@misterhuydo/sentinel 1.4.68 → 1.4.70

package/python/scripts/fix_two_bugs.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""
+Fix two bugs:
+1. merge_pr: pr_number param ignored — now uses GitHub API directly for non-state-store PRs
+2. slack_bot: thread replies with file_share subtype silently dropped
+"""
+import ast, sys
+
+# ── Fix 1: merge_pr handler — honour pr_number ────────────────────────────────
+
+BOSS = '/home/sentinel/sentinel/code/sentinel/sentinel_boss.py'
+
+with open(BOSS, 'r', encoding='utf-8') as f:
+    boss = f.read()
+
+OLD_MERGE = '''        if name == "merge_pr":
+            import re as _re
+            import requests as _req
+            repo_name   = inputs.get("repo_name", "").strip()
+            fingerprint = inputs.get("fingerprint", "").strip()
+            github_token = cfg_loader.sentinel.github_token
+            if not github_token:
+                return json.dumps({"error": "GITHUB_TOKEN not configured"})
+
+            # Find the PR in state_store
+            open_prs = store.get_open_prs()
+            candidates = [p for p in open_prs if p.get("repo_name") == repo_name]
+            if fingerprint:
+                candidates = [p for p in candidates if p.get("fingerprint", "").startswith(fingerprint)]
+            if not candidates:
+                return json.dumps({"error": f"No open Sentinel PR found for repo \'{repo_name}\'"
+                                            + (f" with fingerprint \'{fingerprint}\'" if fingerprint else "")})
+            fix = candidates[0]  # most recent
+            pr_url = fix.get("pr_url", "")
+            branch = fix.get("branch", "")
+            fp     = fix.get("fingerprint", "")
+
+            # Parse owner/repo and PR number from pr_url
+            m = _re.search(r"github\\.com/([^/]+/[^/]+)/pull/(\\d+)", pr_url)
+            if not m:
+                return json.dumps({"error": f"Cannot parse PR URL: {pr_url}"})
+            owner_repo = m.group(1)
+            pr_number  = m.group(2)
+            headers = {
+                "Authorization": f"Bearer {github_token}",
+                "Accept": "application/vnd.github+json",
+            }'''
+
+NEW_MERGE = '''        if name == "merge_pr":
+            import re as _re
+            import requests as _req
+            repo_name    = inputs.get("repo_name", "").strip()
+            fingerprint  = inputs.get("fingerprint", "").strip()
+            pr_number_in = inputs.get("pr_number")   # explicit PR number (e.g. Renovate PR)
+            github_token = cfg_loader.sentinel.github_token
+            if not github_token:
+                return json.dumps({"error": "GITHUB_TOKEN not configured"})
+
+            headers = {
+                "Authorization": f"Bearer {github_token}",
+                "Accept": "application/vnd.github+json",
+            }
+
+            # Fuzzy-match repo name against known configs
+            if repo_name not in cfg_loader.repos:
+                for rname in cfg_loader.repos:
+                    if repo_name.lower() in rname.lower():
+                        repo_name = rname
+                        break
+
+            # ── Path A: explicit pr_number — merge directly via GitHub API ────
+            if pr_number_in:
+                pr_number_in = int(pr_number_in)
+                # Determine owner/repo from config or state_store
+                repo_cfg = cfg_loader.repos.get(repo_name)
+                owner_repo = ""
+                if repo_cfg and repo_cfg.repo_url:
+                    url = repo_cfg.repo_url
