forgedock 1.29.1 → 1.31.0

package/bin/lean/checks.mjs

@@ -13,7 +13,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { git, changedFiles, sha256, homeForgeDir, shellSplit, shellQuote, globToRegex } from "../../scripts/ci-local/lib.mjs";
+import { git, changedFiles, sha256, homeForgeDir, shellSplit, shellQuote, globToRegex, parseYaml, trustedForgeYaml } from "../../scripts/ci-local/lib.mjs";
 import { makeScopeCtx, scopeCommand } from "../../scripts/ci-local/scoping.mjs";
 
 const px = path.posix;
@@ -67,16 +67,16 @@ export function discoverChecks(repo) {
     const turbo = turboTasks(repo);
     const scripts = new Map(pkgDirs.map((d) => [d, (readJson(path.join(repo, d, "package.json")) || {}).scripts || {}]));
     for (const [script, kind] of Object.entries(SCRIPT_KINDS)) {
-      if (turbo.has(script)) { out.push({ kind, command: `${exists(repo, "node_modules/.bin/turbo") ? "" : "npx "}turbo run ${script}`, cwd: "." }); continue; }
+      if (turbo.has(script)) { out.push({ kind, command: `${exists(repo, "node_modules/.bin/turbo") ? "" : "npx "}turbo run ${script}`, cwd: ".", eco: "js" }); continue; }
       const ws = pkgDirs.filter((d) => d !== "." && typeof scripts.get(d)[script] === "string").sort();
       const dirs = ws.length ? ws : typeof (scripts.get(".") || {})[script] === "string" ? ["."] : [];
-      for (const d of dirs) out.push({ kind, command: `${pm} run ${script}`, cwd: d, exec: EXEC[pm] });
+      for (const d of dirs) out.push({ kind, command: `${pm} run ${script}`, cwd: d, exec: EXEC[pm], eco: "js" });
     }
   }
   const pyproject = readText(path.join(repo, "pyproject.toml"));
   const run = exists(repo, "uv.lock") ? "uv run " : exists(repo, "poetry.lock") ? "poetry run " : "";
-  if (/^\[tool\.ruff/m.test(pyproject) || exists(repo, "ruff.toml") || exists(repo, ".ruff.toml")) out.push({ kind: "lint", command: `${run}ruff check .`, cwd: "." });
-  if (/^\[tool\.pytest/m.test(pyproject) || exists(repo, "pytest.ini") || tracked.some((f) => px.basename(f) === "conftest.py")) out.push({ kind: "test", command: `${run}pytest`, cwd: "." });
+  if (/^\[tool\.ruff/m.test(pyproject) || exists(repo, "ruff.toml") || exists(repo, ".ruff.toml")) out.push({ kind: "lint", command: `${run}ruff check .`, cwd: ".", eco: "py" });
+  if (/^\[tool\.pytest/m.test(pyproject) || exists(repo, "pytest.ini") || tracked.some((f) => px.basename(f) === "conftest.py")) out.push({ kind: "test", command: `${run}pytest`, cwd: ".", eco: "py" });
   return out;
 }
 
@@ -150,16 +150,39 @@ export function laneChanges(repo, base) {
   return { files: files.filter((f) => !f.startsWith(".forge-lean/")), from };
 }
 
-/** The scoped checks for this lane: [{kind, command, cwd, mode, widen_reason, selector, reason}]. */
-export function scopedChecks({ repo, base, checks = discoverChecks(repo) }) {
+/**
+ * The repo's configured `verification.commands.typescript.lint` (#4381), read only from the trusted forge.yaml copy
+ * (forge#4040: never the PR's own tree). null when absent, empty or unreadable (no yq, parse error).
+ */
+export function configuredLint(repo, base) {
+  try {
+    const mb = git(repo, ["merge-base", base, "HEAD"]).out.trim();
+    const { text } = trustedForgeYaml(repo, base, mb);
+    if (!text) return null;
+    const v = parseYaml(text)?.verification?.commands?.typescript?.lint;
+    return typeof v === "string" && v.trim() ? v.trim() : null;
+  } catch { return null; }
+}
+
+/**
+ * The scoped checks for this lane: [{kind, command, cwd, mode, widen_reason, selector, reason, configured}]. A configured
+ * typescript.lint replaces the discovered JS lint checks (#4381); Python checks are never replaced.
+ */
+export function scopedChecks({ repo, base, checks = discoverChecks(repo), lint = configuredLint(repo, base) }) {
   const { files, from } = laneChanges(repo, base);
   const sctx = makeScopeCtx({ repo, baseRef: base, from, changed: files });
+  if (lint) {
+    const i = checks.findIndex((c) => c.kind === "lint" && c.eco === "js");
+    const own = { kind: "lint", command: lint, cwd: ".", configured: true, ...(exists(repo, "package.json") ? { exec: EXEC[packageManager(repo)] } : {}) };
+    checks = i < 0 ? [...checks, own] : [...checks.slice(0, i), own, ...checks.slice(i).filter((c) => !(c.kind === "lint" && c.eco === "js"))];
+  }
   return checks.map((c) => {
     const r = scopeCommand(c.command, c.cwd === "." ? "" : c.cwd, sctx);
     // A resolved script body (`pnpm run typecheck` -> `tsc -p apps/web`) runs its binary through the package manager.
     const resolved = r.action !== "skip" && c.exec && r.command !== c.command && !SYSTEM_BINS.has(px.basename((shellSplit(r.command) || [""])[0]));
     const out = { kind: c.kind, cwd: c.cwd, command: r.action === "skip" ? "" : resolved ? `${c.exec} ${r.command}` : r.command, mode: r.mode, widen_reason: r.widen_reason || "", selector: r.selector || "" };
     if (r.reason) out.reason = r.reason;
+    if (c.configured) out.configured = true;
     return r.action === "skip" ? out : withCacheFlags(out, repo);
   });
 }
@@ -190,8 +213,8 @@ function main(argv) {
   if (!checks.length) console.log("# no typecheck/lint/test command found");
   for (const c of checks) {
     const where = c.cwd && c.cwd !== "." ? `(cd ${shellQuote(c.cwd)} && ${c.command})` : c.command;
-    if (c.mode === "skip") console.log(`${c.kind} skip  # skipped: ${c.reason || "not affected"}`);
-    else console.log(`${c.kind} ${c.mode} ${where}${c.widen_reason ? `  # widened: ${c.widen_reason}` : ""}`);
+    if (c.mode === "skip") console.log(`${c.kind} skip  # skipped: ${c.reason || "not affected"}${c.configured ? " (configured: verification.commands.typescript.lint)" : ""}`);
+    else console.log(`${c.kind} ${c.mode} ${where}${c.widen_reason ? `  # widened: ${c.widen_reason}` : ""}${c.configured ? "  # configured: verification.commands.typescript.lint" : ""}`);
   }
   return 0;
 }

package/bin/lean/checks.test.mjs

@@ -7,7 +7,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { discoverChecks, scopedChecks, cacheEntry, hydrate, publish, withCacheFlags, LOCAL_CACHE } from "./checks.mjs";
+import { discoverChecks, scopedChecks, configuredLint, cacheEntry, hydrate, publish, withCacheFlags, LOCAL_CACHE } from "./checks.mjs";
+import { yqAvailable } from "../../scripts/ci-local/lib.mjs";
 
