@openhands/extensions 0.24.0 → 0.26.0

package/tests/test_github_stale_ci_pr_closer.py

@@ -0,0 +1,56 @@
+"""Tests for how the stale-CI pull request closer reports its run."""
+
+import json
+
+import pytest
+from github_automation_helpers import worker
+
+
+@pytest.mark.parametrize(
+    ("environment", "expected"),
+    [
+        pytest.param(
+            {"AUTOMATION_CALLBACK_API_KEY": "callback-key"},
+            "Bearer callback-key",
+            id="local-run-uses-its-callback-key",
+        ),
+        pytest.param(
+            {"OPENHANDS_API_KEY": "openhands-key"},
+            "Bearer openhands-key",
+            id="cloud-run-has-no-callback-key-and-uses-its-api-key",
+        ),
+    ],
+)
+def test_completion_is_reported_with_the_key_the_run_was_given(
+    tmp_path, monkeypatch, environment, expected
+):
+    # Arrange
+    module = worker("github-stale-ci-pr-closer", tmp_path, monkeypatch)
+    for name in ("AUTOMATION_CALLBACK_API_KEY", "OPENHANDS_API_KEY"):
+        monkeypatch.delenv(name, raising=False)
+    for name, value in environment.items():
+        monkeypatch.setenv(name, value)
+    monkeypatch.setenv("AUTOMATION_CALLBACK_URL", "https://automation.test/callback")
+    monkeypatch.setenv("AUTOMATION_RUN_ID", "run-1")
+    sent = []
+
+    class _Response:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+    def urlopen(request):
+        sent.append(request)
+        return _Response()
+
+    monkeypatch.setattr(module, "urlopen", urlopen)
+
+    # Act
+    module.complete_run()
+
+    # Assert
+    [request] = sent
+    assert request.get_header("Authorization") == expected
+    assert json.loads(request.data) == {"status": "COMPLETED", "run_id": "run-1"}

package/tests/test_jira_issue_to_pr.py

@@ -0,0 +1,312 @@
+"""Tests for where the jira-issue-to-pr automation script starts its conversations.
+
+The script runs top to bottom as the automation's entrypoint, so each test runs it
+as a subprocess against one stub HTTP server that plays Jira, the automation
+service (KV store and completion callback), and either the local agent server or
+OpenHands Cloud - whichever the run's environment points at.
+"""
+
+import json
+import os
+import shutil
+import subprocess
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).parent.parent
+SCRIPT_PATH = ROOT / "skills" / "jira-issue-to-pr" / "scripts" / "main.py"
+
+ISSUE = {
+    "key": "ENG-1",
+    "fields": {
+        "summary": "Add a README",
+        "description": None,
+        "updated": "2030-01-01T00:00:00.000+0000",
+    },
+}
+# A baseline from before the issue was updated, so the issue counts as new.
+STATE = {"processed_keys": [], "first_run_at": "2020-01-01T00:00:00+00:00"}
+
+
+class StubServer:
+    """Records every request and answers it the way the real service would."""
+
+    def __init__(self):
+        self.requests = []
+        # What the automation's KV store holds, and the tasks OpenHands Cloud
+        # reports for the conversations it was asked to start.
