Pin bot: see pins through our own forge (#508)

ddiff --git a/scripts/pin-bump.js b/scripts/pin-bump.js
iindex b91c991..8591c84 100644
---- a/scripts/pin-bump.js
++++ b/scripts/pin-bump.js
@@@ -63,7 +63,12 @@ function parseArgs(argv) {
  
  /** The pin URL of `library` at `tag`. */
  const pinUrl = (library, tag) => `https://codeload.github.com/${ORG}/${LIBS[library]}/tar.gz/refs/tags/${tag}`;
--const PIN_RE = (library) => new RegExp(`https://codeload\\.github\\.com/${ORG}/${LIBS[library].replace('.', '\\.')}/tar\\.gz/refs/tags/(v\\d+\\.\\d+\\.\\d+)`, 'g');
++// A repo may pin through our own forge (git.openvibe.codes, OpenVibe.Git's own pins since 11-09): the same tag as an archive.
++// Both forms are found, and each pin keeps its own form when it moves (11-12: Git sat on Shared 4.206.0 because only
++// codeload pins were seen).
++const forgeUrl = (library, tag) => `https://git.openvibe.codes/api/v1/repos/${ORG.toLowerCase()}/${LIBS[library].toLowerCase()}/archive/${tag}.tar.gz`;
++const PIN_RE = (library) => new RegExp(`(?:https://codeload\\.github\\.com/${ORG}/${LIBS[library].replace('.', '\\.')}/tar\\.gz/refs/tags/|https://git\\.openvibe\\.codes/api/v1/repos/${ORG.toLowerCase()}/${LIBS[library].toLowerCase().replace('.', '\\.')}/archive/)(v\\d+\\.\\d+\\.\\d+)(?:\\.tar\\.gz)?`, 'g');
++const movePin = (library, tag) => (m) => (m.startsWith('https://git.openvibe.codes/') ? forgeUrl(library, tag) : pinUrl(library, tag));
  
  /** Every package.json the repository tracks, with the pins of `library` it holds below `tag`. */
  function stalePins(dir, library, tag) {
@@@ -404,7 +409,7 @@ function main() {
              const changed = new Set();
              for (const { file } of stale) {
                  const p = path.join(dir, file);
--                fs.writeFileSync(p, fs.readFileSync(p, 'utf8').replace(PIN_RE(library), pinUrl(library, tag)));
++                fs.writeFileSync(p, fs.readFileSync(p, 'utf8').replace(PIN_RE(library), movePin(library, tag)));
                  changed.add(file);
                  const lock = refreshLock(dir, file);
                  if (lock) changed.add(lock);
@@@ -498,4 +503,4 @@ if (require.main === module) {
      try { main(); } catch (err) { console.error(`pin-bump: ${err.message}`); process.exitCode = 1; }
  }
  
--module.exports = { stalePins, staleSecurityPins, updateSecurityPins, updateVersionLines, pinUrl, parseArgs, parseOverBudget, nextHalf, raiseBudgetText, findBudgetFile, raiseBudgets, SERVICE, shipOrder, shipCommand };
++module.exports = { stalePins, staleSecurityPins, updateSecurityPins, updateVersionLines, pinUrl, forgeUrl, PIN_RE, movePin, parseArgs, parseOverBudget, nextHalf, raiseBudgetText, findBudgetFile, raiseBudgets, SERVICE, shipOrder, shipCommand };
ddiff --git a/test/pin-bump.test.js b/test/pin-bump.test.js
iindex 75bc8e8..3dc5687 100644
---- a/test/pin-bump.test.js
++++ b/test/pin-bump.test.js
@@@ -163,6 +163,17 @@ assert.deepStrictEqual(shipCommand('/tools', { repo: 'OpenVibe.Quest', number: 2
  assert.deepStrictEqual(shipCommand('/tools', { repo: 'OpenVibe.Contracts', number: 7 }), { run: [path.join('/tools', 'merge-after-ci.sh'), 'OpenVibe.Contracts#7'], describe: "merge-after-ci.sh 'OpenVibe.Contracts#7'" });
  assert.strictEqual(shipCommand('/tools', { repo: 'OpenVibe.New', number: 1 }).run, null, 'an unmapped repository is shipped by hand, never guessed');
  
++// A pin through our own forge (OpenVibe.Git pins Shared from git.openvibe.codes) is seen, and moves in its own form.
++{
++    const { PIN_RE, movePin, forgeUrl } = require('../scripts/pin-bump.js');
++    const text = '"openvibe-shared": "https://git.openvibe.codes/api/v1/repos/openvibers/openvibe.shared/archive/v4.206.0.tar.gz",\n"openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.160.0"';
++    assert.deepStrictEqual([...text.matchAll(PIN_RE('openvibe-shared'))].map((m) => m[1]), ['v4.206.0'], 'the forge pin is found');
++    assert.deepStrictEqual([...text.matchAll(PIN_RE('openvibe-sdk'))].map((m) => m[1]), ['v0.160.0'], 'a codeload pin still is');
++    const moved = text.replace(PIN_RE('openvibe-shared'), movePin('openvibe-shared', 'v4.227.0')).replace(PIN_RE('openvibe-sdk'), movePin('openvibe-sdk', 'v0.161.0'));
++    assert.ok(moved.includes(`"${forgeUrl('openvibe-shared', 'v4.227.0')}"`) && moved.includes('/archive/v4.227.0.tar.gz"'), 'the forge pin keeps its form');
++    assert.ok(moved.includes('https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.161.0"'), 'the codeload pin keeps its form');
++}
++
  fs.rmSync(bdir, { recursive: true, force: true });
  fs.rmSync(dir, { recursive: true, force: true });
  console.log('pin-bump: all checks passed');