codna 0.2.46__tar.gz → 0.2.47__tar.gz

{codna-0.2.46 → codna-0.2.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.46
+Version: 0.2.47
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.46 → codna-0.2.47}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.46"
+__version__ = "0.2.47"

{codna-0.2.46 → codna-0.2.47}/codna/agent-core/vendor/cline/algenta/review-policy.test.ts

@@ -119,3 +119,21 @@ test("Telys localization is skipped for a review payload", async () => {
 		else process.env.AGENT_CORE_TELYS_LOCALIZE_ENABLED = previous;
 	}
 });
+
+test("triage keeps its evidence bundle (reference-only); only review drops it", () => {
+	const dir = mkdtempSync(path.join(tmpdir(), "codna-triage-"));
+	try {
+		writeFileSync(path.join(dir, "README.md"), "# hi\n");
+		const triage = normalizeSessionPayload(
+			{ working_dir: dir, task_kind: "triage", task_spec: { issue_text: "Why does README.md mention a removed flag?" } },
+			"owner",
+		);
+		expect(triage.prompt).toBe("Why does README.md mention a removed flag?");   // verbatim, no fix framing
+		expect(triage.injectedContext).toContain("README.md");                        // analysis keeps its evidence
+		const system = buildSystemPrompt({ working_dir: dir, prompt: triage.prompt, task_kind: "triage", injected_context: triage.injectedContext } as never);
+		expect(system).toContain("reference only");
+		expect(system).not.toContain("edit that file directly");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});

{codna-0.2.46 → codna-0.2.47}/codna/agent-core/vendor/cline/algenta/server/utils.ts

@@ -433,7 +433,15 @@ export function normalizeLimits(
 	};
 }
 
-/** Task kinds whose user turn is the task text itself: nothing is being fixed. */
+/**
+ * Task kinds whose user turn is the task text itself: nothing is being fixed.
+ *
+ * Review and triage differ in what ELSE they receive, deliberately: a review's evidence is the
+ * diff inside its prompt, so it gets no injected context and no Telys localization
+ * (server/policy.ts, telys-localize.ts); a triage is repository analysis, so it keeps the evidence
+ * bundle and localization as reference material -- buildSystemPrompt (adapter.ts) labels it
+ * reference-only for both kinds and never asks either to edit.
+ */
 const VERBATIM_PROMPT_TASK_KINDS = new Set(["review", "triage"]);
 
 export function payloadTaskKind(payload: Record<string, unknown>): string | undefined {

{codna-0.2.46 → codna-0.2.47}/codna/review.py

@@ -247,7 +247,7 @@ def run_findings_review(args) -> dict:
                 _fail("--post needs a write token: pass --github-token or set GITHUB_TOKEN.")
             try:
                 out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token,
-                                               check_run_id=_env_check_run_id())
+                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean)
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.46 → codna-0.2.47}/codna/review_findings.py

@@ -34,6 +34,9 @@ class ReviewConfig:
     max_findings: int = 10
     blocking_enabled: bool = False
     blocking_severities: tuple[str, ...] = ("high",)
+    # `review.approve` (default on): a review with no medium/high findings and no unresolved codna
+    # threads is posted as an APPROVE (review_github.review_event); off = always COMMENT.
+    approve_clean: bool = True
     categories: dict[str, bool] = field(
         default_factory=lambda: {c: True for c in CATEGORIES}
     )
@@ -86,6 +89,8 @@ def review_config_from_dict(data: dict | None) -> ReviewConfig:
         cfg.min_confidence = max(0.0, min(1.0, float(data["min_confidence"])))
     if isinstance(data.get("max_findings"), int) and data["max_findings"] >= 0:
         cfg.max_findings = int(data["max_findings"])
+    if isinstance(data.get("approve"), bool):
+        cfg.approve_clean = data["approve"]
     blocking = data.get("blocking")
     if isinstance(blocking, dict):
         cfg.blocking_enabled = bool(blocking.get("enabled", False))

