github.js

const GITHUB_GRAPHQL_URL = "https://api.github.com/graphql";

const PENDING_REVIEWS_QUERY = `
  query($owner: String!, $name: String!) {
    repository(owner: $owner, name: $name) {
      pullRequests(states: OPEN, first: 100) {
        nodes {
          number
          title
          url
          isDraft
          authorAssociation
          author { login __typename }
          reviewRequests(first: 20) {
            nodes {
              requestedReviewer {
                ... on User { login }
              }
            }
          }
          timelineItems(itemTypes: [REVIEW_REQUESTED_EVENT], first: 100) {
            nodes {
              ... on ReviewRequestedEvent {
                createdAt
                requestedReviewer {
                  ... on User { login }
                }
              }
            }
          }
        }
      }
    }
  }
`;

async function fetchRepoPRs(org, repo, token) {
  const response = await fetch(GITHUB_GRAPHQL_URL, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      query: PENDING_REVIEWS_QUERY,
      variables: { owner: org, name: repo },
    }),
  });
  if (!response.ok) {
    throw new Error(`GitHub GraphQL error: ${response.status}`);
  }
  const payload = await response.json();
  if (payload.errors) {
    throw new Error(
      `GitHub GraphQL error: ${JSON.stringify(payload.errors)}`
    );
  }
  return payload.data.repository.pullRequests.nodes;
}

function mostRecentRequestedAt(timelineNodes, reviewer) {
  const times = timelineNodes
    .filter(
      (n) => n.requestedReviewer && n.requestedReviewer.login === reviewer
    )
    .map((n) => n.createdAt)
    .sort();
  return times.length ? times[times.length - 1] : null;
}

// GraphQL types bot accounts as Bot, but the same accounts show up as a plain
// login suffixed with "[bot]" elsewhere, so check both.
function isBotAuthor(author) {
  if (!author) return false;
  return author.__typename === "Bot" || /\[bot\]$/.test(author.login || "");
}

// GitHub reports MEMBER/OWNER for members of the org that owns the repo and
// COLLABORATOR for anyone else granted push access; everyone else is outside
// the org.
const COWORKER_ASSOCIATIONS = new Set(["MEMBER", "OWNER", "COLLABORATOR"]);

function authorCategory(pr, teamHandles) {
  const login = pr.author ? pr.author.login : null;
  if (login && teamHandles.has(login)) return "coworker";
  if (isBotAuthor(pr.author)) return "bot";
  if (COWORKER_ASSOCIATIONS.has(pr.authorAssociation)) return "coworker";
  return "external";
}

const CATEGORY_RANK = { coworker: 0, bot: 1, external: 2 };

// Coworkers' PRs first, then bots, then external contributors; within a group
// the longest-waiting review comes first.
function comparePendingReviews(a, b) {
  const byCategory =
    CATEGORY_RANK[a.authorCategory] - CATEGORY_RANK[b.authorCategory];
  if (byCategory !== 0) return byCategory;
  return new Date(a.requestedAt) - new Date(b.requestedAt);
}

// A repo the token cannot see — a private repo when the workflow runs on the
// default repo-scoped GITHUB_TOKEN — fails the same way a transient error does:
// its PRs just go missing. Emit an Actions annotation so the run summary shows
// it instead of burying it in the step log.
function warnRepoFetchFailed(repo, message) {
  const text = `Failed to fetch reviews for ${repo}: ${message}`;
  console.warn(process.env.GITHUB_ACTIONS ? `::warning::${text}` : text);
}

async function getPendingReviews(config, token) {
  const { org, repos, teamMembers } = config;
  const teamHandles = new Set(teamMembers.map((m) => m.github));

  const result = {};
  for (const member of teamMembers) {
    result[member.github] = [];
  }

  const repoResults = await Promise.all(
    repos.map((repo) =>
      fetchRepoPRs(org, repo, token)
        .then((nodes) => ({ repo, nodes }))
        .catch((err) => {
          warnRepoFetchFailed(repo, err.message);
          return { repo, nodes: [] };
        })
    )
  );

  for (const { repo, nodes } of repoResults) {
    for (const pr of nodes) {
      if (pr.isDraft) continue;
      const requestedReviewers = (pr.reviewRequests.nodes || [])
        .map((r) => r.requestedReviewer && r.requestedReviewer.login)
        .filter((login) => login && teamHandles.has(login));
      for (const reviewer of requestedReviewers) {
        const requestedAt = mostRecentRequestedAt(
          pr.timelineItems.nodes || [],
          reviewer
        );
        if (requestedAt && result[reviewer]) {
          result[reviewer].push({
            number: pr.number,
            title: pr.title,
            url: pr.url,
            repo,
            author: pr.author ? pr.author.login : null,
            authorCategory: authorCategory(pr, teamHandles),
            reviewer,
            requestedAt,
          });
        }
      }
    }
  }

  for (const reviews of Object.values(result)) {
    reviews.sort(comparePendingReviews);
  }

  return result;
}

module.exports = {
  getPendingReviews,
};