

Code style

clamp simplified to arrow expression
URLSearchParams object form replaces manual encodeURIComponent query-string building
Env vars destructured as named constants at module top
Blank lines between declarations and logic blocks
FinalContributorReport interface introduced — narrows ContributorReport so syncRepositoryState, renderComment, and writeSummary require author, number, and blocked rather than accepting them as optional

// Before: three separate GitHub search calls with manual encoding
github(`/search/issues?q=${encodeURIComponent(`type:pr author:${login}`)}&per_page=1`)

// After: URLSearchParams object form
github(token, `/search/issues?${new URLSearchParams({ q: `type:pr author:${login}`, per_page: '1' })}`)

…ew changes Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

…/blocked fields Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

TechQuery

@copilot 所有的问题通篇都要改

TechQuery · 2026-08-31T16:03:19Z

+  "scripts": {
+    "test": "node --import tsx/esm --test test/**/*.ts",
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "esbuild": "^0.25.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0"
  }


Suggested change

"scripts": {

"test": "node --import tsx/esm --test test/**/*.ts",

"build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.mjs"

},

"devDependencies": {

"@types/node": "^24.0.0",

"esbuild": "^0.25.0",

"tsx": "^4.0.0",

"typescript": "^5.0.0"

}

"devDependencies": {

"@types/node": "^24.0.0",

"esbuild": "^0.25.0",

"tsx": "^4.0.0",

"typescript": "^6.0.2"

},

"scripts": {

"test": "node --import tsx/esm --test test/**/*.ts",

"build": "esbuild src/index.ts --bundle --platform=node --format=esm --outfile=dist/index.mjs"

}

Done — devDependencies moved before scripts, typescript bumped to ^6.0.2.

TechQuery · 2026-08-31T16:03:50Z

此文件删掉并忽略，改用 PNPM 11 管理。

package-lock.json deleted and added to .gitignore. Added pnpm-workspace.yaml (with allowBuilds: { esbuild: true }) and pnpm-lock.yaml. CI updated to use pnpm/action-setup@v4 and pnpm install/pnpm test.

TechQuery · 2026-08-31T16:07:14Z

 test('AI only changes the score when confidence is strong', () => {
-  const base = { score: 40, level: 'medium', reasons: [], facts: {} };
+  const base = { score: 40, level: 'medium' as const, trusted: false, reasons: [], facts: {} as ReturnType<typeof analyzeContributor>['facts'] };


ReturnType<typeof analyzeContributor>['facts'] 这种复杂类型在顶端声明，并在下面引用。

emptyFacts: ContributorFacts is now declared at the top of the test file and reused throughout.

TechQuery · 2026-08-31T16:11:00Z

+export interface GitHubProfile {
+  login: string;
+  type: string;
+  created_at: string;
+  public_repos?: number;
+  followers?: number;
+  following?: number;
+  name?: string;
+  bio?: string;
+  company?: string;
+  blog?: string;
+  location?: string;
+}
+
+export interface ContributorFacts {
+  accountAgeDays: number;
+  publicRepositories: number;
+  followers: number;
+  following: number;
+  recentPublicEvents: number;
+  authoredPullRequests: number;
+  authoredIssues: number;
+  organizationPullRequests: number;
+}
+
+export interface ContributorReport {
+  score: number;
+  level: 'low' | 'medium' | 'high';
+  trusted: boolean;
+  reasons: string[];
+  facts: ContributorFacts;
+  author?: string;
+  subject?: string;
+  number?: number;
+  blocked?: boolean;
+  aiReview?: AiReview;
+  aiError?: string;
+}
+
+export interface FinalContributorReport extends ContributorReport {
+  author: string;
+  subject: string;
+  number: number;
+  blocked: boolean;
+}
+
+export interface AiReview {
+  classification: 'likely-human' | 'inconclusive' | 'likely-automated';
+  confidence: number;
+  reasons: string[];
+  recommendation: string;
+}
+
+export interface AnalyzeContributorOptions {
+  profile: GitHubProfile;
+  events?: unknown[];
+  authoredPullRequests?: number;
+  authoredIssues?: number;
+  organizationPullRequests?: number;
+  association?: string;
+  content?: string;
+  now?: Date;
+}


大量的类型统一放到 src/type.ts

All type definitions have been extracted to src/type.ts. Both src/analyze.ts and src/utility.ts import from there and re-export as needed.

TechQuery · 2026-08-31T16:11:51Z

+export interface ContributorFacts {
+  accountAgeDays: number;
+  publicRepositories: number;
+  followers: number;
+  following: number;
+  recentPublicEvents: number;
+  authoredPullRequests: number;
+  authoredIssues: number;
+  organizationPullRequests: number;
+}


改用 type + Record 简写

Changed to type ContributorFacts = Record<string, number>.

TechQuery · 2026-08-31T16:23:40Z

+export async function github(
+  token: string,
+  path: string,
+  options: RequestInit = {},
+  allowNotFound = false,
+): Promise<unknown> {


Suggested change

export async function github(

token: string,

path: string,

options: RequestInit = {},

allowNotFound = false,

): Promise<unknown> {

export async function github<T>(

token: string,

path: string,

options: RequestInit = {},

allowNotFound = false,

): Promise<T> {

Done — github is now async function github<T>(token: string, path: string, options: RequestInit = {}, allowNotFound = false): Promise<T>.

TechQuery · 2026-08-31T16:24:13Z

+}: {
+  token: string;
+  owner: string;
+  profile: GitHubProfile;
+  report: ContributorReport;
+  target: ContributorTarget;
+  blockHighConfidenceAutomation: boolean;
+}): Promise<boolean> {


复杂类型先声明再引用

Done — BlockContributorOptions and ReviewWithGitHubModelsOptions interfaces are now declared at the top of src/utility.ts before the functions that reference them.

TechQuery · 2026-08-31T16:29:47Z

+    );
+  }
+
+  const existing = comments.find(comment => comment.body?.includes(marker));


Suggested change

const existing = comments.find(comment => comment.body?.includes(marker));

const existing = comments.find(({ body }) => body?.includes(marker));

尽量直接在函数参数上解构。

Done — comments.find(({ body }) => body?.includes(marker)).

…le fixes Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

Copilot · 2026-08-31T16:45:16Z

@copilot 所有的问题通篇都要改

All issues addressed in this commit — see the checklist in the PR description for the full list of changes.

Copilot AI and others added 2 commits August 31, 2026 12:38

feat: migrate to TypeScript, consolidate tokens, apply all PR #1 revi…

3368669

…ew changes Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

fix: use FinalContributorReport for functions requiring author/number…

9a32923

…/blocked fields Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

Copilot AI assigned Copilot and TechQuery Aug 31, 2026

Copilot created this pull request from a session on behalf of TechQuery August 31, 2026 15:56 View session

TechQuery added the enhancement New feature or request label Aug 31, 2026

TechQuery requested changes Aug 31, 2026

View reviewed changes

Copilot started work on behalf of TechQuery August 31, 2026 16:31 View session

TechQuery mentioned this pull request Aug 31, 2026

feat: add evidence-first contributor trust action #1

Merged

Address all round-2 review comments: pnpm migration, src/type.ts, sty…

e70e8ba

…le fixes Co-authored-by: TechQuery <19969570+TechQuery@users.noreply.github.com>

Copilot finished work on behalf of TechQuery August 31, 2026 16:45

Copilot AI requested a review from TechQuery August 31, 2026 16:45

	const existing = comments.find(comment => comment.body?.includes(marker));
	const existing = comments.find(({ body }) => body?.includes(marker));

Conversation

Copilot AI commented Aug 31, 2026

Configuration & CI

TypeScript migration

Code style

Uh oh!

TechQuery left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants