autonomous-sdlc-harness 0.6.2 → 0.6.4

package/templates/scripts/push-branch.sh

@@ -28,7 +28,28 @@
 # must NEVER abort the calling run — a stale remote is recoverable and a halted
 # run is not. That is why this script uses `set -uo pipefail` deliberately
 # WITHOUT `set -e`, and why even the fail-closed arm below exits 0: it refuses
-# to push, which is the closed outcome here, and says so.
+# to push, which is the closed outcome here, and says so. A push the remote
+# refused for any reason but a `[rejected]` ref is attempted up to
+# PUSH_ATTEMPTS times in all — waiting PUSH_RETRY_DELAY_SECS before the second
+# attempt and three times that before the third — and is still never fatal once
+# given up. PUSH_RETRY_DELAY_SECS is read from the environment as a test and
+# tuning seam: default 5, and anything but a non-negative integer falls back to
+# 5 with one line.
+#
+# A BRANCH ITS REMOTE DELETED STAYS DELETED. A branch this checkout tracks on
+# its remote is never pushed when that remote no longer lists it. It tracks one
+# when `branch.<branch>.merge` is set, or when `refs/remotes/origin/<branch>`
+# resolves; a branch with neither is a first push and is not checked. The remote
+# asked is `branch.<branch>.remote` (else `origin`), for `branch.<branch>.merge`
+# (else `refs/heads/<branch>`), once with `ls-remote --exit-code` before any
+# push attempt. Exit 2 (not listed) skips the push with one line naming the hand
+# push that publishes it again; any other failure is not evidence of a deletion,
+# so the push goes ahead and reports its own result. Reason: Gate 12 round 9,
+# finding 1 — a run stopped because its branch was deleted had that branch
+# re-created by the job's `always()` push step. Accepted costs: a deletion that
+# lands between the `ls-remote` and the push is still pushed back; and a local
+# branch reusing the name of one deleted on origin is not pushed while its stale
+# `refs/remotes/origin/<branch>` survives — the skip line names the hand push.
 #
 # DEFENCE IN DEPTH, NOT THE SOLE GUARD. The caller-agnostic backstop is the
 # committed pre-push hook `init` writes into the configured `githooksDir`, which
@@ -52,7 +73,12 @@
 #
 # WHAT IT NEVER DOES. It performs only a fast-forward push of already-committed
 # work: no `--force`, no `--force-with-lease`, no history-rewriting flag, no
-# commit of its own, and no non-zero exit.
+# commit of its own, and no non-zero exit, and never pushes back a branch it
+# tracks after its remote deleted it. It never retries a push git reports
+# as `! [rejected]` (non-fast-forward, fetch first), and never fetches or
+# rebases: a push that lost a race fails loudly, which is the run-control rule
+# of record (docs/github-run-control.md -> "A push that loses a race fails
+# loudly, and is never fetched, rebased or retried").
 #
 # Usage: push-branch.sh [<repo-dir>]
 #   <repo-dir>  worktree/repository to operate in (default: $PWD)
@@ -67,15 +93,44 @@
 #   no upstream yet   push-branch.sh "$d"   -> exit 0; `git -C "$b" branch` lists
 #                     feat_x and the branch now has an upstream
 #   nothing new       push-branch.sh "$d"   -> exit 0 ("everything up to date")
+#   deleted on origin git -C "$b" update-ref -d refs/heads/feat_x; push-branch.sh "$d"
+#                     -> exit 0, a "no longer has feat_x" line, and
+#                     `git -C "$b" branch` lists no feat_x
 #   protected branch  git -C "$d" checkout -q -b trunk; push-branch.sh "$d"
 #                     -> exit 0, refusal message, "$b" unchanged
 #   unresolvable      printf 'x' > "$d/harness.config.json"; push-branch.sh "$d"
 #                     -> exit 0, refusal message, nothing pushed
 #   push fails        git -C "$d" remote set-url origin /nonexistent.git
 #                     -> exit 0 with a visible failure line
+#   refused once      printf '%s\n' '#!/bin/sh' 'c="$GIT_DIR/refusals"' \
+#                       '[ -e "$c" ] && exit 0' ': > "$c"; exit 1' > "$b/hooks/pre-receive"
+#                     chmod +x "$b/hooks/pre-receive"
+#                     git -C "$d" commit -qm x --allow-empty
+#                     PUSH_RETRY_DELAY_SECS=0 push-branch.sh "$d"
+#                     -> exit 0, one "retrying" line, and `git -C "$b" rev-parse
+#                     feat_x` equals `git -C "$d" rev-parse HEAD`
+#   remote moved      c=$(mktemp -d); git clone -q -b feat_x "$b" "$c"
+#                     git -C "$c" commit -qm other --allow-empty; git -C "$c" push -q
+#                     git -C "$d" commit -qm mine --allow-empty; push-branch.sh "$d"
+#                     -> exit 0, a "(not retried)" line, one push attempt
 
