github-community-projects / github-community-projects/safe-settings

2.1.21: CustomProperties plugin still crashes — modifyProperty() calls renamed octokit methods

Open
#981 6 comments 3 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
921
Forks
226
Avg merge
18h 3m
Merged PRs (30d)
14

Description

## Problem Description

### What is actually happening

`lib/plugins/custom_properties.js` calls two octokit methods that no longer exist in `@octokit/plugin-rest-endpoint-methods@17` (transitively pulled in by `octokit@^5.0.2` and `probot@^14.2.4`):

- `octokit.rest.repos.getCustomPropertiesValues` → `customPropertiesForReposGetRepositoryValues`
- `octokit.rest.repos.createOrUpdateCustomPropertiesValues` → `customPropertiesForReposCreateOrUpdateRepositoryValues`

The rename is a documented breaking change in [@octokit/plugin-rest-endpoint-methods v17.0.0](https://github.com/octokit/plugin-rest-endpoint-methods.js/releases/tag/v17.0.0):

> ### BREAKING CHANGES
> - Several custom property endpoints changed ID

Concrete failure chain on a PR that adds any per-repo `custom_properties:` block:

1. [`find()` (line 43)](https://github.com/github/safe-settings/blob/2.1.21/lib/plugins/custom_properties.js#L43) calls `paginate(undefined, ...)`. paginate falls back to `GET https://api.github.com/`, returns the API root JSON wrapped as a 1-item array. Log says `Found 1 custom properties` but no values were actually fetched.
2. The 2.1.21-patched `normalize()` defensively skips that bogus entry → `target [] with source [{...}]`.
3. Diff thinks the property is a brand-new addition → `add()` → `modifyProperty('Create', ...)`.
4. [`modifyProperty()` (line 113)](https://github.com/github/safe-settings/blob/2.1.21/lib/plugins/custom_properties.js#L113) accesses `this.github.rest.repos.createOrUpdateCustomPropertiesValues.endpoint(params)`. The method is `undefined` → synchronous TypeError.
5. The throw escapes `Promise.all` in `Settings.updateRepos` → unhandled rejection → Node exits 1 → container restarts. The PR check-run created at validation start is never closed, so the validator is stuck `IN_PROGRESS` indefinitely.

#971 was closed as fixed in 2.1.21, but #978 only patched the symptom in `normalize()`. The original reporter never reached `modifyProperty()` because they crashed earlier. With the normalize fix in place, we now reach the next call and die there — same root cause (the v17 rename), different line.

### What is the expected behavior

`CustomProperties` should call the renamed methods (or use `octokit.request("GET /repos/{owner}/{repo}/properties/values")` / `("PATCH /repos/{owner}/{repo}/properties/values")` to be stable across endpoint-methods versions).

The `if (this.nop)` branch should also be wrapped in `try/catch` so a single misconfiguration cannot crash the whole reconcile.

### Error output, if available

```
DEBUG (event): Getting all custom properties for the repo /
DEBUG (octokit): GitHub request: GET https://api.github.com - 200
DEBUG (event): Found 1 custom properties
DEBUG (event): [] [{"name":"","value":""}]
DEBUG (event): Results of comparing CustomProperties diffable target [] with source [...] is {"msg":"Changes found","additions":{"0":{"name":"","value":""}},"modifications":{}}

/opt/safe-settings/lib/plugins/custom_properties.js:113
this.github.rest.repos.createOrUpdateCustomPropertiesValues.endpoint(params),
^
TypeError: Cannot read properties of undefined (reading 'endpoint')
at CustomProperties.modifyProperty (/opt/safe-settings/lib/plugins/custom_properties.js:113:69)
at CustomProperties.add (/opt/safe-settings/lib/plugins/custom_properties.js:88:17)
at /opt/safe-settings/lib/plugins/diffable.js:115:33
at Array.forEach ()
at /opt/safe-settings/lib/plugins/diffable.js:109:25
at async Promise.all (index 1)
at async Settings.updateRepos (/opt/safe-settings/lib/settings.js:384:30)
at async Promise.all (index 0)
at async Settings.syncAll (/opt/safe-settings/lib/settings.js:24:7)
```

100% reproducible.

## Context

### Are you using the hosted instance of probot/settings or running your own?

Self-hosted, official upstream image `ghcr.io/github/safe-settings:2.1.21` on Kubernetes.

### If running your own instance, are you using it with github.com or GitHub Enterprise?

github.com (Enterprise Cloud plan, not Enterprise Server).

#### Version of probot/settings

- safe-settings: 2.1.21
- probot: 14.2.4
- octokit: 5.0.5
- @octokit/plugin-rest-endpoint-methods: 17.0.0

#### Version of GitHub Enterprise

N/A — Enterprise Cloud, not Server.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.