fix: send createSession 201 only after the transaction commits

.github/workflows/issue-claim-bot.yml

@@ -0,0 +1,167 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# issue-claim-bot.yml
+#
+# PURPOSE:
+#   • Posts a welcome comment when a new Issue is opened, inviting contributors
+#     to claim it with /claim.
+#   • Handles /claim comments: assigns the issue, adds a label, and replies.
+#   • Prevents duplicate claims and handles all edge cases gracefully.
+#
+# CUSTOMISATION:
+#   CLAIMED_LABEL  — label added when an issue is claimed (created if missing)
+#   EXEMPT_USERS   — comma-separated GitHub usernames who are always allowed
+# ─────────────────────────────────────────────────────────────────────────────
+name: Issue Claim Bot
+
+on:
+  issues:
+    types: [opened]
+  issue_comment:
+    types: [created]   # only new comments; ignore edits/deletions
+
+permissions:
+  issues: write
+  contents: read
+
+env:
+  CLAIMED_LABEL: "claimed"
+
+jobs:
+  # ── JOB 1: Welcome message when a new issue is opened ──────────────────────
+  welcome:
+    name: Post welcome comment
+    runs-on: ubuntu-latest
+    if: github.event_name == 'issues' && github.event.action == 'opened'
+
+    steps:
+      - name: Comment welcome message
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const issueNumber     = context.payload.issue.number;
+
+            await github.rest.issues.createComment({
+              owner, repo,
+              issue_number: issueNumber,
+              body:
+                `Thanks for creating this issue!\n\n` +
+                `If you'd like to work on it, simply comment:\n\n` +
+                `> /claim\n\n` +
+                `The **first** person to claim the issue will be assigned automatically.\n\n` +
+                `Happy contributing!`,
+            });
+            core.info(`Welcome comment posted on #${issueNumber}`);
+
+  # ── JOB 2: Handle /claim comments ─────────────────────────────────────────
+  handle-claim:
+    name: Handle /claim
+    runs-on: ubuntu-latest
+    # Only run on issue_comment events (not issue opened)
+    if: github.event_name == 'issue_comment' && github.event.action == 'created'
+
+    steps:
+      - name: Process /claim command
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const comment  = context.payload.comment;
+            const issue    = context.payload.issue;
+            const actor    = comment.user.login;
+            const LABEL    = process.env.CLAIMED_LABEL;
+
+            // ── Guard: case-insensitive /claim check (trim whitespace) ───────
+            const body = comment.body.trim().toLowerCase();
+            if (body !== "/claim") {
+              core.info("Comment is not '/claim' — ignoring.");
+              return;
+            }
+
+            core.info(`/claim received on #${issue.number} from @${actor}`);
+
+            // ── Guard: skip bots ──────────────────────────────────────────────
+            if (comment.user.type === "Bot" || actor.endsWith("[bot]")) {
+              core.info("Commenter is a bot — ignoring.");
+              return;
+            }
+
+            // ── Guard: skip if this is a PR (issue_comment fires on PRs too) ─
+            if (issue.pull_request) {
+              core.info("This is a PR comment, not an issue — ignoring.");
+              return;
+            }
+
+            // ── Guard: skip closed issues ────────────────────────────────────
+            if (issue.state === "closed") {
+              await github.rest.issues.createComment({
+                owner, repo,
+                issue_number: issue.number,
+                body: `⚠️ @${actor} — This issue is already **closed** and cannot be claimed.`,
+              });
+              return;
+            }
+
+            // ── Check existing assignees ──────────────────────────────────────
+            const assignees = (issue.assignees || []).map(a => a.login);
+
+            if (assignees.length > 0) {
+              // Already claimed — inform the commenter
+              const claimedBy = assignees[0];
+              await github.rest.issues.createComment({
+                owner, repo,
+                issue_number: issue.number,
+                body:
+                  `❌ This issue has already been claimed by **@${claimedBy}**.\n\n` +
+                  `Please look for another open issue or create a new one to contribute.\n\n` +
+                  `Thank you for your interest!`,
+              });
+              core.info(`Issue #${issue.number} already assigned to @${claimedBy} — notified @${actor}.`);
+              return;
+            }
+
