ace-git-forgejo 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf55e32720105f61ee776ab2e828cc52eff70422d40169c3ec473faa8918852e
-  data.tar.gz: d53c30cfdd65d9efd401846871c8572a48442c68d280a0615e7d9b04c8792b45
+  metadata.gz: 670c1a5fa83a0de21364026001ad9b113742be293bf5930b9557ee56df019023
+  data.tar.gz: 975f91389a01fa855025479f091a397ba074f43eb535c22887014d410ae0a481
 SHA512:
-  metadata.gz: c3d888812cbbec6e223ddfca72514bbee53f3281374825b4147c4f1ebc3fd415528f4fc5c08eafadb6cfed35df6acac4220955f629e15b90dc593d91ceee963c
-  data.tar.gz: 9dd8b2e6fed777a0c038b111e448c536c0a960c7a7ff53e6d0d9ca1e200bd083e591cb35bf6d7943ec552e206b006021a7314b9bb615e93a9df1a34e179c1f98
+  metadata.gz: ea952944afab9658f89959bf5da1f059a4808073c46e77bd6dfcde73017b35021538b353f54cc4c646e6c55937700ca1bc1c47af1c659c6e1f4ff801a7f58693
+  data.tar.gz: f1228942a54b588673fa7ca90150fac10ad36af6334ce9b3d16a2fb2780d7cac4f836e414ccd87d6a1c7353506dec3317f6fc23828d5c3d103ed6f73b96ddc58

data/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-10-08
+
+### Fixed
+
+- Recheck ready/merge acceptance and selected repository provenance; retain the exact expected head and classify unconfirmed effects without replay.
+
+## [0.6.1] - 2026-10-04
+
+### Fixed
+- Prove Forgejo's source repository selector before PR creation and bind accepted receipts to source/base repository IDs, refs, SHA and draft state. Incomplete accepted responses and failed verification remain unknown outcomes without replay.
+
 ## [0.6.0] - 2026-10-04
 
 ### Added
@@ -19,6 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 - The fj-era refusals for fork creation, draft-to-ready, and expected-head merging; the conservative `fj pr merge`/`pr edit` paths are replaced by the API lifecycle.
+- The unused `expected_head` plumbing on the review-comment reconciliation helpers (internal refactor; no behavior change).
 
 ## [0.5.0] - 2026-10-03
 

data/README.md

@@ -96,3 +96,5 @@ Forgejo-specific conventions the provider translates:
 
 Identical lifecycle assertions run against every provider through the
 shared `Ace::TestSupport::PullRequestLifecycleContract` parity suite.
+
+Create preflight verifies the repository that Forgejo's `owner:branch` selector resolves, including direct forks and a fork's parent. Sharing an owner, branch or SHA does not establish source identity. An accepted create returns a receipt only when the response and authoritative read agree with the requested repository IDs, refs, SHA and draft state. A failed or contradictory verification stays `unknown_outcome`; reconcile by reading the exact identity before authorizing another mutation.

data/lib/ace/git/forgejo/http_client.rb

@@ -101,6 +101,8 @@ module Ace
         def exchange_path(suffix)
           return suffix if suffix.to_s.start_with?("/api/v1/")
 
+          return "/api/v1/repos/#{@target.repo}" if suffix.to_s.empty?
+
           "/api/v1/repos/#{@target.repo}/#{suffix}"
         end
 

