raider_reporter 0.8.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 300255531548132ae2fedcd7f10e8e9832925a204f5790ed8accb1d272ab64c6
-  data.tar.gz: ae60aacce4ecd140c8d771b92e8d83b704ec945a3339917d79fb7aeb50d49da9
+  metadata.gz: 291269e17dbda3cec36ff4822af7ba9b16b85f5f1d231eed8b96fb9b89f9e338
+  data.tar.gz: 16e1c480d70fc174b25f7b91fcd5f9b242b04f1e7b751172e796050a0c405a39
 SHA512:
-  metadata.gz: 0213a3b50dbeeedb77ac4e335afc632bf6a25ec815e875cabd4f54bed79fb4164b23770968f38911503055bdb6bc941460f379f08c7e34238f4c379740352f8e
-  data.tar.gz: 6c2c8759eee7dccfb81f93095d4a5c522b6029680ba999ab56073a91a76f5b7e7524da659c9350ea22f8185e1d9c1f294a75ee53aea4ceced898c36b699e0a8d
+  metadata.gz: 6bc649c77eaa3a22110dd19b9a5eb28f1e60aab2d6a2877985a8254c85ad647f58d83427e298f79d48a5e420893afc12c06c54a05526a0b0488ca43c015a6510
+  data.tar.gz: 1590461029cc94956c3e28fffa9003252d8de1f064211dbcc9d3dcdfe0cbe11c4f9125fafb459978f77f082419b80c36a4702d0a7917ba480d4ed6a740a5f8fb

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.10.0 — 2026-10-26
+
+- Video attachments play inline in the HTML report: `video/*` attachments render as a `<video controls>` player (metadata preloaded only) with a download link, instead of a plain link. Unsafe paths are still dropped
+- Videos get their own size cap, `config.max_video_bytes` (default 50 MB); the 5 MB `max_attachment_bytes` still applies to everything else. A video over its cap is skipped with a warning
+- Uploads keep non-video attachments (screenshots, logs) first; videos then fill whatever room is left in the upload budget. A video that does not fit is skipped and later, smaller ones are still tried
+- The Cucumber formatter works on Cucumber 12, which removed `config.strict`: it no longer logs `undefined method 'strict'` and keeps its failure counts (Cucumber 10 and 11 behave as before)
+- No breaking changes
+
+## 0.9.0 — 2026-10-24
+
+- `raider-reporter gate` waits for the Raider quality gate verdict of the CI build (`GET /api/v1/builds/gate`, every 10 seconds, up to `RAIDER_GATE_TIMEOUT` seconds, default 600, 1–3600) and exits 0 when the gate passed or the project has no gate rules, 1 when it failed (naming the failed rules), and 2 when it gets no verdict (timeout, Raider unreachable, token rejected, build not found, any other error). 429, 5xx and network errors are retried within the time limit
+- It posts a `raider/gate` status: a GitHub commit status on the PR head commit (`pull_request` events) or `GITHUB_SHA`, or an Azure Repos PR status; pending while it waits, then success, failure or error. Best effort: a post that fails prints a warning and never changes the exit code
+- `exec`, uploads and `comment` are unchanged and stay fail-open
+- Needs a Raider server with the gate endpoint
+
 ## 0.8.0 — 2026-10-24
 
 - Quarantine: with `RAIDER_QUARANTINE=1` (or `config.quarantine = true`) and a token and endpoint, the formatters fetch the project's quarantine list once per run (`GET /api/v1/quarantine`, 3-second timeout) and report matching failures as `quarantined`, keeping their message, backtrace and attachments. Fail-open: any fetch problem prints `[raider_reporter] quarantine list unavailable (<reason>); no tests quarantined` and nothing is quarantined

data/README.md

@@ -30,7 +30,7 @@ Run `bundle exec rspec` as usual. (For Cucumber, see [Cucumber](#cucumber).) Res
 
 ## Cucumber
 
-Requirements: Cucumber 9, 10 or 11 in your own Gemfile (`gem "cucumber"`). It is not a dependency of this gem; requiring `raider_reporter/cucumber` without Cucumber raises a `LoadError` that says so. Cucumber 9.2.1 on Ruby 4 also needs `gem "logger"` in your Gemfile, because Cucumber requires it without declaring it.
+Requirements: Cucumber 9, 10, 11 or 12 (12 needs Ruby 3.3+) in your own Gemfile (`gem "cucumber"`). It is not a dependency of this gem; requiring `raider_reporter/cucumber` without Cucumber raises a `LoadError` that says so. Cucumber 9.2.1 on Ruby 4 also needs `gem "logger"` in your Gemfile, because Cucumber requires it without declaring it.
 
 ### Plugin mode (recommended)
 
@@ -120,7 +120,11 @@ end
 
 `attach` copies the file right away, so the attachment keeps the bytes the file had at that moment even if the same path is overwritten by a later example. Using a path per example (as above) still makes the files on disk easier to find.
 
-`attach` returns `true` on success. It returns `false` and prints a `[raider_reporter]` warning, never raising, if it is called outside a running example (for instance when the formatter is not loaded), if the file does not exist, or if the file is larger than 5 MB.
+`attach` returns `true` on success. It returns `false` and prints a `[raider_reporter]` warning, never raising, if it is called outside a running example (for instance when the formatter is not loaded), if the file does not exist, or if the file is larger than its size cap: 5 MB (`max_attachment_bytes`), or 50 MB for videos (`video/*`, `max_video_bytes`).
+
+Videos (`.webm`, `.mp4`) are attached the same way, for example `RaiderReporter.attach("video", path, type: :webm)`. In the local HTML report they play inline, with a download link.
+
+When a run is uploaded, screenshots and other non-video attachments are sent first; videos then fill the room left in the upload budget. A video that does not fit is skipped and later, smaller videos are still tried. The local `raider-results/attachments/` folder keeps every attachment that passed its size cap.
 
 ## Configuration
 
@@ -139,6 +143,9 @@ end
 | `clean_output_dir` | `true` | Remove the previous `run.json` and `attachments/` directory (`run-<n>.json` and `attachments-<n>/` when sharded) inside `output_dir` before writing. Nothing else in `output_dir` is touched, except a raider_reporter-written `index.html`. |
 | `html_report` | `true` | Write `index.html`, the local HTML report, into `output_dir` after each run. See [Local report](#local-report). |
 | `quarantine` | `true` when `ENV["RAIDER_QUARANTINE"]` is `1` or `true` | Fetch the quarantine list at run start and report matching failures as `quarantined`. Needs `token` and `endpoint`. See [Quarantine](#quarantine). |
+| `max_attachment_bytes` | `5 MB` | Largest non-video attachment `attach` accepts. |
+| `max_video_bytes` | `50 MB` | Largest `video/*` attachment `attach` accepts. |
+| `exec_summary_path` | `ENV["RAIDER_EXEC_SUMMARY"]` | File where the run writes its failure counts (framework failures, quarantined, errors outside tests) for `raider-reporter exec` to read when it decides the exit code. `exec` sets it for the command it runs; leave it unset otherwise. Nothing is written when it is unset. See [Quarantine](#quarantine). |
 | `environment` | `{}` | Free-form key/values stored with the run (browser, suite name, and so on). Values are JSON values: strings, booleans or numbers. |
 
 ## Local output
@@ -228,6 +235,42 @@ On pull requests, `raider-reporter comment` posts one comment with the build's r
 - The command never fails your CI: it always exits 0 and prints notices to stderr, prefixed `[raider_reporter]`. It needs `GITHUB_TOKEN`, `GITHUB_REPOSITORY`, `GITHUB_EVENT_PATH`, `RAIDER_TOKEN` and `RAIDER_ENDPOINT`; if one is missing, or the event is not a pull request, it does nothing.
 - It requires a Raider server that supports the summary endpoint and the `git.pr` field. Upgrade the server before using it.
 
+## Quality gate
+
+A Raider project can turn on gate rules (minimum pass rate, no new failures against the default branch, no new flaky tests) under its Gate page. Raider computes one verdict per build once every shard is in, and never changes it. `raider-reporter gate` waits for that verdict in CI and fails the job when the gate fails. Run it once, after every test job:
+
+```yaml
+  raider-gate:
+    needs: [test]   # every test job id
+    if: always() && vars.RAIDER_GATE == '1'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with: { ruby-version: "3.4", bundler-cache: true }
+      - name: Wait for the Raider quality gate
+        run: bundle exec raider-reporter gate
+        env:
+          RAIDER_TOKEN: ${{ secrets.RAIDER_TOKEN }}
+          RAIDER_ENDPOINT: ${{ vars.RAIDER_ENDPOINT }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+| Outcome | Exit | Output |
+|---|---|---|
+| passed | 0 | stdout: `raider-reporter gate: passed` and one line per rule |
+| no gate rules | 0 | stdout: `raider-reporter gate: no gate rules for this project` |
+| failed | 1 | stderr: `raider-reporter gate: failed`, one line per failed rule (`  ✗ pass rate: 96% < 98%`) and the build URL |
+| no verdict | 2 | stderr: timeout, Raider unreachable, token rejected, build not found, or another error |
+
+- It polls every 10 seconds (10-second timeouts) for up to `RAIDER_GATE_TIMEOUT` seconds (default 600, 1–3600) and retries 429, 5xx and network errors. While waiting it prints, at most once a minute, `waiting for the verdict (build incomplete: 2 of 4 shards)` or `(analysing results)`.
+- It needs `RAIDER_TOKEN`, `RAIDER_ENDPOINT` and the CI build key that uploads and `comment` use (GitHub Actions or Azure Pipelines); without them it exits 2.
+- It posts a `raider/gate` status: pending while it waits, then success, failure (the failed rules) or error. On GitHub it needs `GITHUB_TOKEN` and `statuses: write`, and uses the PR head commit on `pull_request` events, else `GITHUB_SHA`. On Azure Repos pull requests it needs `SYSTEM_ACCESSTOKEN: $(System.AccessToken)`; other Azure builds get no status. A status that cannot be posted prints a warning and never changes the exit code. Require the `raider/gate` check in branch protection to block merges.
+- Unlike `comment`, `gate` fails closed. Turn it on per repository (the `RAIDER_GATE` variable above) so pull requests from forks and projects without a token are not blocked. The token is never printed.
+
 ## Azure Pipelines
 
 The gem detects Azure Pipelines when `TF_BUILD` is `true`. It reports the build (`provider: azure_pipelines`, build URL, attempt, job), the branch and commit, the pull request and a build key, so shards of one build group together. On a pull request from Azure Repos, `raider-reporter comment` posts one comment thread with the results and sets a `raider/tests` status on the PR.

data/lib/raider_reporter/azure_env.rb

@@ -26,6 +26,16 @@ module RaiderReporter
       value(env, "BUILD_REASON") == "PullRequest" && value(env, "BUILD_REPOSITORY_PROVIDER") == "TfsGit"
     end
 
+    # The REST base of a pull request (threads, statuses), or nil when a part is unknown.
+    def pull_request_api_url(env, number)
+      base = collection_base(env)
+      project = value(env, "SYSTEM_TEAMPROJECTID")
+      repo = value(env, "BUILD_REPOSITORY_ID")
+      return nil unless base && project && repo && number
+
+      "#{base}#{project}/_apis/git/repositories/#{repo}/pullRequests/#{number}"
+    end
+
     def strip_heads(ref)
       return nil if ref.nil?
       return ref.delete_prefix("refs/heads/") if ref.start_with?("refs/heads/")

data/lib/raider_reporter/cli.rb

@@ -2,9 +2,11 @@
 
 require "raider_reporter"
 require "raider_reporter/exec"
+require "raider_reporter/gate"
 
 module RaiderReporter
   # `raider-reporter exec -- <command…>` runs the test suite and decides the build's exit code (see Exec).
+  # `raider-reporter gate` waits for the Raider quality gate verdict and exits 0, 1 or 2 (see Gate).
   # `raider-reporter comment` posts the build summary as a PR comment and sets a commit status
   # (fail-open: always exits 0, notices go to stderr). `raider-reporter report [dir]` rebuilds the
   # local HTML report (exits 1 when there are no run files or the report cannot be written).
@@ -24,10 +26,11 @@ module RaiderReporter
       "failed" => "Raider: tests failed",
       "incomplete" => "Raider: build incomplete"
     }.freeze
-    DEFAULT_API_URL = "https://api.github.com"
     USAGE = <<~TEXT
       #{Exec::USAGE.chomp}
 
+      #{Gate::USAGE.chomp}
+
       Usage: raider-reporter report [dir]
 
       Rebuilds <dir>/index.html (default raider-results) from every run*.json in it. Prints its path.
@@ -53,6 +56,7 @@ module RaiderReporter
 
     def run
       return run_exec if @argv.first == "exec"
+      return run_gate if @argv.first == "gate"
 
       run_reporting
     end
@@ -65,6 +69,16 @@ module RaiderReporter
       Exec.new(command, err: @err).run
     end
 
+    # gate decides the CI job's exit code; Gate owns its own failure handling.
+    def run_gate
+      if @argv.include?("--help") || @argv.include?("-h")
+        @err.puts(Gate::USAGE)
+        return 0
+      end
+
+      Gate.new(env: @env, out: @out, err: @err).run
+    end
+
     def run_reporting
       return report if @argv.first == "report" && !@argv.include?("--help") && !@argv.include?("-h")
 
@@ -161,8 +175,7 @@ module RaiderReporter
     end
 
     def azure_pr_url(pr)
-      "#{AzureEnv.collection_base(@env)}#{AzureEnv.value(@env, 'SYSTEM_TEAMPROJECTID')}/_apis/git/repositories/" \
-        "#{AzureEnv.value(@env, 'BUILD_REPOSITORY_ID')}/pullRequests/#{pr['number']}"
+      AzureEnv.pull_request_api_url(@env, pr["number"])
     end
 
     def azure_forbidden_message
@@ -193,8 +206,7 @@ module RaiderReporter
     end
 
     def api_url
-      url = @env["GITHUB_API_URL"].to_s.strip
-      url.empty? ? DEFAULT_API_URL : url
+      Comment::GithubClient.api_url(@env)
     end
 
     # "**Raider: failed** - 2 failed, 1 quarantined, 148 passed (1m 12s)" -> "2 failed, 1 quarantined, 148 passed".

data/lib/raider_reporter/collector.rb

@@ -8,9 +8,11 @@ require "set"
 module RaiderReporter
   # Accumulates one suite run. Framework formatters call it; writers read the Run it returns.
   class Collector
-    def initialize(max_attachment_bytes:, warn:, clock: -> { Time.now.utc }, uuid: -> { SecureRandom.uuid },
+    def initialize(max_attachment_bytes:, warn:, max_video_bytes: Configuration::DEFAULT_MAX_VIDEO_BYTES,
+                   clock: -> { Time.now.utc }, uuid: -> { SecureRandom.uuid },
                    quarantine: -> { Quarantine::EMPTY })
       @max_attachment_bytes = max_attachment_bytes
+      @max_video_bytes = max_video_bytes
       @warn = warn
       @clock = clock
       @uuid = uuid
@@ -118,8 +120,9 @@ module RaiderReporter
         @warn.call("attachment #{path} no longer exists; skipped")
         return false
       end
-      if File.size(path) > @max_attachment_bytes
-        @warn.call("attachment #{path} is larger than #{@max_attachment_bytes} bytes; skipped")
+      limit = attachment.content_type.to_s.start_with?("video/") ? @max_video_bytes : @max_attachment_bytes
+      if File.size(path) > limit
+        @warn.call("attachment #{path} is larger than #{limit} bytes; skipped")
         return false
       end
       true

data/lib/raider_reporter/comment/azure_client.rb

@@ -38,9 +38,9 @@ module RaiderReporter
         end
       end
 
-      def set_status(state:, description:, target_url:)
+      def set_status(state:, description:, target_url:, name: "tests")
         request(:post, "/statuses", { state: state, description: description.to_s[0, DESCRIPTION_LIMIT],
-                                      targetUrl: target_url, context: { genre: "raider", name: "tests" } },
+                                      targetUrl: target_url, context: { genre: "raider", name: name } },
                 version: STATUS_API_VERSION)
         nil
       end

data/lib/raider_reporter/comment/github_client.rb

@@ -15,8 +15,15 @@ module RaiderReporter
       MAX_PAGES = 10
       PER_PAGE = 100
       DESCRIPTION_LIMIT = 140
+      DEFAULT_API_URL = "https://api.github.com"
 
-      def initialize(token:, repository:, api_url: "https://api.github.com", timeout: 30)
+      # GITHUB_API_URL from a CI env, falling back to github.com when unset or blank.
+      def self.api_url(env)
+        url = env["GITHUB_API_URL"].to_s.strip
+        url.empty? ? DEFAULT_API_URL : url
+      end
+
+      def initialize(token:, repository:, api_url: DEFAULT_API_URL, timeout: 30)
         @token = token
         @repository = repository
         @api_url = api_url.to_s.strip.sub(%r{/+\z}, "")

data/lib/raider_reporter/configuration.rb

@@ -5,9 +5,10 @@ require "raider_reporter/azure_env"
 module RaiderReporter
   class Configuration
     TRUTHY = %w[1 true].freeze
+    DEFAULT_MAX_VIDEO_BYTES = 50 * 1024 * 1024
 
     attr_accessor :token, :endpoint, :output_dir, :clean_output_dir, :html_report, :environment, :max_attachment_bytes,
-                  :quarantine, :exec_summary_path
+                  :max_video_bytes, :quarantine, :exec_summary_path
 
     def initialize(env = ENV)
       @token = AzureEnv.value(env, "RAIDER_TOKEN")
@@ -17,6 +18,7 @@ module RaiderReporter
       @html_report = true
       @environment = {}
       @max_attachment_bytes = 5 * 1024 * 1024
+      @max_video_bytes = DEFAULT_MAX_VIDEO_BYTES
       @quarantine = TRUTHY.include?(AzureEnv.value(env, "RAIDER_QUARANTINE").to_s.downcase)
       @exec_summary_path = AzureEnv.value(env, "RAIDER_EXEC_SUMMARY")
     end

data/lib/raider_reporter/cucumber/formatter.rb

@@ -160,8 +160,8 @@ module RaiderReporter
         return if @outcomes_broken
 
         key = "#{test_case.location}|#{test_case.name}"
-        failed = !result.ok?(strict: @config.strict)
-        flaky = !failed && @failed_before[key] && @config.strict.strict?(:flaky)
+        failed = !result_ok?(result)
+        flaky = !failed && @failed_before[key] && strict_flaky?
         @failed_before[key] ||= failed
         @outcomes[key] = failed || flaky ? true : false
       rescue StandardError => e
@@ -169,6 +169,23 @@ module RaiderReporter
         RaiderReporter.warn("#{e.class}: #{e.message}")
       end
 
+      # Cucumber 10 and 11 carry a strict configuration (config.strict) that result.ok?
+      # takes as a keyword. Cucumber 12 removed it: result.ok? takes nothing, pending and
+      # undefined always fail, and a flaky scenario never does. Detect, never compare versions.
+      def strict_configuration
+        @config.strict if @config.respond_to?(:strict)
+      end
+
+      def result_ok?(result)
+        strict = strict_configuration
+        strict ? result.ok?(strict: strict) : result.ok?
+      end
+
+      def strict_flaky?
+        strict = strict_configuration
+        strict ? strict.strict?(:flaky) : false
+      end
+
       # Scenarios that make cucumber's run fail; one error outside tests when the run
       # stopped before every scenario finished (--fail-fast) (spec §4.4).
       def record_framework_counts

data/lib/raider_reporter/cucumber.rb

@@ -5,7 +5,7 @@ begin
 rescue LoadError => e
   raise unless e.path == "cucumber"
 