 const TMP = tmpDir("checks-4218-");
 process.env.FORGE_CI_LOCAL_HOME = path.join(TMP, "forge-home");
@@ -181,3 +182,79 @@ test("discovery: declared workspace packages' scripts win over the root; undecla
   });
   assert.deepEqual(discoverChecks(r).map((c) => `${c.kind}:${c.command}:${c.cwd}`), ["typecheck:pnpm run typecheck:apps/web", "test:pnpm run test:."]);
 });
+
+// #4381: lint is scoped to the changed packages, never their dependency closure; a configured typescript.lint wins.
+const HAS_YQ = yqAvailable();
+const turboMonorepo = (extra = {}) => repo({
+  ".gitignore": "node_modules/\nforge.yaml\n",
+  "package.json": JSON.stringify({ name: "root", private: true, workspaces: ["apps/*", "packages/*"] }),
+  "pnpm-lock.yaml": "lockfileVersion: '9.0'\n",
+  "turbo.json": JSON.stringify({ tasks: { lint: {}, typecheck: {}, test: {} } }),
+  "packages/db/package.json": JSON.stringify({ name: "db", scripts: { lint: "eslint ." } }),
+  "packages/db/src/index.ts": "export const db = 1;\n",
+  "apps/api/package.json": JSON.stringify({ name: "api", dependencies: { db: "workspace:*" } }),
+  "apps/api/src/index.ts": "export const api = 1;\n",
+  ...extra,
+});
+const TS_LINT_YAML = "verification:\n  commands:\n    typescript:\n      lint: \"pnpm exec eslint --cache packages/db/src\"\n";
+
+test("turbo monorepo: an upstream package change lints only the changed packages; typecheck/test keep dependents", () => {
+  const r = turboMonorepo();
+  touch(r, "packages/db/src/index.ts");
+  const c = byKind(scopedChecks({ repo: r, base: "main", lint: null }));
+  assert.equal(c.lint.selector, "turbo-changed");
+  assert.match(c.lint.command, /^npx turbo run lint '--filter=\[[0-9a-f]{40}\]'$/);
+  assert.doesNotMatch(c.lint.command, /\.\.\.\[/);
+  assert.match(c.typecheck.command, /^npx turbo run typecheck '--filter=\.\.\.\[[0-9a-f]{40}\]'$/);
+  assert.match(c.test.command, /^npx turbo run test '--filter=\.\.\.\[[0-9a-f]{40}\]'$/);
+});
+
+test("turbo: lint-only task lists (lint:*, *:lint) scope to changed packages; mixed lists keep the closure", () => {
+  const r = turboMonorepo();
+  touch(r, "packages/db/src/index.ts");
+  const run = (command) => scopedChecks({ repo: r, base: "main", checks: [{ kind: "lint", command, cwd: "." }], lint: null })[0];
+  assert.equal(run("turbo run lint:types web:lint --concurrency 2").selector, "turbo-changed");
+  assert.equal(run("turbo run lint build").selector, "turbo-affected");
+  assert.equal(run("turbo run lint --filter=web").mode, "full");
+});
+
+test("configured typescript.lint in the main checkout's forge.yaml replaces the discovered lint", { skip: !HAS_YQ && "yq not installed" }, () => {
+  const r = turboMonorepo();
+  fs.writeFileSync(path.join(r, "forge.yaml"), TS_LINT_YAML);
+  const wt = path.join(TMP, `wt${n++}`);
+  git(r, "worktree", "add", "-q", "-b", "lane", wt, "main");
+  touch(wt, "packages/db/src/index.ts");
+  const checks = scopedChecks({ repo: wt, base: "main" });
+  const lints = checks.filter((c) => c.kind === "lint");
+  assert.equal(lints.length, 1);
+  assert.equal(lints[0].configured, true);
+  assert.doesNotMatch(lints[0].command, /turbo/);
+  assert.match(lints[0].command, /eslint .*packages\/db\/src/);
+  assert.deepEqual(checks.map((c) => c.kind), ["typecheck", "lint", "test"]);
+});
+
+test("a PR-tracked forge.yaml is not trusted; without the slot the output equals discovery-only", { skip: !HAS_YQ && "yq not installed" }, () => {
+  const r = turboMonorepo();
+  touch(r, "packages/db/src/index.ts");
+  const before = scopedChecks({ repo: r, base: "main", lint: null });
+  assert.deepEqual(scopedChecks({ repo: r, base: "main" }), before);
+  fs.writeFileSync(path.join(r, "forge.yaml"), "verification:\n  commands:\n    python:\n      lint: \"ruff check .\"\n");
+  assert.deepEqual(scopedChecks({ repo: r, base: "main" }), before);
+  fs.writeFileSync(path.join(r, "forge.yaml"), TS_LINT_YAML);
+  git(r, "add", "-f", "forge.yaml");
+  git(r, "commit", "-qm", "pr config");
+  assert.equal(configuredLint(r, "main"), null);
+  const lint = scopedChecks({ repo: r, base: "main" }).find((c) => c.kind === "lint");
+  assert.equal(lint.configured, undefined);
+  assert.match(lint.command, /^npx turbo run lint/);
+});
+
+test("Python: a configured typescript.lint or python.lint never replaces ruff", { skip: !HAS_YQ && "yq not installed" }, () => {
+  const r = pyRepo("uv.lock", "version = 1\n");
+  fs.appendFileSync(path.join(r, ".gitignore"), "forge.yaml\n");
+  git(r, "commit", "-qam", "ignore forge.yaml");
+  fs.writeFileSync(path.join(r, "forge.yaml"), "verification:\n  commands:\n    python:\n      lint: \"ruff check src\"\n");
+  fs.appendFileSync(path.join(r, "pkg/alpha.py"), "# change\n");
+  assert.equal(configuredLint(r, "main"), null);
+  assert.equal(byKind(scopedChecks({ repo: r, base: "main" })).lint.command, "uv run ruff check pkg/alpha.py");
+});

package/bin/lean/conformance.e2e.test.mjs

@@ -14,6 +14,9 @@ import path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { runCore } from "./lean.mjs";
+import { readLog } from "../engine/runlog.mjs";
+import { runCheckCommand } from "./effects.mjs";
+import { checkFromCli } from "../engine-cli.mjs";
 
 const GIT_ENV = { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@example.invalid", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@example.invalid", GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_NOSYSTEM: "1" };
 const git = (args, cwd) => { try { return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: GIT_ENV }); } catch (e) { throw Object.assign(new Error(`git ${args.join(" ")}: ${e.stderr || e.message}`), { stderr: String(e.stderr ?? "") }); } };
@@ -134,7 +137,7 @@ function builderScript(cs) {
   const finish = (t) => { res.validation = [{ id: "V1", command: V1, exit: t.run(V1) }]; t.lean("implementation.md", `### Approach\nrelease in a catch\n\n### Changes\n${t.changed().map((f) => `- ${f}`).join("\n")}\n\n### Acceptance Criteria Status\n- see result\n\n### Verification\n- ${V1}\n\n### Notes\nnone`); t.lean("result.json", res); };
   return async (n, c, t) => {
     if (n === 1) { t.lean("investigation.md", "**Verdict**: CONFIRMED\n**Confidence**: high\n**Severity**: high\n**Task Type**: bug\n\n### Root Cause\ncheck() throws after reserve() with no release"); t.lean("contract.json", cs.contract()); return; }
-    if (n === 2) { cs.impl(t); t.commit("fix: release on 429"); res = { status: "fixed", summary: "release on 429", requirements: (cs.claims ?? claimAll)(cs.contract()), amendments: [] }; finish(t); return; }
+    if (n === 2) { cs.impl(t); t.commit("fix: release on 429"); if (cs.selfCheck) await cs.selfCheck(c.cwd); res = { status: "fixed", summary: "release on 429", requirements: (cs.claims ?? claimAll)(cs.contract()), amendments: [] }; finish(t); return; }
     if (cs.resume) { cs.resume(t, res); t.commit("fix: conformance"); }
     finish(t);
   };
@@ -162,11 +165,12 @@ function oracle(c) {
 }
 const generic = () => "```json\n" + JSON.stringify({ verdict: "PASS", fixes_issue: true, regression: false, reason: "looks good" }) + "\n```";
 
