alissa-tools-github-revloop 0.16.3__tar.gz → 0.16.4__tar.gz

{alissa_tools_github_revloop-0.16.3/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.16.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.16.3
+Version: 0.16.4
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.4}/src/main/alissa/tools/github/revloop/config.py

@@ -23,6 +23,10 @@ from typing import Any, Mapping
 # A POSIX-ish environment variable name -- what `reviewer_token_env` must be.
 _ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 
+# The per-character half of the same rule, used to name the offending
+# characters in an error without echoing the value (see _describe).
+_ENV_CHAR_RE = re.compile(r"[A-Za-z0-9_]")
+
 # ...which, on its own, accepts every GitHub credential format: `ghp_`, `gho_`,
 # `ghu_`, `ghs_`, `ghr_` and `github_pat_` tokens are `[A-Za-z0-9_]` throughout
 # and therefore valid identifiers. So the shape has to be rejected explicitly,
@@ -30,9 +34,13 @@ _ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 # its variable's NAME belongs -- sails through.
 _TOKEN_SHAPE_RE = re.compile(r"^(gh[pousr]_|github_pat_)", re.IGNORECASE)
 
-# No environment variable name comes close (`REVLOOP_REVIEWER_GH_TOKEN` is 25);
-# every GitHub token, including the 40-character legacy hex ones, exceeds it.
-MAX_ENV_NAME_LENGTH = 32
+# Generous on purpose. A tighter ceiling (32 was tried) rejects names an
+# operator can plausibly write -- `REVLOOP_REVIEWER_GITHUB_TOKEN_ENV` is 33 --
+# and this bound is NOT what catches credentials: MIN_SECRET_RUN_LENGTH is,
+# and it catches a 40-character hex token on its shape whatever the ceiling
+# says. So the ceiling exists only to refuse the obviously absurd, and it is
+# deliberately kept OUT of `_is_credential_shaped` (see there).
+MAX_ENV_NAME_LENGTH = 40
 
 # Length is not the whole discriminator, because a secret can be short enough
 # to fit under the ceiling. The shape is: a long, undifferentiated run of
@@ -47,10 +55,14 @@ def _is_credential_shaped(value: str) -> bool:
     A heuristic, and deliberately one that errs toward accusing: the cost of a
     false positive is renaming a variable, and the cost of a false negative is
     a live credential sitting in a config file on a shared volume.
+
+    Length is deliberately NOT one of the clauses. It was, and it made a merely
+    LONG name get classified as a credential -- rejected, redacted, and told to
+    rotate itself. Over-length is a separate refusal with its own message; only
+    an actual credential SHAPE drives redaction.
     """
     return bool(
         _TOKEN_SHAPE_RE.match(value)
-        or len(value) > MAX_ENV_NAME_LENGTH
         or (
             len(value) >= MIN_SECRET_RUN_LENGTH
             and "_" not in value
@@ -60,18 +72,30 @@ def _is_credential_shaped(value: str) -> bool:
 
 
 def _describe(value: str) -> str:
-    """Name a rejected value in the error -- redacted only when it has to be.
+    """Say what is wrong with a rejected value without reprinting a secret.
 
     `__main__` prints this to stderr as `config error: …`, straight into the
-    container log, so a pasted secret must not be duplicated there: those get
-    length plus a short prefix. But the other way to fail this check is an
-    ordinary typo (`REVLOOP-REVIEWER-GH-TOKEN`), and there the value IS the
-    diagnostic -- redacting it turns a one-glance fix into a puzzle. The two
-    are separable now that credential shapes are identified explicitly.
+    container log, so a pasted credential must never be echoed there. But the
+    other way to fail this check is an ordinary typo
+    (`REVLOOP-REVIEWER-GH-TOKEN`), and there the value IS the diagnostic.
+
+    Redacting everything loses the typo case; echoing whatever the GitHub-shape
+    heuristic does not recognise hands back the container-log disclosure for
+    every non-GitHub secret (`sk-proj-…`, `xoxb-…`, `glpat-…` all carry
+    punctuation and match no clause above). So neither branch prints the value:
+    what an operator needs is WHICH CHARACTERS were rejected, and those can be
+    named with their positions and nothing else.
     """
     if _is_credential_shaped(value):
-        return f'a {len(value)}-character value starting "{value[:4]}…"'
-    return repr(value)
+        return f"a {len(value)}-character value that looks like a credential"
+    offenders = sorted({c for c in value if not _ENV_CHAR_RE.match(c)})
+    if offenders:
+        where = ", ".join(
+            f"{c!r} at {', '.join(str(i) for i, ch in enumerate(value) if ch == c)}"
+            for c in offenders
+        )
+        return f"a {len(value)}-character value containing {where}"
+    return f"a {len(value)}-character value"
 
