@trac3er/oh-my-god 2.2.2 → 2.3.0

package/runtime/github_integration.py

@@ -0,0 +1,255 @@
+from __future__ import annotations
+
+import base64
+import json
+import os
+import time
+from collections.abc import Mapping
+from datetime import UTC, datetime, timedelta
+from typing import Any, cast
+
+import requests
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+
+
+_TOKEN_CACHE: dict[str, object] = {
+    "token": "",
+    "expires_at": 0.0,
+}
+
+
+def get_github_token(
+    *,
+    session: Any | None = None,
+    env: Mapping[str, str] | None = None,
+    now: datetime | None = None,
+    max_retries: int = 2,
+) -> dict[str, object]:
+    source_env = env if env is not None else os.environ
+    current_time = now or datetime.now(UTC)
+
+    app_id = str(source_env.get("GITHUB_APP_ID", "")).strip()
+    private_key = str(source_env.get("GITHUB_APP_PRIVATE_KEY", "")).strip()
+    installation_id = str(source_env.get("GITHUB_INSTALLATION_ID", "")).strip()
+
+    missing: list[str] = []
+    if not app_id:
+        missing.append("GITHUB_APP_ID")
+    if not private_key:
+        missing.append("GITHUB_APP_PRIVATE_KEY")
+    if not installation_id:
+        missing.append("GITHUB_INSTALLATION_ID")
+    if missing:
+        return {
+            "status": "error",
+            "error_code": "GITHUB_CREDENTIALS_MISSING",
+            "message": "GitHub App credentials are missing.",
+            "missing": missing,
+        }
+
+    if _token_is_valid(current_time):
+        return {
+            "status": "ok",
+            "token": str(_TOKEN_CACHE["token"]),
+            "expires_at": _TOKEN_CACHE["expires_at"],
+            "source": "cache",
+        }
+
+    normalized_private_key = private_key.replace("\\n", "\n")
+    jwt_result = _build_app_jwt(app_id=app_id, private_key_pem=normalized_private_key, now=current_time)
+    if jwt_result.get("status") != "ok":
+        return jwt_result
+
+    client = session if session is not None else requests
+    token_result = _exchange_installation_token(
+        session=client,
+        app_jwt=str(jwt_result["jwt"]),
+        installation_id=installation_id,
+        max_retries=max_retries,
+    )
+    if token_result.get("status") != "ok":
+        return token_result
+
+    token = str(token_result.get("token", "")).strip()
+    expires_at_epoch = _to_float(token_result.get("expires_at_epoch"))
+    _TOKEN_CACHE["token"] = token
+    _TOKEN_CACHE["expires_at"] = expires_at_epoch
+    return {
+        "status": "ok",
+        "token": token,
+        "expires_at": expires_at_epoch,
+        "source": "fresh",
+    }
+
+
+def _token_is_valid(now: datetime) -> bool:
+    token = str(_TOKEN_CACHE.get("token", "")).strip()
+    expires_at = _to_float(_TOKEN_CACHE.get("expires_at"))
+    if not token or expires_at <= 0:
+        return False
+    return expires_at > now.timestamp() + 60.0
+
+
+def _build_app_jwt(*, app_id: str, private_key_pem: str, now: datetime) -> dict[str, object]:
+    try:
+        key_obj = serialization.load_pem_private_key(private_key_pem.encode("utf-8"), password=None)
+    except Exception as exc:
+        return {
+            "status": "error",
+            "error_code": "GITHUB_APP_PRIVATE_KEY_INVALID",
+            "message": f"Unable to parse GitHub App private key: {exc}",
+        }
+    if not isinstance(key_obj, RSAPrivateKey):
+        return {
+            "status": "error",
+            "error_code": "GITHUB_APP_PRIVATE_KEY_INVALID",
+            "message": "GitHub App private key must be RSA.",
+        }
+    key = cast(RSAPrivateKey, key_obj)
+
+    header = {"alg": "RS256", "typ": "JWT"}
+    payload = {
+        "iat": int((now - timedelta(seconds=60)).timestamp()),
+        "exp": int((now + timedelta(minutes=9)).timestamp()),
+        "iss": app_id,
+    }
+    signing_input = f"{_b64url_json(header)}.{_b64url_json(payload)}"
+    try:
+        signature = key.sign(signing_input.encode("ascii"), padding.PKCS1v15(), hashes.SHA256())
+    except Exception as exc:
+        return {
+            "status": "error",
+            "error_code": "GITHUB_JWT_SIGNING_FAILED",
+            "message": f"Failed to sign GitHub App JWT: {exc}",
