claude-dev-env 4.3.0 → 7.1.0

package/scripts/automatic_advisory/runner.py

@@ -0,0 +1,399 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+from typing import Protocol
+
+from pr_verification.config.constants import LOCAL_CHECKS_PASSED_LABEL
+from pr_verification.lock import SupervisorLock
+from pr_verification.model import PullRequestCandidate, RepositorySettings
+
+from .checkout import read_local_checkout as _read_local_checkout
+from .config.constants import (
+    GIT_BASE_REF_TEMPLATE,
+    STATE_REASON_BASE_FETCH_FAILED,
+    STATE_REASON_CHECKOUT_MISMATCH,
+    STATE_REASON_CHILD_INCOMPLETE,
+    STATE_REASON_DIRTY_CHECKOUT,
+    STATE_REASON_GITHUB_UNAVAILABLE,
+    STATE_REASON_PUBLISH_FAILED,
+    STATE_REASON_PULL_REQUEST_CLOSED,
+    STATE_REASON_UNCHANGED,
+    STATE_STATUS_CLOSED,
+    STATE_STATUS_ERROR,
+    STATE_STATUS_OFFLINE,
+    STATE_STATUS_PASSED,
+    STATE_STATUS_WAITING,
+)
+from .execution import _child_produced_report, run_verification_child
+from .git import _fetch_base
+from .model import (
+    AdvisoryRegistration,
+    AdvisorySettings,
+    AdvisoryState,
+    ChildOutcome,
+    candidate_identity_matches_state,
+)
+from .publisher import Publication, _cache_status_for_publication, _publish_report
+from .state import _utc_timestamp
+from .state import read_state as _read_state
+from .state import write_state as _write_state
+
+
+class AdvisoryGitHub(Protocol):
+    def list_open_candidates(
+        self,
+        repository: RepositorySettings,
+        *,
+        should_require_merge_commit: bool = True,
+    ) -> tuple[PullRequestCandidate, ...]: ...
+
+    def remove_label(
+        self, repository: RepositorySettings, pull_request_number: int, label: str
+    ) -> None: ...
+
+
+AdvisoryPublisher = Callable[
+    [object, RepositorySettings, int, Path, Path, Path], Publication
+]
+ChildRunner = Callable[[AdvisoryRegistration, str, float], ChildOutcome]
+AdvisoryGitHubFactory = Callable[[RepositorySettings], AdvisoryGitHub]
+Clock = Callable[[], str]
+
+
+class AutomaticAdvisoryRunner:
+    def __init__(
+        self,
+        settings: AdvisorySettings,
+        github: AdvisoryGitHub | None,
+        *,
+        child_runner: ChildRunner | None = None,
+        publisher: AdvisoryPublisher | None = None,
+        github_factory: AdvisoryGitHubFactory | None = None,
+        clock: Clock | None = None,
+    ) -> None:
+        self.settings = settings
+        self.github = github
+        self.child_runner = child_runner or run_verification_child
+        self.publisher = publisher or _publish_report
+        if github_factory is not None:
+            self.github_factory = github_factory
+        elif github is not None:
+            self.github_factory = lambda _repository: github
+        else:
+            self.github_factory = _github_is_unavailable
+        self.clock = clock or _utc_timestamp
+
+    def run_once(self, should_rerun: bool = False) -> tuple[AdvisoryState, ...]:
+        """Run each registration once and return its persisted state.
+
+        Args:
+            should_rerun: True to force a fresh run for every registration.
+
+        Returns:
+            The persisted state of each registration, in settings order.
