forgedock 1.4.0 → 1.5.1

package/scripts/derive-finding-milestone.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# derive-finding-milestone.sh — Single source of truth for deriving the
+#                                milestone a review-finding issue should
+#                                inherit from the PR that spawned it.
+#
+# Usage:
+#   derive-finding-milestone.sh <PR_NUMBER> [-R <owner/repo>]
+#
+#   PR_NUMBER    The number of the PR being reviewed (the one /review-pr or
+#                /review-pr-staging is creating findings against).
+#   -R owner/repo  Optional. Defaults to the current repo (gh's own default
+#                  resolution) when omitted.
+#
+# Resolution (3-tier, first match wins — do NOT add a second copy of this
+# logic anywhere else; both commands/review-pr.md and
+# commands/review-pr-staging.md call this script rather than hand-rolling
+# their own copy, specifically so the two specs cannot independently drift
+# the way they did before this fix — see forge#2447 precedent
+# (scripts/severity-to-priority.sh) and forge#2443 (this script)):
+#
+#   Tier 1 — PR's own milestone: `gh pr view <N> --json milestone`. Most
+#            direct signal — if the PR itself was filed under a milestone,
+#            that is authoritative.
+#   Tier 2 — Originating issue's milestone: parse the PR body for
+#            `Closes/Fixes/Resolves #N` (case-insensitive), then read that
+#            issue's milestone. Covers the common /work-on shape where the
+#            PR body says `Closes #1234` but the PR itself was never
+#            assigned a milestone directly.
+#   Tier 3 — Branch-slug match: if the PR's base or head branch starts with
+#            `milestone/`, slugify the branch name (strip the `milestone/`
+#            prefix) and look for a GitHub milestone whose slugified title
+#            matches — exact match first, substring match as a fallback.
+#            This is the path that fixes forge#2443's Instance B/C: a
+#            milestone-lane PR whose findings had no `Closes #N` and no
+#            milestone set directly, but whose *branch* names the
+#            milestone.
+#
+# Output: the resolved milestone TITLE on stdout, or nothing (empty stdout)
+#         if no tier resolves — this is a normal, common outcome (most
+#         findings are fast-lane, no milestone), not an error.
+#
+# Exit codes:
+#   0  success — milestone title printed to stdout, or nothing if none found
+#   1  error (missing/invalid argument, or `gh` call failed outright —
+#      fails loud rather than silently guessing)
+#
+# Example:
+#   MILESTONE_TITLE=$(scripts/derive-finding-milestone.sh "$PR_NUMBER")
+#   MILESTONE_FLAG=""
+#   [ -n "$MILESTONE_TITLE" ] && MILESTONE_FLAG="--milestone $MILESTONE_TITLE"
+#
+# <!-- Added: forge#2443 -->
+
+set -euo pipefail
+
+PR_NUMBER="${1:-}"
+GH_REPO_ARGS=()
+
+if [ -z "$PR_NUMBER" ]; then
+  echo "ERROR: Usage: derive-finding-milestone.sh <PR_NUMBER> [-R <owner/repo>]" >&2
+  exit 1
+fi
+
+if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+  echo "ERROR: PR_NUMBER must be numeric, got: $PR_NUMBER" >&2
+  exit 1
+fi
+
+shift
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -R)
+      if [ $# -lt 2 ]; then
+        echo "ERROR: -R requires a value <owner/repo>" >&2
+        echo "Usage: derive-finding-milestone.sh <PR_NUMBER> [-R <owner/repo>]" >&2
+        exit 1
+      fi
+      if ! [[ "$2" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+        echo "ERROR: -R value must be owner/repo format, got: $2" >&2
+        exit 1
+      fi
+      GH_REPO_ARGS=(-R "$2")
+      shift 2
+      ;;
+    *)
+      echo "ERROR: unknown argument: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# --- Tier 1: PR's own milestone -------------------------------------------
+# stderr is routed to a separate temp file (not merged via 2>&1) so that a
+# 0-exit gh call's stdout is never polluted with incidental stderr text
+# (e.g. a gh CLI update notice) ahead of the jq -r parse below. Mirrors the
+# GH_STDERR_TMP pattern already used in scripts/classify-lane.sh.
+# Restricted to owner-only permissions (chmod 600) since the file transiently
+# holds gh CLI stderr text; and trap-cleaned on EXIT (mirrors the idiom
+# already in production at scripts/doctor-pipeline-state.sh) so a
+# signal-interrupted run (SIGINT/SIGTERM while `gh pr view` is in flight)
+# doesn't leak the temp file — the two explicit rm -f calls below still run
+# on their normal/error paths; the trap is a no-op in those cases and only
+# matters for exit paths those calls don't cover. <!-- Fixes: forge#2532, forge#2533 -->
+GH_STDERR_TMP=$(mktemp)
+chmod 600 "$GH_STDERR_TMP"
+trap 'rm -f "$GH_STDERR_TMP"' EXIT
+PR_JSON=$(gh pr view "$PR_NUMBER" "${GH_REPO_ARGS[@]+"${GH_REPO_ARGS[@]}"}" \
+  --json milestone,body,baseRefName,headRefName 2>"$GH_STDERR_TMP") || {
+  echo "ERROR: failed to fetch PR #$PR_NUMBER — check PR number and repo flag" >&2
+  cat "$GH_STDERR_TMP" >&2
+  rm -f "$GH_STDERR_TMP"
+  exit 1
+}
+rm -f "$GH_STDERR_TMP"
+
+MILESTONE_TITLE=$(echo "$PR_JSON" | jq -r '.milestone.title // empty')
+if [ -n "$MILESTONE_TITLE" ]; then
+  echo "$MILESTONE_TITLE"
+  exit 0
+fi
+
+# --- Tier 2: originating issue's milestone (Closes/Fixes/Resolves #N) -----
+# Portable (non-PCRE) extraction — grep -oP is not supported by Git Bash's
+# grep build on Windows, so use a bash regex + BASH_REMATCH instead of a
+# lookbehind (same convention as scripts/code-index.sh).
+# The leading (^|[^a-z]) group anchors the alternation to a word start so a
+# close-verb embedded in a larger word (e.g. "encloses #1234") cannot match;
+# the body is already lowercased, so [^a-z] is the correct complement class.
+# The extra group shifts the issue-number capture to BASH_REMATCH[3].
+PR_BODY=$(echo "$PR_JSON" | jq -r '.body // empty')
+SOURCE_ISSUE=""
+PR_BODY_LOWER=$(echo "$PR_BODY" | tr '[:upper:]' '[:lower:]')
+if [[ "$PR_BODY_LOWER" =~ (^|[^a-z])(closes|fixes|resolves)[[:space:]]*#([0-9]+) ]]; then
+  SOURCE_ISSUE="${BASH_REMATCH[3]}"
+fi
+
+if [ -n "$SOURCE_ISSUE" ]; then
+  ISSUE_MILESTONE=$(gh issue view "$SOURCE_ISSUE" "${GH_REPO_ARGS[@]+"${GH_REPO_ARGS[@]}"}" \
+    --json milestone --jq '.milestone.title // empty' 2>/dev/null || echo "")
+  if [ -n "$ISSUE_MILESTONE" ]; then
+    echo "$ISSUE_MILESTONE"
+    exit 0
+  fi
+fi
+
+# --- Tier 3: branch-slug match ---------------------------------------------
+BASE_BRANCH=$(echo "$PR_JSON" | jq -r '.baseRefName // empty')
+HEAD_BRANCH=$(echo "$PR_JSON" | jq -r '.headRefName // empty')
+
+MILESTONE_BRANCH=""
+if echo "$BASE_BRANCH" | grep -qE "^milestone/"; then
+  MILESTONE_BRANCH="$BASE_BRANCH"
+elif echo "$HEAD_BRANCH" | grep -qE "^milestone/"; then
+  MILESTONE_BRANCH="$HEAD_BRANCH"
+fi
+
+if [ -n "$MILESTONE_BRANCH" ]; then
+  BRANCH_SLUG=$(echo "$MILESTONE_BRANCH" | sed 's|^milestone/||')
+
+  # Resolve owner/repo for the milestones API call: use -R's value if given,
+  # otherwise gh's own default-repo resolution (the `:owner/:repo` REST
+  # placeholder gh substitutes from the current git remote / repo context).
+  if [ ${#GH_REPO_ARGS[@]} -gt 0 ]; then
+    MILESTONES_REPO="${GH_REPO_ARGS[1]}"
+  else
+    MILESTONES_REPO=":owner/:repo"
+  fi
+  ALL_MILESTONES=$(gh api "repos/${MILESTONES_REPO}/milestones" 2>/dev/null || echo "")
+
+  if [ -n "$ALL_MILESTONES" ] && [ "$ALL_MILESTONES" != "[]" ]; then
+    # Single jq invocation: shared `def slugify` replaces the duplicated
+    # downcase/gsub slug transform that previously appeared once per tier
+    # (exact-match, then substring-fallback). Exact match is tried first
+    # (array 1), substring match second (array 2); `first` picks the winner
+    # from the concatenation, preserving the exact-match-wins-over-substring
+    # ordering and the regex semantics of `test($slug)` exactly as before.
+    # <!-- Fixes: forge#2670 -->
+    MATCH=$(echo "$ALL_MILESTONES" | jq -r --arg slug "$BRANCH_SLUG" '
+      def slugify: ascii_downcase | gsub("[^a-z0-9]+"; "-");
+      ([.[] | select((.title | slugify) == $slug)]
+       + [.[] | select((.title | slugify) | test($slug))])
+      | (first.title // empty)')
+    if [ -n "$MATCH" ]; then
+      echo "$MATCH"
+      exit 0
+    fi
+  fi
+fi
+
+# No tier resolved — normal outcome, empty stdout, success exit.
+exit 0

package/scripts/doctor-pipeline-state.sh

@@ -119,6 +119,7 @@ GH_FLAG="-R $GH_REPO"
 # the diagnostic stderr text for the WARNING message on actual failure.
 # ---------------------------------------------------------------------------
 GH_STDERR_TMP=$(mktemp)
+chmod 600 "$GH_STDERR_TMP"
 trap 'rm -f "$GH_STDERR_TMP"' EXIT
 
 # ---------------------------------------------------------------------------

package/scripts/extract-affected-files.sh

@@ -0,0 +1,232 @@
+#!/usr/bin/env bash
+# extract-affected-files.sh — Positionally-scoped affected-file extraction for
+# /orchestrate Phase 3C Layer 1 (see commands/orchestrate/phase-3-dependency.md)
+#
+# Usage:
+#   extract-affected-files.sh <issue_number> -R <owner/repo>
+#   extract-affected-files.sh <issue_number> "-R <owner/repo>"   (single pre-joined token also accepted)
+#
+# Output (stdout):
+#   Line 1:   PROVENANCE=affected-files-section | body-fallback | none | error
+#   Line 2+:  one extracted file path per line (zero lines when PROVENANCE=none or error)
+#
+# Exit codes:
+#   0 — Extraction completed (including the zero-files/PROVENANCE=none case — that is
+#       a valid, expected outcome, NOT an error; callers must not treat exit 0 as proof
+#       that files were found).
+#   2 — Usage error (missing issue number, malformed -R value).
+#
+# Extraction rules (forge#2436):
+#   1. Primary path — the issue's FORGE:INVESTIGATOR comment (if one exists), scoped to
+#      ONLY its own "### Affected Files" section. Capture stops at the next markdown
+#      heading of any level, so paths mentioned in "### Evidence", "### Root Cause",
+#      "### Related Issues", etc. are never collected.
+#      -> PROVENANCE=affected-files-section
+#   2. Fallback path — used ONLY when no FORGE:INVESTIGATOR comment exists at all.
+#      Scoped to a deliverables-shaped heading in the raw issue body:
+#      "## Affected Files", "## Deliverables", or "### Files to change". Capture stops
+#      at the next markdown heading of any level, so "## Context", "## Prior art",
+#      "## Related", "## Root Cause", etc. are never scanned.
+#      -> PROVENANCE=body-fallback
+#   3. If neither path yields a scoped section containing a recognized file path:
+#      PROVENANCE=none, zero files. This is intentional — phase-3-dependency.md's
+#      Layer 4 conservative-serialization fallback fires when file extraction yields
+#      fewer than 2 paths, and a confident-but-wrong list (the pre-fix behavior of
+#      scraping the whole body/comment) defeated that safety net. Yielding nothing
+#      when there is nothing to justify is strictly safer than yielding something
+#      wrong (forge#2436).
+#   4. PROVENANCE=error — distinct from `none` (forge#2504): emitted when a `gh`
+#      invocation itself fails (non-zero exit — network error, auth expiry, rate
+#      limit) AND no file path was recovered from any path (including a fallback
+#      attempted after a failed primary call). `none` means "we confirmed there is
+#      nothing to extract"; `error` means "we could not confirm that — a `gh` call
+#      failed, so this result is inconclusive, not a verified empty result." A `gh`
+#      failure that is followed by a *successful* fallback yielding real files still
+#      reports the normal `body-fallback` provenance — `error` only fires when the
+#      failure actually cost us data.
