codna 0.2.40__tar.gz → 0.2.42__tar.gz

{codna-0.2.40 → codna-0.2.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.40
+Version: 0.2.42
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.40 → codna-0.2.42}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.40"
+__version__ = "0.2.42"

{codna-0.2.40 → codna-0.2.42}/codna/webhook.py

@@ -392,9 +392,13 @@ def classify_event(event: str, payload: Mapping[str, Any]) -> WebhookJob | None:
             # `head_ref` travels in context so the command builder can target the PR's OWN branch:
             # a fix PR opened against the default branch would try to repair code that only exists
             # on this PR's branch.
-            ctx = {"head_ref": head_ref} if head_ref else None
+            ctx: dict[str, Any] = {"head_ref": head_ref} if head_ref else {}
+            if isinstance(suite.get("id"), int):
+                # The suite id lets the worker ask, before spending anything, whether this suite is
+                # still red and what its failed jobs actually died on (webhook_ci_triage).
+                ctx["check_suite_id"] = suite["id"]
             return WebhookJob("fix", repo, ref=head_sha, pr_number=number,
-                              installation_id=installation, context=ctx,
+                              installation_id=installation, context=ctx or None,
                               reason="check_suite_failure")
         # No associated pull request means this was a push to a branch — the repo-CI-health case
         # the docstring rejects. Ignored on purpose.
@@ -562,6 +566,10 @@ def codna_command(
                 # branch instead would try to repair code that does not exist there yet -- the
                 # failing change lives only on this PR's branch until it merges.
                 args += ["--base-branch", ctx["head_ref"]]
+            if ctx.get("ci_failure"):
+                # CI evidence gathered by webhook_ci_triage (the failing step and the log around its
+                # error): the agent fixes what CI saw, not only what its own sandboxed test run finds.
+                args += ["--issue", str(ctx["ci_failure"])]
         elif job.issue_number or issue_text or ctx.get("feedback_issue"):
             # Label-triggered (labeled_codna_fix, or a feedback-routed report -- both have no
             # commit/tests to run): `codna fix` requires one of --issue/--tests/--from-junit or it

codna-0.2.42/codna/webhook_ci_triage.py

@@ -0,0 +1,268 @@
+"""CI-failure triage for ``check_suite_failure`` fix jobs.
+
+A red check suite on a pull request enqueues a ``codna fix``. Before that job spends anything it
+asks three questions, in order, and stops at the first one with a settled answer:
+
+1. **Is the failure still current?** The PR head may have moved, or the suite may have been re-run
+   and passed. Then there is nothing to fix on this commit.
+2. **Is it a code defect at all?** A ``bun install`` that fails extracting a tarball, a registry
+   503, a runner that lost contact, a full disk -- none of these are fixed by editing the
+   repository. Left alone, the fix agent ran the repo's tests in its own sandbox, "found" whatever
+   failed there, and patched THAT (thyn-ai/algenta#1040, 2026-09-19: a test-only patch, refused
+   by the guard, one metered run later). Infrastructure failures end the job ``neutral`` and are
+   re-run once when the App may (``actions: write``).
+3. **Otherwise it is a code failure**: the failing step and the log around the error travel to
+   the agent as the issue text, so it fixes what CI saw and not what its sandbox saw.
+
+Reading job steps and logs needs ``actions: read`` on the installation, which installs made before
+2026-09-19 never granted. Without it the job proceeds exactly as before (verdict ``unknown``) and
+the check summary asks for the permission. Every network call here is opportunistic and
+failure-tolerant: triage can only ever SKIP work, never fail a job.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from typing import Any
+
+# Verdicts that end the job without running the agent.
+TERMINAL = frozenset({"green", "head_moved", "infrastructure"})
+
+PERMISSION_NOTE = (
+    "ℹ️ Codna could not read this CI job's steps and log. Grant the Codna GitHub App "
+    "**Actions: read** (App settings → Permissions & events, then accept on the installation) so it "
+    "can tell an infrastructure failure from a code defect and hand the agent the real CI error; "
+    "**Actions: write** also lets it re-run infrastructure failures itself."
+)
+
+# Steps whose job is to fetch the world rather than to exercise the code.
+_INFRA_STEP_RE = re.compile(
+    r"(?i)\b(install|setup|set[ -]up|cache|restore|checkout|check[ -]out|download|fetch|pull|login|"
+    r"log[ -]in|bootstrap|provision|prepare|toolchain|dependencies|deps)\b"
+)
+# What a network, registry or runner failure looks like in a step's log.
+_TRANSIENT_RE = re.compile(
+    r"(?i)("
+    r"fail(?:ed)? extracting tarball|tarball[^\n]*?(?:corrupt|integrity|checksum|extract)|"
+    r"integrity check(?:sum)? failed|unexpected end of (?:file|json input|archive)|unexpected eof|"
+    r"ECONNRESET|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|EPIPE|socket hang up|"
+    r"connection reset by peer|connection timed out|operation timed out|read timed out|"
+    r"tls handshake timeout|temporary failure in name resolution|could not resolve host|"
+    r"too many requests|rate limit(?:ed)?(?: exceeded)?|service unavailable|bad gateway|"
+    r"gateway time-?out|(?:status(?: code)?|HTTP(?:/[\d.]+)?|error)\s*:?\s*\(?(?:429|50[234])\b|"
+    r"unable to (?:download|resolve action)|failed to (?:download|fetch|createartifact|restore)|"
+    r"cache service responded with|error response from daemon[^\n]*?(?:pull|manifest|blob|timeout|eof|tls)|"
+    r"x509: certificate|no space left on device"
+    r")"
+)
+# Failures of the machine itself, whatever step they surface in.
+_RUNNER_LEVEL_RE = re.compile(
+    r"(?i)(the runner has received a shutdown signal|lost communication with the server|"
+    r"the hosted runner[^\n]*? encountered an error|no space left on device)"
+)
+# Evidence that the code, not the plumbing, failed -- vetoes the transient reading of an install step.
+_CODE_MARKER_RE = re.compile(
+    r"(?m)(?:^|\s)(?:FAILED |AssertionError|Traceback \(most recent call last\)|error TS\d{4}|"
+    r"SyntaxError:|TypeError:|ReferenceError:|\d+ (?:tests?|specs?) failed|Tests:\s+\d+ failed|"
+    r"FAIL:|--- FAIL|panic:|lockfile had changes|frozen-lockfile|lockfile needs to be updated|"
+    r"Cannot find module)"
+)
+_TS_RE = re.compile(r"^\d{4}-\d{2}-\d{2}T[\d:.]+Z ?")
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
+
+
+@dataclass
+class CITriage:
+    verdict: str  # "green" | "head_moved" | "infrastructure" | "code" | "unknown"
+    summary: str = ""  # Check Run markdown when the verdict is terminal
+    issue_text: str | None = None  # CI evidence for the agent when the verdict is "code"
+    note: str | None = None  # appended to the final check summary (a missing permission)
+    rerun: bool = False  # the failed jobs were re-run
+
+
+@dataclass
+class _Evidence:
+    run: dict
+    verdict: str
+    step: str | None = None
+    window: str | None = None
+    info: dict | None = field(default=None)
+
+
+def focus_log(text: str | None, *, before: int = 60, after: int = 0) -> str | None:
+    """The lines around the FIRST ``##[error]`` marker -- the failure that made the job fail;
+    later ``if: always()`` steps carry their own -- cleaned of timestamps and colour codes. The
+    last ``before`` lines when there is no marker."""
+    if not text:
+        return None
+    lines = [_ANSI_RE.sub("", _TS_RE.sub("", ln)).rstrip() for ln in text.splitlines()]
+    lines = [ln for ln in lines if ln and not ln.startswith(("##[group]", "##[endgroup]"))]
+    idx = next((i for i, ln in enumerate(lines) if ln.startswith("##[error]")), None)
+    window = lines[-before:] if idx is None else lines[max(0, idx - before): idx + 1 + after]
+    return "\n".join(ln[:400] for ln in window)[:8000] or None
+
+
+def failing_step(info: dict | None) -> str | None:
+    """Name of the first step that failed in an Actions job payload."""
+    for step in (info or {}).get("steps") or []:
+        if isinstance(step, dict) and step.get("conclusion") == "failure":
+            return str(step.get("name") or "") or None
+    return None
+
+
+def classify_job(step: str | None, log_window: str | None) -> str:
+    """``infrastructure`` / ``code`` / ``unknown`` for one failed Actions job.
+
+    Runner-level failures are infrastructure wherever they surface. An install/setup-style step
+    whose log shows a network, registry or archive failure -- and no test/compile failure -- is
+    infrastructure too (a lockfile drift in the same step is code). Without a log nothing is
+    decided.
+    """
+    text = log_window or ""
+    if _RUNNER_LEVEL_RE.search(text):
+        return "infrastructure"
+    if not text:
+        return "unknown"
+    if step and _INFRA_STEP_RE.search(step) and _TRANSIENT_RE.search(text) and not _CODE_MARKER_RE.search(text):
+        return "infrastructure"
+    return "code"
+
+
+def _signature(window: str | None) -> str:
+    """The first log line that carries the transient/runner signature, for the check summary."""
+    for line in (window or "").splitlines():
+        if _RUNNER_LEVEL_RE.search(line) or _TRANSIENT_RE.search(line):
+            return line.strip()[:160]
+    return ""
+
+
+def _actions_token(job: Any, token: str, github: Any, app_id: str | None,
+                   private_key: str | None) -> tuple[str | None, bool]:
+    """A token that can read Actions jobs and logs (and re-run them when ``writable``), or None
+    when the installation never granted ``actions``. Dev mode (no App auth) tries the ambient
+    token and lets the API answer."""
+    mint = getattr(github, "installation_token", None)
+    if not (job.installation_id and app_id and private_key and callable(mint)):
+        return token, bool(token)
+    for kind, writable in (("ci_rerun", True), ("ci_triage", False)):
+        try:
+            minted = mint(app_id, private_key, job.installation_id,
+                          repo_full_name=job.repo_full_name, kind=kind)
+        except Exception:  # noqa: BLE001 -- 422 "permission not granted" (or anything else): try smaller
+            continue
+        if minted:
+            return str(minted), writable
+    return None, False
+
+
+def _call(fn: Any, *args: Any, **kwargs: Any) -> Any:
+    if not callable(fn):
+        return None
+    try:
+        return fn(*args, **kwargs)
+    except Exception:  # noqa: BLE001 -- triage is opportunistic; a failed lookup is "no evidence"
+        return None
+
+
+def _infrastructure_summary(evidence: list[_Evidence], *, rerun_action: str) -> str:
+    lines = ["**codna fix** — not a code defect; nothing was spent.", ""]
+    for ev in evidence:
+        name = str(ev.run.get("name") or "CI job")
+        url = str(ev.run.get("html_url") or "")
+        label = f"[{name}]({url})" if url else f"`{name}`"
+        step = f" failed in step `{ev.step}`" if ev.step else " failed"
+        sig = _signature(ev.window)
+        lines.append(f"- {label}{step}" + (f": `{sig}`" if sig else "") + " — an infrastructure error.")
+    lines += ["", rerun_action]
+    return "\n".join(lines)
+
+
+def _code_issue_text(job: Any, evidence: list[_Evidence]) -> str:
+    parts = [
+        f"CI failed on this pull request's head commit {job.ref}. Fix the code so these jobs pass; "
+        "do not weaken, skip or delete tests.",
+        "",
+    ]
+    for ev in evidence:
+        if ev.verdict != "code":
+            continue
+        name = str(ev.run.get("name") or "CI job")
+        head = f"## {name}" + (f" — failing step: {ev.step}" if ev.step else "")
+        parts += [head, "```", ev.window or "(log unavailable)", "```", ""]
+    infra = [ev for ev in evidence if ev.verdict == "infrastructure"]
+    if infra:
+        parts.append("Ignore these jobs, they failed on infrastructure, not code: "
+                     + ", ".join(str(ev.run.get("name") or "?") for ev in infra))
+    return "\n".join(parts).strip()
+
+
+def triage(job: Any, token: str, github: Any, *, app_id: str | None = None,
+           private_key: str | None = None) -> CITriage:
+    """Decide what a ``check_suite_failure`` fix job should do. Never raises."""
+    ctx = job.context or {}
+    repo = job.repo_full_name
+
+    # 1. Head moved since the failure? The new commit's own CI decides.
+    if job.pr_number and job.ref:
+        head = _call(getattr(github, "pull_request_head_sha", None), repo, token, job.pr_number)
+        if isinstance(head, str) and head and head != job.ref:
+            return CITriage("head_moved", summary=(
+                f"**codna fix** — superseded. The PR head moved from `{job.ref[:8]}` to `{head[:8]}` "
+                "after this CI failure; the new commit's own CI decides whether anything needs fixing. "
+                "Nothing was spent."))
+
+    # 2. Suite still red? A re-run replaces its check runs in place.
+    suite_id = ctx.get("check_suite_id")
+    failing = None
+    if isinstance(suite_id, int):
+        failing = _call(getattr(github, "failing_check_runs_in_suite", None), repo, token, suite_id)
+    if isinstance(failing, list) and not failing:
+        return CITriage("green", summary=(
+            "**codna fix** — superseded. The failed check suite has no failing job any more (it was "
+            "re-run and passed, or a re-run is in progress). Nothing to fix on this commit; nothing was spent."))
+    if not isinstance(failing, list):
+        return CITriage("unknown")  # cannot see the suite: run as before
+
+    # 3. What failed, and how?
+    actions_token, can_rerun = _actions_token(job, token, github, app_id, private_key)
+    if not actions_token:
+        return CITriage("unknown", note=PERMISSION_NOTE)
+    evidence: list[_Evidence] = []
+    for run in failing:
+        if not isinstance(run, dict):
+            continue
+        if run.get("app_slug") != "github-actions" or not isinstance(run.get("id"), int):
+            evidence.append(_Evidence(run, "unknown"))  # another CI system: no evidence to read
+            continue
+        info = _call(getattr(github, "actions_job", None), repo, actions_token, run["id"])
+        window = focus_log(_call(getattr(github, "actions_job_log_tail", None), repo, actions_token, run["id"]))
+        step = failing_step(info if isinstance(info, dict) else None)
+        evidence.append(_Evidence(run, classify_job(step, window), step, window,
+                                  info if isinstance(info, dict) else None))
+
+    infra = [ev for ev in evidence if ev.verdict == "infrastructure"]
+    if evidence and len(infra) == len(evidence):
+        run_ids = sorted({ev.info["run_id"] for ev in infra
+                          if ev.info and isinstance(ev.info.get("run_id"), int)})
+        attempt = max((int(ev.info.get("run_attempt") or 1) for ev in infra if ev.info), default=1)
+        rerun = False
+        if attempt >= 2:
+            action = (f"This was already attempt {attempt} of that workflow run and it failed the same "
+                      "way — the runner, registry or network needs a human look, not this pull request.")
+        elif not can_rerun or not run_ids:
+            action = ("Re-run the failed jobs to continue. Grant the Codna GitHub App **Actions: write** "
+                      "to let it re-run infrastructure failures itself.")
+        else:
+            # A list, not a generator: `all()` on a lazy generator stops at the first refusal and
+            # would leave every later workflow run un-re-run while the summary blames "the API".
+            outcomes = [bool(_call(getattr(github, "rerun_failed_jobs", None), repo, actions_token, rid))
+                        for rid in run_ids]
+            rerun = all(outcomes)
+            action = (f"Re-ran the failed jobs (workflow run{'s' if len(run_ids) > 1 else ''} "
+                      f"{', '.join(str(r) for r in run_ids)}, attempt {attempt + 1})." if rerun else
+                      "Re-running the failed jobs was refused by the API; re-run them manually.")
+        return CITriage("infrastructure", summary=_infrastructure_summary(infra, rerun_action=action),
+                        rerun=rerun)
+    if any(ev.verdict == "code" for ev in evidence):
+        return CITriage("code", issue_text=_code_issue_text(job, evidence))
+    return CITriage("unknown")

{codna-0.2.40 → codna-0.2.42}/codna/webhook_github.py

@@ -44,6 +44,14 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
     if kind == "queue":
         # Read the PR head + its check runs, write ONE check on the merge-group commit.
         return {"pull_requests": "read", "checks": "write"}
+    if kind == "ci_triage":
+        # Read the evidence behind a failed check suite: the Actions job's steps and log
+        # (webhook_ci_triage). Minted separately from the fix token because an installation that
+        # never granted `actions` answers 422 to the whole request, and the fix must still run then.
+        return {"actions": "read", "checks": "read"}
+    if kind == "ci_rerun":
+        # Same, plus re-running the failed jobs of a run that died on infrastructure.
+        return {"actions": "write", "checks": "read"}
     raise WebhookError("unknown_job_kind", f"no token scope for job kind {kind!r}")
 
 
@@ -553,3 +561,141 @@ def latest_completed_check_run(repo_full_name: str, token: str, *, head_sha: str
             return {"conclusion": str(run["conclusion"]), "summary": str((run.get("output") or {}).get("summary") or ""),
                     "html_url": str(run.get("html_url") or "")}
     return None
+
+
+# --- CI-failure triage (webhook_ci_triage) ------------------------------------------------------
+_FAILED_CONCLUSIONS = frozenset({"failure", "timed_out"})
+
+
+def _next_page(link_header: str) -> str | None:
+    """The URL of ``rel="next"`` in a GitHub ``Link`` header, or None on the last page."""
+    for part in (link_header or "").split(","):
+        if 'rel="next"' in part:
+            return part.split(";")[0].strip().strip("<>") or None
+    return None
+
+
+_SUITE_PAGES_MAX = 5  # 500 check runs; a suite beyond that is reported unknown, never falsely green
+
+
+def failing_check_runs_in_suite(repo_full_name: str, token: str, suite_id: int) -> list[dict] | None:
+    """The check runs of ``suite_id`` that are still failing, newest per name (``filter=latest``):
+    ``id`` (== the Actions job id for github-actions runs), ``name``, ``html_url``, ``app_slug``.
+    An empty list means the suite has no failing job any more (re-run); None means unknown.
+
+    Walks every page (``Link: rel="next"``): an empty FIRST page of a larger suite would otherwise
+    read as "green" and skip a real code failure. When the listing still comes up short of
+    ``total_count`` the answer is None -- unknown runs the fix as before; a false green skips it.
+    """
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}
+    url: str | None = f"{_API}/repos/{repo_full_name}/check-suites/{int(suite_id)}/check-runs"
+    params: dict[str, Any] | None = {"per_page": 100, "filter": "latest"}
+    runs: list = []
+    total: Any = None
+    for _ in range(_SUITE_PAGES_MAX):
+        if not url:
+            break
+        try:
+            resp = httpx.get(url, headers=headers, params=params, timeout=20.0, follow_redirects=True)
+        except Exception:  # noqa: BLE001
+            return None
+        if resp.status_code != 200:
+            return None
+        try:
+            data = resp.json()
+        except ValueError:
+            return None
+        page = data.get("check_runs") if isinstance(data, dict) else None
+        if not isinstance(page, list):
+            return None
+        runs.extend(page)
+        if total is None:
+            total = data.get("total_count")
+        url, params = _next_page(resp.headers.get("link", "")), None
+    if isinstance(total, int) and total > len(runs):
+        return None
+    out: list[dict] = []
+    for run in runs:
+        if not isinstance(run, dict) or run.get("status") != "completed":
+            continue
+        if str(run.get("conclusion") or "") not in _FAILED_CONCLUSIONS:
+            continue
+        out.append({"id": run.get("id"), "name": str(run.get("name") or ""),
+                    "html_url": str(run.get("html_url") or ""),
+                    "app_slug": str(((run.get("app") or {}).get("slug")) or "")})
+    return out
+
+
+def actions_job(repo_full_name: str, token: str, job_id: int) -> dict | None:
+    """An Actions job: ``run_id``, ``run_attempt``, ``name``, ``steps`` (name + conclusion). Needs
+    ``actions: read``; None on any failure (including the permission being absent)."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    try:
+        resp = httpx.get(f"{_API}/repos/{repo_full_name}/actions/jobs/{int(job_id)}",
+                         headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+                         timeout=20.0, follow_redirects=True)
+    except Exception:  # noqa: BLE001
+        return None
+    if resp.status_code != 200:
+        return None
+    try:
+        data = resp.json()
+    except ValueError:
+        return None
+    if not isinstance(data, dict):
+        return None
+    return {"run_id": data.get("run_id"), "run_attempt": data.get("run_attempt"),
+            "name": str(data.get("name") or ""), "html_url": str(data.get("html_url") or ""),
+            "steps": [{"name": str(s.get("name") or ""), "conclusion": s.get("conclusion")}
+                      for s in (data.get("steps") or []) if isinstance(s, dict)]}
+
+
+_LOG_TAIL_BYTES = 512 * 1024
+
+
+def actions_job_log_tail(repo_full_name: str, token: str, job_id: int, *, max_lines: int = 400) -> str | None:
+    """The last ``max_lines`` lines of an Actions job's raw log (the endpoint redirects to a signed
+    blob URL; httpx drops the Authorization header across that origin change). Streams and keeps
+    only the last 512 KiB so a multi-megabyte log never sits in memory on the 2 GB machine."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    buf = bytearray()
+    try:
+        with httpx.stream("GET", f"{_API}/repos/{repo_full_name}/actions/jobs/{int(job_id)}/logs",
+                          headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+                          timeout=30.0, follow_redirects=True) as resp:
+            if resp.status_code != 200:
+                return None  # the `with` closes the response; nothing to drain
+            for chunk in resp.iter_bytes():
+                buf += chunk
+                if len(buf) > _LOG_TAIL_BYTES:
+                    del buf[:-_LOG_TAIL_BYTES]
+    except Exception:  # noqa: BLE001
+        return None
+    text = buf.decode("utf-8", errors="replace")
+    lines = text.splitlines()[-max_lines:]
+    return "\n".join(lines) if lines else None
+
+
+def rerun_failed_jobs(repo_full_name: str, token: str, run_id: int) -> bool:
+    """Re-run only the failed jobs of a workflow run (``actions: write``). True on 201."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return False
+    try:
+        resp = httpx.post(f"{_API}/repos/{repo_full_name}/actions/runs/{int(run_id)}/rerun-failed-jobs",
+                          headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+                          timeout=30.0, follow_redirects=True)
+    except Exception:  # noqa: BLE001
+        return False
+    return resp.status_code == 201

{codna-0.2.40 → codna-0.2.42}/codna/webhook_worker.py

@@ -32,7 +32,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Callable
 
-from . import webhook_github, webhook_metering
+from . import webhook_ci_triage, webhook_github, webhook_metering
 from .admission_control import get_admitter
 from .agent_core_runtime import PROVIDER_RUNTIME_ENV_KEYS
 from .webhook import (
@@ -304,7 +304,11 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
         # disabled" branches in process_job) -- report=True carries the explanation through to the
         # comment posted on the public issue, and spends nothing running codna for nowhere to go.
         return JobResult(True, ctx["routing_error"])
-    with tempfile.TemporaryDirectory(prefix="codna-webhook-job-") as tmp:
+    # ignore_cleanup_errors: on a drain past its grace the interpreter exits while the job's CLI is
+    # still writing here (it lives in its own session), and the finalizer's rmtree raced it into an
+    # "[Errno 39] Directory not empty" traceback on every redeploy (2026-09-19). prepare_scratch_root
+    # sweeps whatever survives on the next boot.
+    with tempfile.TemporaryDirectory(prefix="codna-webhook-job-", ignore_cleanup_errors=True) as tmp:
         if job.kind == "secure":
             if not token:
                 return JobResult(False, "secure job needs an installation token to fetch SARIF")
@@ -587,6 +591,7 @@ def process_job(
     if reply_to and token and qjob.attempts <= 1:
         github.post_review_comment_reply(job.repo_full_name, token, job.pr_number, reply_to, _COMMENT_FIX_ACK)
 
+    ci_note: str | None = None
     check_id = None
     if token and job.ref:
         # A retry (recover_stale after a restart, or attempt 2/3 after a crash) must supersede the
@@ -610,6 +615,21 @@ def process_job(
             job.repo_full_name, token, name=check_run_name(job.kind), head_sha=job.ref,
             summary=f"{check_run_name(job.kind)} started ({job.reason})",
         )
+    if job.kind == "fix" and job.reason == "check_suite_failure" and token and job.ref:
+        # Before spending a metered run on a red check suite: is the failure still current, and is
+        # it a code defect at all? A `bun install` tarball error or a runner that died is fixed by a
+        # re-run, not a patch -- chasing one, the agent ran the repo's tests in its sandbox and
+        # produced a refused test-only patch (thyn-ai/algenta#1040, 2026-09-19). webhook_ci_triage.
+        verdict = webhook_ci_triage.triage(job, token, github, app_id=app_id, private_key=private_key)
+        _log_worker_phase(qjob, f"ci_triage_{verdict.verdict}")
+        if verdict.verdict in webhook_ci_triage.TERMINAL:
+            if check_id:
+                github.update_check_run(job.repo_full_name, token, check_id, conclusion="neutral",
+                                        summary=verdict.summary, name=check_run_name(job.kind))
+            return JobResult(True, f"ci triage: {verdict.verdict} -- nothing to fix on this commit")
+        if verdict.issue_text and isinstance(job.context, dict):
+            job.context["ci_failure"] = verdict.issue_text  # codna_command hands it to the agent as --issue
+        ci_note = verdict.note
     _log_worker_phase(qjob, "runner_start")  # everything before this is token/metering/prepare/ack
     try:
         identity_fn = getattr(github, "app_bot_identity", None)
@@ -630,7 +650,7 @@ def process_job(
         github.update_check_run(
             job.repo_full_name, token, check_id,
             conclusion="success" if result.ok else "failure",
-            summary=result.summary, name=check_run_name(job.kind),
+            summary=result.summary + (f"\n\n{ci_note}" if ci_note else ""), name=check_run_name(job.kind),
         )
     # An issue-label fix has neither a commit (no check_id: job.ref is never set for this trigger)
     # nor a comment thread (no reply_to) to report through, so the issue itself is the ONLY place it

{codna-0.2.40 → codna-0.2.42}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.40
+Version: 0.2.42
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.40 → codna-0.2.42}/codna.egg-info/SOURCES.txt

@@ -73,6 +73,7 @@ codna/telys_onboarding.py
 codna/telys_runtime.py
 codna/testrun.py
 codna/webhook.py
+codna/webhook_ci_triage.py
 codna/webhook_cli.py
 codna/webhook_github.py
 codna/webhook_metering.py
@@ -191,8 +192,10 @@ tests/test_telys_runtime_packaging.py
 tests/test_testrun.py
 tests/test_verify_pypi_trusted_publisher.py
 tests/test_webhook.py
+tests/test_webhook_ci_triage.py
 tests/test_webhook_feedback_dispatch.py
 tests/test_webhook_github.py
+tests/test_webhook_github_ci.py
 tests/test_webhook_metering.py
 tests/test_webhook_queue.py
 tests/test_webhook_worker.py

{codna-0.2.40 → codna-0.2.42}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.40"
+version = "0.2.42"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.40 → codna-0.2.42}/tests/test_webhook.py

@@ -990,3 +990,22 @@ def test_classify_merge_group_destroyed_or_unparseable_is_ignored():
     p = _merge_group_payload()
     p["merge_group"]["head_ref"] = "refs/heads/something-else"
     assert classify_event("merge_group", p) is None
+
+
+def test_classify_check_suite_failure_carries_the_suite_id_for_triage():
+    payload = _check_suite_payload("failure", [_pr()])
+    payload["check_suite"]["id"] = 555
+    job = classify_event("check_suite", payload)
+    assert job is not None and job.context["check_suite_id"] == 555
+    assert job.context["head_ref"] == "feature/login"
+
+
+def test_check_suite_fix_with_ci_evidence_passes_it_as_the_issue():
+    job = WebhookJob("fix", "acme/app", ref="abc123", pr_number=7,
+                     context={"head_ref": "feature/login", "check_suite_id": 555,
+                              "ci_failure": "CI failed at step X"},
+                     reason="check_suite_failure")
+    cmd = codna_command(job)
+    assert "--tests" in cmd
+    assert cmd[cmd.index("--issue") + 1] == "CI failed at step X"
+    assert cmd[cmd.index("--base-branch") + 1] == "feature/login"