claude-dev-env 7.0.0 → 7.1.0

package/hooks/git-hooks/test_verification_notice.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+import io
+from pathlib import Path
+
+import pytest
+import verification_notice
+
+
+def _record_notice_execution(
+    monkeypatch: pytest.MonkeyPatch,
+) -> tuple[io.StringIO, list[object]]:
+    notice_context = object()
+    all_started_contexts: list[object] = []
+    monkeypatch.setattr(
+        verification_notice,
+        "_load_notice_context",
+        lambda event, repository: notice_context,
+    )
+    monkeypatch.setattr(
+        verification_notice,
+        "build_verification_notice",
+        lambda context: "notice\n",
+    )
+    monkeypatch.setattr(
+        verification_notice,
+        "start_automatic_advisory",
+        all_started_contexts.append,
+    )
+    return io.StringIO(), all_started_contexts
+
+
+def test_notice_only_prints_without_starting_verification(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    standard_output, all_started_contexts = _record_notice_execution(monkeypatch)
+
+    exit_code = verification_notice.main(
+        ["--event", "commit", "--notice-only", "--repo", str(tmp_path)],
+        stdout=standard_output,
+    )
+
+    assert exit_code == 0
+    assert standard_output.getvalue() == "notice\n"
+    assert all_started_contexts == []
+
+
+def test_default_notice_prints_and_starts_verification(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    standard_output, all_started_contexts = _record_notice_execution(monkeypatch)
+
+    exit_code = verification_notice.main(
+        ["--event", "commit", "--repo", str(tmp_path)],
+        stdout=standard_output,
+    )
+
+    assert exit_code == 0
+    assert standard_output.getvalue() == "notice\n"
+    assert len(all_started_contexts) == 1

package/hooks/git-hooks/test_verification_start.py

@@ -0,0 +1,173 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+scripts_directory = Path(__file__).resolve().parents[2] / "scripts"
+if str(scripts_directory) not in sys.path:
+    sys.path.insert(0, str(scripts_directory))
+
+from verification_notice import build_verification_notice
+from verification_notice_context import VerificationNoticeContext
+from verification_start import start_automatic_advisory
+
+
+def build_context(
+    repository_root: Path,
+    *,
+    event: str = "commit",
+    repository_remote: str = "jonecho/python-automation",
+) -> VerificationNoticeContext:
+    git_directory = repository_root / ".git"
+    return VerificationNoticeContext(
+        event=event,
+        repository_remote=repository_remote,
+        repository_root=repository_root,
+        current_head="a" * 40,
+        manifest_path=None,
+        manifest_is_available=False,
+        git_directory=git_directory,
+        report_is_present=False,
+        all_report_fields=None,
+    )
+
+
+def write_runner_configuration(repository_root: Path, configuration: object) -> None:
+    runner_path = repository_root / ".git" / "local-verification" / "runner.json"
+    runner_path.parent.mkdir(parents=True)
+    runner_path.write_text(json.dumps(configuration), encoding="utf-8")
+
+
+def create_runner_configuration(repository_root: Path) -> tuple[str, str]:
+    python_path = str(repository_root / "venv" / "Scripts" / "python.exe")
+    settings_path = str(repository_root / "settings.json")
+    write_runner_configuration(
+        repository_root,
+        {"python": python_path, "settings": settings_path},
+    )
+    return python_path, settings_path
+
+
+def test_start_automatic_advisory_launches_without_waiting(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    python_path, settings_path = create_runner_configuration(tmp_path)
+
+    all_launches: list[tuple[object, dict[str, object]]] = []
+
+    class UnwaitedProcess:
+        def wait(self) -> None:
+            raise AssertionError("native startup must not wait")
+
+    def record_launch(
+        command: object,
+        **launch_options: object,
+    ) -> UnwaitedProcess:
+        all_launches.append((command, launch_options))
+        return UnwaitedProcess()
+
+    monkeypatch.setattr(subprocess, "Popen", record_launch)
+
+    start_automatic_advisory(build_context(tmp_path))
+
+    assert len(all_launches) == 1
+    _assert_launch_matches_runner(
+        all_launches[0],
+        python_path,
+        settings_path,
+        tmp_path,
+    )
+
+
+def _assert_launch_matches_runner(
+    launch: tuple[object, dict[str, object]],
+    python_path: str,
+    settings_path: str,
+    repository_root: Path,
+) -> None:
+    command, launch_options = launch
+    assert command == [
+        python_path,
+        str(Path(__file__).resolve().parents[2] / "scripts" / "automatic_advisory" / "cli.py"),
+        "--settings",
+        settings_path,
+        "--start",
+    ]
+    assert launch_options["cwd"] == repository_root
+    assert launch_options["stdin"] is subprocess.DEVNULL
+    assert launch_options["stdout"] is subprocess.DEVNULL
+    assert launch_options["stderr"] is subprocess.DEVNULL
+    assert "--once" not in command
+
+
+def test_start_automatic_advisory_ignores_malformed_configuration(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    runner_path = tmp_path / ".git" / "local-verification" / "runner.json"
+    runner_path.parent.mkdir(parents=True)
+    runner_path.write_text("not-json", encoding="utf-8")
+    monkeypatch.setattr(
+        subprocess,
+        "Popen",
+        lambda *arguments, **options: pytest.fail("malformed configuration launched a process"),
+    )
+
+    start_automatic_advisory(build_context(tmp_path))
+
+
+def test_start_automatic_advisory_ignores_other_repository_and_event(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    write_runner_configuration(
+        tmp_path,
+        {"python": str(tmp_path / "python"), "settings": str(tmp_path / "settings")},
+    )
+    launch_count = 0
+
+    def count_launches(*arguments: object, **options: object) -> None:
+        nonlocal launch_count
+        launch_count += 1
+
+    monkeypatch.setattr(subprocess, "Popen", count_launches)
+
+    start_automatic_advisory(
+        build_context(tmp_path, repository_remote="other-owner/other-repository")
+    )
+    start_automatic_advisory(build_context(tmp_path, event="merge"))
+
+    assert launch_count == 0
+
+
+def test_start_automatic_advisory_ignores_launch_failure(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    write_runner_configuration(
+        tmp_path,
+        {"python": str(tmp_path / "python"), "settings": str(tmp_path / "settings")},
+    )
+
+    def fail_to_launch(*arguments: object, **options: object) -> None:
+        raise OSError("process unavailable")
+
+    monkeypatch.setattr(subprocess, "Popen", fail_to_launch)
+
+    start_automatic_advisory(build_context(tmp_path))
+
+
+def test_notice_prints_runner_python_in_canonical_command(tmp_path: Path) -> None:
+    python_path, settings_path = create_runner_configuration(tmp_path)
+
+    notice_text = build_verification_notice(build_context(tmp_path))
+
+    expected_command = (
+        f"& '{python_path}' '{tmp_path / '.github' / 'ci' / 'local_verify.py'}' --base origin/main"
+    )
+    assert expected_command in notice_text

package/hooks/git-hooks/verification_notice.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""Print a bounded, nonblocking local verification reminder for native Git."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from collections.abc import Sequence
+from pathlib import Path
+from typing import Never, TextIO
+
+from git_hooks_constants.verification_notice_constants import (
+    ALL_NOTICE_EVENTS,
+    BASE_ARGUMENT,
+    BASE_REFERENCE,
+    COMMAND_SEPARATOR,
+    EXECUTOR_ARGUMENT,
+    EXECUTOR_DIRECTORY_NAME,
+    EXECUTOR_FILE_NAME,
+    GIT_COMMAND_SUCCESS_EXIT_CODE,
+    GIT_DIRECTORY_NAME,
+    JSON_ENCODING,
+    LOCAL_VERIFICATION_DIRECTORY_NAME,
+    LOCAL_VERIFICATION_PACKAGE_DIRECTORY_NAME,
+    NO_VERIFIED_SHA,
+    NOTICE_ADVISORY_LINE,
+    NOTICE_HEADER,
+    NOTICE_LINE_SEPARATOR,
+    NOTICE_RUN_LINE,
+    OUTPUT_ARGUMENT,
+    PACKAGE_ROOT_PARENT_INDEX,
+    POWERSHELL_CALL_OPERATOR,
+    POWERSHELL_ESCAPED_QUOTE,
+    POWERSHELL_QUOTE,
+    PYTHON_COMMAND,
+    REPORT_FILE_NAME,
+    SCOPED_VERIFICATION_SCRIPT_PATH,
+    TARGET_REPOSITORY_REMOTE,
+    UNKNOWN_SHA,
+)
+
+verification_scripts_directory = (
+    Path(__file__).resolve().parents[PACKAGE_ROOT_PARENT_INDEX] / EXECUTOR_DIRECTORY_NAME
+)
+if str(verification_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(verification_scripts_directory))
+
+from verification_notice_context import (
+    VerificationNoticeContext,
+    _load_notice_context,
+    _run_git_query,
+)
+from verification_start import load_runner_configuration, start_automatic_advisory
+from verification_notice_state import (
+    _build_state_message,
+    _evaluate_context,
+)
+
+
+class _NoticeArgumentParser(argparse.ArgumentParser):
+    def error(self, message: str) -> Never:
+        raise ValueError(message)
+
+
+def build_verification_notice(context: VerificationNoticeContext) -> str:
+    """Render the advisory for one normalized repository context.
+
+    Args:
+        context: Repository fields that define the rendered notice.
+
+    Returns:
+        The formatted advisory text, or an empty string for another repository.
+    """
+    if context.repository_remote != TARGET_REPOSITORY_REMOTE:
+        return ""
+    current_head = context.current_head or UNKNOWN_SHA
+    state, verified_head = _evaluate_context(context, _run_git_query)
+    all_notice_lines = (
+        NOTICE_HEADER,
+        f"Repository remote: {context.repository_remote}",
+        f"Event: {context.event}",
+        f"Current SHA: {current_head}",
+        f"Verified SHA: {verified_head or NO_VERIFIED_SHA}",
+        f"State: {state}",
+        _build_state_message(state, context.manifest_is_available),
+        NOTICE_ADVISORY_LINE,
+        NOTICE_RUN_LINE,
+        _build_canonical_command(context),
+    )
+    return NOTICE_LINE_SEPARATOR.join(all_notice_lines) + NOTICE_LINE_SEPARATOR
+
+
+def main(
+    all_arguments: Sequence[str] | None = None,
+    *,
+    stdout: TextIO = sys.stdout,
+) -> int:
+    """Read Git metadata and print a reminder without affecting the Git action.
+
+    Args:
+        all_arguments: Optional command arguments for the notice CLI.
+        stdout: Stream receiving the rendered notice.
+
+    Returns:
+        Zero so the native Git action continues.
+    """
+    parsed_arguments = _parse_arguments(all_arguments)
+    if parsed_arguments is None:
+        return GIT_COMMAND_SUCCESS_EXIT_CODE
+    try:
+        _write_parsed_notice(parsed_arguments, stdout)
+    except (OSError, UnicodeError, ValueError):
+        return GIT_COMMAND_SUCCESS_EXIT_CODE
+    return GIT_COMMAND_SUCCESS_EXIT_CODE
+
+
+def _write_parsed_notice(parsed_arguments: argparse.Namespace, stdout: TextIO) -> None:
+    notice_context = _load_notice_context(
+        parsed_arguments.event,
+        Path(parsed_arguments.repository),
+    )
+    if notice_context is None:
+        return
+    _write_notice(stdout, build_verification_notice(notice_context))
+    if parsed_arguments.notice_only:
+        return
+    start_automatic_advisory(notice_context)
+
+
+def _parse_arguments(
+    all_arguments: Sequence[str] | None,
+) -> argparse.Namespace | None:
+    argument_parser = _NoticeArgumentParser(add_help=True)
+    argument_parser.add_argument("--event", required=True)
+    argument_parser.add_argument("--notice-only", action="store_true")
+    argument_parser.add_argument("--repo", dest="repository", required=True)
+    try:
+        parsed_arguments, unknown_arguments = argument_parser.parse_known_args(all_arguments)
+    except (SystemExit, ValueError):
+        return None
+    if unknown_arguments or parsed_arguments.event not in ALL_NOTICE_EVENTS:
+        return None
+    return parsed_arguments
+
+
+def _write_notice(stdout: TextIO, notice_text: str) -> None:
+    try:
+        stdout.write(notice_text)
+    except UnicodeError:
+        stream_encoding = getattr(stdout, "encoding", None) or JSON_ENCODING
+        safe_notice_text = notice_text.encode(
+            stream_encoding,
+            errors="replace",
+        ).decode(stream_encoding, errors="replace")
+        stdout.write(safe_notice_text)
+
+
+def _build_canonical_command(context: VerificationNoticeContext) -> str:
+    git_directory = context.git_directory or context.repository_root / GIT_DIRECTORY_NAME
+    report_path = git_directory / LOCAL_VERIFICATION_DIRECTORY_NAME / REPORT_FILE_NAME
+    executor_path = (
+        Path(__file__).resolve().parents[PACKAGE_ROOT_PARENT_INDEX]
+        / EXECUTOR_DIRECTORY_NAME
+        / LOCAL_VERIFICATION_PACKAGE_DIRECTORY_NAME
+        / EXECUTOR_FILE_NAME
+    )
+    all_command_parts = (
+        _build_python_command(context),
+        _quote_windows_path(context.repository_root / SCOPED_VERIFICATION_SCRIPT_PATH),
+        f"{BASE_ARGUMENT} {BASE_REFERENCE}",
+        f"{EXECUTOR_ARGUMENT} {_quote_windows_path(executor_path)}",
+        f"{OUTPUT_ARGUMENT} {_quote_windows_path(report_path)}",
+    )
+    return COMMAND_SEPARATOR.join(all_command_parts)
+
+
+def _build_python_command(context: VerificationNoticeContext) -> str:
+    runner_configuration = load_runner_configuration(context)
+    if runner_configuration is None:
+        return PYTHON_COMMAND
+    python_path, _ = runner_configuration
+    return POWERSHELL_CALL_OPERATOR + _quote_windows_path(Path(python_path))
+
+
+def _quote_windows_path(path: Path) -> str:
+    path_text = str(path)
+    escaped_path = path_text.replace(POWERSHELL_QUOTE, POWERSHELL_ESCAPED_QUOTE)
+    return f"{POWERSHELL_QUOTE}{escaped_path}{POWERSHELL_QUOTE}"
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/hooks/git-hooks/verification_notice_context.py

@@ -0,0 +1,253 @@
+"""Load repository context used by the native Git verification notice."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from collections.abc import Mapping
+from dataclasses import dataclass
+from pathlib import Path
+from urllib.parse import urlsplit
+
+from git_hooks_constants import (
+    GIT_COMMAND_TIMEOUT_SECONDS,
+    GIT_EXECUTABLE_NAME,
+    GIT_OUTPUT_DECODE_ERRORS_POLICY,
+    GIT_OUTPUT_ENCODING_NAME,
+)
+from git_hooks_constants.verification_notice_constants import (
+    ALL_GIT_ABSOLUTE_DIRECTORY_QUERY,
+    ALL_GIT_HEAD_QUERY,
+    ALL_GIT_REMOTE_URL_QUERY,
+    ALL_GIT_REPOSITORY_ROOT_QUERY,
+    GIT_COMMAND_SUCCESS_EXIT_CODE,
+    GIT_DIRECTORY_NAME,
+    JSON_ENCODING,
+    LOCAL_VERIFICATION_DIRECTORY_NAME,
+    MANIFEST_DIRECTORY_NAME,
+    MANIFEST_FILE_NAME,
+    MINIMUM_REMOTE_PART_COUNT,
+    OWNER_PART_INDEX,
+    REPORT_FILE_NAME,
+    REPOSITORY_PART_INDEX,
+    SELECTED_MANIFEST_PATH_FIELD,
+    SELECTION_FIELD,
+    TARGET_REPOSITORY_REMOTE,
+)
+from local_verification.manifest import ManifestRunFatal, load_manifest
+
+
+@dataclass(frozen=True)
+class VerificationNoticeContext:
+    event: str
+    repository_remote: str
+    repository_root: Path
+    current_head: str | None
+    manifest_path: Path | None
+    manifest_is_available: bool
+    git_directory: Path | None
+    report_is_present: bool
+    all_report_fields: Mapping[str, object] | None
+
+
+def normalize_repository_remote(remote_url: str) -> str | None:
+    """Return an owner/repository slug from common Git remote URL forms.
+
+    Args:
+        remote_url: Git remote URL to normalize.
+
+    Returns:
+        The normalized owner/repository slug, or None for an invalid URL.
+    """
+    stripped_remote_url = remote_url.strip().rstrip("/")
+    if not stripped_remote_url:
+        return None
+    remote_path = _extract_remote_path(stripped_remote_url)
+    all_remote_parts = [each_part for each_part in remote_path.split("/") if each_part]
+    if len(all_remote_parts) < MINIMUM_REMOTE_PART_COUNT:
+        return None
+    repository_name = all_remote_parts[REPOSITORY_PART_INDEX].removesuffix(GIT_DIRECTORY_NAME)
+    owner_name = all_remote_parts[OWNER_PART_INDEX]
+    if not owner_name or not repository_name:
+        return None
+    return f"{owner_name}/{repository_name}".casefold()
+
+
+def _load_notice_context(
+    event: str, repository_path: Path
+) -> VerificationNoticeContext | None:
+    repository_identity = _load_repository_identity(repository_path)
+    if repository_identity is None:
+        return None
+    repository_root, current_head, git_directory_text = repository_identity
+    normalized_remote = normalize_repository_remote(
+        _run_git_query(repository_root, ALL_GIT_REMOTE_URL_QUERY, False) or ""
+    )
+    if normalized_remote != TARGET_REPOSITORY_REMOTE or current_head is None:
+        return None
+    if not git_directory_text:
+        return None
+    git_directory = _resolve_common_directory(repository_root, git_directory_text)
+    all_report_fields, report_is_present = _load_repository_report(git_directory)
+    manifest_path, manifest_is_available = _load_manifest_context(
+        repository_root, git_directory, all_report_fields
+    )
+    return VerificationNoticeContext(
+        event=event,
+        repository_remote=normalized_remote,
+        repository_root=repository_root,
+        current_head=current_head,
+        manifest_path=manifest_path,
+        manifest_is_available=manifest_is_available,
+        git_directory=git_directory,
+        report_is_present=report_is_present,
+        all_report_fields=all_report_fields,
+    )
+
+
+def _load_manifest_context(
+    repository_root: Path,
+    git_directory: Path,
+    all_report_fields: Mapping[str, object] | None,
+) -> tuple[Path | None, bool]:
+    manifest_path = _resolve_selected_manifest_path(
+        repository_root, git_directory, all_report_fields
+    )
+    return manifest_path, _manifest_is_available(manifest_path)
+
+
+def _load_repository_report(
+    git_directory: Path,
+) -> tuple[Mapping[str, object] | None, bool]:
+    report_path = git_directory / LOCAL_VERIFICATION_DIRECTORY_NAME / REPORT_FILE_NAME
+    return _load_json_mapping(report_path), report_path.is_file()
+
+
+def _resolve_selected_manifest_path(
+    repository_root: Path,
+    git_directory: Path,
+    all_report_fields: Mapping[str, object] | None,
+) -> Path | None:
+    selected_path_text = _read_selected_manifest_path(all_report_fields)
+    if selected_path_text is None:
+        if all_report_fields is not None:
+            return None
+        return repository_root / MANIFEST_DIRECTORY_NAME / MANIFEST_FILE_NAME
+    selected_path = Path(selected_path_text)
+    if not selected_path.is_absolute():
+        selected_path = repository_root / selected_path
+    resolved_path = selected_path.resolve()
+    if _is_inside_repository(resolved_path, repository_root):
+        return resolved_path
+    metadata_directory = git_directory / LOCAL_VERIFICATION_DIRECTORY_NAME
