ace-git-forgejo 0.6.2 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 670c1a5fa83a0de21364026001ad9b113742be293bf5930b9557ee56df019023
-  data.tar.gz: 975f91389a01fa855025479f091a397ba074f43eb535c22887014d410ae0a481
+  metadata.gz: 5e06e7ebace5fc96a24f3e1ea11c26a858864acc02be4ff0e8da43823fdc4a01
+  data.tar.gz: 98b6f9244d4d965302a22bd9a7ef0faf1ca91d55801043e961cc9409c66feb0f
 SHA512:
-  metadata.gz: ea952944afab9658f89959bf5da1f059a4808073c46e77bd6dfcde73017b35021538b353f54cc4c646e6c55937700ca1bc1c47af1c659c6e1f4ff801a7f58693
-  data.tar.gz: f1228942a54b588673fa7ca90150fac10ad36af6334ce9b3d16a2fb2780d7cac4f836e414ccd87d6a1c7353506dec3317f6fc23828d5c3d103ed6f73b96ddc58
+  metadata.gz: b07df628f1428cf4599ec991429c0767c03787196e866260ce8efeebb7dc948a0adfee15d22f290b8978c1ad46205147f7b01262929f02d78b135b5449b17527
+  data.tar.gz: 3a4308e47ec2fe95cf9e2f15cc41562a3d627aab7b4466d5029334e0b0b33c280255dd7f6b0542edf8dd4d2c6f5cc1bcdffa2abde9d6b3f22a410f8dab6a75db

data/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-10-23
+
+### Added
+
+- Formal reviewer-owned, exact-head provider approval and read-only approval verification through the forge-neutral review flow; comments do not substitute for approval.
+
+
+### Fixed
+
+- Publish formal approval directly at explicit commit_id instead of rebinding pending-submit; retain safe comment-free owned pending recovery, refuse unrelated pending, ignore request/team rows, and require the verified formal-review API floor.
+
+## [0.7.0] - 2026-10-16
+
+### Added
+
+- Repository-bound API surface for scoped service identities: `HttpClient`/`PullRequestApi` accept an explicit `token:` (a host-installed merge receiver credential) with the `fj` keys-file lookup unchanged as the fallback, and `PullRequestApi#create_comment` attaches one PR-thread comment (the issue-served Forgejo endpoint) with the same `MutationOutcome` refusal classification as the other lifecycle mutations.
+
 ## [0.6.2] - 2026-10-08
 
 ### Fixed

data/lib/ace/git/forgejo/http_client.rb

@@ -20,10 +20,15 @@ module Ace
       # limited to the safe GET verb — a mutation is sent at most once per
       # call, so a lost response stays an unknown outcome.
       class HttpClient
-        def initialize(server:, timeout:, runner: nil)
+        # `token:` injects an explicit credential for deployments whose scoped
+        # service identity is host-installed (e.g. a merge receiver reading its
+        # token from root-owned configuration) instead of the `fj` CLI keys
+        # file; when absent the fj credential governs as before.
+        def initialize(server:, timeout:, runner: nil, token: nil)
           @target = RepositoryBinding::Target.resolve(server.url)
           @timeout = timeout
           @runner = runner
+          @token = token.is_a?(String) && !token.empty? ? token : nil
         end
 
         def paginate(suffix)
@@ -145,6 +150,8 @@ module Ace
         end
 
         def access_token!
+          return @token if @token
+
           path = RepositoryBinding.default_keys_path
           data = path && JSON.parse(File.read(path))
           # fj stores credentials under the bare host (or host:port)

data/lib/ace/git/forgejo/provider.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "ace/git/providers/formal_approval"
 require "uri"
 require "ace/git/atoms/server_url"
 require_relative "cli_executor"
@@ -340,6 +341,14 @@ module Ace
           raise Ace::Git::ProviderMalformedOutputError, "Malformed Forgejo repository file content: #{e.message}"
         end
 
