alissa-tools-github-genloop 0.1.2__tar.gz → 0.1.4__tar.gz

{alissa_tools_github_genloop-0.1.2/src/main/alissa_tools_github_genloop.egg-info → alissa_tools_github_genloop-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-genloop
-Version: 0.1.2
+Version: 0.1.4
 Summary: ALISSA-TOOLS-GITHUB-GENLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_genloop-0.1.2 → alissa_tools_github_genloop-0.1.4}/src/main/alissa/tools/github/genloop/github.py

@@ -1,8 +1,29 @@
 """The GitHub surface the seat drives, all through `gh api` (which keeps its
 own auth): the branch read in the plans repository, the PR open with body and
-trailers, the reviewer request, the `plan-lint` check-run read, the plan-PR
-listing for the day counter, closing an invalid plan, and the comments a
-rule is written from.
+trailers, the reviewer request, the `plan-lint` read, the plan-PR listing
+for the day counter, closing an invalid plan, and the comments a rule is
+written from.
+
+THE PLAN-LINT READ HAS TWO PATHS
+================================
+The check-runs API is the first: the newest `plan-lint` check run on the head.
+A fine-grained personal access token cannot read check runs at all (403), so
+on a 403 or 404 the read falls back to the Actions runs for the head SHA, the
+same fallback orcloop's `ci-green` read uses. It reads only the run of record:
+the newest plan-lint run of the trusted event (`pull_request_target`, the job
+that publishes the `plan-lint` check run), mapped onto the check run's
+`{conclusion}` shape. The offline `pull_request` run never counts, as it never
+does on the check-runs path. A `failure` is red only when the job's publish
+step (`Publish the plan-lint check run …`, `if: always()`) succeeded: that
+step is the only thing that creates the check run, and it publishes `failure`
+itself when the linter never reported. When the publish step failed (a 5xx
+on its POST), no check run exists, so the fallback reads None, as the
+check-runs path would; the run's jobs (`actions/runs/<id>/jobs`) say which.
+A denied 403 ("Resource not accessible") is latched for the process -- every
+later read goes straight to the Actions path;
+any other 403 (a secondary rate limit) falls back for that read only. When
+the Actions read fails too, the warning is logged once per PR per head and
+`LintUnreadable` is raised, which the caller skips quietly.
 
 The seat touches ONE repository on GitHub -- the plans repository. The fed
 repos are the pass session's to read (with `gh api`, never cloned); nothing
@@ -25,6 +46,19 @@ from .proc import CommandError, run
 log = logging.getLogger(__name__)
 
 LINT_CHECK_NAME = "plan-lint"
+# The plan-lint workflow of the plans template, matched against an Actions
+# run's `path` or `name` (`GitHub(lint_workflow=...)` names another).
+LINT_WORKFLOW = ".github/workflows/plan-lint.yml"
+# The event whose plan-lint run publishes the `plan-lint` check run -- the
+# template's trusted job (`GitHub(lint_event=...)` names another). Its run's
+# conclusion passes through verbatim, so only `failure` is a red lint, as on
+# the check-runs path; the offline `pull_request` run is never read.
+LINT_EVENT = "pull_request_target"
+# The trusted job's step that publishes the `plan-lint` check run, matched as a
+# prefix of the step name (`GitHub(lint_publish_step=...)` names another).
+LINT_PUBLISH_STEP = "Publish the plan-lint check run"
+# The 403 body of a token that cannot read check runs, as against a rate limit.
+_DENIED_MARKER = "resource not accessible"
 # A plan PR thread longer than this many pages of 100 comments is read only up to here.
 COMMENT_PAGES_MAX = 10
 _STATUS_RE = re.compile(r"HTTP (\d{3})")
@@ -35,6 +69,10 @@ def http_status(exc: CommandError) -> int | None:
     return int(match.group(1)) if match else None
 
 
+class LintUnreadable(CommandError):
+    """Neither the check-runs read nor the Actions fallback answered."""
+
+
 @dataclass(frozen=True)
 class PullRequest:
     number: int
@@ -82,8 +120,17 @@ class Comment:
 
 
 class GitHub:
-    def __init__(self, *, timeout: int = 60):
+    def __init__(self, *, timeout: int = 60, lint_workflow: str = LINT_WORKFLOW, lint_event: str = LINT_EVENT,
+                 lint_publish_step: str = LINT_PUBLISH_STEP):
         self.timeout = timeout
+        self.lint_workflow = lint_workflow
+        self.lint_event = lint_event
+        self.lint_publish_step = lint_publish_step
+        # Latched on the first 403 from check-runs: this token cannot read them.
+        self._check_runs_denied = False
+        # (repo, pr) -> the head whose unreadable lint has been logged already;
+        # one entry per PR, dropped when the PR's lint reads again.
+        self._lint_unreadable_logged: dict[tuple[str, int | None], str] = {}
 
     # -- transport -------------------------------------------------------------
 
@@ -196,8 +243,34 @@ class GitHub:
         )
         return [pr for pr in (PullRequest.from_payload(d) for d in (data or []) if isinstance(d, dict)) if pr]
 
-    def lint_run(self, repo: str, sha: str) -> dict | None:
-        """The newest `plan-lint` check run on `sha` (by id), or None."""
+    def lint_run(self, repo: str, sha: str, *, pr_number: int | None = None) -> dict | None:
+        """The `plan-lint` verdict on `sha` -- the newest check run, or the
+        Actions runs when check runs are denied -- or None when there is none."""
+        if not self._check_runs_denied:
+            try:
+                return self._lint_check_run(repo, sha)
+            except CommandError as exc:
+                status = http_status(exc)
+                if status not in (403, 404):
+                    raise
+                if status == 403 and _DENIED_MARKER in (exc.stderr or "").lower():
+                    self._check_runs_denied = True
+                    log.info("genloop: check runs answered 403 on %s — reading plan-lint from the Actions runs "
+                             "from now on", repo)
+        key = (repo, pr_number)
+        try:
+            run = self._lint_actions_run(repo, sha)
+        except CommandError as exc:
+            if self._lint_unreadable_logged.get(key) != sha:
+                self._lint_unreadable_logged[key] = sha
+                where = f"#{pr_number}" if pr_number is not None else repo
+                log.warning("genloop: could not read plan-lint on %s at %s from check runs or the Actions runs "
+                            "(%s) — skipped until the head moves", where, sha[:12], exc)
+            raise LintUnreadable(exc.argv, exc.returncode, exc.stderr) from exc
+        self._lint_unreadable_logged.pop(key, None)
+        return run
+
+    def _lint_check_run(self, repo: str, sha: str) -> dict | None:
         data = self._api(
             "-X", "GET", f"repos/{repo}/commits/{sha}/check-runs", "-f", f"check_name={LINT_CHECK_NAME}",
             "-f", "per_page=100",
@@ -209,6 +282,52 @@ class GitHub:
             return None
         return max(named, key=lambda r: int(r.get("id") or 0))
 
+    def _lint_actions_run(self, repo: str, sha: str) -> dict | None:
+        """The newest plan-lint run of `lint_event` on `sha` as a check run:
+        its conclusion verbatim once completed, pending (None) before, and
+        None when there is no such run yet -- or when it failed only because
+        its publish step did, so that no check run exists."""
+        data = self._api(
+            "-X", "GET", f"repos/{repo}/actions/runs", "-f", f"head_sha={sha}", "-f", "per_page=100",
+        )
+        runs = data.get("workflow_runs") if isinstance(data, dict) else None
+        if not isinstance(runs, list):
+            raise CommandError(["gh", "api", f"repos/{repo}/actions/runs"], 0, "no workflow_runs in the answer")
+        trusted = [r for r in runs if isinstance(r, dict) and self._is_lint_workflow(r)
+                   and r.get("event") == self.lint_event]
+        if not trusted:
+            return None
+        head = max(trusted, key=_run_order)
+        completed = head.get("status") == "completed"
+        if completed and head.get("conclusion") == "failure" and not self._lint_published(repo, head):
+            return None
+        return {
+            "id": head.get("id"), "name": LINT_CHECK_NAME, "source": "actions",
+            "status": "completed" if completed else str(head.get("status") or "") or "in_progress",
+            "conclusion": head.get("conclusion") if completed else None, "html_url": head.get("html_url"),
+        }
+
+    def _lint_published(self, repo: str, run: dict) -> bool:
+        """Whether the failed `run` published its `plan-lint` check run: its
+        publish step succeeded, or no step of its jobs is the publish step (the
+        failure then stands, as before this read)."""
+        path = f"repos/{repo}/actions/runs/{run.get('id')}/jobs"
+        data = self._api("-X", "GET", path, "-f", "per_page=100")
+        jobs = data.get("jobs") if isinstance(data, dict) else None
+        if not isinstance(jobs, list):
+            raise CommandError(["gh", "api", path], 0, "no jobs in the answer")
+        steps = [s for j in jobs if isinstance(j, dict) for s in (j.get("steps") or [])
+                 if isinstance(s, dict) and str(s.get("name") or "").startswith(self.lint_publish_step)]
+        if not steps or any(s.get("conclusion") == "success" for s in steps):
+            return True
+        log.debug("genloop: plan-lint run %s on %s failed without publishing its check run — no lint, "
+                  "as on the check-runs path", run.get("id"), repo)
+        return False
+
+    def _is_lint_workflow(self, r: dict) -> bool:
+        path = str(r.get("path") or "").split("@", 1)[0]
+        return self.lint_workflow in (path, str(r.get("name") or ""))
+
     def issue_comments(self, repo: str, number: int) -> list[Comment]:
         """Every comment, oldest first, page by page (up to
         `COMMENT_PAGES_MAX` pages of 100)."""
@@ -284,3 +403,12 @@ class GitHub:
             if http_status(exc) in (404, 422):
                 return
             raise
+
+
+def _run_order(r: dict) -> tuple[str, int]:
+    """Newest first by creation time, then by id (ISO-8601 UTC sorts as text)."""
+    try:
+        run_id = int(r.get("id") or 0)
+    except (TypeError, ValueError):
+        run_id = 0
+    return str(r.get("created_at") or ""), run_id

