@codyswann/lisa 4.40.0 → 4.41.0

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -341,6 +341,7 @@ export const VIOLATIONS = Object.freeze({
   whitespace: "whitespace_in_skip_token",
   vacuous: "vacuous_required_check",
   unproven: "unproven_required_check",
+  absent: "absent_required_check",
   reviewWaived: "review_evidence_waived",
   reviewUnsatisfied: "review_evidence_unsatisfied",
 });
@@ -1411,6 +1412,92 @@ function evaluateEvidenceBearingCheck(name, entry, checks, context) {
   };
 }
 
+/**
+ * Every required context that posted NO check-run at all.
+ *
+ * The third member of the family this file's header names, and the one that was
+ * missing. **Skipped** is a check that ran and declined to prove anything;
+ * **vacuous** is one that ran, reported success, and did no work; **absent** is
+ * one that never reported. All three satisfy a merge gate without evidence, and
+ * absence is the quietest because it produces no row for anyone to read.
+ *
+ * MEASURED (CodySwannGT/lisa#3580, on PR #3573): 15 required contexts, 2
+ * reported, 13 absent. The three workflow runs that would have posted them sat
+ * at `conclusion: action_required` with `created_at == updated_at` — parked,
+ * never executed. The pull request rendered as "CI running" for 26 hours.
+ *
+ * **Why the vacuity arm could not see it.** {@link evaluateVacuousChecks}
+ * iterates `evidence_bearing_checks`, which held ONE name on that repository.
+ * `required_contexts` held fifteen. This file already knew the full required
+ * set and spent it only on an annotation — "This context IS ruleset-required" —
+ * attached to findings about the one. Nothing ever walked the fifteen to ask
+ * which of them said nothing. The data was here; the question was not.
+ *
+ * Three properties, each load-bearing:
+ *
+ * - **Absent is not pending.** A check in flight has posted a row and will post
+ *   a verdict; an absent one never will. Folding them together is the confusion
+ *   that made the stall invisible, so this must not make it in reverse — only a
+ *   context with no row at all counts, whatever state the rows carry.
+ * - **No snapshot, no finding.** Without `required_contexts` this cannot know
+ *   what was required, and a guard that invented the set would fire on every
+ *   repository that has not transcribed one. Absence of knowledge is not
+ *   knowledge of absence — the same distinction the arm exists to enforce,
+ *   pointed at itself.
+ * - **The parked-run lookup is an ENRICHMENT, never a precondition.** It names
+ *   the approval gate when it can, because "absent" alone sends an operator
+ *   hunting a broken workflow. But a finding that only reports when it can also
+ *   explain would report nothing wherever the explanation is unavailable, which
+ *   is the silent failure this was written to end.
+ * @param {object} declaration - The per-repo declaration
+ * @param {ReadonlyArray<{name: string}>} checks - Rows read for the head SHA
+ * @param {object} [options] - `headSha` to cite, `parkedRuns` to explain with
+ * @returns {{violations: object[], checked: number, absent: string[]}} Findings
+ */
+export function evaluateAbsentRequiredChecks(
+  declaration,
+  checks,
+  options = {}
+) {
+  const required = declaration.required_contexts;
+  if (!Array.isArray(required))
+    return { violations: [], checked: 0, absent: [] };
+
+  const at = citeHeadSha(options.headSha);
+  const parked = (options.parkedRuns ?? []).filter(
+    run => String(run?.conclusion ?? "") === "action_required"
+  );
+  // Named once for every finding rather than per context: a parked run posts no
+  // check-run, so nothing ties one run to one absent context. Reporting the
+  // whole parked set against each is honest about that; pretending to a mapping
+  // this data cannot support would be a worse answer than an imprecise one.
+  const approval =
+    parked.length === 0
+      ? ""
+      : ` A workflow run for this head is parked at \`action_required\` and will never complete on its own: ${parked
+          .map(
+            run => `${JSON.stringify(String(run.name ?? ""))} (run ${run.id})`
+          )
+          .join(
+            ", "
+          )}. Approve it with \`gh api -X POST repos/<owner>/<repo>/actions/runs/<id>/approve\`, or the context stays absent indefinitely.`;
+
+  const absent = required.filter(
+    name => checks.find(check => check.name === name) === undefined
+  );
+
+  return {
+    checked: required.length,
+    absent,
+    violations: absent.map(name => ({
+      kind: VIOLATIONS.absent,
+      token: name,
+      contexts: [name],
+      message: `\`${name}\` is ruleset-required but did not report on this pull request at all.${at} It posted NO check-run — not pending, not failing, ABSENT. \`gh pr checks\` prints no line for it and the pull request page renders it exactly as one still in flight, so every surface says "wait" and none says "broken".${approval} (If the context was renamed, fix \`required_contexts\`; names are compared byte for byte.)`,
+    })),
+  };
+}
+
 /**
  * Descriptions that WAIVE the review gate, matched whole and case-insensitively.
  *
@@ -2810,6 +2897,14 @@ export function inspectVacuity(argv, declaration, options = {}) {
     trustRequiredContexts: options.trustRequiredContexts,
     headSha: read.headSha,
   });
+  // Evaluated on the same rows the vacuity arm just read, so the absence arm
+  // costs no extra fetch. It runs on EVERY invocation for the reason the review
+  // gate does: a finding computed only when somebody opted in is invisible on
+  // exactly the repositories that have not opted in yet.
+  const absent = evaluateAbsentRequiredChecks(declaration, read.checks, {
+    headSha: read.headSha,
+    parkedRuns: options.parkedRuns,
+  });
   // The gate is evaluated on EVERY run, not only when a caller asked it to
   // block. Its findings are what make a waiver visible, and a waiver that is
   // only computed when somebody opted in would be invisible on exactly the
@@ -2841,7 +2936,12 @@ export function inspectVacuity(argv, declaration, options = {}) {
     prSource: source,
     headSha: read.headSha,
     checked: evaluated.checked,
-    violations: [...evaluated.violations, ...gate.violations],
+    violations: [
+      ...evaluated.violations,
+      ...absent.violations,
+      ...gate.violations,
+    ],
+    absent: absent.absent,
     gateStates: gate.states,
     gateConditions: gate.conditions,
     gateDescriptions: gate.descriptions,

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -1388,6 +1388,15 @@ export const parseChangedLineRanges = patch => {
 
 /**
  * Stryker mutation ranges for one changed file.
+ *
+ * The diff runs against the WORKING TREE, not `base...HEAD`. Stryker mutates
+ * the files on disk, so a window derived from committed state describes lines
+ * that may no longer be where it says they are: any uncommitted edit above the
+ * change shifts the numbering out from under the window, and the run then
+ * mutates whatever now occupies those lines — measured once as 37 lines of pure
+ * comment, scored, and reported as a verdict about the change. It could as
+ * easily have produced a pass. Diffing what Stryker actually reads is what
+ * makes the window and the subject the same thing.
  * @param {string} cwd - Project root.
  * @param {string} base - Merge-base sha.
  * @param {string} file - Repository-relative path.
@@ -1395,14 +1404,7 @@ export const parseChangedLineRanges = patch => {
  */
 export const selectChangedLineRanges = (cwd, base, file) =>
   parseChangedLineRanges(
-    git(cwd, [
-      "diff",
-      "--unified=0",
-      "--diff-filter=ACMR",
-      `${base}...HEAD`,
-      "--",
-      file,
-    ])
+    git(cwd, ["diff", "--unified=0", "--diff-filter=ACMR", base, "--", file])
   ).map(({ start, end }) => `${file}:${start}-${end}`);
 
 /**
@@ -1416,12 +1418,11 @@ export const selectChangedLineRanges = (cwd, base, file) =>
  *   files no mutation tool here reaches.
  */
 export const selectChangedTargets = (cwd, base, patterns) => {
-  const changed = git(cwd, [
-    "diff",
-    "--name-only",
-    "--diff-filter=ACMRD",
-    `${base}...HEAD`,
-  ])
+  // Working tree, not `base...HEAD`, for the same reason the line ranges are:
+  // a target whose only change is uncommitted is invisible to committed state,
+  // so the gate printed "0 mutate targets" and exited 0 while Stryker, pointed
+  // at the same tree, had a changed target in front of it.
+  const changed = git(cwd, ["diff", "--name-only", "--diff-filter=ACMRD", base])
     .split("\n")
     .map(file => file.trim())
     .filter(Boolean);
@@ -2115,6 +2116,11 @@ export const reportRun = (cwd, result) => {
 export const runGate = (cwd = process.cwd(), argv = []) => {
   const gate = readGate(cwd);
   const enabled = envFlag("MUTATION_ENABLED") ?? gate.enabled === true;
+  // Reads like the LOCAL branch and is not: `resolveDiffBase` probes
+  // `origin/<since>` first and only falls back to the local name, so a stale
+  // local `main` does not drag every commit it is missing into the diff. Said
+  // here because the line alone has already been read the other way and filed
+  // as a defect; the behaviour is pinned by a test rather than by this note.
   const since = process.env.MUTATION_SINCE || gate.since || "main";
 
   if (!enabled) {