codna 0.2.37__tar.gz → 0.2.39__tar.gz

{codna-0.2.37 → codna-0.2.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.37
+Version: 0.2.39
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.37 → codna-0.2.39}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.37"
+__version__ = "0.2.39"

{codna-0.2.37 → codna-0.2.39}/codna/webhook.py

@@ -62,7 +62,7 @@ def verify_signature(secret: str, body: bytes, signature_header: str | None) ->
 class WebhookJob:
     """A Codna job derived from a verified GitHub event."""
 
-    kind: str  # "fix" | "secure" | "review"
+    kind: str  # "fix" | "secure" | "review" | "queue" (a merge-queue group inheriting the PR's review)
     repo_full_name: str
     ref: str | None = None
     installation_id: int | None = None
@@ -100,6 +100,22 @@ def check_run_name(kind: str) -> str:
 _OWN_APP_SLUG = "codna-ai"
 
 
+# refs/heads/gh-readonly-queue/<base>/pr-<N>-<base sha> -- the only place a merge group names its PR.
+# Parsed by prefix + last path segment, not by a search over the whole ref: an unanchored regex with a
+# lazy `.+?` over attacker-shaped input is polynomial (CodeQL py/polynomial-redos on the first cut).
+_MERGE_GROUP_PREFIX = "refs/heads/gh-readonly-queue/"
+_MERGE_GROUP_TAIL = re.compile(r"pr-(\d+)-[0-9a-f]{40}")
+
+
+def merge_group_pr_number(head_ref: str) -> int | None:
+    """The pull request number a merge-group ref was built for, or None."""
+    if not head_ref.startswith(_MERGE_GROUP_PREFIX):
+        return None
+    tail = head_ref.rsplit("/", 1)[-1]  # "pr-<N>-<40 hex>"; the base branch may itself contain "/"
+    m = _MERGE_GROUP_TAIL.fullmatch(tail)
+    return int(m.group(1)) if m else None
+
+
 def _is_own_check_suite(suite: Mapping[str, Any]) -> bool:
     """True when a check_suite belongs to this App itself (its review / fix Check Runs)."""
     app = suite.get("app") or {}
@@ -326,6 +342,21 @@ def classify_event(event: str, payload: Mapping[str, Any]) -> WebhookJob | None:
         return WebhookJob("secure", repo, ref=_safe_ref(payload.get("ref")),
                           installation_id=installation, reason="code_scanning_alert")
 
+    if event == "merge_group" and action == "checks_requested":
+        # A merge queue builds a temporary group commit and asks every REQUIRED check to report on
+        # it. "codna review" is required on repos that use one (algenta-sdk), and a check that only
+        # reacts to pull_request events would never appear there -- the queue would time out and
+        # kick the PR. The group is not re-reviewed: the PR head IS what was reviewed (GitHub only
+        # admits a PR to the queue once its required checks passed), so the worker copies that
+        # verdict onto the group commit. Requires the App to be subscribed to "Merge group" events.
+        group = payload.get("merge_group") or {}
+        head_sha = _safe_ref(group.get("head_sha"))
+        number = merge_group_pr_number(str(group.get("head_ref") or ""))
+        if not head_sha or number is None:
+            return None
+        return WebhookJob("queue", repo, ref=head_sha, pr_number=number,
+                          installation_id=installation, reason="merge_group_checks_requested")
+
     if event == "check_suite" and action == "completed":
         suite = payload.get("check_suite") or {}
         conclusion = str(suite.get("conclusion") or "")
@@ -676,6 +707,14 @@ class _Handler(BaseHTTPRequestHandler):
             pool_diag = pool.diagnostics() if pool is not None else None
             worker_ready = True if pool_diag is None else bool(pool_diag.get("ready"))
             ready = secret_ready and app_ready and worker_ready
+            queue = getattr(self.server, "queue", None)
+            try:
+                # Depth by status ({"queued": n, "running": n, "retry": n, ...}): 17 pull requests opened
+                # within a minute on 2026-09-19 sat behind a 2-thread pool for ~15 minutes and nothing
+                # public said why the checks were missing. Counts only -- no job content.
+                queue_counts = queue.counts() if queue is not None else None
+            except Exception:  # noqa: BLE001 -- readiness must never fail because a diagnostic did
+                queue_counts = None
             self._reply(200 if ready else 503, {
                 "service": "codna-webhook",
                 "ok": ready,
@@ -684,6 +723,7 @@ class _Handler(BaseHTTPRequestHandler):
                 "worker": None if pool_diag is None else {
                     k: pool_diag.get(k) for k in ("alive_threads", "busy_threads", "longest_running_s", "wedged")
                 },
+                "queue": queue_counts,
             })
             return
         if path == "/debug/queue":

