codna 0.2.59__tar.gz → 0.2.60__tar.gz

{codna-0.2.59 → codna-0.2.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.59
+Version: 0.2.60
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.59 → codna-0.2.60}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.59"
+__version__ = "0.2.60"

{codna-0.2.59 → codna-0.2.60}/codna/review.py

@@ -80,6 +80,20 @@ def _pr_head_now(repo_slug: str | None, pr_number: int | None, token: str | None
         return None
 
 
+def _failing_checks_now(repo_slug: str | None, pr_number: int | None, token: str | None) -> list[dict] | None:
+    """The required checks red on the pull request's head at this moment (one GraphQL request), or
+    None when they cannot be read. Read right before posting, next to the head, so the review's
+    approval line can name a red required check instead of reading as a merge go-ahead."""
+    if not (repo_slug and pr_number and token):
+        return None
+    from . import review_github as rg
+
+    try:
+        return rg.failing_required_checks(repo_slug, pr_number, token)
+    except Exception:  # noqa: BLE001 -- best-effort; unknown is said as nothing, never as green
+        return None
+
+
 def _env_review_run_id() -> str | None:
     """``CODNA_REVIEW_RUN_ID``: the webhook job this review runs for; stamped into the review body
     so the same job running twice posts once (review_github.post_review). Unset -> None."""
@@ -329,7 +343,8 @@ def run_findings_review(args) -> dict:
                                                check_run_id=_env_check_run_id(), approve=cfg.approve_clean,
                                                check_head_sha=_env_check_run_head_sha(),
                                                pr_head_sha=_pr_head_now(repo_slug, pr_number, token),
-                                               run_id=_env_review_run_id())
+                                               run_id=_env_review_run_id(),
+                                               failing_checks=_failing_checks_now(repo_slug, pr_number, token))
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.59 → codna-0.2.60}/codna/review_findings.py

@@ -521,12 +521,24 @@ def finalize_findings(
     diff_files: dict[str, DiffFile],
     head_sha: str | None,
     config: ReviewConfig,
+    *,
+    grounder=None,
 ) -> tuple[list[CodnaReviewFinding], list[CodnaReviewFinding], dict[str, int]]:
-    """Pure pipeline: normalize → noise-control/dedup → anchor → split inline vs summary.
-
-    Split out from :func:`run_diff_review` so the whole transform is testable without the agent."""
+    """Pure pipeline: normalize → [ground registry claims] → noise-control/dedup → anchor → split
+    inline vs summary.
+
+    Split out from :func:`run_diff_review` so the whole transform is testable without the agent.
+    ``grounder`` (:func:`review_grounding.grounder_for`; None = the transform stays pure) checks the
+    findings' claims about packages against the npm / PyPI registries BEFORE the noise controls, so a
+    refuted claim neither takes one of the ``max_findings`` slots nor reaches the PR; the counts it
+    returns (``registry_contradicted`` / ``registry_confirmed`` / ``registry_unverified``) join
+    ``dropped``."""
     normalized = [f for f in (normalize_finding(r) for r in raw_findings) if f is not None]
+    grounding: dict[str, int] = {}
+    if grounder is not None and normalized:
+        normalized, grounding = grounder(normalized)
     kept, dropped = apply_noise_controls(normalized, config)
+    dropped.update(grounding)
     anchor_findings(kept, diff_files, head_sha)
     inline = [f for f in kept if f.inline]
     summary = [f for f in kept if not f.inline]
@@ -577,7 +589,12 @@ def run_diff_review(
         changed_lines=diff_changed_lines(diff_text), changed_files=len(changed),
     )
     diff_files = parse_diff(diff_text)
-    inline, summary, dropped = finalize_findings(raw, diff_files, resolved_head, config)
+    # Registry grounding only when the change touches a dependency manifest or lockfile; every other
+    # review keeps the pure transform (no file read, no request).
+    from .review_grounding import grounder_for
+
+    inline, summary, dropped = finalize_findings(raw, diff_files, resolved_head, config,
+                                                 grounder=grounder_for(repo_dir, changed))
     return ReviewResult(
         repository=repository, base=base_label, head_sha=resolved_head, changed_files=changed,
         inline_findings=inline, summary_findings=summary,

{codna-0.2.59 → codna-0.2.60}/codna/review_github.py

@@ -504,13 +504,114 @@ def head_moved_note(reviewed: str, current: str) -> str:
             f"review ran; the current head gets a review of its own.")
 
 
+# statusCheckRollup context states that mean "this check is red" (a CANCELLED run says nothing).
+_RED_CHECK_RUN = frozenset({"FAILURE", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE"})
+_RED_STATUS = frozenset({"FAILURE", "ERROR"})
+_ROLLUP_QUERY = (
+    "query($owner:String!,$name:String!,$number:Int!,$after:String){"
+    " repository(owner:$owner,name:$name){ pullRequest(number:$number){"
+    "  commits(last:1){ nodes{ commit{ oid statusCheckRollup{ contexts(first:100,after:$after){"
+    "   pageInfo{ hasNextPage endCursor }"
+    "   nodes{ __typename"
+    "    ... on CheckRun{ name status conclusion isRequired(pullRequestNumber:$number) }"
+    "    ... on StatusContext{ context state isRequired(pullRequestNumber:$number) } } } } } } } } } }"
+)
+_ROLLUP_PAGES_MAX = 5  # 500 contexts; a rollup beyond that with nothing red on it is unknown, never green
+
+
+def failing_required_checks(repo_slug: str, pr_number: int, token: str | None) -> list[dict] | None:
+    """The REQUIRED checks that are red on the pull request's current head, as
+    ``[{"name", "state", "head_sha"}]`` -- one GraphQL request in the normal case (the PR head's
+    ``statusCheckRollup``, each context's ``isRequired`` for this PR; a rollup of more than 100
+    contexts is walked page by page, at most ``_ROLLUP_PAGES_MAX``). An empty list means no required
+    check is failing; None means the answer is not known (no token, no httpx, an error, a rollup
+    longer than the pages read with nothing red on them) and the caller says nothing rather than
+    guessing.
+
+    Commit statuses (a Vercel deployment reports as one) are visible only to a token with
+    ``statuses: read``; a token without it sees the check runs alone. Read right before posting, like
+    the head itself: the review's approval means "no medium/high findings", and a reader who sees
+    "Approved" next to a red required check must not take it for "safe to merge" (thyn-ai/codna-site#57
+    was approved while its required Vercel status was FAILURE)."""
+    if not token or "/" not in (repo_slug or ""):
+        return None
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    owner, name = repo_slug.split("/", 1)
+    headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}
+    red: list[dict] = []
+    after: str | None = None
+    more = True
+    for _ in range(_ROLLUP_PAGES_MAX):
+        variables = {"owner": owner, "name": name, "number": int(pr_number), "after": after}
+        try:
+            r = httpx.post(f"{_API}/graphql", headers=headers, json={"query": _ROLLUP_QUERY, "variables": variables},
+                           timeout=20.0, follow_redirects=True)
+        except Exception:  # noqa: BLE001 -- best-effort: unknown, never a false "green"
+            return None
+        if r.status_code >= 300:
+            return None
+        try:
+            commit = r.json()["data"]["repository"]["pullRequest"]["commits"]["nodes"][0]["commit"]
+            contexts = (commit.get("statusCheckRollup") or {}).get("contexts") or {}
+            nodes = contexts.get("nodes") or []
+            page = contexts.get("pageInfo") or {}
+            head_sha = str(commit.get("oid") or "")
+        except (ValueError, KeyError, TypeError, IndexError):
+            return None
+        if not isinstance(nodes, list):
+            return None
+        for node in nodes:
+            if not isinstance(node, dict) or not node.get("isRequired"):
+                continue
+            if node.get("__typename") == "CheckRun":
+                state = str(node.get("conclusion") or "").upper()
+                if node.get("status") == "COMPLETED" and state in _RED_CHECK_RUN:
+                    red.append({"name": str(node.get("name") or ""), "state": state, "head_sha": head_sha})
+            elif node.get("__typename") == "StatusContext":
+                state = str(node.get("state") or "").upper()
+                if state in _RED_STATUS:
+                    red.append({"name": str(node.get("context") or ""), "state": state, "head_sha": head_sha})
+        more = bool(page.get("hasNextPage"))
+        after = page.get("endCursor") if more else None
+        if not more or not isinstance(after, str) or not after:
+            break
+    if more:
+        # Pages were left unread (more than the cap, or a cursor GitHub did not hand back). Red ones
+        # already seen are still named -- a partial warning beats none -- but nothing red so far is
+        # "unknown", never "green".
+        return red or None
+    return red
+
+
+def red_head_note(checks: list[dict]) -> str:
+    """One line for the review body and the check summary naming the required checks that are red on
+    the head at review time, so "Approved" is never read as "safe to merge"."""
+    if not checks:
+        return ""
+    names = ", ".join(f"`{c.get('name') or '?'}` ({str(c.get('state') or 'red').lower()})" for c in checks)
+    sha = str((checks[0].get("head_sha") or ""))[:8]
+    where = f"head {sha} is red" if sha else "the head is red"
+    return (f"🔴 Heads-up: {where} -- required check(s) failing at review time: {names}. "
+            "This review's verdict is about the diff, not a merge go-ahead.")
+
+
 def post_review(
     result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
     check_run_id: int | None = None, approve: bool = True,
     check_head_sha: str | None = None, pr_head_sha: str | None = None, run_id: str | None = None,
+    failing_checks: list[dict] | None = None,
 ) -> dict:
     """Post ONE review (+ the "codna review" check) to the PR. Returns a small status dict.
 
+    ``failing_checks`` (:func:`failing_required_checks`, read by the caller right before posting, like
+    ``pr_head_sha``) are the REQUIRED checks red on the PR head at review time. They change no
+    verdict -- the event is still decided by the findings alone -- but when there are any, the
+    approval line is followed by one :func:`red_head_note` naming them, in the review body and in the
+    check summary, so "Approved" is never mistaken for "safe to merge". None = unknown, nothing said.
+
     ``approve`` (``review.approve`` in codna.yaml, default on) lets a clean review be posted as an
     APPROVE -- see :func:`review_event` for exactly when. A PR the App itself authored cannot be
     approved by the App (GitHub answers 422); that case falls back to a COMMENT.
@@ -585,6 +686,10 @@ def post_review(
             event, note = "COMMENT", moved
         else:
             note = f"{note} {moved}"
+    if failing_checks:
+        # Said next to the verdict, never instead of it: the findings decide the event; this line
+        # only keeps a reader from taking an approval for a merge go-ahead on a red head.
+        note = f"{note} {red_head_note(failing_checks)}"
 
     inline_found = len(result.inline_findings)
     demoted = 0
@@ -672,4 +777,6 @@ def post_review(
         # (``head_sha`` in the enclosing result) and where the pull request stands now.
         "check_head_sha": check_head_sha if check_run_id is not None else result.head_sha,
         "pr_head_sha": pr_head_sha,
+        # The required checks that were red on the head when this review posted (None = not read).
+        "failing_required_checks": failing_checks,
     }