+            // ── Assign issue to the claimant ─────────────────────────────────
+            await github.rest.issues.addAssignees({
+              owner, repo,
+              issue_number: issue.number,
+              assignees: [actor],
+            });
+
+            // ── Ensure 'claimed' label exists (create if missing) ─────────────
+            try {
+              await github.rest.issues.getLabel({ owner, repo, name: LABEL });
+            } catch (err) {
+              if (err.status === 404) {
+                await github.rest.issues.createLabel({
+                  owner, repo,
+                  name: LABEL,
+                  color: "0075ca",   // blue
+                  description: "This issue has been claimed by a contributor",
+                });
+                core.info(`Created label '${LABEL}'`);
+              } else {
+                throw err;
+              }
+            }
+
+            // ── Add 'claimed' label ───────────────────────────────────────────
+            await github.rest.issues.addLabels({
+              owner, repo,
+              issue_number: issue.number,
+              labels: [LABEL],
+            });
+
+            // ── Post success comment ──────────────────────────────────────────
+            await github.rest.issues.createComment({
+              owner, repo,
+              issue_number: issue.number,
+              body:
+                `✅ **@${actor}** has successfully claimed this issue!\n\n` +
+                `You've been assigned. Happy coding!\n\n` +
+                `> **Tip:** Please open a Pull Request linked to this issue when you're ready.\n` +
+                `> Add \`Closes #${issue.number}\` in your PR description.`,
+            });
+
+            core.info(`Issue #${issue.number} successfully claimed by @${actor}.`);

.github/workflows/rate-limit-contributions.yml

@@ -0,0 +1,174 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# rate-limit-contributions.yml
+#
+# PURPOSE:
+#   Prevents repository spam by auto-closing any new Issue or Pull Request
+#   from a contributor who already has 3 or more open submissions of that type.
+#
+# CUSTOMISATION:
+#   Change the MAX_OPEN_ISSUES and MAX_OPEN_PRS env vars below to adjust limits.
+#   Admins / maintainers / collaborators are always exempt.
+# ─────────────────────────────────────────────────────────────────────────────
+name: Rate-limit contributions
+
+on:
+  issues:
+    types: [opened]
+  pull_request_target:        # use pull_request_target so GITHUB_TOKEN has write perms on forks
+    types: [opened]
+
+# Minimal, scoped permissions
+permissions:
+  issues: write
+  pull-requests: write
+  contents: read
+
+env:
+  # ── Tune these values to change the limits ──────────────────────────────────
+  MAX_OPEN_ISSUES: 3          # max simultaneous open Issues per contributor
+  MAX_OPEN_PRS: 3             # max simultaneous open PRs per contributor
+  RATE_LIMITED_LABEL: "rate-limited"
+
+jobs:
+  check-rate-limit:
+    runs-on: ubuntu-latest
+    # Skip the check entirely for bots (dependabot, renovate, etc.)
+    if: ${{ !contains(github.actor, '[bot]') }}
+
+    steps:
+      - name: Enforce contribution rate limit
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            // ── Config ─────────────────────────────────────────────────────
+            const MAX_OPEN_ISSUES = parseInt(process.env.MAX_OPEN_ISSUES, 10);
+            const MAX_OPEN_PRS    = parseInt(process.env.MAX_OPEN_PRS,    10);
+            const LABEL           = process.env.RATE_LIMITED_LABEL;
+
+            // ── Excluded contributors (always exempt, regardless of role) ───
+            const EXCLUDED_USERS = [
+              "jainiksha",   // project lead / trusted contributor
+            ];
+
+            const CLOSE_MESSAGE =
+              `Thank you for your contribution!\n\n` +
+              `To keep reviews manageable and maintain repository quality, ` +
+              `contributors may have a maximum of **${MAX_OPEN_ISSUES} open Issues** ` +
+              `and **${MAX_OPEN_PRS} open Pull Requests** at any given time.\n\n` +
+              `Please wait until one of your existing submissions is reviewed or ` +
+              `closed before opening additional ones.\n\n` +
+              `If you believe this was closed by mistake, feel free to contact the maintainers.`;
+
+            const { repo: { owner, repo }, actor } = context;
+            const isIssue = context.eventName === "issues";
+            const itemNumber = isIssue
+              ? context.payload.issue.number
+              : context.payload.pull_request.number;
+
+            core.info(`Event: ${context.eventName}  |  Author: ${actor}  |  #${itemNumber}`);
+
+            // ── 0. Exempt explicitly excluded users ─────────────────────────
+            if (EXCLUDED_USERS.map(u => u.toLowerCase()).includes(actor.toLowerCase())) {
+              core.info(`${actor} is in the exclusion list — skipping rate limit.`);
+              return;
+            }
+
+            // ── 1. Exempt specific contributors, repo owner, admins and collaborators ──
+            const EXEMPT_USERS = ["jainiksha"]; // add more usernames here if needed
+            if (EXEMPT_USERS.map(u => u.toLowerCase()).includes(actor.toLowerCase())) {
+              core.info(`${actor} is in the exempt list — skipping rate limit.`);
+              return;
+            }
+
+            try {
+              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner, repo, username: actor,
+              });
+              // permission levels: admin | maintain | write | triage | read
+              if (["admin", "maintain", "write"].includes(perm.permission)) {
+                core.info(`${actor} has '${perm.permission}' permission — skipping rate limit.`);
+                return;
+              }
+            } catch (err) {
+              // 404 = not a collaborator; any other error → log but continue
+              if (err.status !== 404) core.warning(`Permission check failed: ${err.message}`);
+            }
+
+            // ── 2. Count open Issues / PRs by this author ───────────────────
+            //    GitHub search API: one request for issues, one for PRs.
+            //    We exclude the newly created item from each count so the
+            //    threshold is "already had N open BEFORE this one".
+
+            async function countOpen(type) {
+              // type = "issue" or "pr"
+              const qualifier = type === "issue" ? "is:issue" : "is:pr";
+              const { data } = await github.rest.search.issuesAndPullRequests({
+                q: `repo:${owner}/${repo} is:open ${qualifier} author:${actor}`,
+                per_page: 100,   // max per page; enough for any sane contributor
+              });
+              // Subtract 1 for the item we just opened (it's already in the index)
+              return Math.max(0, data.total_count - 1);
+            }
+
+            const openIssues = isIssue ? await countOpen("issue") : null;
+            const openPRs    = isIssue ? null : await countOpen("pr");
+
+            core.info(`Open issues by ${actor} (excl. current): ${openIssues ?? "n/a"}`);
+            core.info(`Open PRs     by ${actor} (excl. current): ${openPRs    ?? "n/a"}`);
+
+            // ── 3. Decide whether to close ──────────────────────────────────
+            const shouldClose = isIssue
+              ? openIssues >= MAX_OPEN_ISSUES
+              : openPRs   >= MAX_OPEN_PRS;
+
+            if (!shouldClose) {
+              core.info("Within limit — no action needed.");
+              return;
+            }
+
+            core.info(`Limit exceeded — closing #${itemNumber} and adding label '${LABEL}'.`);
+
+            // ── 4. Ensure the label exists (create it if needed) ─────────────
+            try {
+              await github.rest.issues.getLabel({ owner, repo, name: LABEL });
+            } catch {
+              await github.rest.issues.createLabel({
+                owner, repo,
+                name: LABEL,
+                color: "e11d48",   // red-600
+                description: "Closed automatically: contributor rate limit reached",
+              });
+            }
+
+            // ── 5. Add label ─────────────────────────────────────────────────
+            await github.rest.issues.addLabels({
+              owner, repo,
+              issue_number: itemNumber,
+              labels: [LABEL],
+            });
+
+            // ── 6. Post comment ───────────────────────────────────────────────
+            await github.rest.issues.createComment({
+              owner, repo,
+              issue_number: itemNumber,
+              body: CLOSE_MESSAGE,
+            });
+
+            // ── 7. Close the item ─────────────────────────────────────────────
+            if (isIssue) {
+              await github.rest.issues.update({
+                owner, repo,
+                issue_number: itemNumber,
+                state: "closed",
+                state_reason: "not_planned",
+              });
+            } else {
+              await github.rest.pulls.update({
+                owner, repo,
+                pull_number: itemNumber,
+                state: "closed",
+              });
+            }
+
+            core.info(`#${itemNumber} closed successfully.`);