@openhands/extensions 0.25.0 → 0.27.0

package/skills/github-stale-ci-pr-closer/scripts/worker.py

@@ -3,7 +3,7 @@
 import json
 import os
 import time
-from datetime import UTC, datetime, timedelta
+from datetime import datetime
 from pathlib import Path
 from urllib.error import HTTPError
 from urllib.parse import quote
@@ -16,6 +16,38 @@ CLOSE_AFTER_SECONDS = 7 * 24 * 60 * 60
 WARNING_MARKER = "<!-- openhands-stale-ci-warning -->"
 CLOSE_MARKER = "<!-- openhands-stale-ci-close -->"
 PASSING_CONCLUSIONS = {"success", "neutral", "skipped"}
+PULL_REQUESTS_QUERY = """
+query($owner: String!, $name: String!, $cursor: String) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(first: 40, after: $cursor, states: OPEN) {
+      pageInfo { hasNextPage endCursor }
+      nodes {
+        number isDraft baseRefName headRefOid
+        author { login }
+        commits(last: 1) {
+          nodes {
+            commit {
+              statusCheckRollup {
+                contexts(first: 100) {
+                  totalCount
+                  nodes {
+                    __typename
+                    ... on CheckRun {
+                      databaseId name status conclusion startedAt completedAt
+                      checkSuite { app { databaseId } }
+                    }
+                    ... on StatusContext { context state createdAt }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+"""
 KV_TOKEN = os.environ.get("AUTOMATION_KV_TOKEN", "")
 KV_BASE = os.environ.get("AUTOMATION_API_URL", "").rstrip("/")
 
@@ -95,12 +127,16 @@ def complete_run(status="COMPLETED", error=None):
     body = {"status": status, "run_id": os.environ.get("AUTOMATION_RUN_ID", "")}
     if error:
         body["error"] = error
+    # A run on OpenHands Cloud or Enterprise is not given a callback key; it
+    # authenticates with its API key.
+    api_key = os.environ.get("AUTOMATION_CALLBACK_API_KEY") or os.environ.get(
+        "OPENHANDS_API_KEY", ""
+    )
     request = Request(
         url,
         data=json.dumps(body).encode(),
         headers={
-            "Authorization": "Bearer "
-            + os.environ.get("AUTOMATION_CALLBACK_API_KEY", ""),
+            "Authorization": f"Bearer {api_key}",
             "Content-Type": "application/json",
         },
     )
@@ -132,30 +168,25 @@ class StaleCIPullRequestCloser(GitHubRepository):
         self._required_checks = cached
         return required
 
-    def required_ci_state(self, sha, required):
+    @staticmethod
+    def _required_ci_result(runs, statuses, required):
         if not required:
-            return "unconfigured"
-        runs = []
-        for page in range(1, 11):
-            batch = self.gh(
-                "GET", f"/commits/{sha}/check-runs?per_page=100&page={page}"
-            )
-            page_runs = batch.get("check_runs", [])
-            runs.extend(page_runs)
-            if len(page_runs) < 100:
-                break
-        else:
-            raise RuntimeError(f"More than 1,000 check runs found for {sha}")
+            return "unconfigured", None
         latest_runs = {}
         for run in sorted(runs, key=lambda item: item.get("id", 0), reverse=True):
             latest_runs.setdefault(
                 (run.get("name"), (run.get("app") or {}).get("id")), run
             )
-        statuses = {}
-        for status in self.gh_pages(f"/commits/{sha}/statuses"):
-            statuses.setdefault(status.get("context"), status)
+        latest_statuses = {}
+        for status in sorted(
+            statuses,
+            key=lambda item: item.get("updated_at") or item.get("created_at") or "",
+            reverse=True,
+        ):
+            latest_statuses.setdefault(status.get("context"), status)
 