+        self.state = dict(STATE)
+        self.start_tasks = []
+        stub = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def _handle(self):
+                length = int(self.headers.get("Content-Length") or 0)
+                body = self.rfile.read(length) if length else b""
+                stub.requests.append({
+                    "method": self.command,
+                    "path": self.path,
+                    "headers": {k.lower(): v for k, v in self.headers.items()},
+                    "body": json.loads(body) if body else None,
+                })
+                status, payload = stub.respond(self.path)
+                data = payload.encode() if isinstance(payload, str) else json.dumps(payload).encode()
+                self.send_response(status)
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+            do_GET = do_POST = do_PUT = _handle
+
+            def log_message(self, *args):
+                pass
+
+        self.httpd = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
+        self.url = f"http://127.0.0.1:{self.httpd.server_port}"
+        threading.Thread(target=self.httpd.serve_forever, daemon=True).start()
+
+    def respond(self, path):
+        if path == "/rest/api/3/search/jql":
+            return 200, {"issues": [ISSUE]}
+        if path.startswith("/rest/api/3/issue/"):
+            return 201, {}
+        if path == "/automation/v1/kv/state":
+            return 200, {"value": self.state}
+        if path.endswith("/settings/secrets/JIRA_CLOUD_KEY"):
+            return 200, "jira-token"
+        if path == "/api/settings":
+            return 200, {"agent_settings": {"llm": {"model": "test-model"}}}
+        if path == "/api/conversations":
+            return 201, {"id": "local-conversation"}
+        if path == "/api/v1/app-conversations":
+            return 200, {"id": "start-task", "status": "WORKING"}
+        if path.startswith("/api/v1/app-conversations/start-tasks?"):
+            return 200, self.start_tasks
+        if path == "/callback":
+            return 200, {}
+        return 404, {}
+
+    def find(self, method, path):
+        return [r for r in self.requests if r["method"] == method and r["path"] == path]
+
+
+@pytest.fixture
+def stub():
+    server = StubServer()
+    yield server
+    server.httpd.shutdown()
+
+
+@pytest.fixture
+def run_script(stub, tmp_path):
+    def run(env):
+        workdir = tmp_path / "run"
+        workdir.mkdir()
+        shutil.copy(SCRIPT_PATH, workdir / "main.py")
+        (workdir / "config.json").write_text(json.dumps({
+            "jira_base_url": stub.url,
+            "jira_email": "alice@example.test",
+            "jira_token_secret": "JIRA_CLOUD_KEY",
+        }))
+        return subprocess.run(
+            [sys.executable, str(workdir / "main.py")],
+            env={
+                "PATH": os.environ["PATH"],
+                "HOME": str(tmp_path),
+                "AUTOMATION_CALLBACK_URL": f"{stub.url}/callback",
+                "AUTOMATION_RUN_ID": "run-1",
+                **env,
+            },
+            capture_output=True,
+            text=True,
+            timeout=60,
+        )
+
+    return run
+
+
+def cloud_env(stub):
+    return {
+        "OPENHANDS_CLOUD_API_URL": stub.url,
+        "OPENHANDS_API_KEY": "openhands-key",
+        "SANDBOX_ID": "sandbox-1",
+        "SESSION_API_KEY": "session-key",
+        "AUTOMATION_API_URL": f"{stub.url}/automation",
+        "AUTOMATION_KV_TOKEN": "kv-token",
+    }
+
+
+def local_env(stub):
+    return {
+        "AGENT_SERVER_URL": stub.url,
+        "SESSION_API_KEY": "session-key",
+        "AUTOMATION_CALLBACK_API_KEY": "callback-key",
+        "AUTOMATION_API_URL": f"{stub.url}/automation",
+        "AUTOMATION_KV_TOKEN": "kv-token",
+    }
+
+
+def comment_text(comment):
+    return comment["body"]["body"]["content"][0]["content"][0]["text"]
+
+
+def test_a_cloud_run_reads_the_jira_token_from_its_sandbox_secrets(stub, run_script):
+    # Arrange
+    env = cloud_env(stub)
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [secret] = stub.find("GET", "/api/v1/sandboxes/sandbox-1/settings/secrets/JIRA_CLOUD_KEY")
+    assert secret["headers"]["x-session-api-key"] == "session-key"
+
+
+def test_a_cloud_run_starts_each_conversation_through_openhands_cloud(stub, run_script):
+    # Arrange
+    env = cloud_env(stub)
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [conversation] = stub.find("POST", "/api/v1/app-conversations")
+    assert conversation["headers"]["authorization"] == "Bearer openhands-key"
+    assert conversation["body"]["title"] == "[ENG-1] Add a README"
+    assert "ENG-1" in conversation["body"]["initial_message"]["content"][0]["text"]
+    assert stub.find("POST", "/api/conversations") == []
+
+
+def test_a_cloud_run_links_the_jira_issue_to_its_conversation(stub, run_script):
+    # Arrange
+    env = cloud_env(stub)
