claude-dev-env 4.3.0 → 7.1.0

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -0,0 +1,323 @@
+from __future__ import annotations
+
+from pathlib import PurePosixPath
+
+APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
+    PurePosixPath, frozenset[PurePosixPath]
+] = {
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/git-hooks/verification_notice_context.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_verification_notice.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/git-hooks/verification_notice_state.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_verification_notice.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/hooks_constants/post_tool_use_dispatcher_constants.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/validation/test_post_tool_use_dispatcher.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/checkout.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/cli.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/configuration.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/execution.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/git.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/model.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/process_host.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/publisher.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/state.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/window_flags.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/windows_job.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_job_cleanup.py"
+            ),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/scripts/local_report_cli.py"): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_report_publisher_cli.py"
+            ),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/scripts/local_report_core.py"): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_report_publisher.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_report_validation.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_report_publisher.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/check_runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/check_support.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/cli.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification_cli.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/command_runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/git_state.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/manifest.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/model.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification_cli.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/branch_refs.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/github_api.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/github_parsing.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/github.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/scripts/pr_verification/lock.py"): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_lock.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/model.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+}

package/scripts/policy_lint/config/constants.py

@@ -5,6 +5,7 @@ INVALID_INPUT_EXIT_CODE = 2
 GIT_EXECUTABLE = "git"
 UTF8_ENCODING = "utf-8"
 PATH_SEPARATOR = "/"
+ARCHIVED_SKILLS_DIRECTORY_NAME = "skill-archive"
 NUL_BYTE = b"\0"
 ALL_GIT_ROOT_ARGUMENTS = ("rev-parse", "--show-toplevel")
 ALL_GIT_HEAD_ARGUMENTS = ("rev-parse", "--verify", "HEAD")
@@ -13,6 +14,7 @@ GIT_MERGE_BASE_ARGUMENT = "merge-base"
 GIT_HEAD_REFERENCE = "HEAD"
 GIT_INDEX_REFERENCE_PREFIX = ""
 GIT_ENVIRONMENT_VARIABLE_PREFIX = "GIT_"
+GIT_INDEX_ENVIRONMENT_VARIABLE = "GIT_INDEX_FILE"
 ALL_GIT_BLOB_ARGUMENTS = ("cat-file", "blob")
 ALL_MISSING_BLOB_ERROR_FRAGMENTS = (
     "does not exist in",
@@ -75,3 +77,6 @@ TERMINOLOGY_FINDING_PATTERN = re.compile(
 TERMINOLOGY_PATH_GROUP = "path"
 TERMINOLOGY_LINE_NUMBER_GROUP = "line_number"
 TERMINOLOGY_MESSAGE_GROUP = "message"
+
+PR_LOOP_DIRECTORY_NAME = "pr-loop"
+SHARED_ROOT_PARENT_INDEX = 2

package/scripts/policy_lint/engine.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
 from collections.abc import Iterable, Sequence
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 
+from .config.constants import ARCHIVED_SKILLS_DIRECTORY_NAME
 from .model import (
     ChangeSetRule,
     Diagnostic,
@@ -25,6 +26,9 @@ def lint(
 ) -> LintReport:
     """Run the selected rules on one source selection.
 
+    Repository and diff selections check active code. File and editor
+    selections include archived skills.
+
     Args:
         request: Repository root, source, and rule sets.
         all_registry: Optional registry replacement.
@@ -32,10 +36,14 @@ def lint(
     Returns:
         A report of diagnostics and rule execution state.
     """
-    document_set = select_documents(request)
-    candidate_rules = tuple(all_registry) if all_registry is not None else default_registry()
+    document_set = _runtime_document_set(select_documents(request))
+    candidate_rules = (
+        tuple(all_registry) if all_registry is not None else default_registry()
+    )
     selected = selected_rules(candidate_rules, request.rule_sets)
-    all_diagnostics, executed, failed, skipped = _run_selected_rules(selected, document_set)
+    all_diagnostics, executed, failed, skipped = _run_selected_rules(
+        selected, document_set
+    )
     return LintReport(
         1,
         tuple(sorted(all_diagnostics, key=_diagnostic_sort_key)),
@@ -46,6 +54,42 @@ def lint(
     )
 
 
+def _is_runtime_path(path: PurePosixPath) -> bool:
+    return path.parts[0] != ARCHIVED_SKILLS_DIRECTORY_NAME
+
+
+def _runtime_document_set(document_set: DocumentSet) -> DocumentSet:
+    if document_set.selection in {SelectionKind.FILES, SelectionKind.TEXT}:
+        return document_set
+    all_documents = tuple(
+        each_document
+        for each_document in document_set.documents
+        if _is_runtime_path(each_document.path)
+    )
+    all_deleted_paths = tuple(
+        each_path
+        for each_path in document_set.deleted_paths
+        if _is_runtime_path(each_path)
+    ) + tuple(
+        old_path
+        for old_path, new_path in document_set.renamed_paths
+        if _is_runtime_path(old_path) and not _is_runtime_path(new_path)
+    )
+    all_renamed_paths = tuple(
+        each_pair
+        for each_pair in document_set.renamed_paths
+        if _is_runtime_path(each_pair[1])
+    )
+    return DocumentSet(
+        all_documents,
+        document_set.selection,
+        document_set.repository_root,
+        all_deleted_paths,
+        all_renamed_paths,
+        document_set.base_revision,
+    )
+
+
 def _run_selected_rules(
     all_rules: tuple[Rule, ...], document_set: DocumentSet
 ) -> tuple[list[Diagnostic], tuple[str, ...], tuple[str, ...], tuple[str, ...]]:

package/scripts/policy_lint/model.py

@@ -106,6 +106,7 @@ class DocumentSet:
     repository_root: Path
     deleted_paths: tuple[PurePosixPath, ...] = ()
     renamed_paths: tuple[tuple[PurePosixPath, PurePosixPath], ...] = ()
+    base_revision: str | None = None
 
 
 @dataclass(frozen=True)

package/scripts/policy_lint/registry.py

@@ -141,7 +141,7 @@ def default_registry() -> tuple[model.Rule, ...]:
         model.ChangeSetRule(
             "terminology-sweep",
             frozenset({"changed"}),
-            frozenset({model.SelectionKind.STAGED}),
+            frozenset({model.SelectionKind.STAGED, model.SelectionKind.BASE}),
             adapters.terminology_diagnostics,
         ),
         model.RepositoryRule(

package/scripts/policy_lint/selection.py

@@ -172,7 +172,7 @@ def _documents_from_changes(
     selection_kind = SelectionKind.STAGED if is_staged else SelectionKind.BASE
     return DocumentSet(
         tuple(all_documents), selection_kind, repository_root,
-        tuple(all_deleted_paths), tuple(all_renamed_paths),
+        tuple(all_deleted_paths), tuple(all_renamed_paths), base_revision,
     )
 
 
@@ -354,6 +354,7 @@ def _normalize_document_set(repository_root: Path, document_set: DocumentSet) ->
         repository_root,
         all_deleted_paths,
         all_renamed_paths,
+        document_set.base_revision,
     )
 
 

package/scripts/policy_lint/selection_git.py

@@ -10,6 +10,7 @@ from .config.constants import (
     ALL_MISSING_BLOB_ERROR_FRAGMENTS,
     ALL_UNBORN_HEAD_ERROR_FRAGMENTS,
     GIT_ENVIRONMENT_VARIABLE_PREFIX,
+    GIT_INDEX_ENVIRONMENT_VARIABLE,
     GIT_EXECUTABLE,
     NUL_BYTE,
     UTF8_ENCODING,
@@ -105,6 +106,7 @@ def _git_subprocess_environment() -> dict[str, str]:
         each_name: each_environment_text
         for each_name, each_environment_text in os.environ.items()
         if not each_name.upper().startswith(git_prefix)
+        or each_name.upper() == GIT_INDEX_ENVIRONMENT_VARIABLE
     }
 
 

package/scripts/pr_verification/__init__.py

@@ -0,0 +1 @@
+"""Trusted host supervisor for local pull request verification."""

package/scripts/pr_verification/branch_refs.py

@@ -0,0 +1,114 @@
+from __future__ import annotations
+
+import urllib.parse
+from collections.abc import Callable
+from dataclasses import replace
+
+from .config.constants import (
+    GIT_BRANCH_REF_SAFE_CHARACTERS,
+    GIT_BRANCH_REFERENCE_ENDPOINT_TEMPLATE,
+    GIT_REFERENCE_OBJECT_KEY,
+    GIT_REFERENCE_RESOURCE_NAME,
+    PULL_SHA_KEY,
+)
+from .github_parsing import require_mapping, require_text
+from .model import PullRequestCandidate, RepositorySettings
+
+GetJson = Callable[[str], object]
+
+
+def _read_branch_sha(
+    repository: RepositorySettings,
+    base_ref: str,
+    get_json: GetJson,
+) -> str:
+    endpoint = GIT_BRANCH_REFERENCE_ENDPOINT_TEMPLATE.format(
+        repository=repository.slug,
+        base_ref=urllib.parse.quote(
+            base_ref,
+            safe=GIT_BRANCH_REF_SAFE_CHARACTERS,
+        ),
+    )
+    reference = require_mapping(get_json(endpoint), GIT_REFERENCE_RESOURCE_NAME)
+    target = require_mapping(
+        reference.get(GIT_REFERENCE_OBJECT_KEY),
+        GIT_REFERENCE_RESOURCE_NAME,
+    )
+    return require_text(target, PULL_SHA_KEY, GIT_REFERENCE_RESOURCE_NAME)
+
+
+def replace_candidate_base_sha(
+    candidate: PullRequestCandidate,
+    repository: RepositorySettings,
+    get_json: GetJson,
+) -> PullRequestCandidate:
+    """Replace one pull request base SHA with its current branch tip.
+
+    Args:
+        candidate: Pull request candidate from the pulls API.
+        repository: Repository containing the target branch.
+        get_json: Authenticated GitHub JSON reader.
+
+    Returns:
+        Candidate carrying the current target branch SHA.
+    """
+    current_base_sha = _read_branch_sha(repository, candidate.base_ref, get_json)
+    return replace(candidate, base_sha=current_base_sha)
+
+
+def replace_candidate_base_shas(
+    all_candidates: tuple[PullRequestCandidate, ...],
+    repository: RepositorySettings,
+    get_json: GetJson,
+) -> tuple[PullRequestCandidate, ...]:
+    """Replace pull request base SHAs with current unique branch tips.
+
+    Args:
+        all_candidates: Pull request candidates from the pulls API.
+        repository: Repository containing the target branches.
+        get_json: Authenticated GitHub JSON reader.
+
+    Returns:
+        Candidates carrying current target branch SHAs.
+    """
+    base_sha_by_ref = _read_unique_branch_shas(
+        all_candidates,
+        repository,
+        get_json,
+    )
+    return tuple(
+        replace(
+            each_candidate,
+            base_sha=base_sha_by_ref[each_candidate.base_ref],
+        )
+        for each_candidate in all_candidates
+    )
+
+
+def _resolve_candidate_base_shas(
+    all_candidates: list[PullRequestCandidate],
+    repository: RepositorySettings,
+    get_json: GetJson,
+    should_require_merge_commit: bool,
+) -> tuple[PullRequestCandidate, ...]:
+    candidates = tuple(all_candidates)
+    if should_require_merge_commit:
+        return candidates
+    return replace_candidate_base_shas(candidates, repository, get_json)
+
+
+def _read_unique_branch_shas(
+    all_candidates: tuple[PullRequestCandidate, ...],
+    repository: RepositorySettings,
+    get_json: GetJson,
+) -> dict[str, str]:
+    base_sha_by_ref: dict[str, str] = {}
+    for each_candidate in all_candidates:
+        if each_candidate.base_ref in base_sha_by_ref:
+            continue
+        base_sha_by_ref[each_candidate.base_ref] = _read_branch_sha(
+            repository,
+            each_candidate.base_ref,
+            get_json,
+        )
+    return base_sha_by_ref

package/scripts/pr_verification/config/__init__.py

@@ -0,0 +1 @@
+"""Configuration constants for pull request verification."""

