codna 0.2.22__tar.gz → 0.2.23__tar.gz

{codna-0.2.22 → codna-0.2.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.22
+Version: 0.2.23
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.22 → codna-0.2.23}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.22"
+__version__ = "0.2.23"

{codna-0.2.22 → codna-0.2.23}/codna/packaged_git.py

@@ -94,11 +94,27 @@ def open_remote_pr(
         repo_root,
         ["-c", "user.email=codna@codna.ai", "-c", "user.name=codna", "commit", "-m", title],
     )
-    _run_git(
-        repo_root,
-        ["push", "origin", f"HEAD:refs/heads/{branch}"],
-        env=_git_auth_env(repository_url, token),
-    )
+    try:
+        _run_git(
+            repo_root,
+            ["push", "origin", f"HEAD:refs/heads/{branch}"],
+            env=_git_auth_env(repository_url, token),
+        )
+    except PackagedGitError as exc:
+        stderr = str((exc.details or {}).get("stderr", ""))
+        if "without `workflows` permission" in stderr:
+            # GitHub compares a NEW branch's .github/workflows against the default branch, so an
+            # App token without `workflows` cannot push a fix onto any PR branch that predates a
+            # workflow change on main -- even when the fix touches no workflow at all.
+            raise PackagedGitError(
+                "workflows_permission_required",
+                "GitHub refused the push: this branch's .github/workflows files differ from the default "
+                "branch and the Codna App does not have the `workflows` permission. Grant it in the App's "
+                "settings (Repository permissions -> Workflows: Read and write) and accept it on the "
+                "installation, or update the PR branch from the default branch, then re-run `@codna fix`.",
+                {"branch": branch, "stderr": stderr[-800:]},
+            ) from exc
+        raise
     pull_request_url = create_github_pull_request(
         repository_slug=slug,
         token=token,

{codna-0.2.22 → codna-0.2.23}/codna/webhook_github.py

@@ -15,14 +15,27 @@ from .webhook import WebhookError
 _API = "https://api.github.com"
 
 
-def token_permissions_for(kind: str) -> dict[str, str]:
+# installation id -> whether the App has the `workflows` permission there. Learned from GitHub's
+# answer to the first fix-token request per process (422 when it is not granted), so the extra
+# round-trip happens once, not per job.
+_WORKFLOWS_GRANTED: dict[str, bool] = {}
+
+
+def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, str]:
     """Least-privilege installation-token permissions for a job kind.
 
     fix needs to push a branch + open a PR; secure only reads code + code-scanning results.
-    Both may post a Check Run for status.
+    Both may post a Check Run for status. ``workflows=True`` adds `workflows: write` to a fix
+    token: GitHub refuses ANY push from an App without it when the new branch's
+    .github/workflows files differ from the default branch -- which is every PR branch that
+    predates a workflow change on main (thyn-ai/algenta#1003, 2026-09-17), even though the fix
+    commit itself never touches a workflow.
     """
     if kind == "fix":
-        return {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
+        perms = {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
+        if workflows:
+            perms["workflows"] = "write"
+        return perms
     if kind == "secure":
         return {"contents": "read", "security_events": "read", "checks": "write", "issues": "write"}
     if kind == "review":
@@ -31,10 +44,10 @@ def token_permissions_for(kind: str) -> dict[str, str]:
     raise WebhookError("unknown_job_kind", f"no token scope for job kind {kind!r}")
 
 
-def scoped_token_request(repo_full_name: str, kind: str) -> dict[str, Any]:
+def scoped_token_request(repo_full_name: str, kind: str, *, workflows: bool = False) -> dict[str, Any]:
     """Body for POST /app/installations/{id}/access_tokens — scoped to the one repo + minimal perms."""
     repo_name = repo_full_name.split("/", 1)[-1]
-    return {"repositories": [repo_name], "permissions": token_permissions_for(kind)}
+    return {"repositories": [repo_name], "permissions": token_permissions_for(kind, workflows=workflows)}
 
 
 def normalize_private_key_pem(private_key_pem: str) -> str:
@@ -99,12 +112,22 @@ def installation_token(
     except Exception as exc:  # noqa: BLE001
         raise WebhookError("github_app_auth_unavailable", f"cannot sign App JWT: {exc}") from exc
 