{alissa_tools_github_genloop-0.1.2 → alissa_tools_github_genloop-0.1.4}/src/main/alissa/tools/github/genloop/loop.py

@@ -17,9 +17,11 @@ ONE POLL, IN ORDER
    emit their `plan.skipped` lines; `amended` PRs get the reviewer re-requested;
    `skill-missing` holds every further spawn until the image is fixed.
 2. **Lint watch.** A plan PR of ours whose `plan-lint` run concluded `failure`
-   is the generator's to amend on its next pass (D13). One still red after a
-   pass SPAWNED after the red was first seen has ended is `plan.invalid`: a
-   comment, the PR closed, the branch deleted, the plan row `rejected`.
+   is the generator's to amend on its next pass (D13); a token that cannot
+   read check runs reads the plan-lint Actions runs instead (`github.py`). One
+   still red after a pass SPAWNED after the red was first seen has ended is
+   `plan.invalid`: a comment, the PR closed, the branch deleted, the plan row
+   `rejected`.
 3. **Rejections.** A plan PR closed unmerged with a comment by an operator
    login, or an operator comment opening `[do-not-propose]`, writes one
    `proposalRules` row per source key and one for the anchor (§4.4, c7).
@@ -53,7 +55,7 @@ from typing import Callable, Sequence
 from .alissa_cli import AlissaCli
 from .alissa_client import AlissaAuthError, AlissaClient, AlissaError, AlissaTransient
 from .config import BOW_PREFIX, REPOS_SOURCE_STATIC, Config
-from .github import GitHub, PullRequest
+from .github import GitHub, LintUnreadable, PullRequest
 from .loop_events import (
     KIND_PASS_IDLE,
     KIND_PASS_SILENT,
@@ -587,7 +589,10 @@ class GenLoop:
         for pr in pulls:
             key = META_RED_SINCE + str(pr.number)
             try:
-                run = self.github.lint_run(self.repo, pr.head_sha)
+                run = self.github.lint_run(self.repo, pr.head_sha, pr_number=pr.number)
+            except LintUnreadable:
+                # Already logged once for this PR's head by the adapter.
+                continue
             except CommandError as exc:
                 log.warning("genloop: could not read plan-lint on #%d (%s)", pr.number, exc)
                 continue

alissa_tools_github_genloop-0.1.4/src/main/alissa/tools/github/genloop/version

@@ -0,0 +1 @@
+0.1.4

{alissa_tools_github_genloop-0.1.2 → alissa_tools_github_genloop-0.1.4/src/main/alissa_tools_github_genloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-genloop
-Version: 0.1.2
+Version: 0.1.4
 Summary: ALISSA-TOOLS-GITHUB-GENLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_genloop-0.1.2/src/main/alissa/tools/github/genloop/version

@@ -1 +0,0 @@
-0.1.2