+                    if url.startswith("git@"):
+                        owner_repo = url.split(":")[-1].removesuffix(".git")
+                    else:
+                        owner_repo = "/".join(url.rstrip("/").split("/")[-2:]).removesuffix(".git")
+                if not owner_repo:
+                    # Fall back: search state_store PRs for this repo to get owner/repo
+                    for p in store.get_open_prs():
+                        if p.get("repo_name") == repo_name and p.get("pr_url"):
+                            m2 = _re.search(r"github\\.com/([^/]+/[^/]+)/pull/", p["pr_url"])
+                            if m2:
+                                owner_repo = m2.group(1)
+                                break
+                if not owner_repo:
+                    return json.dumps({"error": f"Cannot determine GitHub owner/repo for \'{repo_name}\'"})
+
+                # Fetch PR details to confirm it\'s open
+                pr_resp = _req.get(
+                    f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number_in}",
+                    headers=headers, timeout=15,
+                )
+                if pr_resp.status_code == 404:
+                    return json.dumps({"error": f"PR #{pr_number_in} not found in {owner_repo}"})
+                if pr_resp.status_code != 200:
+                    return json.dumps({"error": f"GitHub API error ({pr_resp.status_code}): {pr_resp.text[:200]}"})
+                pr_data = pr_resp.json()
+                if pr_data.get("state") != "open":
+                    return json.dumps({"error": f"PR #{pr_number_in} is already {pr_data.get('state')} — nothing to merge"})
+                pr_url  = pr_data.get("html_url", "")
+                branch  = pr_data.get("head", {}).get("ref", "")
+                pr_title = pr_data.get("title", "")
+
+                merge_resp = _req.put(
+                    f"https://api.github.com/repos/{owner_repo}/pulls/{pr_number_in}/merge",
+                    json={"merge_method": "squash", "commit_title": f"chore: merge PR #{pr_number_in} [{pr_title[:60]}]"},
+                    headers=headers, timeout=30,
+                )
+                if merge_resp.status_code == 200:
+                    sha = merge_resp.json().get("sha", "")[:8]
+                    logger.info("Boss merge_pr: merged PR #%d for %s by admin %s", pr_number_in, repo_name, user_id)
+                    return json.dumps({
+                        "status": "merged",
+                        "pr": pr_url,
+                        "pr_number": pr_number_in,
+                        "title": pr_title,
+                        "sha": sha,
+                        "repo": repo_name,
+                        "note": f"PR #{pr_number_in} merged. Branch \'{branch}\' can now be deleted.",
+                    })
+                if merge_resp.status_code in (405, 409):
+                    return json.dumps({
+                        "status": "conflict",
+                        "pr": pr_url,
+                        "error": f"PR #{pr_number_in} has merge conflicts — resolve manually on GitHub.",
+                    })
+                return json.dumps({"status": "error", "pr": pr_url,
+                                   "error": f"GitHub API returned {merge_resp.status_code}: {merge_resp.text[:300]}"})
+
+            # ── Path B: state_store lookup (Sentinel-managed PRs) ─────────────
+            open_prs = store.get_open_prs()
+            candidates = [p for p in open_prs if p.get("repo_name") == repo_name]
+            if fingerprint:
