claude-dev-env 8.6.1 → 8.8.0

package/scripts/tests/test_policy_document.py

@@ -7,6 +7,13 @@ import json
 from pathlib import Path
 
 import pytest
+from repository_checks.config.policy_document import (
+    ALL_DOCUMENT_FIELDS,
+    ALL_EXEMPTION_FIELDS,
+    ALL_MATCH_EXEMPTION_FAMILIES,
+    PATH_EXEMPTIONS_FIELD,
+    VERSION_FIELD,
+)
 from repository_checks.policy_document import (
     entry_path_and_digest,
     read_policy_entries,
@@ -92,7 +99,7 @@ def test_entry_validator_returns_the_path_and_digest_without_the_reason() -> Non
 def test_entry_validator_names_the_subject_in_every_rejection(
     entry: object, expected_message: str
 ) -> None:
-    """One validator serves both families, so each message names its subject."""
+    """One validator serves every exemption subject, so each message names its own."""
     with pytest.raises(ValueError) as rejection:
         entry_path_and_digest(entry, "Path exemption")
     assert str(rejection.value) == expected_message
@@ -102,3 +109,34 @@ def test_entry_validator_uses_the_subject_it_is_given() -> None:
     with pytest.raises(ValueError) as rejection:
         entry_path_and_digest({}, "Email exemption")
     assert str(rejection.value) == "Email exemptions require path, sha256, and reason"
+
+
+def test_every_match_family_reads_a_field_the_document_schema_accepts(
+    tmp_path: Path,
+) -> None:
+    for each_family in ALL_MATCH_EXEMPTION_FAMILIES:
+        _write_config(tmp_path, {"version": 1, each_family.field_name: []})
+
+        assert each_family.field_name in ALL_EXEMPTION_FIELDS
+        assert read_policy_entries(tmp_path, each_family.field_name) == []
+
+
+def test_each_match_family_names_its_own_field_category_and_subject() -> None:
+    all_fields = {each.field_name for each in ALL_MATCH_EXEMPTION_FAMILIES}
+    all_categories = {each.category for each in ALL_MATCH_EXEMPTION_FAMILIES}
+    all_subjects = {each.subject for each in ALL_MATCH_EXEMPTION_FAMILIES}
+
+    assert len(all_fields) == len(ALL_MATCH_EXEMPTION_FAMILIES)
+    assert len(all_categories) == len(ALL_MATCH_EXEMPTION_FAMILIES)
+    assert len(all_subjects) == len(ALL_MATCH_EXEMPTION_FAMILIES)
+
+
+def test_all_exemption_fields_is_derived_from_the_match_families_and_path_field() -> (
+    None
+):
+    expected_exemption_fields = {
+        each_family.field_name for each_family in ALL_MATCH_EXEMPTION_FAMILIES
+    } | {PATH_EXEMPTIONS_FIELD}
+
+    assert ALL_EXEMPTION_FIELDS == expected_exemption_fields
+    assert ALL_DOCUMENT_FIELDS == expected_exemption_fields | {VERSION_FIELD}

package/scripts/tests/test_policy_lint_rules_contrast_framing.py

@@ -0,0 +1,68 @@
+"""The contrast-framing rule reaches authored Markdown through the registry."""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapter_contrast_framing, registry
+from policy_lint.model import ContentOrigin, Document, DocumentRule
+
+_RULE_ID = "contrast-framing"
+_DOCUMENT_PATH = "packages/claude-dev-env/rules/example.md"
+
+
+def _document(prose: str, path: str = _DOCUMENT_PATH) -> Document:
+    return Document(
+        PurePosixPath(path),
+        prose,
+        None,
+        None,
+        ContentOrigin.WORKTREE,
+    )
+
+
+def _messages_for(prose: str, repository_root: Path) -> tuple[str, ...]:
+    all_diagnostics = adapter_contrast_framing.contrast_framing_diagnostics(
+        _document(prose), repository_root
+    )
+    return tuple(each_diagnostic.message for each_diagnostic in all_diagnostics)
+
+
+def _registered_rule() -> DocumentRule:
+    for each_rule in registry.default_registry():
+        if each_rule.rule_id == _RULE_ID and isinstance(each_rule, DocumentRule):
+            return each_rule
+    raise AssertionError(_RULE_ID)
+
+
+def test_the_rule_is_registered_for_changed_and_repository_selections() -> None:
+    contrast_rule = _registered_rule()
+
+    assert contrast_rule.rule_sets == frozenset({"changed", "repository"})
+
+
+def test_a_contrast_sentence_reports_with_its_location(tmp_path: Path) -> None:
+    all_diagnostics = adapter_contrast_framing.contrast_framing_diagnostics(
+        _document("Heading line.\nOne answer, not two.\n"), tmp_path
+    )
+
+    assert len(all_diagnostics) == 1
+    assert all_diagnostics[0].rule_id == _RULE_ID
+    assert all_diagnostics[0].location.start_line == 2
+    assert "trailing-comma-not" in all_diagnostics[0].message
+
+
+def test_a_statement_of_what_is_passes(tmp_path: Path) -> None:
+    assert _messages_for("The check names the failing line.\n", tmp_path) == ()
+
+
+def test_the_rule_accepts_authored_markdown_and_skips_the_changelog() -> None:
+    contrast_rule = _registered_rule()
+
+    assert contrast_rule.accepts(_document("text\n"))
+    assert not contrast_rule.accepts(
+        _document("text\n", "packages/claude-dev-env/CHANGELOG.md")
+    )
+    assert not contrast_rule.accepts(
+        _document("text\n", "packages/claude-dev-env/scripts/tool.py")
+    )

package/scripts/tests/test_reporting.py

@@ -12,6 +12,7 @@ if str(_SCRIPTS_DIRECTORY) not in sys.path:
 if str(_TESTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_TESTS_DIRECTORY))
 
+from repository_checks.config.constants import CHECK_ID_PACKAGE_INVENTORY
 from repository_checks.models import RepositoryCheckReport, RepositoryFinding
 from repository_checks.reporting import render_report
 from repository_policy_test_support import (
@@ -52,3 +53,20 @@ def test_should_print_repository_relative_paths_only(tmp_path: Path) -> None:
     assert absolute_root_text not in stdout_text
     assert absolute_root_text not in stderr_text
     assert "notes/CLAUDE.md" in stdout_text
+
+
+def test_should_prefix_an_advisory_finding_line() -> None:
+    report = RepositoryCheckReport(
+        (
+            RepositoryFinding(
+                CHECK_ID_PACKAGE_INVENTORY,
+                "pipeline/check_dialer_seam_cli.py",
+                "production file is absent from package inventory",
+            ),
+        ),
+        (),
+    )
+    assert render_report(report) == (
+        "advisory: package-inventory: pipeline/check_dialer_seam_cli.py: "
+        "production file is absent from package inventory\n"
+    )

package/scripts/tests/test_repository_policy.py

@@ -20,8 +20,17 @@ from repository_checks.config.constants import (
     CHECK_ID_PACKAGE_INVENTORY,
     CHECK_ID_PYTEST_TESTPATHS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    FOLLOWUP_LEDGER_MODULE_NAME,
+    SUCCESS_EXIT_CODE,
+)
+from repository_checks.hook_modules import load_hooks_module
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    seed_clean_repository,
+    write_text,
 )
-from repository_policy_test_support import run_policy, seed_clean_repository
 