{codna-0.2.46 → codna-0.2.47}/codna/review_github.py

@@ -30,6 +30,91 @@ _REVIEWED_HEAD_RE = re.compile(r"<!--\s*codna:reviewed-head=([0-9a-f]{7,40})\s*-
 
 _SEV_EMOJI = {"high": "🔴", "medium": "🟡", "low": "⚪"}
 
+# Approval policy. A review posted as COMMENT is invisible to everything that counts approvals --
+# GitHub's "require approvals" rule and OpenSSF Scorecard's Code-Review check both look for a review
+# in state APPROVED by someone other than the author (Scorecard's codeApproved probe; bot reviewers
+# count, bot AUTHORS are skipped). Codna therefore APPROVES when its review is clean at the
+# severities that mean "do not merge this yet", and only then. Low findings never block approval.
+APPROVAL_BLOCKING_SEVERITIES = ("high", "medium")
+_MAX_THREADS = 100  # reviewThreads page size; more than that -> unknown -> no approval (fail closed)
+
+
+def review_event(result: ReviewResult, *, unresolved_blocking: int | None, approve: bool = True) -> str:
+    """``APPROVE`` when approving is enabled, this pass found nothing at a blocking severity AND no
+    earlier Codna finding at a blocking severity is still unresolved on the PR; otherwise ``COMMENT``.
+    ``unresolved_blocking=None`` means the thread state could not be read: no approval."""
+    if not approve or unresolved_blocking is None or unresolved_blocking > 0:
+        return "COMMENT"
+    if any(f.severity in APPROVAL_BLOCKING_SEVERITIES for f in result.findings):
+        return "COMMENT"
+    return "APPROVE"
+
+
+def approval_note(event: str, result: ReviewResult, unresolved_blocking: int | None, *, approve: bool = True) -> str:
+    """One line for the check summary saying whether this review approved the PR, and if not, why."""
+    if event == "APPROVE":
+        return "✅ Approved: no medium/high findings and no unresolved codna threads."
+    if not approve:
+        return "Approval is turned off for this repository (`review.approve: false`)."
+    blocking = sum(1 for f in result.findings if f.severity in APPROVAL_BLOCKING_SEVERITIES)
+    parts = []
+    if blocking:
+        parts.append(f"{blocking} medium/high finding(s) in this review")
+    if unresolved_blocking is None:
+        parts.append("the PR's review threads could not be read")
+    elif unresolved_blocking:
+        parts.append(f"{unresolved_blocking} earlier codna finding thread(s) at medium/high still unresolved -- "
+                     "resolve them once addressed")
+    return "⏸ Not approved: " + "; ".join(parts) + "." if parts else "⏸ Not approved."
+
+
+def unresolved_blocking_findings(repo_slug: str, pr_number: int, token: str | None) -> int | None:
+    """How many review threads Codna opened on this PR for a medium/high finding are still unresolved.
+
+    The author resolves a thread once the finding is addressed -- that human act, not a re-review of
+    the whole PR, is what lets an incremental review approve. Only threads whose first comment is a
+    Bot's and carries a well-formed ``codna:finding`` marker count. Returns None when the answer is
+    not certain (no token, API error, more than ``_MAX_THREADS`` threads): the caller must then not
+    approve."""
+    if not token or "/" not in (repo_slug or ""):
+        return None
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    owner, name = repo_slug.split("/", 1)
+    query = (
+        "query($owner:String!,$name:String!,$number:Int!,$first:Int!){"
+        " repository(owner:$owner,name:$name){ pullRequest(number:$number){"
+        "  reviewThreads(first:$first){ pageInfo{ hasNextPage }"
+        "   nodes{ isResolved comments(first:1){ nodes{ body author{ login __typename } } } } } } } }"
+    )
+    try:
+        r = httpx.post(f"{_API}/graphql", headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+                       json={"query": query, "variables": {"owner": owner, "name": name, "number": int(pr_number), "first": _MAX_THREADS}},
+                       timeout=30.0, follow_redirects=True)
+    except Exception:  # noqa: BLE001
+        return None
+    if r.status_code >= 300:
+        return None
+    try:
+        threads = r.json()["data"]["repository"]["pullRequest"]["reviewThreads"]
+    except (ValueError, KeyError, TypeError):
+        return None
+    if not isinstance(threads, dict) or (threads.get("pageInfo") or {}).get("hasNextPage"):
+        return None
+    unresolved = 0
+    for node in threads.get("nodes") or []:
+        if not isinstance(node, dict) or node.get("isResolved"):
+            continue
+        first = ((node.get("comments") or {}).get("nodes") or [None])[0]
+        if not isinstance(first, dict) or ((first.get("author") or {}).get("__typename") != "Bot"):
+            continue
+        finding = parse_codna_finding(str(first.get("body") or ""))
+        if finding and finding.get("severity") in APPROVAL_BLOCKING_SEVERITIES:
+            unresolved += 1
+    return unresolved
+
 
 def fp_marker(fingerprint: str) -> str:
     return f"<!-- codna:review:fp={fingerprint} -->"
@@ -110,12 +195,14 @@ def _looks_like_suggestion(patch: str) -> bool:
     return not any(ln[:1] in ("+", "-", "@") for ln in patch.splitlines())
 
 
-def summary_body(result: ReviewResult) -> str:
-    """The review's top-level body: headline + any findings that could not be anchored inline."""
+def summary_body(result: ReviewResult, approval: str | None = None) -> str:
+    """The review's top-level body: headline + any findings that could not be anchored inline
+    (+ the approval line, when the caller decided one)."""
     n = len(result.findings)
     head_mark = reviewed_head_marker(result.head_sha)
+    tail = (approval + "\n\n") if approval else ""
     if n == 0:
-        return "**codna review** — no high-confidence issues found. ✅\n\n" + fp_marker("none") + "\n" + head_mark
+        return "**codna review** — no high-confidence issues found. ✅\n\n" + tail + fp_marker("none") + "\n" + head_mark
     lines = [f"**codna review** — {n} finding(s): "
              f"{len(result.inline_findings)} inline, {len(result.summary_findings)} in summary.", ""]
     for f in result.summary_findings:
@@ -125,7 +212,10 @@ def summary_body(result: ReviewResult) -> str:
         if f.explanation:
             lines.append(f"  <br>{f.explanation.strip()}")
     lines += ["", "_Reply `@codna fix` on a finding to have Codna open a verified, test-green, "
-              "risk-gated fix PR._", "", head_mark]
+              "risk-gated fix PR._", ""]
+    if approval:
+        lines += [approval, ""]
+    lines.append(head_mark)
     return "\n".join(lines)
 
 
@@ -148,12 +238,14 @@ def existing_fingerprints(comments: list[dict]) -> set[str]:
     return fps
 
 
-def build_review_payload(result: ReviewResult, *, skip_fingerprints: set[str] | None = None) -> dict:
-    """Build the ``POST …/reviews`` body: event=COMMENT, summary body, inline comments for anchored
-    findings whose fingerprint has not already been posted. Never REQUEST_CHANGES — non-blocking."""
+def build_review_payload(result: ReviewResult, *, skip_fingerprints: set[str] | None = None,
+                         event: str = "COMMENT", approval: str | None = None) -> dict:
+    """Build the ``POST …/reviews`` body: ``event`` (COMMENT, or APPROVE per :func:`review_event`),
+    summary body, inline comments for anchored findings whose fingerprint has not already been
+    posted. Never REQUEST_CHANGES — the check conclusion is the gate, the review stays non-blocking."""
     skip = skip_fingerprints or set()
     comments = [inline_comment_payload(f) for f in result.inline_findings if f.fingerprint not in skip]
-    payload: dict = {"event": "COMMENT", "body": summary_body(result), "comments": comments}
+    payload: dict = {"event": event, "body": summary_body(result, approval), "comments": comments}
     if result.head_sha:
         payload["commit_id"] = result.head_sha
     return payload
@@ -273,10 +365,14 @@ def parse_pr_arg(value: str, repo_dir: str) -> tuple[str | None, int | None]:
 
 def post_review(
     result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
-    check_run_id: int | None = None,
+    check_run_id: int | None = None, approve: bool = True,
 ) -> dict:
     """Post ONE review (+ the "codna review" check) to the PR. Returns a small status dict.
 
+    ``approve`` (``review.approve`` in codna.yaml, default on) lets a clean review be posted as an
+    APPROVE -- see :func:`review_event` for exactly when. A PR the App itself authored cannot be
+    approved by the App (GitHub answers 422); that case falls back to a COMMENT.
+
     ``dedup`` fetches existing PR review comments and skips fingerprints Codna already posted, so a
     re-run on the same head does not duplicate threads. ``check_run_id`` (the webhook passes it as
     ``CODNA_CHECK_RUN_ID``) is a Check Run the caller already opened for this review: it is
@@ -300,17 +396,31 @@ def post_review(
         except Exception:  # noqa: BLE001 — dedup is best-effort; never block posting
             skip = set()
 
-    payload = build_review_payload(result, skip_fingerprints=skip)
+    unresolved = unresolved_blocking_findings(repo_slug, pr_number, token) if approve else None
+    event = review_event(result, unresolved_blocking=unresolved, approve=approve)
+    note = approval_note(event, result, unresolved, approve=approve)
+    payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note)
     posted_review = False
-    # Post the review only if there is something new to say (new inline comments) or findings exist.
-    if payload["comments"] or result.findings:
+    # Post the review if there is something new to say (new inline comments), findings exist, or the
+    # review is an approval -- an approval with nothing else to say is exactly the review a clean PR
+    # needs (a clean review used to post nothing, so no PR ever carried an approval).
+    if payload["comments"] or result.findings or event == "APPROVE":
         resp = httpx.post(
             f"{_API}/repos/{repo_slug}/pulls/{pr_number}/reviews",
             headers=headers, json=payload, timeout=60.0, follow_redirects=True,
         )
-        if resp.status_code >= 300:
+        if resp.status_code == 422 and event == "APPROVE":
+            # The App cannot approve a PR it authored (its own fix PRs). Say the same thing as a
+            # comment, when there is anything to say.
+            event = "COMMENT"
+            note = approval_note(event, result, unresolved, approve=approve) + " (the App cannot approve its own pull request)"
+            payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note)
+            resp = (httpx.post(f"{_API}/repos/{repo_slug}/pulls/{pr_number}/reviews", headers=headers,
+                               json=payload, timeout=60.0, follow_redirects=True)
+                    if (payload["comments"] or result.findings) else None)
+        if resp is not None and resp.status_code >= 300:
             raise RuntimeError(f"create review failed: {resp.status_code} {resp.text[:300]}")
-        posted_review = True
+        posted_review = resp is not None
 
     check = None
     if check_run_id is not None or result.head_sha:
@@ -320,7 +430,7 @@ def post_review(
             if check_run_id is not None:
                 webhook_github.update_check_run(
                     repo_slug, token, check_run_id, conclusion=result.conclusion,
-                    summary=summary_body(result), name=CHECK_NAME,
+                    summary=summary_body(result, note), name=CHECK_NAME,
                 )
                 check = {"id": check_run_id, "conclusion": result.conclusion, "updated_existing": True}
             else:
@@ -331,7 +441,7 @@ def post_review(
                 if cid is not None:
                     webhook_github.update_check_run(
                         repo_slug, token, cid, conclusion=result.conclusion,
-                        summary=summary_body(result), name=CHECK_NAME,
+                        summary=summary_body(result, note), name=CHECK_NAME,
                     )
                 check = {"id": cid, "conclusion": result.conclusion, "updated_existing": False}
         except Exception:  # noqa: BLE001 — the check is advisory; a failure must not fail the review
@@ -339,6 +449,8 @@ def post_review(
 
     return {
         "posted_review": posted_review,
+        "event": event,
+        "unresolved_blocking": unresolved,
         "inline_posted": len(payload["comments"]),
         "skipped_duplicates": len(result.inline_findings) - len(payload["comments"]),
         "check": check,