         states = []
+        failures = []
         for item in required:
             context = item["context"]
             integration = item.get("integration_id") or None
@@ -172,43 +203,143 @@ class StaleCIPullRequestCloser(GitHubRepository):
                     states.append("passing")
                 else:
                     states.append("failing")
+                    completed = run.get("completed_at") or run.get("started_at")
+                    if completed:
+                        failures.append(_timestamp(completed))
                 continue
-            status = statuses.get(context) if integration is None else None
+            status = latest_statuses.get(context) if integration is None else None
             if status is None or status.get("state") in {"pending", "expected"}:
                 states.append("pending")
             elif status.get("state") == "success":
                 states.append("passing")
             else:
                 states.append("failing")
+                completed = status.get("updated_at") or status.get("created_at")
+                if completed:
+                    failures.append(_timestamp(completed))
         if "pending" in states:
-            return "pending"
+            return "pending", None
         if "failing" in states:
-            return "failing"
-        return "passing"
+            return "failing", max(failures) if failures else None
+        return "passing", None
 
-    def comments(self, number):
-        return self.gh_pages(f"/issues/{number}/comments")
-
-    def stale_failure_numbers(self, now):
-        cutoff = (datetime.fromtimestamp(now, UTC) - timedelta(days=7)).date()
-        query = (
-            f"repo:{self.repository} is:pr is:open draft:false status:failure "
-            f"updated:<{cutoff.isoformat()}"
-        )
-        numbers = set()
+    def required_ci_result(self, sha, required):
+        if not required:
+            return "unconfigured", None
+        runs = []
         for page in range(1, 11):
-            result = self.api(
-                "GET",
-                "/search/issues",
-                params={"q": query, "per_page": 100, "page": page},
+            batch = self.gh(
+                "GET", f"/commits/{sha}/check-runs?per_page=100&page={page}"
             )
-            if result.get("incomplete_results"):
-                raise RuntimeError("GitHub returned incomplete stale CI search results")
-            items = result.get("items", [])
-            numbers.update(item["number"] for item in items)
-            if len(items) < 100:
-                return numbers
-        raise RuntimeError("GitHub stale CI search exceeded 1,000 pull requests")
+            page_runs = batch.get("check_runs", [])
+            runs.extend(page_runs)
+            if len(page_runs) < 100:
+                break
+        else:
+            raise RuntimeError(f"More than 1,000 check runs found for {sha}")
+        statuses = self.gh_pages(f"/commits/{sha}/statuses")
+        return self._required_ci_result(runs, statuses, required)
+
+    def required_ci_state(self, sha, required):
+        return self.required_ci_result(sha, required)[0]
+
+    @staticmethod
+    def _graphql_ci_result(contexts, required):
+        runs = []
+        statuses = []
+        for context in contexts:
+            if context.get("__typename") == "CheckRun":
+                app = ((context.get("checkSuite") or {}).get("app") or {}).get(
+                    "databaseId"
+                )
+                runs.append(
+                    {
+                        "id": context.get("databaseId"),
+                        "name": context.get("name"),
+                        "app": {"id": app},
+                        "status": (context.get("status") or "").lower(),
+                        "conclusion": (context.get("conclusion") or "").lower() or None,
+                        "started_at": context.get("startedAt"),
+                        "completed_at": context.get("completedAt"),
+                    }
+                )
+            elif context.get("__typename") == "StatusContext":
+                statuses.append(
+                    {
+                        "context": context.get("context"),
+                        "state": (context.get("state") or "").lower(),
+                        "created_at": context.get("createdAt"),
+                    }
+                )
+        return StaleCIPullRequestCloser._required_ci_result(runs, statuses, required)
+
+    def open_pull_requests(self):
+        """Read every open PR and its latest check rollup with explicit pagination."""
+        owner, name = self.repository.split("/", 1)
+        cursor = None
+        seen_cursors = set()
+        pull_requests = []
+        while True:
+            for attempt in range(4):
+                try:
+                    result = self.api(
+                        "POST",
+                        "/graphql",
+                        body={
+                            "query": PULL_REQUESTS_QUERY,
+                            "variables": {
+                                "owner": owner,
+                                "name": name,
+                                "cursor": cursor,
+                            },
+                        },
+                    )
+                    break
+                except HTTPError as exc:
+                    if exc.code < 500 or attempt == 3:
+                        raise
+                    time.sleep(2**attempt)
+            if result.get("errors"):
+                raise RuntimeError("GitHub GraphQL pull request query failed")
+            connection = result["data"]["repository"]["pullRequests"]
+            for node in connection["nodes"]:
+                commits = node.get("commits", {}).get("nodes", [])
+                rollup = (
+                    ((commits[-1].get("commit") or {}).get("statusCheckRollup") or {})
+                    if commits
+                    else {}
+                )
+                contexts = rollup.get("contexts") or {"nodes": [], "totalCount": 0}
+                required = self.required_checks(node["baseRefName"])
+                if contexts.get("totalCount", 0) > len(contexts.get("nodes", [])):
+                    state, failed_at = self.required_ci_result(
+                        node["headRefOid"], required
+                    )
+                else:
+                    state, failed_at = self._graphql_ci_result(
+                        contexts.get("nodes", []), required
+                    )
+                pull_requests.append(
+                    {
+                        "number": node["number"],
+                        "draft": node["isDraft"],
+                        "head": {"sha": node["headRefOid"]},
+                        "base": {"ref": node["baseRefName"]},
+                        "user": {"login": (node.get("author") or {}).get("login", "")},
+                        "_ci_state": state,
+                        "_failed_at": failed_at,
+                    }
+                )
+            page = connection["pageInfo"]
+            if not page["hasNextPage"]:
+                return pull_requests
+            cursor = page["endCursor"]
+            if not cursor or cursor in seen_cursors:
+                raise RuntimeError("GitHub returned an invalid pull request cursor")
+            seen_cursors.add(cursor)
+
+    def comments(self, number):
+        return self.gh_pages(f"/issues/{number}/comments")
 
