forgedock 1.36.0 → 1.37.0

package/scripts/wait-ci-green.sh

@@ -71,11 +71,13 @@ jitter() { awk -v s="$1" -v p="$JITTER_PCT" -v r="$RANDOM" 'BEGIN{ v=s*(1-p/100+
 # classify_gh <text> -> prints one class, or nothing when the text is unrecognised:
 #   limited    real rate-limit evidence (x-ratelimit-remaining: 0, HTTP 429, "API rate limit exceeded" or GraphQL "API rate limit already exceeded", secondary rate limit,
 #              abuse detection, too many requests): a wait, bounded by the whole window
-#   auth       a bare 401/403 (bad credentials, missing scope): permanent, never waited on
+#   unauth     a bare 401 (expired token, forge#4662): the refresh timer may fix it, so a small bounded retry, then an explicit auth error
+#   auth       a bare 403 (missing scope): permanent, never waited on
 #   transient  5xx / gateway / network failures: a small bounded retry (FORGE_CI_TRANSIENT_RETRIES), never the long wait
 classify_gh() {
   if printf '%s' "$1" | grep -Eqi 'api rate limit (already )?exceeded|secondary (rate )?limit|abuse detection|x-ratelimit-remaining: *0|HTTP 429|status 429|too many requests'; then echo limited
-  elif printf '%s' "$1" | grep -Eqi 'HTTP (401|403)|status (401|403)|bad credentials|requires authentication'; then echo auth
+  elif printf '%s' "$1" | grep -Eqi 'HTTP 401|status 401|bad credentials|requires authentication'; then echo unauth
+  elif printf '%s' "$1" | grep -Eqi 'HTTP 403|status 403'; then echo auth
   elif printf '%s' "$1" | grep -Eqi 'HTTP 5[0-9][0-9]|status 5[0-9][0-9]|bad gateway|service unavailable|gateway time-?out|timed? ?out|i/o timeout|connection (reset|refused)|could not resolve host|unexpected EOF|network is unreachable|TLS handshake'; then echo transient
   fi
 }
@@ -94,6 +96,10 @@ while :; do
   START_SHA=""; _hc="$(classify_gh "$(cat "$_herr" 2>/dev/null)")"
   case "$_hc" in
     auth) emit ERROR; echo "cannot read PR #$PR head in $REPO (HTTP 401/403 without rate-limit evidence)"; exit 2 ;;
+    unauth)
+      _hfail=$((_hfail + 1))
+      if [ "$_hfail" -gt 2 ]; then emit ERROR; echo "cannot read PR #$PR head in $REPO: HTTP 401 (bot token expired or revoked?) ${_hfail} times in a row; run scripts/refresh-bot-token.sh"; exit 2; fi
+      sleep "$(jitter "$INTERVAL")" ;;
     limited)
       _hlim=$((_hlim + 1))
       if [ $(( $(date +%s) - _hstart )) -ge "$TIMEOUT" ]; then emit RATE_LIMITED; echo "PR #$PR: GitHub rate-limited for the whole ${TIMEOUT}s window reading the PR head; retry later"; exit 4; fi
@@ -117,8 +123,13 @@ while :; do
       NC_OUT="$(gh pr checks "$PR" -R "$REPO" 2>&1 || true)"
       if printf '%s' "$NC_OUT" | grep -qi 'no checks reported'; then JSON='[]'
       elif GH_CLASS="$(classify_gh "$NC_OUT")"; [ "$GH_CLASS" = auth ]; then
-        # A bare 401/403 is an auth fault that never clears: fail fast instead of waiting out the window (forge#4037).
+        # A bare 403 is an auth fault that never clears: fail fast instead of waiting out the window (forge#4037).
         emit ERROR; echo "gh pr checks refused (HTTP 401/403 without rate-limit evidence); fix the token or its scopes"; exit 2
+      elif [ "$GH_CLASS" = unauth ]; then
+        # forge#4662: an expired token is unknown state, not "no checks": back off, then fail with an explicit auth message.
+        transient=$((transient + 1))
+        if [ "$transient" -gt "$TRANSIENT_MAX" ]; then emit ERROR; echo "gh pr checks refused (HTTP 401) ${transient} times in a row; the bot token is expired or revoked, run scripts/refresh-bot-token.sh"; exit 2; fi
+        sleep "$(jitter "$INTERVAL")"; continue
       elif [ "$GH_CLASS" = transient ]; then
         # Network timeout / 5xx: a small bounded retry, never the long rate-limit wait.
         transient=$((transient + 1))