-async function runCase(cs, conformance = "enforce") {
+async function runCase(cs, conformance = "enforce", extra = {}) {
   const dir = tmpDir("conf-e2e-");
   const w = makeWorld(dir, { builder: builderScript(cs), reviewer: (n, c) => (cs.generic ? generic() : oracle(c)) });
-  const ret = await runCore({ issue: 101, repo: "o/r", lane: "staging", cwd: w.repo, worktreeRoot: path.join(dir, "wt"), dir: path.join(dir, "runs"), io: w.io, random: () => 0.5, stableMs: 0, livePollMs: 20, conformance });
-  return w.observe(ret);
+  if (extra.runCommand) w.io.runCommand = extra.runCommand;
+  const ret = await runCore({ issue: 101, repo: "o/r", lane: "staging", cwd: w.repo, worktreeRoot: path.join(dir, "wt"), dir: path.join(dir, "runs"), io: w.io, random: () => 0.5, stableMs: 0, livePollMs: 20, conformance, ...(extra.opts ?? {}) });
+  return { ...w.observe(ret), log: readLog(path.join(dir, "runs"), 101, { repo: "o/r" }) }; // #4432: keyed by repo
 }
 const blocked = (o, code) => {
   assert.equal(o.ret.terminalReason, "needs-human"); assert.equal(o.ret.code, code);
@@ -185,7 +189,7 @@ describe("conformance gate end-to-end (real git, disposable repo)", { skip: !HAV
     const o = await runCase({ contract: FULL, impl: (t) => fix(t, ["scrape", "search", "export"]) });
     merged(o); assert.ok(o.staging.search && o.staging.export && !o.staging.billingChanged);
     assert.deepEqual([o.counts.builder, o.counts.reviewer], [2, 1]);
-    assert.deepEqual(o.markers, ["FORGE:STARTED", "FORGE:INVESTIGATION", "FORGE:CONTRACT", "FORGE:IMPLEMENTATION", "FORGE:REVIEW", "FORGE:TRAJECTORY"]);
+    assert.deepEqual(o.markers, ["FORGE:STARTED", "FORGE:INVESTIGATION", "FORGE:CONTRACT", "FORGE:IMPLEMENTATION", "FORGE:REVIEW", "FORGE:FACTS", "FORGE:TRAJECTORY"]);
   });
   it("2 omission: the contract silently drops requirement 3; review catches it; issue stays open, nothing merged", async () => {
     const o = await runCase({ contract: OMIT, impl: (t) => fix(t, ["scrape", "search"]) });
@@ -225,6 +229,24 @@ describe("conformance gate end-to-end (real git, disposable repo)", { skip: !HAV
     assert.match(o.issue.comments.find((c) => c.includes("FORGE:REVIEW")), /would BLOCK \(nonconforming\)[\s\S]*conformance\.omission/);
     assert.deepEqual([o.counts.builder, o.counts.reviewer], [2, 1]);
   });
+  it("#4364 forgedock check in the lane worktree runs the engine's commands and reaches its verdict", async () => {
+    let cli = null;
+    const learned = [V1, "exit 3"];
+    const o = await runCase({ contract: FULL, impl: (t) => fix(t, ["scrape", "search", "export"]),
+      selfCheck: async (wt) => { cli = await checkFromCli([], { cwd: wt, git: async (a, cwd) => git(a, cwd), out: () => {} }); } },
+    "enforce", { runCommand: runCheckCommand, opts: { precheck: { commands: learned }, verify: { maxRounds: 0 } } });
+    merged(o);
+    const [engine] = o.log.filter((e) => e.event === "PRECHECK_COMMANDS");
+    assert.deepEqual(cli.commands.map(({ command, rc }) => ({ command, rc })), engine.results.map(({ command, rc }) => ({ command, rc })));
+    assert.deepEqual(engine.results.map((r) => r.rc), [0, 3], "one passing and one failing pre-PR command");
+    // validate: the CLI's V1 run agrees with the engine's conformance precheck (no validate failure)
+    assert.deepEqual(cli.validate.map(({ id, rc }) => ({ id, rc })), [{ id: "V1", rc: 0 }]);
+    assert.ok(!o.log.some((e) => e.event === "PRECHECK" && e.failures.length), "the engine's validate verdict passes too");
+    assert.equal(cli.ok, false); assert.equal(cli.exitCode, 1);
+    // the run was on the final tree, so the engine records it as red (not skipped/stale) on both events
+    assert.equal(engine.self_check, "red");
+    assert.deepEqual(o.log.filter((e) => e.event === "SELF_CHECK_MISSING").map((e) => e.state), ["red"]);
+  });
   it("6 a generic PASS over an incomplete implementation never merges (review.incomplete)", async () => {
     const o = await runCase({ contract: FULL, impl: (t) => fix(t, ["scrape", "export"]), generic: true });
     blocked(o, "review.incomplete"); assert.deepEqual([o.counts.builder, o.counts.reviewer], [2, 2]);