data/lib/ace/git/forgejo/provider.rb

@@ -33,6 +33,16 @@ module Ace
         WIP_PREFIXES = ["WIP:", "[WIP]"].freeze
 
         class << self
+          def pull_request_title(title:, draft:)
+            wip = WIP_PREFIXES.any? { |prefix| title.to_s.upcase.start_with?(prefix) }
+            return wip ? title : "WIP: #{title}" if draft
+            if wip
+              raise Ace::Git::ProviderConflictingMatchesError,
+                "Requested draft:false conflicts with the WIP-prefixed title"
+            end
+            title
+          end
+
           def display_name
             "Forgejo"
           end
@@ -496,7 +506,17 @@ module Ace
           head_arg = api_head_argument!(head_repository_url, head_ref)
           send_title = draft_title!(title, draft)
           pr_api.ensure_version_supported!
-          outcome = send_lifecycle_mutation(identity_text(head_repository_url, head_ref, base_ref)) do
+          requested_head = head_repository_url.to_s.empty? ? server.url : head_repository_url
+          owner = Ace::Git::Atoms::ServerUrl.normalize(requested_head).split("/")[1]
+          base_identity, head_identity = pr_api.create_repository_identity(owner: owner)
+          unless Ace::Git::Atoms::ServerUrl.match?("#{server_host_root}/#{base_identity["full_name"]}", server.url) &&
+              Ace::Git::Atoms::ServerUrl.match?("#{server_host_root}/#{head_identity["full_name"]}", requested_head)
+            raise Ace::Git::ProviderIdentityMismatchError,
+              "Forgejo head selector does not select #{requested_head}; refusing create"
+          end
+          identity = "#{identity_text(requested_head, head_ref, base_ref)}, " \
+            "expected head #{expected_head}, draft #{draft.inspect}"
+          outcome = send_lifecycle_mutation(identity) do
             pr_api.create_pull_request(head: head_arg, base: base_ref, title: send_title, body: body)
           end
 
@@ -506,13 +526,31 @@ module Ace
             return reconcile_raced_create(head_repository_url: head_repository_url, head_ref: head_ref,
               base_ref: base_ref, expected_head: expected_head, draft: draft)
           end
-          unless outcome.status == 201 && outcome.payload.is_a?(Hash) && outcome.payload["number"].is_a?(Integer)
+          unless (200..299).cover?(outcome.status)
             classify_create_refusal(outcome, head_repository_url, head_ref, base_ref)
           end
 
-          created = verify_expected_head!(pull_request(number: outcome.payload["number"]), expected_head)
-          ensure_draft_outcome!(created, draft)
-          receipt(:create, created, :created)
+          begin
+            payload = outcome.payload
+            unless outcome.status == 201 && payload.is_a?(Hash) &&
+                payload["number"].is_a?(Integer) && payload["number"].positive?
+              raise Ace::Git::ProviderMalformedOutputError, "Accepted create lacks pull request identity"
+            end
+            accepted = pr_api.creation_evidence(payload)
+            verify_created_identity!(accepted, requested_head, head_ref, base_ref, expected_head,
+              draft, base_identity, head_identity)
+            after = pr_api.pull_request(payload["number"])
+            created = verify_created_identity!(after, requested_head, head_ref, base_ref, expected_head,
+              draft, base_identity, head_identity)
+            receipt(:create, created, :created)
+          rescue Ace::Git::Error => e
+            known_number = outcome.payload.is_a?(Hash) && outcome.payload["number"]
+            known_number = "unknown" unless known_number.is_a?(Integer) && known_number.positive?
+            raise Ace::Git::ProviderUnknownOutcomeError,
+              "Forgejo accepted create but verification failed (#{e.class.name.split("::").last}); " \
+              "reconcile by exact identity before repeating: #{identity_text(requested_head, head_ref, base_ref)}, " \
+              "expected head #{expected_head}, draft #{draft.inspect}, PR #{known_number}"
+          end
         end
 