+        """
+        return tuple(
+            self.run_registration(each_registration, should_rerun)
+            for each_registration in self.settings.registrations
+        )
+
+    def run_registration(
+        self,
+        registration: AdvisoryRegistration,
+        should_rerun: bool,
+    ) -> AdvisoryState:
+        with SupervisorLock(registration.repository_lock_root):
+            return self._run_registration_locked(registration, should_rerun)
+
+    def _run_registration_locked(
+        self,
+        registration: AdvisoryRegistration,
+        should_rerun: bool,
+    ) -> AdvisoryState:
+        github_or_state = self._get_github(registration)
+        if isinstance(github_or_state, AdvisoryState):
+            return github_or_state
+        github = github_or_state
+        candidate_or_state = self._discover_candidate(registration, github)
+        if isinstance(candidate_or_state, AdvisoryState):
+            return candidate_or_state
+        maybe_previous_state = _read_state(registration.state_path)
+        maybe_invalidation_state = self._invalidate_changed_identity(
+            registration, candidate_or_state, maybe_previous_state, github
+        )
+        if maybe_invalidation_state is not None:
+            return maybe_invalidation_state
+        maybe_blocked_state = self._prepare_candidate(registration, candidate_or_state)
+        if maybe_blocked_state is not None:
+            return maybe_blocked_state
+        return self._run_ready_candidate(
+            registration,
+            candidate_or_state,
+            maybe_previous_state,
+            should_rerun,
+        )
+
+    def _get_github(
+        self, registration: AdvisoryRegistration
+    ) -> AdvisoryGitHub | AdvisoryState:
+        try:
+            return self.github_factory(registration.repository)
+        except (OSError, RuntimeError):
+            return self._save_state(
+                registration,
+                STATE_STATUS_OFFLINE,
+                STATE_REASON_GITHUB_UNAVAILABLE,
+                None,
+                None,
+            )
+
+    def _discover_candidate(
+        self, registration: AdvisoryRegistration, github: AdvisoryGitHub
+    ) -> PullRequestCandidate | AdvisoryState:
+        try:
+            maybe_candidate = self._find_open_candidate(registration, github)
+        except (OSError, RuntimeError):
+            return self._save_state(
+                registration,
+                STATE_STATUS_OFFLINE,
+                STATE_REASON_GITHUB_UNAVAILABLE,
+                None,
+                None,
+            )
+        if maybe_candidate is None:
+            if not self._remove_pass_label_safely(registration, github):
+                return self._save_state(
+                    registration,
+                    STATE_STATUS_ERROR,
+                    STATE_REASON_PUBLISH_FAILED,
+                    None,
+                    None,
+                )
+            return self._save_state(
+                registration,
+                STATE_STATUS_CLOSED,
+                STATE_REASON_PULL_REQUEST_CLOSED,
+                None,
+                None,
+            )
+        return maybe_candidate
+
+    def _run_ready_candidate(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+        maybe_previous_state: AdvisoryState | None,
+        should_rerun: bool,
+    ) -> AdvisoryState:
+        if (
+            not should_rerun
+            and maybe_previous_state is not None
+            and candidate_identity_matches_state(candidate, maybe_previous_state)
+        ):
+            return self._save_state(
+                registration,
+                maybe_previous_state.status,
+                STATE_REASON_UNCHANGED,
+                candidate,
+                maybe_previous_state.last_run,
+            )
+        return self._execute_and_publish(registration, candidate)
+
+    def _invalidate_changed_identity(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+        maybe_previous_state: AdvisoryState | None,
+        github: AdvisoryGitHub,
+    ) -> AdvisoryState | None:
+        if (
+            maybe_previous_state is not None
+            and maybe_previous_state.status == STATE_STATUS_PASSED
+            and candidate_identity_matches_state(candidate, maybe_previous_state)
+        ):
+            return None
