codna 0.2.25__tar.gz → 0.2.26__tar.gz

{codna-0.2.25 → codna-0.2.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.25
+Version: 0.2.26
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.25 → codna-0.2.26}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.25"
+__version__ = "0.2.26"

{codna-0.2.25 → codna-0.2.26}/codna/webhook_github.py

@@ -261,6 +261,67 @@ def find_open_pr_by_marker(repo_full_name: str, token: str, marker: str, *, max_
     return None
 
 
+def installation_has_workflows(installation_id: int | str | None) -> bool | None:
+    """What the last fix-token mint learned about the `workflows` permission on this installation:
+    True / False, or None when no fix token has been minted in this process yet."""
+    return _WORKFLOWS_GRANTED.get(str(installation_id)) if installation_id is not None else None
+
+
+def _workflow_files(repo_full_name: str, token: str, ref: str) -> set[tuple[str, str]] | None:
+    """(path, blob sha) of every file under .github/workflows at *ref*; empty set when the directory
+    does not exist; None on any other failure."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    try:
+        resp = httpx.get(
+            f"{_API}/repos/{repo_full_name}/contents/.github/workflows",
+            params={"ref": ref},
+            headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+            timeout=30.0, follow_redirects=True,
+        )
+    except Exception:  # noqa: BLE001
+        return None
+    if resp.status_code == 404:
+        return set()
+    if resp.status_code >= 300:
+        return None
+    try:
+        entries = resp.json()
+    except Exception:  # noqa: BLE001
+        return None
+    if not isinstance(entries, list):
+        return None
+    return {(str(e.get("path")), str(e.get("sha"))) for e in entries if isinstance(e, dict) and e.get("type") == "file"}
+
+
+def workflows_differ_from_default(repo_full_name: str, token: str, head_sha: str) -> bool | None:
+    """True when the branch at *head_sha* carries different .github/workflows files than the default
+    branch -- the condition under which GitHub refuses ANY push by an App without the `workflows`
+    permission, even one that touches no workflow. None when it cannot be determined."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    try:
+        repo = httpx.get(
+            f"{_API}/repos/{repo_full_name}",
+            headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+            timeout=30.0, follow_redirects=True,
+        )
+        default_branch = (repo.json() or {}).get("default_branch") if repo.status_code < 300 else None
+    except Exception:  # noqa: BLE001
+        default_branch = None
+    if not default_branch:
+        return None
+    at_head = _workflow_files(repo_full_name, token, head_sha)
+    at_default = _workflow_files(repo_full_name, token, default_branch)
+    if at_head is None or at_default is None:
+        return None
+    return at_head != at_default
+
+
 def collaborator_permission(repo_full_name: str, token: str, username: str) -> str | None:
     """The repository permission GitHub grants *username*: admin | maintain | write | triage | read |
     none. None on any failure (the caller decides how to degrade). This is the authoritative answer

{codna-0.2.25 → codna-0.2.26}/codna/webhook_worker.py

@@ -313,6 +313,26 @@ def _terse_cli_failure(summary: str) -> str:
 
 _WRITE_PERMISSIONS = frozenset({"admin", "maintain", "write"})
 
+_WORKFLOWS_REMEDY = (
+    "⚠️ Codna can't push a fix to this branch yet: its `.github/workflows` files differ from the default "
+    "branch, and GitHub only lets an App push such a branch when the App has the **Workflows** permission. "
+    "An admin can grant it once — GitHub App settings → Permissions & events → Repository permissions → "
+    "Workflows: Read and write → save, then accept the new permission on the installation — or update this "
+    "branch from the default branch. Then reply `@codna fix` again; nothing was spent."
+)
+
+
+def _workflows_permission_preflight(job: WebhookJob, token: str, github: Any) -> str | None:
+    """The remedy text when the push is known to be refused, else None (proceed)."""
+    has = getattr(github, "installation_has_workflows", None)
+    granted = has(job.installation_id) if callable(has) else None
+    if granted is not False:
+        return None  # granted, or unknown (no fix token minted yet in this process) -> let it run
+    differs = getattr(github, "workflows_differ_from_default", None)
+    if not callable(differs) or not differs(job.repo_full_name, token, job.ref):
+        return None
+    return _WORKFLOWS_REMEDY
+
 
 def _comment_fix_authorized(job: WebhookJob, token: str, github: Any) -> str | None:
     """None when the commenter may request a fix; otherwise a short reason for the job summary."""
@@ -687,6 +707,17 @@ def process_job(
                                                  "⚠️ `@codna fix` is limited to people with write access to this repository.")
             return JobResult(True, verdict, retryable=False)
 
+    # Pre-flight the one GitHub rule that fails AFTER all the work is done: without the `workflows`
+    # permission the App cannot push to a branch whose .github/workflows differ from the default
+    # branch. Say so now, with the remedy, instead of analyzing, patching and then being refused.
+    if reply_to and token and job.ref:
+        blocked = _workflows_permission_preflight(job, token, github)
+        if blocked is not None:
+            if qjob.attempts <= 1:
+                github.post_review_comment_reply(job.repo_full_name, token, job.pr_number, reply_to, blocked)
+            return JobResult(True, "skipped: workflows permission missing for a branch whose workflows differ from the default branch",
+                             retryable=False)
+
     # Idempotency: reuse a PR a prior attempt already opened. Checked BEFORE the ack so a redelivery
     # doesn't post a spurious "analyzing…" then "already opened". For a comment-fix only an OPEN PR
     # counts as a live duplicate — a closed prior fix PR must not block re-requesting a fresh one.

{codna-0.2.25 → codna-0.2.26}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.25
+Version: 0.2.26
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.25 → codna-0.2.26}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.25"
+version = "0.2.26"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.25 → codna-0.2.26}/tests/test_webhook_github.py

@@ -285,3 +285,31 @@ def test_review_tokens_never_ask_for_workflows(monkeypatch):
     sent = _fake_post(monkeypatch, [_Resp(201, {"token": "r"})])
     webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review")
     assert "workflows" not in sent[0]["permissions"] and "contents" in sent[0]["permissions"]
+
+
+
+def test_workflows_differ_compares_path_and_blob_sha_sets(monkeypatch):
+    import httpx
+
+    files = {
+        "main": [{"type": "file", "path": ".github/workflows/security.yml", "sha": "aaa"}],
+        "abc": [{"type": "file", "path": ".github/workflows/security.yml", "sha": "bbb"}],
+        "same": [{"type": "file", "path": ".github/workflows/security.yml", "sha": "aaa"}],
+    }
+
+    def get(url, *, headers, timeout, follow_redirects, params=None):
+        if url.endswith("/repos/acme/app"):
+            return _Resp(200, {"default_branch": "main"})
+        ref = (params or {}).get("ref")
+        if ref == "none":
+            return _Resp(404, {})
+        return _Resp(200, files[ref])
+
+    monkeypatch.setattr(httpx, "get", get)
+    assert webhook_github.workflows_differ_from_default("acme/app", "t", "abc") is True
+    assert webhook_github.workflows_differ_from_default("acme/app", "t", "same") is False
+    assert webhook_github.workflows_differ_from_default("acme/app", "t", "none") is True  # no dir vs one file
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    assert webhook_github.installation_has_workflows(42) is None
+    webhook_github._WORKFLOWS_GRANTED["42"] = False
+    assert webhook_github.installation_has_workflows(42) is False

{codna-0.2.25 → codna-0.2.26}/tests/test_webhook_worker.py

@@ -1412,3 +1412,40 @@ def test_permission_lookup_failure_falls_back_to_the_payload_association():
                           private_key="p", github=_PermissionGitHub(None, parent_body=_codna_finding_comment_body()),
                           runner=lambda job, **kw: JobResult(True, "opened"), resolve_engine_key=lambda iid: "org-key")
     assert allowed.ok and allowed.summary == "opened"
+
+
+
+# --- pre-flight: missing `workflows` permission + stale workflow files -> remedy, no spend ------
+class _WorkflowsGitHub(_PermissionGitHub):
+    def __init__(self, *, granted, differs, **kw):
+        super().__init__("admin", **kw)
+        self._granted, self._differs, self.differ_lookups = granted, differs, []
+
+    def installation_has_workflows(self, installation_id):
+        return self._granted
+
+    def workflows_differ_from_default(self, repo, token, head_sha):
+        self.differ_lookups.append(head_sha)
+        return self._differs
+
+
+def test_fix_on_stale_branch_without_workflows_permission_replies_with_the_remedy_and_spends_nothing():
+    gh = _WorkflowsGitHub(granted=False, differs=True, parent_body=_codna_finding_comment_body())
+    ran = []
+    result = process_job(_contributor_qjob(), app_id="APP", private_key="p", github=gh,
+                         runner=lambda job, **kw: ran.append(1) or JobResult(True, "opened"),
+                         resolve_engine_key=lambda iid: "org-key")
+    assert result.ok and result.retryable is False and "workflows permission missing" in result.summary
+    assert not ran and gh.differ_lookups == ["sha1"]
+    bodies = [b for (_p, _r, b) in gh.replies]
+    assert len(bodies) == 1 and "Workflows: Read and write" in bodies[0] and "nothing was spent" in bodies[0]
+    assert not any(c[0] == "create_check" for c in gh.calls)
+
+
+def test_fix_proceeds_when_workflows_is_granted_or_the_branch_matches_default():
+    for granted, differs in ((True, True), (False, False), (None, True)):
+        gh = _WorkflowsGitHub(granted=granted, differs=differs, parent_body=_codna_finding_comment_body())
+        result = process_job(_contributor_qjob(), app_id="APP", private_key="p", github=gh,
+                             runner=lambda job, **kw: JobResult(True, "opened"),
+                             resolve_engine_key=lambda iid: "org-key")
+        assert result.ok and result.summary == "opened", (granted, differs)