{codna-0.2.37 → codna-0.2.39}/codna/webhook_github.py

@@ -41,6 +41,9 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
     if kind == "review":
         # Read code, write PR review comments + a check. No contents:write — review never pushes.
         return {"contents": "read", "pull_requests": "write", "checks": "write"}
+    if kind == "queue":
+        # Read the PR head + its check runs, write ONE check on the merge-group commit.
+        return {"pull_requests": "read", "checks": "write"}
     raise WebhookError("unknown_job_kind", f"no token scope for job kind {kind!r}")
 
 
@@ -497,3 +500,56 @@ def fetch_code_scanning_sarif(repo_full_name: str, token: str, *, dest_dir: str)
     with open(path, "w", encoding="utf-8") as handle:
         handle.write(sarif.text)
     return path
+
+
+def pull_request_head_sha(repo_full_name: str, token: str, number: int) -> str | None:
+    """The current head SHA of a pull request, or None when it cannot be read."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    try:
+        resp = httpx.get(f"{_API}/repos/{repo_full_name}/pulls/{number}", headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+                         timeout=20.0, follow_redirects=True)
+    except Exception:  # noqa: BLE001
+        return None
+    if resp.status_code != 200:
+        return None
+    try:
+        return str(resp.json()["head"]["sha"])
+    except (ValueError, KeyError, TypeError):
+        return None
+
+
+# Check-run conclusions that are statements about the code (what a merge group may inherit).
+_VERDICT_CONCLUSIONS = frozenset({"success", "neutral", "failure", "action_required"})
+
+
+def latest_completed_check_run(repo_full_name: str, token: str, *, head_sha: str, name: str) -> dict | None:
+    """The newest COMPLETED check run named ``name`` on ``head_sha`` (``conclusion``, ``summary``,
+    ``html_url``), or None. Only this App's own runs are considered."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    try:
+        resp = httpx.get(f"{_API}/repos/{repo_full_name}/commits/{head_sha}/check-runs",
+                         headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}, params={"check_name": name, "status": "completed", "per_page": 20},
+                         timeout=20.0, follow_redirects=True)
+    except Exception:  # noqa: BLE001
+        return None
+    if resp.status_code != 200:
+        return None
+    try:
+        runs = [r for r in resp.json().get("check_runs", []) if isinstance(r, dict)]
+    except ValueError:
+        return None
+    runs.sort(key=lambda r: str(r.get("completed_at") or ""), reverse=True)
+    for run in runs:
+        # Only a VERDICT may be inherited by a merge group. `cancelled` (a retry superseded this run),
+        # `stale`, `timed_out` and `skipped` say nothing about the code; propagating one would block
+        # a queue on a superseded run or, for `skipped`, wave an unreviewed PR through.
+        if str(run.get("conclusion") or "") in _VERDICT_CONCLUSIONS:
+            return {"conclusion": str(run["conclusion"]), "summary": str((run.get("output") or {}).get("summary") or ""),
+                    "html_url": str(run.get("html_url") or "")}
+    return None

{codna-0.2.37 → codna-0.2.39}/codna/webhook_worker.py

@@ -137,7 +137,7 @@ def _prepare_comment_fix(job: WebhookJob, *, token: str, app_id: str | None, git
         return "`@codna fix` only works as a reply to a codna review finding."
     finding = parse_codna_finding(parent.get("body") or "")
     if not finding:
-        return "Couldn't identify a Codna finding on this thread — reply `@codna fix` on a Codna review comment."
+        return "Couldn't identify a codna review finding on this thread — reply `@codna fix` on a codna review comment."
     if not ctx.get("head_ref"):
         return "Couldn't determine the pull-request branch to target for the fix."
     ctx.update({
@@ -372,6 +372,33 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                          check_completed=completed)
 
 
+def _inherit_review_for_merge_group(job: WebhookJob, token: str | None, github: Any) -> JobResult:
+    """Post the PR head's completed ``codna review`` verdict as the merge group's own check.
+
+    Fails CLOSED: when the PR head carries no completed review (a rename window, a repo where the
+    check was never required), the group check is a ``failure`` that says how to get one -- a
+    ``neutral`` would let an unreviewed PR through a queue that requires the review."""
+    name = check_run_name("review")
+    if not (token and job.ref and job.pr_number):
+        return JobResult(False, f"{name} (merge group): missing token, group sha or PR number", retryable=False)
+    head = github.pull_request_head_sha(job.repo_full_name, token, job.pr_number)
+    prior = github.latest_completed_check_run(job.repo_full_name, token, head_sha=head, name=name) if head else None
+    cid = github.create_check_run(job.repo_full_name, token, name=name, head_sha=job.ref,
+                                  summary=f"{name}: inheriting the verdict of PR #{job.pr_number}")
+    if prior is None:
+        text = (f"{name}: no completed review found on PR #{job.pr_number}'s head"
+                f"{' ' + head[:8] if head else ''}. Comment `@codna review` on the PR, then re-queue it.")
+        if cid:
+            github.update_check_run(job.repo_full_name, token, cid, conclusion="failure", summary=text, name=name)
+        return JobResult(False, text, retryable=False)
+    first_line = (prior.get("summary") or "").split("\n", 1)[0][:300]
+    text = (f"{name}: inherited from PR #{job.pr_number} at {head[:8]} ({prior['conclusion']}). "
+            f"Merge groups are not re-reviewed; the queued PR head is what was reviewed. {first_line}").strip()
+    if cid:
+        github.update_check_run(job.repo_full_name, token, cid, conclusion=prior["conclusion"], summary=text, name=name)
+    return JobResult(True, text)
+
+
 def process_job(
     qjob: QueuedJob,
     *,
@@ -393,6 +420,11 @@ def process_job(
             app_id, private_key, job.installation_id, repo_full_name=job.repo_full_name, kind=job.kind
         )
 
+    if job.kind == "queue":
+        # Merge-queue group: copy the PR head's `codna review` verdict onto the group commit. No
+        # metering, no CLI, no review of the group itself -- see classify_event's merge_group branch.
+        return _inherit_review_for_merge_group(job, token, github)
+
     # A `@codna fix` review-comment reply is answered IN-THREAD on every outcome (never silent).
     ctx = job.context or {}
     reply_to = ctx.get("in_reply_to_id") if (job.kind == "fix" and isinstance(ctx.get("in_reply_to_id"), int)) else None

{codna-0.2.37 → codna-0.2.39}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.37
+Version: 0.2.39
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.37 → codna-0.2.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.37"
+version = "0.2.39"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.37 → codna-0.2.39}/tests/test_webhook.py

@@ -532,6 +532,32 @@ def test_ready_endpoint_requires_webhook_secret_and_app_auth(monkeypatch):
         httpd.server_close()
 