+        if self._remove_pass_label_safely(registration, github):
+            return None
+        return self._save_state(
+            registration,
+            STATE_STATUS_ERROR,
+            STATE_REASON_PUBLISH_FAILED,
+            candidate,
+            None,
+        )
+
+    def _execute_and_publish(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+    ) -> AdvisoryState:
+        maybe_child_state = self._run_child(registration, candidate)
+        if maybe_child_state is not None:
+            return maybe_child_state
+        try:
+            fresh_github = self.github_factory(registration.repository)
+        except (OSError, RuntimeError):
+            return self._save_state(
+                registration,
+                STATE_STATUS_OFFLINE,
+                STATE_REASON_GITHUB_UNAVAILABLE,
+                candidate,
+                self.clock(),
+            )
+        return self._publish_and_save(
+            registration,
+            candidate,
+            fresh_github,
+        )
+
+    def _run_child(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+    ) -> AdvisoryState | None:
+        child_outcome = self.child_runner(
+            registration,
+            GIT_BASE_REF_TEMPLATE.format(pull_request=registration.pull_request_number),
+            self.settings.child_timeout_seconds,
+        )
+        if _child_produced_report(child_outcome, registration):
+            return None
+        return self._save_state(
+            registration,
+            STATE_STATUS_ERROR,
+            STATE_REASON_CHILD_INCOMPLETE,
+            candidate,
+            self.clock(),
+        )
+
+    def _prepare_candidate(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+    ) -> AdvisoryState | None:
+        if not _fetch_base(registration, candidate):
+            return self._save_state(
+                registration,
+                STATE_STATUS_OFFLINE,
+                STATE_REASON_BASE_FETCH_FAILED,
+                candidate,
+                None,
+            )
+        return self._check_local_checkout(registration, candidate)
+
+    def _check_local_checkout(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+    ) -> AdvisoryState | None:
+        local_checkout = _read_local_checkout(registration.checkout_path)
+        if not local_checkout.is_clean:
+            return self._save_state(
+                registration,
+                STATE_STATUS_WAITING,
+                STATE_REASON_DIRTY_CHECKOUT,
+                candidate,
+                None,
+            )
+        if local_checkout.head_sha != candidate.head_sha:
+            return self._save_state(
+                registration,
+                STATE_STATUS_WAITING,
+                STATE_REASON_CHECKOUT_MISMATCH,
+                candidate,
+                None,
+            )
+        return None
+
+    def _remove_pass_label_safely(
+        self, registration: AdvisoryRegistration, github: AdvisoryGitHub
+    ) -> bool:
+        try:
+            self._remove_pass_label(registration, github)
+        except (OSError, RuntimeError):
+            return False
+        return True
+
+    def _find_open_candidate(
+        self, registration: AdvisoryRegistration, github: AdvisoryGitHub
+    ) -> PullRequestCandidate | None:
+        all_candidates = github.list_open_candidates(
+            registration.repository,
+            should_require_merge_commit=False,
+        )
+        return next(
+            (
+                each_candidate
+                for each_candidate in all_candidates
+                if each_candidate.pull_request_number
+                == registration.pull_request_number
+            ),
+            None,
+        )
+
+    def _remove_pass_label(
+        self, registration: AdvisoryRegistration, github: AdvisoryGitHub
+    ) -> None:
+        github.remove_label(
+            registration.repository,
+            registration.pull_request_number,
+            LOCAL_CHECKS_PASSED_LABEL,
+        )
+
+    def _publish_and_save(
+        self,
+        registration: AdvisoryRegistration,
+        candidate: PullRequestCandidate,
+        github: AdvisoryGitHub,
+    ) -> AdvisoryState:
+        try:
+            publication = self.publisher(
+                github,
+                registration.repository,
+                registration.pull_request_number,