+                candidates = [p for p in candidates if p.get("fingerprint", "").startswith(fingerprint)]
+            if not candidates:
+                return json.dumps({"error": f"No open Sentinel PR found for repo \'{repo_name}\'"
+                                            + (f" with fingerprint \'{fingerprint}\'" if fingerprint else "")})
+            fix = candidates[0]  # most recent
+            pr_url = fix.get("pr_url", "")
+            branch = fix.get("branch", "")
+            fp     = fix.get("fingerprint", "")
+
+            # Parse owner/repo and PR number from pr_url
+            m = _re.search(r"github\\.com/([^/]+/[^/]+)/pull/(\\d+)", pr_url)
+            if not m:
+                return json.dumps({"error": f"Cannot parse PR URL: {pr_url}"})
+            owner_repo = m.group(1)
+            pr_number  = m.group(2)'''
+
+if OLD_MERGE not in boss:
+    print("ERROR: merge_pr old block not found")
+    sys.exit(1)
+
+boss = boss.replace(OLD_MERGE, NEW_MERGE, 1)
+
+with open(BOSS, 'w', encoding='utf-8') as f:
+    f.write(boss)
+print("Fix 1 applied: merge_pr now honours pr_number")
+
+# ── Fix 2: slack_bot — allow file_share subtype in thread replies ─────────────
+
+SLACK = '/home/sentinel/sentinel/code/sentinel/slack_bot.py'
+
+with open(SLACK, 'r', encoding='utf-8') as f:
+    slack = f.read()
+
+OLD_THREAD = '''        # Thread replies in channels — route to Boss without requiring @mention
+        # (so the user can reply "yes" / "go ahead" in a thread without typing @Sentinel)
+        if event.get("thread_ts") and not event.get("subtype"):'''
+
+NEW_THREAD = '''        # Thread replies in channels — route to Boss without requiring @mention
+        # (so the user can reply "yes" / "go ahead" in a thread without typing @Sentinel)
+        # Also handle file_share subtype (image/file attached without text)
+        _subtype = event.get("subtype", "")
+        if event.get("thread_ts") and (not _subtype or _subtype == "file_share"):'''
+
+if OLD_THREAD not in slack:
+    print("ERROR: slack_bot thread handler not found")
+    sys.exit(1)
+
+slack = slack.replace(OLD_THREAD, NEW_THREAD, 1)
+
+# Also ensure empty text with files still gets dispatched (set fallback text)
+OLD_DISPATCH = '''    await _run_turn(session, text, client, cfg_loader, store, attachments=attachments, is_admin=is_admin)'''
+NEW_DISPATCH = '''    # If message has only a file and no text, use a placeholder so Claude processes the attachment
+    if not text.strip() and attachments:
+        text = "(see attached file)"
+    await _run_turn(session, text, client, cfg_loader, store, attachments=attachments, is_admin=is_admin)'''
+
+if OLD_DISPATCH not in slack:
+    print("ERROR: _run_turn dispatch line not found")
+    sys.exit(1)
+
+slack = slack.replace(OLD_DISPATCH, NEW_DISPATCH, 1)
+
+with open(SLACK, 'w', encoding='utf-8') as f:
+    f.write(slack)
+print("Fix 2 applied: file_share subtype now accepted in thread replies")
+
+# ── Syntax check both files ───────────────────────────────────────────────────
+for path in (BOSS, SLACK):
+    with open(path, 'r', encoding='utf-8') as f:
+        src = f.read()
+    try:
+        ast.parse(src)
+        print(f"Syntax OK: {path.split('/')[-1]}")
+    except SyntaxError as e:
+        lines = src.splitlines()
+        print(f"SyntaxError in {path.split('/')[-1]} at line {e.lineno}: {e.msg}")
+        for i in range(max(0, e.lineno-4), min(len(lines), e.lineno+3)):
+            print(f"  {i+1}: {lines[i]}")
+        sys.exit(1)
+
+print("All done.")