 
+def test_ready_reports_queue_depth_by_status(tmp_path, monkeypatch):
+    """17 PRs opened within a minute sat behind the 2-thread pool for ~15 min on 2026-09-19 and
+    nothing public said why their checks were missing: /ready now carries the queue depth."""
+    import json as _json
+    import urllib.request
+
+    from codna.webhook_queue import WebhookQueue
+
+    monkeypatch.setenv("CODNA_GITHUB_WEBHOOK_SECRET", "s3cr3t")
+    monkeypatch.setenv("GITHUB_TOKEN", "single-repo-token")
+    queue = WebhookQueue(tmp_path / "q.db")
+    for i in range(3):
+        queue.enqueue(WebhookJob("review", "acme/app", ref=f"sha{i}", installation_id=7, pr_number=i, reason="test"),
+                      delivery_id=f"d{i}")
+    assert queue.claim() is not None                      # one running, two still queued
+    httpd, port = _serve_with_queue(queue)
+    try:
+        with urllib.request.urlopen(f"http://127.0.0.1:{port}/ready", timeout=5) as resp:
+            ready = _json.loads(resp.read())
+        assert ready["queue"] == {"queued": 2, "running": 1}   # counts only, never job content
+        assert "recent" not in ready and "jobs" not in ready
+    finally:
+        httpd.shutdown()
+        httpd.server_close()
+
+
 def test_debug_queue_requires_token_and_redacts_recent_results(tmp_path, monkeypatch):
     import json as _json
     import urllib.error
@@ -924,3 +950,43 @@ def test_prepare_scratch_root_without_tmpdir_changes_nothing(monkeypatch):
     monkeypatch.setattr(tempfile, "tempdir", None)
     assert prepare_scratch_root() is None
     assert tempfile.tempdir is None
+
+
+
+# ---- merge queues: the group commit inherits the PR head's review --------------------------------
+
+def _merge_group_payload(action="checks_requested", pr=48, base="main"):
+    return {
+        "action": action,
+        "repository": {"full_name": "acme/app"},
+        "installation": {"id": 42},
+        "merge_group": {
+            "head_sha": "feedfacefeedfacefeedfacefeedfacefeedface",
+            "head_ref": f"refs/heads/gh-readonly-queue/{base}/pr-{pr}-0123456789abcdef0123456789abcdef01234567",
+            "base_ref": f"refs/heads/{base}",
+        },
+    }
+
+
+def test_merge_group_pr_number_parses_the_queue_ref():
+    from codna.webhook import merge_group_pr_number
+
+    assert merge_group_pr_number("refs/heads/gh-readonly-queue/main/pr-48-0123456789abcdef0123456789abcdef01234567") == 48
+    assert merge_group_pr_number("refs/heads/gh-readonly-queue/release/1.x/pr-7-0123456789abcdef0123456789abcdef01234567") == 7
+    assert merge_group_pr_number("refs/heads/feature/pr-48-not-a-queue") is None
+    assert merge_group_pr_number("") is None
+
+
+def test_classify_merge_group_checks_requested_is_a_queue_job():
+    job = classify_event("merge_group", _merge_group_payload())
+    assert job is not None and job.kind == "queue"
+    assert job.repo_full_name == "acme/app" and job.pr_number == 48
+    assert job.ref == "feedfacefeedfacefeedfacefeedfacefeedface"
+    assert job.reason == "merge_group_checks_requested"
+
+
+def test_classify_merge_group_destroyed_or_unparseable_is_ignored():
+    assert classify_event("merge_group", _merge_group_payload(action="destroyed")) is None
+    p = _merge_group_payload()
+    p["merge_group"]["head_ref"] = "refs/heads/something-else"
+    assert classify_event("merge_group", p) is None

{codna-0.2.37 → codna-0.2.39}/tests/test_webhook_github.py

@@ -336,3 +336,32 @@ def test_app_bot_identity_is_resolved_from_the_app_slug_and_bot_user_id(monkeypa
     assert webhook_github.app_bot_identity("1", "pem") == ("codna-ai[bot]", "293953567+codna-ai[bot]@users.noreply.github.com")
     assert len(hits) == 2  # memoized after the first resolution
     assert webhook_github.app_bot_identity(None, None) is None
+
+
+
+def test_latest_completed_check_run_skips_non_verdict_conclusions(monkeypatch):
+    """A merge group must inherit a VERDICT: a newer cancelled/stale/skipped run (a superseded retry,
+    a stale head) says nothing about the code and must not block -- or wave through -- the queue."""
+    from codna.webhook_github import latest_completed_check_run
+
+    class _Resp:
+        status_code = 200
+
+        def json(self):
+            return {"check_runs": [
+                {"conclusion": "cancelled", "completed_at": "2026-09-19T03:00:00Z", "output": {"summary": "superseded"}, "html_url": "c"},
+                {"conclusion": "skipped", "completed_at": "2026-09-19T02:59:00Z", "output": {"summary": "skip"}, "html_url": "s"},
+                {"conclusion": "neutral", "completed_at": "2026-09-19T02:50:00Z", "output": {"summary": "**codna review** — 1 finding"}, "html_url": "n"},
+                {"conclusion": "success", "completed_at": "2026-09-19T02:40:00Z", "output": {"summary": "older"}, "html_url": "o"},
+            ]}
+
+    monkeypatch.setattr("httpx.get", lambda *a, **k: _Resp())
+    run = latest_completed_check_run("acme/app", "t", head_sha="h" * 40, name="codna review")
+    assert run == {"conclusion": "neutral", "summary": "**codna review** — 1 finding", "html_url": "n"}
+
+    class _NoVerdict(_Resp):
+        def json(self):
+            return {"check_runs": [{"conclusion": "stale", "completed_at": "2026-09-19T03:00:00Z", "output": {}, "html_url": ""}]}
+
+    monkeypatch.setattr("httpx.get", lambda *a, **k: _NoVerdict())
+    assert latest_completed_check_run("acme/app", "t", head_sha="h" * 40, name="codna review") is None

{codna-0.2.37 → codna-0.2.39}/tests/test_webhook_worker.py

@@ -1623,3 +1623,63 @@ def test_run_codna_job_keeps_check_completed_when_the_review_summary_is_unparsab
     job = WebhookJob("review", "acme/app", ref="sha1", installation_id=42, pr_number=7, reason="test")
     res = worker_module.run_codna_job(job, token="t", engine_key="k", check_run_id=9001)
     assert res.ok and res.check_completed is True
+
+
+
+# ---- merge queue: the group commit inherits the PR head's review -------------------------------
+class _QueueGitHub(_FakeGitHub):
+    def __init__(self, head="a" * 40, prior=None):
+        super().__init__()
+        self._head, self._prior, self.summaries = head, prior, []
+
+    def pull_request_head_sha(self, repo, token, number):
+        self.calls.append(("pr_head", number))
+        return self._head
+
+    def latest_completed_check_run(self, repo, token, *, head_sha, name):
+        self.calls.append(("latest_run", head_sha, name))
+        return self._prior
+
+    def create_check_run(self, repo, token, *, name, head_sha, summary):
+        self.calls.append(("create_check", name, head_sha))
+        return 4242
+
+    def update_check_run(self, repo, token, check_run_id, *, conclusion, summary, name="codna"):
+        self.calls.append(("update_check", conclusion))
+        self.summaries.append(summary)
+
+
+def _queue_job(attempts=1):
+    return QueuedJob(row_id=9, delivery_id="d9", attempts=attempts,
+                     job=WebhookJob("queue", "acme/app", ref="f" * 40, installation_id=42, pr_number=48,
+                                    reason="merge_group_checks_requested"))
+
+
+def test_queue_job_copies_the_pr_heads_review_verdict_onto_the_group_commit():
+    """algenta-sdk gates main with a merge queue: the required `codna review` must appear on the
+    queue's group commit or the queue times out and kicks the PR."""
+    gh = _QueueGitHub(prior={"conclusion": "neutral", "summary": "**codna review** — 2 finding(s)\nmore", "html_url": "u"})
+    ran = []
+    result = process_job(_queue_job(), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: ran.append(1) or JobResult(True, "ran"),
+                         resolve_engine_key=lambda iid: (_ for _ in ()).throw(AssertionError("no metering for queue jobs")))
+    assert result.ok and ran == []                                        # no CLI, no metering, no spend
+    assert ("token", 42, "queue") in gh.calls                             # least-privilege scope for the kind
+    assert ("create_check", "codna review", "f" * 40) in gh.calls         # on the GROUP commit
+    assert ("update_check", "neutral") in gh.calls                        # the PR head's verdict, verbatim
+    assert "inherited from PR #48" in gh.summaries[-1] and "2 finding(s)" in gh.summaries[-1]
+
+
+def test_queue_job_fails_closed_when_the_pr_head_has_no_completed_review():
+    gh = _QueueGitHub(prior=None)
+    result = process_job(_queue_job(), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: JobResult(True, "ran"), resolve_engine_key=lambda iid: "unused")
+    assert not result.ok and not result.retryable
+    assert ("update_check", "failure") in gh.calls                        # never a pass-through neutral
+    assert "@codna review" in gh.summaries[-1]
+
+
+def test_queue_token_scope_is_read_pr_write_checks_only():
+    from codna.webhook_github import token_permissions_for
+
+    assert token_permissions_for("queue") == {"pull_requests": "read", "checks": "write"}