-  raise LoadError, "raider_reporter/cucumber needs the cucumber gem (>= 9, < 12) in your Gemfile"
+  raise LoadError, "raider_reporter/cucumber needs the cucumber gem (>= 9, < 13) in your Gemfile"
 end
 require "raider_reporter"
 require_relative "cucumber/formatter"

data/lib/raider_reporter/gate.rb

@@ -0,0 +1,193 @@
+# frozen_string_literal: true
+
+require "raider_reporter/azure_env"
+require "raider_reporter/ci_detector"
+require "raider_reporter/gate_client"
+require "raider_reporter/gate_status"
+
+module RaiderReporter
+  # `raider-reporter gate` (spec §5): waits for the Raider server's frozen quality gate
+  # verdict of this CI build. Exits 0 when it passed or the project has no gate rules,
+  # 1 when it failed, and 2 for every way it gets no verdict. Unlike `exec` and
+  # `comment`, it fails closed. The tokens are never printed.
+  class Gate
+    PREFIX = "raider-reporter gate:"
+    PASSED = 0
+    FAILED = 1
+    NO_VERDICT = 2
+    DEFAULT_TIMEOUT = 600
+    TIMEOUT_RANGE = (1..3600)
+    INTERVAL = 10
+    PROGRESS_EVERY = 60
+    LABELS = { "pass_rate" => "pass rate", "new_failures" => "new failures", "new_flaky" => "new flaky" }.freeze
+    MARKS = { "passed" => "✓", "failed" => "✗", "skipped" => "–" }.freeze
+    USAGE = <<~TEXT
+      Usage: raider-reporter gate
+
+      Waits for the Raider quality gate verdict of this CI build and posts a "raider/gate" status.
+      Exits 0 when the gate passed or the project has no gate rules, 1 when it failed, and 2 when no
+      verdict arrived (timeout, Raider unreachable, token rejected, build not found).
+        Environment: RAIDER_TOKEN, RAIDER_ENDPOINT, RAIDER_GATE_TIMEOUT (seconds, 1-3600, default 600).
+        Status: GITHUB_TOKEN (GitHub Actions) or SYSTEM_ACCESSTOKEN (Azure Repos pull requests).
+    TEXT
+
+    def initialize(env: ENV, out: $stdout, err: $stderr, clock: nil, sleeper: nil)
+      @env = env
+      @out = out
+      @err = err
+      @clock = clock || -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+      @sleeper = sleeper || ->(seconds) { sleep(seconds) }
+      @status = nil
+      @url = nil
+      @detail = nil
+      @last_progress = nil
+    end
+
+    def run
+      build_key = CiDetector.new(env: @env, git: ->(*) {}).ci&.dig("build_key")
+      return refuse("no CI build key (run this in GitHub Actions or Azure Pipelines)") unless build_key
+
+      token = AzureEnv.value(@env, "RAIDER_TOKEN")
+      endpoint = AzureEnv.value(@env, "RAIDER_ENDPOINT")
+      return refuse("RAIDER_TOKEN and RAIDER_ENDPOINT are required") unless token && endpoint
+
+      timeout = parse_timeout
+      return refuse("RAIDER_GATE_TIMEOUT must be a whole number of seconds from 1 to 3600") unless timeout
+
+      @status = GateStatus.new(env: @env, warn: ->(message) { say(@err, "#{PREFIX} #{message}") })
+      @status.post(:pending, "Waiting for the Raider verdict")
+      finish(poll(GateClient.new(endpoint: endpoint, token: token), build_key, timeout), timeout)
+    rescue StandardError => e
+      no_verdict("#{e.class}: #{e.message}")
+    end
+
+    private
+
+    def parse_timeout
+      raw = AzureEnv.value(@env, "RAIDER_GATE_TIMEOUT")
+      return DEFAULT_TIMEOUT if raw.nil?
+
+      value = Integer(raw, 10, exception: false)
+      value if value && TIMEOUT_RANGE.cover?(value)
+    end
+
+    # The last response that ends the wait, or nil when the time limit ran out.
+    def poll(client, build_key, timeout)
+      deadline = @clock.call + timeout
+      loop do
+        response = client.fetch(build_key)
+        return response unless response.kind == :retry || pending?(response)
+
+        note(response)
+        remaining = deadline - @clock.call
+        return nil if remaining <= 0
+
+        @sleeper.call([INTERVAL, remaining].min)
+      end
+    end
+
+    def pending?(response)
+      response.kind == :verdict && response.data["state"] == "pending"
+    end
+
+    def note(response)
+      if response.kind == :retry
+        @detail = response.reason
+        return
+      end
+
+      remember_url(response.data)
+      @detail = pending_detail(response.data)
+      now = @clock.call
+      return if @last_progress && now - @last_progress < PROGRESS_EVERY
+
+      @last_progress = now
+      say(@out, "#{PREFIX} waiting for the verdict (#{@detail})")
+    end
+
+    def pending_detail(data)
+      shards = data["shards"].is_a?(Hash) ? data["shards"] : {}
+      received = shards["received"]
+      expected = shards["expected"]
+      if received.is_a?(Integer) && expected.is_a?(Integer) && received < expected
+        "build incomplete: #{received} of #{expected} shards"
+      else
+        "analysing results"
+      end
+    end
+
+    def finish(response, timeout)
+      return no_verdict("no verdict after #{timeout}s (#{@detail || 'no response'})") unless response
+
+      case response.kind
+      when :rejected then no_verdict("token rejected (HTTP #{response.code})")
+      when :not_found then no_verdict("build not found (did the tests upload?)")
+      when :error then no_verdict(response.reason)
+      else report(response.data)
+      end
+    end
+
+    def report(data)
+      remember_url(data)
+      rules = data["rules"].select { |rule| rule.is_a?(Hash) }
+      case data["state"]
+      when "none"
+        say(@out, "#{PREFIX} no gate rules for this project")
+        @status.post(:success, "No gate rules", target_url: @url)
+        PASSED
+      when "passed"
+        say(@out, "#{PREFIX} passed")
+        rules.each { |rule| say(@out, rule_line(rule)) }
+        @status.post(:success, "Gate passed", target_url: @url)
+        PASSED
+      else
+        report_failed(rules.select { |rule| rule["outcome"] == "failed" })
+      end
+    end
+
+    def report_failed(failed)
+      say(@err, "#{PREFIX} failed")
+      failed.each { |rule| say(@err, rule_line(rule)) }
+      say(@err, "  #{@url}") if @url
+      description = failed.map { |rule| rule_text(rule) }.join("; ")
+      @status.post(:failure, description.empty? ? "Gate failed" : description, target_url: @url)
+      FAILED
+    end
+
+    def rule_line(rule)
+      "  #{MARKS.fetch(rule['outcome'].to_s, '?')} #{rule_text(rule)}"
+    end
+
+    def rule_text(rule)
+      name = rule["rule"].to_s
+      "#{LABELS.fetch(name, name)}: #{rule['detail']}"
+    end
+
+    def remember_url(data)
+      @url = data["url"] if data["url"].is_a?(String) && !data["url"].empty?
+    end
+
+    # Exit 2 before polling: nothing was posted, so there is no status to clear.
+    def refuse(message)
+      say(@err, "#{PREFIX} #{message}")
+      NO_VERDICT
+    end
+
+    # Exit 2 after the pending status: replace it, so a required check is never left pending.
+    def no_verdict(message)
+      say(@err, "#{PREFIX} #{message}")
+      @status&.post(:error, "No verdict", target_url: @url)
+      NO_VERDICT
+    end
+
+    def say(io, text)
+      io.puts(redact(text))
+    end
+
+    def redact(text)
+      secrets = [AzureEnv.value(@env, "RAIDER_TOKEN"), AzureEnv.value(@env, "GITHUB_TOKEN"),
+                 AzureEnv.value(@env, "SYSTEM_ACCESSTOKEN")].compact
+      secrets.reduce(text.to_s) { |memo, secret| memo.gsub(secret, "[REDACTED]") }
+    end
+  end
+end

data/lib/raider_reporter/gate_client.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "cgi/escape"
+require "json"
+require "net/http"
+require "openssl"
+require "timeout"
+require "uri"
+require "raider_reporter/version"
+
+module RaiderReporter
+  # One GET /api/v1/builds/gate call for `raider-reporter gate` (spec §5), classified
+  # so the caller can decide: a verdict, retry (429, 5xx, network), or stop.
+  class GateClient
+    class InvalidResponse < StandardError; end
+
+    PATH = "/api/v1/builds/gate"
+    TIMEOUT = 10
+    STATES = %w[pending none passed failed].freeze
+    NETWORK_ERRORS = [Timeout::Error, SystemCallError, SocketError, IOError, OpenSSL::SSL::SSLError,
+                      Net::ProtocolError, Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError].freeze
+
+    # kind: :verdict, :retry, :rejected, :not_found or :error.
+    Response = Data.define(:kind, :data, :code, :reason)
+
+    def initialize(endpoint:, token:)
+      @endpoint = endpoint
+      @token = token
+    end
+
+    def fetch(build_key)
+      classify(request(build_key))
+    rescue *NETWORK_ERRORS => e
+      Response.new(kind: :retry, data: nil, code: nil, reason: redact("#{e.class}: #{e.message}"))
+    end
+
+    private
+
+    def request(build_key)
+      uri = URI.parse("#{@endpoint.to_s.strip.chomp('/')}#{PATH}?build_key=#{CGI.escape(build_key.to_s)}")
+      raise ArgumentError, "RAIDER_ENDPOINT must start with http:// or https://" unless uri.is_a?(URI::HTTP)
+
+      req = Net::HTTP::Get.new(uri)
+      req["Authorization"] = "Bearer #{@token}"
+      req["Accept"] = "application/json"
+      req["User-Agent"] = "raider_reporter/#{VERSION}"
+      Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", open_timeout: TIMEOUT,
+                                          read_timeout: TIMEOUT, max_retries: 0) { |http| http.request(req) }
+    end
+
+    def classify(response)
+      code = response.code.to_i
+      case code
+      when 200 then parse(response.body)
+      when 401, 403 then Response.new(kind: :rejected, data: nil, code: code, reason: nil)
+      when 404 then Response.new(kind: :not_found, data: nil, code: code, reason: nil)
+      when 429, 500..599 then Response.new(kind: :retry, data: nil, code: code, reason: "HTTP #{code}")
+      else error_response(code, "unexpected HTTP #{code}")
+      end
+    end
+
+    def parse(body)
+      data = JSON.parse(body.to_s)
+      return error_response(200, "invalid gate response") unless valid?(data)
+
+      Response.new(kind: :verdict, data: data, code: 200, reason: nil)
+    rescue JSON::ParserError => e
+      Response.new(kind: :error, data: nil, code: 200, reason: redact("#{e.class}: #{e.message}"))
+    end
+
+    def valid?(data)
+      data.is_a?(Hash) && STATES.include?(data["state"]) && data["rules"].is_a?(Array)
+    end
+
+    # Spec §5 "other error" form: <class>: <message>.
+    def error_response(code, message)
+      Response.new(kind: :error, data: nil, code: code, reason: "#{InvalidResponse}: #{message}")
+    end
+
+    def redact(text)
+      @token.to_s.empty? ? text : text.gsub(@token.to_s, "[REDACTED]")
+    end
+  end
+end

