@trac3er/oh-my-god 2.2.3 → 2.2.4

package/build/lib/runtime/github_integration.py

@@ -1,255 +0,0 @@
-from __future__ import annotations
-
-import base64
-import json
-import os
-import time
-from collections.abc import Mapping
-from datetime import UTC, datetime, timedelta
-from typing import Any, cast
-
-import requests
-from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.asymmetric import padding
-from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
-
-
-_TOKEN_CACHE: dict[str, object] = {
-    "token": "",
-    "expires_at": 0.0,
-}
-
-
-def get_github_token(
-    *,
-    session: Any | None = None,
-    env: Mapping[str, str] | None = None,
-    now: datetime | None = None,
-    max_retries: int = 2,
-) -> dict[str, object]:
-    source_env = env if env is not None else os.environ
-    current_time = now or datetime.now(UTC)
-
-    app_id = str(source_env.get("GITHUB_APP_ID", "")).strip()
-    private_key = str(source_env.get("GITHUB_APP_PRIVATE_KEY", "")).strip()
-    installation_id = str(source_env.get("GITHUB_INSTALLATION_ID", "")).strip()
-
-    missing: list[str] = []
-    if not app_id:
-        missing.append("GITHUB_APP_ID")
-    if not private_key:
-        missing.append("GITHUB_APP_PRIVATE_KEY")
-    if not installation_id:
-        missing.append("GITHUB_INSTALLATION_ID")
-    if missing:
-        return {
-            "status": "error",
-            "error_code": "GITHUB_CREDENTIALS_MISSING",
-            "message": "GitHub App credentials are missing.",
-            "missing": missing,
-        }
-
-    if _token_is_valid(current_time):
-        return {
-            "status": "ok",
-            "token": str(_TOKEN_CACHE["token"]),
-            "expires_at": _TOKEN_CACHE["expires_at"],
-            "source": "cache",
-        }
-
-    normalized_private_key = private_key.replace("\\n", "\n")
-    jwt_result = _build_app_jwt(app_id=app_id, private_key_pem=normalized_private_key, now=current_time)
-    if jwt_result.get("status") != "ok":
-        return jwt_result
-
-    client = session if session is not None else requests
-    token_result = _exchange_installation_token(
-        session=client,
-        app_jwt=str(jwt_result["jwt"]),
-        installation_id=installation_id,
-        max_retries=max_retries,
-    )
-    if token_result.get("status") != "ok":
-        return token_result
-
-    token = str(token_result.get("token", "")).strip()
-    expires_at_epoch = _to_float(token_result.get("expires_at_epoch"))
-    _TOKEN_CACHE["token"] = token
-    _TOKEN_CACHE["expires_at"] = expires_at_epoch
-    return {
-        "status": "ok",
-        "token": token,
-        "expires_at": expires_at_epoch,
-        "source": "fresh",
-    }
-
-
-def _token_is_valid(now: datetime) -> bool:
-    token = str(_TOKEN_CACHE.get("token", "")).strip()
-    expires_at = _to_float(_TOKEN_CACHE.get("expires_at"))
-    if not token or expires_at <= 0:
-        return False
-    return expires_at > now.timestamp() + 60.0
-
-
-def _build_app_jwt(*, app_id: str, private_key_pem: str, now: datetime) -> dict[str, object]:
-    try:
-        key_obj = serialization.load_pem_private_key(private_key_pem.encode("utf-8"), password=None)
-    except Exception as exc:
-        return {
-            "status": "error",
-            "error_code": "GITHUB_APP_PRIVATE_KEY_INVALID",
-            "message": f"Unable to parse GitHub App private key: {exc}",
-        }
-    if not isinstance(key_obj, RSAPrivateKey):
-        return {
-            "status": "error",
-            "error_code": "GITHUB_APP_PRIVATE_KEY_INVALID",
-            "message": "GitHub App private key must be RSA.",
-        }
-    key = cast(RSAPrivateKey, key_obj)
-
-    header = {"alg": "RS256", "typ": "JWT"}
-    payload = {
-        "iat": int((now - timedelta(seconds=60)).timestamp()),
-        "exp": int((now + timedelta(minutes=9)).timestamp()),
-        "iss": app_id,
-    }
-    signing_input = f"{_b64url_json(header)}.{_b64url_json(payload)}"
-    try:
-        signature = key.sign(signing_input.encode("ascii"), padding.PKCS1v15(), hashes.SHA256())
-    except Exception as exc:
-        return {
-            "status": "error",
-            "error_code": "GITHUB_JWT_SIGNING_FAILED",
-            "message": f"Failed to sign GitHub App JWT: {exc}",
-        }
-    jwt_token = f"{signing_input}.{_b64url_bytes(signature)}"
-    return {
-        "status": "ok",
-        "jwt": jwt_token,
-    }
-
-
-def _exchange_installation_token(
-    *,
-    session: Any,
-    app_jwt: str,
-    installation_id: str,
-    max_retries: int,
-) -> dict[str, object]:
-    url = f"https://api.github.com/app/installations/{installation_id}/access_tokens"
-    headers = {
-        "Accept": "application/vnd.github+json",
-        "Authorization": f"Bearer {app_jwt}",
-        "X-GitHub-Api-Version": "2022-11-28",
-    }
-
-    attempts = max(0, int(max_retries)) + 1
-    for attempt in range(1, attempts + 1):
-        try:
-            response = session.post(url, headers=headers, timeout=20)
-        except Exception as exc:
-            if attempt >= attempts:
-                return {
-                    "status": "error",
-                    "error_code": "GITHUB_TOKEN_REQUEST_FAILED",
-                    "message": f"Failed to request installation token: {exc}",
-                }
-            time.sleep(1.0)
-            continue
-
-        if _is_rate_limited(response) and attempt < attempts:
-            delay = _retry_after_seconds(response)
-            time.sleep(delay)
-            continue
-
-        if int(getattr(response, "status_code", 0)) >= 400:
-            return {
-                "status": "error",
-                "error_code": "GITHUB_TOKEN_REQUEST_REJECTED",
-                "http_status": int(getattr(response, "status_code", 0)),
-                "message": "GitHub rejected installation token request.",
-                "response_excerpt": str(getattr(response, "text", ""))[:300],
-            }
-
-        try:
-            payload = response.json()
-        except Exception:
-            payload = None
-        if not isinstance(payload, dict):
-            return {
-                "status": "error",
-                "error_code": "GITHUB_TOKEN_RESPONSE_INVALID",
-                "message": "GitHub token response was not valid JSON.",
-            }
-
-        token = str(payload.get("token", "")).strip()
-        expires_at = str(payload.get("expires_at", "")).strip()
-        if not token or not expires_at:
-            return {
-                "status": "error",
-                "error_code": "GITHUB_TOKEN_RESPONSE_INVALID",
-                "message": "GitHub token response missing token or expires_at.",
-            }
-
-        expires_at_epoch = _parse_iso8601(expires_at)
-        return {
-            "status": "ok",
-            "token": token,
-            "expires_at_epoch": expires_at_epoch,
-        }
-
-    return {
-        "status": "error",
-        "error_code": "GITHUB_TOKEN_REQUEST_FAILED",
-        "message": "GitHub installation token request exhausted retries.",
-    }
-
-
-def _is_rate_limited(response: Any) -> bool:
-    status = int(getattr(response, "status_code", 0))
-    headers = getattr(response, "headers", {}) or {}
-    remaining = str(headers.get("X-RateLimit-Remaining", "")).strip()
-    return status == 429 or (status == 403 and remaining == "0")
-
-
-def _retry_after_seconds(response: Any) -> float:
-    headers = getattr(response, "headers", {}) or {}
-    retry_after = str(headers.get("Retry-After", "")).strip()
-    try:
-        value = float(retry_after)
-    except ValueError:
-        value = 1.0
-    return max(0.2, value)
-
-
-def _parse_iso8601(value: str) -> float:
-    text = value.strip().replace("Z", "+00:00")
-    parsed = datetime.fromisoformat(text)
-    if parsed.tzinfo is None:
-        parsed = parsed.replace(tzinfo=UTC)
-    return parsed.timestamp()
-
-
-def _b64url_json(payload: Mapping[str, object]) -> str:
-    raw = json.dumps(payload, separators=(",", ":"), ensure_ascii=True).encode("utf-8")
-    return _b64url_bytes(raw)
-
-
-def _b64url_bytes(raw: bytes) -> str:
-    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
-
-
-def _to_float(value: object) -> float:
-    if isinstance(value, (int, float)):
-        return float(value)
-    if isinstance(value, str):
-        try:
-            return float(value)
-        except ValueError:
-            return 0.0
-    return 0.0
-
-