 set -uo pipefail
 
+# Attempts in all, and the wait before the second; the third waits three times
+# that (EVERY FAILURE PATH IS NON-FATAL above).
+PUSH_ATTEMPTS=3
+PUSH_RETRY_DELAY_SECS="${PUSH_RETRY_DELAY_SECS:-5}"
+case "$PUSH_RETRY_DELAY_SECS" in
+  '' | *[!0-9]*)
+    echo "push-branch.sh: PUSH_RETRY_DELAY_SECS='$PUSH_RETRY_DELAY_SECS' is not a non-negative integer — using 5"
+    PUSH_RETRY_DELAY_SECS=5
+    ;;
+  *)
+    # Base 10, so a leading zero is not read as octal.
+    PUSH_RETRY_DELAY_SECS=$((10#$PUSH_RETRY_DELAY_SECS))
+    ;;
+esac
+
 # The library is reached by a path computed from this script's own location — no
 # session root, and no runtime-substituted token, is assumed. Not finding it is
 # non-fatal like everything else here.
@@ -121,20 +176,64 @@ case "$protected" in
     ;;
 esac
 
-# Push the branch. Use the existing upstream when one is configured; otherwise
-# set it on the fly, so a branch with no upstream is still pushed. Fast-forward
-# only.
-if git -C "$top" rev-parse --abbrev-ref --symbolic-full-name '@{u}' >/dev/null 2>&1; then
-  git -C "$top" push
-else
-  git -C "$top" push --set-upstream origin "$branch"
+# A BRANCH ITS REMOTE DELETED STAYS DELETED (header). Once, before the retry
+# loop; a branch tracking nothing is a first push and skips the check.
+track_merge="$(git -C "$top" config --get "branch.$branch.merge" 2>/dev/null)"
+if [ -n "$track_merge" ] ||
+  git -C "$top" rev-parse --verify --quiet "refs/remotes/origin/$branch" >/dev/null 2>&1; then
+  track_remote="$(git -C "$top" config --get "branch.$branch.remote" 2>/dev/null)"
+  [ -n "$track_remote" ] || track_remote=origin
+  track_ref="${track_merge:-refs/heads/$branch}"
+  git -C "$top" ls-remote --exit-code --heads "$track_remote" "$track_ref" >/dev/null 2>&1
+  ls_status=$?
+  case "$ls_status" in
+    0) ;;
+    2)
+      echo "push-branch.sh: $track_remote no longer has $branch, which this checkout tracks; not pushing it back (a branch deleted on its remote stays deleted). To publish it again on purpose: git push --set-upstream $track_remote $branch"
+      exit 0
+      ;;
+    *)
+      echo "push-branch.sh: could not ask $track_remote whether it still has $branch (ls-remote exited $ls_status); pushing as before"
+      ;;
+  esac
 fi
-push_status=$?
 
-if [ "$push_status" -eq 0 ]; then
-  echo "push-branch.sh: pushed $branch to origin"
+# Push the branch; the deleted-on-its-remote check above has already run. Use
+# the existing upstream when one is configured; otherwise set it on the fly, so
+# a branch with no upstream is still pushed. Fast-forward only.
+if git -C "$top" rev-parse --abbrev-ref --symbolic-full-name '@{u}' >/dev/null 2>&1; then
+  push_cmd=(git -C "$top" push)
 else
-  # Visible but non-blocking: a push problem must never abort the calling run.
-  echo "push-branch.sh: push failed for $branch (see output above)"
+  push_cmd=(git -C "$top" push --set-upstream origin "$branch")
 fi
+
+# Every failure line keeps the `push failed for <branch>` prefix: logs and
+# Gate 12 records quote it.
+attempt=1
+delay="$PUSH_RETRY_DELAY_SECS"
+while :; do
+  push_out="$("${push_cmd[@]}" 2>&1)"
+  push_status=$?
+  # git writes its ref-status lines to stderr; keep them there.
+  [ -n "$push_out" ] && printf '%s\n' "$push_out" >&2
+
+  if [ "$push_status" -eq 0 ]; then
+    echo "push-branch.sh: pushed $branch to origin"
+    break
+  fi
+  # A here-string, not a pipe: `grep -q` exiting early would fail a pipeline
+  # under pipefail.
+  if grep -q '^ ! \[rejected\]' <<<"$push_out"; then
+    echo "push-branch.sh: push failed for $branch: origin has commits this branch does not (not retried)"
+    break
+  fi
+  if [ "$attempt" -ge "$PUSH_ATTEMPTS" ]; then
+    echo "push-branch.sh: push failed for $branch after $PUSH_ATTEMPTS attempts (see output above)"
+    break
+  fi
+  echo "push-branch.sh: push failed for $branch (attempt $attempt of $PUSH_ATTEMPTS); retrying in ${delay}s"
+  sleep "$delay"
+  attempt=$((attempt + 1))
+  delay=$((delay * 3))
+done
 exit 0