{codna-0.2.46 → codna-0.2.47}/codna/webhook_summaries.py

@@ -95,13 +95,15 @@ def _review_job_summary(stdout: str) -> str | None:
     findings = result.get("findings") or []
     if not findings:
         note = result.get("note")
-        return f"codna review: {note}" if note else "codna review: no high-confidence issues found ✅"
+        approved = " · approved" if (result.get("posted") or {}).get("event") == "APPROVE" else ""
+        return f"codna review: {note}" if note else f"codna review: no high-confidence issues found ✅{approved}"
     posted = result.get("posted") or {}
     inline = posted.get("inline_posted", 0)
     summary_n = result.get("summary_count", 0)
+    approved = " · approved" if posted.get("event") == "APPROVE" else ""
     return (
         f"codna review: {len(findings)} finding(s) — {inline} inline, {summary_n} in summary "
-        f"(conclusion: {result.get('conclusion', 'unknown')}). See the PR's review comments for details."
+        f"(conclusion: {result.get('conclusion', 'unknown')}){approved}. See the PR's review comments for details."
     )
 
 

{codna-0.2.46 → codna-0.2.47}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.46
+Version: 0.2.47
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.46 → codna-0.2.47}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.46"
+version = "0.2.47"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.46 → codna-0.2.47}/tests/test_review_findings.py

@@ -690,3 +690,155 @@ def test_unparseable_findings_error_is_a_cline_agent_error_with_its_own_code():
     with pytest.raises(UnparseableFindingsError) as exc:
         extract_findings_json("just prose")
     assert isinstance(exc.value, ClineAgentError) and exc.value.code == "review_unparseable_output"
+
+
+# --- a clean review APPROVES (Scorecard Code-Review + "require approvals" both need an APPROVED review) ---
+def _af(sev="high", fp="f1", line=1):
+    """An INLINE finding for the approval tests (anchored, as real inline findings are; distinct name:
+    `_finding` above has a different signature)."""
+    return rf.CodnaReviewFinding(path="a.py", line=line, severity=sev, category="correctness", title=f"t-{fp}",
+                                 explanation="x", confidence=0.9, fingerprint=fp, end_line=None,
+                                 diff_anchor=rf.DiffAnchor(commit_id="h" * 40, side="RIGHT", line=line))
+
+
+def _ar(findings=()):
+    return rf.ReviewResult(repository="u", base="b", head_sha="h" * 40, changed_files=["a.py"],
+                           inline_findings=list(findings), summary_findings=[], conclusion="neutral" if findings else "success",
+                           dropped={})
+
+
+def test_review_event_approves_only_a_clean_pr_with_no_unresolved_blocking_threads():
+    assert rg.review_event(_ar(), unresolved_blocking=0) == "APPROVE"
+    assert rg.review_event(_ar([_af("low")]), unresolved_blocking=0) == "APPROVE"     # low never blocks
+    assert rg.review_event(_ar([_af("medium")]), unresolved_blocking=0) == "COMMENT"
+    assert rg.review_event(_ar([_af("high")]), unresolved_blocking=0) == "COMMENT"
+    assert rg.review_event(_ar(), unresolved_blocking=1) == "COMMENT"                     # earlier finding still open
+    assert rg.review_event(_ar(), unresolved_blocking=None) == "COMMENT"                  # unknown -> fail closed
+    assert rg.review_event(_ar(), unresolved_blocking=0, approve=False) == "COMMENT"      # turned off
+
+
+def test_approval_note_explains_why_not():
+    assert "Approved" in rg.approval_note("APPROVE", _ar(), 0)
+    n = rg.approval_note("COMMENT", _ar([_af("high")]), 2)
+    assert "1 medium/high finding" in n and "2 earlier codna finding thread(s)" in n
+    assert "could not be read" in rg.approval_note("COMMENT", _ar(), None)
+    assert "turned off" in rg.approval_note("COMMENT", _ar(), 0, approve=False)
+
+
+def test_build_review_payload_carries_the_event_and_the_approval_line():
+    p = rg.build_review_payload(_ar(), event="APPROVE", approval="✅ Approved: x")
+    assert p["event"] == "APPROVE" and "✅ Approved: x" in p["body"] and p["comments"] == []
+    assert rg.build_review_payload(_ar())["event"] == "COMMENT"          # default unchanged
+
+
+def _thread(body, resolved=False, typename="Bot"):
+    return {"isResolved": resolved, "comments": {"nodes": [{"body": body, "author": {"login": "codna-ai[bot]", "__typename": typename}}]}}
+
+
+def test_unresolved_blocking_findings_counts_only_open_bot_threads_at_medium_or_high(monkeypatch):
+    import httpx
+    high = rg.comment_body(_af("high", "aa"))
+    low = rg.comment_body(_af("low", "bb"))
+    medium = rg.comment_body(_af("medium", "cc"))
+    nodes = [_thread(high), _thread(high, resolved=True), _thread(low), _thread(medium),
+             _thread(medium, typename="User"), _thread("a human comment")]
+    class _Resp:
+        status_code = 200
+        def json(self):
+            return {"data": {"repository": {"pullRequest": {"reviewThreads": {"pageInfo": {"hasNextPage": False}, "nodes": nodes}}}}}
+    captured = {}
+    monkeypatch.setattr(httpx, "post", lambda url, **k: captured.update(k) or _Resp())
+    assert rg.unresolved_blocking_findings("o/r", 7, "tok") == 2                 # one open high + one open medium
+    assert captured["json"]["variables"] == {"owner": "o", "name": "r", "number": 7, "first": 100}
+
+
+def test_unresolved_blocking_findings_is_unknown_on_errors_or_overflow(monkeypatch):
+    import httpx
+    class _Err:
+        status_code = 502
+        def json(self): return {}
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _Err())
+    assert rg.unresolved_blocking_findings("o/r", 7, "tok") is None
+    class _More:
+        status_code = 200
+        def json(self):
+            return {"data": {"repository": {"pullRequest": {"reviewThreads": {"pageInfo": {"hasNextPage": True}, "nodes": []}}}}}
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _More())
+    assert rg.unresolved_blocking_findings("o/r", 7, "tok") is None
+    assert rg.unresolved_blocking_findings("o/r", 7, None) is None
+
+
+def _stub_checks(monkeypatch):
+    from codna import webhook_github