-__all__ = ["get_github_token"]

package/build/lib/runtime/github_review_bot.py

@@ -1,290 +0,0 @@
-from __future__ import annotations
-
-from collections.abc import Mapping
-from typing import Any
-
-import requests
-
-from runtime.github_integration import get_github_token
-from runtime.github_review_contract import GitHubReviewContract, ReviewStatus
-from runtime.github_review_formatter import format_review_payload
-
-
-class GitHubReviewBot:
-    def __init__(self, *, session: Any | None = None, api_base: str = "https://api.github.com") -> None:
-        self.session = session if session is not None else requests
-        self.api_base = api_base.rstrip("/")
-        self.contract = GitHubReviewContract()
-
-    def process_pull_request_event(self, event_payload: dict[str, Any], evidence: dict[str, Any]) -> dict[str, Any]:
-        event = self._extract_event(event_payload)
-        if event.get("status") != "ok":
-            return event
-
-        repo = str(event["repo"])
-        pr_number = int(event["pr_number"])
-        head_sha = str(event["head_sha"])
-        action = str(event["action"])
-
-        if action == "synchronize":
-            stale = self.contract.mark_stale_for_new_sha(pr_number, head_sha)
-            if stale.get("marked") and stale.get("stale_status") == "approved":
-                stale_review_id = stale.get("stale_review_id")
-                if isinstance(stale_review_id, int):
-                    _ = self._dismiss_review(repo=repo, pr_number=pr_number, review_id=stale_review_id)
-
-        if self.contract.should_skip_sha(pr_number, head_sha):
-            state = self.contract.get_state(pr_number)
-            return {
-                "status": "skipped",
-                "reason": "duplicate_sha",
-                "repo": repo,
-                "pr_number": pr_number,
-                "head_sha": head_sha,
-                "review_id": state.review_id if state is not None else None,
-                "check_run_id": state.check_run_id if state is not None else None,
-            }
-
-        token_result = get_github_token(session=self.session)
-        if token_result.get("status") != "ok":
-            return token_result
-        token = str(token_result.get("token", "")).strip()
-        if not token:
-            return {
-                "status": "error",
-                "error_code": "GITHUB_TOKEN_EMPTY",
-                "message": "GitHub token is empty.",
-            }
-
-        formatted = format_review_payload(evidence)
-        if formatted.get("status") != "ok":
-            return formatted
-
-        review_result = self._post_review(
-            repo=repo,
-            pr_number=pr_number,
-            token=token,
-            event=str(formatted["review_event"]),
-            body=str(formatted["body"]),
-            inline_comments=list(formatted.get("inline_comments", [])),
-        )
-        if review_result.get("status") != "ok":
-            return review_result
-
-        check_result = self._post_check_run(
-            repo=repo,
-            token=token,
-            head_sha=head_sha,
-            review_status=str(formatted["review_status"]),
-            body=str(formatted["body"]),
-        )
-        if check_result.get("status") != "ok":
-            return check_result
-
-        review_status = self._to_review_status(str(formatted["review_status"]))
-        state = self.contract.record_review(
-            pr_number=pr_number,
-            head_sha=head_sha,
-            review_id=self._to_int(review_result.get("review_id")),
-            check_run_id=self._to_int(check_result.get("check_run_id")),
-            status=review_status,
-        )
-
-        return {
-            "status": "ok",
-            "repo": repo,
-            "pr_number": pr_number,
-            "head_sha": head_sha,
-            "review_id": state.review_id,
-            "check_run_id": state.check_run_id,
-            "review_status": state.status,
-            "inline_comment_count": len(list(formatted.get("inline_comments", []))),
-            "dropped_inline_comments": int(formatted.get("dropped_inline_comments", 0) or 0),
-        }
-
-    def _extract_event(self, payload: dict[str, Any]) -> dict[str, Any]:
-        if not isinstance(payload, dict):
-            return {
-                "status": "error",
-                "error_code": "GITHUB_EVENT_INVALID",
-                "message": "GitHub event payload must be an object.",
-            }
-        pull_request = payload.get("pull_request")
-        repository = payload.get("repository")
-        if not isinstance(pull_request, dict) or not isinstance(repository, dict):
-            return {
-                "status": "error",
-                "error_code": "GITHUB_EVENT_INVALID",
-                "message": "GitHub event payload must include pull_request and repository.",
-            }
-
-        action = str(payload.get("action", "")).strip()
-        repo = str(repository.get("full_name", "")).strip()
-        pr_number = pull_request.get("number")
-        head = pull_request.get("head")
-        if not isinstance(head, dict):
-            head = {}
-        head_sha = str(head.get("sha", "")).strip()
-
-        if not action or not repo or not isinstance(pr_number, int) or not head_sha:
-            return {
-                "status": "error",
-                "error_code": "GITHUB_EVENT_INVALID",
-                "message": "GitHub event payload missing action, repository name, PR number, or head sha.",
-            }
-
-        return {
-            "status": "ok",
-            "action": action,
-            "repo": repo,
-            "pr_number": pr_number,
-            "head_sha": head_sha,
-        }
-
-    def _post_review(
-        self,
-        *,
-        repo: str,
-        pr_number: int,
-        token: str,
-        event: str,
-        body: str,
-        inline_comments: list[dict[str, object]],
-    ) -> dict[str, object]:
-        url = f"{self.api_base}/repos/{repo}/pulls/{pr_number}/reviews"
-        headers = self._headers(token)
-        payload = {
-            "event": event,
-            "body": body,
-            "comments": inline_comments,
-        }
-        return self._post(url=url, payload=payload, expected_field="id", error_code="GITHUB_REVIEW_POST_FAILED", headers=headers)
-
-    def _post_check_run(
-        self,
-        *,
-        repo: str,
-        token: str,
-        head_sha: str,
-        review_status: str,
-        body: str,
-    ) -> dict[str, object]:
-        url = f"{self.api_base}/repos/{repo}/check-runs"
-        conclusion = {
-            "approved": "success",
-            "rejected": "failure",
-            "pending": "neutral",
-        }.get(review_status, "neutral")
-        payload = {
-            "name": "OMG PR Reviewer",
-            "head_sha": head_sha,
-            "status": "completed",
-            "conclusion": conclusion,
-            "output": {
-                "title": "OMG PR Reviewer verdict",
-                "summary": body[:65000],
-            },
-        }
-        headers = self._headers(token)
-        return self._post(url=url, payload=payload, expected_field="id", error_code="GITHUB_CHECK_RUN_POST_FAILED", headers=headers)
-
-    def _dismiss_review(self, *, repo: str, pr_number: int, review_id: int) -> dict[str, object]:
-        token_result = get_github_token(session=self.session)
-        if token_result.get("status") != "ok":
-            return token_result
-        token = str(token_result.get("token", "")).strip()
-        if not token:
-            return {
-                "status": "error",
-                "error_code": "GITHUB_TOKEN_EMPTY",
-                "message": "GitHub token is empty.",
-            }
-
-        url = f"{self.api_base}/repos/{repo}/pulls/{pr_number}/reviews/{review_id}/dismissals"
-        payload = {
-            "message": "New commits were pushed; previous approval is stale.",
-        }
-        headers = self._headers(token)
-        return self._post(
-            url=url,
-            payload=payload,
-            expected_field="id",
-            error_code="GITHUB_REVIEW_DISMISS_FAILED",
-            headers=headers,
-        )
-
-    def _post(
-        self,
-        *,
-        url: str,
-        payload: Mapping[str, object],
-        expected_field: str,
-        error_code: str,
-        headers: dict[str, str],
-    ) -> dict[str, object]:
-        try:
-            response = self.session.post(url, headers=headers, json=payload, timeout=20)
-        except Exception as exc:
-            return {
-                "status": "error",
-                "error_code": error_code,
-                "message": f"GitHub API call failed: {exc}",
-            }
-
-        if int(getattr(response, "status_code", 0)) >= 400:
-            return {
-                "status": "error",
-                "error_code": error_code,
-                "http_status": int(getattr(response, "status_code", 0)),
-                "message": "GitHub API rejected request.",
-                "response_excerpt": str(getattr(response, "text", ""))[:300],
-            }
-        try:
-            payload_json = response.json()
-        except Exception:
-            payload_json = None
-        if not isinstance(payload_json, dict):
-            return {
-                "status": "error",
-                "error_code": error_code,
-                "message": "GitHub API response was not valid JSON.",
-            }
-
-        value = payload_json.get(expected_field)
-        if not isinstance(value, int):
-            return {
-                "status": "error",
-                "error_code": error_code,
-                "message": f"GitHub API response missing '{expected_field}'.",
-            }
-        key = "review_id" if "review" in url and "dismissals" not in url else "check_run_id"
-        if "dismissals" in url:
-            key = "dismissed_review_id"
-        return {
-            "status": "ok",
-            key: value,
-        }
-
-    def _to_int(self, value: object) -> int | None:
-        if isinstance(value, int):
-            return value
-        return None
-
-    def _to_review_status(self, value: str) -> ReviewStatus:
-        if value == "approved":
-            return "approved"
-        if value == "rejected":
-            return "rejected"
-        if value == "stale":
-            return "stale"
-        return "pending"
-
-    def _headers(self, token: str) -> dict[str, str]:
-        return {
-            "Accept": "application/vnd.github+json",
-            "Authorization": f"Bearer {token}",
-            "X-GitHub-Api-Version": "2022-11-28",
-        }
-
-
-__all__ = ["GitHubReviewBot"]

package/build/lib/runtime/github_review_contract.py

@@ -1,65 +0,0 @@
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Literal
-
-
-ReviewStatus = Literal["pending", "approved", "rejected", "stale"]
-
-
-@dataclass(slots=True)
-class GitHubReviewState:
-    head_sha: str
-    review_id: int | None
-    check_run_id: int | None
-    status: ReviewStatus
-
-
-class GitHubReviewContract:
-    def __init__(self) -> None:
-        self._state_by_pr: dict[int, GitHubReviewState] = {}
-
-    def get_state(self, pr_number: int) -> GitHubReviewState | None:
-        return self._state_by_pr.get(pr_number)
-
-    def should_skip_sha(self, pr_number: int, head_sha: str) -> bool:
-        current = self._state_by_pr.get(pr_number)
-        if current is None:
-            return False
-        return current.head_sha == head_sha and current.status in {"pending", "approved", "rejected"}
-
-    def mark_stale_for_new_sha(self, pr_number: int, new_head_sha: str) -> dict[str, object]:
-        current = self._state_by_pr.get(pr_number)
-        if current is None or current.head_sha == new_head_sha:
-            return {"marked": False}
-
-        stale_review_id = current.review_id
-        stale_status = current.status
-        current.status = "stale"
-        return {
-            "marked": True,
-            "stale_review_id": stale_review_id,
-            "stale_status": stale_status,
-            "stale_sha": current.head_sha,
-        }
-
-    def record_review(
-        self,
-        *,
-        pr_number: int,
-        head_sha: str,
-        review_id: int | None,
-        check_run_id: int | None,
-        status: ReviewStatus,
-    ) -> GitHubReviewState:
-        state = GitHubReviewState(
-            head_sha=head_sha,
-            review_id=review_id,
-            check_run_id=check_run_id,
-            status=status,
-        )
-        self._state_by_pr[pr_number] = state
-        return state
-
-
-__all__ = ["GitHubReviewContract", "GitHubReviewState", "ReviewStatus"]