package/python/scripts/patch_chain_release.py

@@ -0,0 +1,236 @@
+#!/usr/bin/env python3
+"""Patch sentinel_boss.py to add chain_release tool."""
+import sys
+
+TARGET = '/home/sentinel/sentinel/code/sentinel/sentinel_boss.py'
+
+with open(TARGET, 'r', encoding='utf-8') as f:
+    content = f.read()
+
+# ── 1. Add tool definition (before the closing ] of the tools list) ──────────
+
+TOOL_DEF = '''    {
+        "name": "chain_release",
+        "description": (
+            "Execute a sequential release chain: release repo A, update repo B's dependency on A and release B, "
+            "update repo C's dependency on B and release C, and so on. "
+            "Use when the admin describes a multi-step release pipeline like "
+            "'release TypeLib, then update Java-SDK with new TypeLib and release it, then update Admin-SDK...'. "
+            "Also handles shorter requests like 'release TypeLib and cascade' by inferring the full chain. "
+            "confirmed=false shows the full plan with version numbers; confirmed=true executes all steps in order."
+        ),
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "chain": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": (
+                        "Ordered list of repo names from first-to-release to last. "
+                        "E.g. ['Whydah-TypeLib', 'Whydah-Java-SDK', 'Whydah-Admin-SDK', '1881-SSOLoginWebApp']"
+                    ),
+                },
+                "confirmed": {
+                    "type": "boolean",
+                    "description": "false = show plan only (default); true = execute all steps in sequence",
+                },
+            },
+            "required": ["chain", "confirmed"],
+        },
+    },
+]'''
+
+OLD_CLOSE = '''    },
+]
+
+
+# ── Workspace helpers'''
+
+NEW_CLOSE = TOOL_DEF + '''
+
+
+# ── Workspace helpers'''
+
+if OLD_CLOSE not in content:
+    print("ERROR: tools list closing marker not found")
+    sys.exit(1)
+
+content = content.replace(OLD_CLOSE, NEW_CLOSE, 1)
+
+# ── 2. Add chain_release to _ADMIN_TOOLS ─────────────────────────────────────
+
+OLD_ADMIN = '"manage_release"}'
+NEW_ADMIN = '"manage_release", "chain_release"}'
+if OLD_ADMIN not in content:
+    print("ERROR: _ADMIN_TOOLS not found")
+    sys.exit(1)
+content = content.replace(OLD_ADMIN, NEW_ADMIN, 1)
+
+# ── 3. Add handler (before final "unknown tool" fallback) ────────────────────
+
+HANDLER = '''    if name == "chain_release":
+        from .dependency_manager import get_artifact_id, get_release_version, update_dependency
+        from .git_manager import commit_file_change, push_dep_update
+        from .cicd_trigger import _trigger_jenkins_release
+        from .notify import slack_alert
+
+        chain_repos = inputs.get("chain", [])
+        confirmed   = bool(inputs.get("confirmed", False))
+
+        if not chain_repos or len(chain_repos) < 2:
+            return json.dumps({"error": "chain must contain at least 2 repos"})
+
+        # Resolve repo configs (fuzzy match)
+        resolved = []
+        for rname in chain_repos:
+            repo = cfg_loader.repos.get(rname)
+            if not repo:
+                for k, v in cfg_loader.repos.items():
+                    if rname.lower() in k.lower():
+                        repo = v
+                        rname = k
+                        break
+            if not repo:
+                return json.dumps({"error": f"Repo not found: {rname}. Known: {list(cfg_loader.repos.keys())}"})
+            resolved.append(repo)
+
+        # Gather artifact IDs and release versions for each repo
+        steps = []
+        for repo in resolved:
+            artifact_id  = get_artifact_id(repo.local_path)  if repo.local_path else ""
+            release_ver  = get_release_version(repo.local_path) if repo.local_path else ""
+            steps.append({
+                "repo":            repo.repo_name,
+                "artifact_id":     artifact_id,
+                "release_version": release_ver,
+                "cicd_url":        repo.cicd_job_url,
+                "auto_publish":    repo.auto_publish,
+            })
+
+        # ── Plan phase ───────────────────────────────────────────────────────
+        if not confirmed:
+            plan_steps = []
+            for i, step in enumerate(steps):
+                if i == 0:
+                    desc = f"Release {step['repo']} v{step['release_version']}"
+                else:
+                    prev = steps[i - 1]
+                    desc = (
+                        f"Update {step['repo']} dep on {prev['artifact_id']} "
+                        f"→ {prev['release_version']}, then release v{step['release_version']}"
+                    )
+                plan_steps.append({
+                    "step":            i + 1,
+                    "action":          desc,
+                    "repo":            step["repo"],
+                    "release_version": step["release_version"],
+                    "jenkins_url":     step["cicd_url"],
+                    "mode":            "push to main" if step["auto_publish"] else "open PR",
+                })
+            return json.dumps({
+                "plan":           f"Sequential release chain: {' → '.join(s['repo'] for s in steps)}",
+                "steps":          plan_steps,
