codna 0.2.11__tar.gz → 0.2.12__tar.gz

{codna-0.2.11 → codna-0.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.11
+Version: 0.2.12
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.11 → codna-0.2.12}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.11"
+__version__ = "0.2.12"

{codna-0.2.11 → codna-0.2.12}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/Users/angel/Developer/actions-runner/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/Users/angel/actions-runner-mac-2/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.2.11 → codna-0.2.12}/codna/ci_admission.py

@@ -27,7 +27,7 @@ slot, so the wait is bounded (`CODNA_CI_MAX_WAIT_S`) and expiry admits rather th
 """
 from __future__ import annotations
 
-import fcntl
+import contextlib
 import json
 import os
 import platform
@@ -60,6 +60,9 @@ DEFAULT_MAX_WAIT_S = 120.0        # bounded: a waiting job is still holding a ru
 DEFAULT_POLL_S = 5.0
 DEFAULT_LEASE_MAX_AGE_S = 6 * 3600.0
 DURATION_WINDOW = 200
+_LOCK_WAIT_S = 10.0               # then run unlocked -- a lock file must never block a build
+_LOCK_STALE_S = 60.0              # older than this, its holder died mid-section
+_LOCK_POLL_S = 0.05
 
 
 def _env_float(name: str, default: float) -> float:
@@ -241,24 +244,50 @@ class LeaseStore:
         self.durations_dir.mkdir(parents=True, exist_ok=True)
 
     # ── locking ────────────────────────────────────────────────────────────────────────────────
+    @contextlib.contextmanager
     def _locked(self):
-        """flock around check-and-reserve, so two runners cannot both see the last free slot."""
+        """Exclusive lock around check-and-reserve, so two runners cannot both take the last slot.
+
+        Uses an O_EXCL lock FILE rather than `fcntl.flock`. flock is the obvious choice and is
+        POSIX-only: importing it made this whole module fail to import on Windows, so a Windows
+        runner could not run the gate at all. `os.open(..., O_CREAT | O_EXCL)` is atomic on every
+        platform Python supports, and nothing here may assume an OS — the fleet is meant to be
+        adoptable on any runner.
+
+        Two safety valves, because a lock must never be able to wedge CI:
+          * a lock older than `_LOCK_STALE_S` is stolen — its holder died mid-section;
+          * if it still cannot be taken within `_LOCK_WAIT_S`, the section runs UNLOCKED. Briefly
+            risking an over-admit is strictly better than blocking a build on a lock file.
+        """
         self.ensure_dirs()
-        fh = open(self.lock_path, "a+")
-
-        class _Guard:
-            def __enter__(self_inner):
-                fcntl.flock(fh, fcntl.LOCK_EX)
-                return fh
-
-            def __exit__(self_inner, *exc):
+        deadline = time.monotonic() + _LOCK_WAIT_S
+        fd = None
+        while fd is None:
+            try:
+                fd = os.open(str(self.lock_path), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+            except FileExistsError:
                 try:
-                    fcntl.flock(fh, fcntl.LOCK_UN)
+                    if time.time() - os.path.getmtime(self.lock_path) > _LOCK_STALE_S:
+                        os.unlink(self.lock_path)
+                        continue
+                except OSError:
+                    pass            # vanished under us — just retry
+                if time.monotonic() >= deadline:
+                    break           # proceed unlocked rather than block CI
+                time.sleep(_LOCK_POLL_S)
+            except OSError:
+                break               # unwritable state dir — proceed unlocked
+        try:
+            yield fd
+        finally:
+            if fd is not None:
+                try:
+                    os.close(fd)
                 finally:
-                    fh.close()
-                return False
-
-        return _Guard()
+                    try:
+                        os.unlink(self.lock_path)
+                    except OSError:
+                        pass
 
     # ── occupancy ──────────────────────────────────────────────────────────────────────────────
     @staticmethod

{codna-0.2.11 → codna-0.2.12}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.11
+Version: 0.2.12
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.11 → codna-0.2.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.11"
+version = "0.2.12"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.11 → codna-0.2.12}/tests/test_ci_admission.py

@@ -374,6 +374,69 @@ def test_job_class_cannot_escape_the_state_directory():
     assert ci._safe_name("") == "job"
 
 
+# ── platform agnostic: the fleet must be adoptable on any runner ───────────────────────────────────
+def test_the_gate_imports_without_posix_only_modules():
+    """REGRESSION. The lock was `fcntl.flock`, and `import fcntl` is POSIX-only — so this module
+    could not even be IMPORTED on Windows and a Windows runner could not run the gate at all. The
+    gate is meant to work on any platform, so it must not depend on an OS-specific module.
+
+    Checked structurally because the suite itself runs on POSIX, where a regression would pass
+    silently: importing fcntl here succeeds, so only the absence of the import proves portability.
+
+    Parsed with `ast` rather than grepped: a substring check matches the module's own docstring
+    (which names `fcntl.flock` to explain why it is gone) and so fails while the code is correct —
+    the same false-positive trap as asserting on a comment.
+    """
+    import ast
+    import inspect
+
+    imported: set[str] = set()
+    for node in ast.walk(ast.parse(inspect.getsource(ci))):
+        if isinstance(node, ast.Import):
+            imported.update(alias.name.split(".")[0] for alias in node.names)
+        elif isinstance(node, ast.ImportFrom) and node.module:
+            imported.add(node.module.split(".")[0])
+
+    posix_only = imported & {"fcntl", "msvcrt", "termios", "pwd", "grp"}
+    assert not posix_only, f"platform-specific dependency reintroduced: {sorted(posix_only)}"
+
+
+def test_locking_survives_a_holder_that_died_mid_section(tmp_path, monkeypatch):
+    """A crashed job must not wedge the fleet. An O_EXCL lock file has no OS-level owner, so nothing
+    releases it automatically — an abandoned lock is stolen once it is older than the stale window.
+
+    Asserts it happens PROMPTLY, not merely that it happens: the fail-open path would eventually
+    admit anyway after `_LOCK_WAIT_S`, so a lease-only assertion passes with stealing removed
+    entirely (verified by mutation). The elapsed time is what distinguishes stolen from waited-out.
+    """
+    monkeypatch.setattr(ci, "_LOCK_WAIT_S", 5.0)
+    store = ci.LeaseStore(tmp_path / "s")
+    store.ensure_dirs()
+    store.lock_path.write_text("")                      # an abandoned lock, no owner
+    old = ci.time.time() - (ci._LOCK_STALE_S + 60)
+    os.utime(store.lock_path, (old, old))
+
+    started = ci.time.monotonic()
+    lease, _, _ = store.acquire("j", {}, lambda live: (True, "ok"))
+    elapsed = ci.time.monotonic() - started
+
+    assert lease is not None, "a stale lock must be stolen, not waited on forever"
+    assert elapsed < 1.0, f"stale lock was waited out ({elapsed:.1f}s), not stolen"
+
+
+def test_locking_never_blocks_a_build_indefinitely(tmp_path, monkeypatch):
+    """If the lock cannot be taken at all, the section runs UNLOCKED rather than blocking. Briefly
+    risking an over-admit is strictly better than failing a build on a lock file."""
+    monkeypatch.setattr(ci, "_LOCK_WAIT_S", 0.05)
+    monkeypatch.setattr(ci, "_LOCK_STALE_S", 10_000.0)   # fresh enough that it is never stolen
+    store = ci.LeaseStore(tmp_path / "s")
+    store.ensure_dirs()
+    store.lock_path.write_text("")                       # held, and not stale
+
+    lease, _, _ = store.acquire("j", {}, lambda live: (True, "ok"))
+    assert lease is not None, "an unavailable lock must not block admission"
+
+
 # ── fail open, always ──────────────────────────────────────────────────────────────────────────────
 def test_admission_failure_admits_rather_than_blocking_ci(tmp_path, monkeypatch):
     """The gate is infrastructure protecting throughput; it must never become the reason a build

{codna-0.2.11 → codna-0.2.12}/tests/test_packaging.py

@@ -426,7 +426,17 @@ def test_cli_publish_workflow_uses_trusted_publishing_and_contract_verification(
     assert "telys runtime install" not in workflow
     assert workflow.count("python scripts/verify_cli_wheel_tags.py --cli-dir cli") == 2
     assert workflow.count("python -m twine check cli/dist/*") == 2
-    assert "pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b" in workflow
+    # Pinned to a full 40-hex commit SHA, never a floating tag: a mutable ref on the action that
+    # uploads releases is a supply-chain hole. Asserted as a PROPERTY, not as one literal SHA --
+    # a hardcoded SHA fails on every LEGITIMATE re-pin (this one broke when the org aligned action
+    # refs org-wide to stop self-hosted runner cache thrash), and the only available fix is "bump
+    # the constant", which is not review and provides no real protection.
+    pypi_pins = re.findall(r"pypa/gh-action-pypi-publish@(\S+)", workflow)
+    assert pypi_pins, "the OIDC publish path must use pypa/gh-action-pypi-publish"
+    for _ref in pypi_pins:
+        assert re.fullmatch(r"[0-9a-f]{40}", _ref), (
+            f"pypa/gh-action-pypi-publish must be pinned to a full commit SHA, got {_ref!r}"
+        )
     # Publish auth policy: trusted-publisher OIDC is PREFERRED; a GATED PyPI API-token fallback is
     # allowed so a release does not hard-block on trusted-publisher registration (which is a one-time
     # PyPI UI step). The token/password credential is confined to the token-gated publish step