gitlab-triage 1.51.1 → 1.53.0

data/lib/gitlab/triage/graphql_network.rb

@@ -29,7 +29,7 @@ module Gitlab
         parsed_graphql_query = adapter.parse(graphql_query.query)
 
         begin
-          print '.'
+          print '.' unless options.quiet
 
           response = adapter.query(
             parsed_graphql_query,
@@ -52,7 +52,7 @@ module Gitlab
       def mutate(graphql_mutation, variables = {})
         return if graphql_mutation.blank?
 
-        print '.'
+        print '.' unless options.quiet
 
         parsed_mutation = adapter.parse(graphql_mutation)
 
@@ -99,6 +99,7 @@ module Gitlab
         return unless reset_at
 
         puts Gitlab::Triage::UI.debug "Rate limit almost exceeded, sleeping for #{reset_at - Time.now} seconds" if options.debug
+        adapter.tracker&.record_rate_limit_wait
         sleep(1) until Time.now >= reset_at
       end
     end

data/lib/gitlab/triage/network.rb

@@ -37,6 +37,10 @@ module Gitlab
         restapi.post_api(...)
       end
 
+      def patch_api(...)
+        restapi.patch_api(...)
+      end
+
       def delete_api(...)
         restapi.delete_api(...)
       end

data/lib/gitlab/triage/network_adapters/base_adapter.rb

@@ -8,10 +8,11 @@ module Gitlab
       class BaseAdapter
         USER_AGENT = "GitLab Triage #{Gitlab::Triage::VERSION}".freeze
 
-        attr_reader :options
+        attr_reader :options, :tracker
 
-        def initialize(options)
+        def initialize(options, tracker: nil)
           @options = options
+          @tracker = tracker
         end
       end
     end

data/lib/gitlab/triage/network_adapters/graphql_adapter.rb

@@ -138,8 +138,11 @@ module Gitlab
         end
 
         def http_client
-          Client::HTTP.new("#{options.host_url}/api/graphql") do
-            def execute(document:, operation_name: nil, variables: {}, context: {}) # rubocop:disable Lint/NestedMethodDefinition
+          graphql_tracker = tracker
+          graphql_url = "#{options.host_url}/api/graphql"
+
+          Client::HTTP.new(graphql_url) do
+            define_method(:execute) do |document:, operation_name: nil, variables: {}, context: {}|
               body = {}
               body['query'] = document.to_query_string
               body['variables'] = variables if variables.any?
@@ -157,6 +160,7 @@ module Gitlab
 
               case response.code
               when 200, 400
+                graphql_tracker&.record('POST', graphql_url)
                 JSON.parse(response.body).merge('extensions' => { 'headers' => response.headers })
               else
                 { 'errors' => [{ 'message' => "#{response.code} #{response.message}" }] }

data/lib/gitlab/triage/network_adapters/httparty_adapter.rb

@@ -24,13 +24,18 @@ module Gitlab
           raise_on_internal_server_error!(response)
           raise_on_too_many_requests!(response)
 
-          {
+          result = {
             more_pages: (response.headers["x-next-page"].to_s != ""),
             next_page_url: next_page_url(url, response),
             results: response.parsed_response,
             ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
             ratelimit_reset_at: Time.at(response.headers["ratelimit-reset"].to_i)
           }
+
+          resource_count = result[:results].is_a?(Array) ? result[:results].size : 0
+          tracker&.record('GET', url, resource_count: resource_count)
+
+          result
         end
 
         def post(token, url, body)
@@ -48,6 +53,8 @@ module Gitlab
           raise_on_internal_server_error!(response)
           raise_on_too_many_requests!(response)
 
+          tracker&.record('POST', url)
+
           {
             results: response.parsed_response,
             ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,
@@ -55,6 +62,30 @@ module Gitlab
           }
         end
 
+        def patch(token, url, body)
+          response = HTTParty.patch(
+            url,
+            body: body.to_json,
+            headers: {
+              'User-Agent' => USER_AGENT,
+              'Content-type' => 'application/json',
+              'PRIVATE-TOKEN' => token
+            }
+          )
+
+          raise_on_unauthorized_error!(response)
+          raise_on_internal_server_error!(response)
+          raise_on_too_many_requests!(response)
+
+          tracker&.record('PATCH', url)
+
+          {
+            results: response.parsed_response,
+            ratelimit_remaining: response.headers['ratelimit-remaining'].to_i,
+            ratelimit_reset_at: Time.at(response.headers['ratelimit-reset'].to_i)
+          }
+        end
+
         def delete(token, url)
           response = HTTParty.delete(
             url,
@@ -68,6 +99,8 @@ module Gitlab
           raise_on_internal_server_error!(response)
           raise_on_too_many_requests!(response)
 
+          tracker&.record('DELETE', url)
+
           {
             results: response.parsed_response,
             ratelimit_remaining: response.headers["ratelimit-remaining"].to_i,

data/lib/gitlab/triage/normalizers/work_item_normalizer.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require 'active_support/all'
+
+module Gitlab
+  module Triage
+    module Normalizers
+      # Translates a raw Work Items REST API payload into the flat,
+      # issue-shaped resource hash the rest of the gem expects (integer id,
+      # iid, state as opened/closed, labels as title strings, assignees and
+      # author as hashes). This is the single place that knows the Work Items
+      # REST wire shape: the sparse `fields` payload and the nested `features`
+      # object with its labels/assignees/status widgets.
+      class WorkItemNormalizer
+        def call(raw)
+          resource = raw.deep_transform_keys(&:underscore).with_indifferent_access
+          features = resource[:features] || {}
+
+          namespace = resource[:namespace] || {}
+
+          {
+            id: resource[:id],
+            iid: resource[:iid],
+            web_url: resource[:web_url],
+            title: resource[:title],
+            state: resource[:state],
+            confidential: resource[:confidential],
+            created_at: resource[:created_at],
+            updated_at: resource[:updated_at],
+            author: resource[:author],
+            labels: label_titles(features),
+            assignees: assignees(features),
+            milestone: features[:milestone],
+            work_item_type: resource.dig(:work_item_type, :name),
+            work_item_status: status_name(features),
+            start_date: features.dig(:start_and_due_date, :start_date),
+            due_date: features.dig(:start_and_due_date, :due_date),
+            namespace: namespace.presence,
+            group_id: group_id_for(namespace),
+            type: 'work_items'
+          }.compact.with_indifferent_access
+        end
+
+        private
+
+        # The list endpoint exposes the containing namespace, not a legacy
+        # project id. For a group namespace, `namespace.id` IS the legacy group
+        # id, so we can surface `group_id` directly - that lets the resource's
+        # group-scoped helpers build `/groups/:id/...` URLs unchanged.
+        #
+        # For a project namespace, `namespace.id` is the project-namespace id,
+        # which is NOT the legacy project id and is useless for `/projects/:id`
+        # endpoints. We deliberately do NOT map it to `project_id`; the source
+        # resolves the real project id from `namespace.full_path` instead (it
+        # needs the network, so it cannot happen here).
+        def group_id_for(namespace)
+          namespace[:id] if namespace[:kind] == 'group'
+        end
+
+        def label_titles(features)
+          [*features.dig(:labels, :labels)].pluck(:title)
+        end
+
+        def assignees(features)
+          [*features[:assignees]]
+        end
+
+        def status_name(features)
+          features.dig(:status, :status, :name)
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/triage/option_parser.rb

@@ -65,6 +65,14 @@ module Gitlab
               options.debug = value
             end
 
+            opts.on('--summary', 'Print API call summary at end of execution') do |value|
+              options.summary = value
+            end
+
+            opts.on('--quiet', 'Suppress pagination dots and section headers') do |value|
+              options.quiet = value
+            end
+
             opts.on('--cache-dir [string]', String,
               'Directory containing pre-fetched API responses. ' \
                 'Files must follow the naming convention: <source>_<id>_<resource>.json ' \

data/lib/gitlab/triage/options.rb

@@ -15,7 +15,9 @@ module Gitlab
       :host_url,
       :require_files,
       :api_version,
-      :cache_dir
+      :cache_dir,
+      :summary,
+      :quiet
     ) do
       def initialize(*args)
         super

data/lib/gitlab/triage/policies/base_policy.rb

@@ -71,6 +71,10 @@ module Gitlab
           actions.key?(:work_item_status)
         end
 
+        def work_item?
+          (actions.keys.map(&:to_sym) & %i[labels assignees]).any?
+        end
+
         def build_issue
           raise NotImplementedError
         end

data/lib/gitlab/triage/resource/context.rb

@@ -7,6 +7,7 @@ require_relative 'linked_issue'
 require_relative 'merge_request'
 require_relative 'instance_version'
 require_relative 'branch'
+require_relative 'work_item'
 
 module Gitlab
   module Triage

data/lib/gitlab/triage/resource/work_item.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative 'base'
+require_relative 'shared/issuable'
+
+module Gitlab
+  module Triage
+    module Resource
+      class WorkItem < Base
+        include Shared::Issuable
+
+        DATE_FIELDS = %i[
+          start_date
+          due_date
+        ].freeze
+
+        DATE_FIELDS.each do |field|
+          define_field(field) do
+            value = resource[field]
+
+            Date.parse(value) if value
+          end
+        end
+
+        def work_item_type
+          resource[:work_item_type]
+        end
+
+        def work_item_status
+          resource[:work_item_status]
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/triage/rest_api_network.rb

@@ -35,7 +35,7 @@ module Gitlab
         resources = []
 
         begin
-          print '.'
+          print '.' unless options.quiet
           url = response.fetch(:next_page_url) { url }
 
           response = execute_with_retry(
@@ -90,6 +90,28 @@ module Gitlab
         end
       end
 
+      def patch_api(url, body)
+        response = execute_with_retry(
+          exception_types: [Net::ReadTimeout, Errors::Network::InternalServerError],
+          backoff_exceptions: Errors::Network::TooManyRequests, debug: options.debug) do
+          puts Gitlab::Triage::UI.debug "patch_api: #{url}" if options.debug
+
+          @adapter.patch(token, url, body)
+        end
+
+        rate_limit_debug(response) if options.debug
+        rate_limit_wait(response)
+
+        results = response.delete(:results)
+
+        case results
+        when Hash
+          results.with_indifferent_access
+        else
+          raise_unexpected_response(results)
+        end
+      end
+
       def delete_api(url)
         response = execute_with_retry(
           exception_types: [Net::ReadTimeout, Errors::Network::InternalServerError],
@@ -165,6 +187,7 @@ module Gitlab
         return unless response.delete(:ratelimit_remaining) < MINIMUM_RATE_LIMIT
 
         puts Gitlab::Triage::UI.debug "Rate limit almost exceeded, sleeping for #{response[:ratelimit_reset_at] - Time.now} seconds" if options.debug
+        @adapter.tracker&.record_rate_limit_wait
         sleep(1) until Time.now >= response[:ratelimit_reset_at]
       end
 

data/lib/gitlab/triage/sources/work_items_rest_source.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require 'active_support/all'
+
+require_relative '../url_builders/url_builder'
+require_relative '../normalizers/work_item_normalizer'
+require_relative '../errors'
+require_relative '../ui'
+
+module Gitlab
+  module Triage
+    module Sources
+      # Fetches and updates work items through the GitLab Work Items REST API.
+      #
+      # Unlike the legacy issues REST API, the Work Items REST list endpoint
+      # applies no default base-type filter, so work items of any type -
+      # including custom, namespace-defined types - are returned and can be
+      # matched by name via the `work_item_type_names` filter.
+      #
+      # The source is a self-contained peer to the engine's inline issues /
+      # merge_requests / branches fetch: it owns list URL building, filter
+      # push-down, normalization, and the PATCH update path. Comment creation
+      # is not yet available on the Work Items REST API, so the `comment`
+      # action is rejected at load time by Validators::PolicyValidator.
+      class WorkItemsRestSource
+        UnavailableError = Class.new(StandardError)
+        ScopeError = Class.new(StandardError)
+
+        # Base fields opted into on the list endpoint. The endpoint is sparse
+        # by default (id, iid, global_id, title only); every field a filter or
+        # template reads must be requested here or it comes back nil.
+        LIST_FIELDS = %w[
+          state
+          confidential
+          created_at
+          updated_at
+          web_url
+          author
+          namespace
+          work_item_type
+        ].freeze
+
+        # Widget payloads opted into via `features`.
+        LIST_FEATURES = %w[
+          labels
+          assignees
+          milestone
+          status
+          start_and_due_date
+        ].freeze
+
+        def initialize(network:, options:, per_page: 100, normalizer: Normalizers::WorkItemNormalizer.new)
+          @network = network
+          @options = options
+          @per_page = per_page
+          @normalizer = normalizer
+        end
+
+        def list(conditions)
+          raw = @network.query_api(build_list_url(conditions))
+
+          raise_if_unavailable!(raw)
+
+          raw.map { |item| resolve_project_id!(@normalizer.call(item)) }
+        end
+
+        def update(resource, features)
+          @network.patch_api(work_item_url(resource), features: features)
+        end
+
+        # Returns [source, source_id] for the namespace the resource lives in.
+        # A group run can return work items from descendant projects, and an
+        # iid is only unique within its own namespace, so writes and label
+        # lookups must target the resource's namespace, not the run-level
+        # source.
+        def scope_for(resource)
+          return ['projects', resource[:project_id]] if resource[:project_id]
+          return ['groups', resource[:group_id]] if resource[:group_id]
+
+          # A project item whose legacy project id could not be resolved must
+          # not fall back to the run-level scope: on a group run the same iid
+          # can name a different, visible work item there.
+          if resource.dig(:namespace, :kind) == 'project'
+            raise ScopeError,
+              "Cannot resolve the project for work item #{resource[:web_url] || resource[:iid]}; " \
+                'the token may lack access to its project.'
+          end
+
+          [@options.source, @options.source_id]
+        end
+
+        private
+
+        # The normalizer surfaces `group_id` directly for group-namespace items
+        # (namespace.id == legacy group id) but cannot supply a `project_id` for
+        # project-namespace items, because the list payload only carries the
+        # project-namespace id and full path, not the legacy project id that the
+        # gem's project-scoped resource helpers need. Resolve it here from the
+        # full path, cached per run, so that a group-spanning run makes at most
+        # one lookup per distinct project - and only for project items.
+        def resolve_project_id!(resource)
+          namespace = resource[:namespace]
+          return resource unless namespace && namespace[:kind] == 'project'
+
+          full_path = namespace[:full_path]
+          return resource if full_path.blank?
+
+          project_id = project_id_by_full_path(full_path)
+          resource[:project_id] = project_id if project_id
+
+          resource
+        end
+
+        def project_id_by_full_path(full_path)
+          @project_ids_by_full_path ||= {}
+          return @project_ids_by_full_path[full_path] if @project_ids_by_full_path.key?(full_path)
+
+          project = @network.query_api_cached(project_url(full_path)).first
+          @project_ids_by_full_path[full_path] = project && project[:id]
+        end
+
+        def project_url(full_path)
+          UrlBuilders::UrlBuilder.new(
+            network_options: @options,
+            source: 'projects',
+            source_id: full_path
+          ).build
+        end
+
+        # The Work Items REST API is behind the :work_item_rest_api feature
+        # flag. When it is off, or the token lacks access, or the endpoint is
+        # absent, the response is an error hash (e.g. a 403 "feature flag is
+        # disabled" or a 404). The adapter does not raise on those, so without
+        # this guard the error hash would be normalized into a bogus resource
+        # and the run would silently match nothing - which in an automation
+        # tool looks like "all clear". Raise a clear, actionable error instead.
+        def raise_if_unavailable!(raw)
+          error = raw.find { |item| item.is_a?(Hash) && item[:iid].blank? && (item[:message] || item[:error]) }
+          return unless error
+
+          message = error[:message] || error[:error]
+
+          raise UnavailableError,
+            "The Work Items REST API is not available (#{message}). " \
+              'Ensure the :work_item_rest_api feature flag is enabled and the ' \
+              'token has sufficient access.'
+        end
+
+        def build_list_url(conditions)
+          UrlBuilders::UrlBuilder.new(
+            network_options: @options,
+            source: @options.source,
+            source_id: @options.source_id,
+            resource_type: '-/work_items',
+            params: list_params(conditions)
+          ).build
+        end
+
+        def work_item_url(resource)
+          scope, scope_id = scope_for(resource)
+
+          UrlBuilders::UrlBuilder.new(
+            network_options: @options,
+            source: scope,
+            source_id: scope_id,
+            resource_type: '-/work_items',
+            resource_id: resource[:iid]
+          ).build
+        end
+
+        def list_params(conditions)
+          params = {
+            per_page: @per_page,
+            fields: LIST_FIELDS.join(','),
+            features: LIST_FEATURES.join(',')
+          }
+
+          apply_filters(params, conditions)
+
+          params
+        end
+
+        # Push-down: map work_items conditions to Work Items REST query params.
+        # `type` uses `work_item_type_names`, which resolves names (including
+        # custom types) case-insensitively server-side - no id resolution
+        # needed.
+        def apply_filters(params, conditions)
+          params[:iids] = Array(conditions[:iids]).join(',') if conditions[:iids].present?
+          params[:work_item_type_names] = Array(conditions[:type]).join(',') if conditions[:type]
+          params[:state] = conditions[:state] if conditions[:state]
+          params[:label_name] = Array(conditions[:labels]).join(',') if conditions[:labels]
+          params['not[label_name]'] = Array(conditions[:forbidden_labels]).join(',') if conditions[:forbidden_labels]
+          params[:assignee_usernames] = Array(conditions[:assignees]).join(',') if conditions[:assignees]
+          params['status[name]'] = conditions[:status] if conditions[:status]
+
+          apply_date_filter(params, conditions[:date]) if conditions[:date]
+        end
+
+        def apply_date_filter(params, date_condition)
+          attribute = date_condition[:attribute]
+          condition = date_condition[:condition]
+          return unless %w[created_at updated_at].include?(attribute)
+
+          boundary = date_boundary(date_condition)
+          return unless boundary
+
+          direction = condition == 'older_than' ? 'before' : 'after'
+          params["#{attribute.delete_suffix('_at')}_#{direction}"] = boundary.iso8601
+        end
+
+        def date_boundary(date_condition)
+          interval = date_condition[:interval]
+          interval_type = date_condition[:interval_type]
+          return unless interval && interval_type
+
+          # A malformed interval_type raises here rather than silently dropping
+          # the date bound, which would widen the matched set - dangerous in an
+          # automation tool. interval_type is also validated by the date filter.
+          interval.public_send(interval_type).ago # rubocop:disable GitlabSecurity/PublicSend -- interval_type constrained to a known set
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/triage/validators/policy_validator.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Triage
+    module Validators
+      # Validates policy definitions at load time, before any resource is
+      # fetched or acted on. Triage typically runs unattended and scheduled,
+      # so an unsupported policy must be rejected up front rather than raising
+      # partway through a run (which could leave a rule half-applied and fail
+      # where nobody sees it).
+      class PolicyValidator
+        UnsupportedActionError = Class.new(StandardError)
+
+        COMMENT_NOT_SUPPORTED_MESSAGE =
+          'Commenting on work_items is not yet supported by the Work Items REST API ' \
+            '(blocked on https://gitlab.com/gitlab-org/gitlab/-/work_items/604028). ' \
+            'Use the issues policy type for comment actions.'
+
+        # Action keys Action.actions_for dispatches for work_items policies.
+        # Unlike the legacy resource types, work_items have no quick-actions
+        # comment fallback for unrecognized keys, so anything outside this
+        # list would silently do nothing - reject it up front instead.
+        SUPPORTED_WORK_ITEM_ACTIONS = %i[labels assignees summarize comment_on_summary].freeze
+
+        def initialize(resource_rules)
+          @resource_rules = resource_rules || {}
+        end
+
+        def validate!
+          @resource_rules.each do |resource_type, policy_definition|
+            next unless resource_type.to_s == 'work_items'
+
+            validate_work_items_actions!(policy_definition)
+          end
+        end
+
+        private
+
+        def validate_work_items_actions!(policy_definition)
+          action_sets_from(policy_definition).each do |actions|
+            raise UnsupportedActionError, COMMENT_NOT_SUPPORTED_MESSAGE if actions.key?(:comment)
+
+            unsupported = actions.keys.map(&:to_sym) - SUPPORTED_WORK_ITEM_ACTIONS
+            next if unsupported.none?
+
+            raise UnsupportedActionError,
+              "Unsupported action(s) for work_items policies: #{unsupported.join(', ')}. " \
+                "Supported actions: #{SUPPORTED_WORK_ITEM_ACTIONS.join(', ')}."
+          end
+        end
+
+        # Every place a policy definition can carry actions: top-level rules,
+        # rules nested in summaries, and the summaries' own actions.
+        def action_sets_from(policy_definition)
+          policy_definition ||= {}
+
+          summaries = Array(policy_definition[:summaries])
+          summary_rules = summaries.flat_map { |summary| Array(summary[:rules]) }
+
+          (Array(policy_definition[:rules]) + summary_rules + summaries)
+            .map { |definition| definition[:actions] || {} }
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/triage/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module Triage
-    VERSION = '1.51.1'
+    VERSION = '1.53.0'
   end
 end