+                "confirm_prompt": "Reply with confirmed=true to execute all steps in sequence.",
+            })
+
+        # ── Execute phase ─────────────────────────────────────────────────────
+        cfg = cfg_loader.sentinel
+        slack_alert(
+            cfg.slack_bot_token, cfg.slack_channel,
+            f":chains: *Chain release started* ({len(steps)} steps)\\n"
+            + " \\u2192 ".join(s["repo"] for s in steps),
+        )
+
+        results = []
+        for i, (step, repo) in enumerate(zip(steps, resolved)):
+            step_label = f"Step {i + 1}/{len(steps)}"
+
+            # Update dependency on previous repo's artifact
+            if i > 0:
+                prev = steps[i - 1]
+                if not prev["artifact_id"] or not prev["release_version"]:
+                    msg = f"{step_label}: skipped — could not read artifact/version from {prev['repo']}"
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "skipped", "error": msg})
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel, f":warning: {msg}")
+                    break
+                changed = update_dependency(repo.local_path, prev["artifact_id"], prev["release_version"])
+                if changed:
+                    commit_msg = (
+                        f"chore(deps): update {prev['artifact_id']} to {prev['release_version']} [sentinel-chain]\\n\\n"
+                        f"Part of release chain: {' -> '.join(s['repo'] for s in steps)}"
+                    )
+                    status, commit_hash = commit_file_change(repo, ["pom.xml"], commit_msg)
+                    if status != "committed":
+                        msg = f"{step_label}: git commit failed for {repo.repo_name}"
+                        results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                        slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                    f":x: *Chain release failed at {step_label}*\\n{msg}")
+                        break
+                    branch, pr_url = push_dep_update(repo, cfg, prev["artifact_id"], prev["release_version"], commit_hash)
+                    action = f"<{pr_url}|PR opened>" if pr_url else f"pushed to `{branch}`"
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":arrow_right: {step_label}: Updated `{repo.repo_name}` "
+                                f"`{prev['artifact_id']}` \\u2192 `{prev['release_version']}` ({action})")
+                else:
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":information_source: {step_label}: `{repo.repo_name}` dep already at "
+                                f"`{prev['release_version']}` — skipping pom.xml update")
+
+            # Trigger Jenkins release
+            if repo.cicd_job_url and repo.cicd_type:
+                success = _trigger_jenkins_release(repo)
+                if success:
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":rocket: {step_label}: Jenkins release triggered — "
+                                f"`{repo.repo_name}` v{step['release_version']}")
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "released",
+                                    "version": step["release_version"]})
+                else:
+                    msg = f"Jenkins release trigger failed for {repo.repo_name}"
+                    results.append({"step": i + 1, "repo": step["repo"], "status": "failed", "error": msg})
+                    slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                                f":x: *Chain release failed at {step_label}*\\n{msg}")
+                    break
+            else:
+                slack_alert(cfg.slack_bot_token, cfg.slack_channel,
+                            f":information_source: {step_label}: `{repo.repo_name}` has no CI/CD — "
+                            f"pom.xml updated but Jenkins not triggered")
+                results.append({"step": i + 1, "repo": step["repo"], "status": "no_cicd",
+                                "note": "pom.xml updated, no Jenkins trigger configured"})
+
+        all_ok = all(r.get("status") in ("released", "no_cicd") for r in results)
+        final  = "completed" if all_ok else "partial" if results else "failed"
+        slack_alert(
+            cfg.slack_bot_token, cfg.slack_channel,
+            f":{'white_check_mark' if all_ok else 'warning'}: *Chain release {final}* \\u2014 "
+            + ", ".join(
+                f"`{r['repo']}` {'\\u2713' if r.get('status') in ('released', 'no_cicd') else '\\u2717'}"
+                for r in results
+            ),
+        )
+        logger.info("Boss chain_release: %s by %s — %s", final, user_id, results)
+        return json.dumps({"status": final, "steps": results})
+
+'''
+
+OLD_FALLBACK = '    return json.dumps({"error": f"unknown tool: {name}"})'
+if OLD_FALLBACK not in content:
+    print("ERROR: unknown tool fallback not found")
+    sys.exit(1)
+content = content.replace(OLD_FALLBACK, HANDLER + OLD_FALLBACK, 1)
+
+with open(TARGET, 'w', encoding='utf-8') as f:
+    f.write(content)
+
+print("Patch applied successfully.")
+
+# Verify
+import ast, py_compile, tempfile, os
+with tempfile.NamedTemporaryFile(suffix='.py', delete=False, mode='w') as tmp:
+    tmp.write(content)
+    tmp_name = tmp.name
+try:
+    py_compile.compile(tmp_name, doraise=True)
+    print("Syntax OK")
+finally:
+    os.unlink(tmp_name)

