fix(sections): live creation-cap and webhook shapes reject bodies the spec forbids

The creation-cap GET response requires max_open_pull_requests, but the live shape had it optional, so a body of just { enabled: true } read as a cap with no limit and the snapshot dropped the live limit silently. The field is required now, so such a body fails the read as a shape violation like the other off-shape bodies.

A live webhook config was an untyped record, so a non-string config.secret (123) reached the snapshot, which minted a $WEBHOOK_SECRET_<id> reference for it. The live config types secret as the string the spec documents, so a non-string one fails the read instead.

Both are pinned in the round-trip suite: { enabled: true } and secret: 123 each fail naming the field.

Author: Vivswan

src/sections/interaction_limits/index.ts

@@ -117,7 +117,7 @@ function noLiveLimit(live: unknown): boolean {
 
 const LiveCreationCap = z.looseObject({
   enabled: z.boolean(),
-  max_open_pull_requests: z.number().optional(),
+  max_open_pull_requests: z.number(),
 });
 
 const LiveInteractionLimit = z.looseObject({
@@ -362,10 +362,12 @@ export const interactionLimitsSection = {
     return plan;
   },
   /**
-   * The base limit only when the repository owns it (an inherited one is the organization's
-   * setting); the cap only where the feature exists (its 405 also means the bypass endpoints
-   * would deny) and is enabled, since a disabled cap is GitHub's default; the bypass list only
-   * when someone is on it.
+   * Only what the repository itself owns reads back; an inherited limit is the org's or user's
+   * setting, and a disabled cap is GitHub's default.
+   *
+   *   limit inherited (org or user origin)   -> noted, not declared
+   *   cap answers 405                        -> cap and bypass both omitted, noted
+   *   cap disabled, or nobody on the bypass  -> omitted
    */
   async snapshot(ctx) {
     const notes: string[] = [];

src/sections/webhooks/index.ts

@@ -42,7 +42,7 @@ const LiveHook = z.looseObject({
   name: z.string().optional(),
   active: z.boolean().optional(),
   events: z.array(z.string()).optional(),
-  config: z.record(z.string(), z.unknown()).optional(),
+  config: z.looseObject({ secret: z.string().optional() }).optional(),
 });
 type LiveHook = z.infer<typeof LiveHook>;
 

test/sections/snapshot-roundtrip.test.ts

@@ -159,7 +159,14 @@ describe("snapshot round trip", () => {
   });
 
   test.each([
-    [{ enabled: "yes" }, "enabled: Invalid input: expected boolean, received string"],
+    [
+      { enabled: "yes", max_open_pull_requests: 1 },
+      "enabled: Invalid input: expected boolean, received string",
+    ],
+    [
+      { enabled: true },
+      "max_open_pull_requests: Invalid input: expected number, received undefined",
+    ],
     [null, "(body): Invalid input: expected object, received null"],
   ])(
     "a creation-cap body off the shape (%j) fails the snapshot instead of reading as no cap",
@@ -182,6 +189,26 @@ describe("snapshot round trip", () => {
     },
   );
 
+  test("a hook whose config.secret is not a string fails the snapshot instead of minting a reference", async () => {
+    const fake = registryFake({});
+    const api: GithubClient = {
+      tryRequest: (method, path, payload, options) =>
+        method === "GET" && path.startsWith("/repos/o/r/hooks?")
+          ? Promise.resolve({
+              data: [
+                { id: 7, name: "web", config: { url: "https://ci.example.com/hook", secret: 123 } },
+              ],
+            })
+          : fake.tryRequest(method, path, payload, options),
+      tryGraphql: (op, variables, slug) => fake.tryGraphql(op, variables, slug),
+    };
+    await expect(webhooksSection.snapshot(planContext(webhooksSection, api, REPO))).rejects.toThrow(
+      "webhooks: GET /repos/{owner}/{repo}/hooks returned a body outside the documented shape - " +
+        "[0].config.secret: Invalid input: expected string, received number. Check the " +
+        '"api-version" input against the GitHub REST docs for this endpoint',
+    );
+  });
+
   test("a hook without a config.url is noted and left out; alone, it leaves nothing to declare", async () => {
     const api = registryFake({ hooks: [{ id: 7, config: {} }] });
     const snapshot = await webhooksSection.snapshot(planContext(webhooksSection, api, REPO));