     def post_comment(self, number, body):
         return self.gh("POST", f"/issues/{number}/comments", {"body": body})
@@ -222,6 +353,28 @@ class StaleCIPullRequestCloser(GitHubRepository):
             for comment in comments
         )
 
+    def _backfill_first_failed_at(self, pr, record):
+        """Age a record from the required-check failure, unless it is a reset.
+
+        Versions before this one stored first *observation* time, so a record
+        whose CI had already been failing for longer than we had been watching
+        under-counted the window; re-age it to the newest required-check
+        failure. Versions before this one also cleared `warning` on author
+        follow-up to open a fresh window without leaving a marker, so such a
+        reset is indistinguishable from a first sighting by record shape alone
+        and is recognized from the comment history instead: the author of the
+        pull request commented after the newest required-check failure. Aging
+        that record would collapse the fresh window the follow-up just opened,
+        so it is left alone.
+        """
+        failed_at = pr.get("_failed_at")
+        if failed_at is None:
+            return
+        if self.author_followed_up(pr, self.comments(pr["number"]), failed_at):
+            record["reset_at"] = record["first_failed_at"]
+            return
+        record["first_failed_at"] = min(record["first_failed_at"], failed_at)
+
     def reconcile(self, pr, records, now):
         number = pr["number"]
         key = str(number)
@@ -229,17 +382,26 @@ class StaleCIPullRequestCloser(GitHubRepository):
             records.pop(key, None)
             return "draft"
         head = pr["head"]["sha"]
-        required = self.required_checks(pr["base"]["ref"])
-        ci_state = self.required_ci_state(head, required)
+        ci_state = pr.get("_ci_state")
+        if ci_state is None:
+            required = self.required_checks(pr["base"]["ref"])
+            ci_state = self.required_ci_state(head, required)
         if ci_state != "failing":
             records.pop(key, None)
             return ci_state
 
         record = records.get(key)
         if not record or record.get("head_sha") != head:
-            record = {"head_sha": head, "first_failed_at": now}
+            failed_at = pr.get("_failed_at")
+            record = {
+                "head_sha": head,
+                "first_failed_at": now if failed_at is None else failed_at,
+            }
             records[key] = record
+
         warning = record.get("warning")
+        if not warning and not record.get("reset_at"):
+            self._backfill_first_failed_at(pr, record)
         if not warning:
             if now - record["first_failed_at"] < WARN_AFTER_SECONDS:
                 return "observing"
@@ -281,7 +443,11 @@ class StaleCIPullRequestCloser(GitHubRepository):
 
         comments = self.comments(number)
         if self.author_followed_up(pr, comments, warning["at"]):
-            records[key] = {"head_sha": head, "first_failed_at": now}
+            records[key] = {
+                "head_sha": head,
+                "first_failed_at": now,
+                "reset_at": now,
+            }
             return "followed-up"
         if now - warning["at"] < CLOSE_AFTER_SECONDS:
             return "waiting"
@@ -300,13 +466,20 @@ class StaleCIPullRequestCloser(GitHubRepository):
     def run(self):
         state = load_state(self.repository)
         records = state.setdefault("prs", {})
-        open_prs = self.gh_pages("/pulls?state=open")
+        open_prs = self.open_pull_requests()
         open_by_number = {pr["number"]: pr for pr in open_prs}
         open_numbers = {str(number) for number in open_by_number}
         for key in set(records) - open_numbers:
             records.pop(key, None)
         now = time.time()
-        candidates = self.stale_failure_numbers(now)
+        candidates = {
+            pr["number"]
+            for pr in open_prs
+            if not pr["draft"]
+            and pr["_ci_state"] == "failing"
+            and pr["_failed_at"] is not None
+            and now - pr["_failed_at"] >= WARN_AFTER_SECONDS
+        }
         candidates.update(int(number) for number in records)
         for number in sorted(candidates, reverse=True):
             pr = open_by_number.get(number)

package/skills/github-stale-ci-pr-closer/tests/test_worker.py

@@ -3,6 +3,7 @@ import unittest
 from os import environ
 from pathlib import Path
 from unittest.mock import Mock, patch
+from urllib.error import HTTPError
 
 sys.path.insert(0, str(Path(__file__).parent.parent / "scripts"))
 sys.path.insert(0, str(Path(__file__).parents[2] / "github" / "scripts"))
@@ -125,6 +126,49 @@ class TestReconcile(unittest.TestCase):
             self.records["7"], {"head_sha": "def", "first_failed_at": 14 * DAY}
         )
 
+    def test_old_check_failure_warns_despite_recent_pr_activity(self):
+        self.pr["updated_at"] = "1970-01-08T00:00:00Z"
+        self.pr["_ci_state"] = "failing"
+        self.pr["_failed_at"] = 0
+        self.assertEqual(self.reconcile(7 * DAY), "warned")
+
+    def test_backfills_legacy_observation_time_from_check_failure(self):
+        self.records["7"] = {"head_sha": "abc", "first_failed_at": 6 * DAY}
+        self.pr["_ci_state"] = "failing"
+        self.pr["_failed_at"] = 0
+        self.assertEqual(self.reconcile(7 * DAY), "warned")
+
+    def test_backfill_leaves_a_legacy_follow_up_reset_alone(self):
+        # A pre-marker version cleared `warning` on author follow-up to open a
+        # fresh window. Re-aging that record to the check failure would collapse
+        # the new window and warn inside it.
+        self.records["7"] = {"head_sha": "abc", "first_failed_at": 13 * DAY}
+        self.pr["_ci_state"] = "failing"
+        self.pr["_failed_at"] = 0
+        self.closer.comments.return_value = [
+            {
+                "user": {"login": "author"},
+                "created_at": "1970-01-14T00:00:00Z",
+                "body": "working",
+            }
+        ]
+        self.assertEqual(self.reconcile(14 * DAY), "observing")
+        self.assertEqual(self.records["7"]["first_failed_at"], 13 * DAY)
+        self.closer.post_comment.assert_not_called()
+
+    def test_legacy_follow_up_reset_still_warns_after_a_full_fresh_window(self):
+        self.records["7"] = {"head_sha": "abc", "first_failed_at": 13 * DAY}
+        self.pr["_ci_state"] = "failing"
+        self.pr["_failed_at"] = 0
+        self.closer.comments.return_value = [
+            {
+                "user": {"login": "author"},
+                "created_at": "1970-01-14T00:00:00Z",
+                "body": "working",
+            }
+        ]
+        self.assertEqual(self.reconcile(20 * DAY), "warned")
+
     def test_draft_cancels_the_lifecycle(self):
         self.reconcile(0)
         self.pr["draft"] = True
@@ -185,28 +229,124 @@ class TestRequiredCI(unittest.TestCase):
         ]
         self.assertEqual(self.state(runs, required), "pending")
 
+    def test_newest_required_failure_sets_the_age(self):
+        contexts = [
+            {
+                "__typename": "CheckRun",
+                "databaseId": 2,
+                "name": "a",
+                "status": "COMPLETED",
+                "conclusion": "FAILURE",
+                "completedAt": "1970-01-01T00:00:00Z",
+                "checkSuite": {"app": {"databaseId": 1}},
+            },
+            {
+                "__typename": "CheckRun",
+                "databaseId": 3,
+                "name": "b",
+                "status": "COMPLETED",
+                "conclusion": "FAILURE",
+                "completedAt": "1970-01-03T00:00:00Z",
+                "checkSuite": {"app": {"databaseId": 1}},
+            },
+        ]
+        state, failed_at = self.closer._graphql_ci_result(
+            contexts,
+            [
+                {"context": "a", "integration_id": 1},
+                {"context": "b", "integration_id": 1},
+            ],
+        )
+        self.assertEqual(state, "failing")
+        self.assertEqual(failed_at, 2 * DAY)
+
 
-class TestCandidateSearch(unittest.TestCase):
+class TestPullRequestPagination(unittest.TestCase):
     def setUp(self):
         self.closer = object.__new__(worker.StaleCIPullRequestCloser)
         self.closer.repository = "OpenHands/OpenHands"
 
-    def test_searches_only_inactive_failing_pull_requests(self):
-        self.closer.api = Mock(
-            return_value={
-                "incomplete_results": False,
-                "items": [{"number": 2}, {"number": 3}],
+    @staticmethod
+    def page(number, has_next, cursor):
+        return {
+            "data": {
+                "repository": {
+                    "pullRequests": {
+                        "pageInfo": {
+                            "hasNextPage": has_next,
+                            "endCursor": cursor,
+                        },
+                        "nodes": [
+                            {
+                                "number": number,
+                                "isDraft": False,
+                                "baseRefName": "main",
+                                "headRefOid": f"sha-{number}",
+                                "author": {"login": "author"},
+                                "commits": {
+                                    "nodes": [
+                                        {
+                                            "commit": {
+                                                "statusCheckRollup": {
+                                                    "contexts": {
+                                                        "totalCount": 0,
+                                                        "nodes": [],
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    ]
+                                },
+                            }
+                        ],
+                    }
+                }
             }
+        }
+
+    def test_paginates_every_open_pull_request(self):
+        self.closer.required_checks = Mock(return_value=[])
+        self.closer.api = Mock(
+            side_effect=[self.page(2, True, "next"), self.page(3, False, None)]
         )
-        self.assertEqual(self.closer.stale_failure_numbers(14 * DAY), {2, 3})
-        params = self.closer.api.call_args.kwargs["params"]
-        self.assertIn("is:pr is:open draft:false status:failure", params["q"])
-        self.assertIn("updated:<1970-01-08", params["q"])
-
-    def test_rejects_incomplete_search_results(self):
-        self.closer.api = Mock(return_value={"incomplete_results": True, "items": []})
-        with self.assertRaisesRegex(RuntimeError, "incomplete"):
-            self.closer.stale_failure_numbers(14 * DAY)
+        self.assertEqual(
+            [pr["number"] for pr in self.closer.open_pull_requests()], [2, 3]
+        )
+        second_variables = self.closer.api.call_args_list[1].kwargs["body"]["variables"]
+        self.assertEqual(second_variables["cursor"], "next")
+
+    def test_falls_back_to_rest_when_check_contexts_are_paginated(self):
+        page = self.page(2, False, None)
+        contexts = page["data"]["repository"]["pullRequests"]["nodes"][0]["commits"][
+            "nodes"
+        ][0]["commit"]["statusCheckRollup"]["contexts"]
+        contexts["totalCount"] = 101
+        self.closer.required_checks = Mock(return_value=[{"context": "test"}])
+        self.closer.required_ci_result = Mock(return_value=("failing", 0))
+        self.closer.api = Mock(return_value=page)
+
+        pull_request = self.closer.open_pull_requests()[0]
+
+        self.assertEqual(pull_request["_ci_state"], "failing")
+        self.assertEqual(pull_request["_failed_at"], 0)
+        self.closer.required_ci_result.assert_called_once_with(
+            "sha-2", [{"context": "test"}]
+        )
+
+    @patch("worker.time.sleep")
+    def test_retries_a_transient_graphql_page_failure(self, sleep):
+        self.closer.required_checks = Mock(return_value=[])
+        self.closer.api = Mock(
+            side_effect=[
+                HTTPError(
+                    "https://api.github.com/graphql", 502, "bad gateway", {}, None
+                ),
+                self.page(2, False, None),
+            ]
+        )
+
+        self.assertEqual(self.closer.open_pull_requests()[0]["number"], 2)
+        sleep.assert_called_once_with(1)
 
 
 if __name__ == "__main__":

package/skills/gitlab-issue-to-mr/README.md

@@ -53,6 +53,18 @@ conversation never loses the work. `origin` carries no credential, so each GitLa
 command has to name `GITLAB_TOKEN`, which the SDK injects only into a command
 that mentions it and masks in the output.
 
+On OpenHands Cloud and Enterprise the conversation is started through the
+OpenHands API in a sandbox of its own, which changes three things:
+
+- The agent clones the project itself; the script keeps no clone.
+- The conversation runs with the user's own settings, so the secret allow-list
+  above does not apply: it holds the user's secrets and MCP servers.
+- A conversation that ends without a merge request is reported on the issue. The
+  script cannot finish the work, because it has no copy of it.
+
+A user with no `GITLAB_TOKEN` secret is served the token of their connected
+GitLab integration instead.
+
 ## Two setup paths
 
 The `/issue-to-mr:setup` conversation substitutes the constants at the top of

package/skills/gitlab-issue-to-mr/SKILL.md

@@ -252,17 +252,24 @@ Fix any syntax errors before proceeding.
 
 ### Step 10 - Package and upload
 
-Determine the Automation backend URL and auth from the `<RUNTIME_SERVICES>`
-block in your system context:
-- **OPENHANDS_HOST**: the Automation backend `url_from_agent`
-- **Auth**: `X-Session-API-Key: $OPENHANDS_AUTOMATION_API_KEY`
+Set `OPENHANDS_HOST` and `AUTH_HEADER` for the commands below:
+- **OpenHands Cloud or Enterprise** - a `<HOST>` value is in your system prompt:
+  use it as `OPENHANDS_HOST`, with `AUTH_HEADER="Authorization: Bearer $OPENHANDS_API_KEY"`
+- **Local Agent Canvas** - an **Automation backend** is listed in the
+  `<RUNTIME_SERVICES>` block of your system context: use its `url_from_agent` as
+  `OPENHANDS_HOST`, with `AUTH_HEADER="X-Session-API-Key: $OPENHANDS_AUTOMATION_API_KEY"`
+
+On OpenHands Cloud or Enterprise each run starts in a fresh sandbox, so the
+automation keeps its state in the KV store: check that `kvStore` is listed under
+`features` in `GET ${OPENHANDS_HOST}/api/automation/v1/capabilities` before
+deploying.
 
 ```bash
 tar -czf /tmp/issue-to-mr.tar.gz -C /tmp/issue-to-mr-build .
 
 TARBALL_PATH=$(curl -s -X POST \
   "${OPENHANDS_HOST}/api/automation/v1/uploads?name=gitlab-issue-to-mr" \
-  -H "X-Session-API-Key: $OPENHANDS_AUTOMATION_API_KEY" \
+  -H "$AUTH_HEADER" \
   -H "Content-Type: application/gzip" \
   --data-binary @/tmp/issue-to-mr.tar.gz \
   | python3 -c "import json,sys; print(json.load(sys.stdin)['tarball_path'])")
@@ -274,7 +281,7 @@ echo "Uploaded: $TARBALL_PATH"
 
 ```bash
 curl -s -X POST "${OPENHANDS_HOST}/api/automation/v1" \
-  -H "X-Session-API-Key: $OPENHANDS_AUTOMATION_API_KEY" \
+  -H "$AUTH_HEADER" \
   -H "Content-Type: application/json" \
   -d "{
     \"name\": \"GitLab Issue to MR: {project_summary} label {trigger_label}\",