package/python/sentinel/cicd_trigger.py

@@ -7,6 +7,7 @@ triggered by the normal GitHub merge webhook.
 
 import logging
 import re
+import time
 from pathlib import Path
 
 import requests
@@ -16,8 +17,12 @@ from .state_store import StateStore
 
 logger = logging.getLogger(__name__)
 
+# How long to wait for a Jenkins release build to complete (chain releases can be slow)
+JENKINS_RELEASE_TIMEOUT = 900   # 15 minutes
+JENKINS_POLL_INTERVAL   = 20    # seconds between polls
 
-def trigger(repo: RepoConfig, store: StateStore, fingerprint: str) -> bool:
+
+def trigger(repo: RepoConfig, store: StateStore, fingerprint: str, wait: bool = False) -> bool:
     if not repo.cicd_type or not repo.cicd_job_url:
         return True
 
@@ -25,7 +30,7 @@ def trigger(repo: RepoConfig, store: StateStore, fingerprint: str) -> bool:
     if cicd_type == "jenkins":
         return _trigger_jenkins(repo)
     elif cicd_type in ("jenkins_release", "jenkins-release"):
-        return _trigger_jenkins_release(repo)
+        return _trigger_jenkins_release(repo, wait=wait)
     elif cicd_type in ("github_actions", "github-actions"):
         return _trigger_github_actions(repo, fingerprint)
     else:
@@ -44,29 +49,133 @@ def _trigger_jenkins(repo: RepoConfig) -> bool:
     return success
 