 
 # What to do when a PR has a pending review request but no matching Alissa
@@ -322,7 +346,11 @@ class Config:
             # rather than exposed. So the check is two-sided: it must LOOK like
             # a name, and it must not look like a credential. The value itself
             # is never echoed back (see _redact).
-            if not _ENV_NAME_RE.match(token_env) or _is_credential_shaped(token_env):
+            if (
+                not _ENV_NAME_RE.match(token_env)
+                or _is_credential_shaped(token_env)
+                or len(token_env) > MAX_ENV_NAME_LENGTH
+            ):
                 rotate = (
                     " If that is a credential, rotate it: it is now in a config file."
                     if _is_credential_shaped(token_env)
@@ -330,7 +358,8 @@ class Config:
                 )
                 raise ValueError(
                     f"reviewer_token_env must be an environment variable NAME "
-                    f"(e.g. 'REVLOOP_REVIEWER_GH_TOKEN'), not a value or a "
+                    f"(e.g. 'REVLOOP_REVIEWER_GH_TOKEN') of at most "
+                    f"{MAX_ENV_NAME_LENGTH} characters, not a value or a "
                     f"token — got {_describe(token_env)}.{rotate}"
                 )
 

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.4}/src/main/alissa/tools/github/revloop/ghclient.py

@@ -41,11 +41,15 @@ SUBMITTED_STATES = {"APPROVED", "CHANGES_REQUESTED", "COMMENTED", "DISMISSED"}
 PER_PAGE = 100
 COMMENT_PAGE_LIMIT = 20
 
-# Same bound for the PR's commit list. Read only when a review POST was
-# rejected (see pull_request_commits), and a partial answer there is worse than
-# none -- so unlike the comment list, exceeding this raises rather than
-# returning a truncated list a caller could misread as "the SHA is gone".
-COMMIT_PAGE_LIMIT = 20
+# GitHub's OWN cap on the pull-request commits endpoint: it "lists a maximum of
+# 250 commits" and refers callers with more to the repository commits endpoint.
+# That, not a page count of ours, is where absence stops being provable -- a
+# 250-entry answer looks complete (the last page is short) while saying nothing
+# about commit 251. And the direction is hostile: the endpoint returns commits
+# OLDEST first, so on a longer PR the 250 returned are the oldest and a recent
+# `judged` head is absent from every read. Unguarded, the "is the pinned commit
+# gone?" probe would answer yes on every large PR and abandon real verdicts.
+PR_COMMIT_CAP = 250
 
 # Environment variables `gh` reads a token from. Both are cleared before an
 # explicitly-routed call, so an inherited implementer credential cannot win by
@@ -432,14 +436,15 @@ class GitHub:
         this" from "this can never succeed", so it is worth a call, but only
         there; nothing on the common path reads it.
 
-        Paged like `issue_comments`, and bounded the same way. Truncation is
-        logged and matters here in one direction only: a SHA missing from a
-        truncated list would read as "gone" when it is merely on a later page.
-        The caller must therefore treat an empty/short read conservatively --
-        see loop._abandon_verdict, which only abandons on a complete read.
+        Raises `TruncatedListing` rather than returning a possibly-incomplete
+        list, because the caller uses ABSENCE as evidence and a short answer
+        cannot support that. The bound is GitHub's own 250 (PR_COMMIT_CAP), not
+        a page count of ours: at 250 the last page is short and the listing
+        looks complete while saying nothing about the commits past it.
         """
         out: list[str] = []
-        for page in range(1, COMMIT_PAGE_LIMIT + 1):
+        page = 1
+        while True:
             data = (
                 self._api(
                     "-X",
@@ -453,16 +458,20 @@ class GitHub:
                 or []
             )
             out.extend(str(c.get("sha") or "") for c in data)
+            if len(out) >= PR_COMMIT_CAP:
+                log.warning(
+                    "%s/%s#%d reached GitHub's %d-commit listing cap — the "
+                    "commit list is not complete, so a missing SHA cannot be "
+                    "read as absent",
+                    owner, repo, number, PR_COMMIT_CAP,
+                )
+                raise TruncatedListing(
+                    f"{owner}/{repo}#{number} reached GitHub's {PR_COMMIT_CAP}-commit "
+                    f"listing cap; absence cannot be proven from it"
+                )
             if len(data) < PER_PAGE:
                 return out
-        log.warning(
-            "%s/%s#%d has more than %d commits — the list is truncated, so a "
-            "missing SHA cannot be read as absent",
-            owner, repo, number, COMMIT_PAGE_LIMIT * PER_PAGE,
-        )
-        raise TruncatedListing(
-            f"{owner}/{repo}#{number} has more than {COMMIT_PAGE_LIMIT * PER_PAGE} commits"
-        )
+            page += 1
 
     def my_reviews(self, owner: str, repo: str, number: int) -> list[Review]:
         """My substantive submitted reviews, oldest first -- one per round.

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.4}/src/main/alissa/tools/github/revloop/loop.py

@@ -508,6 +508,11 @@ class Action(str, Enum):
     # window, or the post failed and is being retried. Either way the round is
     # NOT closed and nothing downstream of it runs.
     AWAITING_POST = "awaiting-post"
+    # The round's verdict can never be posted -- the head it judged is gone
+    # from the PR. Distinct from AWAITING_POST on purpose: that one retries,
+    # this one has given up, and the poll snapshot and console aggregate the
+    # action rather than the reason.
+    ABANDONED = "abandoned"
 
 
 @dataclass(frozen=True)
@@ -617,16 +622,21 @@ class ReviewWatcher:
         # purpose: an approve envelope with no native APPROVE behind it would
         # otherwise close the loop with no verdict of record on GitHub and the
         # review request still dangling -- the studio #298 failure.
-        # ...unless the post was ABANDONED, which happens only when the head the
-        # round judged is gone from the PR. There is then no commit left to
-        # record that verdict against, and holding the round open would strand
-        # the PR outside the loop forever; the round is released instead and a
-        # fresh one is owed against the new head. See _abandon_verdict.
-        if (
-            task is not None
-            and completed > native
-            and not self.state.verdict_post_abandoned(pr.full_name, number, completed)
-        ):
+        # ...discounting rounds whose post was ABANDONED, which happens only
+        # when the head the round judged is gone from the PR. There is then no
+        # commit left to record that verdict against, and holding the round
+        # open would strand the PR outside the loop forever; the round is
+        # released instead and a fresh one is owed against the new head (see
+        # _abandon_verdict).
+        #
+        # The discount is a SUBTRACTION, not just a check on the newest round.
+        # An abandoned round's envelope stays on the task forever while its
+        # review record never exists, so it leaves a permanent hole between the
+        # two counts -- and an uncorrected hole reads, on the NEXT round, as
+        # "that round has no native verdict", producing a duplicate post over a
+        # session that closed its own round correctly.
+        owed = completed - self.state.abandoned_rounds(pr.full_name, number)
+        if task is not None and owed > native:
             # Terminal for this pass either way. On a landed post the review
             # request it consumed drops the PR out of the search, so
             # convergence and the next round belong to the next pass, decided
@@ -737,6 +747,7 @@ class ReviewWatcher:
             pr.full_name, pr.number, round_, self._judged_head(pr, round_)
         )
         attempts = int(row["attempts"])
+        # `left` decides; `reason` only ever reaches a caller when left > 0.
         if attempts == 0:
             # The grace window: measured from the first observation, because it
             # is about the round's own session getting its chance, not about
@@ -907,7 +918,7 @@ class ReviewWatcher:
             f"A fresh round is owed against `{pr.head_sha[:8]}`.",
         )
         return Decision(
-            Action.AWAITING_POST,
+            Action.ABANDONED,
             f"round {round_}'s native verdict was abandoned — {why}",
             round_,
             task_ref=task.ref,
@@ -2154,6 +2165,7 @@ class ReviewWatcher:
             reaped=reaped,
             posted=counts[Action.POSTED],
             awaiting_post=counts[Action.AWAITING_POST],
+            abandoned=counts[Action.ABANDONED],
             stages=stages,
         )
 

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.4}/src/main/alissa/tools/github/revloop/state.py

@@ -128,6 +128,7 @@ CREATE TABLE IF NOT EXISTS poll_snapshots (
     reaped            INTEGER NOT NULL,
     posted            INTEGER NOT NULL DEFAULT 0,
     awaiting_post     INTEGER NOT NULL DEFAULT 0,
+    abandoned         INTEGER NOT NULL DEFAULT 0,
     stages_json       TEXT    NOT NULL
 );
 """
@@ -140,6 +141,7 @@ CREATE TABLE IF NOT EXISTS poll_snapshots (
 _SNAPSHOT_ADDED_COLUMNS = (
     ("posted", "INTEGER NOT NULL DEFAULT 0"),
     ("awaiting_post", "INTEGER NOT NULL DEFAULT 0"),
+    ("abandoned", "INTEGER NOT NULL DEFAULT 0"),
 )
 
 
@@ -509,6 +511,23 @@ class State:
         row = self.get_verdict_post(repo, number, round_)
         return bool(row is not None and row["abandoned_at"])
 
+    def abandoned_rounds(self, repo: str, number: int) -> int:
+        """How many of this PR's rounds will never have a native verdict.
+
+        Each one leaves a permanent hole between the envelope count and the
+        review count -- the envelope is on the task forever, the review record
+        never exists -- so every later comparison of the two has to subtract
+        it. Without that the daemon reads the hole as "the newest round has no
+        native verdict" and posts a redundant one on the round AFTER each
+        abandonment.
+        """
+        row = self._db.execute(
+            "SELECT COUNT(*) AS n FROM verdict_posts "
+            "WHERE repo=? AND number=? AND abandoned_at IS NOT NULL",
+            (repo, number),
+        ).fetchone()
+        return int(row["n"]) if row else 0
+
     def record_verdict_post(
         self, repo: str, number: int, round_: int, review_url: str
     ) -> None:
@@ -551,6 +570,7 @@ class State:
         reaped: int = 0,
         posted: int = 0,
         awaiting_post: int = 0,
+        abandoned: int = 0,
         stages: list[dict],
     ) -> None:
         """Append one poll-pass observation, then prune to the newest
@@ -566,8 +586,8 @@ class State:
             "INSERT INTO poll_snapshots "
             "(ts, duration_ms, candidates, spawned, stale_reenqueued, "
             "in_flight, deferred, converged, capped, escalated, skipped, "
-            "reaped, posted, awaiting_post, stages_json) "
-            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+            "reaped, posted, awaiting_post, abandoned, stages_json) "
+            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
             (
                 int(time.time()),
                 duration_ms,
@@ -583,6 +603,7 @@ class State:
                 reaped,
                 posted,
                 awaiting_post,
+                abandoned,
                 json.dumps(stages, separators=(",", ":")),
             ),
         )

alissa_tools_github_revloop-0.16.4/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.16.4

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.4}/src/main/alissa/tools/github/revloop/webui/page.py

@@ -208,6 +208,8 @@ section.panel {
   border-color: var(--status-pending); background: var(--status-pending-bg); }
 .pill.converged, .pill.posted { color: var(--status-in-progress);
   border-color: var(--status-in-progress); background: var(--status-in-progress-bg); }
+.pill.abandoned { color: var(--status-cancelled);
+  border-color: var(--status-cancelled); background: var(--status-cancelled-bg); }
 .pill.awaiting-post { color: var(--status-blocked);
   border-color: var(--status-blocked); background: var(--status-blocked-bg); }
 .pill.capped { color: var(--status-cancelled);

{alissa_tools_github_revloop-0.16.3 → alissa_tools_github_revloop-0.16.4/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.16.3
+Version: 0.16.4
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_revloop-0.16.3/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.16.3