Function setupPat

packages/bumpy/src/commands/ci-setup.ts:64–115

(rootDir: string, repo: string, pm: PackageManager)

// ---- PAT flow ----

async function setupPat(rootDir: string, repo: string, pm: PackageManager): Promise<void> {
  const patUrl = 'https://github.com/settings/personal-access-tokens/new';

  p.log.info('');
  p.note(
    [
      `1. Open: ${pc.cyan(patUrl)}`,
      '',
      `2. Set a name, e.g. ${pc.dim('"bumpy-ci"')}`,
      '',
      `3. Under ${pc.bold('Resource owner')}, select the org or account that owns ${pc.cyan(repo)}`,
      '',
      `4. Set ${pc.bold('Expiration')} — choose a longer duration to avoid frequent rotation`,
      `   (you'll need to regenerate and update the secret when it expires)`,
      '',
      `5. Under ${pc.bold('Repository access')}, select ${pc.bold('"Only select repositories"')}`,
      `   and choose ${pc.cyan(repo)}`,
      '',
      `6. Under ${pc.bold('Permissions → Repository permissions')}, grant:`,
      ...PAT_PERMISSIONS.map((perm) => `   • ${pc.bold(perm)}`),
      '',
      '7. Click "Generate token" and copy the value',
      '',
      pc.dim('Note: if the resource owner is an org, an admin may need to approve'),
      pc.dim('the token request before it can be used.'),
      '',
      pc.dim('Tip: enable branch protection rules on your main branch to prevent'),
      pc.dim('direct pushes — the PAT will only be used to push the version branch.'),
    ].join('\n'),
    'Create a fine-grained PAT',
  );

  // Try to open browser
  const shouldOpen = unwrap(await p.confirm({ message: 'Open the token creation page in your browser?' }));
  if (shouldOpen) {
    openBrowser(patUrl);
  }

  // Prompt for the token
  const token = unwrap(
    await p.text({
      message: 'Paste your token:',
      placeholder: 'github_pat_...',
      validate: (value) => {
        if (!value?.trim()) return 'Token is required';
        if (!value?.startsWith('github_pat_')) return 'Expected a fine-grained PAT (starts with github_pat_)';
      },
    }),
  );

  await storeSecret(rootDir, repo, token, pm);
}

// ---- GitHub App flow ----