data/lib/raider_reporter/gate_status.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "raider_reporter/version"
+require "raider_reporter/azure_env"
+require "raider_reporter/ci_detector"
+require "raider_reporter/comment/github_client"
+require "raider_reporter/comment/azure_client"
+
+module RaiderReporter
+  # Posts the "raider/gate" status for `raider-reporter gate` (spec §5): a GitHub commit
+  # status (PR head SHA on pull_request events, else GITHUB_SHA) or an Azure Repos PR
+  # status (genre raider, name gate). Best effort: a failed post warns and never raises.
+  class GateStatus
+    CONTEXT = "raider/gate"
+    AZURE_NAME = "gate"
+    TIMEOUT = 10
+    GITHUB_STATES = { pending: "pending", success: "success", failure: "failure", error: "error" }.freeze
+    AZURE_STATES = { pending: "pending", success: "succeeded", failure: "failed", error: "error" }.freeze
+
+    def initialize(env:, warn:)
+      @env = env
+      @warn = warn
+      @provider = begin
+        detect
+      rescue StandardError
+        nil
+      end
+    end
+
+    def active?
+      !@provider.nil?
+    end
+
+    # state: :pending, :success, :failure or :error.
+    def post(state, description, target_url: nil)
+      case @provider
+      when :github
+        github_client.set_status(@sha, state: GITHUB_STATES.fetch(state), target_url: target_url,
+                                       description: description, context: CONTEXT)
+      when :azure
+        azure_client.set_status(state: AZURE_STATES.fetch(state), description: description, target_url: target_url,
+                                name: AZURE_NAME)
+      end
+      nil
+    rescue StandardError => e
+      @warn.call("could not post the #{CONTEXT} status (#{e.class}: #{e.message})")
+      nil
+    end
+
+    private
+
+    def detect
+      detector = CiDetector.new(env: @env, git: ->(*) {})
+      if @env["GITHUB_ACTIONS"] == "true"
+        @sha = detector.git&.dig("commit_sha")
+        :github if [@env["GITHUB_TOKEN"], @env["GITHUB_REPOSITORY"], @sha].none? { |value| value.to_s.strip.empty? }
+      elsif AzureEnv.azure?(@env)
+        pr = detector.git&.dig("pr")
+        @azure_url = pr && AzureEnv.pull_request_api_url(@env, pr["number"])
+        :azure if @azure_url && AzureEnv.value(@env, "SYSTEM_ACCESSTOKEN")
+      end
+    end
+
+    def github_client
+      Comment::GithubClient.new(token: @env["GITHUB_TOKEN"], repository: @env["GITHUB_REPOSITORY"],
+                                api_url: Comment::GithubClient.api_url(@env), timeout: TIMEOUT)
+    end
+
+    def azure_client
+      Comment::AzureClient.new(token: AzureEnv.value(@env, "SYSTEM_ACCESSTOKEN"), base_url: @azure_url, timeout: TIMEOUT)
+    end
+  end
+end

data/lib/raider_reporter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RaiderReporter
-  VERSION = "0.8.0"
+  VERSION = "0.10.0"
 end

data/lib/raider_reporter/writers/html.rb

@@ -224,8 +224,11 @@ module RaiderReporter
           href = safe_href(attachment["path"])
           next unless href
 
-          if attachment["content_type"].to_s.start_with?("image/")
+          content_type = attachment["content_type"].to_s
+          if content_type.start_with?("image/")
             %(<a href="#{href}"><img loading="lazy" src="#{href}" alt="#{h(attachment['name'])}"></a>)
+          elsif content_type.start_with?("video/")
+            %(<video controls preload="metadata" src="#{href}"></video><a href="#{href}" download>#{h(attachment['name'])}</a>)
           else
             %(<a href="#{href}">#{h(attachment['name'])}</a>)
           end
@@ -280,6 +283,7 @@ module RaiderReporter
         .r p{margin:2px 0;overflow-wrap:anywhere}.n{font-weight:500}.x{color:var(--ruby);font-weight:600}
         pre{margin:4px 0;padding:8px;background:var(--card);border-radius:6px;overflow-x:auto;white-space:pre-wrap;font-size:12px}
         .a img{max-width:100%;max-height:240px;border:1px solid var(--bdr);border-radius:4px;margin-top:4px}
+        .a video{max-width:100%;max-height:360px;display:block}
         a{color:var(--ruby)}.empty{padding:24px 0;color:var(--mute)}
       CSS
 

