forgedock 1.16.2 → 1.18.0

package/scripts/resolve-deploy-gate.sh

@@ -11,7 +11,9 @@
 # A base is the deploy gate when it is empty/`null`, the literal `main` (hard
 # floor), the repository's GitHub default branch (`default_branch`), or the
 # `branches.default` of the default branch's COMMITTED forge.yaml
-# (`origin/<default>:forge.yaml`, falling back to the contents API) or of an
+# (`refs/remotes/origin/<default>:forge.yaml`, falling back to the contents API;
+# if neither source is readable the result is `true`, never `false`; a source that
+# cleanly reports forge.yaml absent is "no config" and falls through) or of an
 # explicit trusted config (FORGE_TRUSTED_CONFIG, orchestrator-supplied).
 #
 # It NEVER reads forge.yaml from $PWD: the PR worktree is author-controlled, so
@@ -34,13 +36,37 @@ GH_DEFAULT=$(gh api "repos/${REPO}" --jq .default_branch 2>/dev/null || echo "")
 
 _cfg_default() { yq '.branches.default // ""' 2>/dev/null || true; }
 
+# Parse stdin's branches.default. Returns non-zero when yq is missing or the
+# parse fails, so "config unreadable" is distinguishable from "no branches.default".
+_cfg_parse() { command -v yq >/dev/null 2>&1 && yq '.branches.default // ""' 2>/dev/null; }
+
 CFG_DEFAULT=""
-# Committed default-branch config only (a ref, never the working tree).
-CFG_DEFAULT=$(git show "origin/${GH_DEFAULT}:forge.yaml" 2>/dev/null | _cfg_default)
-if [ -z "$CFG_DEFAULT" ]; then
-  CFG_DEFAULT=$(gh api "repos/${REPO}/contents/forge.yaml?ref=${GH_DEFAULT}" --jq .content 2>/dev/null \
-    | base64 -d 2>/dev/null | _cfg_default)
+READ_OK=""
+# Committed default-branch config only (a ref, never the working tree). The
+# fully-qualified ref cannot be shadowed by a local tag/branch named origin/<default>.
+# A present ref with no forge.yaml at that path is a clean "no config" read (READ_OK,
+# empty default); an unfetched ref, missing yq or parse error stays unreadable.
+CFG_REF="refs/remotes/origin/${GH_DEFAULT}"
+if git rev-parse -q --verify "${CFG_REF}^{commit}" >/dev/null 2>&1; then
+  if git cat-file -e "${CFG_REF}:forge.yaml" 2>/dev/null; then
+    CFG_RAW=$(git show "${CFG_REF}:forge.yaml" 2>/dev/null) && [ -n "$CFG_RAW" ] \
+      && CFG_DEFAULT=$(printf '%s\n' "$CFG_RAW" | _cfg_parse) && READ_OK=1
+  else
+    READ_OK=1
+  fi
+fi
+if [ -z "$READ_OK" ]; then
+  CFG_DEFAULT=""
+  API_OUT=$(gh api "repos/${REPO}/contents/forge.yaml?ref=${GH_DEFAULT}" --jq .content 2>&1); API_RC=$?
+  if [ "$API_RC" -eq 0 ]; then
+    CFG_RAW=$(printf '%s' "$API_OUT" | base64 -d 2>/dev/null) && [ -n "$CFG_RAW" ] \
+      && CFG_DEFAULT=$(printf '%s\n' "$CFG_RAW" | _cfg_parse) && READ_OK=1
+  elif printf '%s' "$API_OUT" | grep -q 'HTTP 404'; then
+    READ_OK=1   # API says the file does not exist: clean "no config", not a read failure
+  fi
 fi
+# Config unreadable from every source (no yq, ref unfetched, API failing): fail closed.
+[ -n "$READ_OK" ] || emit true
 [ -n "$CFG_DEFAULT" ] && [ "$CFG_DEFAULT" != "null" ] && [ "$BASE" = "$CFG_DEFAULT" ] && emit true
 
 if [ -n "${FORGE_TRUSTED_CONFIG:-}" ] && [ -f "$FORGE_TRUSTED_CONFIG" ]; then

package/scripts/resolve-deploy-gate.test.sh

@@ -9,7 +9,7 @@ TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
 ok() { PASS=$((PASS+1)); }
 bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 
-command -v yq >/dev/null 2>&1 || { echo "SKIP: yq not installed"; exit 0; }
+HAVE_YQ=1; command -v yq >/dev/null 2>&1 || HAVE_YQ=0
 
 # Stub gh: GH_DEFAULT_STUB drives `repos/<r> --jq .default_branch`; contents API unused (fails).
 mkdir -p "$TMP/bin"
@@ -17,6 +17,7 @@ cat > "$TMP/bin/gh" <<'EOF'
 #!/usr/bin/env bash
 case "$*" in
   *"--jq .default_branch"*) [ -n "${GH_FAIL:-}" ] && exit 1; printf '%s\n' "${GH_DEFAULT_STUB:-}" ;;
+  *"contents/forge.yaml"*) [ -n "${GH_CONTENTS_404:-}" ] && { echo "gh: Not Found (HTTP 404)" >&2; exit 1; }; exit 1 ;;
   *) exit 1 ;;
 esac
 EOF
@@ -40,6 +41,7 @@ run() { # base default_stub [env...]
 }
 expect() { [ "$1" = "$2" ] && ok || bad "$3: got '$1' want '$2'"; }
 
+if [ "$HAVE_YQ" = 1 ]; then
 expect "$(run main trunk)" true "main with worktree release"
 expect "$(run release trunk)" false "worktree-declared branch is not a gate"
 expect "$(run staging trunk)" false "staging is fast lane"
@@ -55,5 +57,44 @@ printf 'branches:\n  default: prod\n' > "$TMP/trusted.yaml"
 expect "$(run prod trunk FORGE_TRUSTED_CONFIG="$TMP/trusted.yaml")" true "trusted config default"
 expect "$(run prod trunk)" false "prod without trusted config"
 
+
+# Shadowing: a local tag named origin/trunk carrying a config without `develop`
+# must not displace the committed refs/remotes/origin/trunk config.
+printf 'branches:\n  default: other\n' > "$REPO/forge.yaml"
+git -C "$REPO" add forge.yaml; git -C "$REPO" commit -qm shadow
+git -C "$REPO" tag origin/trunk
+expect "$(run develop trunk)" true "shadow tag origin/trunk does not displace committed config"
+expect "$(run other trunk)" false "shadow tag config is not honoured"
+git -C "$REPO" tag -d origin/trunk >/dev/null
+fi
+
+# Config read fail: no origin ref and failing contents API -> true (fail closed).
+NOREF="$TMP/noref"; git init -q "$NOREF"
+run_in() { # dir base [env...]
+  local dir="$1" base="$2"; shift 2
+  (cd "$dir" && env PATH="$TMP/bin:$PATH" GH_DEFAULT_STUB=trunk "$@" bash "$S" "$base" owner/repo)
+}
+expect "$(run_in "$NOREF" staging)" true "config read fail (no origin ref, API failing) fails closed"
+
+# Missing forge.yaml is a clean "no config" read, not a read failure (falls through to false).
+NOCFG="$TMP/nocfg.git"; NOCFGW="$TMP/nocfgw"
+git init -q --bare "$NOCFG"; git init -q "$NOCFGW"
+git -C "$NOCFGW" config user.email t@t; git -C "$NOCFGW" config user.name t
+echo x > "$NOCFGW/README"; git -C "$NOCFGW" add README; git -C "$NOCFGW" commit -qm init
+git -C "$NOCFGW" branch -M trunk; git -C "$NOCFGW" remote add origin "$NOCFG"
+git -C "$NOCFGW" push -q origin trunk 2>/dev/null; git -C "$NOCFGW" fetch -q origin
+expect "$(run_in "$NOCFGW" staging)" false "forge.yaml absent on default branch ref is no-config (fast lane)"
+expect "$(run_in "$NOCFGW" main)" true "main stays strict with no config"
+expect "$(run_in "$NOCFGW" trunk)" true "github default stays strict with no config"
+# API 404 (ref not fetched, file absent) is also a clean no-config read; other API failures stay closed.
+expect "$(run_in "$NOREF" staging GH_CONTENTS_404=1)" false "contents API 404 is no-config"
+expect "$(run_in "$NOREF" staging)" true "non-404 contents API failure fails closed"
+
+# Config unreadable: yq unusable (a failing stub shadows any real yq; portable to Git Bash, unlike a stripped PATH) even though the ref is readable.
+NOYQ="$TMP/noyqbin"; mkdir -p "$NOYQ"
+printf '#!/usr/bin/env bash\nexit 127\n' > "$NOYQ/yq"; chmod +x "$NOYQ/yq"
+cp "$TMP/bin/gh" "$NOYQ/gh"
+expect "$(cd "$REPO" && env PATH="$NOYQ:$PATH" GH_DEFAULT_STUB=trunk bash "$S" staging owner/repo)" true "config unreadable (yq failing) fails closed"
+
 echo "resolve-deploy-gate.test.sh: $PASS passed, $FAILN failed"
 [ "$FAILN" -eq 0 ]

package/scripts/review-acceptance-gate.sh

@@ -4,13 +4,17 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # Usage: review-acceptance-gate.sh <issue> <gh_repo> "<gh_flag>" <worktree_path>     (DRY_RUN=1 skips gh writes)
-# Evaluates the ACCEPTANCE_CHECK lines the build gate (B6.5) deferred: `phase=review` checks, plus untagged legacy
-# command/behavior checks on a `gh pr` target. Uses its own FORGE:ACCEPTANCE_GATE_REVIEW marker, never the build
+# Evaluates the ACCEPTANCE_CHECK lines the build gate (B6.5) deferred: `phase=review` checks, plus command/behavior
+# checks on a `gh pr` target (B6.5's legacy deferral ignores any phase= tag, so a tagged phase=build one is selected too). Uses its own FORGE:ACCEPTANCE_GATE_REVIEW marker, never the build
 # gate's FORGE:ACCEPTANCE_GATE header or :PASSED/:FAILED/:BLOCKED sentinels (the engine reads those).
 # Malformed checks (forge#3694 parity with B6.5: 4+ backslash run, `bash -n` parse failure, grep usage error) are skipped and listed,
 # never a FAIL and never needs-human. With zero verified checks and some malformed, a non-blocking notice is posted (no PASSED marker).
 # Exit: 0 passed / no-op / notice / already passed for this head, 1 a deferred check failed (issue gets needs-human).
 set -uo pipefail
+# Telemetry (forge#3834): best-effort decision record; never changes stdout, stderr or the exit code.
+_TEL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/telemetry.sh"; [ -f "$_TEL" ] && . "$_TEL" 2>/dev/null
+type forge_emit >/dev/null 2>&1 || forge_emit() { :; }
+[ -z "${DRY_RUN:-}" ] || FORGE_TELEMETRY=off
 
 NUMBER="${1:?issue number}"; GH_REPO="${2:?repo}"; GH_FLAG="${3:-}"; WT="${4:-.}"
 cd "$WT" || exit 2
@@ -42,6 +46,7 @@ if printf '%s' "$LAST" | grep -qF "<!-- FORGE:ACCEPTANCE_GATE_REVIEW:PASSED:${HE
 fi
 
 CHECKS=$(printf '%s\n' "$TRUSTED_INV" | jq -r '.' 2>/dev/null | grep "^ACCEPTANCE_CHECK:")
+GREP_CLS=$(forge_resolve classify-grep-exit.sh) # unresolved = grep exit>=2 stays a real FAIL (fail closed, forge#3802)
 GATE_PASS=true; FAILED=""; VERIFIED_COUNT=0; MALFORMED_CHECKS=""; RESULTS=""
 while IFS= read -r check_line; do
   [ -z "$check_line" ] && continue
@@ -57,12 +62,12 @@ while IFS= read -r check_line; do
   [ "$PHASE" = "review" ] || PHASE=build
   case "$TYPE" in command|behavior) ;; *) [ "$PHASE" = "review" ] || continue ;; esac
   if [ "$PHASE" != "review" ]; then
-    printf '%s\n' "$check_line" | grep -qE ' phase=(build|review)( |$)' && continue
     case "$TARGET" in *'gh pr'*) ;; *) continue ;; esac
   fi
   # malformed-check (forge#3694): static screen only parses (bash -n), never executes.
   MALFORMED=""
   { [ "$TYPE" = "command" ] || [ "$TYPE" = "behavior" ]; } && { case "$TARGET" in *'\\\\'*) MALFORMED="run of 4+ backslashes (over-escaped target)";; esac; [ -n "$MALFORMED" ] || bash -n -c "$TARGET" 2>/dev/null || MALFORMED="shell syntax error (unbalanced quotes)"; }
+  { [ "$TYPE" = "command" ] || [ "$TYPE" = "behavior" ]; } && [ -z "$MALFORMED" ] && case "$(printf '%s' "$TARGET" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')" in none) MALFORMED='target "none" is not a command (a manual criterion must be type=skipped)';; esac
   if [ -n "$MALFORMED" ]; then MALFORMED_CHECKS="${MALFORMED_CHECKS}\n- **$ID** ($DESC): $MALFORMED"; continue; fi
   RESULT="PASS"; DETAIL=""
   case "$TYPE" in
@@ -72,12 +77,14 @@ while IFS= read -r check_line; do
     command|behavior)
       if [ "$MATCHER" = "exit_0" ]; then
         ERR=$(eval "$TARGET" 2>&1 >/dev/null); RC=$?
-        # grep exit >= 2 is a usage error, not a verdict; a missing/unreadable operand also exits 2 but stays a real FAIL.
-        [ "$RC" -ge 2 ] && case "$TARGET" in grep\ *|egrep\ *|fgrep\ *) printf '%s' "$ERR" | grep -qE 'No such file or directory|Permission denied|Is a directory' || MALFORMED="grep usage error (exit $RC)";; esac
+        # grep exit >= 2 is a usage error, not a verdict; only a positively identified usage error (classify-grep-exit.sh) is malformed; a missing operand stays a real FAIL even with stderr suppressed.
+        [ "$RC" -ge 2 ] && MALFORMED=$(bash "$GREP_CLS" "$RC" "$ERR" "$TARGET" 2>/dev/null)
+        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && printf '%s' "$ERR" | grep -qF 'command not found' && MALFORMED="command not found (rc 127): the target is not an executable command"
         [ "$RC" -eq 0 ] || [ -n "$MALFORMED" ] || { RESULT="FAIL"; DETAIL="command exited non-zero: $TARGET"; }
       else
-        OUTPUT=$(eval "$TARGET" 2>&1); RC=$?; ERR="$OUTPUT"
-        [ "$RC" -ge 2 ] && case "$TARGET" in grep\ *|egrep\ *|fgrep\ *) printf '%s' "$ERR" | grep -qE 'No such file or directory|Permission denied|Is a directory' || MALFORMED="grep usage error (exit $RC)";; esac
+        ERRF=$(mktemp); OUTPUT=$(eval "$TARGET" 2>"$ERRF"); RC=$?; ERR=$(cat "$ERRF"); rm -f "$ERRF"; [ -z "$ERR" ] || OUTPUT="${OUTPUT}${OUTPUT:+$'\n'}${ERR}" # classify on stderr only, match on both
+        [ "$RC" -ge 2 ] && MALFORMED=$(bash "$GREP_CLS" "$RC" "$ERR" "$TARGET" 2>/dev/null)
+        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && printf '%s' "$ERR" | grep -qF 'command not found' && MALFORMED="command not found (rc 127): the target is not an executable command"
         if [ -n "$MALFORMED" ]; then :
         else
           printf '%s\n' "$OUTPUT" | grep -qE "$MATCHER" || printf '%s\n' "$OUTPUT" | grep -qF -- "$MATCHER" \
@@ -95,6 +102,8 @@ done <<< "$CHECKS"
 MALFORMED_SECTION=""
 [ -n "$MALFORMED_CHECKS" ] && MALFORMED_SECTION=$(printf '\n**malformed-check (not counted as failures; regenerate the acceptance spec by re-running investigate)**:%b\n' "$MALFORMED_CHECKS")
 
+_nf=$(printf '%b' "$FAILED" | grep -c '^- ' || true); _nm=$(printf '%b' "$MALFORMED_CHECKS" | grep -c '^- ' || true)
+FORGE_REPO="${FORGE_REPO:-$GH_REPO}" FORGE_ISSUE="${FORGE_ISSUE:-$NUMBER}" forge_emit acceptance_gate phase=review verified="$VERIFIED_COUNT" failed="${_nf:-0}" malformed="${_nm:-0}" deferred=$((VERIFIED_COUNT + ${_nm:-0}))
 if [ "$VERIFIED_COUNT" -eq 0 ] && [ -z "$MALFORMED_CHECKS" ]; then
   echo "No deferred acceptance checks; R2.5 is a no-op."
 elif [ "$VERIFIED_COUNT" -eq 0 ]; then

package/scripts/review-acceptance-gate.test.sh

@@ -75,6 +75,9 @@ inv "$(chk ac-1 false)"; rc=$(run); eq "real fail: rc 1" "$rc" 1
 grep -q 'needs-human' "$TMP/out" && ok "real fail: needs-human added" || bad "real fail: no needs-human"
 inv "$(chk ac-1 'grep -q nomatch f.txt')"; rc=$(run); eq "grep exit 1 is a real fail" "$rc" 1
 inv "$(chk ac-1 'grep -q x nofile.txt')"; rc=$(run); eq "grep missing operand file stays a real fail" "$rc" 1
+inv "$(chk ac-1 'grep -q x nofile.txt 2>/dev/null')"; rc=$(run); eq "stderr-suppressed missing operand is a real fail (forge#3802)" "$rc" 1
+grep -q ':PASSED:' "$TMP/out" && bad "stderr-suppressed missing operand wrote PASSED" || ok "stderr-suppressed missing operand: no PASSED marker"
+inv "$(chk ac-1 'grep -sq x nofile.txt')"; rc=$(run); eq "grep -s missing operand is a real fail (forge#3802)" "$rc" 1
 
 for t in "echo 'unbalanced" 'echo a\\\\\\\\b' "grep -E '[' f.txt"; do
   inv "$(chk ac-7 "$t")"; rc=$(run); eq "malformed skipped, rc 0: $t" "$rc" 0
@@ -87,4 +90,14 @@ inv "$(chk ac-1 true)" "$(chk ac-7 "echo 'unbalanced")"; rc=$(run); eq "mixed pa
 grep -q ':PASSED:' "$TMP/out" && grep -qi 'malformed' "$TMP/out" && ok "mixed: PASSED with malformed listed" || bad "mixed: wrong output"
 inv "$(chk ac-1 false)" "$(chk ac-7 "echo 'unbalanced")"; rc=$(run); eq "mixed fail+malformed: fails closed" "$rc" 1
 
+# Selection parity with B6.5 (forge#3809): non-review checks are selected by the `gh pr` target only, never by a phase= text match.
+bt() { printf 'ACCEPTANCE_CHECK: id=%s type=command target="%s" matcher="exit_0" phase=%s description=%s' "$1" "$2" "$3" "$4"; }
+inv "$(bt ac-1 'gh pr view 1 && false' build d)"; rc=$(run); eq "phase=build gh pr check is evaluated (fails)" "$rc" 1
+inv "$(bt ac-1 'gh pr view 1 && true' build d)"; rc=$(run)
+grep -q ':PASSED:' "$TMP/out" && ok "phase=build gh pr check counted and passes" || bad "phase=build gh pr check not counted"
+inv "$(bt ac-1 'false' build d)"; rc=$(run); eq "phase=build non-gh-pr check is not selected" "$rc" 0
+inv "$(bt ac-1 'gh pr view 1 && false' build 'x phase=review y')"; rc=$(run); eq "phase=review in description does not change selection" "$rc" 1
+inv "$(bt ac-1 'false' build 'x phase=review y')"; rc=$(run); eq "phase=review in description does not select a non-gh-pr check" "$rc" 0
+inv 'ACCEPTANCE_CHECK: id=ac-1 type=command target="gh pr view 1 && false" matcher="exit_0" description=untagged'; rc=$(run); eq "untagged gh pr check is evaluated" "$rc" 1
+
 echo "$PASS passed, $FAILN failed"; [ "$FAILN" -eq 0 ]