claude-dev-env 7.0.0 → 7.1.0

package/scripts/automatic_advisory/execution.py

@@ -0,0 +1,350 @@
+from __future__ import annotations
+
+import json
+import os
+import signal
+import subprocess
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+from typing import IO
+
+from .config.constants import (
+    CHILD_BASE_FLAG,
+    CHILD_EXECUTOR_FLAG,
+    CHILD_OUTPUT_FLAG,
+    LOCAL_VERIFICATION_CLI_FILENAME,
+    PYTEST_AUTO_WORKERS_ENVIRONMENT_KEY,
+    PYTEST_AUTO_WORKERS_LIMIT,
+    PYTHON_MODULE_ARGUMENT,
+    PYTHONPATH_ENVIRONMENT_KEY,
+    SCOPED_VERIFICATION_SCRIPT_PATH,
+    WINDOWS_PLATFORM,
+    WINDOWS_PRIORITY_CLASS_ATTRIBUTE,
+    WINDOWS_PROCESS_HOST_MODULE,
+    WINDOWS_PROCESS_START_SIGNAL,
+)
+from .config.timing import CHILD_CLEANUP_TIMEOUT_SECONDS
+from .model import AdvisoryRegistration, ChildOutcome
+from .window_flags import hidden_window_creation_flags
+from .windows_job import (
+    _assign_process,
+    _close_handle,
+    _create_kill_on_close_job,
+    _terminate_job,
+)
+
+
+@dataclass(frozen=True)
+class OwnedChildProcess:
+    process: subprocess.Popen[str]
+    process_group_identifier: int | None
+    windows_job_handle: int | None
+
+
+def run_verification_child(
+    registration: AdvisoryRegistration,
+    base_ref: str,
+    timeout_seconds: float,
+) -> ChildOutcome:
+    """Run the existing local verification CLI with a bounded timeout.
+
+    Args:
+        registration: Checkout, manifest, and report paths for the pair.
+        base_ref: Dedicated fetched base revision.
+        timeout_seconds: Maximum child runtime.
+
+    Returns:
+        Captured child status and streams.
+    """
+    scripts_directory = Path(__file__).resolve().parents[1]
+    all_arguments = _build_child_arguments(registration, base_ref, scripts_directory)
+    child_environment = _build_child_environment(registration, scripts_directory)
+    if not _clear_child_artifacts(registration):
+        return ChildOutcome(None, "", "child artifacts could not be cleared", False)
+    maybe_owned_child = _start_child_process(
+        all_arguments, registration, child_environment
+    )
+    if maybe_owned_child is None:
+        return ChildOutcome(None, "", "child process could not start", False)
+    return _collect_child_outcome(maybe_owned_child, timeout_seconds)
+
+
+def _build_child_arguments(
+    registration: AdvisoryRegistration,
+    base_ref: str,
+    scripts_directory: Path,
+) -> tuple[str, ...]:
+    verification_cli_path = (
+        scripts_directory / "local_verification" / LOCAL_VERIFICATION_CLI_FILENAME
+    )
+    return (
+        sys.executable,
+        str(registration.checkout_path / SCOPED_VERIFICATION_SCRIPT_PATH),
+        CHILD_BASE_FLAG,
+        base_ref,
+        CHILD_EXECUTOR_FLAG,
+        str(verification_cli_path),
+        CHILD_OUTPUT_FLAG,
+        str(registration.report_path),
+    )
+
+
+def _build_child_environment(
+    registration: AdvisoryRegistration, scripts_directory: Path
+) -> dict[str, str]:
+    child_environment = os.environ.copy()
+    all_python_paths = [str(registration.checkout_path), str(scripts_directory)]
+    existing_python_path = child_environment.get(PYTHONPATH_ENVIRONMENT_KEY)
+    if existing_python_path:
+        all_python_paths.append(existing_python_path)
+    child_environment[PYTHONPATH_ENVIRONMENT_KEY] = os.pathsep.join(all_python_paths)
+    child_environment[PYTEST_AUTO_WORKERS_ENVIRONMENT_KEY] = PYTEST_AUTO_WORKERS_LIMIT
+    return child_environment
+
+
+def _clear_child_artifacts(registration: AdvisoryRegistration) -> bool:
+    try:
+        for each_artifact_path in (
+            registration.report_path,
+            registration.selected_manifest_path,
+        ):
+            each_artifact_path.unlink(missing_ok=True)
+    except OSError:
+        return False
+    return True
+
+
+def _child_produced_report(
+    child_outcome: ChildOutcome,
+    registration: AdvisoryRegistration,
+) -> bool:
+    if child_outcome.exit_code is None or child_outcome.timed_out:
+        return False
+    if not registration.selected_manifest_path.is_file():
+        return False
+    try:
+        report_fields = json.loads(registration.report_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return False
+    return (
+        isinstance(report_fields, dict)
+        and report_fields.get("exit_code") == child_outcome.exit_code
+    )
+
+
+def _start_child_process(
+    all_arguments: tuple[str, ...],
+    registration: AdvisoryRegistration,
+    all_child_environment: dict[str, str],
+) -> OwnedChildProcess | None:
+    if sys.platform == WINDOWS_PLATFORM:
+        return _start_windows_child(
+            all_arguments,
+            registration,
+            all_child_environment,
+        )
+    return _start_posix_child(
+        all_arguments,
+        registration,
+        all_child_environment,
+    )
+
+
+def _start_posix_child(
+    all_arguments: tuple[str, ...],
+    registration: AdvisoryRegistration,
+    all_child_environment: dict[str, str],
+) -> OwnedChildProcess | None:
+    try:
+        child_process = subprocess.Popen(
+            all_arguments,
+            cwd=registration.checkout_path,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            env=all_child_environment,
+            start_new_session=True,
+        )
+    except OSError:
+        return None
+    return OwnedChildProcess(child_process, child_process.pid, None)
+
+
+def _start_windows_child(
+    all_arguments: tuple[str, ...],
+    registration: AdvisoryRegistration,
+    all_child_environment: dict[str, str],
+) -> OwnedChildProcess | None:
+    maybe_job_handle = _create_kill_on_close_job()
+    if maybe_job_handle is None:
+        return None
+    maybe_child_process = _spawn_windows_process_host(
+        all_arguments,
+        registration,
+        all_child_environment,
+    )
+    if maybe_child_process is None:
+        _close_handle(maybe_job_handle)
+        return None
+    if not _assign_process(maybe_job_handle, maybe_child_process.pid):
+        _stop_unowned_process(maybe_child_process)
+        _close_handle(maybe_job_handle)
+        return None
+    if not _release_windows_process_host(maybe_child_process):
+        _terminate_job(maybe_job_handle)
+        _close_handle(maybe_job_handle)
+        return None
+    return OwnedChildProcess(maybe_child_process, None, maybe_job_handle)
+
+
+def _spawn_windows_process_host(
+    all_arguments: tuple[str, ...],
+    registration: AdvisoryRegistration,
+    all_child_environment: dict[str, str],
+) -> subprocess.Popen[str] | None:
+    try:
+        return subprocess.Popen(
+            (
+                sys.executable,
+                PYTHON_MODULE_ARGUMENT,
+                WINDOWS_PROCESS_HOST_MODULE,
+                *all_arguments,
+            ),
+            cwd=registration.checkout_path,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            env=all_child_environment,
+            creationflags=hidden_window_creation_flags()
+            | getattr(subprocess, WINDOWS_PRIORITY_CLASS_ATTRIBUTE, 0),
+        )
+    except OSError:
+        return None
+
+
+def _release_windows_process_host(child_process: subprocess.Popen[str]) -> bool:
+    stdin_stream = child_process.stdin
+    if stdin_stream is None:
+        return False
+    child_process.stdin = None
+    try:
+        stdin_stream.write(WINDOWS_PROCESS_START_SIGNAL)
+        stdin_stream.flush()
+        return True
+    except OSError:
+        return False
+    finally:
+        _close_stream_without_raising(stdin_stream)
+
+
+def _close_stream_without_raising(stream: IO[str]) -> None:
+    try:
+        stream.close()
+    except OSError:
+        return
+
+
+def _collect_child_outcome(
+    owned_child: OwnedChildProcess,
+    timeout_seconds: float,
+) -> ChildOutcome:
+    child_process = owned_child.process
+    try:
+        try:
+            stdout_text, stderr_text = child_process.communicate(
+                timeout=timeout_seconds
+            )
+        except subprocess.TimeoutExpired as timeout_error:
+            return _stop_timed_out_child(owned_child, timeout_error)
+        return ChildOutcome(
+            child_process.returncode,
+            stdout_text,
+            stderr_text,
+            False,
+        )
+    finally:
+        _close_process_ownership(owned_child)
+        _close_child_streams(child_process)
+        _reap_child_process(child_process)
+
+
+def _stop_timed_out_child(
+    owned_child: OwnedChildProcess,
+    timeout_error: subprocess.TimeoutExpired,
+) -> ChildOutcome:
+    child_process = owned_child.process
+    _terminate_owned_process_tree(owned_child)
+    try:
+        stdout_text, stderr_text = child_process.communicate(
+            timeout=CHILD_CLEANUP_TIMEOUT_SECONDS
+        )
+    except subprocess.TimeoutExpired as cleanup_error:
+        stdout_text = str(cleanup_error.stdout or timeout_error.stdout or "")
+        stderr_text = str(cleanup_error.stderr or timeout_error.stderr or "")
+    return ChildOutcome(None, str(stdout_text), str(stderr_text), True)
+
+
+def _terminate_owned_process_tree(
+    owned_child: OwnedChildProcess,
+) -> None:
+    if owned_child.windows_job_handle is not None:
+        _terminate_job(owned_child.windows_job_handle)
+    if owned_child.process_group_identifier is not None:
+        _kill_posix_process_group(owned_child.process_group_identifier)
+    _kill_direct_child(owned_child.process)
+
+
+def _kill_posix_process_group(process_group_identifier: int) -> None:
+    if sys.platform == "win32":
+        return
+    try:
+        os.killpg(process_group_identifier, signal.SIGKILL)
+    except OSError:
+        return
+
+
+def _kill_direct_child(child_process: subprocess.Popen[str]) -> None:
+    if child_process.poll() is None:
+        try:
+            child_process.kill()
+        except ProcessLookupError:
+            pass
+
+
+def _close_process_ownership(owned_child: OwnedChildProcess) -> None:
+    if owned_child.windows_job_handle is None:
+        return
+    _close_handle(owned_child.windows_job_handle)
+
+
+def _close_child_streams(child_process: subprocess.Popen[str]) -> None:
+    for each_stream in (
+        child_process.stdout,
+        child_process.stderr,
+        child_process.stdin,
+    ):
+        if each_stream is None:
+            continue
+        try:
+            each_stream.close()
+        except OSError:
+            pass
+
+
+def _stop_unowned_process(child_process: subprocess.Popen[str]) -> None:
+    try:
+        child_process.kill()
+    except ProcessLookupError:
+        return
+    _reap_child_process(child_process)
+
+
+def _reap_child_process(child_process: subprocess.Popen[str]) -> None:
+    if child_process.poll() is not None:
+        return
+    try:
+        child_process.wait(timeout=CHILD_CLEANUP_TIMEOUT_SECONDS)
+    except subprocess.TimeoutExpired:
+        return

package/scripts/automatic_advisory/git.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+import os
+import subprocess
+
+from pr_verification.model import PullRequestCandidate
+
+from .config.constants import (
+    GIT_BASE_REFSPEC_TEMPLATE,
+    GIT_EXECUTABLE,
+    GIT_FETCH_ARGUMENT,
+    GIT_FORCE_FLAG,
+    GIT_NO_TAGS_FLAG,
+    GIT_PROMPT_DISABLED_VALUE,
+    GIT_REMOTE_BASE_REFSPEC_TEMPLATE,
+    GIT_TERMINAL_PROMPT_ENVIRONMENT_KEY,
+)
+from .config.timing import GIT_FETCH_TIMEOUT_SECONDS
+from .model import AdvisoryRegistration
+from .window_flags import hidden_window_creation_flags
+
+
+def _fetch_base(
+    registration: AdvisoryRegistration,
+    candidate: PullRequestCandidate,
+) -> bool:
+    all_fetch_refspecs = _base_fetch_refspecs(registration, candidate)
+    try:
+        completed_process = subprocess.run(
+            (
+                GIT_EXECUTABLE,
+                GIT_FETCH_ARGUMENT,
+                GIT_FORCE_FLAG,
+                GIT_NO_TAGS_FLAG,
+                registration.remote_name,
+                *all_fetch_refspecs,
+            ),
+            cwd=registration.checkout_path,
+            capture_output=True,
+            check=False,
+            env=_build_git_environment(),
+            creationflags=hidden_window_creation_flags(),
+            timeout=GIT_FETCH_TIMEOUT_SECONDS,
+        )
+    except subprocess.TimeoutExpired:
+        return False
+    return completed_process.returncode == 0
+
+
+def _base_fetch_refspecs(
+    registration: AdvisoryRegistration,
+    candidate: PullRequestCandidate,
+) -> tuple[str, str]:
+    return (
+        GIT_BASE_REFSPEC_TEMPLATE.format(
+            base_ref=candidate.base_ref,
+            pull_request=registration.pull_request_number,
+        ),
+        GIT_REMOTE_BASE_REFSPEC_TEMPLATE.format(
+            base_ref=candidate.base_ref,
+            remote_name=registration.remote_name,
+        ),
+    )
+
+
+def _build_git_environment() -> dict[str, str]:
+    git_environment = os.environ.copy()
+    git_environment[GIT_TERMINAL_PROMPT_ENVIRONMENT_KEY] = GIT_PROMPT_DISABLED_VALUE
+    return git_environment

package/scripts/automatic_advisory/model.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+
+from pr_verification.model import PullRequestCandidate, RepositorySettings
+
+from .config.constants import (
+    ALL_TERMINAL_STATUSES,
+    POLL_ERROR_LOG_FILE_NAME,
+    POLL_LOCK_DIRECTORY_NAME,
+    SELECTED_MANIFEST_SUFFIX,
+)
+
+
+@dataclass(frozen=True)
+class AdvisoryRegistration:
+    repository: RepositorySettings
+    pull_request_number: int
+    checkout_path: Path
+    manifest_path: PurePosixPath
+    report_path: Path
+    state_path: Path
+    base_ref: str
+    remote_name: str
+
+    @property
+    def manifest_absolute_path(self) -> Path:
+        return self.checkout_path / Path(self.manifest_path)
+
+    @property
+    def selected_manifest_path(self) -> Path:
+        return self.report_path.with_name(
+            self.report_path.stem + SELECTED_MANIFEST_SUFFIX
+        )
+
+    @property
+    def repository_lock_root(self) -> Path:
+        return self.state_path.parent
+
+
+@dataclass(frozen=True)
+class AdvisorySettings:
+    api_url: str
+    app_id: int
+    installation_id: int
+    private_key_path: Path
+    poll_seconds: float
+    child_timeout_seconds: float
+    registrations: tuple[AdvisoryRegistration, ...]
+
+    @property
+    def poll_lock_root(self) -> Path:
+        return self.registrations[0].state_path.parent / POLL_LOCK_DIRECTORY_NAME
+
+    @property
+    def poll_error_log_path(self) -> Path:
+        return self.registrations[0].state_path.parent / POLL_ERROR_LOG_FILE_NAME
+
+
+@dataclass(frozen=True)
+class AdvisoryState:
+    repository: str
+    pull_request_number: int
+    status: str
+    reason: str
+    head_sha: str | None
+    base_sha: str | None
+    last_poll: str
+    last_run: str | None
+    report_path: str
+
+
+@dataclass(frozen=True)
+class ChildOutcome:
+    exit_code: int | None
+    stdout_text: str
+    stderr_text: str
+    timed_out: bool
+
+
+@dataclass(frozen=True)
+class LocalCheckout:
+    head_sha: str | None
+    is_clean: bool
+
+
+def candidate_identity_matches_state(
+    candidate: PullRequestCandidate,
+    maybe_state: AdvisoryState | None,
+) -> bool:
+    """Return whether a terminal state already covers the candidate identity.
+
+    Args:
+        candidate: Current remote pull request identity.
+        maybe_state: Recorded advisory state.
+
+    Returns:
+        True when the same head and base already reached a terminal state.
+    """
+    if maybe_state is None:
+        return False
+    return (
+        maybe_state.head_sha == candidate.head_sha
+        and maybe_state.base_sha == candidate.base_sha
+        and maybe_state.status in ALL_TERMINAL_STATUSES
+    )

package/scripts/automatic_advisory/process_host.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+from collections.abc import Sequence
+
+from pr_verification.config.constants import INCOMPLETE_EXIT_CODE
+
+from .config.constants import WINDOWS_PROCESS_START_SIGNAL
+
+
+def run_owned_child(all_arguments: Sequence[str]) -> int:
+    """Wait for ownership, then run the advisory child.
+
+    Args:
+        all_arguments: Child executable and arguments.
+
+    Returns:
+        Child exit code or the incomplete exit code when ownership is absent.
+    """
+    if sys.stdin.read(1) != WINDOWS_PROCESS_START_SIGNAL:
+        return INCOMPLETE_EXIT_CODE
+    completed_process = subprocess.run(
+        tuple(all_arguments),
+        shell=False,
+        check=False,
+    )
+    return completed_process.returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(run_owned_child(sys.argv[1:]))

package/scripts/automatic_advisory/publisher.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from importlib import import_module
+from pathlib import Path
+from typing import Protocol
+
+from pr_verification.config.constants import STATUS_FAILURE, STATUS_SUCCESS
+from pr_verification.model import RepositorySettings
+
+from .config.constants import STATE_STATUS_FAILED, STATE_STATUS_PASSED
+
+
+class Publication(Protocol):
+    @property
+    def status(self) -> str: ...
+
+    @property
+    def description(self) -> str: ...
+
+
+class PublicationStatus(Protocol):
+    @property
+    def value(self) -> str: ...
+
+
+class PublisherOutcome(Protocol):
+    @property
+    def status(self) -> PublicationStatus: ...
+
+    @property
+    def description(self) -> str: ...
+
+
+@dataclass(frozen=True)
+class PublicationRecord:
+    status: str
+    description: str
+
+
+def _publish_report(
+    github: object,
+    repository: RepositorySettings,
+    pull_request_number: int,
+    checkout_path: Path,
+    manifest_path: Path,
+    report_path: Path,
+) -> Publication:
+    publisher_module = import_module("local_report_publisher")
+    publisher_function: Callable[..., PublisherOutcome] = (
+        publisher_module.publish_local_report
+    )
+    publication_outcome = publisher_function(
+        github,
+        repository,
+        pull_request_number,
+        checkout_path,
+        manifest_path,
+        report_path,
+    )
+    publication_status = publication_outcome.status
+    publication_description = publication_outcome.description
+    return PublicationRecord(
+        _normalize_publication_status(publication_status),
+        publication_description,
+    )
+
+
+def _normalize_publication_status(publication_status: PublicationStatus) -> str:
+    status_text = publication_status.value
+    if status_text == STATUS_SUCCESS:
+        return STATUS_SUCCESS
+    if status_text == STATUS_FAILURE:
+        return STATUS_FAILURE
+    return status_text
+
+
+def _cache_status_for_publication(publication_status: str) -> str:
+    if publication_status == STATUS_SUCCESS:
+        return STATE_STATUS_PASSED
+    if publication_status == STATUS_FAILURE:
+        return STATE_STATUS_FAILED
+    return publication_status