stack/packages/mosaic/framework/tools/git/issue-close.sh

#!/bin/bash
# issue-close.sh - Close an issue on GitHub or Gitea
# Usage: issue-close.sh -i <issue_number> [-b <comment>]
# (-c/--comment is a backward-compatible alias for -b/--body; R1/R4 2026-08-28)

set -e

# Source platform detection
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/detect-platform.sh"

# Parse arguments
ISSUE_NUMBER=""
COMMENT=""

# Usage-error contract (R4, 2026-08-28): usage errors print to STDERR and exit 2,
# distinct from provider, credential, and verification failures (exit 1), so a
# caller or stop gate can tell an invocation defect from a delivery blocker.
usage_error() {
    echo "Error: $*" >&2
    echo "Usage: issue-close.sh -i <issue_number> [-b <comment>] (see --help)" >&2
    exit 2
}

while [[ $# -gt 0 ]]; do
    case $1 in
        -i|--issue)
            [[ $# -ge 2 && "$2" != --* && ! "$2" =~ ^-[a-zA-Z]$ ]] || usage_error "option $1 requires a value (option-like values are rejected)"
            ISSUE_NUMBER="$2"
            shift 2
            ;;
        -b|--body|-c|--comment)
            # R1 (2026-08-28): --body is the canonical flag; -c/--comment stays
            # a backward-compatible alias.
            [[ $# -ge 2 && "$2" != --* && ! "$2" =~ ^-[a-zA-Z]$ ]] || usage_error "option $1 requires a value (option-like values are rejected)"
            COMMENT="$2"
            shift 2
            ;;
        -h|--help)
            echo "Usage: issue-close.sh -i <issue_number> [-b <comment>]"
            echo ""
            echo "Options:"
            echo "  -i, --issue    Issue number (required)"
            echo "  -b, --body     Comment to add before closing (optional; canonical)"
            echo "  -c, --comment  Alias for --body"
            echo "  -h, --help     Show this help"
            echo ""
            echo "Exit codes: 0 success; 2 usage error (stderr); 1 provider/credential/verification failure."
            exit 0
            ;;
        *)
            usage_error "unknown option: $1"
            ;;
    esac
done

if [[ -z "$ISSUE_NUMBER" ]]; then
    usage_error "issue number is required (-i/--issue)"
fi

# Detect platform and close issue
detect_platform >/dev/null
OWNER=$(get_repo_owner)
REPO=$(get_repo_name)

gitea_issue_comment_api() {
    local host token url payload
    host=$(get_remote_host) || return 1
    token=$(get_gitea_token "$host") || return 1
    url="https://${host}/api/v1/repos/${OWNER}/${REPO}/issues/${ISSUE_NUMBER}/comments"
    payload=$(COMMENT="$COMMENT" python3 - <<'PY'
import json
import os

print(json.dumps({"body": os.environ["COMMENT"]}))
PY
)
    curl -fsS -X POST \
        -H "User-Agent: curl/8" \
        -H "Authorization: token ${token}" \
        -H "Content-Type: application/json" \
        -d "$payload" \
        "$url" >/dev/null
}

gitea_issue_close_api() {
    local host token url
    host=$(get_remote_host) || return 1
    token=$(get_gitea_token "$host") || return 1
    url="https://${host}/api/v1/repos/${OWNER}/${REPO}/issues/${ISSUE_NUMBER}"
    curl -fsS -X PATCH \
        -H "User-Agent: curl/8" \
        -H "Authorization: token ${token}" \
        -H "Content-Type: application/json" \
        -d '{"state":"closed"}' \
        "$url" >/dev/null
}

if [[ "$PLATFORM" == "github" ]]; then
    # R4: normalize provider failures to exit 1 (gh's own usage errors exit 2
    # and would collide with the reserved usage-error status).
    if [[ -n "$COMMENT" ]]; then
        gh_rc=0
        gh issue comment "$ISSUE_NUMBER" --body "$COMMENT" || gh_rc=$?
        if [[ "$gh_rc" -ne 0 ]]; then
            echo "Error: GitHub comment before close failed (gh exit $gh_rc)" >&2
            exit 1
        fi
    fi
    gh_rc=0
    gh issue close "$ISSUE_NUMBER" || gh_rc=$?
    if [[ "$gh_rc" -ne 0 ]]; then
        echo "Error: GitHub issue close failed (gh exit $gh_rc)" >&2
        exit 1
    fi
    echo "Closed GitHub issue #$ISSUE_NUMBER"
elif [[ "$PLATFORM" == "gitea" ]]; then
    GITEA_LOGIN_NAME=$(get_gitea_login || true)
    if [[ -n "$GITEA_LOGIN_NAME" ]]; then
        if [[ -n "$COMMENT" ]]; then
            # `tea issue comment` is NOT a subcommand -- tea 0.11.x lists only
            # list/create/edit/reopen/close under `tea issue`. Comments are the
            # TOP-LEVEL `tea comment`, which takes the same --repo/--login flags.
            # The old call therefore always failed, was unchecked, and the script
            # closed the issue anyway, losing the record of WHY.
            #
            # Use `tea comment` rather than the API helper so the comment and the
            # close are made by the SAME principal ($GITEA_LOGIN_NAME). Routing the
            # comment through the token-authenticated helper here would attribute the
            # comment to the token holder and the close to the tea login -- two
            # principals for one operation.
            tea comment "$ISSUE_NUMBER" "$COMMENT" --repo "$OWNER/$REPO" --login "$GITEA_LOGIN_NAME" || {
                echo "Error: failed to post comment on #$ISSUE_NUMBER -- NOT closing (fail closed)." >&2
                exit 1
            }
        fi
        prov_rc=0
        tea issue close "$ISSUE_NUMBER" --repo "$OWNER/$REPO" --login "$GITEA_LOGIN_NAME" || prov_rc=$?
        [[ "$prov_rc" -eq 0 ]] || { echo "Error: provider command failed (exit ${prov_rc}; provider failure, not a usage error)" >&2; exit 1; }
    else
        echo "No tea login configured for $(get_remote_host); using authenticated Gitea API fallback." >&2
        if [[ -n "$COMMENT" ]]; then
            # Fail closed here too: an unchecked comment lets the issue close without its
            # audit trail, which is the same defect as the tea path above.
            gitea_issue_comment_api || {
                echo "Error: failed to post comment on #$ISSUE_NUMBER -- NOT closing (fail closed)." >&2
                exit 1
            }
        fi
        gitea_issue_close_api
    fi
    echo "Closed Gitea issue #$ISSUE_NUMBER"
else
    echo "Error: Unknown platform"
    exit 1
fi