+    if _is_inside_repository(resolved_path, metadata_directory):
+        return resolved_path
+    return None
+
+
+def _read_selected_manifest_path(
+    all_report_fields: Mapping[str, object] | None,
+) -> str | None:
+    if all_report_fields is None:
+        return None
+    selection_record = all_report_fields.get(SELECTION_FIELD)
+    if not isinstance(selection_record, Mapping):
+        return None
+    selected_path_text = selection_record.get(SELECTED_MANIFEST_PATH_FIELD)
+    if not isinstance(selected_path_text, str) or not selected_path_text.strip():
+        return None
+    return selected_path_text
+
+
+def _is_inside_repository(candidate_path: Path, repository_root: Path) -> bool:
+    try:
+        candidate_path.relative_to(repository_root)
+    except ValueError:
+        return False
+    return True
+
+
+def _load_repository_identity(
+    repository_path: Path,
+) -> tuple[Path, str | None, str | None] | None:
+    if not repository_path.is_dir():
+        return None
+    repository_root_text = _run_git_query(
+        repository_path,
+        ALL_GIT_REPOSITORY_ROOT_QUERY,
+        False,
+    )
+    if repository_root_text is None:
+        return None
+    repository_root = Path(repository_root_text).resolve()
+    return (
+        repository_root,
+        _run_git_query(repository_root, ALL_GIT_HEAD_QUERY, False),
+        _run_git_query(repository_root, ALL_GIT_ABSOLUTE_DIRECTORY_QUERY, False),
+    )
+
+
+def _run_git_query(
+    repository_root: Path,
+    all_git_arguments: tuple[str, ...],
+    should_allow_empty: bool,
+) -> str | None:
+    try:
+        completed_process = subprocess.run(
+            [GIT_EXECUTABLE_NAME, *all_git_arguments],
+            cwd=repository_root,
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding=GIT_OUTPUT_ENCODING_NAME,
+            errors=GIT_OUTPUT_DECODE_ERRORS_POLICY,
+            timeout=GIT_COMMAND_TIMEOUT_SECONDS,
+        )
+    except (OSError, subprocess.SubprocessError, UnicodeError):
+        return None
+    if completed_process.returncode != GIT_COMMAND_SUCCESS_EXIT_CODE:
+        return None
+    stripped_stdout = completed_process.stdout.strip()
+    if stripped_stdout or should_allow_empty:
+        return stripped_stdout
+    return None
+
+
+def _extract_remote_path(remote_url: str) -> str:
+    if "://" in remote_url:
+        return urlsplit(remote_url).path
+    if "@" in remote_url and ":" in remote_url:
+        return remote_url.rsplit(":", 1)[1]
+    return remote_url
+
+
+def _resolve_common_directory(
+    repository_root: Path,
+    common_directory_text: str,
+) -> Path:
+    common_directory_path = Path(common_directory_text)
+    if common_directory_path.is_absolute():
+        return common_directory_path.resolve()
+    return (repository_root / common_directory_path).resolve()
+
+
+def _load_json_mapping(json_path: Path) -> Mapping[str, object] | None:
+    if not json_path.is_file():
+        return None
+    try:
+        parsed_json: object = json.loads(json_path.read_text(encoding=JSON_ENCODING))
+    except (OSError, UnicodeError, ValueError):
+        return None
+    if not isinstance(parsed_json, Mapping):
+        return None
+    return parsed_json
+
+
+def _manifest_is_available(manifest_path: Path | None) -> bool:
+    if manifest_path is None:
+        return False
+    try:
+        load_manifest(manifest_path)
+    except (ManifestRunFatal, OSError, UnicodeError, ValueError):
+        return False
+    return True