         # Edit title/body after exact-head verification through the same
@@ -521,7 +559,10 @@ module Ace
         # @return [ProviderMutationReceipt] operation :update
         def update_pull_request(number:, expected_head:, title: nil, body: nil)
           number = request_number!(number)
-          verify_expected_head!(pull_request(number: number), expected_head)
+          before = verify_expected_head!(pull_request(number: number), expected_head)
+          # Title edits are not a ready transition. Keep Forgejo's title-based
+          # draft state, just as providers with an explicit draft field do.
+          title = draft_title!(title, before.draft) if title
           if title || body
             pr_api.ensure_version_supported!
             outcome = send_lifecycle_mutation("PR ##{number} on #{server.name}, head #{expected_head}") do
@@ -532,9 +573,13 @@ module Ace
                 "PR update refused for ##{number} (HTTP #{outcome.status}: #{outcome.message}); " \
                 "reconcile before repeating"
             end
-            verify_post_mutation_head!(number, expected_head, "update")
+            after = verify_post_mutation_head!(number, expected_head, "update")
+            unless after.draft == before.draft
+              raise Ace::Git::ProviderUnknownOutcomeError,
+                "PR update changed draft state for ##{number}; reconcile before repeating"
+            end
           end
-          receipt(:update, pull_request(number: number), nil)
+          receipt(:update, after || before, nil)
         end
 
         # Mark a draft ready on the exact head. Forgejo derives draft state
@@ -650,6 +695,19 @@ module Ace
             "#{e.message}; reconcile by exact identity before repeating: #{identity}"
         end
 
+        def verify_created_identity!(payload, head_url, head_ref, base_ref, expected_head,
+          draft, base_identity, head_identity)
+          created = verify_expected_head!(normalize_api_pr(payload), expected_head)
+          unless created.state == :open && created.head_ref == head_ref && created.base_ref == base_ref &&
+              Ace::Git::Atoms::ServerUrl.match?(created.head_repository_url, head_url) &&
+              payload.dig("head", "repo", "id") == head_identity["id"] &&
+              payload.dig("base", "repo", "id") == base_identity["id"]
+            raise Ace::Git::ProviderIdentityMismatchError, "Created pull request provenance does not match request"
+          end
+          ensure_draft_outcome!(created, draft)
+          created
+        end
+
         # Server-derived draft state must agree with the request for an
         # existing exact match to be reusable.
         def ensure_draft_agreement!(existing, draft)
@@ -674,15 +732,7 @@ module Ace
         # defaults, compared case-insensitively without trimming); the API
         # create form has no draft field.
         def draft_title!(title, draft)
-          if draft
-            work_in_progress_title?(title) ? title : "WIP: #{title}"
-          elsif work_in_progress_title?(title)
-            raise Ace::Git::ProviderConflictingMatchesError,
-              "Requested draft:false conflicts with the WIP-prefixed title #{title.inspect}; " \
-              "Forgejo would create the pull request as a draft"
-          else
-            title
-          end
+          self.class.pull_request_title(title: title, draft: draft)
         end
 
         def work_in_progress_title?(title)
@@ -709,6 +759,9 @@ module Ace
         # an owner path; cross-host sources are refused before any
         # mutation (the exact-match lookup may read first).
         def api_head_argument!(head_repository_url, head_ref)
+          if head_ref.to_s.empty? || head_ref.include?(":")
+            raise Ace::Git::ProviderIdentityMismatchError, "Head ref cannot encode a repository selector"
+          end
           return head_ref if head_repository_url.nil? ||
             Ace::Git::Atoms::ServerUrl.match?(head_repository_url, server.url)
           unless same_server_authority?(head_repository_url)
@@ -717,7 +770,8 @@ module Ace
               "selected server #{server.url}; only canonical and same-server fork sources are supported"
           end
 
-          owner = URI.parse(head_repository_url.to_s).path.to_s.split("/").reject(&:empty?).first
+          segments = Ace::Git::Atoms::ServerUrl.normalize(head_repository_url).split("/")[1..]
+          owner = segments.first if segments.length == 2 && segments.none?(&:empty?)
           unless owner
             raise Ace::Git::ProviderIdentityMismatchError,
               "Head repository #{head_repository_url.inspect} has no owner path; " \
@@ -740,7 +794,11 @@ module Ace
         # a deleted fork repository reports none, and that absence stays
         # honest instead of being relabelled.
         def api_head_repository_url(payload)
-          full_name = payload.dig("head", "repo", "full_name")
+          repo = payload.dig("head", "repo")
+          unless repo.nil? || repo.is_a?(Hash)
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo source repository evidence"
+          end
+          full_name = repo && repo["full_name"]
           return nil if !full_name.is_a?(String) || full_name.empty?
 