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [conversation] = stub.find("POST", "/api/v1/app-conversations")
+    [comment] = stub.find("POST", "/rest/api/3/issue/ENG-1/comment")
+    conversation_id = conversation["body"]["conversation_id"]
+    assert comment_text(comment) == f"I'm on it: {stub.url}/canvas/conversations/{conversation_id}"
+
+
+def test_a_cloud_run_starts_an_issue_again_when_its_conversation_failed_to_start(stub, run_script):
+    # Arrange - an earlier run asked for the conversation and marked the issue done
+    stub.state = {
+        **STATE,
+        "processed_keys": ["ENG-1"],
+        "pending_starts": {"ENG-1": {"task_id": "task-1", "attempts": 1}},
+    }
+    stub.start_tasks = [{"id": "task-1", "status": "ERROR", "detail": "sandbox did not start"}]
+
+    # Act
+    result = run_script(cloud_env(stub))
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [conversation] = stub.find("POST", "/api/v1/app-conversations")
+    assert conversation["body"]["title"] == "[ENG-1] Add a README"
+
+
+def test_a_cloud_run_leaves_an_issue_alone_once_its_conversation_is_up(stub, run_script):
+    # Arrange
+    stub.state = {
+        **STATE,
+        "processed_keys": ["ENG-1"],
+        "pending_starts": {"ENG-1": {"task_id": "task-1", "attempts": 1}},
+    }
+    stub.start_tasks = [{"id": "task-1", "status": "READY"}]
+
+    # Act
+    result = run_script(cloud_env(stub))
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    assert stub.find("POST", "/api/v1/app-conversations") == []
+    assert stub.find("POST", "/rest/api/3/issue/ENG-1/comment") == []
+
+
+def test_a_cloud_run_reports_a_start_that_keeps_failing_on_the_issue(stub, run_script):
+    # Arrange - the last allowed attempt has failed as well
+    stub.state = {
+        **STATE,
+        "processed_keys": ["ENG-1"],
+        "pending_starts": {"ENG-1": {"task_id": "task-1", "attempts": 3}},
+    }
+    stub.start_tasks = [{"id": "task-1", "status": "ERROR", "detail": "sandbox did not start"}]
+
+    # Act
+    result = run_script(cloud_env(stub))
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    assert stub.find("POST", "/api/v1/app-conversations") == []
+    [comment] = stub.find("POST", "/rest/api/3/issue/ENG-1/comment")
+    assert "could not start a conversation" in comment_text(comment)
+    assert "sandbox did not start" in comment_text(comment)
+
+
+def test_a_cloud_run_reports_completion_with_its_api_key(stub, run_script):
+    # Arrange
+    env = cloud_env(stub)
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [callback] = stub.find("POST", "/callback")
+    assert callback["headers"]["authorization"] == "Bearer openhands-key"
+    assert callback["body"]["status"] == "COMPLETED"
+
+
+def test_a_cloud_run_without_the_kv_store_fails_before_dispatching(stub, run_script):
+    # Arrange
+    env = cloud_env(stub)
+    del env["AUTOMATION_KV_TOKEN"]
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 1
+    assert stub.find("POST", "/api/v1/app-conversations") == []
+    [callback] = stub.find("POST", "/callback")
+    assert callback["body"]["status"] == "FAILED"
+
+
+def test_a_local_run_still_starts_conversations_on_the_agent_server(stub, run_script):
+    # Arrange
+    env = local_env(stub)
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [conversation] = stub.find("POST", "/api/conversations")
+    assert conversation["headers"]["x-session-api-key"] == "session-key"
+    [comment] = stub.find("POST", "/rest/api/3/issue/ENG-1/comment")
+    assert comment_text(comment) == f"I'm on it: {stub.url}/conversations/local-conversation"
+    assert stub.find("POST", "/api/v1/app-conversations") == []
+
+
+def test_a_local_run_still_reports_completion_with_its_callback_key(stub, run_script):
+    # Arrange
+    env = {**local_env(stub), "OPENHANDS_API_KEY": "openhands-key"}
+
+    # Act
+    result = run_script(env)
+
+    # Assert
+    assert result.returncode == 0, result.stderr
+    [callback] = stub.find("POST", "/callback")
+    assert callback["headers"]["authorization"] == "Bearer callback-key"

package/tests/test_jira_setup_webhook.py

@@ -0,0 +1,309 @@
+"""Tests for the script that sets up the Jira webhook of an event-based automation.
+
+The script talks to two services over HTTPS: the OpenHands automation API and
+Jira Cloud. Each test runs it as the entrypoint it is, with `urlopen` replaced by
+one in-process stand-in for both services that keeps what they would store.
+"""
+
+import hashlib
+import hmac
+import io
+import json
+import runpy
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+import pytest
+
+SCRIPT_PATH = (
+    Path(__file__).parent.parent
+    / "skills"
+    / "jira-issue-to-pr"
+    / "scripts"
+    / "setup_webhook.py"
+)
+OPENHANDS = "https://openhands.example.test"
+JIRA = "https://acme.atlassian.net"
+WEBHOOK_URL = f"{OPENHANDS}/api/automation/v1/events/org-1/jira"
+
+
+class Services:
+    """What the OpenHands automation API and Jira Cloud hold, and how they answer."""
