ace-git 0.32.0 → 0.33.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93ab21fbc075387d07fecb5c99fa35e9b3fca1134828578fd9d23fff9a8fdc65
-  data.tar.gz: da9b32ec8ac46c10e9c1f7e648c26ba21003f04603b80a41b15cfa3705e52da4
+  metadata.gz: 183166f8ce864a5503f765212e4a0a89e26ec22f03dca7ab8a918c9499ec064a
+  data.tar.gz: 5c3eaa10c29b1873bf504cecaff12ac77806740f1bf1ee1e3c8372081c9d18e4
 SHA512:
-  metadata.gz: 2f89ac9e97703d6f9fd2b7d65b58a14ee4e444cb7e67981a860927e11de387ce7600fa4bfe4e724978b9a29252f1b2ec67848eb76977e95e18ba3f1e84caa26a
-  data.tar.gz: aefa646c548c7fd820e539367cbbbc79569d71b44b484e7482c0ca3ef89249172bc1fdb89338f6c3e155026236d78d785e64521d478fe8bd354a44f5f780dae6
+  metadata.gz: 21397a89baadadc17c0c18ce73c3fb558a6195133381e6f26df5e4ab897e025cff8aaa563b2cb6169400d8a5a7f43c2ff7c8549d6af261389d0690ba40c35fef
+  data.tar.gz: 2067ddf2e8871231ed33e0392aa922a429114b68c25dd9c3fe914c3d88d0df185ecc3ebebb2b4f9a1433a9a882c9c6aa147978616a2c03c31a2967508fd3e790

data/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to ace-git will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.33.0] - 2026-11-10
+
+### Added
+
+- Include PR authors and semantic issue bodies in provider evidence. Verify scoped formal reviewer identity and exact HEAD; reject oversized or invalid UTF-8 PR bodies instead of truncating them.
 ## [0.32.0] - 2026-10-30
 
 ### Added

data/lib/ace/git/cli/commands/pr.rb

@@ -121,6 +121,7 @@ module Ace
                 number: pr.number,
                 url: pr.url,
                 title: pr.title,
+                author: pr.author,
                 state: pr.state,
                 draft: pr.draft,
                 head: pr.head_sha,

data/lib/ace/git/organisms/pull_request_lifecycle.rb

@@ -363,7 +363,14 @@ module Ace
           raise ArgumentError, "--body-file is required" unless path
           raise ArgumentError, "Body file not found: #{path}" unless File.file?(path)
 
-          File.read(path, limit)
+          body = File.binread(path, limit) || +""
+          if limit && body.bytesize >= limit
+            raise ArgumentError, "Body file exceeds #{limit - 1} bytes: #{path}"
+          end
+          body.force_encoding(Encoding::UTF_8)
+          raise ArgumentError, "Body file must contain valid UTF-8: #{path}" unless body.valid_encoding?
+
+          body
         rescue SystemCallError => e
           raise ArgumentError, "Cannot read body file #{path}: #{e.message}"
         end

data/lib/ace/git/providers/evidence.rb

@@ -16,7 +16,11 @@ module Ace
       :head_repository_url, :base_repository_url, :merge_commit_sha
     )
 
-    ProviderIssue = Data.define(:server_name, :number, :title, :state, :author, :url, :labels)
+    ProviderIssue = Data.define(:server_name, :number, :title, :state, :author, :url, :labels, :body) do
+      def initialize(body: nil, **fields)
+        super(body: body, **fields)
+      end
+    end
 
     # Normalized check/CI evidence for one check run.
     ProviderCheck = Data.define(:server_name, :name, :state, :conclusion, :url)

data/lib/ace/git/providers/formal_approval.rb

@@ -16,9 +16,10 @@ module Ace
         CORRELATION = /\A[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}\z/
         MARKER = /\n\n<!-- ace-approval:([a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}) sha256:([0-9a-f]{64}) -->\z/
 
-        def initialize(provider:, request:, list:, official: false, pending_reuse: false)
+        def initialize(provider:, request:, list:, official: false, pending_reuse: false, expected_reviewer: nil)
           @provider, @request, @list, @official = provider, request, list, official
           @pending_reuse = pending_reuse
+          @expected_reviewer = expected_reviewer
         end
 
         def approve(number:, expected_head:, body:, correlation:)
@@ -44,7 +45,7 @@ module Ace
             end
             lock.flock(File::LOCK_EX)
             pr = current!(number, expected_head)
-            actor = identity!(@request.call(:get, :actor, nil))
+            actor = @expected_reviewer ? [nil, @expected_reviewer] : identity!(@request.call(:get, :actor, nil))
             deny_author!(pr, actor)
             rows = reviews!(number)
             matches = rows.select { |row| row.fetch("body").include?("<!-- ace-approval:#{correlation} ") }
@@ -52,14 +53,18 @@ module Ace
             existing = matches.first
             row!(existing) if existing
             if existing && (existing["body"] != sent_body || existing["commit_id"] != expected_head ||
-                identity!(existing["user"]) != actor)
+                !matches_actor?(actor, identity!(existing["user"])))
               raise ProviderConflictingMatchesError, "Approval correlation is already bound to different evidence"
             end
             # A provider may reuse its current pending object on direct create.
             # Only an exact known, comment-free pending review is resumable, and
             # only when the adapter proves explicit commit preservation on reuse.
             owned_pending = rows.select do |row|
-              row["state"] == "PENDING" && row["user"].is_a?(Hash) && row["user"]["id"] == actor.first
+              next false unless row["state"] == "PENDING"
+
+              # A repository-scoped Forgejo token can only see its own
+              # pending reviews. Preserve every visible unrelated pending.
+              @expected_reviewer || (row["user"].is_a?(Hash) && row["user"]["id"] == actor.first)
             end
             unrelated = owned_pending.any? { |row| !existing || row["id"] != existing["id"] }
             if unrelated
@@ -140,6 +145,10 @@ module Ace
           [user["id"], user["login"]]
         end
 
+        def matches_actor?(expected, actual)
+          expected.first ? expected == actual : expected.last.casecmp?(actual.last)
+        end
+
         def deny_author!(pr, actor)
           unless pr.author.is_a?(String) && !pr.author.empty?
             raise ProviderMalformedOutputError, "PR author is unverified"
@@ -199,7 +208,7 @@ module Ace
               row["state"] == "APPROVED" && row["commit_id"] == expected_head &&
               !row["dismissed"] && !row["stale"] && (!@official || row["official"] == true) &&
               (!latest || latest["id"] == row["id"]) && (!expected_body || row["body"] == expected_body) &&
-              (!actor || actor == actual_actor) && row["html_url"].is_a?(String) &&
+              (!actor || matches_actor?(actor, actual_actor)) && row["html_url"].is_a?(String) &&
               row["html_url"].start_with?("#{pr.url}#")
             raise ProviderIdentityMismatchError, "Review is not the effective exact-head formal approval"
           end

data/lib/ace/git/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Git
-    VERSION = "0.32.0"
+    VERSION = "0.33.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-git
 version: !ruby/object:Gem::Version
-  version: 0.32.0
+  version: 0.33.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-30 00:00:00.000000000 Z
+date: 2026-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-config