forgedock 1.18.0 → 1.20.0

package/scripts/fixtures/ci-local/gitlab/docs/d.md

@@ -0,0 +1 @@
+d

package/scripts/fixtures/ci-local/gitlab/src/a.txt

@@ -0,0 +1 @@
+a

package/scripts/fixtures/ci-local/monorepo/.github/workflows/ci.yml

@@ -0,0 +1,13 @@
+name: CI
+on:
+  pull_request:
+jobs:
+  test-a:
+    runs-on: ubuntu-latest
+    steps:
+      - run: bash packages/a/tests/a.test.sh
+      - run: bash packages/b/tests/b.test.sh
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - run: shellcheck -S error packages/a/src/a.sh packages/b/src/b.sh

package/scripts/fixtures/ci-local/monorepo/package-lock.json

@@ -0,0 +1 @@
+{"lockfileVersion":1}

package/scripts/fixtures/ci-local/monorepo/packages/a/src/a.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+a() { echo a; }

package/scripts/fixtures/ci-local/monorepo/packages/a/tests/a.test.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+. "$(dirname "$0")/../src/a.sh"
+[ "$(a)" = a ]

package/scripts/fixtures/ci-local/monorepo/packages/b/src/b.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+b() { echo b; }

package/scripts/fixtures/ci-local/monorepo/packages/b/tests/b.test.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+. "$(dirname "$0")/../src/b.sh"
+[ "$(b)" = b ]

package/scripts/fixtures/ci-local/no-ci/Makefile

@@ -0,0 +1,6 @@
+test:
+	@echo make-test
+lint:
+	@echo make-lint
+build:
+	@echo build

package/scripts/fixtures/ci-local/no-ci/package.json

@@ -0,0 +1 @@
+{ "name": "noci", "version": "1.0.0", "scripts": { "test": "node --test tests/", "lint": "echo lint-ok" } }

package/scripts/fixtures/ci-local/no-ci/src/a.js

@@ -0,0 +1 @@
+module.exports = 1

package/scripts/fixtures/ci-local/no-ci/src/b.js

@@ -0,0 +1 @@
+module.exports = 2

package/scripts/fixtures/ci-local/no-ci/tests/a.test.js

@@ -0,0 +1,2 @@
+const t = require('node:test');
+t('a', () => require('../src/a.js'));

package/scripts/fixtures/ci-local/no-ci/tests/b.test.js

@@ -0,0 +1,2 @@
+const t = require('node:test');
+t('b', () => require('../src/b.js'));

package/scripts/forge-root.test.sh

@@ -464,7 +464,7 @@ for f in $STUB_SITES; do
   expect "$f: forge_root calls without a preceding locator in the same fence" 0 "$(awk '/^[ ]*```/{loc=0} /^[ ]*type forge_resolve >\/dev\/null/{loc=1} /FORGE_ROOT="\$\(forge_root /&&!loc{bad++} END{print bad+0}' "$ROOT/$f")"
 done
 # the spec-count of stub resolutions pins the conversion (a copy dropped or re-inlined changes it)
-for pair in work-on.md:3 work-on/review.md:2 work-on/build/validate.md:2 work-on/investigate.md:1 work-on/decompose.md:1 work-on/close.md:1 work-on/build.md:1 quality-gate.md:4 orchestrate/phase-1-resolve.md:2 orchestrate/phase-4-execution.md:8; do
+for pair in work-on.md:3 work-on/review.md:2 work-on/build/validate.md:5 work-on/investigate.md:1 work-on/decompose.md:1 work-on/close.md:1 work-on/build.md:1 quality-gate.md:4 orchestrate/phase-1-resolve.md:2 orchestrate/phase-4-execution.md:8; do
   f="commands/${pair%%:*}"; n="${pair##*:}"
   expect "$f: FORGE_ROOT stub resolutions" "$n" "$(grep -cF "$FR_LINE" "$ROOT/$f" || true)"
 done

package/scripts/lib/telemetry.sh

@@ -51,6 +51,9 @@ _forge_tel_record() { # event k=v... -> one JSON line on stdout
        run: ($run | str), phase: ($phase | str), event: $ev, eid: $eid} + $p' --args "${args[@]}"
 }
 
+# build_selfreview (forge#3971: tier, agents, findings, fixed, declined, skipped=<reason>; ids and counts only) has no review-side
+# routing: it defaults to the issue target below, like diff_size.
+# finding_disposition payload is generic key=value (incl. scope=introduced|pre-existing|unknown); no per-field allowlist applies.
 # Prints "<number> <repo>" of the comment target (issue or PR) for this event, or nothing when none is usable.
 _forge_tel_target() {
   local ev="$1" repo="$2" n

package/scripts/remediate-approved-head.test.sh

@@ -5,6 +5,8 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
 set -uo pipefail
+# Every mktemp below lands in one private dir that the EXIT trap removes (forge#4016).
+_SUITE_TMP=$(mktemp -d); export TMPDIR="$_SUITE_TMP"; trap 'rm -rf "$_SUITE_TMP"' EXIT
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 SPEC="$ROOT/commands/work-on/remediate.md"

package/scripts/remediate-basesync.test.sh

@@ -66,7 +66,7 @@ eq "MERGE_RC/MERGE_OUT read only in the fence that sets them" "$FENCE_USE" "$FEN
 has "refused park posts needs-human from the sync fence" 'echo "BLOCKED: base-sync: merge refused'
 
 # Behavioural: dirty tree + base change -> refused (rc!=0, no MERGE_HEAD, empty U-list); real conflict -> MERGE_HEAD present.
-T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+T="$(mktemp -d)"; trap 'rm -rf "$T" "$CAPDIR"' EXIT
 (
   cd "$T" && git init -q -b main . && git config user.email t@t && git config user.name t
   echo a > f && git add f && git commit -qm base

package/scripts/review-acceptance-gate.sh

@@ -79,12 +79,12 @@ while IFS= read -r check_line; do
         ERR=$(eval "$TARGET" 2>&1 >/dev/null); RC=$?
         # grep exit >= 2 is a usage error, not a verdict; only a positively identified usage error (classify-grep-exit.sh) is malformed; a missing operand stays a real FAIL even with stderr suppressed.
         [ "$RC" -ge 2 ] && MALFORMED=$(bash "$GREP_CLS" "$RC" "$ERR" "$TARGET" 2>/dev/null)
-        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && printf '%s' "$ERR" | grep -qF 'command not found' && MALFORMED="command not found (rc 127): the target is not an executable command"
+        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && { FIRST=${TARGET#"${TARGET%%[![:space:]]*}"}; FIRST=${FIRST%%[[:space:]]*}; [ -n "$FIRST" ] && [ "${FIRST#*/}" = "$FIRST" ] && ! command -v -- "$FIRST" >/dev/null 2>&1 && printf '%s\n' "$ERR" | grep -qE "(^|: )$(printf '%s' "$FIRST" | sed 's/[][\.*^$(){}?+|/]/\\&/g'):"; } && MALFORMED="command not found (rc 127): the target is not an executable command"
         [ "$RC" -eq 0 ] || [ -n "$MALFORMED" ] || { RESULT="FAIL"; DETAIL="command exited non-zero: $TARGET"; }
       else
         ERRF=$(mktemp); OUTPUT=$(eval "$TARGET" 2>"$ERRF"); RC=$?; ERR=$(cat "$ERRF"); rm -f "$ERRF"; [ -z "$ERR" ] || OUTPUT="${OUTPUT}${OUTPUT:+$'\n'}${ERR}" # classify on stderr only, match on both
         [ "$RC" -ge 2 ] && MALFORMED=$(bash "$GREP_CLS" "$RC" "$ERR" "$TARGET" 2>/dev/null)
-        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && printf '%s' "$ERR" | grep -qF 'command not found' && MALFORMED="command not found (rc 127): the target is not an executable command"
+        [ "$RC" -eq 127 ] && [ -z "$MALFORMED" ] && { FIRST=${TARGET#"${TARGET%%[![:space:]]*}"}; FIRST=${FIRST%%[[:space:]]*}; [ -n "$FIRST" ] && [ "${FIRST#*/}" = "$FIRST" ] && ! command -v -- "$FIRST" >/dev/null 2>&1 && printf '%s\n' "$ERR" | grep -qE "(^|: )$(printf '%s' "$FIRST" | sed 's/[][\.*^$(){}?+|/]/\\&/g'):"; } && MALFORMED="command not found (rc 127): the target is not an executable command"
         if [ -n "$MALFORMED" ]; then :
         else
           printf '%s\n' "$OUTPUT" | grep -qE "$MATCHER" || printf '%s\n' "$OUTPUT" | grep -qF -- "$MATCHER" \

package/scripts/review-acceptance-gate.test.sh

@@ -90,6 +90,23 @@ inv "$(chk ac-1 true)" "$(chk ac-7 "echo 'unbalanced")"; rc=$(run); eq "mixed pa
 grep -q ':PASSED:' "$TMP/out" && grep -qi 'malformed' "$TMP/out" && ok "mixed: PASSED with malformed listed" || bad "mixed: wrong output"
 inv "$(chk ac-1 false)" "$(chk ac-7 "echo 'unbalanced")"; rc=$(run); eq "mixed fail+malformed: fails closed" "$rc" 1
 
+# rc 127 downgrade only when the target's own first word is the missing command (forge#3842).
+printf '#!/bin/bash\nno-such-tool-xyzzy\n' > "$TMP/wt/inner.sh"
+inv "$(chk ac-8 'no-such-cmd-xyzzy --help')"; rc=$(run); eq "first word missing: malformed, rc 0" "$rc" 0
+grep -qi 'malformed' "$TMP/out" && ok "first word missing reported malformed" || bad "first word missing not reported"
+inv "$(chk ac-8 'bash inner.sh')"; rc=$(run); eq "script with missing inner tool is a real fail" "$rc" 1
+inv "$(chk ac-8 'true && no-such-cmd-xyzzy')"; rc=$(run); eq "missing command not first word is a real fail" "$rc" 1
+export LANG=de_DE.UTF-8 LC_MESSAGES=de_DE.UTF-8
+inv "$(chk ac-8 'no-such-cmd-xyzzy --help')"; rc=$(run); eq "non-English locale: first word missing still malformed" "$rc" 0
+grep -qi 'malformed' "$TMP/out" && ok "locale: reported malformed" || bad "locale: not reported malformed"
+unset LANG LC_MESSAGES
+# target runs in its native locale: a locale-dependent verdict (wc -m on multibyte) must not be forced to C
+export LC_ALL=C.UTF-8
+inv "$(chk ac-8 'printf "\303\251" | wc -m | grep -qx 1')"; rc=$(run); eq "target keeps native locale (wc -m multibyte)" "$rc" 0
+unset LC_ALL
+inv 'ACCEPTANCE_CHECK: id=ac-9 type=command target="no-such-cmd-xyzzy" matcher="QQQ" phase=review description=d'; rc=$(run); eq "matcher branch: first word missing malformed" "$rc" 0
+inv 'ACCEPTANCE_CHECK: id=ac-9 type=command target="bash inner.sh" matcher="QQQ" phase=review description=d'; rc=$(run); eq "matcher branch: inner missing tool is a real fail" "$rc" 1
+
 # Selection parity with B6.5 (forge#3809): non-review checks are selected by the `gh pr` target only, never by a phase= text match.
 bt() { printf 'ACCEPTANCE_CHECK: id=%s type=command target="%s" matcher="exit_0" phase=%s description=%s' "$1" "$2" "$3" "$4"; }
 inv "$(bt ac-1 'gh pr view 1 && false' build d)"; rc=$(run); eq "phase=build gh pr check is evaluated (fails)" "$rc" 1
@@ -99,5 +116,8 @@ inv "$(bt ac-1 'false' build d)"; rc=$(run); eq "phase=build non-gh-pr check is
 inv "$(bt ac-1 'gh pr view 1 && false' build 'x phase=review y')"; rc=$(run); eq "phase=review in description does not change selection" "$rc" 1
 inv "$(bt ac-1 'false' build 'x phase=review y')"; rc=$(run); eq "phase=review in description does not select a non-gh-pr check" "$rc" 0
 inv 'ACCEPTANCE_CHECK: id=ac-1 type=command target="gh pr view 1 && false" matcher="exit_0" description=untagged'; rc=$(run); eq "untagged gh pr check is evaluated" "$rc" 1
+# test= tolerance (forge#3630): a test="..." token between phase= and description= does not change phase handling or selection.
+inv 'ACCEPTANCE_CHECK: id=ac-1 type=command target="gh pr view 1 && false" matcher="exit_0" phase=review test="node --test x.mjs" description=d'; rc=$(run); eq "test= token on a phase=review check is tolerated (evaluated, fails)" "$rc" 1
+inv 'ACCEPTANCE_CHECK: id=ac-1 type=command target="false" matcher="exit_0" phase=build test="node --test x.mjs" description=d'; rc=$(run); eq "test= token on a phase=build non-gh-pr check is not selected" "$rc" 0
 
 echo "$PASS passed, $FAILN failed"; [ "$FAILN" -eq 0 ]

package/scripts/review-delta.sh

@@ -172,7 +172,14 @@ while IFS= read -r c; do
   if [ "$rc" -ne 0 ]; then SYNC=0; break; fi         # second parent is not base history
   CC=$(G diff-tree --cc --no-commit-id -r "$c" 2>/dev/null); rc=$?
   [ "$rc" -eq 0 ] || full
-  if [ -n "$CC" ]; then SYNC=0; break; fi            # conflict-resolution content in the merge
+  if [ -n "$CC" ]; then
+    # Non-empty --cc is either hand-written resolution content (not mechanical) or a merge=union result (forge#3969).
+    # Accept only when re-running the merge mechanically reproduces the committed tree exactly: a clean
+    # `merge-tree` (rc 0) whose tree equals the merge commit's. A hand-resolved or hand-edited merge never matches.
+    MT=$(G merge-tree --write-tree "$2" "$3" 2>/dev/null); rc=$?
+    MT=$(printf '%s\n' "$MT" | sed -n 1p)
+    if [ "$rc" -ne 0 ] || [ -z "$MT" ] || [ "$MT" != "$(G rev-parse "${c}^{tree}" 2>/dev/null)" ]; then SYNC=0; break; fi
+  fi
 done <<< "$CHAIN"
 
 # per-path shape of a diff: modes, status and path for every file, plus both blob ids for binary files

package/scripts/review-delta.test.sh

@@ -83,6 +83,25 @@ commit shared.txt "feat side" "feat edits shared"; R=$(sha HEAD); panel "$R"
 g merge -q --no-ff origin/main >/dev/null 2>&1; printf 'resolved\n' > "$W/shared.txt"; g add -A >/dev/null; g commit -q -m "merge main (resolved)" >/dev/null; HEAD=$(sha HEAD)
 out=$(run_rd | sed -n 1p); case "$out" in BASE_SYNC_ONLY*) bad "conflict-resolution merge must not be BASE_SYNC_ONLY (got $out)" ;; *) ok ;; esac
 
+# 5b. union-merged base merge (forge#3969): both sides append a different line to a union-attributed registry.
+# merge=union makes the same-spot append conflict-free, so the sync merge has no resolution edit and stays BASE_SYNC_ONLY.
+mkrepo; g checkout -q main; printf 'e1\ne2\n' > "$W/list.txt"; g add -A >/dev/null; g commit -q -m "registry" >/dev/null; g push -q origin main
+g checkout -q feat; g merge -q --no-ff -m "sync" main >/dev/null 2>&1
+printf 'list.txt merge=union\n' > "$W/.git/info/attributes"
+printf 'e-pr\n' >> "$W/list.txt"; g add -A >/dev/null; g commit -q -m "pr appends" >/dev/null; R=$(sha HEAD); panel "$R"
+g checkout -q main; printf 'e-base\n' >> "$W/list.txt"; g add -A >/dev/null; g commit -q -m "base appends" >/dev/null; g push -q origin main; g checkout -q feat; g fetch -q origin
+if g merge -q --no-ff -m "merge main" origin/main >/dev/null 2>&1; then
+  HEAD=$(sha HEAD)
+  grep -qxF e-pr "$W/list.txt" && grep -qxF e-base "$W/list.txt" && ok || bad "union-merged base merge lost a line"
+  expect "union-merged base merge" "BASE_SYNC_ONLY $R" 1
+else
+  bad "union-merged base merge should be conflict-free"
+fi
+# same union merge, then hand-edited before the merge commit: the mechanical re-merge no longer matches -> not BASE_SYNC_ONLY
+g reset -q --hard "$R"; g merge -q --no-ff --no-commit origin/main >/dev/null 2>&1; printf 'e-hand\n' >> "$W/list.txt"; g add -A >/dev/null; g commit -q -m "merge main (edited)" >/dev/null; HEAD=$(sha HEAD)
+out=$(run_rd | sed -n 1p); case "$out" in BASE_SYNC_ONLY*) bad "hand-edited union merge must not be BASE_SYNC_ONLY (got $out)" ;; *) ok ;; esac
+rm -f "$W/.git/info/attributes"
+
 # 6. mixed: base merge plus a regular commit -> DELTA
 mkrepo; R=$(sha HEAD); panel "$R"; base_advance b.txt "b1"; g merge -q --no-ff -m "merge main" origin/main >/dev/null 2>&1; commit pr.txt "pr2" "pr2"; HEAD=$(sha HEAD)
 expect "base merge plus regular commit" "DELTA $R..$HEAD" 1