+
+    def __init__(self):
+        self.jira_admin = True
+        self.jira_rejects_writes = False
+        self.openhands_webhook = None  # includes its "secret"
+        self.jira_webhooks = {}  # id -> webhook, including its "secret"
+        self.writes = []
+        self.delivered = []
+
+    def urlopen(self, request, timeout=None):
+        method, url = request.get_method(), request.full_url
+        body = json.loads(request.data) if request.data else None
+        if method != "GET" and "/events/" not in url:
+            self.writes.append((method, url))
+        status, payload = self._answer(method, url, body, request)
+        if status >= 400:
+            raise urllib.error.HTTPError(
+                url, status, "error", {}, io.BytesIO(json.dumps(payload).encode())
+            )
+        return _Response(status, payload)
+
+    def _answer(self, method, url, body, request):
+        if url == WEBHOOK_URL:
+            signature = "sha256=" + hmac.new(
+                self.openhands_webhook["secret"].encode(), request.data, hashlib.sha256
+            ).hexdigest()
+            if request.get_header("X-hub-signature") != signature:
+                return 401, {"detail": "Invalid signature"}
+            self.delivered.append(body)
+            return 200, {"received": True, "matched": 0}
+        if url.startswith(OPENHANDS):
+            return self._openhands(method, url, body)
+        return self._jira(method, url, body)
+
+    def _openhands(self, method, url, body):
+        def public():
+            return {k: v for k, v in self.openhands_webhook.items() if k != "secret"}
+
+        if method == "GET":
+            return 200, {"webhooks": [public()] if self.openhands_webhook else []}
+        if url.endswith("/rotate-secret"):
+            self.openhands_webhook["secret"] = "rotated-" + "r" * 32
+            return 200, {"webhook_secret": self.openhands_webhook["secret"]}
+        if method == "PATCH":
+            self.openhands_webhook.update(body)
+            return 200, public()
+        self.openhands_webhook = {
+            "id": "webhook-1",
+            "enabled": True,
+            "webhook_url": WEBHOOK_URL,
+            "secret": body.pop("webhook_secret"),
+            **body,
+        }
+        return 201, {**public(), "webhook_secret": None}
+
+    def _jira(self, method, url, body):
+        if "/mypermissions" in url:
+            return 200, {
+                "permissions": {"ADMINISTER": {"havePermission": self.jira_admin}}
+            }
+        if method != "GET" and self.jira_rejects_writes:
+            return 400, {"messages": ["rejected", (body or {}).get("secret")]}
+        hook_id = url.rsplit("/", 1)[-1]
+        if method == "GET":
+            return 200, [
+                {**hook, "self": f"{JIRA}/rest/webhooks/1.0/webhook/{i}"}
+                for i, hook in self.jira_webhooks.items()
+            ]
+        if method == "DELETE":
+            del self.jira_webhooks[hook_id]
+            return 204, {}
+        if method == "PUT":
+            # Jira keeps the secret of a webhook updated without one.
+            kept = self.jira_webhooks[hook_id].get("secret")
+            self.jira_webhooks[hook_id] = {"secret": kept, **body}
+        else:
+            hook_id = "71"
+            self.jira_webhooks[hook_id] = body
+        return 200, {**body, "self": f"{JIRA}/rest/webhooks/1.0/webhook/{hook_id}"}
+
+
+class _Response:
+    def __init__(self, status, payload):
+        self.status = status
+        self._raw = json.dumps(payload).encode()
+
+    def read(self):
+        return self._raw
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        return False
+
+
+@pytest.fixture
+def services(monkeypatch):
+    services = Services()
+    monkeypatch.setattr(urllib.request, "urlopen", services.urlopen)
+    monkeypatch.setenv("OPENHANDS_API_KEY", "openhands-key")
+    monkeypatch.setenv("JIRA_ADMIN_TOKEN", "jira-token")
+    return services
+
+
+@pytest.fixture
+def run_script(monkeypatch, capsys):
+    """Run the script with the given action and flags; return (exit code, output)."""
