@openhands/extensions 0.23.0 → 0.25.0

package/skills/github-pr-reviewer/tests/test_main.py

@@ -538,6 +538,75 @@ class TestRepoReviewGuide(unittest.TestCase):
         self.assertIn("Do not add speculative or out-of-scope notes", prompt)
         self.assertIn("forbids the configured bot from approving its own PR", prompt)
 
+    def test_prompt_requires_refreshing_mutable_github_state(self):
+        """A resumed conversation must not trust an earlier turn's observations."""
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            self._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+        )
+
+        assert "CURRENT STATE" in prompt
+        for surface in (
+            "still matches the Head SHA",
+            "current PR title and body",
+            "current review comments and threads",
+            "current review requests",
+            "GitHub Actions check results",
+            "body and labels of every linked issue",
+        ):
+            self.assertIn(surface, prompt)
+        # The readiness case from the report: a linked issue gaining a label.
+        self.assertIn("ready-for-dev", prompt)
+
+    def test_prompt_forbids_repeating_an_earlier_observation(self):
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            self._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+        )
+
+        self.assertIn("fresh review", prompt)
+        self.assertIn("re-established now", prompt)
+        self.assertIn(
+            "never repeat an earlier finding, verdict, or "
+            "label/priority claim",
+            prompt,
+        )
+
+    def test_prompt_refreshes_state_before_the_scope_gate_and_keeps_analysis(self):
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            self._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+        )
+
+        # The refresh precedes the verdict-shaping steps, while the repository
+        # analysis the conversation already did stays part of the workflow.
+        self.assertLess(prompt.index("CURRENT STATE"), prompt.index("SCOPE GATE"))
+        self.assertLess(prompt.index("CURRENT STATE"), prompt.index("MUST read"))
+        self.assertIn("useful background", prompt)
+        self.assertIn("AGENTS.md", prompt)
+
+    def test_prompt_scope_gate_stops_before_the_technical_review(self):
+        prompt = main._build_review_prompt(
+            "owner/repo",
+            self._pr(),
+            "0123456789abcdef",
+            {"id": "1", "created_at": "t"},
+        )
+
+        gate = prompt.index("SCOPE GATE")
+        self.assertLess(gate, prompt.index("Inspect the PR discussion"))
+        self.assertLess(gate, prompt.index("Ground every finding"))
+        self.assertIn("before inspecting changed files, reading the diff, or running", prompt)
+        self.assertIn("scope categories and ownership boundaries", prompt)
+        self.assertIn("continue the technical review unchanged", prompt)
+        self.assertIn("move repositories, close, or receive a maintainer decision", prompt)
+
 
 class TestNormalizeRepo(unittest.TestCase):
     """A repository is written down in more than one way, and every API path in

package/skills/github-repo-monitor/scripts/github_client.py

@@ -165,6 +165,122 @@ class GitHubRepository:
             result.setdefault(item["context"], item["state"])
         return result
 