+#
+# Extension regex covers: py|tsx?|jsx?|sql|json|ya?ml|mjs|js|sh|md — the repo's
+# dominant file types. mjs/js/sh/md were previously missing, which meant the
+# "primary" INVESTIGATOR-comment path silently extracted nothing for most
+# ForgeDock issues (a .mjs/.md-heavy repo), so the unscoped body fallback was
+# the path that actually determined DAG edges in practice (forge#2436).
+#
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -euo pipefail
+
+EXT_REGEX='`[^`]*\.(py|tsx?|jsx?|sql|json|ya?ml|mjs|js|sh|md)`'
+
+# --------------------------------------------------------------------------- #
+# Argument parsing — mirrors scripts/issue-dedup.sh's -R / -R\ * case arms
+# exactly (forge#1533, forge#1563: trailing/malformed -R values must be a
+# usage error, never silently misread by callers as "extraction found
+# nothing").
+# --------------------------------------------------------------------------- #
+NUM=""
+REPO=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    "")
+      # Empty-string token — e.g. a caller quoting an unset/empty $GH_FLAG.
+      # Treat as "no repo flag supplied", not as the issue number.
+      shift
+      ;;
+    -R)
+      shift
+      if [[ $# -eq 0 ]]; then
+        echo "Missing value for -R" >&2
+        exit 2
+      fi
+      REPO="$1"
+      shift
+      ;;
+    -R\ *)
+      # Single pre-joined token, e.g. "-R owner/repo" — produced when a caller
+      # quotes an already-composed $GH_FLAG variable ("$GH_FLAG") instead of
+      # passing -R and the repo as two separate argv tokens.
+      #
+      # Guard: a valid repo token always contains '/' (owner/repo format).
+      # If the value after "-R " has no '/', treat the whole token as
+      # malformed input rather than guessing (this script takes no other
+      # positional string argument that could plausibly start with "-R ").
+      _rval="${1#-R }"
+      if [[ "$_rval" == */* ]]; then
+        REPO="$_rval"
+        shift
+      else
+        echo "Malformed -R value: $1" >&2
+        exit 2
+      fi
+      ;;
+    -*)
+      echo "Unknown flag: $1" >&2
+      exit 2
+      ;;
+    *)
+      NUM="$1"
+      shift
+      ;;
+  esac
+done
+
+if [[ -z "$NUM" ]]; then
+  echo "Usage: extract-affected-files.sh <issue_number> -R <owner/repo>" >&2
+  exit 2
+fi
+
+# --------------------------------------------------------------------------- #
+# Scoped section extraction — turn capture on at a target heading, off at the
+# next markdown heading of any level. Same sentinel-based awk pattern already
+# used elsewhere in this command family (see phase-3-dependency.md's sibling
+# command work-on/build.md Phase 3C.5: `awk '/^### Deliverables/{p=1; next}
+# /^### /{p=0} p'`), generalized here to stop at ANY heading level so a
+# deeper sub-heading inside a deliverables section still closes capture
+# rather than leaking into unrelated prose.
+# --------------------------------------------------------------------------- #
+extract_investigator_section() {
+  awk '
+    /^### Affected Files/ { p=1; next }
+    /^#/ { p=0 }
+    p { print }
+  ' <<< "$1"
+}
+
+extract_body_fallback_section() {
+  awk '
+    /^## Affected Files/ || /^## Deliverables/ || /^### Files to change/ { p=1; next }
+    /^#/ { p=0 }
+    p { print }
+  ' <<< "$1"
+}
+
+extract_paths() {
+  # -E (POSIX extended regex), not -P (PCRE): the pattern below needs only
+  # alternation and `?` grouping, both supported by -E, and -P depends on a
+  # UTF-8 locale being active (`grep: -P supports only unibyte and UTF-8
+  # locales` otherwise) — a portability trap the original inline pseudocode
+  # in phase-3-dependency.md carried (forge#2436) and that this script fixes
+  # by not needing PCRE at all.
+  grep -oE "$EXT_REGEX" <<< "$1" 2>/dev/null | tr -d '`' | sort -u || true
+}
+
+# --------------------------------------------------------------------------- #
+# Primary path: FORGE:INVESTIGATOR comment, scoped to its own Affected Files section
+# --------------------------------------------------------------------------- #
+PROVENANCE="none"
+FILES=""
+GH_CALL_FAILED=0
+
+# NOTE: deliberately no `| tail -1` here — `gh api --jq`'s raw-string output
+# for a multi-line `.body` field embeds literal newlines, so isolating "the
+# last comment" by taking the last output LINE would instead truncate to
+# only the last line of the (possibly only) comment's body, breaking the
+# heading-scoped awk extraction below. In practice Phase 1 of the pipeline
+# deletes any partial FORGE:INVESTIGATOR comment before reposting (see
+# work-on/investigate.md), so at most one such comment exists per issue at
+# any time — matching the original Layer 1 pseudocode, which also consumed
+# this stream directly with no last-comment isolation.
+#
+# forge#2504: `VAR=$(cmd 2>/dev/null || true)` discarded gh's exit code
+# entirely, so a genuine `gh` failure (network error, auth expiry, rate
+# limit) was indistinguishable from "gh succeeded, output legitimately
+# empty." Use `if ! VAR=$(cmd); then ... fi` instead — exempt from
+# `set -e` because it's an `if` condition, so no `|| true` is needed — and
+# track the failure in GH_CALL_FAILED so it can be reflected in PROVENANCE
+# below rather than silently defaulting to "none". Same idiom already
+# established in scripts/transition-label.sh (forge#1991/PR #1996), adapted
+# here because this script must always complete (exit 0) rather than abort,
+# so failures are surfaced via a new PROVENANCE=error value instead of a
+# non-zero exit.
+if ! INVESTIGATOR_BODY=$(gh api "repos/${REPO}/issues/${NUM}/comments" \
+  --jq '.[] | select(.body | contains("FORGE:INVESTIGATOR")) | .body' 2>/dev/null); then
+  GH_CALL_FAILED=1
+  echo "WARNING: gh api call failed while fetching comments for issue #$NUM (repo: $REPO) — cannot confirm whether a FORGE:INVESTIGATOR comment exists; treating as inconclusive, not empty" >&2
+  INVESTIGATOR_BODY=""
+fi
+
+if [[ -n "$INVESTIGATOR_BODY" ]]; then
+  SCOPED=$(extract_investigator_section "$INVESTIGATOR_BODY")
+  FILES=$(extract_paths "$SCOPED")
+  if [[ -n "$FILES" ]]; then
+    PROVENANCE="affected-files-section"
+  fi
+else
+  # --------------------------------------------------------------------------- #
+  # Fallback path: raw issue body, scoped to a deliverables-shaped heading.
+  # Reached both when NO FORGE:INVESTIGATOR comment exists (the original Layer 1
+  # contract: "For issues WITHOUT an investigation comment, fall back to parsing
+  # the issue body") AND when the primary gh call above failed (in which case we
+  # genuinely don't know if a comment exists, so attempting the fallback gives a
+  # chance at real data rather than giving up immediately).
+  # --------------------------------------------------------------------------- #
+  if ! ISSUE_BODY=$(gh issue view "$NUM" -R "$REPO" --json body --jq '.body' 2>/dev/null); then
+    GH_CALL_FAILED=1
+    echo "WARNING: gh issue view call failed for issue #$NUM (repo: $REPO) — cannot confirm the issue body's Affected Files section; treating as inconclusive, not empty" >&2
+    ISSUE_BODY=""
+  fi
+  if [[ -n "$ISSUE_BODY" ]]; then
+    SCOPED=$(extract_body_fallback_section "$ISSUE_BODY")
+    FILES=$(extract_paths "$SCOPED")
+    if [[ -n "$FILES" ]]; then
+      PROVENANCE="body-fallback"
+    fi
+  fi
+fi
+
+# forge#2504: only escalate to "error" when neither path yielded real data AND
+# at least one gh call genuinely failed along the way. A failed primary call
+# followed by a successful fallback that found files must still report
+# body-fallback (real data recovered) — never overwrite that with "error".
+if [[ "$PROVENANCE" == "none" && "$GH_CALL_FAILED" -eq 1 ]]; then
+  PROVENANCE="error"
+fi
+
+echo "PROVENANCE=$PROVENANCE"
+if [[ -n "$FILES" ]]; then
+  printf '%s\n' "$FILES"
+fi
+
+exit 0