 _POLICY_SCRIPT_PATH = _SCRIPTS_DIRECTORY / "repository_policy.py"
 _CHECK_SCRIPT_PATH = _SCRIPTS_DIRECTORY / "check.ps1"
@@ -69,3 +78,36 @@ def test_should_run_the_checker_as_a_subprocess(tmp_path: Path) -> None:
     )
     assert completed.returncode == 0
     assert completed.stdout == ""
+
+
+def test_should_record_a_stale_inventory_and_leave_the_tree_passing(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    package_directory = repository_root / "pipeline"
+    write_text(
+        package_directory / "README.md",
+        "# Pipeline\n\n"
+        "| Path | Role |\n"
+        "|---|---|\n"
+        "| `dialer_compose.py` | Composes a dialer strip. |\n"
+        "| `compose_dialer_cli.py` | CLI for the dialer strip. |\n",
+    )
+    write_text(package_directory / "dialer_compose.py", "x = 1\n")
+    write_text(package_directory / "compose_dialer_cli.py", "x = 1\n")
+    write_text(package_directory / "check_dialer_seam_cli.py", "x = 1\n")
+    commit_tracked_files(repository_root)
+
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert stdout_text == (
+        "advisory: package-inventory: pipeline/check_dialer_seam_cli.py: "
+        "production file is absent from package inventory\n"
+    )
+    ledger = load_hooks_module(FOLLOWUP_LEDGER_MODULE_NAME)
+    all_recorded = ledger.all_recorded_findings(repository_root)
+    assert [each_finding.message for each_finding in all_recorded] == [
+        "production file is absent from package inventory"
+    ]

package/scripts/tests/test_review_closure.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+import review_closure as command
+import review_closure_model as model
+from pr_verification.github_parsing import GitHubError
+
+SLUG = "jl-cmd/claude-dev-env"
+PULL_REQUEST = {
+    "number": 7,
+    "head": {"sha": "ab845eb"},
+    "user": {"login": "claude[bot]"},
+}
+
+
+def bot_comment(body: str = "This call drops the return value.") -> model.ReviewComment:
+    return model.ReviewComment(author_login="qodo-merge-pro[bot]", body=body)
+
+
+def agent_comment() -> model.ReviewComment:
+    return model.ReviewComment(author_login="claude[bot]", body="Fixed and pushed.")
+
+
+def unanswered_thread() -> model.ReviewThread:
+    return model.ReviewThread(
+        subject="scripts/example.py",
+        is_resolved=False,
+        is_outdated=False,
+        all_comments=(bot_comment(),),
+    )
+
+
+def answered_thread() -> model.ReviewThread:
+    return model.ReviewThread(
+        subject="scripts/example.py",
+        is_resolved=False,
+        is_outdated=False,
+        all_comments=(bot_comment(), agent_comment()),
+    )
+
+
+def stub_reads(
+    monkeypatch: pytest.MonkeyPatch,
+    all_threads: tuple[model.ReviewThread, ...],
+    conclusion: str | None = "success",
+) -> None:
+    monkeypatch.setattr(command, "github_token", lambda: "a-token")
+    monkeypatch.setattr(command, "read_pull_request", lambda *_: PULL_REQUEST)
+    monkeypatch.setattr(command, "read_review_threads", lambda *_: all_threads)
+    monkeypatch.setattr(command, "read_approvals_conclusion", lambda *_: conclusion)
+
+
+def should_build_a_parser_that_collects_extra_driver_logins() -> None:
+    parsed = command.build_parser().parse_args(
+        [SLUG, "7", "--driver-login", "JonEcho", "--driver-login", "claude[bot]"]
+    )
+
+    assert parsed.slug == SLUG
+    assert parsed.number == 7
+    assert parsed.driver_login == ["JonEcho", "claude[bot]"]
+
+
+def should_report_an_unanswered_finding(monkeypatch: pytest.MonkeyPatch) -> None:
+    stub_reads(monkeypatch, (unanswered_thread(),))
+
+    report = command.closure_report(SLUG, 7, [], "a-token")
+
+    assert report.verdict.startswith("OPEN")
+    assert [each.subject for each in report.all_findings] == ["scripts/example.py"]
+
+
+def should_report_an_answered_pull_request_as_closed(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    stub_reads(monkeypatch, (answered_thread(),))
+
+    report = command.closure_report(SLUG, 7, [], "a-token")
+
+    assert report.verdict.startswith("CLOSED")
+    assert report.all_findings == ()
+
+
+def should_exit_one_while_a_finding_waits(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    stub_reads(monkeypatch, (unanswered_thread(),))
+
+    status = command.main([SLUG, "7"])
+
+    assert status == 1
+    assert "scripts/example.py" in capsys.readouterr().out
+
+
+def should_exit_zero_once_the_finding_is_answered(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    stub_reads(monkeypatch, (answered_thread(),))
+
+    status = command.main([SLUG, "7"])
+
+    assert status == 0
+    assert capsys.readouterr().out.startswith("CLOSED")
+
+
+def should_exit_two_when_the_state_could_not_be_read(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr(command, "github_token", lambda: "a-token")
+
+    def refuse(*_: object) -> None:
+        raise GitHubError("the proxy refused this read")
+
+    monkeypatch.setattr(command, "read_pull_request", refuse)
+
+    status = command.main([SLUG, "7"])
+
+    assert status == 2
+    assert "refused" in capsys.readouterr().err

package/scripts/tests/test_review_closure_github.py

@@ -0,0 +1,240 @@
+from __future__ import annotations
+
+import json
+import os
+import sys
+from collections.abc import Iterator
+from contextlib import contextmanager
+from pathlib import Path
+
+import pytest
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+import review_closure_github as reader
+from dev_env_scripts_constants.review_closure_constants import APPROVALS_CHECK_NAME
+from pr_verification.github_parsing import GitHubError
+
+TOKEN = os.environ.get("REVIEW_CLOSURE_TEST_TOKEN", "test-value")
+
+
+class FakeReply:
+    def __init__(self, status: int, document: object) -> None:
+        self.status = status
+        self._body = json.dumps(document).encode("utf-8")
+
+    def read(self) -> bytes:
+        return self._body
+
+
+def answer_with(
+    monkeypatch: pytest.MonkeyPatch,
+    all_answers_by_url_fragment: dict[str, tuple[int, object]],
+) -> list[str]:
+    all_requested_urls: list[str] = []
+
+    @contextmanager
+    def fake_urlopen(request: object, timeout: int = 0) -> Iterator[FakeReply]:
+        url = request.full_url
+        all_requested_urls.append(url)
+        for each_fragment, (status, document) in all_answers_by_url_fragment.items():
+            if each_fragment in url:
+                yield FakeReply(status, document)
+                return
+        raise AssertionError(url)
+
+    monkeypatch.setattr(reader.urllib.request, "urlopen", fake_urlopen)
+    return all_requested_urls
+
+
+def should_read_a_token_from_the_environment(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("GH_TOKEN", raising=False)
+    monkeypatch.setenv("GITHUB_TOKEN", TOKEN)
+
+    assert reader.github_token() == TOKEN
+
+
+def should_report_a_missing_token(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("GITHUB_TOKEN", raising=False)
+    monkeypatch.delenv("GH_TOKEN", raising=False)
+
+    with pytest.raises(GitHubError):
+        reader.github_token()
+
+
+def should_send_a_read_and_decode_its_answer(monkeypatch: pytest.MonkeyPatch) -> None:
+    answer_with(monkeypatch, {"/pulls/7": (200, {"number": 7})})
+
+    document = reader.request_json("GET", "https://api.github.com/pulls/7", TOKEN, None)
+
+    assert document == {"number": 7}
+
+
+def should_report_a_status_other_than_success(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(monkeypatch, {"/pulls/7": (404, {})})
+
+    with pytest.raises(GitHubError):
+        reader.request_json("GET", "https://api.github.com/pulls/7", TOKEN, None)
+
+
+def should_read_one_pull_request(monkeypatch: pytest.MonkeyPatch) -> None:
+    answer_with(
+        monkeypatch,
+        {"/pulls/7": (200, {"number": 7, "head": {"sha": "ab845eb"}})},
+    )
+
+    assert reader.read_pull_request("jl-cmd/claude-dev-env", 7, TOKEN) == {
+        "number": 7,
+        "head": {"sha": "ab845eb"},
+    }
+
+
+def should_report_a_pull_request_answer_of_the_wrong_shape(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(monkeypatch, {"/pulls/7": (200, ["not a pull request"])})
+
+    with pytest.raises(GitHubError):
+        reader.read_pull_request("jl-cmd/claude-dev-env", 7, TOKEN)
+
+
+def should_read_review_threads_over_the_session_route(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(
+        monkeypatch,
+        {
+            "ccr/review_threads": (
+                200,
+                [
+                    {
+                        "path": "scripts/example.py",
+                        "resolved": False,
+                        "comment_ids": [11],
+                    }
+                ],
+            ),
+            "/comments": (
+                200,
+                [{"id": 11, "body": "A finding.", "user": {"login": "a-bot"}}],
+            ),
+        },
+    )
+
+    all_threads = reader.read_review_threads("jl-cmd/claude-dev-env", 7, TOKEN)
+
+    assert len(all_threads) == 1
+    assert all_threads[0].subject == "scripts/example.py"
+    assert all_threads[0].all_comments[0].author_login == "a-bot"
+    assert all_threads[0].all_comments[0].body == "A finding."
+
+
+def should_read_the_review_comments_keyed_by_identifier(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(
+        monkeypatch,
+        {"/comments": (200, [{"id": 11, "body": "A finding."}])},
+    )
+
+    all_comment_records = reader.read_review_comments_by_id(
+        "jl-cmd/claude-dev-env", 7, TOKEN
+    )
+
+    assert all_comment_records == {11: {"id": 11, "body": "A finding."}}
+
+
+def should_report_a_comment_page_of_the_wrong_shape(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(monkeypatch, {"/comments": (200, {"message": "not a list"})})
+
+    with pytest.raises(GitHubError):
+        reader.read_review_comments_by_id("jl-cmd/claude-dev-env", 7, TOKEN)
+
+
+def should_fall_back_to_the_graphql_query(monkeypatch: pytest.MonkeyPatch) -> None:
+    all_requested_urls = answer_with(
+        monkeypatch,
+        {
+            "ccr/review_threads": (404, {}),
+            "graphql": (
+                200,
+                {
+                    "data": {
+                        "repository": {
+                            "pullRequest": {
+                                "reviewThreads": {
+                                    "nodes": [
+                                        {
+                                            "path": "scripts/example.py",
+                                            "isResolved": True,
+                                            "isOutdated": False,
+                                            "comments": {"nodes": []},
+                                        }
+                                    ]
+                                }
+                            }
+                        }
+                    }
+                },
+            ),
+        },
+    )
+
+    all_threads = reader.read_review_threads("jl-cmd/claude-dev-env", 7, TOKEN)
+
+    assert [each.is_resolved for each in all_threads] == [True]
+    assert any("graphql" in each_url for each_url in all_requested_urls)
+
+
+def should_report_a_graphql_answer_carrying_no_threads(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(
+        monkeypatch,
+        {
+            "ccr/review_threads": (404, {}),
+            "graphql": (200, {"errors": [{"message": "refused"}]}),
+        },
+    )
+
+    with pytest.raises(GitHubError):
+        reader.read_review_threads("jl-cmd/claude-dev-env", 7, TOKEN)
+
+
+def should_read_the_approvals_conclusion_on_a_head(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(
+        monkeypatch,
+        {
+            "check-runs": (
+                200,
+                {
+                    "check_runs": [
+                        {"name": APPROVALS_CHECK_NAME, "conclusion": "failure"}
+                    ]
+                },
+            )
+        },
+    )
+
+    conclusion = reader.read_approvals_conclusion(
+        "jl-cmd/claude-dev-env", "ab845eb", TOKEN
+    )
+
+    assert conclusion == "failure"
+
+
+def should_report_a_check_run_answer_of_the_wrong_shape(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    answer_with(monkeypatch, {"check-runs": (200, {"check_runs": "none"})})
+
+    with pytest.raises(GitHubError):
+        reader.read_approvals_conclusion("jl-cmd/claude-dev-env", "ab845eb", TOKEN)