+        def approve_pull_request(number:, expected_head:, body:, correlation:)
+          formal_approval.approve(number: number, expected_head: expected_head, body: body, correlation: correlation)
+        end
+
+        def pull_request_approval(number:, expected_head:, review_id:)
+          formal_approval.read(number: number, expected_head: expected_head, review_id: review_id)
+        end
+
         def create_pull_request_comment(number:, expected_head:, body:, correlation:)
           number = request_number!(number)
           pr = verify_expected_head!(pull_request(number: number), expected_head)
@@ -914,6 +923,25 @@ module Ace
             "Cannot post review comment to PR ##{pr.number} in #{pr.state} state"
         end
 
+        def formal_approval
+          pr_api.ensure_formal_review_supported!
+          request = lambda do |method, path, payload|
+            path = "/api/v1/user" if path == :actor
+            payload = payload.merge("event" => "APPROVED") if method == :post
+            review_http.request(method, path, body: payload)
+          end
+          Ace::Git::Providers::FormalApproval.new(provider: self, request: request,
+            list: method(:formal_review_rows), official: true, pending_reuse: true)
+        end
+
+        # Forgejo lists review requests alongside actual reviews. User and
+        # team requests have no reviewed commit; they are not approval evidence.
+        def formal_review_rows(path)
+          review_http.paginate(path).reject do |row|
+            row.is_a?(Hash) && row["state"] == "REQUEST_REVIEW"
+          end
+        end
+
         def review_http
           @review_http ||= HttpClient.new(server: server, timeout: timeout, runner: runner)
         end

data/lib/ace/git/forgejo/pull_request_api.rb

@@ -35,8 +35,8 @@ module Ace
         # success), and the parsed payload when the server returned one.
         MutationOutcome = Data.define(:status, :message, :payload)
 
-        def initialize(server:, timeout:, runner: nil)
-          @http = HttpClient.new(server: server, timeout: timeout, runner: runner)
+        def initialize(server:, timeout:, runner: nil, token: nil)
+          @http = HttpClient.new(server: server, timeout: timeout, runner: runner, token: token)
         end
 
         # Probe and validate the selected server's API version once per
@@ -70,9 +70,21 @@ module Ace
               "Forgejo server reports #{version}; PR delivery requires #{MINIMUM_SERVER_VERSION} " \
               "(server-enforced expected-head merge is not documented below it)"
           end
+          @server_version = version
           @version_supported = true
         end
 
+        # Formal create-with-event preserves explicit commit_id in the
+        # inspected Forgejo v11.0.0 and v16.0.5 router/service/model sources.
+        # Pending submission does not: it rebinds to current HEAD and is unused.
+        def ensure_formal_review_supported!
+          ensure_version_supported!
+          unless @server_version >= Gem::Version.new("11.0.0")
+            raise Ace::Git::ProviderUnsupportedCapabilityError,
+              "Formal exact-commit approval requires Forgejo 11.0.0 or newer"
+          end
+        end
+
         # @return [Hash] the raw validated pull request payload
         # @raise [Ace::Git::ProviderObjectNotFoundError] when absent
         # @raise [Ace::Git::ProviderMalformedOutputError] on schema violation
@@ -161,6 +173,19 @@ module Ace
           MutationOutcome.new(status: status, message: message, payload: payload)
         end
 
+        # Attach one comment to the pull request thread (Forgejo serves PR
+        # comments on the issue endpoints) — e.g. a reviewer-produced evidence
+        # body handed over by a caller before the merge invocation.
+        #
+        # @return [MutationOutcome] 201 with the created comment payload, or a
+        #   refusal outcome (404 absent pull request, 422 rejected body)
+        def create_comment(number, body)
+          status, payload, message = @http.exchange(:post, "issues/#{number}/comments",
+            body: {"body" => body.to_s})
+          classify_send!(status, "create pull request #{number} comment")
+          MutationOutcome.new(status: status, message: message, payload: payload)
+        end
+
         private
 
         # Authentication, absence, and transport failures classify directly

data/lib/ace/git/forgejo/version.rb

@@ -3,7 +3,7 @@
 module Ace
   module Git
     module Forgejo
-      VERSION = "0.6.2"
+      VERSION = "0.8.0"
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-git-forgejo
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.8.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-08 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-git
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.30'
+        version: '0.31'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.30'
+        version: '0.31'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement