cherry-docs 0.2.0__py3-none-any.whl

scripts/check_size_limits.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""
+Code size guardrails:
+- max 250 lines per Python file
+- max 100 lines per function/method
+
+Existing legacy violations can be listed in scripts/code_size_allowlist.txt.
+New violations fail CI immediately.
+"""
+
+from __future__ import annotations
+
+import argparse
+import ast
+from pathlib import Path
+from typing import Iterable, List, Set, Tuple
+
+MAX_FILE_LINES = 250
+MAX_FUNCTION_LINES = 100
+ALLOWLIST_PATH = Path("scripts/code_size_allowlist.txt")
+
+
+def _load_allowlist(path: Path) -> Set[str]:
+    if not path.exists():
+        return set()
+    return {
+        line.strip()
+        for line in path.read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.strip().startswith("#")
+    }
+
+
+def _iter_python_files(root: Path) -> Iterable[Path]:
+    return sorted(p for p in root.rglob("*.py") if p.is_file())
+
+
+def _collect_violations(root: Path) -> List[str]:
+    violations: List[str] = []
+    for file_path in _iter_python_files(root):
+        text = file_path.read_text(encoding="utf-8")
+        lines = text.splitlines()
+        rel = file_path.as_posix()
+
+        if len(lines) > MAX_FILE_LINES:
+            violations.append(f"file:{rel}:{len(lines)}")
+
+        tree = ast.parse(text)
+        for node in ast.walk(tree):
+            if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                continue
+            if not getattr(node, "end_lineno", None):
+                continue
+            span = node.end_lineno - node.lineno + 1
+            if span > MAX_FUNCTION_LINES:
+                violations.append(f"func:{rel}:{node.name}:{node.lineno}:{span}")
+    return sorted(violations)
+
+
+def _split_violations(
+    violations: List[str],
+    allowlist: Set[str],
+) -> Tuple[List[str], List[str]]:
+    unexpected = [v for v in violations if v not in allowlist]
+    resolved = sorted(item for item in allowlist if item not in violations)
+    return unexpected, resolved
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Enforce code size limits.")
+    parser.add_argument("--root", default="app", help="Path to scan (default: app)")
+    parser.add_argument(
+        "--strict",
+        action="store_true",
+        help="Fail on all violations, including allowlisted legacy ones.",
+    )
+    args = parser.parse_args()
+
+    root = Path(args.root)
+    if not root.exists():
+        print(f"ERROR: root path not found: {root}")
+        return 2
+
+    violations = _collect_violations(root)
+    allowlist = _load_allowlist(ALLOWLIST_PATH)
+
+    if args.strict:
+        unexpected = violations
+        resolved = []
+    else:
+        unexpected, resolved = _split_violations(violations, allowlist)
+
+    if violations:
+        print("Code size violations:")
+        for item in violations:
+            print(f"  - {item}")
+    else:
+        print("No code size violations found.")
+
+    if resolved:
+        print("\nAllowlist entries now resolved (remove these lines):")
+        for item in resolved:
+            print(f"  - {item}")
+
+    if unexpected:
+        print("\nERROR: New/unallowlisted size violations found.")
+        if not args.strict:
+            print(f"Add legacy-only items to {ALLOWLIST_PATH} if unavoidable.")
+        return 1
+
+    print("\nOK: No new size violations.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/ci_auto_capture.py

@@ -0,0 +1,289 @@
+#!/usr/bin/env python3
+"""Auto-capture GitHub CI/PR lifecycle events into CherryDocs memory."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import urllib.error
+import urllib.request
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict
+
+
+def normalize_workspace_repo(raw: str | None) -> str:
+    value = (raw or "").strip()
+    if not value:
+        return "github.com/unknown/unknown"
+    if value.startswith("github.com/"):
+        return value
+    return f"github.com/{value}"
+
+
+def read_event_context() -> Dict[str, Any]:
+    payload: Dict[str, Any] = {}
+    payload_path = os.getenv("GITHUB_EVENT_PATH")
+    if payload_path and Path(payload_path).exists():
+        try:
+            payload = json.loads(Path(payload_path).read_text())
+        except Exception:
+            payload = {}
+
+    pull_request = payload.get("pull_request") or {}
+    pr_number = pull_request.get("number")
+    pr_title = pull_request.get("title")
+
+    return {
+        "event_name": os.getenv("GITHUB_EVENT_NAME", ""),
+        "event_action": payload.get("action", ""),
+        "workflow": os.getenv("GITHUB_WORKFLOW", ""),
+        "repository": os.getenv("GITHUB_REPOSITORY", ""),
+        "sha": os.getenv("GITHUB_SHA", ""),
+        "ref": os.getenv("GITHUB_REF_NAME", ""),
+        "run_id": os.getenv("GITHUB_RUN_ID", ""),
+        "run_attempt": os.getenv("GITHUB_RUN_ATTEMPT", ""),
+        "server_url": os.getenv("GITHUB_SERVER_URL", "https://github.com"),
+        "pr_number": pr_number,
+        "pr_title": pr_title,
+        "pr_base_ref": pull_request.get("base", {}).get("ref"),
+        "pr_head_ref": pull_request.get("head", {}).get("ref"),
+        "pr_changed_files": pull_request.get("changed_files"),
+        "pr_additions": pull_request.get("additions"),
+        "pr_deletions": pull_request.get("deletions"),
+    }
+
+
+def classify_failure_modes(statuses: Dict[str, str], gate_summary: Dict[str, Any] | None = None) -> list[str]:
+    classes: list[str] = []
+    if statuses.get("quality_fast") and statuses["quality_fast"] != "success":
+        classes.append("quality_fast_failure")
+    if statuses.get("quality_integration") and statuses["quality_integration"] != "success":
+        classes.append("integration_failure")
+    if statuses.get("security_scan") and statuses["security_scan"] == "failure":
+        classes.append("security_scan_failure")
+    if statuses.get("typecheck_targeted") and statuses["typecheck_targeted"] == "failure":
+        classes.append("typecheck_failure")
+    if statuses.get("duplication_check") and statuses["duplication_check"] == "failure":
+        classes.append("duplication_failure")
+    if statuses.get("pr_gate_report") and statuses["pr_gate_report"] == "failure":
+        classes.append("report_failure")
+    if statuses.get("eval_secret_check") and statuses["eval_secret_check"] == "failure":
+        classes.append("eval_secret_config_failure")
+    if statuses.get("eval_smoke") and statuses["eval_smoke"] == "failure":
+        classes.append("eval_smoke_failure")
+    if statuses.get("eval_golden_memory") and statuses["eval_golden_memory"] == "failure":
+        classes.append("eval_golden_memory_failure")
+    if statuses.get("eval_pr_local") and statuses["eval_pr_local"] == "failure":
+        classes.append("eval_pr_local_failure")
+    return classes
+
+
+def _read_json(path: Path) -> Dict[str, Any] | None:
+    if not path.exists():
+        return None
+    try:
+        return json.loads(path.read_text())
+    except Exception:
+        return None
+
+
+def load_gate_summary(artifacts_root: str) -> Dict[str, Any] | None:
+    root = Path(artifacts_root)
+    if not root.exists():
+        return None
+    return _read_json(root / "pr-gate-report" / "pr-gate-report.json")
+
+
+def summarize_gate_summary(summary: Dict[str, Any] | None) -> str:
+    if not summary:
+        return "PR Gate Summary: unavailable"
+
+    lines: list[str] = []
+    coverage = summary.get("coverage") or {}
+    if coverage:
+        lines.append(
+            "Coverage: "
+            f"line {float(coverage.get('line_rate', 0.0)):.2f}% / "
+            f"branch {float(coverage.get('branch_rate', 0.0)):.2f}%"
+        )
+    coverage_regression = summary.get("coverage_regression") or {}
+    if coverage_regression:
+        lines.append(
+            "Coverage Regression: "
+            f"baseline {float(coverage_regression.get('baseline_line_rate', 0.0)):.2f}% -> "
+            f"candidate {float(coverage_regression.get('candidate_line_rate', 0.0)):.2f}% "
+            f"(drop {float(coverage_regression.get('line_rate_drop', 0.0)):.2f})"
+        )
+    duplication = summary.get("duplication") or {}
+    if duplication:
+        lines.append(
+            f"Duplication: {float(duplication.get('percentage', 0.0)):.2f}% "
+            f"({duplication.get('duplicated_lines', 0)} duplicated lines)"
+        )
+    promptfoo = summary.get("promptfoo") or {}
+    if promptfoo:
+        lines.append(
+            "Promptfoo: "
+            f"score {float(promptfoo.get('overall_score', 0.0)):.3f}, "
+            f"{promptfoo.get('passing_cases', 0)} passing / {promptfoo.get('failing_cases', 0)} failing"
+        )
+    security = summary.get("security") or {}
+    bandit = security.get("bandit") or {}
+    gitleaks = security.get("gitleaks") or {}
+    semgrep = security.get("semgrep") or {}
+    if bandit or gitleaks or semgrep:
+        lines.append(
+            "Security: "
+            f"bandit_high={bandit.get('high', 0)}, "
+            f"gitleaks={gitleaks.get('findings', 0)}, "
+            f"semgrep_error={semgrep.get('error', 0)}"
+        )
+    return "PR Gate Summary:\n" + ("\n".join(lines) if lines else "No aggregated artifact data available")
+
+
+def build_capture_payload(args: argparse.Namespace, ctx: Dict[str, Any]) -> Dict[str, Any]:
+    workspace_repo = normalize_workspace_repo(args.workspace_repo or ctx.get("repository"))
+    run_url = f"{ctx['server_url']}/{ctx['repository']}/actions/runs/{ctx['run_id']}" if ctx.get("run_id") else ""
+
+    statuses = {
+        "quality_fast": args.quality_fast,
+        "quality_integration": args.quality_integration,
+        "security_scan": args.security_scan,
+        "typecheck_targeted": args.typecheck_targeted,
+        "duplication_check": args.duplication_check,
+        "pr_gate_report": args.pr_gate_report,
+        "eval_secret_check": args.eval_secret_check,
+        "eval_smoke": args.eval_smoke,
+        "eval_golden_memory": args.eval_golden_memory,
+        "eval_pr_local": args.eval_pr_local,
+    }
+    status_line = ", ".join(f"{k}={v}" for k, v in statuses.items() if v)
+    gate_summary = load_gate_summary(args.artifacts_root)
+    failure_classes = classify_failure_modes(statuses, gate_summary)
+    event_desc = f"{ctx.get('event_name')}:{ctx.get('event_action') or 'n/a'}"
+    pr_text = (
+        f"PR #{ctx['pr_number']} - {ctx['pr_title']}"
+        if ctx.get("pr_number")
+        else "No PR context"
+    )
+    pr_scope = ""
+    if ctx.get("pr_number"):
+        pr_scope = (
+            f"PR Base: {ctx.get('pr_base_ref')}\n"
+            f"PR Head: {ctx.get('pr_head_ref')}\n"
+            f"PR Changed Files: {ctx.get('pr_changed_files')}\n"
+            f"PR Additions/Deletions: +{ctx.get('pr_additions')} / -{ctx.get('pr_deletions')}\n"
+        )
+    gate_summary_text = summarize_gate_summary(gate_summary)
+
+    summary = (
+        f"CI auto-capture [{ctx.get('workflow', 'workflow')}] "
+        f"{ctx.get('event_name', 'event')} on {ctx.get('ref', '?')} ({args.capture_status})"
+        f"{f' [{failure_classes[0]}]' if failure_classes else ''}"
+    )
+    details = (
+        f"Captured GitHub workflow lifecycle automatically.\n"
+        f"Workflow: {ctx.get('workflow')}\n"
+        f"Event: {event_desc}\n"
+        f"Repository: {ctx.get('repository')}\n"
+        f"Ref: {ctx.get('ref')}\n"
+        f"SHA: {ctx.get('sha')}\n"
+        f"Run URL: {run_url}\n"
+        f"Job statuses: {status_line or 'none'}\n"
+        f"Failure classes: {', '.join(failure_classes) if failure_classes else 'none'}\n"
+        f"{gate_summary_text}\n"
+        f"PR Context: {pr_text}\n"
+        f"{pr_scope}"
+        f"Captured At (UTC): {datetime.now(timezone.utc).isoformat()}"
+    )
+    tags = [
+        "auto-capture",
+        "ci",
+        f"workflow:{ctx.get('workflow', 'unknown')}",
+        f"event:{ctx.get('event_name', 'unknown')}",
+        f"status:{args.capture_status}",
+    ]
+    tags.extend(f"failure:{item}" for item in failure_classes)
+
+    arguments = {
+        "_workspace_repo": workspace_repo,
+        "type": "episodic",
+        "summary": summary,
+        "details": details,
+        "reasoning": "Manual logging of pipeline events is unreliable; automatic capture prevents knowledge gaps.",
+        "tags": tags,
+    }
+    return {
+        "jsonrpc": "2.0",
+        "id": 1,
+        "method": "tools/call",
+        "params": {"name": "log_activity", "arguments": arguments},
+    }
+
+
+def post_jsonrpc(url: str, api_key: str, payload: Dict[str, Any]) -> Dict[str, Any]:
+    body = json.dumps(payload).encode("utf-8")
+    req = urllib.request.Request(
+        url,
+        data=body,
+        headers={
+            "Content-Type": "application/json",
+            "Authorization": f"Bearer {api_key}",
+        },
+        method="POST",
+    )
+    with urllib.request.urlopen(req, timeout=15) as resp:
+        raw = resp.read().decode("utf-8")
+        return json.loads(raw)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Auto-capture CI events to CherryDocs")
+    parser.add_argument("--workspace-repo", default="", help="Workspace repo (github.com/owner/repo)")
+    parser.add_argument("--artifacts-root", default="artifacts")
+    parser.add_argument("--capture-status", default="success", choices=["success", "failure"])
+    parser.add_argument("--quality-fast", default="")
+    parser.add_argument("--quality-integration", default="")
+    parser.add_argument("--security-scan", default="")
+    parser.add_argument("--typecheck-targeted", default="")
+    parser.add_argument("--duplication-check", default="")
+    parser.add_argument("--pr-gate-report", default="")
+    parser.add_argument("--eval-secret-check", default="")
+    parser.add_argument("--eval-smoke", default="")
+    parser.add_argument("--eval-golden-memory", default="")
+    parser.add_argument("--eval-pr-local", default="")
+    parser.add_argument("--golden-workflow", default="")
+    parser.add_argument("--mcp-url", default=os.getenv("CHERRY_MCP_URL", "https://cherry-docs.onrender.com/mcp"))
+    parser.add_argument("--api-key", default=os.getenv("CHERRY_API_KEY", ""))
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    if not args.api_key:
+        print("ci-auto-capture: CHERRY_API_KEY missing; skipping.")
+        return 0
+
+    ctx = read_event_context()
+    payload = build_capture_payload(args, ctx)
+    try:
+        response = post_jsonrpc(args.mcp_url, args.api_key, payload)
+    except (urllib.error.URLError, TimeoutError) as exc:
+        print(f"ci-auto-capture: network error while posting log: {exc}")
+        return 0
+    except Exception as exc:
+        print(f"ci-auto-capture: unexpected error while posting log: {exc}")
+        return 0
+
+    result = response.get("result", {})
+    if result.get("isError"):
+        print(f"ci-auto-capture: log rejected: {result.get('error', 'unknown error')}")
+        return 0
+
+    print("ci-auto-capture: log sent successfully.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())