claude-dev-env 7.0.0 → 7.1.0

package/scripts/pr_verification/branch_refs.py

@@ -0,0 +1,114 @@
+from __future__ import annotations
+
+import urllib.parse
+from collections.abc import Callable
+from dataclasses import replace
+
+from .config.constants import (
+    GIT_BRANCH_REF_SAFE_CHARACTERS,
+    GIT_BRANCH_REFERENCE_ENDPOINT_TEMPLATE,
+    GIT_REFERENCE_OBJECT_KEY,
+    GIT_REFERENCE_RESOURCE_NAME,
+    PULL_SHA_KEY,
+)
+from .github_parsing import require_mapping, require_text
+from .model import PullRequestCandidate, RepositorySettings
+
+GetJson = Callable[[str], object]
+
+
+def _read_branch_sha(
+    repository: RepositorySettings,
+    base_ref: str,
+    get_json: GetJson,
+) -> str:
+    endpoint = GIT_BRANCH_REFERENCE_ENDPOINT_TEMPLATE.format(
+        repository=repository.slug,
+        base_ref=urllib.parse.quote(
+            base_ref,
+            safe=GIT_BRANCH_REF_SAFE_CHARACTERS,
+        ),
+    )
+    reference = require_mapping(get_json(endpoint), GIT_REFERENCE_RESOURCE_NAME)
+    target = require_mapping(
+        reference.get(GIT_REFERENCE_OBJECT_KEY),
+        GIT_REFERENCE_RESOURCE_NAME,
+    )
+    return require_text(target, PULL_SHA_KEY, GIT_REFERENCE_RESOURCE_NAME)
+
+
+def replace_candidate_base_sha(
+    candidate: PullRequestCandidate,
+    repository: RepositorySettings,
+    get_json: GetJson,
+) -> PullRequestCandidate:
+    """Replace one pull request base SHA with its current branch tip.
+
+    Args:
+        candidate: Pull request candidate from the pulls API.
+        repository: Repository containing the target branch.
+        get_json: Authenticated GitHub JSON reader.
+
+    Returns:
+        Candidate carrying the current target branch SHA.
+    """
+    current_base_sha = _read_branch_sha(repository, candidate.base_ref, get_json)
+    return replace(candidate, base_sha=current_base_sha)
+
+
+def replace_candidate_base_shas(
+    all_candidates: tuple[PullRequestCandidate, ...],
+    repository: RepositorySettings,
+    get_json: GetJson,
+) -> tuple[PullRequestCandidate, ...]:
+    """Replace pull request base SHAs with current unique branch tips.
+
+    Args:
+        all_candidates: Pull request candidates from the pulls API.
+        repository: Repository containing the target branches.
+        get_json: Authenticated GitHub JSON reader.
+
+    Returns:
+        Candidates carrying current target branch SHAs.
+    """
+    base_sha_by_ref = _read_unique_branch_shas(
+        all_candidates,
+        repository,
+        get_json,
+    )
+    return tuple(
+        replace(
+            each_candidate,
+            base_sha=base_sha_by_ref[each_candidate.base_ref],
+        )
+        for each_candidate in all_candidates
+    )
+
+
+def _resolve_candidate_base_shas(
+    all_candidates: list[PullRequestCandidate],
+    repository: RepositorySettings,
+    get_json: GetJson,
+    should_require_merge_commit: bool,
+) -> tuple[PullRequestCandidate, ...]:
+    candidates = tuple(all_candidates)
+    if should_require_merge_commit:
+        return candidates
+    return replace_candidate_base_shas(candidates, repository, get_json)
+
+
+def _read_unique_branch_shas(
+    all_candidates: tuple[PullRequestCandidate, ...],
+    repository: RepositorySettings,
+    get_json: GetJson,
+) -> dict[str, str]:
+    base_sha_by_ref: dict[str, str] = {}
+    for each_candidate in all_candidates:
+        if each_candidate.base_ref in base_sha_by_ref:
+            continue
+        base_sha_by_ref[each_candidate.base_ref] = _read_branch_sha(
+            repository,
+            each_candidate.base_ref,
+            get_json,
+        )
+    return base_sha_by_ref

package/scripts/pr_verification/config/__init__.py

@@ -0,0 +1 @@
+"""Configuration constants for pull request verification."""

package/scripts/pr_verification/config/constants.py

@@ -0,0 +1,84 @@
+import re
+
+SUCCESS_EXIT_CODE = 0
+INCOMPLETE_EXIT_CODE = 3
+HTTP_OK = 200
+HTTP_CREATED = 201
+HTTP_NO_CONTENT = 204
+GITHUB_API_URL = "https://api.github.com"
+GITHUB_PAGE_SIZE = 100
+UTF8_ENCODING = "utf-8"
+JSON_CONTENT_TYPE = "application/json"
+GITHUB_ACCEPT_TYPE = "application/vnd.github+json"
+GITHUB_API_VERSION = "2022-11-28"
+AUTHORIZATION_HEADER = "Authorization"
+ACCEPT_HEADER = "Accept"
+CONTENT_TYPE_HEADER = "Content-Type"
+API_VERSION_HEADER = "X-GitHub-Api-Version"
+BEARER_PREFIX = "Bearer "
+APP_JWT_ALGORITHM = "RS256"
+APP_ISSUER_CLAIM = "iss"
+APP_ISSUED_AT_CLAIM = "iat"
+APP_EXPIRATION_CLAIM = "exp"
+PULL_NUMBER_KEY = "number"
+PULL_DRAFT_KEY = "draft"
+PULL_MERGE_SHA_KEY = "merge_commit_sha"
+PULL_BASE_KEY = "base"
+PULL_HEAD_KEY = "head"
+PULL_REF_KEY = "ref"
+PULL_SHA_KEY = "sha"
+COMMIT_PARENTS_KEY = "parents"
+TOKEN_KEY = "token"
+REPOSITORIES_KEY = "repositories"
+PERMISSIONS_KEY = "permissions"
+CONTENTS_PERMISSION_KEY = "contents"
+PULL_REQUESTS_PERMISSION_KEY = "pull_requests"
+STATUSES_PERMISSION_KEY = "statuses"
+ISSUES_PERMISSION_KEY = "issues"
+READ_PERMISSION = "read"
+WRITE_PERMISSION = "write"
+STATUS_STATE_KEY = "state"
+STATUS_CONTEXT_KEY = "context"
+STATUS_DESCRIPTION_KEY = "description"
+STATUS_PENDING = "pending"
+STATUS_ERROR = "error"
+STATUS_FAILURE = "failure"
+STATUS_SUCCESS = "success"
+LOCAL_CHECKS_CONTEXT = "local-checks"
+LOCAL_CHECKS_PASSED_LABEL = "local-checks:passed"
+PULLS_ENDPOINT_TEMPLATE = (
+    "/repos/{repository}/pulls?state=open&per_page={page_size}&page={page}"
+)
+PULL_ENDPOINT_TEMPLATE = "/repos/{repository}/pulls/{pull_number}"
+GIT_BRANCH_REFERENCE_ENDPOINT_TEMPLATE = "/repos/{repository}/git/ref/heads/{base_ref}"
+GIT_BRANCH_REF_SAFE_CHARACTERS = "/"
+GIT_REFERENCE_OBJECT_KEY = "object"
+GIT_REFERENCE_RESOURCE_NAME = "git reference"
+COMMIT_ENDPOINT_TEMPLATE = "/repos/{repository}/git/commits/{commit_sha}"
+STATUS_ENDPOINT_TEMPLATE = "/repos/{repository}/statuses/{commit_sha}"
+ISSUE_LABELS_ENDPOINT_TEMPLATE = "/repos/{repository}/issues/{pull_number}/labels"
+ISSUE_LABELS_PAGE_ENDPOINT_TEMPLATE = (
+    "/repos/{repository}/issues/{pull_number}/labels?per_page={page_size}&page={page}"
+)
+ISSUE_LABEL_ENDPOINT_TEMPLATE = (
+    "/repos/{repository}/issues/{pull_number}/labels/{label}"
+)
+ISSUE_LABELS_KEY = "labels"
+INSTALLATION_TOKEN_ENDPOINT_TEMPLATE = (
+    "/app/installations/{installation_id}/access_tokens"
+)
+GITHUB_REQUEST_ERROR_TEMPLATE = "GitHub {method} {url} returned {status_code}"
+GITHUB_JSON_ERROR_TEMPLATE = "GitHub returned invalid JSON from {url}"
+GITHUB_SHAPE_ERROR_TEMPLATE = "GitHub returned an invalid {resource} payload"
+PULL_RESOURCE_NAME = "pull request"
+PULL_LIST_RESOURCE_NAME = "pull request list"
+TOKEN_RESOURCE_NAME = "installation token"
+PENDING_DESCRIPTION = "Local verification is running"
+FAILURE_DESCRIPTION = "A required local check failed"
+ERROR_DESCRIPTION = "Local verification did not complete"
+GIT_BARE_SUFFIX = ".git"
+SUPERVISOR_LOCK_FILENAME = "supervisor.lock"
+SUPERVISOR_LOCK_ERROR = "Another verification supervisor owns this cache root"
+SUPERVISOR_LOCK_IO_ERROR = "Verification supervisor lock file is unavailable"
+SUPERVISOR_LOCK_FILE_MODE = 0o600
+REPOSITORY_SLUG_PATTERN = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")

package/scripts/pr_verification/config/timing.py

@@ -0,0 +1,5 @@
+APP_JWT_LIFETIME_SECONDS = 540
+APP_JWT_CLOCK_SKEW_SECONDS = 60
+HTTP_TIMEOUT_SECONDS = 30
+DOCKER_CLEANUP_TIMEOUT_SECONDS = 30
+CHECK_TIMEOUT_GRACE_SECONDS = 15

package/scripts/pr_verification/github.py

@@ -0,0 +1,137 @@
+from __future__ import annotations
+
+import json
+import time
+from collections.abc import Callable
+from pathlib import Path
+
+from . import github_api, github_transport
+from .config.constants import (
+    APP_EXPIRATION_CLAIM,
+    APP_ISSUED_AT_CLAIM,
+    APP_ISSUER_CLAIM,
+    APP_JWT_ALGORITHM,
+    CONTENTS_PERMISSION_KEY,
+    HTTP_CREATED,
+    INSTALLATION_TOKEN_ENDPOINT_TEMPLATE,
+    ISSUES_PERMISSION_KEY,
+    PERMISSIONS_KEY,
+    PULL_REQUESTS_PERMISSION_KEY,
+    READ_PERMISSION,
+    REPOSITORIES_KEY,
+    STATUSES_PERMISSION_KEY,
+    TOKEN_KEY,
+    TOKEN_RESOURCE_NAME,
+    UTF8_ENCODING,
+    WRITE_PERMISSION,
+)
+from .config.timing import (
+    APP_JWT_CLOCK_SKEW_SECONDS,
+    APP_JWT_LIFETIME_SECONDS,
+)
+from .github_api import authorized_headers, request_json
+from .github_parsing import require_mapping, require_text
+from .github_transport import (
+    HttpRequester,
+    JwtEncoder,
+    encode_app_jwt,
+    request_http,
+)
+from .model import RepositorySettings
+
+GitHubApi = github_api.GitHubApi
+GitHubError = github_api.GitHubError
+HttpReply = github_transport.HttpReply
+
+
+def _build_installation_token_body(
+    repository: RepositorySettings, should_write_issue_labels: bool
+) -> bytes:
+    all_permissions = {
+        CONTENTS_PERMISSION_KEY: READ_PERMISSION,
+        PULL_REQUESTS_PERMISSION_KEY: READ_PERMISSION,
+        STATUSES_PERMISSION_KEY: WRITE_PERMISSION,
+    }
+    if should_write_issue_labels:
+        all_permissions[ISSUES_PERMISSION_KEY] = WRITE_PERMISSION
+        all_permissions[PULL_REQUESTS_PERMISSION_KEY] = WRITE_PERMISSION
+    token_request = {
+        REPOSITORIES_KEY: [repository.name],
+        PERMISSIONS_KEY: all_permissions,
+    }
+    return json.dumps(token_request).encode(UTF8_ENCODING)
+
+
+class GitHubAppAuthenticator:
+    def __init__(
+        self,
+        api_url: str,
+        app_id: int,
+        installation_id: int,
+        private_key_path: Path,
+        requester: HttpRequester = request_http,
+        jwt_encoder: JwtEncoder = encode_app_jwt,
+        clock: Callable[[], float] = time.time,
+    ) -> None:
+        self.api_url = api_url
+        self.app_id = app_id
+        self.installation_id = installation_id
+        self.private_key_path = private_key_path
+        self.requester = requester
+        self.jwt_encoder = jwt_encoder
+        self.clock = clock
+
+    def issue_repository_api(
+        self,
+        repository: RepositorySettings,
+        *,
+        should_write_issue_labels: bool = False,
+    ) -> GitHubApi:
+        """Create a repository-scoped API client.
+
+        Args:
+            repository: Repository to scope.
+
+        Returns:
+            Authenticated API client.
+        """
+        installation_token = self._request_repository_token(
+            repository, should_write_issue_labels
+        )
+        return GitHubApi(self.api_url, installation_token, self.requester)
+
+    def _request_repository_token(
+        self, repository: RepositorySettings, should_write_issue_labels: bool
+    ) -> str:
+        app_token = self.create_app_token()
+        endpoint = INSTALLATION_TOKEN_ENDPOINT_TEMPLATE.format(
+            installation_id=self.installation_id
+        )
+        request_body = _build_installation_token_body(
+            repository, should_write_issue_labels
+        )
+        token_payload = request_json(
+            self.requester,
+            "POST",
+            self.api_url + endpoint,
+            authorized_headers(app_token),
+            request_body,
+            HTTP_CREATED,
+        )
+        token_mapping = require_mapping(token_payload, TOKEN_RESOURCE_NAME)
+        return require_text(token_mapping, TOKEN_KEY, TOKEN_RESOURCE_NAME)
+
+    def create_app_token(self) -> str:
+        """Create an app JWT for token exchange.
+
+        Returns:
+            The encoded app token.
+        """
+        current_time = int(self.clock())
+        all_claims: dict[str, int | str] = {
+            APP_ISSUER_CLAIM: str(self.app_id),
+            APP_ISSUED_AT_CLAIM: current_time - APP_JWT_CLOCK_SKEW_SECONDS,
+            APP_EXPIRATION_CLAIM: current_time + APP_JWT_LIFETIME_SECONDS,
+        }
+        private_key = self.private_key_path.read_text(encoding=UTF8_ENCODING)
+        return self.jwt_encoder(all_claims, private_key, APP_JWT_ALGORITHM)