+                registration.checkout_path,
+                registration.selected_manifest_path,
+                registration.report_path,
+            )
+        except (OSError, RuntimeError):
+            return self._save_state(
+                registration,
+                STATE_STATUS_ERROR,
+                STATE_REASON_PUBLISH_FAILED,
+                candidate,
+                self.clock(),
+            )
+        return self._save_state(
+            registration,
+            _cache_status_for_publication(publication.status),
+            publication.description,
+            candidate,
+            self.clock(),
+        )
+
+    def _save_state(
+        self,
+        registration: AdvisoryRegistration,
+        status: str,
+        reason: str,
+        maybe_candidate: PullRequestCandidate | None,
+        maybe_last_run: str | None,
+    ) -> AdvisoryState:
+        state = AdvisoryState(
+            registration.repository.slug,
+            registration.pull_request_number,
+            status,
+            reason,
+            maybe_candidate.head_sha if maybe_candidate else None,
+            maybe_candidate.base_sha if maybe_candidate else None,
+            self.clock(),
+            maybe_last_run,
+            str(registration.report_path),
+        )
+        _write_state(registration.state_path, state)
+        return state
+
+
+def _github_is_unavailable(_repository: RepositorySettings) -> AdvisoryGitHub:
+    raise RuntimeError("GitHub client factory is unavailable")

package/scripts/automatic_advisory/state.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+import json
+import os
+from collections.abc import Mapping
+from datetime import UTC, datetime
+from pathlib import Path
+
+from .config.constants import (
+    JSON_INDENT_SPACES,
+    REPORT_NEWLINE,
+    STATE_BASE_SHA_KEY,
+    STATE_FILE_SUFFIX,
+    STATE_HEAD_SHA_KEY,
+    STATE_LAST_POLL_KEY,
+    STATE_LAST_RUN_KEY,
+    STATE_PULL_REQUEST_KEY,
+    STATE_REASON_KEY,
+    STATE_REPORT_KEY,
+    STATE_REPOSITORY_KEY,
+    STATE_STATUS_KEY,
+    STATE_VERSION,
+    STATE_VERSION_KEY,
+    UTF8_ENCODING,
+)
+from .model import AdvisoryState
+
+
+def read_state(state_path: Path) -> AdvisoryState | None:
+    """Read one persisted advisory state when its shape is valid.
+
+    Args:
+        state_path: JSON state file to read.
+
+    Returns:
+        Parsed advisory state, or None when the file is absent or invalid.
+    """
+    try:
+        parsed_state = json.loads(state_path.read_text(encoding=UTF8_ENCODING))
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not isinstance(parsed_state, Mapping):
+        return None
+    return _state_from_mapping(parsed_state)
+
+
+def _state_from_mapping(
+    all_state_fields: Mapping[str, object],
+) -> AdvisoryState | None:
+    if all_state_fields.get(STATE_VERSION_KEY) != STATE_VERSION:
+        return None
+    try:
+        repository = _require_state_text(all_state_fields.get(STATE_REPOSITORY_KEY))
+        status = _require_state_text(all_state_fields.get(STATE_STATUS_KEY))
+        reason = _require_state_text(all_state_fields.get(STATE_REASON_KEY))
+        last_poll = _require_state_text(all_state_fields.get(STATE_LAST_POLL_KEY))
+        report_path = _require_state_text(all_state_fields.get(STATE_REPORT_KEY))
+    except TypeError:
+        return None
+    pull_request_number = all_state_fields.get(STATE_PULL_REQUEST_KEY)
+    if not isinstance(pull_request_number, int):
+        return None
+    return AdvisoryState(
+        repository,
+        pull_request_number,
+        status,
+        reason,
+        _optional_text(all_state_fields.get(STATE_HEAD_SHA_KEY)),
+        _optional_text(all_state_fields.get(STATE_BASE_SHA_KEY)),
+        last_poll,
+        _optional_text(all_state_fields.get(STATE_LAST_RUN_KEY)),
+        report_path,
+    )
+
+
+def _require_state_text(state_field: object) -> str:
+    if not isinstance(state_field, str):
+        raise TypeError("state field must be text")
+    return state_field
+
+
+def _optional_text(state_field: object) -> str | None:
+    return state_field if isinstance(state_field, str) else None
+
+
+def write_state(state_path: Path, state: AdvisoryState) -> None:
+    """Atomically persist one advisory state.
+
+    Args:
+        state_path: Destination JSON state file.
+        state: State record to persist.
