@misterhuydo/sentinel 1.4.68 → 1.4.69

package/python/sentinel/git_manager.py

@@ -51,6 +51,27 @@ def _git_env(repo: RepoConfig) -> dict:
     return env
 
 
+def maven_compile_check(local_path: str, timeout: int = 300) -> tuple[bool, str]:
+    """
+    Run `mvn compile -DskipTests -q --batch-mode` to verify the pom.xml is valid
+    and all dependencies resolve before committing.
+    Returns (success, output). Raises MissingToolError if mvn is not installed.
+    """
+    import shutil
+    mvn = shutil.which("mvn")
+    if not mvn:
+        raise MissingToolError("mvn")
+    r = subprocess.run(
+        [mvn, "compile", "-DskipTests", "-q", "--batch-mode"],
+        cwd=local_path,
+        capture_output=True,
+        text=True,
+        timeout=timeout,
+    )
+    output = (r.stdout + r.stderr).strip()
+    return r.returncode == 0, output
+
+
 def _check_protected_paths(patch_path: Path) -> bool:
     text = patch_path.read_text(encoding="utf-8", errors="replace")
     for line in text.splitlines():
@@ -162,19 +183,24 @@ def commit_file_change(
     repo: RepoConfig,
     files: list[str],
     commit_msg: str,
+    skip_pull: bool = False,
 ) -> tuple[str, str]:
     """
-    Pull, stage the given files, and commit.
+    Stage the given files and commit, optionally pulling first.
     Returns (status, commit_hash) — status: "committed" | "failed".
     Does NOT run tests (dependency bumps don't need them).
+
+    skip_pull=True when the caller already pulled before modifying files
+    (git pull --rebase fails on a dirty working tree).
     """
     env = _git_env(repo)
     local_path = repo.local_path
 
-    r = _git(["pull", "--rebase", "origin", repo.branch], cwd=local_path, env=env)
-    if r.returncode != 0:
-        logger.error("git pull failed for %s:\n%s", repo.repo_name, r.stderr)
-        return "failed", ""
+    if not skip_pull:
+        r = _git(["pull", "--rebase", "origin", repo.branch], cwd=local_path, env=env)
+        if r.returncode != 0:
+            logger.error("git pull failed for %s:\n%s", repo.repo_name, r.stderr)
+            return "failed", ""
 
     _git(["add"] + files, cwd=local_path, env=env)
     r = _git(["commit", "-m", commit_msg], cwd=local_path, env=env)
@@ -194,11 +220,12 @@ def push_dep_update(
     artifact_id: str,
     new_version: str,
     commit_hash: str,
-) -> tuple[str, str]:
+) -> tuple[str, str, bool]:
     """
     Push a dependency update commit. AUTO_PUBLISH=true → main branch.
     AUTO_PUBLISH=false → sentinel/dep-<artifact>-<version> branch + open PR.
-    Returns (branch, pr_url).
+    Returns (branch, pr_url, push_ok).
+    push_ok=False means the commit is local only (no write access) — chain release continues.
     """
     env = _git_env(repo)
     local_path = repo.local_path
@@ -206,8 +233,12 @@ def push_dep_update(
     if repo.auto_publish:
         r = _git(["push", "origin", repo.branch], cwd=local_path, env=env)
         if r.returncode != 0:
-            logger.error("git push failed for %s:\n%s", repo.repo_name, r.stderr)
-        return repo.branch, ""
+            logger.warning(
+                "git push failed for %s (commit is local only): %s",
+                repo.repo_name, r.stderr.strip().splitlines()[0] if r.stderr else "",
+            )
+            return repo.branch, "", False
+        return repo.branch, "", True
     else:
         safe_artifact = re.sub(r"[^a-zA-Z0-9_-]", "-", artifact_id)
         safe_version = re.sub(r"[^a-zA-Z0-9._-]", "-", new_version)
@@ -215,12 +246,15 @@ def push_dep_update(
         _git(["checkout", "-B", branch], cwd=local_path, env=env)
         r = _git(["push", "-u", "origin", branch], cwd=local_path, env=env)
         if r.returncode != 0:
-            logger.error("git push branch failed for %s:\n%s", repo.repo_name, r.stderr)
+            logger.warning(
+                "git push branch failed for %s (commit is local only): %s",
+                repo.repo_name, r.stderr.strip().splitlines()[0] if r.stderr else "",
+            )
             _git(["checkout", repo.branch], cwd=local_path, env=env)
-            return branch, ""
+            return branch, "", False
         _git(["checkout", repo.branch], cwd=local_path, env=env)
         pr_url = open_dep_pr(repo, cfg, branch, artifact_id, new_version, commit_hash)
-        return branch, pr_url
+        return branch, pr_url, True
 
 
 def open_dep_pr(

package/python/sentinel/notify.py

@@ -355,6 +355,40 @@ def notify_cascade_result(
         slack_alert(cfg.slack_bot_token, cfg.slack_channel, text)
 
 
+def notify_cascade_build_failed(
+    cfg,
+    repo_name: str,
+    artifact_id: str,
+    new_version: str,
+    build_output: str,
+    user_id: str = "",
+) -> None:
+    """Alert admin when a Maven compile check fails after a dep bump — pom.xml was reverted."""
+    # Maven errors accumulate at the bottom — show the last 600 chars
+    snippet = build_output.strip()[-600:]
+    text = (
+        f":x: *Cascade build check failed — `{repo_name}`*\n"
+        f"Bumping `{artifact_id}` \u2192 `{new_version}` caused a compile error.\n"
+        f"`pom.xml` has been reverted. Manual intervention required.\n"
+        f"```{snippet}```"
+    )
+    if user_id:
+        slack_alert(cfg.slack_bot_token, cfg.slack_channel, f"<@{user_id}> {text}")
+    else:
+        slack_alert(cfg.slack_bot_token, cfg.slack_channel, f"<!channel> {text}")
+    try:
+        from .reporter import send_failure_notification
+        send_failure_notification(cfg, {
+            "source":    repo_name,
+            "message":   f"Cascade dep bump {artifact_id}={new_version} failed Maven compile",
+            "repo_name": repo_name,
+            "reason":    f"Maven compile error after dep bump: {build_output[:300]}",
+            "body":      build_output,
+        })
+    except Exception as exc:
+        logger.warning("notify_cascade_build_failed: email notification failed: %s", exc)
+
+
 def alert_if_rate_limited(
     bot_token: str,
     channel: str,