githubRepository.ts

/*---------------------------------------------------------------------------------------------
 *  Copyright (c) Microsoft Corporation. All rights reserved.
 *  Licensed under the MIT License. See License.txt in the project root for license information.
 *--------------------------------------------------------------------------------------------*/

import * as buffer from 'buffer';
import { ApolloQueryResult, DocumentNode, FetchResult, MutationOptions, NetworkStatus, OperationVariables, QueryOptions } from 'apollo-boost';
import LRUCache from 'lru-cache';
import * as vscode from 'vscode';
import { mergeQuerySchemaWithShared, OctokitCommon } from './common';
import { CredentialStore, GitHub } from './credentials';
import {
	AssignableUsersResponse,
	CheckSuiteForRollup,
	CreatePullRequestResponse,
	FileContentResponse,
	ForkDetailsResponse,
	GetBranchResponse,
	GetChecksResponse,
	isCheckRun,
	IssueResponse,
	IssuesSearchResponse,
	ListBranchesResponse,
	MaxIssueResponse,
	MentionableUsersResponse,
	MergeQueueForBranchResponse,
	MilestoneIssuesResponse,
	OrganizationTeamsCountResponse,
	OrganizationTeamsResponse,
	OrgProjectsResponse,
	PullRequestNumberData,
	PullRequestNumbersResponse,
	PullRequestParticipantsResponse,
	PullRequestResponse,
	PullRequestsResponse,
	PullRequestTemplatesResponse,
	RepoProjectsResponse,
	RevertPullRequestResponse,
	SuggestedActorsResponse,
	UserResponse,
	ViewerPermissionResponse,
} from './graphql';
import {
	CheckState,
	GithubItemStateEnum,
	IAccount,
	IMilestone,
	IProject,
	Issue,
	ITeam,
	MergeMethod,
	PullRequest,
	PullRequestChecks,
	PullRequestCheckStatus,
	PullRequestReviewRequirement,
	RepoAccessAndMergeMethods,
	User,
} from './interface';
import { IssueChangeEvent, IssueModel } from './issueModel';
import { getErrorCode, GraphQLError, LoggingOctokit } from './loggingOctokit';
import { PullRequestModel } from './pullRequestModel';
import defaultSchema from './queries.gql';
import * as extraSchema from './queriesExtra.gql';
import * as limitedSchema from './queriesLimited.gql';
import * as sharedSchema from './queriesShared.gql';
import {
	convertRESTPullRequestToRawPullRequest,
	getAvatarWithEnterpriseFallback,
	getOverrideBranch,
	GraphQLAccount,
	isInCodespaces,
	parseAccount,
	parseGraphQLIssue,
	parseGraphQLPullRequest,
	parseGraphQLUser,
	parseGraphQLViewerPermission,
	parseMergeMethod,
	parseMilestone,
	restPaginate,
} from './utils';
import { PullRequestPreview } from './views';
import { StackCandidate } from '../../common/views';
import { AuthenticationError, AuthProvider, GitHubServerType, isSamlError } from '../common/authentication';

import { Disposable, disposeAll } from '../common/lifecycle';

import Logger from '../common/logger';
import { GitHubRemote, parseRemote } from '../common/remote';


import { BRANCH_LIST_TIMEOUT, PR_SETTINGS_NAMESPACE } from '../common/settingKeys';
import { ITelemetry } from '../common/telemetry';
import { compareIgnoreCase, isObject } from '../common/utils';

import { PullRequestCommentController } from '../view/pullRequestCommentController';

import { PRCommentControllerRegistry } from '../view/pullRequestCommentControllerRegistry';


export const PULL_REQUEST_PAGE_SIZE = 20;

const GRAPHQL_COMPONENT_ID = 'GraphQL';

export interface ItemsData<T> {
	items: T[];
	hasMorePages: boolean;
	totalCount?: number;
}

export interface IssueData extends ItemsData<Issue> {
	items: Issue[];
	hasMorePages: boolean;
}

export interface PullRequestData extends ItemsData<PullRequestModel> {
	items: PullRequestModel[];
}

export interface MilestoneData extends ItemsData<{ milestone: IMilestone; issues: IssueModel[] }> {
	items: { milestone: IMilestone; issues: IssueModel[] }[];
	hasMorePages: boolean;
}

export enum ViewerPermission {
	Unknown = 'unknown',
	Admin = 'ADMIN',
	Maintain = 'MAINTAIN',
	Read = 'READ',
	Triage = 'TRIAGE',
	Write = 'WRITE',
}

export class RateLimitError extends Error {
	constructor(message?: string) {
		super(message ?? 'GitHub API rate limit exceeded');
		this.name = 'RateLimitError';
	}
}

export function isRateLimitError(e: unknown): boolean {
	if (e instanceof RateLimitError) {
		return true;
	}
	if (e instanceof Error) {
		const msg = e.message.toLowerCase();
		if (msg.includes('rate limit') || msg.includes('secondary rate') || msg.includes('abuse detection')) {
			return true;
		}
	}
	return false;
}

export enum TeamReviewerRefreshKind {
	None,
	Try,
	Force
}

export interface ForkDetails {
	isFork: boolean;
	parent: {
		owner: {
			login: string;
		};
		name: string;
	};
}

export type IMetadata = OctokitCommon.ReposGetResponseData;

export enum CopilotWorkingStatus {
	NotCopilotIssue = 'NotCopilotIssue',
	InProgress = 'InProgress',
	Error = 'Error',
	Done = 'Done',
}

export interface PullRequestChangeEvent {
	model: IssueModel;
	event: IssueChangeEvent;
}

export class GitHubRepository extends Disposable {
	static ID = 'GitHubRepository';
	private static _allRepoIds: Set<number> = new Set();
	private static _succeededPullRequests: Map<number, Set<number>> = new Map();
	protected _initialized: boolean = false;
	protected _hub: GitHub | undefined;
	protected _metadata: Promise<IMetadata> | undefined;
	private _isInaccessible: boolean = false;
	public commentsController?: vscode.CommentController;
	public commentsHandler?: PRCommentControllerRegistry;
	private _pullRequestModelsByNumber: LRUCache<number, { model: PullRequestModel, disposables: vscode.Disposable[] }> = new LRUCache({
		maxAge: 1000 * 60 * 60 * 4 /* 4 hours */, stale: true, updateAgeOnGet: true,
		dispose: (_key, value) => {
			disposeAll(value.disposables);
			value.model.dispose();
		}
	});
	private _issueModelsByNumber: LRUCache<number, { model: IssueModel, disposables: vscode.Disposable[] }> = new LRUCache({
		maxAge: 1000 * 60 * 60 * 4 /* 4 hours */, stale: true, updateAgeOnGet: true,
		dispose: (_key, value) => {
			disposeAll(value.disposables);
			value.model.dispose();
		}
	});
	// eslint-disable-next-line rulesdir/no-any-except-union-method-signature
	private _queriesSchema: any;
	private _areQueriesLimited: boolean = false;

	private static readonly MAX_ITEM_NUMBER_TTL_MS = 60 * 60 * 1000; /* 1 hour */
	private static readonly MAX_ITEM_NUMBER_BUFFER = 50;
	private _maxItemNumberCache: { value: number; fetchedAt: number } | undefined;
	private _maxItemNumberPromise: Promise<number | undefined> | undefined;
	get areQueriesLimited(): boolean { return this._areQueriesLimited; }
	get isInaccessible(): boolean { return this._isInaccessible; }

	private _branchesCache: Map<string, string[]> = new Map();

	private _onDidAddPullRequest: vscode.EventEmitter<PullRequestModel> = this._register(new vscode.EventEmitter());
	public readonly onDidAddPullRequest: vscode.Event<PullRequestModel> = this._onDidAddPullRequest.event;
	private _onDidChangePullRequests: vscode.EventEmitter<PullRequestChangeEvent[]> = this._register(new vscode.EventEmitter());
	public readonly onDidChangePullRequests: vscode.Event<PullRequestChangeEvent[]> = this._onDidChangePullRequests.event;

	public get hub(): GitHub {
		if (this._hub && this.remote.isEnterprise && (!this.authMatchesServer || !this.remote.matchesServerUri(this._hub.serverUri))) {
			throw new AuthenticationError(vscode.l10n.t('The authentication session no longer matches this GitHub repository. Refresh the repository or sign in again.'));
		}
		if (!this._hub) {
			if (!this._initialized) {
				throw new Error('Call ensure() before accessing this property.');
			} else {
				throw new AuthenticationError();
			}
		}
		return this._hub;
	}

	public equals(repo: GitHubRepository): boolean {
		return this.remote.equals(repo.remote);
	}

	getExistingPullRequestModel(prNumber: number): PullRequestModel | undefined {
		return this._pullRequestModelsByNumber.get(prNumber)?.model;
	}

	getExistingIssueModel(issueNumber: number): IssueModel | undefined {
		return this._issueModelsByNumber.get(issueNumber)?.model;
	}

	get pullRequestModels(): PullRequestModel[] {
		return Array.from(this._pullRequestModelsByNumber.values().map(value => value.model));
	}

	get issueModels(): IssueModel[] {
		return Array.from(this._issueModelsByNumber.values().map(value => value.model));
	}

	public async ensureCommentsController(): Promise<void> {
		try {
			await this.ensure();
			if (this.commentsController) {
				return;
			}
			this.commentsController = vscode.comments.createCommentController(
				`${PullRequestCommentController.PREFIX}-${this.remote.gitProtocol.normalizeUri()?.authority}-${this.remote.remoteName}-${this.remote.owner}-${this.remote.repositoryName}`,
				`Pull Request (${this.remote.owner}/${this.remote.repositoryName})`,
			);
			this.commentsHandler = new PRCommentControllerRegistry(this.commentsController, this.telemetry);
			this._register(this.commentsHandler);
			this._register(this.commentsController);
		} catch (e) {
			console.log(e);
		}
	}

	override dispose() {
		super.dispose();
		GitHubRepository._allRepoIds.delete(this._id);
		for (const repoIds of GitHubRepository._succeededPullRequests.values()) {
			repoIds.delete(this._id);
		}
		this.commentsController = undefined;
		this.commentsHandler = undefined;
	}

	public get octokit(): LoggingOctokit {
		return this.hub && this.hub.octokit;
	}

	private get id(): string {
		return `${GitHubRepository.ID}+${this._id}`;
	}

	constructor(
		private readonly _id: number,
		public remote: GitHubRemote,
		public readonly rootUri: vscode.Uri,
		private readonly _credentialStore: CredentialStore,
		public readonly telemetry: ITelemetry,
		silent: boolean = false
	) {
		super();
		GitHubRepository._allRepoIds.add(this._id);
		this._queriesSchema = mergeQuerySchemaWithShared(sharedSchema.default, defaultSchema);
		this._register(this._credentialStore.onDidChangeSessions(e => {
			if (e.provider.id === this.remote.authProviderId) {
				this._hub = this._credentialStore.getHub(this.remote.authProviderId);
				if (e.accountChanged || e.serverChanged) {
					this._metadata = undefined;
				}
			}
		}));
		// kick off the comments controller early so that the Comments view is visible and doesn't pop up later in an way that's jarring
		if (!silent) {
			this.ensureCommentsController();
		}
	}

	get authMatchesServer(): boolean {
		if ((this.remote.githubServerType === GitHubServerType.GitHubDotCom) && this._credentialStore.isAuthenticated(AuthProvider.github)) {
			return true;
		} else if (this.remote.githubServerType === GitHubServerType.Enterprise) {
			const hub = this._credentialStore.getHub(AuthProvider.githubEnterprise);
			return !!hub && this.remote.matchesServerUri(hub.serverUri);
		} else {
			// Not good. We have a mismatch between auth type and server type.
			return false;
		}
	}

	private async codespacesTokenError<T>(action: QueryOptions | MutationOptions<T>) {
		if (isInCodespaces() && (await this._metadata)?.fork) {
			// :( https://github.com/microsoft/vscode-pull-request-github/issues/5325#issuecomment-1798243852
			/* __GDPR__
				"pr.codespacesTokenError" : {
					"action": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" }
				}
			*/
			this.telemetry.sendTelemetryErrorEvent('pr.codespacesTokenError', {
				action: action.context
			});

			throw new Error(vscode.l10n.t('This action cannot be completed in a GitHub Codespace on a fork.'));
		}
	}

	query = async <T>(query: QueryOptions, ignoreSamlErrors: boolean = false, legacyFallback?: { query: DocumentNode, variables: OperationVariables }, allowLimitedFallback: boolean = true): Promise<ApolloQueryResult<T>> => {
		const gql = this.authMatchesServer && this.hub && this.hub.graphql;
		if (!gql) {
			const logValue = (query.query.definitions[0] as { name: { value: string } | undefined }).name?.value;
			Logger.debug(`Not available for query: ${logValue ?? 'unknown'}`, GRAPHQL_COMPONENT_ID);
			const empty: ApolloQueryResult<T> = {
				data: null as T,
				loading: false,
				networkStatus: NetworkStatus.error,
				stale: false,
			} satisfies ApolloQueryResult<T>;
			return empty;
		}

		let rsp;
		try {
			rsp = await gql.query<T>(query);
		} catch (e) {
			const logInfo = (query.query.definitions[0] as { name: { value: string } | undefined }).name?.value;
			const gqlErrors = e.graphQLErrors ? e.graphQLErrors as GraphQLError[] : undefined;
			Logger.error(`Error querying GraphQL API (${logInfo}): ${e.message}${gqlErrors ? `. ${gqlErrors.map(error => error.extensions?.code).join(',')}` : ''}`, this.id);
			if (legacyFallback) {
				query.query = legacyFallback.query;
				query.variables = legacyFallback.variables;
				return this.query(query, ignoreSamlErrors);
			}

			if (allowLimitedFallback && gqlErrors && gqlErrors.length && (gqlErrors.some(error => error.extensions?.code === 'undefinedField')) && !this._areQueriesLimited) {
				// We're running against a GitHub server that doesn't support the query we're trying to run.
				// Switch to the limited schema and try again.
				this._areQueriesLimited = true;
				this._queriesSchema = mergeQuerySchemaWithShared(sharedSchema.default, limitedSchema.default);
				query.query = this.schema[(query.query.definitions[0] as { name: { value: string } }).name.value];
				rsp = await gql.query<T>(query);
			} else if (ignoreSamlErrors && isSamlError(e)) {
				// Some queries just result in SAML errors.
			} else if ((e.message as string | undefined)?.includes('401 Unauthorized')) {
				await this._credentialStore.recreate(vscode.l10n.t('Your authentication session has lost authorization. You need to sign in again to regain authorization.'));
				rsp = await gql.query<T>(query);
			} else {
				if (e.graphQLErrors && e.graphQLErrors.length && e.graphQLErrors[0].message === 'Resource not accessible by integration') {
					await this.codespacesTokenError(query);
				}
				throw e;
			}
		}
		return rsp;
	};

	mutate = async <T>(mutation: MutationOptions<T>, legacyFallback?: { mutation: DocumentNode, deleteProps: string[] }): Promise<FetchResult<T>> => {
		const gql = this.authMatchesServer && this.hub && this.hub.graphql;
		if (!gql) {
			Logger.debug(`Not available for query: ${mutation.context as string}`, GRAPHQL_COMPONENT_ID);
			const empty: FetchResult<T> = {
				data: null
			};
			return empty;
		}

		let rsp: FetchResult<T>;
		try {
			rsp = await gql.mutate<T>(mutation);
		} catch (e) {
			if (legacyFallback) {
				mutation.mutation = legacyFallback.mutation;
				if (mutation.variables?.input) {
					for (const prop of legacyFallback.deleteProps) {
						delete mutation.variables.input[prop];
					}
				}
				return this.mutate(mutation);
			} else if (e.graphQLErrors && e.graphQLErrors.length && e.graphQLErrors[0].message === 'Resource not accessible by integration') {
				await this.codespacesTokenError(mutation);
			}
			throw e;
		}
		return rsp;
	};

	get schema() {
		return this._queriesSchema;
	}

	private async getMetadataForRepo(owner: string, repo: string): Promise<IMetadata> {
		if (this._metadata && this.remote.owner === owner && this.remote.repositoryName === repo) {
			Logger.debug(`Using cached metadata for repo ${owner}/${repo}`, this.id);
			return this._metadata;
		}

		Logger.debug(`Fetch metadata for repo - enter`, this.id);
		const { octokit } = await this.ensure();
		const result = await octokit.call(octokit.api.repos.get, {
			owner,
			repo
		});
		Logger.debug(`Fetch metadata for repo ${owner}/${repo} - done`, this.id);
		const metadata = { ...result.data, currentUser: await this.getAuthenticatedUser() };
		return metadata;
	}

	async getMetadata(): Promise<IMetadata> {
		if (this._metadata) {
			const metadata = await this._metadata;
			Logger.debug(`Using cached metadata ${metadata.owner?.login}/${metadata.name}`, this.id);
			return metadata;
		}

		Logger.debug(`Fetch metadata - enter`, this.id);
		const { remote } = await this.ensure();
		const metadata = this.getMetadataForRepo(remote.owner, remote.repositoryName).catch(e => {
			if (this._metadata === metadata) {
				if ((getErrorCode(e) === '404') && !isSamlError(e)) {
					if (!this._isInaccessible) {
						this._isInaccessible = true;
						Logger.warn(`Repository ${remote.owner}/${remote.repositoryName} from remote ${remote.remoteName} in workspace folder ${this.rootUri.fsPath} returned HTTP 404 and will be skipped for this session.`, this.id);
					}
				} else {
					this._metadata = undefined;
				}
			}
			throw e;
		});
		this._metadata = metadata;
		Logger.debug(`Fetch metadata ${remote.owner}/${remote.repositoryName} - done`, this.id);
		return metadata;
	}

	/**
	 * Resolves remotes with redirects.
	 * @returns
	 */
	async resolveRemote(): Promise<boolean> {
		try {
			const { clone_url } = await this.getMetadata();
			this.remote = GitHubRemote.remoteAsGitHub(parseRemote(this.remote.remoteName, clone_url, this.remote.gitProtocol)!, this.remote.githubServerType);
		} catch (e) {
			if (this._isInaccessible) {
				return false;
			}
			Logger.warn(`Unable to resolve remote: ${e}`);
			if (isSamlError(e)) {
				return false;
			}
		}
		return true;
	}

	async ensure(additionalScopes: boolean = false): Promise<GitHubRepository> {
		this._initialized = true;
		if (!this._credentialStore.isAuthenticated(this.remote.authProviderId)) {
			// We need auth now. (ex., a PR is already checked out)
			// We can no longer wait until later for login to be done
			await this._credentialStore.create(undefined, additionalScopes);
			if (!this._credentialStore.isAuthenticated(this.remote.authProviderId)) {
				this._hub = await this._credentialStore.showSignInNotification(this.remote.authProviderId);
			}
		} else {
			if (additionalScopes) {
				this._hub = await this._credentialStore.getHubEnsureAdditionalScopes(this.remote.authProviderId);
			} else {
				this._hub = this._credentialStore.getHub(this.remote.authProviderId);
			}
		}

		if (this._hub && !this.remote.matchesServerUri(this._hub.serverUri)) {
			this._hub = undefined;
			const error = new AuthenticationError(vscode.l10n.t('The selected authentication session does not match the GitHub server for this repository.'));
			Logger.warn(error.message, this.id);
			throw error;
		}

		// A session event may have already refreshed the hub before ensure().
		if (this._hub) {
			if (this._areQueriesLimited || this._credentialStore.areScopesOld(this.remote.authProviderId) || (this.remote.authProviderId === AuthProvider.githubEnterprise)) {
				this._areQueriesLimited = true;
				this._queriesSchema = mergeQuerySchemaWithShared(sharedSchema.default, limitedSchema.default);
			} else {
				if (this._credentialStore.areScopesExtra(this.remote.authProviderId)) {
					this._queriesSchema = mergeQuerySchemaWithShared(sharedSchema.default, extraSchema.default);
				} else {
					this._queriesSchema = mergeQuerySchemaWithShared(sharedSchema.default, defaultSchema);
				}
			}
		}
		return this;
	}

	async ensureAdditionalScopes(): Promise<GitHubRepository> {
		return this.ensure(true);
	}

	async getDefaultBranch(): Promise<string> {
		const overrideSetting = getOverrideBranch();
		if (overrideSetting) {
			return overrideSetting;
		}
		try {
			const data = await this.getMetadata();
			return data.default_branch;
		} catch (e) {
			if (!this._isInaccessible) {
				Logger.warn(`Fetching default branch for ${this.remote.owner}/${this.remote.repositoryName} in workspace folder ${this.rootUri.fsPath} failed: ${e}`, this.id);
			}
		}

		return 'master';
	}

	async getPullRequestTemplates(): Promise<string[] | undefined> {
		try {
			Logger.debug('Fetch pull request templates - enter', this.id);
			const { query, remote, schema } = await this.ensure();

			const result = await query<PullRequestTemplatesResponse>({
				query: schema.PullRequestTemplates,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
				}
			});

			Logger.debug('Fetch pull request templates - done', this.id);
			return result.data.repository.pullRequestTemplates.map(template => template.body);
		} catch (e) {
			Logger.error(`Fetching pull request templates failed: ${e}`, this.id);
			const properties: { errorCode?: string } = {};
			const errorCode = getErrorCode(e);
			if (errorCode) {
				properties.errorCode = errorCode;
			}
			/* __GDPR__
				"pr.getPullRequestTemplatesFailed" : {
					"errorCode": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" }
				}
			*/
			this.telemetry.sendTelemetryErrorEvent('pr.getPullRequestTemplatesFailed', properties);
		}
	}

	private _repoAccessAndMergeMethods: RepoAccessAndMergeMethods | undefined;
	async getRepoAccessAndMergeMethods(refetch: boolean = false): Promise<RepoAccessAndMergeMethods> {
		try {
			if (!this._repoAccessAndMergeMethods || refetch) {
				Logger.debug(`Fetch repo permissions and available merge methods - enter`, this.id);
				const data = await this.getMetadata();

				Logger.debug(`Fetch repo permissions and available merge methods - done`, this.id);
				const hasWritePermission = data.permissions?.push ?? false;
				this._repoAccessAndMergeMethods = {
					// Users with push access to repo have rights to merge/close PRs,
					// edit title/description, assign reviewers/labels etc.
					hasWritePermission,
					mergeMethodsAvailability: {
						merge: data.allow_merge_commit ?? false,
						squash: data.allow_squash_merge ?? false,
						rebase: data.allow_rebase_merge ?? false,
					},
					viewerCanAutoMerge: (data.allow_auto_merge && hasWritePermission) ?? false
				};
			}
			return this._repoAccessAndMergeMethods;
		} catch (e) {
			Logger.warn(`GitHubRepository> Fetching repo permissions and available merge methods failed: ${e}`);
		}

		return {
			hasWritePermission: true,
			mergeMethodsAvailability: {
				merge: true,
				squash: true,
				rebase: true,
			},
			viewerCanAutoMerge: false
		};
	}

	private _branchHasMergeQueue: Map<string, MergeMethod> = new Map();
	async mergeQueueMethodForBranch(branch: string): Promise<MergeMethod | undefined> {
		if (this._branchHasMergeQueue.has(branch)) {
			return this._branchHasMergeQueue.get(branch)!;
		}
		try {
			Logger.debug('Fetch branch has merge queue - enter', this.id);
			const { query, remote, schema } = await this.ensure();
			if (!schema.MergeQueueForBranch) {
				return undefined;
			}
			const result = await query<MergeQueueForBranchResponse>({
				query: schema.MergeQueueForBranch,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					branch
				}
			});

			Logger.debug('Fetch branch has merge queue - done', this.id);
			const mergeMethod = parseMergeMethod(result.data.repository.mergeQueue?.configuration?.mergeMethod);
			if (mergeMethod) {
				this._branchHasMergeQueue.set(branch, mergeMethod);
			}
			return mergeMethod;
		} catch (e) {
			Logger.error(`Fetching branch has merge queue failed: ${e}`, this.id);
		}
	}

	async commit(branch: string, message: string, files: Map<string, Uint8Array>): Promise<boolean> {
		Logger.debug(`Committing files to branch ${branch} - enter`, this.id);
		let success = false;
		try {
			const { octokit, remote } = await this.ensure();
			const lastCommitSha = (await octokit.call(octokit.api.repos.getBranch, { owner: remote.owner, repo: remote.repositoryName, branch })).data.commit.sha;
			const lastTreeSha = (await octokit.call(octokit.api.repos.getCommit, { owner: remote.owner, repo: remote.repositoryName, ref: lastCommitSha })).data.commit.tree.sha;
			const treeItems: { path: string, mode: '100644', content: string }[] = [];
			for (const [path, content] of files) {
				treeItems.push({ path: path.substring(1), mode: '100644', content: content.toString() });
			}
			const newTreeSha = (await octokit.call(octokit.api.git.createTree, { owner: remote.owner, repo: remote.repositoryName, base_tree: lastTreeSha, tree: treeItems })).data.sha;
			const newCommitSha = (await octokit.call(octokit.api.git.createCommit, { owner: remote.owner, repo: remote.repositoryName, message, tree: newTreeSha, parents: [lastCommitSha] })).data.sha;
			await octokit.call(octokit.api.git.updateRef, { owner: remote.owner, repo: remote.repositoryName, ref: `heads/${branch}`, sha: newCommitSha });
			success = true;
		} catch (e) {
			// not sure what kinds of errors to expect here
			Logger.error(`Committing files to branch ${branch} failed: ${e}`, this.id);
		}
		Logger.debug(`Committing files to branch ${branch} - done`, this.id);

		return success;
	}

	async getCommitParent(ref: string): Promise<string | undefined> {
		Logger.debug(`Fetch commit for ref ${ref} - enter`, this.id);
		try {
			const { octokit, remote } = await this.ensure();
			const commit = (await octokit.call(octokit.api.repos.getCommit, { owner: remote.owner, repo: remote.repositoryName, ref })).data;
			return commit.parents[0].sha;
		} catch (e) {
			Logger.error(`Fetching commit for ref ${ref} failed: ${e}`, this.id);
		}
		Logger.debug(`Fetch commit for ref ${ref} - done`, this.id);
	}


	async getAllPullRequests(page?: number): Promise<PullRequestData | undefined> {
		let remote: GitHubRemote | undefined;
		try {
			Logger.debug(`Fetch all pull requests - enter`, this.id);
			const ensured = await this.ensure();
			remote = ensured.remote;
			const octokit = ensured.octokit;
			const result = await octokit.call(octokit.api.pulls.list, {
				owner: remote.owner,
				repo: remote.repositoryName,
				per_page: PULL_REQUEST_PAGE_SIZE,
				page: page || 1,
			});

			const hasMorePages = !!result.headers.link && result.headers.link.indexOf('rel="next"') > -1;
			if (!result.data) {
				// We really don't expect this to happen, but it seems to (see #574).
				// Log a warning and return an empty set.
				Logger.warn(
					`No result data for ${remote.owner}/${remote.repositoryName} Status: ${result.status}`,
				);
				return {
					items: [],
					hasMorePages: false,
					totalCount: 0
				};
			}

			const pullRequests = result.data
				.map(pullRequest => {
					if (!pullRequest.head.repo) {
						Logger.appendLine('The remote branch for this PR was already deleted.', this.id);
						return null;
					}

					return this.createOrUpdatePullRequestModel(
						convertRESTPullRequestToRawPullRequest(pullRequest, this),
					);
				})
				.filter(item => item !== null) as PullRequestModel[];

			Logger.debug(`Fetch all pull requests - done`, this.id);
			return {
				items: pullRequests,
				hasMorePages
			};
		} catch (e) {
			Logger.error(`Fetching all pull requests failed: ${e}`, this.id);
			if (e.status === 404) {
				// not found
				vscode.window.showWarningMessage(
					`Fetching all pull requests for remote '${remote?.remoteName}' failed, please check if the repository ${remote?.owner}/${remote?.repositoryName} is valid.`,
				);
			} else {
				throw e;
			}
		}
		return undefined;
	}

	async getPullRequestNumbers(): Promise<PullRequestNumberData[] | undefined> {
		let remote: GitHubRemote | undefined;
		try {
			Logger.debug(`Fetch pull request numbers - enter`, this.id);
			const ensured = await this.ensure();
			remote = ensured.remote;
			const { query, schema } = ensured;
			const { data } = await query<PullRequestNumbersResponse>({
				query: schema.PullRequestNumbers,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					first: 100,
				},
			});
			Logger.debug(`Fetch pull request numbers - done`, this.id);

			if (data?.repository?.pullRequests) {
				return data.repository.pullRequests.nodes;
			}
		} catch (e) {
			Logger.error(`Fetching pull request numbers failed: ${e}`, this.id);
			if (e.status === 404) {
				// not found
				vscode.window.showWarningMessage(
					`Fetching pull request numbers for remote '${remote?.remoteName}' failed, please check if the repository ${remote?.owner}/${remote?.repositoryName} is valid.`,
				);
			} else {
				throw e;
			}
		}
		return undefined;
	}

	async getPullRequestForBranch(branch: string, headOwner: string, throwOnError: boolean = false): Promise<PullRequestModel | undefined> {
		let remote: GitHubRemote | undefined;
		try {
			Logger.debug(`Fetch pull requests for branch - enter`, this.id);
			const ensured = await this.ensure();
			remote = ensured.remote;
			const { query, schema } = ensured;
			const { data } = await query<PullRequestsResponse>({
				query: schema.PullRequestForHead,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					headRefName: branch,
				},
			});
			Logger.debug(`Fetch pull requests for branch - done`, this.id);

			if (data?.repository) {
				const nodes = [...data.repository.openPullRequests.nodes, ...data.repository.pullRequests.nodes]
					.filter((pullRequest, index, pullRequests) => pullRequests.findIndex(candidate => candidate.number === pullRequest.number) === index);
				const prs = (await Promise.all(nodes.map(node => parseGraphQLPullRequest(node, this)))).filter(pr => pr.head && compareIgnoreCase(pr.head.repo.owner, headOwner) === 0);
				if (prs.length === 0) {
					return undefined;
				}
				const mostRecentOrOpenPr = prs.find(pr => pr.state.toLowerCase() === 'open') ?? prs[0];
				return this.createOrUpdatePullRequestModel(mostRecentOrOpenPr);
			}
		} catch (e) {
			Logger.error(`Fetching pull request for branch failed: ${e}`, this.id);
			if (throwOnError) {
				throw e;
			}
			if (e.status === 404) {
				// not found
				vscode.window.showWarningMessage(
					`Fetching pull request for branch for remote '${remote?.remoteName}' failed, please check if the repository ${remote?.owner}/${remote?.repositoryName} is valid.`,
				);
			}
		}
		return undefined;
	}

	async getStackCandidate(baseBranch: string): Promise<StackCandidate | undefined> {
		const parent = await this.getPullRequestForBranch(baseBranch, this.remote.owner, true);
		if (!parent || parent.state !== GithubItemStateEnum.Open || parent.head?.ref !== baseBranch
			|| parent.head.owner.toLowerCase() !== this.remote.owner.toLowerCase()
			|| parent.head.repositoryCloneUrl.repositoryName.toLowerCase() !== this.remote.repositoryName.toLowerCase()) {
			return;
		}

		const { octokit, remote } = await this.ensure();
		let data: unknown;
		try {
			({ data } = await octokit.call(() => octokit.api.request('GET /repos/{owner}/{repo}/stacks', {
				owner: remote.owner,
				repo: remote.repositoryName,
				pull_request: parent.number,
				per_page: 1,
				headers: { 'X-GitHub-Api-Version': '2026-03-10' },
			})));
		} catch (error) {
			const response = isObject(error) && isObject(error.response) ? error.response.data : undefined;
			const unsupportedVersion = isObject(response) && [response.message, response.errors].some(detail => {
				if (typeof detail !== 'string') {
					return false;
				}
				const text = detail.toLowerCase();
				return text.includes('version') && (text.includes('not supported') || text.includes('not a supported version'));
			});
			if (isObject(error) && (error.status === 404 || (error.status === 400 && unsupportedVersion))) {
				Logger.debug('Pull request stacks are not supported by this GitHub server.', this.id);
				return;
			}
			throw error;
		}

		if (!Array.isArray(data) || data.length > 1) {
			throw new Error('GitHub returned an invalid pull request stack list.');
		}
		if (data.length === 0) {
			return { parentPullRequestNumber: parent.number, size: 1, url: parent.html_url };
		}
		const stack: unknown = data[0];
		if (!isObject(stack) || typeof stack.number !== 'number' || !Array.isArray(stack.pull_requests)
			|| stack.pull_requests.length === 0) {
			throw new Error('GitHub returned an invalid pull request stack.');
		}
		const top: unknown = stack.pull_requests[stack.pull_requests.length - 1];
		if (!isObject(top) || typeof top.number !== 'number') {
			throw new Error('GitHub returned an invalid pull request stack entry.');
		}
		if (top.number !== parent.number) {
			return;
		}
		return { parentPullRequestNumber: parent.number, stackNumber: stack.number, size: stack.pull_requests.length, url: parent.html_url };
	}

	async addPullRequestToStack(candidate: StackCandidate, number: number): Promise<void> {
		const { octokit, remote } = await this.ensure();
		const params = {
			owner: remote.owner,
			repo: remote.repositoryName,
			headers: { 'X-GitHub-Api-Version': '2026-03-10' },
		};
		const stackNumber = candidate.stackNumber;
		if (stackNumber !== undefined) {
			await octokit.call(() => octokit.api.request('POST /repos/{owner}/{repo}/stacks/{stack_number}/add', {
				...params,
				stack_number: stackNumber,
				pull_requests: [number],
			}));
		} else {
			await octokit.call(() => octokit.api.request('POST /repos/{owner}/{repo}/stacks', {
				...params,
				pull_requests: [candidate.parentPullRequestNumber, number],
			}));
		}
	}

	async canGetProjectsNow(): Promise<boolean> {
		let { schema } = await this.ensure();
		if (schema.GetRepoProjects && schema.GetOrgProjects) {
			return true;
		}
		return false;
	}

	async getOrgProjects(): Promise<IProject[]> {
		Logger.debug(`Fetch org projects - enter`, this.id);
		let { query, remote, schema } = await this.ensure();
		const projects: IProject[] = [];

		try {
			const { data } = await query<OrgProjectsResponse>({
				query: schema.GetOrgProjects,
				variables: {
					owner: remote.owner,
					after: null,
				}
			});

			if (data && data.organization.projectsV2 && data.organization.projectsV2.nodes) {
				data.organization.projectsV2.nodes.forEach(raw => {
					projects.push(raw);
				});
			}

		} catch (e) {
			Logger.error(`Unable to fetch org projects: ${e}`, this.id);
			return projects;
		}
		Logger.debug(`Fetch org projects - done`, this.id);

		return projects;
	}

	async getProjects(): Promise<IProject[] | undefined> {
		try {
			Logger.debug(`Fetch projects - enter`, this.id);
			let { query, remote, schema } = await this.ensure();
			if (!schema.GetRepoProjects) {
				const additional = await this.ensureAdditionalScopes();
				query = additional.query;
				remote = additional.remote;
				schema = additional.schema;
			}
			const { data } = await query<RepoProjectsResponse>({
				query: schema.GetRepoProjects,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
				},
			});
			Logger.debug(`Fetch projects - done`, this.id);

			const projects: IProject[] = [];
			if (data && data.repository?.projectsV2 && data.repository.projectsV2.nodes) {
				data.repository.projectsV2.nodes.forEach(raw => {
					projects.push(raw);
				});
			}
			return projects;
		} catch (e) {
			Logger.error(`Unable to fetch projects: ${e}`, this.id);
			return;
		}
	}

	async getMilestones(includeClosed: boolean = false): Promise<IMilestone[] | undefined> {
		try {
			Logger.debug(`Fetch milestones - enter`, this.id);
			const { query, remote, schema } = await this.ensure();
			const states = ['OPEN'];
			if (includeClosed) {
				states.push('CLOSED');
			}
			const { data } = await query<MilestoneIssuesResponse>({
				query: schema.GetMilestones,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					states: states,
				},
			});
			Logger.debug(`Fetch milestones - done`, this.id);

			const milestones: IMilestone[] = [];
			if (data && data.repository?.milestones && data.repository.milestones.nodes) {
				data.repository.milestones.nodes.forEach(raw => {
					const milestone = parseMilestone(raw);
					if (milestone) {
						milestones.push(milestone);
					}
				});
			}
			return milestones;
		} catch (e) {
			Logger.error(`Unable to fetch milestones: ${e}`, this.id);
			return;
		}
	}

	async getLines(sha: string, file: string, lineStart: number, lineEnd: number): Promise<string | undefined> {
		Logger.debug(`Fetch milestones - enter`, this.id);
		const { query, remote, schema } = await this.ensure();
		const { data } = await query<FileContentResponse>({
			query: schema.GetFileContent,
			variables: {
				owner: remote.owner,
				name: remote.repositoryName,
				expression: `${sha}:${file}`
			}
		});

		if (!data.repository?.object.text) {
			return undefined;
		}

		return data.repository.object.text.split('\n').slice(lineStart - 1, lineEnd).join('\n');
	}

	async getIssues(page?: number, queryString?: string): Promise<IssueData | undefined> {
		try {
			Logger.debug(`Fetch issues with query - enter`, this.id);
			const { query, schema } = await this.ensure();
			const { data } = await query<IssuesSearchResponse>({
				query: schema.Issues,
				variables: {
					query: `${queryString} type:issue`,
				},
			});
			Logger.debug(`Fetch issues with query - done`, this.id);

			let issues: Issue[] = [];
			if (data && data.search.edges) {
				// Preserve the order returned by the server (e.g. sort:created-desc).
				// Using `Promise.all(map(async ... push))` would reorder results by completion time.
				const parsed = await Promise.all(data.search.edges.map(async raw => {
					if (raw.node.id) {
						return parseGraphQLIssue(raw.node, this);
					}
					return undefined;
				}));
				issues = parsed.filter((issue): issue is Issue => issue !== undefined);
			}
			return {
				items: issues,
				hasMorePages: data.search.pageInfo.hasNextPage,
				totalCount: data.search.issueCount
			};
		} catch (e) {
			Logger.error(`Unable to fetch issues with query: ${e}`, this.id);
			return;
		}
	}

	private async _getMaxItem(isIssue: boolean): Promise<number | undefined> {
		try {
			Logger.debug(`Fetch max ${isIssue ? 'issue' : 'pull request'} - enter`, this.id);
			const { query, remote, schema } = await this.ensure();
			const { data } = await query<MaxIssueResponse>({
				query: isIssue ? schema.MaxIssue : schema.MaxPullRequest,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
				},
			});
			Logger.debug(`Fetch max ${isIssue ? 'issue' : 'pull request'} - done`, this.id);

			if (data?.repository && data.repository.issues.edges.length === 1) {
				return data.repository.issues.edges[0].node.number;
			}
			return;
		} catch (e) {
			Logger.error(`Unable to fetch ${isIssue ? 'issues' : 'pull requests'} with query: ${e}`, this.id);
			return;
		}
	}

	async getMaxIssue(): Promise<number | undefined> {
		return this._getMaxItem(true);
	}

	async getMaxPullRequest(): Promise<number | undefined> {
		return this._getMaxItem(false);
	}

	/**
	 * Returns the highest known issue or pull request number for this repository.
	 * Issues and pull requests share the same number sequence on GitHub, so the
	 * larger of the two latest items is an upper bound for any valid number.
	 * Result is cached for a short TTL to avoid extra round-trips.
	 */
	private async getCachedMaxItemNumber(forceRefresh: boolean = false): Promise<number | undefined> {
		const now = Date.now();
		if (!forceRefresh && this._maxItemNumberCache && (now - this._maxItemNumberCache.fetchedAt) < GitHubRepository.MAX_ITEM_NUMBER_TTL_MS) {
			return this._maxItemNumberCache.value;
		}
		if (this._maxItemNumberPromise) {
			return this._maxItemNumberPromise;
		}
		this._maxItemNumberPromise = (async () => {
			const [maxIssue, maxPr] = await Promise.all([this._getMaxItem(true), this._getMaxItem(false)]);
			const max = Math.max(maxIssue ?? 0, maxPr ?? 0);
			if (max > 0) {
				this._maxItemNumberCache = { value: max, fetchedAt: Date.now() };
				return max;
			}
			return undefined;
		})();
		try {
			return await this._maxItemNumberPromise;
		} finally {
			this._maxItemNumberPromise = undefined;
		}
	}

	/**
	 * Returns false when `number` is implausibly higher than the latest known
	 * issue/PR number for this repository. Used to short-circuit fetches for
	 * numbers that came from arbitrary text (e.g. `#1234567890` in source code)
	 * before they hit the network and produce noisy error telemetry.
	 */
	private async isPlausibleItemNumber(itemNumber: number): Promise<boolean> {
		if (!Number.isFinite(itemNumber) || itemNumber <= 0) {
			return false;
		}
		let max = await this.getCachedMaxItemNumber();
		if (max === undefined) {
			// Couldn't determine the max (e.g. network error); allow through.
			return true;
		}
		if (itemNumber <= max + GitHubRepository.MAX_ITEM_NUMBER_BUFFER) {
			return true;
		}
		// Number is above the cached max; refresh once before deciding to handle newly-created items.
		max = await this.getCachedMaxItemNumber(true);
		if (max === undefined) {
			return true;
		}
		return itemNumber <= max + GitHubRepository.MAX_ITEM_NUMBER_BUFFER;
	}

	async getViewerPermission(): Promise<ViewerPermission> {
		try {
			Logger.debug(`Fetch viewer permission - enter`, this.id);
			const { query, remote, schema } = await this.ensure();
			const { data } = await query<ViewerPermissionResponse>({
				query: schema.GetViewerPermission,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
				},
			});
			Logger.debug(`Fetch viewer permission - done`, this.id);
			return parseGraphQLViewerPermission(data);
		} catch (e) {
			Logger.error(`Unable to fetch viewer permission: ${e}`, this.id);
			if (isRateLimitError(e)) {
				throw new RateLimitError();
			}
			return ViewerPermission.Unknown;
		}
	}

	public async getWorkflowRunsFromAction(fromDate: string): Promise<OctokitCommon.ListWorkflowRunsForRepo[]> {
		const { octokit, remote } = await this.ensure();
		const createdDate = new Date(fromDate);
		const created = `>=${createdDate.getFullYear()}-${String(createdDate.getMonth() + 1).padStart(2, '0')}-${String(createdDate.getDate()).padStart(2, '0')}`;
		const allRuns = await restPaginate<typeof octokit.api.actions.listWorkflowRunsForRepo, OctokitCommon.ListWorkflowRunsForRepo>(octokit.api.actions.listWorkflowRunsForRepo, {
			owner: remote.owner,
			repo: remote.repositoryName,
			event: 'dynamic',
			created
		});

		return allRuns;
	}

	public async getWorkflowJobs(workflowRunId: number): Promise<OctokitCommon.WorkflowJob[]> {
		const { octokit, remote } = await this.ensure();
		const jobs = await octokit.call(octokit.api.actions.listJobsForWorkflowRun, {
			owner: remote.owner,
			repo: remote.repositoryName,
			run_id: workflowRunId
		});
		return jobs.data.jobs;
	}

	async getCheckRunLogs(checkRunDatabaseId: number): Promise<string> {
		Logger.debug(`Fetch check run logs - enter`, this.id);
		const { octokit, remote } = await this.ensure();

		// Try GitHub Actions logs first (works for Actions workflow runs)
		try {
			const result = await octokit.call(octokit.api.actions.downloadJobLogsForWorkflowRun, {
				owner: remote.owner,
				repo: remote.repositoryName,
				job_id: checkRunDatabaseId,
			});
			Logger.debug(`Fetch check run logs via Actions API - done`, this.id);
			return result.data as string;
		} catch {
			// Not a GitHub Actions job - fall through to Checks API
		}

		// Fall back to Checks API output (works for any GitHub App, e.g. Azure Pipelines)
		try {
			const result = await octokit.call(octokit.api.checks.get, {
				owner: remote.owner,
				repo: remote.repositoryName,
				check_run_id: checkRunDatabaseId,
			});
			const output = result.data.output;
			const parts: string[] = [];
			if (output.title) {
				parts.push(output.title);
				parts.push('');
			}
			if (output.summary) {
				parts.push(output.summary);
				parts.push('');
			}
			if (output.text) {
				parts.push(output.text);
			}
			if (parts.length === 0) {
				return 'No log output available for this check run.';
			}
			Logger.debug(`Fetch check run logs via Checks API - done`, this.id);
			return parts.join('\n');
		} catch (e) {
			Logger.error(`Unable to fetch check run logs: ${e}`, this.id);
			throw e;
		}
	}

	async fork(): Promise<string | undefined> {
		try {
			Logger.debug(`Fork repository`, this.id);
			const { octokit, remote } = await this.ensure();
			const result = await octokit.call(octokit.api.repos.createFork, {
				owner: remote.owner,
				repo: remote.repositoryName,
			});
			Logger.debug(`Fork repository - done`, this.id);
			// GitHub can say the fork succeeded but it isn't actually ready yet.
			// So we wait up to 5 seconds for the fork to be ready
			const start = Date.now();
			let exists = async () => {
				try {
					await octokit.call(octokit.api.repos.get, { owner: result.data.owner.login, repo: result.data.name });
					Logger.appendLine('Fork ready', this.id);
					return true;
				} catch (e) {
					Logger.appendLine('Fork not ready yet', this.id);
					return false;
				}
			};
			while (!(await exists()) && ((Date.now() - start) < 5000)) {
				await new Promise(resolve => setTimeout(resolve, 500));
			}

			return result.data.clone_url;
		} catch (e) {
			Logger.error(`GitHubRepository> Forking repository failed: ${e}`, this.id);
			return undefined;
		}
	}

	async getRepositoryForkDetails(): Promise<ForkDetails | undefined> {
		try {
			Logger.debug(`Fetch repository fork details - enter`, this.id);
			const { query, remote, schema } = await this.ensure();
			const { data } = await query<ForkDetailsResponse>({
				query: schema.GetRepositoryForkDetails,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
				},
			});
			Logger.debug(`Fetch repository fork details - done`, this.id);
			return data.repository;
		} catch (e) {
			Logger.error(`Unable to fetch repository fork details: ${e}`, this.id);
			return;
		}
	}

	async getAuthenticatedUser(): Promise<IAccount> {
		return await this._credentialStore.getCurrentUser(this.remote.authProviderId);
	}

	async getAuthenticatedUserEmails(): Promise<string[]> {
		try {
			Logger.debug(`Fetch authenticated user emails - enter`, this.id);
			const { octokit } = await this.ensure();
			const { data } = await octokit.call(octokit.api.users.listEmailsForAuthenticatedUser, {});
			Logger.debug(`Fetch authenticated user emails - done`, this.id);
			// sort the primary email to the first index
			const hasPrivate = data.some(email => email.visibility === 'private');
			return data.filter(email => hasPrivate ? email.email.endsWith('@users.noreply.github.com') : email.verified)
				.sort((a, b) => +b.primary - +a.primary)
				.map(email => email.email);
		} catch (e) {
			Logger.error(`Unable to fetch authenticated user emails: ${e}`, this.id);
			return [];
		}
	}

	createOrUpdatePullRequestModel(pullRequest: PullRequest, silent: boolean = false): PullRequestModel {
		let model = this._pullRequestModelsByNumber.get(pullRequest.number)?.model;
		if (model) {
			model.update(pullRequest);
		} else {
			model = new PullRequestModel(this._credentialStore, this.telemetry, this, this.remote, pullRequest);
			const prModel = model;
			const disposables: vscode.Disposable[] = [];
			disposables.push(model.onDidChange(e => this._onPullRequestModelChanged(prModel, e)));
			this._pullRequestModelsByNumber.set(pullRequest.number, { model, disposables });
			if (!silent) {
				this._onDidAddPullRequest.fire(model);
			}
		}

		return model;
	}

	private createOrUpdateIssueModel(issue: Issue): IssueModel {
		let model = this._issueModelsByNumber.get(issue.number)?.model;
		if (model) {
			model.update(issue);
		} else {
			model = new IssueModel(this.telemetry, this, this.remote, issue);
			// No issue-specific event emitters yet; store empty disposables list for symmetry/cleanup
			const disposables: vscode.Disposable[] = [];
			this._issueModelsByNumber.set(issue.number, { model, disposables });
		}
		return model;
	}

	private _onPullRequestModelChanged(model: PullRequestModel, change: IssueChangeEvent): void {
		this._onDidChangePullRequests.fire([{ model, event: change }]);
	}

	async createPullRequest(params: OctokitCommon.PullsCreateParams): Promise<PullRequestModel> {
		try {
			Logger.debug(`Create pull request - enter`, this.id);
			const metadata = await this.getMetadata();
			const { mutate, schema } = await this.ensure();

			const { data } = await mutate<CreatePullRequestResponse>({
				mutation: schema.CreatePullRequest,
				variables: {
					input: {
						repositoryId: metadata.node_id,
						baseRefName: params.base,
						headRefName: params.head,
						title: params.title,
						body: params.body,
						draft: params.draft
					}
				}
			});
			Logger.debug(`Create pull request - done`, this.id);
			if (!data) {
				throw new Error('Failed to create pull request.');
			}
			return this.createOrUpdatePullRequestModel(await parseGraphQLPullRequest(data.createPullRequest.pullRequest, this));
		} catch (e) {
			Logger.error(`Unable to create PR: ${e}`, this.id);
			throw e;
		}
	}

	async revertPullRequest(pullRequestId: string, title: string, body: string, draft: boolean): Promise<PullRequestModel> {
		try {
			Logger.debug(`Revert pull request - enter`, this.id);
			const { mutate, schema } = await this.ensure();

			const { data } = await mutate<RevertPullRequestResponse>({
				mutation: schema.RevertPullRequest,
				variables: {
					input: {
						pullRequestId,
						title,
						body,
						draft
					}
				}
			});
			Logger.debug(`Revert pull request - done`, this.id);
			if (!data) {
				throw new Error('Failed to create revert pull request.');
			}
			return this.createOrUpdatePullRequestModel(await parseGraphQLPullRequest(data.revertPullRequest.revertPullRequest, this));
		} catch (e) {
			Logger.error(`Unable to create revert PR: ${e}`, this.id);
			throw e;
		}
	}

	async getPullRequestPreview(number: number): Promise<PullRequestPreview> {
		if (!Number.isSafeInteger(number) || number <= 0) {
			throw new Error(`Invalid pull request number: ${number}`);
		}
		const { query, remote, schema } = await this.ensure();
		type PreviewData = Omit<PullRequestPreview, 'author' | 'base' | 'head'> & {
			author: GraphQLAccount | null;
			baseRefName: string;
			headRefName: string;
			baseRepository: { owner: { login: string } };
			headRepository: { owner: { login: string } } | null;
		};
		const { data } = await query<{ repository: { pullRequest: PreviewData | null } | null }>({
			query: schema.PullRequestPreview,
			variables: { owner: remote.owner, name: remote.repositoryName, number },
		});
		if (!data.repository?.pullRequest) {
			throw new Error(`Unable to load pull request preview for ${remote.owner}/${remote.repositoryName}#${number}`);
		}
		// A preview must never populate the shared cache of actionable PR models.
		const { author, baseRefName, headRefName, baseRepository, headRepository, ...preview } = data.repository.pullRequest;
		return {
			...preview,
			author: parseAccount(author, this),
			base: `${baseRepository.owner.login}/${remote.repositoryName}:${baseRefName}`,
			head: headRepository ? `${headRepository.owner.login}/${remote.repositoryName}:${headRefName}` : '',
		};
	}

	async getPullRequest(id: number, callerName: string, useCache: boolean = false, silent: boolean = false, loadMode: 'default' | 'overview' = 'default'): Promise<PullRequestModel | undefined> {
		if (useCache && this._pullRequestModelsByNumber.has(id)) {
			Logger.debug(`Using cached pull request model for ${id}`, this.id);
			return this._pullRequestModelsByNumber.get(id)!.model;
		}

		// Explicit overview requests already identify a PR; the max-number lookup is
		// only useful for speculative references extracted from text.
		if (!Number.isSafeInteger(id) || id <= 0 || (loadMode === 'default' && !(await this.isPlausibleItemNumber(id)))) {
			Logger.debug(`Skipping pull request fetch for implausible number ${id} (caller: ${callerName})`, this.id);
			return;
		}

		try {
			const { query, remote, schema } = await this.ensure();
			Logger.debug(`Fetch pull request ${remote.owner}/${remote.repositoryName} ${id} - enter`, this.id);

			const { data } = await query<PullRequestResponse>({
				query: schema.PullRequest,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					number: id,
				},
			}, true);
			if (data.repository === null) {
				Logger.error('Unexpected null repository when getting PR', this.id);
				return;
			}

			Logger.debug(`Fetch pull request ${id} - done`, this.id);
			const pr = this.createOrUpdatePullRequestModel(await parseGraphQLPullRequest(data.repository.pullRequest, this), silent);
			if (loadMode === 'default') {
				await pr.getLastUpdateTime(new Date(pr.item.updatedAt));
			}
			let repoIds = GitHubRepository._succeededPullRequests.get(id);
			if (!repoIds) {
				repoIds = new Set();
				GitHubRepository._succeededPullRequests.set(id, repoIds);
			}
			repoIds.add(this._id);
			return pr;
		} catch (e) {
			Logger.error(`Unable to fetch PR: ${e}`, this.id);
			const succeededRepos = GitHubRepository._succeededPullRequests.get(id);
			const succeededInOtherRepo = succeededRepos ? succeededRepos.size > 0 && !succeededRepos.has(this._id) : false;
			const properties: { succeededInOtherRepo: string; callerName: string; errorCode?: string } = {
				succeededInOtherRepo: String(succeededInOtherRepo),
				callerName
			};
			const errorCode = getErrorCode(e);
			if (errorCode) {
				properties.errorCode = errorCode;
			}
			/* __GDPR__
				"pr.getPullRequestFailed" : {
					"prNumber": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" },
					"gitHubRepoCount": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" },
					"succeededInOtherRepo": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" },
					"errorCode": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" },
					"callerName": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" }
				}
			*/
			this.telemetry.sendTelemetryErrorEvent('pr.getPullRequestFailed', properties, {
				prNumber: id,
				gitHubRepoCount: GitHubRepository._allRepoIds.size
			});
			return;
		}
	}

	async getIssue(id: number, withComments: boolean = false, useCache: boolean = false): Promise<IssueModel | undefined> {
		if (useCache) {
			const cached = this._issueModelsByNumber.get(id)?.model;
			if (cached) {
				Logger.debug(`Using cached issue model for ${id}`, this.id);
				return cached;
			}
		}
		if (!(await this.isPlausibleItemNumber(id))) {
			Logger.debug(`Skipping issue fetch for implausible number ${id}`, this.id);
			return undefined;
		}
		try {
			Logger.debug(`Fetch issue ${id} - enter`, this.id);
			const { query, remote, schema } = await this.ensure();

			const { data } = await query<IssueResponse>({
				query: withComments ? schema.IssueWithComments : schema.Issue,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					number: id,
				},
			}, true); // Don't retry on SAML errors as it's too disruptive for this query.

			if (data.repository === null) {
				Logger.error('Unexpected null repository when getting issue', this.id);
				return undefined;
			}
			Logger.debug(`Fetch issue ${id} - done`, this.id);

			const issue = this.createOrUpdateIssueModel(await parseGraphQLIssue(data.repository.issue, this));
			await issue.getLastUpdateTime(new Date(issue.item.updatedAt));
			return issue;
		} catch (e) {
			Logger.error(`Unable to fetch issue: ${e}`, this.id);
			return;
		}
	}

	/**
	 * Gets file content for a file at the specified commit
	 * @param filePath The file path
	 * @param ref The commit
	 */
	async getFile(filePath: string, ref: string): Promise<Uint8Array> {
		const { octokit, remote } = await this.ensure();
		let contents: string = '';
		let fileContent: { data: { content: string; encoding: string; sha: string } };
		Logger.debug(`Fetch file ${filePath} - enter`, this.id);
		try {
			fileContent = (await octokit.call(octokit.api.repos.getContent,
				{
					owner: remote.owner,
					repo: remote.repositoryName,
					path: filePath,
					ref,
				},
			)) as { data: { content: string; encoding: string; sha: string } };

			if (Array.isArray(fileContent.data)) {
				throw new Error(`Unexpected array response when getting file ${filePath}`);
			}

			contents = fileContent.data.content ?? '';
		} catch (e) {
			Logger.error(`Unable to fetch file ${filePath}: ${e}`, this.id);
			if (e.status === 404) {
				return new Uint8Array(0);
			}
			throw e;
		}

		// Empty contents and 'none' encoding indcates that the file has been truncated and we should get the blob.
		if (contents === '' && fileContent.data.encoding === 'none') {
			Logger.debug(`Fetch blob file ${filePath} - enter`, this.id);
			const fileSha = fileContent.data.sha;
			fileContent = await octokit.call(octokit.api.git.getBlob, {
				owner: remote.owner,
				repo: remote.repositoryName,
				file_sha: fileSha,
			});
			contents = fileContent.data.content;
			Logger.debug(`Fetch blob file ${filePath} - done`, this.id);
		}

		const buff = buffer.Buffer.from(contents, fileContent.data.encoding as BufferEncoding);
		Logger.debug(`Fetch file ${filePath}, file length ${contents.length} - done`, this.id);
		return buff;
	}

	async hasBranch(branchName: string): Promise<string | undefined> {
		Logger.appendLine(`Fetch branch ${branchName} - enter`, this.id);
		const { query, remote, schema } = await this.ensure();

		const { data } = await query<GetBranchResponse>({
			query: schema.GetBranch,
			variables: {
				owner: remote.owner,
				name: remote.repositoryName,
				qualifiedName: `refs/heads/${branchName}`,
			}
		});
		Logger.appendLine(`Fetch branch ${branchName} - done: ${data.repository?.ref !== null}`, this.id);
		return data.repository?.ref?.target.oid;
	}

	private branchesCacheKey(owner: string, repositoryName: string): string {
		return `${owner}/${repositoryName}`;
	}

	getCachedBranches(owner: string, repositoryName: string): string[] | undefined {
		return this._branchesCache.get(this.branchesCacheKey(owner, repositoryName));
	}

	async listBranches(owner: string, repositoryName: string, prefix: string | undefined): Promise<string[]> {
		const { query, remote, schema } = await this.ensure();
		Logger.debug(`List branches for ${owner}/${repositoryName} - enter`, this.id);

		let after: string | null = null;
		let hasNextPage = false;
		const branches: string[] = [];
		const defaultBranch = (await this.getMetadataForRepo(owner, repositoryName)).default_branch;
		const startingTime = new Date().getTime();
		const timeout = vscode.workspace.getConfiguration(PR_SETTINGS_NAMESPACE).get<number>(BRANCH_LIST_TIMEOUT, 5000);

		do {
			try {
				const { data } = await query<ListBranchesResponse>({
					query: schema.ListBranches,
					variables: {
						owner: remote.owner,
						name: remote.repositoryName,
						first: 100,
						after: after,
						query: prefix ? prefix : null,
					},
				});

				branches.push(...data.repository.refs.nodes.map(node => node.name));
				if (new Date().getTime() - startingTime > timeout) {
					Logger.warn(`List branches timeout hit after ${timeout}ms.`, this.id);
					break;
				}
				hasNextPage = data.repository.refs.pageInfo.hasNextPage;
				after = data.repository.refs.pageInfo.endCursor;
			} catch (e) {
				Logger.debug(`List branches for ${owner}/${repositoryName} failed`, this.id);
				throw e;
			}
		} while (hasNextPage);

		Logger.debug(`List branches for ${owner}/${repositoryName} - done`, this.id);
		if (!branches.includes(defaultBranch)) {
			branches.unshift(defaultBranch);
		}
		// Cache results for unprefixed queries
		if (!prefix) {
			this._branchesCache.set(this.branchesCacheKey(owner, repositoryName), branches);
		}
		return branches;
	}

	async deleteBranch(pullRequestModel: PullRequestModel): Promise<void> {
		const { octokit } = await this.ensure();

		if (!pullRequestModel.validatePullRequestModel('Unable to delete branch')) {
			return;
		}

		try {
			await octokit.call(octokit.api.git.deleteRef, {
				owner: pullRequestModel.head.repositoryCloneUrl.owner,
				repo: pullRequestModel.head.repositoryCloneUrl.repositoryName,
				ref: `heads/${pullRequestModel.head.ref}`,
			});
		} catch (e) {
			Logger.error(`Unable to delete branch: ${e}`, this.id);
			return;
		}
	}

	async getMentionableUsers(): Promise<IAccount[]> {
		Logger.debug(`Fetch mentionable users - enter`, this.id);
		const { query, remote, schema } = await this.ensure();

		let after: string | null = null;
		let hasNextPage = false;
		const ret: IAccount[] = [];

		do {
			try {
				const result: { data: MentionableUsersResponse } = await query<MentionableUsersResponse>({
					query: schema.GetMentionableUsers,
					variables: {
						owner: remote.owner,
						name: remote.repositoryName,
						first: 100,
						after: after,
					},
				});

				if (result.data.repository === null) {
					Logger.error('Unexpected null repository when getting mentionable users', this.id);
					return [];
				}

				ret.push(
					...result.data.repository.mentionableUsers.nodes.map(node => {
						return parseAccount(node, this);
					}),
				);

				hasNextPage = result.data.repository.mentionableUsers.pageInfo.hasNextPage;
				after = result.data.repository.mentionableUsers.pageInfo.endCursor;
			} catch (e) {
				Logger.debug(`Unable to fetch mentionable users: ${e}`, this.id);
				return ret;
			}
		} while (hasNextPage);

		return ret;
	}

	async resolveUser(login: string): Promise<User | undefined> {
		Logger.debug(`Fetch user ${login}`, this.id);
		const { query, schema } = await this.ensure();

		try {
			const { data } = await query<UserResponse>({
				query: schema.GetUser,
				variables: {
					login,
				},
			});
			return parseGraphQLUser(data, this);
		} catch (e) {
			// Ignore cases where the user doesn't exist
			if (!(e.message as (string | undefined))?.startsWith('GraphQL error: Could not resolve to a User with the login of')) {
				Logger.warn(e.message);
			}
		}
		return undefined;
	}

	async getAssignableUsers(): Promise<IAccount[]> {
		Logger.debug(`Fetch assignable users - enter`, this.id);
		const { query, remote, schema } = await this.ensure();

		let after: string | null = null;
		let hasNextPage = false;
		const ret: IAccount[] = [];
		// Once we fall back to the legacy assignableUsers query, the cursors are not compatible
		// with suggestedActors, so stay on the legacy query for the rest of the pagination.
		let useLegacyAssignableUsers = false;

		do {
			try {
				let result: { data: AssignableUsersResponse | SuggestedActorsResponse | null } | undefined;
				if (schema.GetSuggestedActors && !useLegacyAssignableUsers) {
					result = await query<SuggestedActorsResponse>({
						query: schema.GetSuggestedActors,
						variables: {
							owner: remote.owner,
							name: remote.repositoryName,
							capabilities: ['CAN_BE_ASSIGNED'],
							first: 100,
							after: after,
						},
					}, false, {
						query: schema.GetAssignableUsers,
						variables: {
							owner: remote.owner,
							name: remote.repositoryName,
							first: 100,
							after: after,
						}
					});

				} else {
					result = await query<AssignableUsersResponse>({
						query: schema.GetAssignableUsers,
						variables: {
							owner: remote.owner,
							name: remote.repositoryName,
							first: 100,
							after: after,
						},
					}, true); // we ignore SAML errors here because this query can happen at startup
				}

				if (result.data?.repository === null) {
					Logger.error('Unexpected null repository when getting assignable users', this.id);
					return [];
				}

				const users = (result.data as AssignableUsersResponse).repository?.assignableUsers ?? (result.data as SuggestedActorsResponse).repository?.suggestedActors;

				// If we got assignableUsers back (either because we already used the legacy query, or
				// because the legacy fallback kicked in inside query()), the cursor is incompatible with
				// suggestedActors. Stay on the legacy query for subsequent pages.
				if ((result.data as AssignableUsersResponse).repository?.assignableUsers) {
					useLegacyAssignableUsers = true;
				}

				ret.push(
					...(users?.nodes.map(node => {
						return parseAccount(node, this);
					}) || []),
				);

				hasNextPage = users?.pageInfo.hasNextPage;
				after = users?.pageInfo.endCursor;
			} catch (e) {
				Logger.debug(`Unable to fetch assignable users: ${e}`, this.id);
				const properties: { errorCode?: string; usedSuggestedActors: string } = {
					usedSuggestedActors: String(!!schema.GetSuggestedActors),
				};
				const errorCode = getErrorCode(e);
				if (errorCode) {
					properties.errorCode = errorCode;
				}
				/* __GDPR__
					"pr.getAssignableUsersFailed" : {
						"errorCode": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" },
						"usedSuggestedActors": { "classification": "SystemMetaData", "purpose": "PerformanceAndHealth" }
					}
				*/
				this.telemetry.sendTelemetryErrorEvent('pr.getAssignableUsersFailed', properties);
				if (
					e.graphQLErrors &&
					e.graphQLErrors.length > 0 &&
					e.graphQLErrors[0].type === 'INSUFFICIENT_SCOPES'
				) {
					vscode.window.showWarningMessage(
						`GitHub user features will not work. ${e.graphQLErrors[0].message}`,
					);
				}
				return ret;
			}
		} while (hasNextPage);

		return ret;
	}

	async cancelWorkflow(workflowRunId: number): Promise<boolean> {
		Logger.debug(`Cancel workflow run - enter`, this.id);
		const { octokit, remote } = await this.ensure();
		try {
			const result = await octokit.call(octokit.api.actions.cancelWorkflowRun, {
				owner: remote.owner,
				repo: remote.repositoryName,
				run_id: workflowRunId,
			});
			return result.status === 202;
		} catch (e) {
			Logger.error(`Unable to cancel workflow run: ${e}`, this.id);
			return false;
		}
	}

	async getOrgTeamsCount(): Promise<number> {
		Logger.debug(`Fetch Teams Count - enter`, this.id);
		if (!this._credentialStore.isAuthenticatedWithAdditionalScopes(this.remote.authProviderId)) {
			return 0;
		}

		const { query, remote, schema } = await this.ensureAdditionalScopes();

		try {
			const result: { data: OrganizationTeamsCountResponse } = await query<OrganizationTeamsCountResponse>({
				query: schema.GetOrganizationTeamsCount,
				variables: {
					login: remote.owner
				},
			});
			const totalCount = result.data.organization.teams.totalCount;
			Logger.debug(`Fetch Teams Count - done`, this.id);
			return totalCount;
		} catch (e) {
			Logger.debug(`Unable to fetch teams Count: ${e}`, this.id);
			if (
				e.graphQLErrors &&
				e.graphQLErrors.length > 0 &&
				e.graphQLErrors[0].type === 'INSUFFICIENT_SCOPES'
			) {
				vscode.window.showWarningMessage(
					`GitHub teams features will not work. ${e.graphQLErrors[0].message}`,
				);
			}
			return 0;
		}
	}

	async getOrgTeams(refreshKind: TeamReviewerRefreshKind): Promise<(ITeam & { repositoryNames: string[] })[]> {
		Logger.debug(`Fetch Teams - enter`, this.id);
		if ((refreshKind === TeamReviewerRefreshKind.None) || (refreshKind === TeamReviewerRefreshKind.Try && !this._credentialStore.isAuthenticatedWithAdditionalScopes(this.remote.authProviderId))) {
			Logger.debug(`Fetch Teams - exit without fetching teams`, this.id);
			return [];
		}

		const { query, remote, schema } = await this.ensureAdditionalScopes();

		let after: string | null = null;
		let hasNextPage = false;
		const orgTeams: (ITeam & { repositoryNames: string[] })[] = [];

		do {
			try {
				const result: { data: OrganizationTeamsResponse } = await query<OrganizationTeamsResponse>({
					query: schema.GetOrganizationTeams,
					variables: {
						login: remote.owner,
						after: after,
						repoName: remote.repositoryName,
					},
				});

				result.data.organization.teams.nodes.forEach(node => {
					const team: ITeam = {
						avatarUrl: getAvatarWithEnterpriseFallback(node.avatarUrl, undefined, this.remote.isEnterprise),
						name: node.name,
						url: node.url,
						slug: node.slug,
						id: node.id,
						org: remote.owner
					};
					orgTeams.push({ ...team, repositoryNames: node.repositories.nodes.map(repo => repo.name) });
				});

				hasNextPage = result.data.organization.teams.pageInfo.hasNextPage;
				after = result.data.organization.teams.pageInfo.endCursor;
			} catch (e) {
				Logger.debug(`Unable to fetch teams: ${e}`, this.id);
				if (
					e.graphQLErrors &&
					e.graphQLErrors.length > 0 &&
					e.graphQLErrors[0].type === 'INSUFFICIENT_SCOPES'
				) {
					vscode.window.showWarningMessage(
						`GitHub teams features will not work. ${e.graphQLErrors[0].message}`,
					);
				}
				return orgTeams;
			}
		} while (hasNextPage);

		Logger.debug(`Fetch Teams - exit`, this.id);
		return orgTeams;
	}

	async getPullRequestParticipants(pullRequestNumber: number): Promise<IAccount[]> {
		Logger.debug(`Fetch participants from a Pull Request`, this.id);
		const { query, remote, schema } = await this.ensure();

		const ret: IAccount[] = [];

		try {
			const result: { data: PullRequestParticipantsResponse } = await query<PullRequestParticipantsResponse>({
				query: schema.GetParticipants,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					number: pullRequestNumber,
					first: 18
				},
			});
			if (result.data.repository === null) {
				Logger.error('Unexpected null repository when fetching participants', this.id);
				return [];
			}

			ret.push(
				...result.data.repository.pullRequest.participants.nodes.map(node => {
					return parseAccount(node, this);
				}),
			);
		} catch (e) {
			Logger.debug(`Unable to fetch participants from a PullRequest: ${e}`, this.id);
			if (
				e.graphQLErrors &&
				e.graphQLErrors.length > 0 &&
				e.graphQLErrors[0].type === 'INSUFFICIENT_SCOPES'
			) {
				vscode.window.showWarningMessage(
					`GitHub user features will not work. ${e.graphQLErrors[0].message}`,
				);
			}
		}

		return ret;
	}

	/**
	 * Compare across commits.
	 * @param base The base branch. Must be a branch name. If comparing across repositories, use the format <repo_owner>:branch.
	 * @param head The head branch. Must be a branch name. If comparing across repositories, use the format <repo_owner>:branch.
	 */
	public async compareCommits(base: string, head: string): Promise<OctokitCommon.ReposCompareCommitsResponseData | undefined> {
		Logger.debug('Compare commits - enter', this.id);
		try {
			const { remote, octokit } = await this.ensure();
			const { data } = await octokit.call(octokit.api.repos.compareCommits, {
				repo: remote.repositoryName,
				owner: remote.owner,
				base,
				head,
			});
			Logger.debug('Compare commits - done', this.id);
			return data;
		} catch (e) {
			Logger.error(`Unable to compare commits between ${base} and ${head}: ${e}`, this.id);
		}
	}

	isCurrentUser(authProviderId: AuthProvider, login: string): Promise<boolean> {
		return this._credentialStore.isCurrentUser(authProviderId, login);
	}

	/**
	 * Get the status checks of the pull request, those for the last commit.
	 *
	 * This method should go in PullRequestModel, but because of the status checks bug we want to track `_useFallbackChecks` at a repo level.
	 */
	private _useFallbackChecks: boolean = false;
	async getStatusChecks(number: number): Promise<[PullRequestChecks | null, PullRequestReviewRequirement | null]> {
		Logger.debug('Get Status Checks - enter', this.id);

		const { query, remote, schema } = await this.ensure();
		const captureUseFallbackChecks = this._useFallbackChecks;
		let result: ApolloQueryResult<GetChecksResponse>;
		try {
			result = await query<GetChecksResponse>({
				query: captureUseFallbackChecks ? schema.GetChecksWithoutSuite : schema.GetChecks,
				variables: {
					owner: remote.owner,
					name: remote.repositoryName,
					number: number,
				},
			});
		} catch (e) {
			// There's an issue with the GetChecks that can result in SAML errors.
			if (isSamlError(e) || this.remote.isEnterprise) {
				// There seems to be an issue with fetching status checks if you haven't SAML'd with every org you have
				// The issue is specifically with the CheckSuite property. Make the query again, but without that property.
				if (!captureUseFallbackChecks) {
					this._useFallbackChecks = true;
					return this.getStatusChecks(number);
				}
			}
			Logger.error(`Unable to fetch PR checks: ${e}`, this.id);
			throw e;
		}

		if ((result.data.repository === null) || (result.data.repository.pullRequest.commits.nodes === undefined) || (result.data.repository.pullRequest.commits.nodes.length === 0)) {
			Logger.error(`Unable to fetch PR checks: ${result.errors?.map(error => error.message).join(', ')}`, this.id);
			return [null, null];
		}

		// We always fetch the status checks for only the last commit, so there should only be one node present
		const statusCheckRollup = result.data.repository.pullRequest.commits.nodes[0].commit.statusCheckRollup;

		let checks: PullRequestChecks;
		if (!statusCheckRollup) {
			checks = {
				state: CheckState.Success,
				statuses: []
			};
		} else {
			const dedupedStatuses = this.deduplicateStatusChecks(statusCheckRollup.contexts.nodes.map(context => {
				if (isCheckRun(context)) {
					return {
						id: context.id,
						databaseId: context.databaseId,
						url: context.checkSuite?.app?.url,
						avatarUrl:
							context.checkSuite?.app?.logoUrl &&
							getAvatarWithEnterpriseFallback(
								context.checkSuite.app.logoUrl,
								undefined,
								this.remote.isEnterprise,
							),
						state: this.mapStateAsCheckState(context.conclusion),
						description: context.title,
						context: context.name,
						workflowName: context.checkSuite?.workflowRun?.workflow.name,
						event: context.checkSuite?.workflowRun?.event,
						targetUrl: context.detailsUrl,
						isRequired: context.isRequired,
						isCheckRun: true,
					};
				} else {
					return {
						id: context.id,
						databaseId: undefined,
						url: context.targetUrl ?? undefined,
						avatarUrl: context.avatarUrl
							? getAvatarWithEnterpriseFallback(context.avatarUrl, undefined, this.remote.isEnterprise)
							: undefined,
						state: this.mapStateAsCheckState(context.state),
						description: context.description,
						context: context.context,
						workflowName: undefined,
						event: undefined,
						targetUrl: context.targetUrl,
						isRequired: context.isRequired,
						isCheckRun: false,
					};
				}
			}));

			checks = {
				state: this.computeOverallCheckState(dedupedStatuses),
				statuses: dedupedStatuses
			};
		}

		// Workflows triggered from forks (e.g. by first-time contributors) can sit in an
		// "awaiting approval" state where GitHub has created the workflow run but no check
		// runs yet. These don't appear in the statusCheckRollup, which would otherwise leave
		// the PR with no reported checks (surfaced as "Unknown"). Surface them as pending so
		// the status reflects that something is waiting.
		const checkSuites = result.data.repository.pullRequest.commits.nodes[0].commit.checkSuites?.nodes;
		const awaitingApprovalStatuses = this.computeAwaitingApprovalStatuses(
			checkSuites,
			checks.statuses,
			result.data.repository.pullRequest.url,
		);
		if (awaitingApprovalStatuses.length) {
			checks.statuses = checks.statuses.concat(awaitingApprovalStatuses);
			checks.state = this.computeOverallCheckState(checks.statuses);
		}

		let reviewRequirement: PullRequestReviewRequirement | null = null;
		const rule = result.data.repository.pullRequest.baseRef?.refUpdateRule;
		if (rule) {
			const prUrl = result.data.repository.pullRequest.url;

			for (const context of rule.requiredStatusCheckContexts || []) {
				if (!checks.statuses.some(status => status.context === context)) {
					checks.state = CheckState.Pending;
					checks.statuses.push({
						id: '',
						databaseId: undefined,
						url: undefined,
						avatarUrl: undefined,
						state: CheckState.Pending,
						description: vscode.l10n.t('Waiting for status to be reported'),
						context: context,
						workflowName: undefined,
						event: undefined,
						targetUrl: prUrl,
						isRequired: true,
						isCheckRun: false
					});
				}
			}

			const requiredApprovingReviews = rule.requiredApprovingReviewCount ?? 0;
			const approvingReviews = result.data.repository.pullRequest.latestReviews.nodes.filter(
				review => review.authorCanPushToRepository && review.state === 'APPROVED',
			);
			const requestedChanges = result.data.repository.pullRequest.reviewsRequestingChanges.nodes.filter(
				review => review.authorCanPushToRepository
			);
			let state: CheckState = CheckState.Success;
			if (approvingReviews.length < requiredApprovingReviews) {
				state = CheckState.Failure;

				if (requestedChanges.length) {
					state = CheckState.Pending;
				}
			}
			if (requiredApprovingReviews > 0) {
				reviewRequirement = {
					count: requiredApprovingReviews,
					approvals: approvingReviews.map(review => review.author.login),
					requestedChanges: requestedChanges.map(review => review.author.login),
					state: state
				};
			}
		}