 
-def _trigger_jenkins_release(repo: RepoConfig) -> bool:
-    # Maven Release Plugin — POST to /m2release/submit with release + dev versions
+def _get_last_build_number(session: requests.Session, job_url: str) -> int:
+    """Return the current lastBuild number for a Jenkins job, or 0 if none."""
+    try:
+        r = session.get(f"{job_url.rstrip('/')}/api/json", timeout=10)
+        data = r.json()
+        lb = data.get("lastBuild")
+        return lb["number"] if lb else 0
+    except Exception as exc:
+        logger.warning("Could not get last build number for %s: %s", job_url, exc)
+        return 0
+
+
+def _wait_for_jenkins_build(
+    session: requests.Session,
+    job_url: str,
+    prev_build_num: int,
+    timeout: int = JENKINS_RELEASE_TIMEOUT,
+) -> bool:
+    """
+    Poll until a new build appears and completes. Returns True on SUCCESS.
+    Logs progress every poll cycle.
+    """
+    deadline = time.time() + timeout
+    build_num = None
+
+    # Phase 1: wait for a new build to appear
+    while time.time() < deadline:
+        current = _get_last_build_number(session, job_url)
+        if current > prev_build_num:
+            build_num = current
+            logger.info("Jenkins build #%d started for %s", build_num, job_url)
+            break
+        logger.debug("Waiting for Jenkins build to start (last=%d)...", current)
+        time.sleep(JENKINS_POLL_INTERVAL)
+    else:
+        logger.error("Timed out waiting for Jenkins build to start: %s", job_url)
+        return False
+
+    # Phase 2: poll until build completes
+    build_api = f"{job_url.rstrip('/')}/{build_num}/api/json"
+    while time.time() < deadline:
+        try:
+            r = session.get(build_api, timeout=10)
+            data = r.json()
+            if not data.get("building", True):
+                result = data.get("result", "UNKNOWN")
+                if result == "SUCCESS":
+                    logger.info("Jenkins build #%d SUCCESS: %s", build_num, job_url)
+                    return True
+                else:
+                    logger.error("Jenkins build #%d %s: %s", build_num, result, job_url)
+                    return False
+            elapsed = int(time.time() - (deadline - timeout))
+            logger.info("Jenkins build #%d still running (%ds elapsed)...", build_num, elapsed)
+        except Exception as exc:
+            logger.warning("Jenkins poll error for %s: %s", build_api, exc)
+        time.sleep(JENKINS_POLL_INTERVAL)
+
+    logger.error("Timed out waiting for Jenkins build #%d to complete: %s", build_num, job_url)
+    return False
+
+
+def _trigger_jenkins_release(repo: RepoConfig, wait: bool = False) -> bool:
+    # Maven Release Plugin — POST to /m2release/submit
+    # Jenkins/Stapler requires a `json` parameter containing the form data or it returns 400.
     release_ver, dev_ver = _maven_release_versions(repo.local_path)
+    if not release_ver:
+        logger.error("Jenkins release: could not determine release version from pom.xml")
+        return False
     url = f"{repo.cicd_job_url.rstrip('/')}/m2release/submit"
-    resp = requests.post(
+    auth = (repo.cicd_user or "sentinel", repo.cicd_token)
+
+    # Fetch crumb (CSRF token) using a session so the cookie is preserved
+    session = requests.Session()
+    session.auth = auth
+    from urllib.parse import urlparse
+    parsed = urlparse(repo.cicd_job_url)
+    jenkins_root = f"{parsed.scheme}://{parsed.netloc}"
+    crumb_data = session.get(f"{jenkins_root}/crumbIssuer/api/json", timeout=10).json()
+    crumb_header = {crumb_data["crumbRequestField"]: crumb_data["crumb"]}
+
+    # Record current last build number before triggering
+    prev_build_num = _get_last_build_number(session, repo.cicd_job_url) if wait else 0
+
+    scm_tag = f"{repo.repo_name}-{release_ver}"
+    import json as _json
+    stapler_json = _json.dumps({
+        "releaseVersion":        release_ver,
+        "developmentVersion":    dev_ver,
+        "isDryRun":              False,
+        "specifyScmCredentials": False,
+        "scmUsername":           "",
+        "scmCommentPrefix":      "[maven-release-plugin] ",
+        "appendHudsonUserName":  False,
+        "specifyScmTag":         False,
+        "scmTag":                scm_tag,
+    })
+    resp = session.post(
         url,
-        auth=(repo.cicd_user or "sentinel", repo.cicd_token),
+        headers={
+            **crumb_header,
+            "Referer": f"{repo.cicd_job_url.rstrip('/')}/m2release/",
+        },
         data={
-            "releaseVersion": release_ver,
+            "releaseVersion":     release_ver,
             "developmentVersion": dev_ver,
-            "isDryRun": "false",
-            "specifyScmCredentials": "false",
-            "specifyCustomScmCommentPrefix": "false",
-            "specifyCustomScmTag": "false",
+            "scmCommentPrefix":   "[maven-release-plugin] ",
+            "scmTag":             scm_tag,
+            "json":               stapler_json,
         },
         timeout=15,
+        allow_redirects=False,
     )
-    success = resp.status_code in (200, 201, 204)
-    if success:
-        logger.info("Jenkins Maven Release triggered: %s → %s (next: %s)", repo.cicd_job_url, release_ver, dev_ver)
-    else:
+    triggered = resp.status_code in (200, 201, 204, 302)
+    if not triggered:
         logger.error("Jenkins release trigger failed (%s): %s", resp.status_code, resp.text[:200])
-    return success
+        return False
+
+    logger.info(
+        "Jenkins Maven Release triggered: %s → %s (next: %s)%s",
+        repo.cicd_job_url, release_ver, dev_ver,
+        " — waiting for completion..." if wait else "",
+    )
+
+    if wait:
+        return _wait_for_jenkins_build(session, repo.cicd_job_url, prev_build_num)
+    return True
 
 
 def _maven_release_versions(local_path: str) -> tuple[str, str]: