alissa-tools-github-revloop 0.16.4__tar.gz → 0.16.6__tar.gz

{alissa_tools_github_revloop-0.16.4/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.16.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.16.4
+Version: 0.16.6
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.16.4 → alissa_tools_github_revloop-0.16.6}/src/main/alissa/tools/github/revloop/ghclient.py

@@ -15,6 +15,7 @@ without it the client inherits, exactly as it always did.
 
 from __future__ import annotations
 
+import json
 import logging
 import os
 import re
@@ -96,6 +97,12 @@ class PullRequest:
     # "open" or "closed"; merged PRs report state "closed" AND merged True.
     state: str = "open"
     merged: bool = False
+    # Logins GitHub currently holds a pending review request against. Read off
+    # the same PR payload as everything else here, so knowing whether this
+    # daemon's own request is still dangling costs no extra call. USERS only:
+    # `requested_teams` is a separate field and is deliberately not carried,
+    # because nothing in the loop may ever withdraw a team's request.
+    requested_reviewers: tuple[str, ...] = ()
 
     @property
     def full_name(self) -> str:
@@ -331,9 +338,23 @@ class GitHub:
             )
         return actual
 
-    def _api(self, *args: str, timeout: int = 60, forbidden_is_rate_limit: bool = True):
+    def _api(
+        self,
+        *args: str,
+        timeout: int = 60,
+        forbidden_is_rate_limit: bool = True,
+        body: "dict | None" = None,
+    ):
         """One `gh api` call, with GitHub's throttling mapped to RateLimited.
 
+        `body` is for requests whose payload must have a particular JSON SHAPE.
+        `gh`'s `-f` fields cannot express one portably: `-f 'k[]=v'` is encoded
+        as the array `{"k": ["v"]}` only by modern `gh`, and as a string field
+        NAMED `k[]` by the 2.4.0 this client targets -- silently, so the
+        request goes out well-formed and simply missing the key the endpoint
+        wants. Passing the body on stdin through `--input -` (which 2.4.0 does
+        support) takes every `gh` version out of the encoding decision.
+
         `forbidden_is_rate_limit` is about one ambiguity: GitHub answers a
         secondary rate limit with 403, so a bare "403" in stderr is read as
         throttling by default, and `run_forever` backs off. That default is
@@ -348,8 +369,13 @@ class GitHub:
         that pass False: an explicit throttling marker still raises
         RateLimited, and everything else stays a CommandError they can handle.
         """
+        argv = ["gh", "api", *args]
+        stdin = None
+        if body is not None:
+            argv += ["--input", "-"]
+            stdin = json.dumps(body)
         try:
-            return run_json(["gh", "api", *args], timeout=timeout, env=self._env())
+            return run_json(argv, timeout=timeout, env=self._env(), stdin=stdin)
         except CommandError as exc:
             blob = exc.stderr.lower()
             throttled = any(marker in blob for marker in RATE_LIMIT_MARKERS)
@@ -402,6 +428,11 @@ class GitHub:
             url=data.get("html_url", ""),
             state=data.get("state") or "open",
             merged=bool(data.get("merged")),
+            requested_reviewers=tuple(
+                str((u or {}).get("login") or "")
+                for u in (data.get("requested_reviewers") or [])
+                if (u or {}).get("login")
+            ),
         )
 
     def reviews(self, owner: str, repo: str, number: int) -> list[Review]:
@@ -547,6 +578,38 @@ class GitHub:
         data = self._api(*argv, forbidden_is_rate_limit=False) or {}
         return str(data.get("html_url") or "")
 
+    def remove_review_request(
+        self, owner: str, repo: str, number: int, login: str
+    ) -> None:
+        """Withdraw the pending review request held against ONE login.
+
+        The payload names exactly one reviewer, never the whole list: GitHub's
+        DELETE removes only what it is given, so a human reviewer or a second
+        bot sitting in the same `requested_reviewers` array is untouched. The
+        caller is the round close-out (loop._clear_own_review_request), and the
+        only login it ever passes is the daemon's own.
+
+        The body goes out through `--input` rather than `-f 'reviewers[]=…'`,
+        because that field syntax means different things on different `gh`
+        versions and this client targets 2.4.0, where it produces a string
+        field literally named `reviewers[]` -- no `reviewers` key, a 422, and a
+        feature that never worked. See `_api`.
+
+        `forbidden_is_rate_limit=False` for the same reason `submit_review`
+        passes it: a 403 here is this identity not being allowed to edit the
+        PR's reviewers, which is a fact about the deployment that its caller
+        logs and degrades on -- not a throttle worth backing the whole poll
+        pass off for. Note the permission is `pull_requests: write`, strictly
+        more than reviewing needs.
+        """
+        self._api(
+            "-X",
+            "DELETE",
+            f"repos/{owner}/{repo}/pulls/{number}/requested_reviewers",
+            body={"reviewers": [login]},
+            forbidden_is_rate_limit=False,
+        )
+
     def comment(self, owner: str, repo: str, number: int, body: str) -> None:
         run_json(
             [

{alissa_tools_github_revloop-0.16.4 → alissa_tools_github_revloop-0.16.6}/src/main/alissa/tools/github/revloop/loop.py

@@ -399,6 +399,70 @@ def capout_kind(head_sha: str, granted: int) -> str:
     return f"capout:{head_sha}:{granted}"
 
 
+def identity_drift_kind(requested: str, author: str) -> str:
+    """The ping-ledger kind that dedupes ONE request/author identity-drift warning.
+
+    Scope is once per PR per ordered login pair -- the ledger keys on
+    `(repo, number, kind)`, so folding the pair into the kind narrows the
+    dedupe WITHIN a PR and cannot lift it above one. What the pair buys is that
+    a drift which later becomes a DIFFERENT drift announces itself again
+    instead of staying quiet because this PR once warned about something else.
+
+    Durable rather than in-memory because it is a configuration alarm, not a
+    per-poll observation: a restart re-stating it on every open PR would be a
+    wall of noise. Per-PR is bounded in practice by the withdrawal itself --
+    once the request is gone the PR leaves the poll set, so a drifted
+    deployment emits one block per PR it closes a round on, not one per poll.
+    """
+    return f"reqdrift:{requested}->{author}"
+
+
+def drift_probe_kind(head_sha: str) -> str:
+    """The ping-ledger kind that bounds the drift check's EXTRA read.
+
+    The check needs the unfiltered review list, which `my_reviews` cannot
+    supply -- a review by another identity is exactly what it filters out. That
+    is one more API call, and on a PR whose withdrawal fails permanently (a
+    reviewer identity without `pull_requests: write`) the close-out path runs
+    every poll, so "one extra call on the rare path" would quietly become one
+    per poll forever.
+
+    Keyed on the head so the probe re-runs when the code moves -- a new head
+    means a new round and a new chance for its verdict to land under the wrong
+    login -- and recorded only once the review list has actually been READ, so
+    an unreadable list retries instead of being settled by a failure.
+    """
+    return f"driftprobe:{head_sha}"
+
+
+def withdraw_failed_kind(exc: BaseException) -> str:
+    """The ping-ledger kind that dedupes a failing review-request withdrawal.
+
+    Retrying a failed DELETE is right -- a 403 can be a permission grant away
+    from working. Re-LOGGING it every poll is not: the common failure is
+    permanent and per-PR, so at a 30s poll interval one such PR would emit
+    ~2,880 warning lines a day that never converge on anything.
+
+    Keyed on the exception class, not its message: a message carries the PR
+    and the moment, which would defeat the dedupe, while a 403 that later
+    becomes a 422 is a genuinely different condition and says so once.
+    """
+    return f"withdraw-failed:{type(exc).__name__}"
+
+
+def withdrawn_kind(head_sha: str) -> str:
+    """The ping-ledger kind that marks a review request already withdrawn at
+    this head -- so a request that COMES BACK is distinguishable from the first
+    one.
+
+    Withdrawing is the daemon undoing a state change a human or an automation
+    made on GitHub. Doing it once at a head is routine close-out; doing it
+    again means somebody deliberately asked for another look and the daemon
+    took it away, which is worth a louder line than the first.
+    """
+    return f"withdrawn:{head_sha}"
+
+
 def _now() -> str:
     """The activity comment's timestamp format (UTC, seconds)."""
     return time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime())
@@ -580,6 +644,13 @@ class ReviewWatcher:
         # The surviving-session set the cap alarm last paged on, so a standing
         # over-cap condition pages once per episode -- see _check_session_cap.
         self._paged_cap: frozenset[str] | None = None
+        # (repo slug, number, drift kind) already announced by THIS process in
+        # dry-run. Deliberately in-memory: a dry-run pass must never be
+        # suppressed by anything durable (a production pass writing the ledger
+        # would silence the operator's diagnostic), but a daemon left in
+        # dry-run should not re-announce the same drift every poll either --
+        # see _warn_identity_drift.
+        self._dry_run_drift: set[tuple[str, int, str]] = set()
 
     # -- per-PR decision ---------------------------------------------------
 
@@ -646,6 +717,13 @@ class ReviewWatcher:
 
         converged = self._convergence_reason(my_reviews, task, pr.head_sha)
         if converged is not None:
+            # THE terminal branch: a verdict of record exists at the current
+            # head, so no round k+1 can be owed from here -- every path that
+            # could open one (head moved, non-approve verdict, cap re-entry
+            # ack) is either upstream of this return or unreachable past it.
+            # That is what makes it the only safe place to withdraw a dangling
+            # self review request; see _clear_own_review_request.
+            self._clear_own_review_request(pr, my_reviews, converged)
             return Decision(Action.CONVERGED, converged, completed)
 
         # The effective cap is the configured one plus every re-entry an
@@ -1290,6 +1368,210 @@ class ReviewWatcher:
 
         return None
 
+    # -- round close-out ---------------------------------------------------
+
+    def _clear_own_review_request(
+        self, pr: PullRequest, my_reviews: list[Review], why: str
+    ) -> None:
+        """Withdraw this daemon's own dangling review request on a closed round.
+
+        Normally there is nothing to do: GitHub consumes a review request the
+        moment the requested identity submits a review, so a converged PR has
+        no request left and drops straight out of `review_requests`. The
+        request survives when the review that closed the round was NOT posted
+        by the requested identity -- studio #298, where a ready-flip
+        auto-requested `alissa-app` while the round ran under another login.
+        Nothing then ever consumes it, so the PR stays in the search set and
+        every poll pays a full re-verification (PR fetch, reviews, task,
+        envelope count) to reach this same no-op. Removing the request is what
+        ends that: the search is the evaluation set, so the PR leaves it.
+
+        Four properties this must not violate:
+
+        * Only ever OUR login. Human reviewers and any second bot in the same
+          `requested_reviewers` array are somebody else's pending work, and a
+          daemon that withdrew them would silently cancel real reviews.
+        * Only from the terminal branch. The caller is the one return where a
+          verdict of record stands at the current head and no further round can
+          be owed; a request withdrawn while a round could still open would
+          delete the very trigger that surfaces the PR.
+        * Only on a HEAD-BOUND verdict. `_convergence_reason` cannot check a
+          review that carries no `commit_id` and lets it converge anyway; that
+          convergence is not about the current head, so withdrawing on it would
+          take a PR out of the daemon's sight on a verdict that might be about
+          old code. Such a review is not producible today -- `submit_review`
+          always pins a commit and GitHub populates it -- but the terminal
+          argument must hold on its own terms rather than by inheritance, so
+          the check is repeated here.
+        * Never blocking. The removal is a side effect of a decision already
+          made, so any failure -- including a throttled one -- is logged and
+          dropped rather than raised: the pass keeps walking and the next poll
+          retries, which is strictly better than converting a no-op into an
+          aborted pass. (Deliberately unlike the read paths, which let
+          RateLimited reach run_forever's backoff.)
+
+        `my_reviews` is non-empty at every call site -- `_convergence_reason`
+        returns None on an empty one -- so its newest entry IS the verdict of
+        record, read positionally rather than defended against.
+        """
+        mine = self.github.login
+        if mine not in pr.requested_reviewers:
+            return
+
+        verdict = my_reviews[-1]
+        if not verdict.commit_id:
+            log.debug(
+                "%s: not withdrawing the review request — the converged review "
+                "%s carries no commit_id, so convergence is not head-bound",
+                pr.slug, verdict.url or "with no url",
+            )
+            return
+
+        # Above the dry-run guard: the drift check reads and logs but takes
+        # nothing on GitHub, and in dry-run it records nothing either -- it
+        # OBSERVES the pass rather than acting in it. Dry-run is the mode an
+        # operator reaches for to diagnose exactly this, so staying silent
+        # about it there is the worst place. See _warn_identity_drift for why
+        # the ledger is untouched in BOTH directions there.
+        self._warn_identity_drift(pr)
+
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would withdraw the dangling review request for %s on "
+                "%s — the round is closed (%s)",
+                mine, pr.slug, why,
+            )
+            return
+
+        try:
+            self.github.remove_review_request(pr.owner, pr.repo, pr.number, mine)
+        except Exception as exc:
+            kind = withdraw_failed_kind(exc)
+            if self.state.pinged(pr.full_name, pr.number, kind):
+                # Still retried, just not re-announced; see withdraw_failed_kind.
+                log.debug(
+                    "%s: withdrawal still failing for %s (%s)", pr.slug, mine, exc
+                )
+                return
+            self.state.record_ping(pr.full_name, pr.number, kind)
+            log.warning(
+                "%s: could not withdraw the dangling review request for %s (%s) "
+                "— the closed round will be re-evaluated next poll and the "
+                "removal retried. Withdrawing needs `pull_requests: write`, "
+                "which is more than reviewing needs; further failures of this "
+                "kind log at debug",
+                pr.slug, mine, exc,
+            )
+            return
+
+        others = [login for login in pr.requested_reviewers if login != mine]
+        left = ", ".join(others) if others else "no other reviewers"
+        kind = withdrawn_kind(pr.head_sha)
+        if self.state.pinged(pr.full_name, pr.number, kind):
+            # The request came back at a head this daemon already closed out.
+            # Someone asked for another look at code that still carries its
+            # approve -- and the daemon has just taken their request away, so
+            # say so where they will find it.
+            log.warning(
+                "%s round close-out: the review request for %s came back at "
+                "head %s and was withdrawn AGAIN — the approve at that head "
+                "still stands (%s), so no round is owed; only a new commit "
+                "opens one. Verdict of record %s. Left in place: %s",
+                pr.slug, mine, pr.head_sha[:8], why, verdict.url, left,
+            )
+            return
+        self.state.record_ping(pr.full_name, pr.number, kind)
+        log.info(
+            "%s round close-out: withdrew the dangling review request for %s — "
+            "%s; verdict of record %s at head %s. Left in place: %s",
+            pr.slug, mine, why, verdict.url, pr.head_sha[:8], left,
+        )
+
+    def _drift_gated(self, pr: PullRequest, kind: str, record: bool) -> bool:
+        """Whether this drift-check gate is already closed for `pr`.
+
+        The two backing stores are not interchangeable and the split is the
+        whole point: durable in production, process-lifetime in dry-run, so
+        neither mode can ever silence the other. See _warn_identity_drift.
+        """
+        if record:
+            return self.state.pinged(pr.full_name, pr.number, kind)
+        return (pr.full_name, pr.number, kind) in self._dry_run_drift
+
+    def _note_drift_gate(self, pr: PullRequest, kind: str, record: bool) -> None:
+        if record:
+            self.state.record_ping(pr.full_name, pr.number, kind)
+        else:
+            self._dry_run_drift.add((pr.full_name, pr.number, kind))
+
+    def _warn_identity_drift(self, pr: PullRequest) -> None:
+        """Page once when the round's write-up landed under a login GitHub does
+        not hold the request against.
+
+        This is the #298 shape: the request names one identity, the newest
+        review on the PR carries another, and GitHub only ever consumes a
+        request when the REQUESTED login submits. Withdrawing the request
+        cleans up this PR; the config that produced it will produce the next
+        one too, so it is worth one loud line naming both identities.
+
+        Diagnostic only -- it never gates the removal, and an unreadable review
+        list just means no warning, not a stalled close-out.
+
+        Two gates, both of them once-per-condition: the extra read runs once per
+        (PR, head) and the warning once per (PR, login pair). See
+        drift_probe_kind and identity_drift_kind.
+
+        In `--dry-run` the SAME two gates apply, held in memory instead of in
+        the ping ledger -- which the run must not touch in either direction.
+        Writing would let a diagnostic pass durably silence the daemon it was
+        run to diagnose (`state_db` has no dry-run branch, so the rows land in
+        the same `state.db` production reads, and the alarm is once-per-PR).
+        Reading would silence the DIAGNOSTIC instead: a production pass that
+        already probed this head would make the operator's dry-run print
+        nothing. Process-lifetime scope gives both -- a fresh dry-run always
+        announces, and a daemon left running in dry-run does not re-emit the
+        same block every poll. Same reasoning as `_ignored_acks`: a statement
+        about one process belongs in the process, not in the ledger.
+        """
+        record = not self.config.dry_run
+
+        probe = drift_probe_kind(pr.head_sha)
+        if self._drift_gated(pr, probe, record):
+            return
+
+        try:
+            reviews = self.github.reviews(pr.owner, pr.repo, pr.number)
+        except Exception as exc:
+            # Deliberately not recorded: a read that failed settles nothing.
+            log.debug("%s: could not read reviews for the drift check: %s", pr.slug, exc)
+            return
+        self._note_drift_gate(pr, probe, record)
+
+        substantive = [r for r in reviews if r.is_substantive]
+        if not substantive:
+            return
+        newest = max(substantive, key=lambda r: r.submitted_at)
+        if newest.author == self.github.login:
+            return
+
+        kind = identity_drift_kind(self.github.login, newest.author)
+        if self._drift_gated(pr, kind, record):
+            return
+        self._note_drift_gate(pr, kind, record)
+        log.warning(
+            "IDENTITY DRIFT on %s: the review request is held against %r but "
+            "the round's newest review was submitted by %r (%s). GitHub only "
+            "consumes a review request when the REQUESTED login submits, so "
+            "native review consumption cannot work for this deployment: every "
+            "closed round will leave a dangling request for the daemon to "
+            "withdraw. Point reviewer_login/reviewer_token_env at one identity "
+            "and have that identity post the verdict of record.",
+            pr.slug,
+            self.github.login,
+            newest.author,
+            newest.url or "no url",
+        )
+
     # -- reap sweep --------------------------------------------------------
 
     def sweep_sessions(self) -> int:

{alissa_tools_github_revloop-0.16.4 → alissa_tools_github_revloop-0.16.6}/src/main/alissa/tools/github/revloop/proc.py

@@ -36,12 +36,20 @@ def run(
     check: bool = True,
     cwd: "str | os.PathLike[str] | None" = None,
     env: "Mapping[str, str] | None" = None,
+    stdin: "str | None" = None,
 ) -> str:
     """Run a command, return stdout. Never uses shell=True.
 
     `env`, when given, REPLACES the child's environment rather than adding to
     it -- that is what makes it an identity guarantee: a credential the caller
     did not put in the mapping cannot reach the child by inheritance.
+
+    `stdin` feeds the child's standard input. It exists for `gh api --input -`:
+    `gh`'s `-f key=value` fields are encoded differently across `gh` versions
+    (`key[]=v` is a JSON array only on modern builds, a string field named
+    `key[]` on the 2.4.0 this client targets), so a request whose body must
+    have a particular JSON SHAPE is built by the caller and piped in, where no
+    version gets a say in it.
     """
     log.debug("exec: %s", " ".join(argv))
     try:
@@ -52,6 +60,7 @@ def run(
             timeout=timeout,
             cwd=str(cwd) if cwd is not None else None,
             env=dict(env) if env is not None else None,
+            input=stdin,
         )
     except subprocess.TimeoutExpired as exc:
         raise CommandError(argv, -1, f"timed out after {timeout}s") from exc
@@ -66,9 +75,10 @@ def run_json(
     *,
     timeout: int = 60,
     env: "Mapping[str, str] | None" = None,
+    stdin: "str | None" = None,
 ):
     """Run a command whose stdout is JSON."""
-    out = run(argv, timeout=timeout, env=env).strip()
+    out = run(argv, timeout=timeout, env=env, stdin=stdin).strip()
     if not out:
         return None
     try:

alissa_tools_github_revloop-0.16.6/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.16.6

{alissa_tools_github_revloop-0.16.4 → alissa_tools_github_revloop-0.16.6/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.16.4
+Version: 0.16.6
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_revloop-0.16.4/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.16.4