package/scripts/wait-ci-green.test.sh

@@ -74,7 +74,9 @@ expect "rate limited for the whole window is RATE_LIMITED rc 4" "4|CI_GATE: RATE
 expect "more than 5 rate-limit hits are not an ERROR" "0|CI_GATE: PASS" "$(run "$(mk rlmany RATE RATE RATE RATE RATE RATE RATE "$P")" --timeout 60)"
 # forge#4037: only real rate-limit evidence is RATE_LIMITED; a bare 401/403 fails fast; timeouts/5xx are a small bounded retry.
 expect "bare 403 is a permanent error rc 2" "2|CI_GATE: ERROR" "$(run "$(mk a403 A403 "$P")" --timeout 60)"
-expect "bare 401 is a permanent error rc 2" "2|CI_GATE: ERROR" "$(run "$(mk a401 A401 "$P")" --timeout 60)"
+# forge#4662: a 401 is a refreshable token, so it is retried a bounded number of times before it is an error.
+expect "401 then pass retries (token refreshed meanwhile)" "0|CI_GATE: PASS" "$(run "$(mk a401 A401 "$P")" --timeout 60)"
+expect "persistent 401 is rc 2 after the bounded retries" "2|CI_GATE: ERROR" "$(run "$(mk a401all A401)" --timeout 60)"
 expect "HTTP 429 is RATE_LIMITED rc 4" "4|CI_GATE: RATE_LIMITED" "$(run "$(mk r429 R429)" --timeout 2)"
 expect "x-ratelimit-remaining: 0 on a 403 is RATE_LIMITED rc 4" "4|CI_GATE: RATE_LIMITED" "$(run "$(mk rhdr RHDR)" --timeout 2)"
 expect "network timeout then pass retries" "0|CI_GATE: PASS" "$(run "$(mk tmo TMO "$P")")"

package/templates/bootstrap/needs-human-issue.md

@@ -1,10 +1,13 @@
 <!-- SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios -->
 <!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
 <!-- /bootstrap needs-human issue: one per credential, account or external input (OAuth client, cloud or DNS account,
-payment keys, API keys, legal review). Label it needs-human and set "needsHuman": true in the plan. Code issues
+payment keys, API keys, legal review). Label it needs-human and needs-human:external (the script adds the latter), give it a `gates:` line (preview|staging-deploy|prod-deploy|feature-flag:<name>) and an `owner:` line, and set "needsHuman": true in the plan. Code issues
 reference it (#{{KEY}}) but never list it under Dependencies; their mocks keep dev and CI green. Copy from "## Problem" down. -->
 ## Problem
 
+gates: preview
+owner: maintainer
+
 {which credential, account or external input is needed, and which issues use it}
 
 ### Setup steps

package/templates/github-actions/migration-journal-guard.test.mjs

@@ -0,0 +1,26 @@
+// Guard test template for repos with a drizzle-style migration journal (#4661). Copy it next to your tests and set JOURNAL.
+// Newest-only migrators (drizzle `migrate()`) skip an entry whose `when` is older than one already applied. CI migrates a
+// fresh database, so it never notices; parallel milestone branches interleave stamps and hit this on persistent databases.
+// Run in CI with the base ref fetched: BASE_REF=origin/main node --test migration-journal-guard.test.mjs
+//
+// Optional upgrade test (repo-specific, not provided): migrate a database to the base's head, apply the branch's
+// migrations, then assert that every migration the branch added is recorded as applied.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+const JOURNAL = process.env.JOURNAL ?? "drizzle/meta/_journal.json";
+const BASE_REF = process.env.BASE_REF ?? "origin/main";
+const entries = JSON.parse(readFileSync(JOURNAL, "utf8")).entries;
+
+test("journal `when` strictly increases", () => {
+  for (let i = 1; i < entries.length; i++) assert.ok(entries[i].when > entries[i - 1].when, `${entries[i].tag} when ${entries[i].when} is not after ${entries[i - 1].tag}`);
+});
+
+test("no new entry is older than the base max `when`", (t) => {
+  let base;
+  try { base = JSON.parse(execFileSync("git", ["show", `${BASE_REF}:${JOURNAL}`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] })).entries; } catch { return t.skip(`no ${JOURNAL} at ${BASE_REF}`); }
+  const known = new Set(base.map((e) => e.tag)), max = Math.max(...base.map((e) => e.when));
+  for (const e of entries.filter((x) => !known.has(x.tag))) assert.ok(e.when > max, `${e.tag} when ${e.when} is not above the base max ${max}: re-stamp it with the generator`);
+});