+    def check_runs(self, sha):
+        """Return every check run GitHub reported for one commit SHA.
+
+        Reading check runs needs no branch-protection or ruleset access, so this
+        is the head-eligibility signal the automation's own token can always
+        see. The endpoint answers with an object rather than a list, so it
+        paginates through ``gh`` instead of ``gh_pages``.
+        """
+        runs = []
+        for page in range(1, 101):
+            data = self.gh(
+                "GET", f"/commits/{sha}/check-runs?per_page=100&page={page}"
+            )
+            batch = data.get("check_runs") or []
+            runs.extend(batch)
+            if len(runs) >= int(data.get("total_count") or 0) or not batch:
+                return runs
+        raise RuntimeError("GitHub check-run pagination exceeded limit")
+
+    def required_check_contexts(self, number):
+        """Return the status contexts GitHub marks required on one pull request.
+
+        `isRequired` is the merge-policy source of truth and is PR-scoped, so it
+        is correct for a stacked PR whose symbolic base branch carries no branch
+        rules of its own. It is a field on each context in the head's status
+        check rollup and takes the pull request number, so a single GraphQL query
+        answers with the required check runs and any required commit statuses,
+        each already attributed to the exact head. Only contexts GitHub itself
+        reports as required are returned, so an optional workflow that fails
+        before creating any check run is not present.
+        """
+        owner, name = self.repository.split("/", 1)
+        query = (
+            "query($owner:String!,$name:String!,$number:Int!){"
+            "repository(owner:$owner,name:$name){"
+            "pullRequest(number:$number){"
+            "commits(last:1){"
+            "nodes{"
+            "commit{"
+            "statusCheckRollup{"
+            "contexts(first:100){"
+            "pageInfo{hasNextPage}"
+            "nodes{"
+            "__typename"
+            " ... on CheckRun{name isRequired(pullRequestNumber:$number)}"
+            " ... on StatusContext{context isRequired(pullRequestNumber:$number)}"
+            "}"
+            "}"
+            "}"
+            "}"
+            "}"
+            "}"
+            "}"
+            "}"
+            "}"
+        )
+        data = self.api(
+            "POST",
+            "/graphql",
+            body={
+                "query": query,
+                "variables": {"owner": owner, "name": name, "number": number},
+            },
+        )
+        if data.get("errors"):
+            raise RuntimeError(
+                f"GitHub required-check query failed: {data['errors'][0].get('message')}"
+            )
+        nodes = (
+            (((data.get("data") or {}).get("repository") or {}).get("pullRequest") or {})
+            .get("commits", {})
+            .get("nodes")
+        ) or []
+        contexts = (
+            ((nodes[0].get("commit") or {}).get("statusCheckRollup") or {}).get(
+                "contexts", {}
+            )
+            if nodes
+            else {}
+        )
+        if (contexts.get("pageInfo") or {}).get("hasNextPage"):
+            raise RuntimeError(
+                "GitHub required-check rollup exceeds one page; the required "
+                "set may be incomplete"
+            )
+        return [
+            {
+                "name": node.get("name") or node.get("context"),
+                "kind": node.get("__typename"),
+            }
+            for node in (contexts.get("nodes") or [])
+            if node.get("isRequired") and (node.get("name") or node.get("context"))
+        ]
+
+    def workflow_runs(self, sha):
+        """Return every Actions workflow run GitHub reported for one commit SHA.
+
+        A workflow that fails before any job starts - a workflow-level error, or
+        a `pull_request` run whose jobs never materialize - still records a
+        failed check suite, but it contributes no check runs, so the commit's
+        check-run rollup and `gh pr checks` both report success. Reading the
+        workflow runs directly is the only way the gate can see that failure.
+        Like the check-run endpoint this answers with an object, so it paginates
+        manually.
+        """
+        runs = []
+        for page in range(1, 101):
+            data = self.gh(
+                "GET", f"/actions/runs?head_sha={sha}&per_page=100&page={page}"
+            )
+            batch = data.get("workflow_runs") or []
+            runs.extend(batch)
+            if len(runs) >= int(data.get("total_count") or 0) or not batch:
+                return runs
+        raise RuntimeError("GitHub workflow-run pagination exceeded limit")
+
     def completed_dependency(self, number):
         if number in self._completed_dependencies:
             return self._completed_dependencies[number]

package/skills/github-repo-monitor/scripts/main.py

@@ -33,6 +33,7 @@ from pathlib import Path
 import time
 import urllib.error
 import urllib.request
+from urllib.parse import quote
 from datetime import datetime, timedelta, timezone
 
 from github_client import github_request as _github_request
@@ -394,11 +395,41 @@ def _fetch_settings(agent_url: str, api_key: str) -> dict:
         raise RuntimeError(f"GET /api/settings failed: {exc.code}") from exc
 