+    """
+    state_path.parent.mkdir(parents=True, exist_ok=True)
+    state_mapping = {
+        STATE_VERSION_KEY: STATE_VERSION,
+        STATE_REPOSITORY_KEY: state.repository,
+        STATE_PULL_REQUEST_KEY: state.pull_request_number,
+        STATE_STATUS_KEY: state.status,
+        STATE_REASON_KEY: state.reason,
+        STATE_HEAD_SHA_KEY: state.head_sha,
+        STATE_BASE_SHA_KEY: state.base_sha,
+        STATE_LAST_POLL_KEY: state.last_poll,
+        STATE_LAST_RUN_KEY: state.last_run,
+        STATE_REPORT_KEY: state.report_path,
+    }
+    temporary_state_path = state_path.with_name(state_path.name + STATE_FILE_SUFFIX)
+    temporary_state_path.write_text(
+        json.dumps(state_mapping, indent=JSON_INDENT_SPACES, sort_keys=True)
+        + REPORT_NEWLINE,
+        encoding=UTF8_ENCODING,
+    )
+    os.replace(temporary_state_path, state_path)
+
+
+def _utc_timestamp() -> str:
+    return datetime.now(UTC).isoformat()

package/scripts/automatic_advisory/window_flags.py

@@ -0,0 +1,41 @@
+"""Windows creation flags that hide the advisory poller and its children.
+
+A poller with no console makes each git call and each check open a fresh
+console window. A hidden console is inherited by descendants, so those
+children stay off the screen.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+
+from .config.constants import (
+    CREATE_NEW_PROCESS_GROUP_ATTRIBUTE,
+    CREATE_NO_WINDOW_ATTRIBUTE,
+    WINDOWS_PLATFORM,
+)
+
+
+def hidden_window_creation_flags() -> int:
+    """Return the flag that runs a Windows child without a visible console.
+
+    Returns:
+        The hidden-console flag on Windows, zero elsewhere.
+    """
+    if sys.platform != WINDOWS_PLATFORM:
+        return 0
+    return getattr(subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0)
+
+
+def detached_poller_creation_flags() -> int:
+    """Return the flags for the long-running poller on Windows.
+
+    Returns:
+        A new process group plus a hidden console on Windows, zero elsewhere.
+    """
+    if sys.platform != WINDOWS_PLATFORM:
+        return 0
+    return getattr(subprocess, CREATE_NEW_PROCESS_GROUP_ATTRIBUTE, 0) | getattr(
+        subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0
+    )

package/scripts/automatic_advisory/windows_job.py

@@ -0,0 +1,122 @@
+from __future__ import annotations
+
+import ctypes
+
+from .config.constants import (
+    WINDOWS_EXTENDED_LIMIT_INFORMATION_CLASS,
+    WINDOWS_JOB_KILL_ON_CLOSE_LIMIT,
+    WINDOWS_PROCESS_SET_QUOTA_ACCESS,
+    WINDOWS_PROCESS_TERMINATE_ACCESS,
+)
+
+
+class _JobObjectBasicLimitInformation(ctypes.Structure):
+    _fields_ = [
+        ("PerProcessUserTimeLimit", ctypes.c_longlong),
+        ("PerJobUserTimeLimit", ctypes.c_longlong),
+        ("LimitFlags", ctypes.c_uint32),
+        ("MinimumWorkingSetSize", ctypes.c_size_t),
+        ("MaximumWorkingSetSize", ctypes.c_size_t),
+        ("ActiveProcessLimit", ctypes.c_uint32),
+        ("Affinity", ctypes.c_size_t),
+        ("PriorityClass", ctypes.c_uint32),
+        ("SchedulingClass", ctypes.c_uint32),
+    ]
+
+
+class _IoCounters(ctypes.Structure):
+    _fields_ = [
+        ("ReadOperationCount", ctypes.c_ulonglong),
+        ("WriteOperationCount", ctypes.c_ulonglong),
+        ("OtherOperationCount", ctypes.c_ulonglong),
+        ("ReadTransferCount", ctypes.c_ulonglong),
+        ("WriteTransferCount", ctypes.c_ulonglong),
+        ("OtherTransferCount", ctypes.c_ulonglong),
+    ]
+
+
+class _JobObjectExtendedLimitInformation(ctypes.Structure):