+
+    def run(*args):
+        monkeypatch.setattr(
+            sys,
+            "argv",
+            [
+                str(SCRIPT_PATH),
+                *args,
+                *("--jira-base-url", JIRA, "--jira-email", "alice@acme.com"),
+                *("--jira-token-env", "JIRA_ADMIN_TOKEN"),
+                *("--openhands-host", OPENHANDS),
+            ],
+        )
+        code = 0
+        try:
+            runpy.run_path(str(SCRIPT_PATH), run_name="__main__")
+        except SystemExit as exit_:
+            code = exit_.code or 0
+        captured = capsys.readouterr()
+        return code, captured.out + captured.err
+
+    return run
+
+
+def test_apply_registers_the_webhook_on_both_sides_with_one_secret(
+    services, run_script
+):
+    # Act
+    code, _ = run_script("apply")
+
+    # Assert
+    assert code == 0
+    [jira_webhook] = services.jira_webhooks.values()
+    assert jira_webhook["url"] == WEBHOOK_URL
+    assert jira_webhook["events"] == ["jira:issue_created", "jira:issue_updated"]
+    assert jira_webhook["filters"] == {
+        "issue-related-events-section": 'labels = "create-pr"'
+    }
+    assert jira_webhook["secret"] == services.openhands_webhook["secret"]
+
+
+def test_apply_registers_the_openhands_webhook_the_way_jira_signs(
+    services, run_script
+):
+    # Act
+    run_script("apply")
+
+    # Assert
+    assert services.openhands_webhook["signature_header"] == "X-Hub-Signature"
+    assert services.openhands_webhook["event_key_expr"] == "webhookEvent"
+
+
+def test_apply_proves_the_pair_with_a_signed_delivery_that_starts_nothing(
+    services, run_script
+):
+    # Act
+    _, output = run_script("apply")
+
+    # Assert
+    assert json.loads(output)["signed_delivery_check"] == "ok"
+    assert services.delivered == [{"webhookEvent": "openhands:setup_check"}]
+
+
+def test_apply_never_prints_the_signing_secret(services, run_script):
+    # Act
+    _, output = run_script("apply")
+
+    # Assert
+    assert services.openhands_webhook["secret"] not in output
+
+
+def test_applying_again_updates_jira_and_keeps_the_secret(services, run_script):
+    # Arrange
+    run_script("apply")
+    secret = services.openhands_webhook["secret"]
+
+    # Act
+    code, _ = run_script("apply", "--label", "needs-pr")
+
+    # Assert
+    assert code == 0
+    [jira_webhook] = services.jira_webhooks.values()
+    assert jira_webhook["filters"] == {
+        "issue-related-events-section": 'labels = "needs-pr"'
+    }
+    assert jira_webhook["secret"] == secret == services.openhands_webhook["secret"]
+
+
+def test_a_failed_jira_update_leaves_the_existing_secret_working(services, run_script):
+    # Arrange
+    run_script("apply")
+    secret = services.openhands_webhook["secret"]
+    services.jira_rejects_writes = True
+
+    # Act
+    code, _ = run_script("apply", "--label", "needs-pr")
+
+    # Assert
+    assert code == 1
+    [jira_webhook] = services.jira_webhooks.values()
+    assert jira_webhook["secret"] == secret == services.openhands_webhook["secret"]
+
+
+def test_rotate_secret_gives_both_sides_a_new_secret(services, run_script):
+    # Arrange
+    run_script("apply")
+    secret = services.openhands_webhook["secret"]
+
+    # Act
+    code, _ = run_script("apply", "--rotate-secret")
+
+    # Assert
+    assert code == 0
+    [jira_webhook] = services.jira_webhooks.values()
+    assert services.openhands_webhook["secret"] != secret
+    assert jira_webhook["secret"] == services.openhands_webhook["secret"]
+
+
+def test_a_jira_error_that_echoes_the_secret_is_redacted(services, run_script):
+    # Arrange
+    services.jira_rejects_writes = True
+
+    # Act
+    code, output = run_script("apply")
+
+    # Assert
+    assert code == 1
+    assert services.openhands_webhook["secret"] not in output
+
+
+def test_an_account_that_is_not_a_jira_administrator_changes_nothing(
+    services, run_script
+):
+    # Arrange
+    services.jira_admin = False
+
+    # Act
+    code, output = run_script("apply")
+
+    # Assert - exit code 3 is what tells the skill to fall back to manual setup
+    assert code == 3
+    assert "Administer Jira" in output
+    assert services.writes == []
+
+
+def test_a_dry_run_changes_nothing(services, run_script):
+    # Act
+    code, output = run_script("apply", "--dry-run")
+
+    # Assert
+    assert code == 0
+    assert json.loads(output)["jira_webhook"] == "create"
+    assert services.writes == []
+
+
+def test_delete_removes_the_jira_webhook_and_keeps_the_openhands_one(
+    services, run_script
+):
+    # Arrange
+    run_script("apply")
+
+    # Act
+    code, _ = run_script("delete")
+
+    # Assert
+    assert code == 0
+    assert services.jira_webhooks == {}
+    assert services.openhands_webhook is not None