           "#{server_host_root}/#{full_name}"
@@ -750,7 +808,11 @@ module Ace
         # repository must be the selected one: a misrouted payload is never
         # relabelled.
         def normalize_api_pr(payload)
-          base_full_name = payload.dig("base", "repo", "full_name").to_s
+          base_repo = payload.dig("base", "repo")
+          unless base_repo.nil? || base_repo.is_a?(Hash)
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo destination repository evidence"
+          end
+          base_full_name = base_repo.is_a?(Hash) ? base_repo["full_name"].to_s : ""
           unless !base_full_name.empty? && base_full_name.casecmp(repository_target.repo).zero?
             raise Ace::Git::ProviderIdentityMismatchError,
               "Forgejo returned pull request ##{payload["number"]} with base repository " \

data/lib/ace/git/forgejo/pull_request_api.rb

@@ -97,6 +97,29 @@ module Ace
           @http.paginate("pulls?state=open").map { |payload| validate_pr_payload!(payload, payload["number"]) }
         end
 
+        # Prove the repository selected by Forgejo's owner:branch resolver.
+        # Forgejo uses the selected repository for its own owner, otherwise
+        # a direct fork owned by that user (the supported Forgejo 8 resolver).
+        def create_repository_identity(owner:)
+          base = repository_identity!(@http.request(:get, ""))
+          return [base, base] if base.dig("owner", "login").casecmp?(owner)
+
+          forks = @http.paginate("forks").map { |entry| repository_identity!(entry) }
+          matches = forks.select { |entry| entry.dig("owner", "login").casecmp?(owner) }
+          if matches.length > 1
+            raise Ace::Git::ProviderConflictingMatchesError, "Forgejo fork selector is ambiguous for #{owner}"
+          end
+          head = matches.first
+          unless head
+            raise Ace::Git::ProviderIdentityMismatchError, "Forgejo cannot prove fork selector for #{owner}"
+          end
+          [base, head]
+        end
+
+        def creation_evidence(payload)
+          validate_pr_payload!(payload, payload.is_a?(Hash) ? payload["number"] : nil)
+        end
+
         # Send the create mutation. The head argument must already be in the
         # documented API form (plain branch, or "owner:branch" for a
         # same-server fork).
@@ -154,6 +177,17 @@ module Ace
           raise error, "Forgejo #{operation} returned HTTP #{status}; reconcile before repeating"
         end
 
+        def repository_identity!(payload)
+          unless payload.is_a?(Hash) && payload["id"].is_a?(Integer) && payload["id"].positive? &&
+              payload["full_name"].is_a?(String) && payload["full_name"].match?(%r{\A[^/:\s?#]+/[^/:\s?#]+\z}) &&
+              payload["owner"].is_a?(Hash) && payload.dig("owner", "id").is_a?(Integer) && payload.dig("owner", "id").positive? &&
+              payload.dig("owner", "login").is_a?(String) && !payload.dig("owner", "login").empty? &&
+              payload["full_name"].split("/").first.casecmp?(payload.dig("owner", "login"))
+            raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo repository selector evidence"
+          end
+          payload
+        end
+
         def validate_pr_payload!(payload, requested_number)
           unless payload.is_a?(Hash)
             raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo pull request evidence"

data/lib/ace/git/forgejo/version.rb

@@ -3,7 +3,7 @@
 module Ace
   module Git
     module Forgejo
-      VERSION = "0.6.0"
+      VERSION = "0.6.2"
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-git-forgejo
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-git
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.26'
+        version: '0.30'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.26'
+        version: '0.30'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement