scripts/retire.sh: use commits endpoint rather than activity

The activity endpoint does not work with the merge queue, and counts
things like branch creations that we don’t really want to include.

This finds two‐parent merge commits with the correct author committed
and signed by the GitHub key that are reachable from the main branch;
I believe that PR merges are the only such commits, but any exceptions
should be very marginal.

Closes: #69

Author: emilazy

scripts/retire.sh

@@ -101,22 +101,18 @@ for login in *; do
     continue
   fi
 
-  trace gh api -X GET /repos/"$ORG"/"$ACTIVITY_REPO"/activity \
-    -f time_period=year \
-    -f actor="$login" \
+  trace gh api -X GET /repos/"$ORG"/"$ACTIVITY_REPO"/commits \
+    -f since="$(date --date='1 year ago' --iso-8601=seconds)Z" \
+    -f author="$login" \
+    -f committer=web-flow \
     -f per_page=100 \
     --jq '.[] |
-      "- \(.timestamp) [\(.activity_type) on \(.ref | ltrimstr("refs/heads/"))](https://github.com/'"$ORG/$ACTIVITY_REPO"'/\(
-        if .activity_type == "branch_creation" then
-          "commit/\(.after)"
-        elif .activity_type == "branch_deletion" then
-          "commit/\(.before)"
-        else
-          "compare/\(.before)...\(.after)"
-        end
-      ))"' \
+      # PR merge commits have two parents. We also check it’s an
+      # authentic GitHub commit, because… why not?
+      select((.parents | length) == 2 and .commit.verification.verified) |
+      .sha' \
     > "$tmp/$login"
-  activityCount=$(wc -l <"$tmp/$login")
+  mergeCount=$(wc -l <"$tmp/$login")
 
   if [[ "$prState" == open ]]; then
     # If there is an open PR already
@@ -126,9 +122,13 @@ for login in *; do
       log "$login has a retirement PR due, unmarking PR as draft and commenting with next steps"
       effect gh pr ready --repo "$ORG/$MEMBER_REPO" "$prNumber"
       {
-        if (( activityCount > 0 )); then
+        if (( mergeCount > 0 )); then
           echo "One month has passed, and @$login has been active again:"
-          cat "$tmp/$login"
+          while read -r sha; do
+            gh api "/repos/$ORG/$ACTIVITY_REPO/commits/$sha/pulls" --jq '.[] |
+              select(.merge_commit_sha == "'"$sha"'") |
+              "- `\(.merged_at)` – \(.html_url)"'
+          done < "$tmp/$login"
           echo ""
           echo "If still appropriate, this PR may be merged and implemented by:"
         else
@@ -151,7 +151,7 @@ for login in *; do
     else
       log "$login has a retirement PR pending"
     fi
-  elif (( activityCount <= 0 )); then
+  elif (( mergeCount <= 0 )); then
     log "$login has become inactive, opening a PR"
     # If there is no PR yet, but they have become inactive
     (
@@ -185,7 +185,7 @@ for login in *; do
         -f "labels[]=retirement" >/dev/null
     )
   else
-    log "$login is active with $activityCount activities"
+    log "$login is active with $mergeCount merges"
   fi
   log ""
 done