package/scripts/pr_verification/config/constants.py

@@ -0,0 +1,84 @@
+import re
+
+SUCCESS_EXIT_CODE = 0
+INCOMPLETE_EXIT_CODE = 3
+HTTP_OK = 200
+HTTP_CREATED = 201
+HTTP_NO_CONTENT = 204
+GITHUB_API_URL = "https://api.github.com"
+GITHUB_PAGE_SIZE = 100
+UTF8_ENCODING = "utf-8"
+JSON_CONTENT_TYPE = "application/json"
+GITHUB_ACCEPT_TYPE = "application/vnd.github+json"
+GITHUB_API_VERSION = "2022-11-28"
+AUTHORIZATION_HEADER = "Authorization"
+ACCEPT_HEADER = "Accept"
+CONTENT_TYPE_HEADER = "Content-Type"
+API_VERSION_HEADER = "X-GitHub-Api-Version"
+BEARER_PREFIX = "Bearer "
+APP_JWT_ALGORITHM = "RS256"
+APP_ISSUER_CLAIM = "iss"
+APP_ISSUED_AT_CLAIM = "iat"
+APP_EXPIRATION_CLAIM = "exp"
+PULL_NUMBER_KEY = "number"
+PULL_DRAFT_KEY = "draft"
+PULL_MERGE_SHA_KEY = "merge_commit_sha"
+PULL_BASE_KEY = "base"
+PULL_HEAD_KEY = "head"
+PULL_REF_KEY = "ref"
+PULL_SHA_KEY = "sha"
+COMMIT_PARENTS_KEY = "parents"
+TOKEN_KEY = "token"
+REPOSITORIES_KEY = "repositories"
+PERMISSIONS_KEY = "permissions"
+CONTENTS_PERMISSION_KEY = "contents"
+PULL_REQUESTS_PERMISSION_KEY = "pull_requests"
+STATUSES_PERMISSION_KEY = "statuses"
+ISSUES_PERMISSION_KEY = "issues"
+READ_PERMISSION = "read"
+WRITE_PERMISSION = "write"
+STATUS_STATE_KEY = "state"
+STATUS_CONTEXT_KEY = "context"
+STATUS_DESCRIPTION_KEY = "description"
+STATUS_PENDING = "pending"
+STATUS_ERROR = "error"
+STATUS_FAILURE = "failure"
+STATUS_SUCCESS = "success"
+LOCAL_CHECKS_CONTEXT = "local-checks"
+LOCAL_CHECKS_PASSED_LABEL = "local-checks:passed"
+PULLS_ENDPOINT_TEMPLATE = (
+    "/repos/{repository}/pulls?state=open&per_page={page_size}&page={page}"
+)
+PULL_ENDPOINT_TEMPLATE = "/repos/{repository}/pulls/{pull_number}"
+GIT_BRANCH_REFERENCE_ENDPOINT_TEMPLATE = "/repos/{repository}/git/ref/heads/{base_ref}"
+GIT_BRANCH_REF_SAFE_CHARACTERS = "/"
+GIT_REFERENCE_OBJECT_KEY = "object"
+GIT_REFERENCE_RESOURCE_NAME = "git reference"
+COMMIT_ENDPOINT_TEMPLATE = "/repos/{repository}/git/commits/{commit_sha}"
+STATUS_ENDPOINT_TEMPLATE = "/repos/{repository}/statuses/{commit_sha}"
+ISSUE_LABELS_ENDPOINT_TEMPLATE = "/repos/{repository}/issues/{pull_number}/labels"
+ISSUE_LABELS_PAGE_ENDPOINT_TEMPLATE = (
+    "/repos/{repository}/issues/{pull_number}/labels?per_page={page_size}&page={page}"
+)
+ISSUE_LABEL_ENDPOINT_TEMPLATE = (
+    "/repos/{repository}/issues/{pull_number}/labels/{label}"
+)
+ISSUE_LABELS_KEY = "labels"
+INSTALLATION_TOKEN_ENDPOINT_TEMPLATE = (
+    "/app/installations/{installation_id}/access_tokens"
+)
+GITHUB_REQUEST_ERROR_TEMPLATE = "GitHub {method} {url} returned {status_code}"
+GITHUB_JSON_ERROR_TEMPLATE = "GitHub returned invalid JSON from {url}"
+GITHUB_SHAPE_ERROR_TEMPLATE = "GitHub returned an invalid {resource} payload"
+PULL_RESOURCE_NAME = "pull request"
+PULL_LIST_RESOURCE_NAME = "pull request list"
+TOKEN_RESOURCE_NAME = "installation token"
+PENDING_DESCRIPTION = "Local verification is running"
+FAILURE_DESCRIPTION = "A required local check failed"
+ERROR_DESCRIPTION = "Local verification did not complete"
+GIT_BARE_SUFFIX = ".git"
+SUPERVISOR_LOCK_FILENAME = "supervisor.lock"
+SUPERVISOR_LOCK_ERROR = "Another verification supervisor owns this cache root"
+SUPERVISOR_LOCK_IO_ERROR = "Verification supervisor lock file is unavailable"
+SUPERVISOR_LOCK_FILE_MODE = 0o600
+REPOSITORY_SLUG_PATTERN = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")

package/scripts/pr_verification/config/timing.py

@@ -0,0 +1,5 @@
+APP_JWT_LIFETIME_SECONDS = 540
+APP_JWT_CLOCK_SKEW_SECONDS = 60
+HTTP_TIMEOUT_SECONDS = 30
+DOCKER_CLEANUP_TIMEOUT_SECONDS = 30
+CHECK_TIMEOUT_GRACE_SECONDS = 15