 
+def _fetch_profile_llm(agent_url: str, api_key: str, profile: str) -> dict | None:
+    """Fetch one LLM profile's config, or None when it no longer exists.
+
+    Uses X-Expose-Secrets: plaintext so the config carries a real api_key,
+    mirroring _fetch_settings. Only 404 falls back; other errors raise.
+    """
+    req = urllib.request.Request(
+        f"{agent_url}/api/profiles/{quote(profile, safe='')}",
+        headers={"X-Session-API-Key": api_key, "X-Expose-Secrets": "plaintext"},
+    )
+    try:
+        with urllib.request.urlopen(req) as r:
+            return json.loads(r.read())["config"]
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            print(f"profile {profile!r} not found; falling back to active profile")
+            return None
+        raise
+
+
 def _get_agent_dict(agent_url: str, api_key: str) -> dict:
-    """Fetch configured agent settings for conversation creation."""
+    """Fetch configured agent settings for conversation creation.
+
+    When AUTOMATION_MODEL names an LLM profile, resolve that profile instead
+    of the active one so the automation runs on its configured model.
+    """
     data = _fetch_settings(agent_url, api_key)
     agent_settings = data.get("agent_settings", {})
     llm = agent_settings.get("llm", {})
+    profile = os.environ.get("AUTOMATION_MODEL")
+    if profile:
+        profile_llm = _fetch_profile_llm(agent_url, api_key, profile)
+        if profile_llm is not None:
+            llm = profile_llm
+            llm["usage_id"] = f"profile:{profile}"
     # settings["agent_settings"]["agent"] reflects the full-app agent registry
     # (e.g. "CodeActAgent", "BrowsingAgent").  The automation SDK is a separate
     # runtime whose only valid kind is "Agent" — never forward that value.

package/skills/github-stale-ci-pr-closer/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "github-stale-ci-pr-closer",
+  "version": "1.0.0",
+  "description": "Warn and close abandoned pull requests whose required CI remains failing.",
+  "author": {
+    "name": "OpenHands"
+  },
+  "license": "MIT"
+}

package/skills/github-stale-ci-pr-closer/.codex-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "github-stale-ci-pr-closer",
+  "version": "1.0.0",
+  "description": "Warn and close abandoned pull requests whose required CI remains failing.",
+  "author": {
+    "name": "OpenHands"
+  },
+  "license": "MIT"
+}

package/skills/github-stale-ci-pr-closer/.plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "github-stale-ci-pr-closer",
+  "version": "1.0.0",
+  "description": "Warn and close abandoned pull requests whose required CI remains failing.",
+  "author": {
+    "name": "OpenHands"
+  },
+  "license": "MIT"
+}

package/skills/github-stale-ci-pr-closer/README.md

@@ -0,0 +1,9 @@
+# GitHub stale CI pull request closer
+
+This extension runs a deterministic scheduled maintenance pass over configured
+GitHub repositories. It warns after seven days of continuously failing required
+CI and closes after another seven days without author follow-up. Optional checks
+do not affect the decision, and no LLM slot is used.
+
+Conversation and review automation state are unaffected. Warning and closure
+comments carry stable markers so retries remain idempotent.

package/skills/github-stale-ci-pr-closer/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: github-stale-ci-pr-closer
+description: Warn and close abandoned pull requests whose required CI remains failing.
+triggers:
+- /github-stale-ci-pr-closer
+---
+
+# GitHub stale CI pull request closer
+
+This deterministic scheduled automation scans every open, non-draft pull
+request in its configured repositories. It reads the required status checks
+from the GitHub rules that apply to the pull request's base branch.
+
+- After required CI remains failing for seven days, it posts one marked warning.
+- After seven more days, it closes the pull request only when required CI still
+  fails and the author has neither pushed nor commented since the warning.
+- Passing or pending CI, a draft conversion, closure, merge, or author follow-up
+  cancels the pending close. Continued failure starts a fresh warning window.
+
+The automation creates no agent or conversation. Configure a repository-scoped
+fine-grained PAT with Metadata: Read, Actions: Read, Commit statuses: Read,
+Issues: Read and Write, and Pull requests: Read and Write. The token also needs
+read access to repository rules. Package `scripts/worker.py` as `worker.py` and
+the shared `skills/github/scripts/github_client.py` as `github_client.py`.