+    monkeypatch.setattr(webhook_github, "create_check_run", lambda *a, **k: 777)
+    monkeypatch.setattr(webhook_github, "update_check_run", lambda *a, **k: None)
+
+
+def test_post_review_posts_an_approve_for_a_clean_pr(monkeypatch):
+    """A clean review used to post NOTHING (only the check), so no PR ever carried an approval."""
+    import httpx
+    _stub_checks(monkeypatch)
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: 0)
+    posts = []
+    class _Ok:
+        status_code = 200
+        text = ""
+        def json(self): return {}
+    monkeypatch.setattr(httpx, "post", lambda url, **k: posts.append((url, k["json"])) or _Ok())
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False)
+    assert out["event"] == "APPROVE" and out["posted_review"] is True and out["unresolved_blocking"] == 0
+    assert posts[0][0].endswith("/repos/o/r/pulls/5/reviews") and posts[0][1]["event"] == "APPROVE"
+    assert "✅ Approved" in posts[0][1]["body"]
+
+
+def test_post_review_comments_when_a_medium_finding_or_an_open_thread_remains(monkeypatch):
+    import httpx
+    _stub_checks(monkeypatch)
+    posts = []
+    class _Ok:
+        status_code = 200
+        text = ""
+    monkeypatch.setattr(httpx, "post", lambda url, **k: posts.append(k["json"]) or _Ok())
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: 0)
+    out = rg.post_review(_ar([_af("medium")]), repo_slug="o/r", pr_number=5, token="t", dedup=False)
+    assert out["event"] == "COMMENT" and posts[-1]["event"] == "COMMENT" and "Not approved" in posts[-1]["body"]
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: 3)
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False)
+    assert out["event"] == "COMMENT" and out["posted_review"] is False       # clean pass, but 3 open threads: nothing to post
+    assert out["unresolved_blocking"] == 3
+
+
+def test_post_review_falls_back_to_a_comment_when_github_refuses_the_approval(monkeypatch):
+    """The App cannot approve a PR it authored (its own fix PRs): GitHub answers 422."""
+    import httpx
+    _stub_checks(monkeypatch)
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: 0)
+    posts = []
+    class _Resp:
+        def __init__(self, code): self.status_code, self.text = code, "Unprocessable"
+    def fake_post(url, **k):
+        posts.append(k["json"]["event"])
+        return _Resp(422 if k["json"]["event"] == "APPROVE" else 200)
+    monkeypatch.setattr(httpx, "post", fake_post)
+    # clean + refused: nothing else to say -> no second post, no error
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False)
+    assert posts == ["APPROVE"] and out["event"] == "COMMENT" and out["posted_review"] is False
+    # low-only findings + refused: the findings are still posted as a COMMENT
+    posts.clear()
+    out = rg.post_review(_ar([_af("low")]), repo_slug="o/r", pr_number=5, token="t", dedup=False)
+    assert posts == ["APPROVE", "COMMENT"] and out["event"] == "COMMENT" and out["posted_review"] is True
+
+
+def test_post_review_approve_flag_off_never_calls_the_thread_lookup(monkeypatch):
+    import httpx
+    _stub_checks(monkeypatch)
+    monkeypatch.setattr(rg, "unresolved_blocking_findings", lambda *a, **k: pytest.fail("must not be called"))
+    monkeypatch.setattr(httpx, "post", lambda url, **k: pytest.fail("nothing to post for a clean, approval-off review"))
+    out = rg.post_review(_ar(), repo_slug="o/r", pr_number=5, token="t", dedup=False, approve=False)
+    assert out["event"] == "COMMENT" and out["posted_review"] is False
+
+
+def test_review_config_parses_the_approve_switch():
+    assert rf.ReviewConfig().approve_clean is True
+    assert rf.review_config_from_dict({"approve": False}).approve_clean is False
+    assert rf.review_config_from_dict({"approve": "no"}).approve_clean is True          # only a real bool counts

{codna-0.2.46 → codna-0.2.47}/tests/test_webhook_worker.py

@@ -1779,3 +1779,12 @@ def test_detail_value_cut_on_a_crlf_boundary_leaves_no_bare_carriage_return():
     value = "x" * (_DETAIL_VALUE_CHARS - 1) + "\r\nsecond line"
     block = _details_block({"raw_head": value})
     assert "\r" not in block and block.endswith("…\n```")
+
+
+def test_review_job_summary_mentions_the_approval():
+    from codna.webhook_summaries import _review_job_summary
+    clean = json.dumps({"conclusion": "success", "findings": [], "posted": {"event": "APPROVE"}})
+    assert _review_job_summary(clean).endswith("✅ · approved")
+    with_findings = json.dumps({"conclusion": "neutral", "findings": [{"x": 1}], "summary_count": 0,
+                                "posted": {"event": "COMMENT", "inline_posted": 1}})
+    assert "approved" not in _review_job_summary(with_findings)