claude-dev-env 8.6.0 → 8.7.0

package/scripts/tests/test_review_closure_model.py

@@ -0,0 +1,299 @@
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+import review_closure_model as model
+from dev_env_scripts_constants.review_closure_constants import (
+    APPROVALS_CHECK_NAME,
+    APPROVALS_OPEN_REASON,
+    RED_CIRCLE_MARKER,
+    RED_CIRCLE_OPEN_REASON,
+    UNANSWERED_OPEN_REASON,
+    UNNAMED_THREAD_SUBJECT,
+)
+
+DRIVING_AGENT = frozenset({"claude[bot]"})
+REVIEW_BOT = "qodo-merge-pro[bot]"
+
+
+def thread(
+    *,
+    all_comments: tuple[model.ReviewComment, ...],
+    is_resolved: bool = False,
+    is_outdated: bool = False,
+    subject: str = "scripts/example.py",
+) -> model.ReviewThread:
+    return model.ReviewThread(
+        subject=subject,
+        is_resolved=is_resolved,
+        is_outdated=is_outdated,
+        all_comments=all_comments,
+    )
+
+
+def bot_comment(body: str = "This call drops the return value.") -> model.ReviewComment:
+    return model.ReviewComment(author_login=REVIEW_BOT, body=body)
+
+
+def agent_comment(body: str = "Fixed in the next push.") -> model.ReviewComment:
+    return model.ReviewComment(author_login="claude[bot]", body=body)
+
+
+def should_report_an_unanswered_thread_as_open() -> None:
+    finding = model.thread_finding(thread(all_comments=(bot_comment(),)), DRIVING_AGENT)
+
+    assert finding == model.OpenFinding(
+        subject="scripts/example.py", reason=UNANSWERED_OPEN_REASON
+    )
+
+
+def should_close_a_thread_the_driving_agent_replied_to() -> None:
+    answered = thread(all_comments=(bot_comment(), agent_comment()))
+
+    assert model.thread_finding(answered, DRIVING_AGENT) is None
+
+
+def should_leave_a_thread_open_when_only_another_bot_replied() -> None:
+    other_bot = model.ReviewComment(author_login="graphite[bot]", body="Same here.")
+    noisy = thread(all_comments=(bot_comment(), other_bot))
+
+    assert model.thread_finding(noisy, DRIVING_AGENT) is not None
+
+
+def should_close_an_outdated_thread_without_a_reply() -> None:
+    replaced = thread(all_comments=(bot_comment(),), is_outdated=True)
+
+    assert model.thread_finding(replaced, DRIVING_AGENT) is None
+
+
+def should_close_a_resolved_ordinary_thread() -> None:
+    resolved = thread(all_comments=(bot_comment(),), is_resolved=True)
+
+    assert model.thread_finding(resolved, DRIVING_AGENT) is None
+
+
+def should_keep_a_resolved_red_circle_finding_open() -> None:
+    blocking = thread(
+        all_comments=(bot_comment(f"{RED_CIRCLE_MARKER} This drops user input."),),
+        is_resolved=True,
+    )
+
+    finding = model.thread_finding(blocking, DRIVING_AGENT)
+
+    assert finding == model.OpenFinding(
+        subject="scripts/example.py", reason=RED_CIRCLE_OPEN_REASON
+    )
+
+
+def should_close_a_red_circle_finding_the_agent_answered() -> None:
+    answered = thread(
+        all_comments=(
+            bot_comment(f"{RED_CIRCLE_MARKER} This drops user input."),
+            agent_comment(),
+        )
+    )
+
+    assert model.thread_finding(answered, DRIVING_AGENT) is None
+
+
+def should_close_a_red_circle_finding_a_push_replaced() -> None:
+    replaced = thread(
+        all_comments=(bot_comment(f"{RED_CIRCLE_MARKER} This drops user input."),),
+        is_outdated=True,
+    )
+
+    assert model.thread_finding(replaced, DRIVING_AGENT) is None
+
+
+def should_close_a_thread_the_driving_agent_opened() -> None:
+    own = thread(all_comments=(agent_comment("Reading this back for the reviewer."),))
+
+    assert model.thread_finding(own, DRIVING_AGENT) is None
+
+
+def should_report_the_driving_agent_as_the_thread_author() -> None:
+    own = thread(all_comments=(agent_comment(),))
+
+    assert model.opened_by_driver(own, DRIVING_AGENT) is True
+    assert model.opened_by_driver(thread(all_comments=()), DRIVING_AGENT) is False
+
+
+def should_report_a_reply_from_the_driving_agent() -> None:
+    answered = thread(all_comments=(bot_comment(), agent_comment()))
+
+    assert model.has_driver_reply(answered, DRIVING_AGENT) is True
+    assert (
+        model.has_driver_reply(thread(all_comments=(bot_comment(),)), DRIVING_AGENT)
+        is False
+    )
+
+
+def should_report_a_blocking_approvals_row_as_open() -> None:
+    all_findings = model.all_open_findings((), DRIVING_AGENT, "failure")
+
+    assert all_findings == (
+        model.OpenFinding(subject=APPROVALS_CHECK_NAME, reason=APPROVALS_OPEN_REASON),
+    )
+
+
+def should_pass_when_approvals_succeeds_and_no_thread_waits() -> None:
+    answered = thread(all_comments=(bot_comment(), agent_comment()))
+
+    assert model.all_open_findings((answered,), DRIVING_AGENT, "success") == ()
+
+
+def should_pass_where_the_approvals_check_does_not_run() -> None:
+    assert model.all_open_findings((), DRIVING_AGENT, None) == ()
+
+
+def should_report_every_open_thread_and_the_approvals_row() -> None:
+    first = thread(all_comments=(bot_comment(),), subject="scripts/first.py")
+    second = thread(all_comments=(bot_comment(),), subject="scripts/second.py")
+
+    all_findings = model.all_open_findings(
+        (first, second), DRIVING_AGENT, "action_required"
+    )
+
+    assert [each.subject for each in all_findings] == [
+        "scripts/first.py",
+        "scripts/second.py",
+        APPROVALS_CHECK_NAME,
+    ]
+
+
+def should_read_a_graphql_thread_record() -> None:
+    parsed = model.parse_thread(
+        {
+            "path": "scripts/example.py",
+            "isResolved": False,
+            "isOutdated": True,
+            "comments": {
+                "nodes": [
+                    {"body": "A finding.", "author": {"login": REVIEW_BOT}},
+                    {"body": "Answered.", "author": {"login": "claude[bot]"}},
+                ]
+            },
+        }
+    )
+
+    assert parsed == model.ReviewThread(
+        subject="scripts/example.py",
+        is_resolved=False,
+        is_outdated=True,
+        all_comments=(
+            model.ReviewComment(author_login=REVIEW_BOT, body="A finding."),
+            model.ReviewComment(author_login="claude[bot]", body="Answered."),
+        ),
+    )
+
+
+def should_read_a_rest_thread_record() -> None:
+    parsed = model.parse_thread(
+        {
+            "resolved": True,
+            "outdated": False,
+            "comments": [{"body": "A finding.", "user": {"login": REVIEW_BOT}}],
+        }
+    )
+
+    assert parsed == model.ReviewThread(
+        subject=UNNAMED_THREAD_SUBJECT,
+        is_resolved=True,
+        is_outdated=False,
+        all_comments=(model.ReviewComment(author_login=REVIEW_BOT, body="A finding."),),
+    )
+
+
+def should_read_a_thread_that_carries_no_comments() -> None:
+    parsed = model.parse_thread({"path": "scripts/example.py"})
+
+    assert parsed.all_comments == ()
+    assert model.carries_red_circle(parsed) is False
+
+
+def should_find_the_approvals_conclusion_among_the_check_runs() -> None:
+    all_check_runs = [
+        {"name": "Python suite (ubuntu)", "conclusion": "success"},
+        {"name": APPROVALS_CHECK_NAME, "conclusion": "failure"},
+    ]
+
+    assert model.approvals_conclusion(all_check_runs) == "failure"
+
+
+def should_report_no_conclusion_where_approvals_does_not_run() -> None:
+    assert model.approvals_conclusion([{"name": "Python suite (ubuntu)"}]) is None
+
+
+def should_count_the_pull_request_author_as_the_driving_agent() -> None:
+    all_logins = model.driver_logins({"user": {"login": "claude[bot]"}}, [])
+
+    assert all_logins == frozenset({"claude[bot]"})
+
+
+def should_add_each_login_named_on_the_command_line() -> None:
+    all_logins = model.driver_logins({"user": {"login": "claude[bot]"}}, ["JonEcho"])
+
+    assert all_logins == frozenset({"claude[bot]", "JonEcho"})
+
+
+def should_read_the_head_commit_from_the_pull_request() -> None:
+    assert model.head_sha({"head": {"sha": "ab845eb"}}) == "ab845eb"
+    assert model.head_sha({}) == ""
+
+
+def should_name_the_open_count_in_the_verdict_line() -> None:
+    line = model.verdict_line(
+        "jl-cmd/claude-dev-env",
+        {"number": 1442, "head": {"sha": "ab845ebc0ffee11"}},
+        (model.OpenFinding(subject="scripts/example.py", reason="waiting"),),
+    )
+
+    assert line.startswith("OPEN jl-cmd/claude-dev-env#1442 ab845eb :: 1 review")
+
+
+def should_name_the_closed_state_in_the_verdict_line() -> None:
+    line = model.verdict_line(
+        "jl-cmd/claude-dev-env",
+        {"number": 1442, "head": {"sha": "ab845ebc0ffee11"}},
+        (),
+    )
+
+    assert line.startswith("CLOSED jl-cmd/claude-dev-env#1442 ab845eb ::")
+
+
+def should_join_a_session_route_thread_with_its_comments() -> None:
+    parsed = model.parse_thread(
+        {"path": "scripts/example.py", "resolved": False, "comment_ids": [11, 12]},
+        {
+            11: {"body": "A finding.", "user": {"login": REVIEW_BOT}},
+            12: {"body": "Answered.", "user": {"login": "claude[bot]"}},
+        },
+    )
+
+    assert [each.author_login for each in parsed.all_comments] == [
+        REVIEW_BOT,
+        "claude[bot]",
+    ]
+    assert model.thread_finding(parsed, DRIVING_AGENT) is None
+
+
+def should_skip_a_comment_identifier_the_listing_does_not_carry() -> None:
+    parsed = model.parse_thread(
+        {"path": "scripts/example.py", "comment_ids": [11, 99]},
+        {11: {"body": "A finding.", "user": {"login": REVIEW_BOT}}},
+    )
+
+    assert len(parsed.all_comments) == 1
+
+
+def should_key_the_review_comments_by_identifier() -> None:
+    all_comment_records = model.comment_records_by_id(
+        [{"id": 11, "body": "A finding."}, {"body": "no identifier"}, "not a record"]
+    )
+
+    assert all_comment_records == {11: {"id": 11, "body": "A finding."}}

package/scripts/tests/test_tracked_secrets.py

@@ -45,6 +45,9 @@ _PII_PREVENTION_CONSTANTS = load_hooks_module(
 )
 _PII_CATEGORY_EMAIL = _PII_PREVENTION_CONSTANTS.CATEGORY_EMAIL
 _PII_CATEGORY_HOME_PATH = _PII_PREVENTION_CONSTANTS.CATEGORY_HOME_PATH
+_PII_CATEGORY_PRIVATE_IP = _PII_PREVENTION_CONSTANTS.CATEGORY_PRIVATE_IP
+_OWNED_ADDRESS = "10.83.21.14"
+_OWNED_ADDRESS_RELATIVE_PATH = "src/runner.py"
 
 
 def test_should_flag_a_tracked_secret(tmp_path: Path) -> None:
@@ -265,3 +268,42 @@ def _install_exact_email_exemption(monkeypatch: pytest.MonkeyPatch) -> None:
             }
         ),
     )
+
+
+def test_should_clear_a_private_address_a_committed_entry_owns(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(
+        repository_root / _OWNED_ADDRESS_RELATIVE_PATH, f"host = '{_OWNED_ADDRESS}'\n"
+    )
+    write_text(
+        repository_root / _OTHER_NOTES_RELATIVE_PATH, f"host = '{_OWNED_ADDRESS}'\n"
+    )
+    write_text(
+        repository_root / "config" / "repository-policy.json",
+        json.dumps(
+            {
+                "version": 1,
+                "private_ip_exemptions": [
+                    {
+                        "path": _OWNED_ADDRESS_RELATIVE_PATH,
+                        "sha256": hashlib.sha256(
+                            _OWNED_ADDRESS.encode(_UTF8_ENCODING)
+                        ).hexdigest(),
+                        "reason": "Documented address of the shared build runner",
+                    }
+                ],
+            }
+        ),
+    )
+    commit_tracked_files(repository_root)
+
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+
+    assert _PII_CATEGORY_PRIVATE_IP not in _pii_categories_for_path(
+        stdout_text, _OWNED_ADDRESS_RELATIVE_PATH
+    )
+    assert _PII_CATEGORY_PRIVATE_IP in _pii_categories_for_path(
+        stdout_text, _OTHER_NOTES_RELATIVE_PATH
+    )
+    assert exit_code == FINDINGS_EXIT_CODE

package/hooks/hooks_constants/precommit_code_rules_gate_constants.py

@@ -1,12 +0,0 @@
-"""Constants for git-repository-root resolution.
-
-The git-repository-root resolution command and its timeout, used by
-``resolve_repository_root`` to find the repository a directory belongs to.
-"""
-
-GIT_COMMAND_TIMEOUT_SECONDS: int = 5
-ALL_GIT_REPOSITORY_ROOT_COMMAND: tuple[str, ...] = (
-    "git",
-    "rev-parse",
-    "--show-toplevel",
-)

package/scripts/repository_checks/email_exemptions.py

@@ -1,39 +0,0 @@
-"""Load exact public-email exceptions owned by a repository."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-from repository_checks.config.policy_document import (
-    EMAIL_CATEGORY,
-    EMAIL_EXEMPTION_SUBJECT,
-    EMAIL_EXEMPTIONS_FIELD,
-)
-from repository_checks.policy_document import (
-    PolicyConfigurationRunFatal,
-    entry_path_and_digest,
-    read_policy_entries,
-)
-
-
-def load_email_exemptions(repository_root: Path) -> frozenset[tuple[str, str, str]]:
-    """Read validated email exceptions.
-
-    Args:
-        repository_root: Repository containing the optional policy configuration.
-    Returns:
-        Exact path, email category, and digest identities.
-    Raises:
-        ValueError: Configuration contains invalid JSON or schema fields.
-        OSError: Configuration cannot be read.
-    """
-    exemptions: set[tuple[str, str, str]] = set()
-    for each_entry in read_policy_entries(repository_root, EMAIL_EXEMPTIONS_FIELD):
-        relative_path, digest = entry_path_and_digest(
-            each_entry, EMAIL_EXEMPTION_SUBJECT
-        )
-        identity = (relative_path, EMAIL_CATEGORY, digest)
-        if identity in exemptions:
-            raise PolicyConfigurationRunFatal("Duplicate repository email exemption")
-        exemptions.add(identity)
-    return frozenset(exemptions)

package/scripts/tests/test_email_exemptions.py

@@ -1,158 +0,0 @@
-"""Exact public-contact exceptions preserve all other scanner findings."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-from pathlib import Path
-
-import pytest
-from repository_checks.email_exemptions import load_email_exemptions
-from repository_checks.tracked_secrets import collect_tracked_secret_findings
-
-CONTACT = "fixture-contact@company.io"
-CHANGED_CONTACT = "changed-contact@company.io"
-DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
-
-
-def _write_config(root: Path, entries: list[object]) -> None:
-    directory = root / "config"
-    directory.mkdir(exist_ok=True)
-    (directory / "repository-policy.json").write_text(
-        json.dumps({"version": 1, "email_exemptions": entries}), encoding="utf-8"
-    )
-
-
-def _entry(**changes: object) -> dict[str, object]:
-    return {
-        "path": "contacts.py",
-        "sha256": DIGEST,
-        "reason": "Published support contact",
-        **changes,
-    }
-
-
-def test_only_matching_email_and_path_are_exempt(tmp_path: Path) -> None:
-    _write_config(tmp_path, [_entry()])
-    (tmp_path / "contacts.py").write_text(
-        f"contact = '{CONTACT}'\nchanged = '{CHANGED_CONTACT}'\n", encoding="utf-8"
-    )
-    (tmp_path / "other.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
-    findings = collect_tracked_secret_findings(tmp_path, ["contacts.py", "other.py"])
-    assert [finding.relative_path for finding in findings] == [
-        "contacts.py",
-        "other.py",
-    ]
-    assert all(finding.message.startswith("[email]") for finding in findings)
-
-
-def test_matching_contact_has_no_findings(tmp_path: Path) -> None:
-    _write_config(tmp_path, [_entry()])
-    (tmp_path / "contacts.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
-    assert collect_tracked_secret_findings(tmp_path, ["contacts.py"]) == []
-
-
-@pytest.mark.parametrize(
-    "path",
-    [
-        "/contacts.py",
-        "C:/contacts.py",
-        "../contacts.py",
-        "src/../contacts.py",
-        "*.py",
-        "src/?.py",
-        "src/[a].py",
-        "src\\contacts.py",
-        "src//contacts.py",
-        "./contacts.py",
-        "",
-    ],
-)
-def test_rejects_nonliteral_or_nonrelative_paths(tmp_path: Path, path: str) -> None:
-    _write_config(tmp_path, [_entry(path=path)])
-    with pytest.raises(ValueError):
-        load_email_exemptions(tmp_path)
-
-
-@pytest.mark.parametrize(
-    "entry",
-    [
-        None,
-        {},
-        _entry(reason=" "),
-        _entry(sha256="f" * 63),
-        _entry(sha256="z" * 64),
-        _entry(category="secret"),
-    ],
-)
-def test_rejects_invalid_entries(tmp_path: Path, entry: object) -> None:
-    _write_config(tmp_path, [entry])
-    with pytest.raises(ValueError):
-        load_email_exemptions(tmp_path)
-
-
-def test_rejects_duplicate_entries(tmp_path: Path) -> None:
-    _write_config(tmp_path, [_entry(), _entry(reason="Another explanation")])
-    with pytest.raises(ValueError):
-        load_email_exemptions(tmp_path)
-
-
-@pytest.mark.parametrize(
-    "content",
-    [
-        "{",
-        "[]",
-        '{"version":true,"email_exemptions":[]}',
-        '{"version":1,"email_exemptions":{}}',
-        '{"version":1,"email_exemptions":[],"extra":0}',
-        '{"version":1,"version":1,"email_exemptions":[]}',
-    ],
-)
-def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
-    (tmp_path / "config").mkdir()
-    (tmp_path / "config" / "repository-policy.json").write_text(
-        content, encoding="utf-8"
-    )
-    with pytest.raises(ValueError):
-        collect_tracked_secret_findings(tmp_path, [])
-
-
-def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
-    assert load_email_exemptions(tmp_path) == frozenset()
-
-
-@pytest.mark.parametrize(
-    "document",
-    [
-        {"version": 1},
-        {
-            "version": 1,
-            "path_exemptions": [
-                {
-                    "path": "evidence/manifest.json",
-                    "sha256": DIGEST,
-                    "reason": "Frozen evidence file pinned by its consumers",
-                }
-            ],
-        },
-    ],
-)
-def test_document_without_the_email_list_loads_no_email_exemptions(
-    tmp_path: Path, document: dict[str, object]
-) -> None:
-    """A document may carry the other family, or no exception list at all."""
-    (tmp_path / "config").mkdir()
-    (tmp_path / "config" / "repository-policy.json").write_text(
-        json.dumps(document), encoding="utf-8"
-    )
-    assert load_email_exemptions(tmp_path) == frozenset()
-
-
-def test_reason_rejection_names_the_ownership_requirement(tmp_path: Path) -> None:
-    _write_config(tmp_path, [_entry(reason=" ")])
-    with pytest.raises(ValueError) as rejection:
-        load_email_exemptions(tmp_path)
-    assert (
-        str(rejection.value)
-        == "Email exemption reason must explain why the exception is owned"
-    )