package/skills/github-stale-ci-pr-closer/commands/github-stale-ci-pr-closer.md

@@ -0,0 +1,8 @@
+---
+# auto-generated by sync_extensions.py
+description: Warn and close abandoned pull requests whose required CI remains failing.
+---
+
+Read and follow the complete instructions in the SKILL.md file located in this skill's directory.
+
+$ARGUMENTS

package/skills/github-stale-ci-pr-closer/scripts/worker.py

@@ -0,0 +1,335 @@
+"""Warn and close abandoned pull requests with persistently failing required CI."""
+
+import json
+import os
+import time
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+from urllib.error import HTTPError
+from urllib.parse import quote
+from urllib.request import Request, urlopen
+
+from github_client import GitHubRepository, run_repositories
+
+WARN_AFTER_SECONDS = 7 * 24 * 60 * 60
+CLOSE_AFTER_SECONDS = 7 * 24 * 60 * 60
+WARNING_MARKER = "<!-- openhands-stale-ci-warning -->"
+CLOSE_MARKER = "<!-- openhands-stale-ci-close -->"
+PASSING_CONCLUSIONS = {"success", "neutral", "skipped"}
+KV_TOKEN = os.environ.get("AUTOMATION_KV_TOKEN", "")
+KV_BASE = os.environ.get("AUTOMATION_API_URL", "").rstrip("/")
+
+
+def _timestamp(value):
+    return datetime.fromisoformat(value).timestamp()
+
+
+def _state_key(repo):
+    payload = json.loads(os.environ.get("AUTOMATION_EVENT_PAYLOAD", "{}"))
+    automation_id = payload.get("automation_id", "default")
+    return f"github-stale-ci-pr-closer:{automation_id}:{repo.replace('/', '__')}"
+
+
+def _state_path(repo):
+    workspace = Path(
+        os.environ.get("WORKSPACE_BASE", Path.home() / ".openhands/workspaces")
+    )
+    root = (
+        workspace.resolve().parent.parent
+        if os.environ.get("WORKSPACE_BASE")
+        else workspace
+    )
+    directory = root / "automation-state"
+    directory.mkdir(parents=True, exist_ok=True)
+    return directory / (_state_key(repo) + ".json")
+
+
+def _kv_request(key, method, value=None):
+    if not KV_TOKEN or not KV_BASE:
+        return None
+    data = json.dumps({"value": value}).encode() if value is not None else None
+    request = Request(
+        f"{KV_BASE}/v1/kv/{quote(key, safe='')}",
+        data=data,
+        method=method,
+        headers={
+            "Authorization": f"Bearer {KV_TOKEN}",
+            "Content-Type": "application/json",
+        },
+    )
+    try:
+        with urlopen(request) as response:
+            payload = json.loads(response.read() or b"{}")
+            return payload.get("value")
+    except HTTPError as exc:
+        if method == "GET" and exc.code == 404:
+            return None
+        raise
+
+
+def load_state(repo):
+    if KV_TOKEN and KV_BASE:
+        return _kv_request(_state_key(repo), "GET") or {"version": 1, "prs": {}}
+    path = _state_path(repo)
+    if not path.exists():
+        return {"version": 1, "prs": {}}
+    return json.loads(path.read_text())
+
+
+def save_state(repo, state):
+    state["version"] = 1
+    if KV_TOKEN and KV_BASE:
+        _kv_request(_state_key(repo), "PUT", state)
+        return
+    path = _state_path(repo)
+    temporary = path.with_suffix(".tmp")
+    temporary.write_text(json.dumps(state, indent=2, sort_keys=True) + "\n")
+    os.replace(temporary, path)
+
+
+def complete_run(status="COMPLETED", error=None):
+    """Report this detached entrypoint's terminal state to Automations."""
+    url = os.environ.get("AUTOMATION_CALLBACK_URL")
+    if not url:
+        return
+    body = {"status": status, "run_id": os.environ.get("AUTOMATION_RUN_ID", "")}
+    if error:
+        body["error"] = error
+    request = Request(
+        url,
+        data=json.dumps(body).encode(),
+        headers={
+            "Authorization": "Bearer "
+            + os.environ.get("AUTOMATION_CALLBACK_API_KEY", ""),
+            "Content-Type": "application/json",
+        },
+    )
+    with urlopen(request):
+        pass
+
+
+class StaleCIPullRequestCloser(GitHubRepository):
+    name = "github-stale-ci-pr-closer"
+
+    def required_checks(self, branch):
+        cached = getattr(self, "_required_checks", {})
+        if branch in cached:
+            return cached[branch]
+        try:
+            rules = self.gh("GET", f"/rules/branches/{quote(branch, safe='')}")
+        except HTTPError as exc:
+            if exc.code == 404:
+                return []
+            raise
