Avoid Administration-gated branchProtectionRule in GraphQL fetch.

[cb-anomitromunshi]

The app token lacks Administration, so that field returns FORBIDDEN and octokit.graphql aborts despite usable Ref.rules data. Use rules plus refUpdateRule, and read GraphQL via POST so partial errors are ignored.

Updates fetchProtectedBranchNames to list paginated staging/* refs through POST /graphql, then verify protection through REST. Removes the Administration-gated branchProtectionRule query and adds explicit handling for missing repository or ref data and GraphQL errors.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Walkthrough

fetchProtectedBranchNames now lists staging/* refs through paginated GraphQL, checks each branch through REST, and returns branches with protected set to true. It also handles missing repository or ref data and GraphQL errors.

Changes

Protected staging branch detection

Layer / File(s)	Summary
Staging reference listing apps/github.js	A paginated POST /graphql helper lists staging/* refs. It filters invalid refs and reports missing data or GraphQL errors.
Branch protection evaluation apps/github.js	fetchProtectedBranchNames checks each staging branch with repos.getBranch and includes only branches with data.protected set to true.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant fetchProtectedBranchNames
  participant GitHubGraphQL
  participant GitHubREST
  fetchProtectedBranchNames->>GitHubGraphQL: List paginated staging/* refs
  GitHubGraphQL-->>fetchProtectedBranchNames: Return ref names or errors
  fetchProtectedBranchNames->>GitHubREST: Check each branch with repos.getBranch
  GitHubREST-->>fetchProtectedBranchNames: Return protected flag

Loading

Possibly related PRs

• chargebee/distributed-gitflow#55: Both changes update fetchProtectedBranchNames to list protected staging/* branches, while this PR uses REST protection checks instead of ruleset inspection.

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

apps/github.js (1)

42-59: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Validate GraphQL pagination fields before iterating.

RefConnection.nodes is nullable, so a null value causes the for...of loop to throw a TypeError. Because PageInfo.endCursor is nullable, hasNextPage: true with a null or unchanged cursor can repeat the same request indefinitely. Reject incomplete pages and require an advancing cursor before continuing.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/github.js` around lines 42 - 59, Validate repository.refs.nodes and
repository.refs.pageInfo before iterating in the staging-ref pagination flow.
Require nodes to be iterable, and when hasNextPage is true, require a non-null
endCursor that differs from the current cursor; otherwise throw the existing
GraphQL listing error instead of continuing. Preserve normal branch collection
and termination when hasNextPage is false.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/github.js`:
- Around line 9-14: Update fetchProtectedBranchNames around the repos.getBranch
call to catch errors for each stagingBranchName. Skip only a confirmed
stale-branch 404 caused by the branch being deleted, while propagating
authentication, access-related, and all other errors; continue evaluating the
remaining branches after the stale branch is skipped.

---

Outside diff comments:
In `@apps/github.js`:
- Around line 42-59: Validate repository.refs.nodes and repository.refs.pageInfo
before iterating in the staging-ref pagination flow. Require nodes to be
iterable, and when hasNextPage is true, require a non-null endCursor that
differs from the current cursor; otherwise throw the existing GraphQL listing
error instead of continuing. Preserve normal branch collection and termination
when hasNextPage is false.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 3f790127-edba-43bd-b948-f641d075b529

📥 Commits

Reviewing files that changed from the base of the PR and between e5618b2 and 662bad2.

⛔ Files ignored due to path filters (1)

• dist/index.js is excluded by !**/dist/**

📒 Files selected for processing (1)

• apps/github.js