data/lib/raider_reporter/writers/uploader.rb

@@ -48,30 +48,59 @@ module RaiderReporter
 
       private
 
-      # Keeps the leading attachments that fit the byte and count budget and
-      # rebuilds the payload without the rest, so part names stay contiguous.
-      # The local run.json is written from the original payload and keeps all.
+      # Keeps the attachments that fit the byte and count budget, non-video
+      # attachments first and videos in whatever room is left, and rebuilds the
+      # payload without the rest, so part names stay contiguous. Survivors keep
+      # their original order. The local run.json is written from the original
+      # payload and keeps all.
       def within_budget(payload)
         entries = payload.attachment_entries
-        bytes = 0
-        keep = entries.index do |entry|
-          bytes += File.size?(entry[:attachment].source_path).to_i
-          bytes > MAX_UPLOAD_ATTACHMENT_BYTES
-        end || entries.size
-        keep = [keep, MAX_UPLOAD_ATTACHMENTS].min
-        return payload if keep == entries.size
-
-        dropped = entries.size - keep
+        keep = budgeted(entries)
+        return payload if keep.size == entries.size
+
+        dropped = entries.size - keep.size
         @warn.call("not uploading #{dropped} #{dropped == 1 ? 'attachment' : 'attachments'}: over the upload " \
                    "budget of #{MAX_UPLOAD_ATTACHMENT_BYTES / (1024 * 1024)} MB / " \
                    "#{MAX_UPLOAD_ATTACHMENTS} files; they remain in #{@config.output_dir}")
-        seen = 0
         run = payload.run
         Payload.new(run.with(results: run.results.map do |result|
-          result.with(attachments: result.attachments.select { (seen += 1) <= keep })
+          result.with(attachments: result.attachments.select { |attachment| keep.key?(attachment) })
         end))
       end
 
+      # Identity-keyed set of the attachments to upload. Non-videos come first
+      # and stop at the first byte overflow; videos then fill the room left,
+      # a video that does not fit is skipped and later ones are still tried.
+      def budgeted(entries)
+        videos, others = entries.partition { |entry| video?(entry[:attachment]) }
+        keep = {}.compare_by_identity
+        bytes = 0
+        others.each do |entry|
+          bytes += size_of(entry)
+          break if bytes > MAX_UPLOAD_ATTACHMENT_BYTES || keep.size >= MAX_UPLOAD_ATTACHMENTS
+
+          keep[entry[:attachment]] = true
+        end
+        videos.each do |entry|
+          break if keep.size >= MAX_UPLOAD_ATTACHMENTS
+
+          size = size_of(entry)
+          next if bytes + size > MAX_UPLOAD_ATTACHMENT_BYTES
+
+          bytes += size
+          keep[entry[:attachment]] = true
+        end
+        keep
+      end
+
+      def video?(attachment)
+        attachment.content_type.to_s.start_with?("video/")
+      end
+
+      def size_of(entry)
+        File.size?(entry[:attachment].source_path).to_i
+      end
+
       def add_field(body, boundary, name, value)
         body << "--#{boundary}\r\nContent-Disposition: form-data; name=\"#{name}\"\r\n\r\n".b
         body << value.to_s.b << "\r\n".b

data/lib/raider_reporter.rb

@@ -50,6 +50,7 @@ module RaiderReporter
       @project_root = Dir.pwd
       @collector = Collector.new(
         max_attachment_bytes: configuration.max_attachment_bytes,
+        max_video_bytes: configuration.max_video_bytes,
         warn: ->(message) { warn(message) },
         quarantine: -> { quarantined_keys }
       )
@@ -70,14 +71,15 @@ module RaiderReporter
         return false
       end
 
-      limit = configuration.max_attachment_bytes
+      content_type = ContentTypes.resolve(type, path)
+      limit = attachment_limit(content_type)
       if File.size(path.to_s) > limit
         warn("attach(#{name.inspect}): file #{path} is larger than #{limit} bytes; ignored")
         return false
       end
 
       collector.attach(Attachment.new(name: name.to_s, source_path: collector.stage(path.to_s),
-                                      content_type: ContentTypes.resolve(type, path)))
+                                      content_type: content_type))
     rescue StandardError => e
       warn("attach(#{name.inspect}) failed: #{e.class}: #{e.message}")
       false
@@ -119,6 +121,10 @@ module RaiderReporter
 
     private
 
+    def attachment_limit(content_type)
+      content_type.start_with?("video/") ? configuration.max_video_bytes : configuration.max_attachment_bytes
+    end
+
     # First, so a later reporting problem cannot lose it. A failure here only means
     # no summary, and exec then keeps the command's exit code.
     def write_exec_summary

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: raider_reporter
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Augustin Gottlieb
@@ -38,6 +38,9 @@ files:
 - lib/raider_reporter/cucumber/formatter.rb
 - lib/raider_reporter/exec.rb
 - lib/raider_reporter/exec_summary.rb
+- lib/raider_reporter/gate.rb
+- lib/raider_reporter/gate_client.rb
+- lib/raider_reporter/gate_status.rb
 - lib/raider_reporter/github_event.rb
 - lib/raider_reporter/models.rb
 - lib/raider_reporter/payload.rb
@@ -71,7 +74,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.21
+rubygems_version: 4.0.20
 specification_version: 4
 summary: RSpec and Cucumber formatters that write Raider reports locally and upload
   them to Raider