+        required = []
+        for rule in rules:
+            if rule.get("type") != "required_status_checks":
+                continue
+            required.extend(
+                rule.get("parameters", {}).get("required_status_checks", [])
+            )
+        cached[branch] = required
+        self._required_checks = cached
+        return required
+
+    def required_ci_state(self, sha, required):
+        if not required:
+            return "unconfigured"
+        runs = []
+        for page in range(1, 11):
+            batch = self.gh(
+                "GET", f"/commits/{sha}/check-runs?per_page=100&page={page}"
+            )
+            page_runs = batch.get("check_runs", [])
+            runs.extend(page_runs)
+            if len(page_runs) < 100:
+                break
+        else:
+            raise RuntimeError(f"More than 1,000 check runs found for {sha}")
+        latest_runs = {}
+        for run in sorted(runs, key=lambda item: item.get("id", 0), reverse=True):
+            latest_runs.setdefault(
+                (run.get("name"), (run.get("app") or {}).get("id")), run
+            )
+        statuses = {}
+        for status in self.gh_pages(f"/commits/{sha}/statuses"):
+            statuses.setdefault(status.get("context"), status)
+
+        states = []
+        for item in required:
+            context = item["context"]
+            integration = item.get("integration_id") or None
+            run = latest_runs.get((context, integration))
+            if run is None and integration is None:
+                matches = [
+                    value for (name, _), value in latest_runs.items() if name == context
+                ]
+                run = max(matches, key=lambda value: value.get("id", 0), default=None)
+            if run is not None:
+                if run.get("status") != "completed" or run.get("conclusion") is None:
+                    states.append("pending")
+                elif run.get("conclusion") in PASSING_CONCLUSIONS:
+                    states.append("passing")
+                else:
+                    states.append("failing")
+                continue
+            status = statuses.get(context) if integration is None else None
+            if status is None or status.get("state") in {"pending", "expected"}:
+                states.append("pending")
+            elif status.get("state") == "success":
+                states.append("passing")
+            else:
+                states.append("failing")
+        if "pending" in states:
+            return "pending"
+        if "failing" in states:
+            return "failing"
+        return "passing"
+
+    def comments(self, number):
+        return self.gh_pages(f"/issues/{number}/comments")
+
+    def stale_failure_numbers(self, now):
+        cutoff = (datetime.fromtimestamp(now, UTC) - timedelta(days=7)).date()
+        query = (
+            f"repo:{self.repository} is:pr is:open draft:false status:failure "
+            f"updated:<{cutoff.isoformat()}"
+        )
+        numbers = set()
+        for page in range(1, 11):
+            result = self.api(
+                "GET",
+                "/search/issues",
+                params={"q": query, "per_page": 100, "page": page},
+            )
+            if result.get("incomplete_results"):
+                raise RuntimeError("GitHub returned incomplete stale CI search results")
+            items = result.get("items", [])
+            numbers.update(item["number"] for item in items)
+            if len(items) < 100:
+                return numbers
+        raise RuntimeError("GitHub stale CI search exceeded 1,000 pull requests")
+
+    def post_comment(self, number, body):
+        return self.gh("POST", f"/issues/{number}/comments", {"body": body})
+
+    @staticmethod
+    def author_followed_up(pr, comments, after):
+        author = (pr.get("user") or {}).get("login", "").lower()
+        return any(
+            (comment.get("user") or {}).get("login", "").lower() == author
+            and _timestamp(comment["created_at"]) > after
+            for comment in comments
+        )
+
+    def reconcile(self, pr, records, now):
+        number = pr["number"]
+        key = str(number)
+        if pr.get("draft"):
+            records.pop(key, None)
+            return "draft"
+        head = pr["head"]["sha"]
+        required = self.required_checks(pr["base"]["ref"])
+        ci_state = self.required_ci_state(head, required)
+        if ci_state != "failing":
+            records.pop(key, None)
+            return ci_state
+
+        record = records.get(key)
+        if not record or record.get("head_sha") != head:
+            record = {"head_sha": head, "first_failed_at": now}
+            records[key] = record
+        warning = record.get("warning")
+        if not warning:
+            if now - record["first_failed_at"] < WARN_AFTER_SECONDS:
+                return "observing"
+            comments = self.comments(number)
+            head_marker = f"<!-- openhands-stale-ci-warning head={head} -->"
+            existing = [
+                comment
+                for comment in comments
+                if head_marker in (comment.get("body") or "")
+            ]
+            existing.sort(
+                key=lambda comment: comment.get("created_at", ""), reverse=True
+            )
+            if existing:
+                warning_at = _timestamp(existing[0]["created_at"])
+                if warning_at >= record[
+                    "first_failed_at"
+                ] and not self.author_followed_up(pr, comments, warning_at):
+                    warning = {
+                        "at": warning_at,
+                        "head_sha": head,
+                        "comment_id": existing[0].get("id"),
+                    }
+                    record["warning"] = warning
+            if not warning:
+                comment = self.post_comment(
+                    number,
+                    f"{WARNING_MARKER}\n{head_marker}\nRequired CI has remained failing for "
+                    "seven days. Please repair it or comment with an update. If the author "
+                    "does not push or comment and required CI remains failing for another "
+                    "seven days, this pull request will be closed automatically.",
+                )
+                record["warning"] = {
+                    "at": now,
+                    "head_sha": head,
+                    "comment_id": comment.get("id"),
+                }
+                return "warned"
+
+        comments = self.comments(number)
+        if self.author_followed_up(pr, comments, warning["at"]):
+            records[key] = {"head_sha": head, "first_failed_at": now}
+            return "followed-up"
+        if now - warning["at"] < CLOSE_AFTER_SECONDS:
+            return "waiting"
+
+        if not any(CLOSE_MARKER in (comment.get("body") or "") for comment in comments):
+            self.post_comment(
+                number,
+                f"{CLOSE_MARKER}\nClosing because required CI is still failing seven days "
+                "after the automated warning and the author has not pushed or commented. "
+                "The pull request can be reopened when work resumes.",
+            )
+        self.gh("PATCH", f"/pulls/{number}", {"state": "closed"})
+        records.pop(key, None)
+        return "closed"
+
+    def run(self):
+        state = load_state(self.repository)
+        records = state.setdefault("prs", {})
+        open_prs = self.gh_pages("/pulls?state=open")
+        open_by_number = {pr["number"]: pr for pr in open_prs}
+        open_numbers = {str(number) for number in open_by_number}
+        for key in set(records) - open_numbers:
+            records.pop(key, None)
+        now = time.time()
+        candidates = self.stale_failure_numbers(now)
+        candidates.update(int(number) for number in records)
+        for number in sorted(candidates, reverse=True):
+            pr = open_by_number.get(number)
+            if pr is None:
+                continue
+            outcome = self.reconcile(pr, records, now)
+            print(
+                json.dumps(
+                    {
+                        "repository": self.repository,
+                        "pr": pr["number"],
+                        "outcome": outcome,
+                    }
+                )
+            )
+        save_state(self.repository, state)
+
+
+if __name__ == "__main__":
+    try:
+        run_repositories(StaleCIPullRequestCloser)
+    except Exception as exc:
+        complete_run("FAILED", str(exc))
+        raise
+    else:
+        complete_run()