+        }
+    jwt_token = f"{signing_input}.{_b64url_bytes(signature)}"
+    return {
+        "status": "ok",
+        "jwt": jwt_token,
+    }
+
+
+def _exchange_installation_token(
+    *,
+    session: Any,
+    app_jwt: str,
+    installation_id: str,
+    max_retries: int,
+) -> dict[str, object]:
+    url = f"https://api.github.com/app/installations/{installation_id}/access_tokens"
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "Authorization": f"Bearer {app_jwt}",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+
+    attempts = max(0, int(max_retries)) + 1
+    for attempt in range(1, attempts + 1):
+        try:
+            response = session.post(url, headers=headers, timeout=20)
+        except Exception as exc:
+            if attempt >= attempts:
+                return {
+                    "status": "error",
+                    "error_code": "GITHUB_TOKEN_REQUEST_FAILED",
+                    "message": f"Failed to request installation token: {exc}",
+                }
+            time.sleep(1.0)
+            continue
+
+        if _is_rate_limited(response) and attempt < attempts:
+            delay = _retry_after_seconds(response)
+            time.sleep(delay)
+            continue
+
+        if int(getattr(response, "status_code", 0)) >= 400:
+            return {
+                "status": "error",
+                "error_code": "GITHUB_TOKEN_REQUEST_REJECTED",
+                "http_status": int(getattr(response, "status_code", 0)),
+                "message": "GitHub rejected installation token request.",
+                "response_excerpt": str(getattr(response, "text", ""))[:300],
+            }
+
+        try:
+            payload = response.json()
+        except Exception:
+            payload = None
+        if not isinstance(payload, dict):
+            return {
+                "status": "error",
+                "error_code": "GITHUB_TOKEN_RESPONSE_INVALID",
+                "message": "GitHub token response was not valid JSON.",
+            }
+
+        token = str(payload.get("token", "")).strip()
+        expires_at = str(payload.get("expires_at", "")).strip()
+        if not token or not expires_at:
+            return {
+                "status": "error",
+                "error_code": "GITHUB_TOKEN_RESPONSE_INVALID",
+                "message": "GitHub token response missing token or expires_at.",
+            }
+
+        expires_at_epoch = _parse_iso8601(expires_at)
+        return {
+            "status": "ok",
+            "token": token,
+            "expires_at_epoch": expires_at_epoch,
+        }
+
+    return {
+        "status": "error",
+        "error_code": "GITHUB_TOKEN_REQUEST_FAILED",
+        "message": "GitHub installation token request exhausted retries.",
+    }
+
+
+def _is_rate_limited(response: Any) -> bool:
+    status = int(getattr(response, "status_code", 0))
+    headers = getattr(response, "headers", {}) or {}
+    remaining = str(headers.get("X-RateLimit-Remaining", "")).strip()
+    return status == 429 or (status == 403 and remaining == "0")
+
+
+def _retry_after_seconds(response: Any) -> float:
+    headers = getattr(response, "headers", {}) or {}
+    retry_after = str(headers.get("Retry-After", "")).strip()
+    try:
+        value = float(retry_after)
+    except ValueError:
+        value = 1.0
+    return max(0.2, value)
+
+
+def _parse_iso8601(value: str) -> float:
+    text = value.strip().replace("Z", "+00:00")
+    parsed = datetime.fromisoformat(text)
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=UTC)
+    return parsed.timestamp()
+
+
+def _b64url_json(payload: Mapping[str, object]) -> str:
+    raw = json.dumps(payload, separators=(",", ":"), ensure_ascii=True).encode("utf-8")
+    return _b64url_bytes(raw)
+
+
+def _b64url_bytes(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+
+
+def _to_float(value: object) -> float:
+    if isinstance(value, (int, float)):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            return 0.0
+    return 0.0
+
+
+__all__ = ["get_github_token"]

package/runtime/github_review_bot.py

@@ -0,0 +1,290 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+import requests
+
+from runtime.github_integration import get_github_token
+from runtime.github_review_contract import GitHubReviewContract, ReviewStatus
+from runtime.github_review_formatter import format_review_payload
+
+
+class GitHubReviewBot:
+    def __init__(self, *, session: Any | None = None, api_base: str = "https://api.github.com") -> None:
+        self.session = session if session is not None else requests
+        self.api_base = api_base.rstrip("/")
+        self.contract = GitHubReviewContract()
+
+    def process_pull_request_event(self, event_payload: dict[str, Any], evidence: dict[str, Any]) -> dict[str, Any]:
+        event = self._extract_event(event_payload)
+        if event.get("status") != "ok":
+            return event
+
+        repo = str(event["repo"])
+        pr_number = int(event["pr_number"])
+        head_sha = str(event["head_sha"])
+        action = str(event["action"])
+
+        if action == "synchronize":
+            stale = self.contract.mark_stale_for_new_sha(pr_number, head_sha)
+            if stale.get("marked") and stale.get("stale_status") == "approved":
+                stale_review_id = stale.get("stale_review_id")
+                if isinstance(stale_review_id, int):
+                    _ = self._dismiss_review(repo=repo, pr_number=pr_number, review_id=stale_review_id)
+
+        if self.contract.should_skip_sha(pr_number, head_sha):
+            state = self.contract.get_state(pr_number)
+            return {
+                "status": "skipped",
+                "reason": "duplicate_sha",
+                "repo": repo,
+                "pr_number": pr_number,
+                "head_sha": head_sha,
+                "review_id": state.review_id if state is not None else None,
+                "check_run_id": state.check_run_id if state is not None else None,
+            }
+
+        token_result = get_github_token(session=self.session)
+        if token_result.get("status") != "ok":
+            return token_result
+        token = str(token_result.get("token", "")).strip()
+        if not token:
+            return {
+                "status": "error",
+                "error_code": "GITHUB_TOKEN_EMPTY",
+                "message": "GitHub token is empty.",
+            }
+
+        formatted = format_review_payload(evidence)
+        if formatted.get("status") != "ok":
+            return formatted
+
+        review_result = self._post_review(
+            repo=repo,
+            pr_number=pr_number,
+            token=token,
+            event=str(formatted["review_event"]),
+            body=str(formatted["body"]),
+            inline_comments=list(formatted.get("inline_comments", [])),
+        )
+        if review_result.get("status") != "ok":
+            return review_result
+
+        check_result = self._post_check_run(
+            repo=repo,
+            token=token,
+            head_sha=head_sha,
+            review_status=str(formatted["review_status"]),
+            body=str(formatted["body"]),
+        )
+        # Check-run is supplementary — don't fail the whole flow if it errors
+        # (e.g., app may lack Checks permission while still having PR write)
+
+        review_status = self._to_review_status(str(formatted["review_status"]))
+        state = self.contract.record_review(
+            pr_number=pr_number,
+            head_sha=head_sha,
+            review_id=self._to_int(review_result.get("review_id")),
+            check_run_id=self._to_int(check_result.get("check_run_id")),
+            status=review_status,
+        )
+
+        return {
+            "status": "ok",
+            "repo": repo,
+            "pr_number": pr_number,
+            "head_sha": head_sha,
+            "review_id": state.review_id,
+            "check_run_id": state.check_run_id,
+            "review_status": state.status,
+            "inline_comment_count": len(list(formatted.get("inline_comments", []))),
+            "dropped_inline_comments": int(formatted.get("dropped_inline_comments", 0) or 0),
+        }
+
+    def _extract_event(self, payload: dict[str, Any]) -> dict[str, Any]:
+        if not isinstance(payload, dict):
+            return {
+                "status": "error",
+                "error_code": "GITHUB_EVENT_INVALID",
+                "message": "GitHub event payload must be an object.",
+            }
+        pull_request = payload.get("pull_request")
+        repository = payload.get("repository")
+        if not isinstance(pull_request, dict) or not isinstance(repository, dict):
+            return {
+                "status": "error",
+                "error_code": "GITHUB_EVENT_INVALID",
+                "message": "GitHub event payload must include pull_request and repository.",
+            }
+
+        action = str(payload.get("action", "")).strip()
+        repo = str(repository.get("full_name", "")).strip()
+        pr_number = pull_request.get("number")
+        head = pull_request.get("head")
+        if not isinstance(head, dict):
+            head = {}
+        head_sha = str(head.get("sha", "")).strip()
+
+        if not action or not repo or not isinstance(pr_number, int) or not head_sha:
+            return {
+                "status": "error",
+                "error_code": "GITHUB_EVENT_INVALID",
+                "message": "GitHub event payload missing action, repository name, PR number, or head sha.",
+            }
+
+        return {
+            "status": "ok",
+            "action": action,
+            "repo": repo,
+            "pr_number": pr_number,
+            "head_sha": head_sha,
+        }
+
+    def _post_review(
+        self,
+        *,
+        repo: str,
+        pr_number: int,
+        token: str,
+        event: str,
+        body: str,
+        inline_comments: list[dict[str, object]],
+    ) -> dict[str, object]:
+        url = f"{self.api_base}/repos/{repo}/pulls/{pr_number}/reviews"
+        headers = self._headers(token)
+        payload = {
+            "event": event,
+            "body": body,
+            "comments": inline_comments,
+        }
+        return self._post(url=url, payload=payload, expected_field="id", error_code="GITHUB_REVIEW_POST_FAILED", headers=headers)
+
+    def _post_check_run(
+        self,
+        *,
+        repo: str,
+        token: str,
+        head_sha: str,
+        review_status: str,
+        body: str,
+    ) -> dict[str, object]:
+        url = f"{self.api_base}/repos/{repo}/check-runs"
+        conclusion = {
+            "approved": "success",
+            "rejected": "failure",
+            "pending": "neutral",
+        }.get(review_status, "neutral")
+        payload = {
+            "name": "OMG PR Reviewer",
+            "head_sha": head_sha,
+            "status": "completed",
+            "conclusion": conclusion,
+            "output": {
+                "title": "OMG PR Reviewer verdict",
+                "summary": body[:65000],
+            },
+        }
+        headers = self._headers(token)
+        return self._post(url=url, payload=payload, expected_field="id", error_code="GITHUB_CHECK_RUN_POST_FAILED", headers=headers)
+
+    def _dismiss_review(self, *, repo: str, pr_number: int, review_id: int) -> dict[str, object]:
+        token_result = get_github_token(session=self.session)
+        if token_result.get("status") != "ok":
+            return token_result
+        token = str(token_result.get("token", "")).strip()
+        if not token:
+            return {
+                "status": "error",
+                "error_code": "GITHUB_TOKEN_EMPTY",
+                "message": "GitHub token is empty.",
+            }
+
+        url = f"{self.api_base}/repos/{repo}/pulls/{pr_number}/reviews/{review_id}/dismissals"
+        payload = {
+            "message": "New commits were pushed; previous approval is stale.",
+        }
+        headers = self._headers(token)
+        return self._post(
+            url=url,
+            payload=payload,
+            expected_field="id",
+            error_code="GITHUB_REVIEW_DISMISS_FAILED",
+            headers=headers,
+        )
+
+    def _post(
+        self,
+        *,
+        url: str,
+        payload: Mapping[str, object],
+        expected_field: str,
+        error_code: str,
+        headers: dict[str, str],
+    ) -> dict[str, object]:
+        try:
+            response = self.session.post(url, headers=headers, json=payload, timeout=20)
+        except Exception as exc:
+            return {
+                "status": "error",
+                "error_code": error_code,
+                "message": f"GitHub API call failed: {exc}",
+            }
+
+        if int(getattr(response, "status_code", 0)) >= 400:
+            return {
+                "status": "error",
+                "error_code": error_code,
+                "http_status": int(getattr(response, "status_code", 0)),
+                "message": "GitHub API rejected request.",
+                "response_excerpt": str(getattr(response, "text", ""))[:300],
+            }
+        try:
+            payload_json = response.json()
+        except Exception:
+            payload_json = None
+        if not isinstance(payload_json, dict):
+            return {
+                "status": "error",
+                "error_code": error_code,
+                "message": "GitHub API response was not valid JSON.",
+            }
+
+        value = payload_json.get(expected_field)
+        if not isinstance(value, int):
+            return {
+                "status": "error",
+                "error_code": error_code,
+                "message": f"GitHub API response missing '{expected_field}'.",
+            }
+        key = "review_id" if "review" in url and "dismissals" not in url else "check_run_id"
+        if "dismissals" in url:
+            key = "dismissed_review_id"
+        return {
+            "status": "ok",
+            key: value,
+        }
+
+    def _to_int(self, value: object) -> int | None:
+        if isinstance(value, int):
+            return value
+        return None
+
+    def _to_review_status(self, value: str) -> ReviewStatus:
+        if value == "approved":
+            return "approved"
+        if value == "rejected":
+            return "rejected"
+        if value == "stale":
+            return "stale"
+        return "pending"
+
+    def _headers(self, token: str) -> dict[str, str]:
+        return {
+            "Accept": "application/vnd.github+json",
+            "Authorization": f"Bearer {token}",
+            "X-GitHub-Api-Version": "2022-11-28",
+        }
+
+
+__all__ = ["GitHubReviewBot"]

package/runtime/github_review_contract.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal
+
+
+ReviewStatus = Literal["pending", "approved", "rejected", "stale"]
+
+
+@dataclass(slots=True)
+class GitHubReviewState:
+    head_sha: str
+    review_id: int | None
+    check_run_id: int | None
+    status: ReviewStatus
+
+
+class GitHubReviewContract:
+    def __init__(self) -> None:
+        self._state_by_pr: dict[int, GitHubReviewState] = {}
+
+    def get_state(self, pr_number: int) -> GitHubReviewState | None:
+        return self._state_by_pr.get(pr_number)
+
+    def should_skip_sha(self, pr_number: int, head_sha: str) -> bool:
+        current = self._state_by_pr.get(pr_number)
+        if current is None:
+            return False
+        return current.head_sha == head_sha and current.status in {"pending", "approved", "rejected"}
+
+    def mark_stale_for_new_sha(self, pr_number: int, new_head_sha: str) -> dict[str, object]:
+        current = self._state_by_pr.get(pr_number)
+        if current is None or current.head_sha == new_head_sha:
+            return {"marked": False}
+
+        stale_review_id = current.review_id
+        stale_status = current.status
+        current.status = "stale"
+        return {
+            "marked": True,
+            "stale_review_id": stale_review_id,
+            "stale_status": stale_status,
+            "stale_sha": current.head_sha,
+        }
+
+    def record_review(
+        self,
+        *,
+        pr_number: int,
+        head_sha: str,
+        review_id: int | None,
+        check_run_id: int | None,
+        status: ReviewStatus,
+    ) -> GitHubReviewState:
+        state = GitHubReviewState(
+            head_sha=head_sha,
+            review_id=review_id,
+            check_run_id=check_run_id,
+            status=status,
+        )
+        self._state_by_pr[pr_number] = state
+        return state
+
+
+__all__ = ["GitHubReviewContract", "GitHubReviewState", "ReviewStatus"]