+    _fields_ = [
+        ("BasicLimitInformation", _JobObjectBasicLimitInformation),
+        ("IoInfo", _IoCounters),
+        ("ProcessMemoryLimit", ctypes.c_size_t),
+        ("JobMemoryLimit", ctypes.c_size_t),
+        ("PeakProcessMemoryUsed", ctypes.c_size_t),
+        ("PeakJobMemoryUsed", ctypes.c_size_t),
+    ]
+
+
+def _create_kill_on_close_job() -> int | None:
+    create_job = ctypes.windll.kernel32.CreateJobObjectW
+    create_job.argtypes = (ctypes.c_void_p, ctypes.c_wchar_p)
+    create_job.restype = ctypes.c_void_p
+    maybe_job_handle = create_job(None, None)
+    if maybe_job_handle is None:
+        return None
+    job_handle = int(maybe_job_handle)
+    if _configure_kill_on_close(job_handle):
+        return job_handle
+    _close_handle(job_handle)
+    return None
+
+
+def _configure_kill_on_close(job_handle: int) -> bool:
+    job_limits = _JobObjectExtendedLimitInformation()
+    job_limits.BasicLimitInformation.LimitFlags = WINDOWS_JOB_KILL_ON_CLOSE_LIMIT
+    set_job_information = ctypes.windll.kernel32.SetInformationJobObject
+    set_job_information.argtypes = (
+        ctypes.c_void_p,
+        ctypes.c_int,
+        ctypes.c_void_p,
+        ctypes.c_uint32,
+    )
+    set_job_information.restype = ctypes.c_int
+    return bool(
+        set_job_information(
+            ctypes.c_void_p(job_handle),
+            WINDOWS_EXTENDED_LIMIT_INFORMATION_CLASS,
+            ctypes.byref(job_limits),
+            ctypes.sizeof(job_limits),
+        )
+    )
+
+
+def _assign_process(job_handle: int, process_identifier: int) -> bool:
+    process_access = WINDOWS_PROCESS_SET_QUOTA_ACCESS | WINDOWS_PROCESS_TERMINATE_ACCESS
+    open_process = ctypes.windll.kernel32.OpenProcess
+    open_process.argtypes = (ctypes.c_uint32, ctypes.c_int, ctypes.c_uint32)
+    open_process.restype = ctypes.c_void_p
+    maybe_process_handle = open_process(process_access, 0, process_identifier)
+    if maybe_process_handle is None:
+        return False
+    process_handle = int(maybe_process_handle)
+    try:
+        return _assign_process_handle(job_handle, process_handle)
+    finally:
+        _close_handle(process_handle)
+
+
+def _assign_process_handle(job_handle: int, process_handle: int) -> bool:
+    assign_process_to_job = ctypes.windll.kernel32.AssignProcessToJobObject
+    assign_process_to_job.argtypes = (ctypes.c_void_p, ctypes.c_void_p)
+    assign_process_to_job.restype = ctypes.c_int
+    return bool(
+        assign_process_to_job(
+            ctypes.c_void_p(job_handle),
+            ctypes.c_void_p(process_handle),
+        )
+    )
+
+
+def _terminate_job(job_handle: int) -> None:
+    terminate_job_object = ctypes.windll.kernel32.TerminateJobObject
+    terminate_job_object.argtypes = (ctypes.c_void_p, ctypes.c_uint32)
+    terminate_job_object.restype = ctypes.c_int
+    terminate_job_object(ctypes.c_void_p(job_handle), 1)
+
+
+def _close_handle(job_handle: int) -> None:
+    close_windows_handle = ctypes.windll.kernel32.CloseHandle
+    close_windows_handle.argtypes = (ctypes.c_void_p,)
+    close_windows_handle.restype = ctypes.c_int
+    close_windows_handle(ctypes.c_void_p(job_handle))

package/scripts/check.ps1

@@ -152,7 +152,6 @@ if (-not $SkipMypy) {
                 copilot_quota.py `
                 fix_hookspath.py `
                 grant_project_claude_permissions.py `
-                post_audit_thread.py `
                 preflight_self_heal.py `
                 preflight.py `
                 reviewer_availability.py `