-    resp = httpx.post(
-        f"{_API}/app/installations/{installation_id}/access_tokens",
-        headers={"Authorization": f"Bearer {jwt}", "Accept": "application/vnd.github+json"},
-        json=scoped_token_request(repo_full_name, kind),
-        timeout=30.0, follow_redirects=True,
-    )
+    def _mint(with_workflows: bool):
+        return httpx.post(
+            f"{_API}/app/installations/{installation_id}/access_tokens",
+            headers={"Authorization": f"Bearer {jwt}", "Accept": "application/vnd.github+json"},
+            json=scoped_token_request(repo_full_name, kind, workflows=with_workflows),
+            timeout=30.0, follow_redirects=True,
+        )
+
+    want_workflows = kind == "fix" and _WORKFLOWS_GRANTED.get(str(installation_id), True)
+    resp = _mint(want_workflows)
+    if want_workflows and resp.status_code == 422 and "permission" in resp.text.lower():
+        # The App has not been granted `workflows` on this installation: remember, mint without it.
+        _WORKFLOWS_GRANTED[str(installation_id)] = False
+        resp = _mint(False)
+    elif want_workflows and resp.status_code < 300:
+        _WORKFLOWS_GRANTED[str(installation_id)] = True
     if resp.status_code >= 300:
         raise WebhookError("installation_token_failed", f"installation token: {resp.status_code} {resp.text[:200]}")
     token = resp.json().get("token")

{codna-0.2.22 → codna-0.2.23}/codna/webhook_worker.py

@@ -303,8 +303,9 @@ def _terse_cli_failure(summary: str) -> str:
         lines = [ln.strip() for ln in stderr.splitlines() if ln.strip()]
         # the reason is usually the LAST informative line ("! [remote rejected] ... (why)"), not
         # the "To https://..." banner git prints first
-        informative = [ln for ln in lines if re.search(r"rejected|error|fatal|denied|GH0\d\d|refusing", ln, re.I)]
-        pick = (informative or lines)[-1] if (informative or lines) else ""
+        strong = [ln for ln in lines if re.search(r"rejected|refusing|denied|GH0\d\d", ln, re.I)]
+        weak = [ln for ln in lines if re.search(r"error|fatal", ln, re.I)]
+        pick = (strong or weak or lines)[-1] if lines else ""
         if pick:
             hint = f" (git: {pick[:200]})"
     return f"{rest.strip().rstrip('.')}{hint} [{code}]"

{codna-0.2.22 → codna-0.2.23}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.22
+Version: 0.2.23
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.22 → codna-0.2.23}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.22"
+version = "0.2.23"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.22 → codna-0.2.23}/tests/test_packaged_git_clone.py

@@ -43,3 +43,30 @@ def test_existing_checkout_refreshes_shallowly(monkeypatch, tmp_path):
     fetch = next(c for c in calls if c["args"][0] == "fetch" and "--prune" in c["args"])
     assert "--depth=1" in fetch["args"] and fetch["timeout"] == packaged_git.GIT_CLONE_TIMEOUT_SECONDS
     assert not any(c["args"][0] == "clone" for c in calls)
+
+
+
+def test_push_refused_for_missing_workflows_permission_is_reported_actionably(monkeypatch, tmp_path):
+    from codna import packaged_git as pg
+
+    def fake_run_git(cwd, args, *, env=None, check=True, timeout=None):
+        if args[0] == "push":
+            raise pg.PackagedGitError("git_command_failed", "Git command failed while preparing packaged repository access.",
+                                      {"args": args, "stderr": "To https://github.com/acme/app.git\n ! [remote rejected] HEAD -> codna/abc "
+                                       "(refusing to allow a GitHub App to create or update workflow `.github/workflows/security.yml` "
+                                       "without `workflows` permission)\nerror: failed to push some refs\n"})
+        return subprocess.CompletedProcess(["git", *args], 0, "", "")
+
+    monkeypatch.setattr(pg, "_run_git", fake_run_git)
+    monkeypatch.setattr(pg, "_require_git_repo", lambda repo_root: None)
+    monkeypatch.setattr(pg, "_reset_owned_checkout", lambda repo_root: None)
+    monkeypatch.setattr(pg, "_apply_patch_to_index", lambda repo_root, patch: None)
+    try:
+        pg.open_remote_pr(repo_root=tmp_path, repository_url="https://github.com/acme/app.git", repository_slug="acme/app",
+                          access_token="tok", plan_id="plan_abc123", patch_diff="--- a/x\n+++ b/x\n@@ -1 +1 @@\n-a\n+b\n",
+                          base_branch="main", title="t", body="b")
+    except pg.PackagedGitError as exc:
+        assert exc.code == "workflows_permission_required"
+        assert "`workflows` permission" in str(exc) and "update the PR branch" in str(exc)
+    else:
+        raise AssertionError("expected PackagedGitError")

{codna-0.2.22 → codna-0.2.23}/tests/test_webhook_github.py

@@ -228,3 +228,60 @@ def test_comment_authored_by_app_gate():
     # Fallback when the App id isn't configured: accept a Bot-type author only.
     assert comment_authored_by_app({"user": {"type": "Bot"}}, None) is True
     assert comment_authored_by_app({"user": {"type": "User"}}, None) is False
+
+
+
+# --- fix tokens ask for `workflows: write` when the App has it, and learn when it does not -----
+from codna import webhook_github  # noqa: E402
+
+class _Resp:
+    def __init__(self, status, payload=None, text=""):
+        self.status_code, self._payload, self.text = status, payload or {}, text
+
+    def json(self):
+        return self._payload
+
+
+def _fake_post(monkeypatch, responses):
+    import httpx
+
+    sent = []
+
+    def post(url, *, headers, json, timeout, follow_redirects):
+        sent.append(json)
+        return responses.pop(0)
+
+    monkeypatch.setattr(httpx, "post", post)
+    monkeypatch.setattr(webhook_github, "_app_jwt", lambda app_id, pem, *, now: "jwt")
+    monkeypatch.setattr(webhook_github, "normalize_private_key_pem", lambda pem: pem, raising=False)
+    return sent
+
+
+def test_fix_token_requests_workflows_and_remembers_it_is_granted(monkeypatch):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [_Resp(201, {"token": "t1"})])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="fix") == "t1"
+    assert sent[0]["permissions"]["workflows"] == "write"
+    assert webhook_github._WORKFLOWS_GRANTED["42"] is True
+
+
+def test_fix_token_falls_back_without_workflows_when_github_says_not_granted(monkeypatch):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [
+        _Resp(422, text='{"message":"The permissions requested are not granted to this installation."}'),
+        _Resp(201, {"token": "t2"}),
+    ])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="fix") == "t2"
+    assert "workflows" in sent[0]["permissions"] and "workflows" not in sent[1]["permissions"]
+    assert webhook_github._WORKFLOWS_GRANTED["42"] is False
+    # the next mint for that installation does not ask again
+    sent2 = _fake_post(monkeypatch, [_Resp(201, {"token": "t3"})])
+    webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="fix")
+    assert len(sent2) == 1 and "workflows" not in sent2[0]["permissions"]
+
+
+def test_review_tokens_never_ask_for_workflows(monkeypatch):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [_Resp(201, {"token": "r"})])
+    webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review")
+    assert "workflows" not in sent[0]["permissions"] and "contents" in sent[0]["permissions"]

{codna-0.2.22 → codna-0.2.23}/tests/test_webhook_worker.py

@@ -1349,3 +1349,15 @@ def test_terse_cli_failure_drops_paths_and_keeps_gits_reason():
     assert "/tmp/" not in t2
     assert worker_module._terse_cli_failure("codna fix failed (cli_error): no test runner") == "no test runner [cli_error]"
     assert worker_module._terse_cli_failure("plain text") == "plain text"
+
+
+
+def test_terse_cli_failure_prefers_the_rejection_line_over_gits_generic_error_line():
+    live = ('codna fix failed (cli_error): apply failed: Git command failed while preparing packaged repository access. '
+            '| code=git_command_failed | details={"args": ["push", "origin", "HEAD:refs/heads/codna/6e4b"], "cwd": "/tmp/x", '
+            '"stderr": "To https://github.com/thyn-ai/algenta.git\\n ! [remote rejected] HEAD -> codna/6e4b (refusing to allow a '
+            'GitHub App to create or update workflow `.github/workflows/security.yml` without `workflows` permission)\\nerror: '
+            'failed to push some refs to \'https://github.com/thyn-ai/algenta.git\'\\n"}  (patch ref: packaged-local-patch://p1)')
+    terse = worker_module._terse_cli_failure(live)
+    assert "refusing to allow a GitHub App" in terse and "failed to push some refs" not in terse
+    assert terse.endswith("[git_command_failed]") and "/tmp/" not in terse