Unified PR machinery for actions like pull request comment

go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/erikgeiser/promptkit v0.9.0
 	github.com/evanphx/json-patch/v5 v5.9.0
 	github.com/fergusstrange/embedded-postgres v1.30.0
+	github.com/gammazero/deque v0.2.1
 	github.com/go-git/go-billy/v5 v5.6.0
 	github.com/go-git/go-git/v5 v5.12.0
 	github.com/go-playground/validator/v10 v10.23.0

go.sum

@@ -382,6 +382,8 @@ github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/
 github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/gabriel-vasile/mimetype v1.4.6 h1:3+PzJTKLkvgjeTbts6msPJt4DixhT4YtFNf1gtGe3zc=
 github.com/gabriel-vasile/mimetype v1.4.6/go.mod h1:JX1qVKqZd40hUPpAfiNTe0Sne7hdfKSbOqqmkq8GCXc=
+github.com/gammazero/deque v0.2.1 h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
+github.com/gammazero/deque v0.2.1/go.mod h1:LFroj8x4cMYCukHJDbxFCkT+r9AndaJnFMuZDV34tuU=
 github.com/gkampitakis/ciinfo v0.3.0 h1:gWZlOC2+RYYttL0hBqcoQhM7h1qNkVqvRCV1fOvpAv8=
 github.com/gkampitakis/ciinfo v0.3.0/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=

internal/engine/actions/alert/alert.go

@@ -53,15 +53,23 @@ func NewRuleAlert(
 		if alertCfg.GetPullRequestComment() == nil {
 			return nil, fmt.Errorf("alert engine missing pull_request_review configuration")
 		}
-		client, err := provinfv1.As[provinfv1.GitHub](provider)
+		client, err := provinfv1.As[provinfv1.PullRequestCommenter](provider)
 		if err != nil {
 			zerolog.Ctx(ctx).Debug().Str("rule-type", ruletype.GetName()).
 				Msg("provider is not a GitHub provider. Silently skipping alerts.")
 			return noop.NewNoopAlert(ActionType)
 		}
 		return pull_request_comment.NewPullRequestCommentAlert(
-			ActionType, alertCfg.GetPullRequestComment(), client, setting)
+			ActionType, alertCfg.GetPullRequestComment(), client, setting,
+			defaultName(ruletype))
 	}
 
 	return nil, fmt.Errorf("unknown alert type: %s", alertCfg.GetType())
 }
+
+func defaultName(ruletype *pb.RuleType) string {
+	if ruletype.GetDisplayName() != "" {
+		return ruletype.GetDisplayName()
+	}
+	return ruletype.GetName()
+}

internal/engine/actions/alert/pull_request_comment/flush.go

@@ -0,0 +1,78 @@
+// SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package pull_request_comment
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/rs/zerolog"
+
+	"github.com/mindersec/minder/internal/entities/properties"
+	provifv1 "github.com/mindersec/minder/pkg/providers/v1"
+)
+
+// alertFlusher aggregates a list of comments and flushes them to the PR
+// as a single comment. The idea is that we can aggregate multiple alerts
+// into a single comment without needing to flood the PR with multiple comments.
+// This is only instantiated once; the first creation is the only one that will
+// be used.
+type alertFlusher struct {
+	props     *properties.Properties
+	commitSha string
+	commenter provifv1.PullRequestCommenter
+}
+
+func newAlertFlusher(props *properties.Properties, commitSha string, commenter provifv1.PullRequestCommenter) *alertFlusher {
+	return &alertFlusher{
+		props:     props,
+		commitSha: commitSha,
+		commenter: commenter,
+	}
+}
+
+func (a *alertFlusher) Flush(ctx context.Context, items ...any) error {
+	title := title1("Minder Alerts")
+
+	aggregatedAlerts := getAlerts(ctx, items...)
+
+	_, err := a.commenter.CommentOnPullRequest(ctx, a.props, provifv1.PullRequestCommentInfo{
+		Commit: a.commitSha,
+		Body:   fmt.Sprintf("%s\n\n%s", title, aggregatedAlerts),
+	})
+	if err != nil {
+		return fmt.Errorf("error creating PR review: %w", err)
+	}
+
+	return nil
+}
+
+func getAlerts(ctx context.Context, items ...any) string {
+	logger := zerolog.Ctx(ctx)
+
+	if len(items) == 0 {
+		return "Minder found no issues."
+	}
+
+	var alerts []string
+
+	// iterate and aggregate
+	for _, item := range items {
+		fp, ok := item.(*provifv1.PullRequestCommentInfo)
+		if !ok {
+			logger.Error().Msgf("expected PullRequestCommentInfo, got %T", item)
+			continue
+		}
+
+		alerts = append(alerts, alert(fp.Header, fp.Body))
+	}
+
+	// Ensure predictable ordering
+	// TODO: This should be sorted by severity
+	slices.Sort(alerts)
+
+	return strings.Join(alerts, spacing())
+}

internal/engine/actions/alert/pull_request_comment/format.go

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: Copyright 2024 The Minder Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package pull_request_comment
+
+import "fmt"
+
+func formatTitle(displayName string) string {
+	return fmt.Sprintf("Rule '%s' Alert", displayName)
+}
+
+// Formats the comment for a single alert as markdown
+func alert(title, body string) string {
+	return fmt.Sprintf("%s\n\n%s", title2(title), body)
+}
+
+func title1(title string) string {
+	return fmt.Sprintf("# %s", title)
+}
+
+func title2(title string) string {
+	return fmt.Sprintf("## %s", title)
+}
+
+func spacing() string {
+	return "\n\n"
+}
+
+func separator() string {
+	return "---"
+}