		Logger.debug('Get Status Checks - done', this.id);
		return [checks.statuses.length ? checks : null, reviewRequirement];
	}

	mapStateAsCheckState(state: string | null | undefined): CheckState {
		switch (state) {
			case 'EXPECTED':
			case 'PENDING':
			case 'ACTION_REQUIRED':
			case 'STALE':
				return CheckState.Pending;
			case 'ERROR':
			case 'FAILURE':
			case 'TIMED_OUT':
			case 'STARTUP_FAILURE':
				return CheckState.Failure;
			case 'SUCCESS':
				return CheckState.Success;
			case 'NEUTRAL':
			case 'SKIPPED':
				return CheckState.Neutral;
		}

		return CheckState.Unknown;
	}

	/**
	 * Deduplicate status checks by context (check name).
	 * When a check is re-run on the same commit (e.g., when a PR is closed and reopened),
	 * GitHub's API returns all check run instances. This method keeps only one entry per
	 * check context, preferring pending/running checks over completed ones, and the most
	 * recent completed check when all are completed.
	 */
	private deduplicateStatusChecks(statuses: PullRequestCheckStatus[]): PullRequestCheckStatus[] {
		const statusByContext = new Map<string, PullRequestCheckStatus>();

		for (const status of statuses) {
			// Include event and workflowName in the key so that checks from different
			// workflow events (e.g. "push" vs "pull_request") or different workflows
			// are not incorrectly merged during deduplication.
			const key = `${status.context}\0${status.event ?? ''}\0${status.workflowName ?? ''}`;
			const existing = statusByContext.get(key);
			if (!existing) {
				statusByContext.set(key, status);
				continue;
			}

			// Prefer pending/unknown checks over completed ones (they represent the latest run)
			const existingIsPending = existing.state === CheckState.Pending || existing.state === CheckState.Unknown;
			const currentIsPending = status.state === CheckState.Pending || status.state === CheckState.Unknown;

			if (currentIsPending && !existingIsPending) {
				// Current is pending, existing is completed - prefer current
				statusByContext.set(key, status);
			} else if (!currentIsPending && existingIsPending) {
				// Current is completed, existing is pending - keep existing
				continue;
			} else {
				// Both are same type (both pending or both completed)
				// Prefer the one with a higher ID (more recent), as GitHub IDs are monotonically increasing
				if (status.id > existing.id) {
					statusByContext.set(key, status);
				}
			}
		}

		return Array.from(statusByContext.values());
	}

	/**
	 * Compute the overall check state from individual status checks.
	 * - If any check has failed, the overall state is failure
	 * - If any check is pending/unknown (and none have failed), the overall state is pending
	 * - If all checks are successful or neutral/skipped, the overall state is success
	 */
	private computeOverallCheckState(statuses: PullRequestCheckStatus[]): CheckState {
		if (statuses.length === 0) {
			return CheckState.Success;
		}

		let hasFailure = false;
		let hasPending = false;

		for (const status of statuses) {
			if (status.state === CheckState.Failure) {
				hasFailure = true;
			} else if (status.state === CheckState.Pending || status.state === CheckState.Unknown) {
				hasPending = true;
			}
		}

		if (hasFailure) {
			return CheckState.Failure;
		}
		if (hasPending) {
			return CheckState.Pending;
		}
		return CheckState.Success;
	}

	/**
	 * Build synthetic pending statuses for workflow runs that are awaiting approval
	 * (typically for pull requests from forks). Such runs exist as check suites but have
	 * not produced any check runs yet, so they are absent from the statusCheckRollup.
	 * Only suites that aren't already represented by an existing status are included, to
	 * avoid duplicating checks that GitHub has already reported.
	 */
	private computeAwaitingApprovalStatuses(
		checkSuites: CheckSuiteForRollup[] | undefined,
		existingStatuses: PullRequestCheckStatus[],
		prUrl: string,
	): PullRequestCheckStatus[] {
		if (!checkSuites?.length) {
			return [];
		}

		const existingWorkflowNames = new Set(
			existingStatuses.map(status => status.workflowName).filter((name): name is string => !!name),
		);

		const awaitingApproval: PullRequestCheckStatus[] = [];
		for (const suite of checkSuites) {
			// A suite that is waiting or has only been requested and hasn't concluded is
			// awaiting approval before it can run.
			if (suite.conclusion !== null || (suite.status !== 'WAITING' && suite.status !== 'REQUESTED')) {
				continue;
			}

			const workflowName = suite.workflowRun?.workflow.name;
			if (workflowName && existingWorkflowNames.has(workflowName)) {
				continue;
			}

			awaitingApproval.push({
				id: `awaiting-approval:${workflowName ?? awaitingApproval.length}`,
				databaseId: undefined,
				url: suite.app?.url,
				avatarUrl:
					suite.app?.logoUrl &&
					getAvatarWithEnterpriseFallback(suite.app.logoUrl, undefined, this.remote.isEnterprise),
				state: CheckState.Pending,
				description: vscode.l10n.t('Waiting for approval'),
				context: workflowName ?? vscode.l10n.t('Workflow awaiting approval'),
				workflowName,
				event: suite.workflowRun?.event,
				targetUrl: prUrl,
				isRequired: false,
				isCheckRun: true,
			});
		}

		return awaitingApproval;
	}

	/**
	 * Upload a file to GitHub via the mobile upload policy API. Returns a markdown
	 * snippet appropriate for embedding in an issue/PR comment.
	 */
	public async uploadFile(uri: vscode.Uri, fileName: string): Promise<string> {
		// Guard against very large files: check size before reading the bytes into memory.
		let fileSize: number | undefined;
		try {
			const stat = await vscode.workspace.fs.stat(uri);
			fileSize = stat.size;
		} catch {
			// Fall through; readFile will surface a more specific error if needed.
		}
		if (fileSize !== undefined && fileSize > MAX_UPLOAD_SIZE_BYTES) {
			throw new Error(`File "${fileName}" is too large to upload (${Math.round(fileSize / (1024 * 1024))} MB). The maximum allowed size is ${MAX_UPLOAD_SIZE_BYTES / (1024 * 1024)} MB.`);
		}

		const fileBytes = await vscode.workspace.fs.readFile(uri);
		return this.uploadFileBytes(fileBytes, fileName);
	}

	/**
	 * Upload a file's raw bytes to GitHub via the mobile upload policy API.
	 * Returns a markdown snippet appropriate for embedding in an issue/PR comment.
	 */
	public async uploadFileBytes(fileBytes: Uint8Array, fileName: string): Promise<string> {
		if (fileBytes.byteLength > MAX_UPLOAD_SIZE_BYTES) {
			throw new Error(`File "${fileName}" is too large to upload (${Math.round(fileBytes.byteLength / (1024 * 1024))} MB). The maximum allowed size is ${MAX_UPLOAD_SIZE_BYTES / (1024 * 1024)} MB.`);
		}
		const contentType = guessContentType(fileName);

		const { octokit } = await this.ensure();
		const metadata = await this.getMetadata();
		const repositoryId = metadata.id;

		// Step 1: Get upload policy
		const policyResponse = await octokit.api.request('POST /mobile/upload/policy', {
			name: fileName,
			size: fileBytes.byteLength,
			content_type: contentType,
			repository_id: repositoryId,
			headers: { accept: 'application/json' },
		});
		const policy = policyResponse.data as {
			upload_url: string;
			form: Record<string, string>;
			asset: { id: number; name: string; href: string };
			asset_upload_url: string;
		};

		// Step 2: Upload bytes to the storage location returned by the policy.
		// Pass the Uint8Array directly to Blob to avoid an extra full-size copy.
		const formData = new FormData();
		for (const [key, value] of Object.entries(policy.form)) {
			formData.append(key, value);
		}
		// The DOM Blob types require Uint8Array<ArrayBuffer>, but vscode.workspace.fs.readFile
		// returns Uint8Array<ArrayBufferLike>. The runtime accepts it, so cast via unknown to avoid a copy.
		formData.append('file', new Blob([fileBytes as unknown as BlobPart], { type: contentType }), policy.asset.name);
		const s3Response = await fetch(policy.upload_url, { method: 'POST', body: formData });
		if (s3Response.status !== 204 && s3Response.status !== 201 && s3Response.status !== 200) {
			throw new Error(`Storage upload failed with status ${s3Response.status}`);
		}

		// Step 3: Confirm the upload with GitHub
		await octokit.api.request(`PUT ${policy.asset_upload_url}`, {
			headers: { accept: 'application/json' },
		});

		const url = policy.asset.href;
		const safeName = escapeMarkdownLinkText(fileName);
		if (contentType.startsWith('image/')) {
			return `![${safeName}](${url})`;
		}
		if (contentType.startsWith('video/')) {
			return url;
		}
		return `[${safeName}](${url})`;
	}
}

const MAX_UPLOAD_SIZE_BYTES = 25 * 1024 * 1024; // 25 MB

/**
 * Escape characters that would break a markdown link's text segment (`[text](url)`).
 * Filenames may legally contain `[`, `]`, `\`, etc., which can corrupt the rendered link.
 */
function escapeMarkdownLinkText(text: string): string {
	return text.replace(/([\\\[\]`])/g, '\\$1');
}

function guessContentType(fileName: string): string {
	const lastDot = fileName.lastIndexOf('.');
	const ext = lastDot >= 0 ? fileName.substring(lastDot).toLowerCase() : '';
	switch (ext) {
		case '.png': return 'image/png';
		case '.jpg':
		case '.jpeg': return 'image/jpeg';
		case '.gif': return 'image/gif';
		case '.webp': return 'image/webp';
		case '.svg': return 'image/svg+xml';
		case '.bmp': return 'image/bmp';
		case '.heic': return 'image/heic';
		case '.mp4': return 'video/mp4';
		case '.mov': return 'video/quicktime';
		case '.webm': return 'video/webm';
		case '.pdf': return 'application/pdf';
		case '.zip': return 'application/zip';
		case '.gz': return 'application/gzip';
		case '.tar': return 'application/x-tar';
		case '.txt': return 'text/plain';
		case '.md': return 'text/markdown';
		case '.json': return 'application/json';
		case '.log': return 'text/plain';
		case '.docx': return 'application/vnd.openxmlformats-officedocument.wordprocessingml.document';
		case '.xlsx': return 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet';
		case '.pptx': return 'application/vnd.openxmlformats-officedocument.presentationml.presentation';
		default: return 'application/octet-stream';
	}
}