codna 0.2.61__tar.gz → 0.2.62__tar.gz

{codna-0.2.61 → codna-0.2.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.61
+Version: 0.2.62
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.61 → codna-0.2.62}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.61"
+__version__ = "0.2.62"

{codna-0.2.61 → codna-0.2.62}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.61
+Version: 0.2.62
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.61 → codna-0.2.62}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.61"
+version = "0.2.62"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

codna-0.2.62/tests/test_workflows.py

@@ -0,0 +1,232 @@
+"""Contracts over the repository's own GitHub Actions configuration.
+
+Every expectation is derived from the files under .github/ (job lists, workflow names), never
+from a hardcoded count, so adding a workflow cannot silently escape a rule.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+WORKFLOWS = ROOT / ".github" / "workflows"
+WORKFLOW_FILES = sorted(WORKFLOWS.glob("*.yml")) + sorted(WORKFLOWS.glob("*.yaml"))
+
+
+def _jobs(path: Path) -> dict:
+    doc = yaml.safe_load(path.read_text(encoding="utf-8"))
+    assert isinstance(doc, dict), path
+    return doc["jobs"]
+
+
+def test_workflows_are_present():
+    assert WORKFLOW_FILES, "no workflow files found under .github/workflows"
+
+
+@pytest.mark.parametrize("path", WORKFLOW_FILES, ids=lambda p: p.name)
+def test_no_workflow_reads_the_retired_fleet_variable(path):
+    # `fromJSON(vars.RUNNER_LABELS)` fails at workflow PARSE time (zero jobs, no logs) once the
+    # org variable is gone; every job runs on GitHub-hosted runners now.
+    assert "fromJSON(vars.RUNNER_LABELS)" not in path.read_text(encoding="utf-8")
+
+
+@pytest.mark.parametrize("path", WORKFLOW_FILES, ids=lambda p: p.name)
+def test_every_job_declares_a_timeout(path):
+    # GitHub's default is 360 minutes per job, billed on hosted runners. A job that calls a
+    # reusable workflow (`uses:`) may not set timeout-minutes itself; the callee's jobs carry it.
+    missing = [
+        job for job, spec in _jobs(path).items()
+        if "timeout-minutes" not in spec and "uses" not in spec
+    ]
+    assert missing == [], f"{path.name}: jobs without timeout-minutes: {missing}"
+
+
+def test_security_workflow_pins_the_toolchain_by_sha_with_a_version_comment():
+    text = (WORKFLOWS / "security.yml").read_text(encoding="utf-8")
+    uses = [line.strip() for line in text.splitlines() if line.strip().startswith("uses: thyn-ai/security-toolchain/")]
+    assert len(uses) == 1, uses
+    assert re.fullmatch(
+        r"uses: thyn-ai/security-toolchain/\.github/workflows/security-full\.yml@[0-9a-f]{40} # v\d+\.\d+\.\d+",
+        uses[0],
+    ), uses[0]
+
+
+def test_dependabot_leaves_the_toolchain_pin_to_propagate():
+    doc = yaml.safe_load((ROOT / ".github" / "dependabot.yml").read_text(encoding="utf-8"))
+    actions = [
+        u
+        for u in doc["updates"]
+        if u["package-ecosystem"] == "github-actions" and u.get("directory") == "/"
+    ]
+    assert actions, "no github-actions block covers .github/workflows"
+    ignored = [entry["dependency-name"] for block in actions for entry in block.get("ignore", [])]
+    # Dependabot names a reusable workflow by its full path, so only a wildcard can match it.
+    assert any(name.startswith("thyn-ai/security-toolchain") and name.endswith("*") for name in ignored), ignored
+
+
+# --- webhook-ops.yml: the rollout's operator surface --------------------------------------------------
+
+WEBHOOK_OPS = WORKFLOWS / "webhook-ops.yml"
+ACTION_LITERAL = re.compile(r"inputs\.action\s*==\s*'([a-z-]+)'")
+# A rollout flag is a switch, never a credential: none of these words may appear in an allowed name.
+CREDENTIAL_MARKERS = ("TOKEN", "SECRET", "KEY", "PASSWORD", "DATABASE_URL", "PRIVATE", "CREDENTIAL")
+
+
+def _webhook_ops() -> dict:
+    doc = yaml.safe_load(WEBHOOK_OPS.read_text(encoding="utf-8"))
+    assert isinstance(doc, dict)
+    return doc
+
+
+def _ops_steps() -> list[dict]:
+    return _webhook_ops()["jobs"]["run"]["steps"]
+
+
+def _ops_step(action: str) -> dict:
+    hits = [s for s in _ops_steps() if action in ACTION_LITERAL.findall(str(s.get("if", ""))) and "run" in s]
+    assert len(hits) == 1, (action, [s.get("name") for s in hits])
+    return hits[0]
+
+
+def test_webhook_ops_action_choices_and_steps_agree():
+    doc = _webhook_ops()
+    trigger = doc.get("on", doc.get(True))  # PyYAML reads the bare key `on` as the boolean True
+    choices = trigger["workflow_dispatch"]["inputs"]["action"]["options"]
+    assert len(set(choices)) == len(choices), "duplicate action choice"
+    referenced = set(ACTION_LITERAL.findall(WEBHOOK_OPS.read_text(encoding="utf-8")))
+    assert set(choices) == referenced, {"choice without a step": set(choices) - referenced,
+                                        "step without a choice": referenced - set(choices)}
+
+
+def test_webhook_ops_flag_allow_list_names_only_switches_the_service_reads():
+    names = _webhook_ops()["jobs"]["run"]["env"]["FLAG_ALLOW_LIST"].split()
+    assert names and len(set(names)) == len(names)
+    assert [n for n in names if any(m in n for m in CREDENTIAL_MARKERS)] == []
+    codna = ROOT / "cli" / "codna"
+    source = "".join(p.read_text(encoding="utf-8") for p in sorted(codna.glob("*.py")))
+    unread = [n for n in names if f'"{n}"' not in source and f"'{n}'" not in source]
+    assert unread == [], f"allow-listed flags nothing in cli/codna reads: {unread}"
+    # the step validates against THAT list, not a copy of it
+    run = _ops_step("set-flags")["run"]
+    assert "$FLAG_ALLOW_LIST" in run
+    assert not any(n in run.split("case \"$name\" in")[0].split("allowed=")[0] for n in names), \
+        "the allow-list must not be duplicated inside the step"
+
+
+def test_webhook_ops_set_flags_validates_every_pair_before_it_writes():
+    run = _ops_step("set-flags")["run"]
+    for needle in ("is not an allow-listed rollout flag", "is not NAME=VALUE", "the value must match"):
+        assert needle in run
+    assert run.index("the value must match") < run.index("flyctl secrets set"), "validation precedes the write"
+    assert run.index("flyctl secrets set") < run.index("GITHUB_STEP_SUMMARY")
+    assert "redeploys every machine" in run, "the run summary must say Fly redeploys on a secrets change"
+    # every value pattern is anchored and closed: nothing can smuggle a second NAME=VALUE through
+    for pattern in re.findall(r"pattern='([^']+)'", run):
+        assert pattern.startswith("^") and pattern.endswith("$"), pattern
+
+
+def test_webhook_ops_secret_minting_steps_mask_first_and_never_echo_a_value():
+    text = WEBHOOK_OPS.read_text(encoding="utf-8")
+    assert "set -x" not in text
+    for action in ("rotate-ops-token", "worker-token", "worker-secrets"):
+        run = _ops_step(action)["run"]
+        assert "::add-mask::" in run, action
+        assert run.index("::add-mask::") < run.index("flyctl secrets set"), f"{action}: mask before use"
+        secret_var = r"\$\{?(token|value|b64|out|line)\b"
+        for line in run.splitlines():
+            if "::add-mask::" in line or not re.search(secret_var, line):
+                continue
+            # an echo whose ARGUMENT names one of these variables would print a secret
+            assert not re.search(r"\becho\b[^;|&]*" + secret_var, line), f"{action}: echoes a secret-bearing variable: {line.strip()}"
+            if re.search(r"\bprintf\b[^;|&]*" + secret_var, line):
+                assert "|" in line, f"{action}: printf of a secret-bearing variable must feed a pipe, not the log: {line.strip()}"
+
+
+def test_webhook_ops_worker_secrets_refuses_a_partial_set_and_copies_exactly_the_runbook_names():
+    run = _ops_step("worker-secrets")["run"]
+    runbook = (ROOT / "infra" / "README-webhook-deploy.md").read_text(encoding="utf-8")
+    names = re.search(r'names="([^"]+)"', run).group(1).split()
+    assert set(names) == {"GITHUB_APP_ID", "GITHUB_APP_PRIVATE_KEY", "CODNA_ENGINE_URL", "CODNA_WEBHOOK_INTERNAL_SECRET"}
+    assert all(f"`{n}`" in runbook for n in names)
+    for forbidden in ("FLY_API_TOKEN", "CODNA_GITHUB_WEBHOOK_SECRET", "CODNA_WEBHOOK_OPS_TOKEN"):
+        assert forbidden not in names
+    assert "refusing to configure" in run and run.index("refusing to configure") < run.index("flyctl secrets set")
+
+
+def test_webhook_ops_mpg_steps_redact_the_connection_string_flyctl_prints():
+    for action in ("mpg-create", "mpg-attach"):
+        run = _ops_step(action)["run"].replace("\\\n", " ")  # join shell continuation lines
+        redact = [line for line in run.splitlines() if re.match(r"\s*flyctl mpg (create|attach)\b", line)]
+        assert redact and all("redacted" in line for line in redact), (action, redact)
+        assert "--yes" not in run, f"{action}: flyctl mpg create/attach have no --yes flag (cobra rejects unknown flags)"
+
+
+def test_webhook_ops_actions_that_read_repo_files_check_the_repository_out_first():
+    steps = _ops_steps()
+    [checkout] = [s for s in steps if str(s.get("uses", "")).startswith("actions/checkout@")]
+    assert checkout["with"]["persist-credentials"] is False
+    covered = set(ACTION_LITERAL.findall(str(checkout["if"])))
+    needs_repo = {
+        action
+        for s in steps if "run" in s
+        for action in ACTION_LITERAL.findall(str(s.get("if", "")))
+        if "infra/" in str(s.get("env", "")) or "infra/" in s["run"]
+    }
+    assert needs_repo and needs_repo <= covered, {"needs checkout": needs_repo, "checked out": covered}
+
+
+def test_webhook_ops_worker_pool_takes_its_environment_from_the_worker_toml():
+    run = _ops_step("worker-pool-reconcile")["run"]
+    assert "machine create" in run and "--skip-launch" not in run, "create = created stopped; run has no --skip-launch"
+    assert 'tomllib.load(fh)["env"]' in run and '"${envflags[@]}"' in run
+    assert "CODNA_WEBHOOK_ROLE=worker" not in run, "no hand-copied env: the toml is the single source"
+
+
+def test_webhook_ops_keeps_the_default_token_powerless():
+    doc = _webhook_ops()
+    assert doc["permissions"] == {}
+    assert "permissions" not in doc["jobs"]["run"]
+    # only the release PAT is ever handed to a step, and only to the one that writes a repo secret
+    for step in _ops_steps():
+        for value in (step.get("env") or {}).values():
+            if "secrets." in str(value):
+                assert "RELEASE_PLEASE_TOKEN" in str(value) and "rotate-ops-token" in str(step.get("if")), step["name"]
+
+
+# --- webhook-slo.yml: an absent gauge is 0, not an alert ------------------------------------------------
+
+def _slo_decide_script() -> str:
+    doc = yaml.safe_load((WORKFLOWS / "webhook-slo.yml").read_text(encoding="utf-8"))
+    [step] = [s for s in doc["jobs"]["evaluate"]["steps"] if s.get("id") == "decide"]
+    return step["run"]
+
+
+def _run_decide(tmp_path, **env):
+    import os
+    import subprocess
+
+    out = tmp_path / "out.txt"
+    out.write_text("")
+    base = dict(VERDICT="not_measured", P95="", SAMPLES="0", BACKEND="sqlite", PG_UP="0", OLDEST="",
+                DEAD="", CEILING="", SCALER_ERRORS="", SPOOL="")
+    base.update(env)
+    proc = subprocess.run(["bash", "-c", _slo_decide_script()], env={**os.environ, **base, "GITHUB_OUTPUT": str(out)},
+                          capture_output=True, text=True, check=False)
+    assert proc.returncode == 0, proc.stderr
+    return out.read_text()
+
+
+def test_webhook_slo_absent_gauges_do_not_alert(tmp_path):
+    # On the sqlite backend dead_total / scaler_errors_total are not rendered at all: the gauge
+    # reader yields "" and that must read as 0 (it alerted as "dead-lettered job(s)" on 2026-09-20).
+    assert "alert=false" in _run_decide(tmp_path)
+
+
+def test_webhook_slo_present_conditions_still_alert(tmp_path):
+    body = _run_decide(tmp_path, DEAD="2", SCALER_ERRORS="1")
+    assert "alert=true" in body and "2 dead-lettered job(s)" in body and "scaler errors: 1" in body
+    body = _run_decide(tmp_path, BACKEND="postgres", PG_UP="0", SPOOL="3")
+    assert "alert=true" in body and "pg_up 0" in body and "spooling 3" in body

codna-0.2.61/tests/test_workflows.py

@@ -1,103 +0,0 @@
-"""Contracts over the repository's own GitHub Actions configuration.
-
-Every expectation is derived from the files under .github/ (job lists, workflow names), never
-from a hardcoded count, so adding a workflow cannot silently escape a rule.
-"""
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-import pytest
-import yaml
-
-ROOT = Path(__file__).resolve().parents[2]
-WORKFLOWS = ROOT / ".github" / "workflows"
-WORKFLOW_FILES = sorted(WORKFLOWS.glob("*.yml")) + sorted(WORKFLOWS.glob("*.yaml"))
-
-
-def _jobs(path: Path) -> dict:
-    doc = yaml.safe_load(path.read_text(encoding="utf-8"))
-    assert isinstance(doc, dict), path
-    return doc["jobs"]
-
-
-def test_workflows_are_present():
-    assert WORKFLOW_FILES, "no workflow files found under .github/workflows"
-
-
-@pytest.mark.parametrize("path", WORKFLOW_FILES, ids=lambda p: p.name)
-def test_no_workflow_reads_the_retired_fleet_variable(path):
-    # `fromJSON(vars.RUNNER_LABELS)` fails at workflow PARSE time (zero jobs, no logs) once the
-    # org variable is gone; every job runs on GitHub-hosted runners now.
-    assert "fromJSON(vars.RUNNER_LABELS)" not in path.read_text(encoding="utf-8")
-
-
-@pytest.mark.parametrize("path", WORKFLOW_FILES, ids=lambda p: p.name)
-def test_every_job_declares_a_timeout(path):
-    # GitHub's default is 360 minutes per job, billed on hosted runners. A job that calls a
-    # reusable workflow (`uses:`) may not set timeout-minutes itself; the callee's jobs carry it.
-    missing = [
-        job for job, spec in _jobs(path).items()
-        if "timeout-minutes" not in spec and "uses" not in spec
-    ]
-    assert missing == [], f"{path.name}: jobs without timeout-minutes: {missing}"
-
-
-def test_security_workflow_pins_the_toolchain_by_sha_with_a_version_comment():
-    text = (WORKFLOWS / "security.yml").read_text(encoding="utf-8")
-    uses = [line.strip() for line in text.splitlines() if line.strip().startswith("uses: thyn-ai/security-toolchain/")]
-    assert len(uses) == 1, uses
-    assert re.fullmatch(
-        r"uses: thyn-ai/security-toolchain/\.github/workflows/security-full\.yml@[0-9a-f]{40} # v\d+\.\d+\.\d+",
-        uses[0],
-    ), uses[0]
-
-
-def test_dependabot_leaves_the_toolchain_pin_to_propagate():
-    doc = yaml.safe_load((ROOT / ".github" / "dependabot.yml").read_text(encoding="utf-8"))
-    actions = [
-        u
-        for u in doc["updates"]
-        if u["package-ecosystem"] == "github-actions" and u.get("directory") == "/"
-    ]
-    assert actions, "no github-actions block covers .github/workflows"
-    ignored = [entry["dependency-name"] for block in actions for entry in block.get("ignore", [])]
-    # Dependabot names a reusable workflow by its full path, so only a wildcard can match it.
-    assert any(name.startswith("thyn-ai/security-toolchain") and name.endswith("*") for name in ignored), ignored
-
-
-# --- webhook-slo.yml: an absent gauge is 0, not an alert ------------------------------------------------
-
-def _slo_decide_script() -> str:
-    doc = yaml.safe_load((WORKFLOWS / "webhook-slo.yml").read_text(encoding="utf-8"))
-    [step] = [s for s in doc["jobs"]["evaluate"]["steps"] if s.get("id") == "decide"]
-    return step["run"]
-
-
-def _run_decide(tmp_path, **env):
-    import os
-    import subprocess
-
-    out = tmp_path / "out.txt"
-    out.write_text("")
-    base = dict(VERDICT="not_measured", P95="", SAMPLES="0", BACKEND="sqlite", PG_UP="0", OLDEST="",
-                DEAD="", CEILING="", SCALER_ERRORS="", SPOOL="")
-    base.update(env)
-    proc = subprocess.run(["bash", "-c", _slo_decide_script()], env={**os.environ, **base, "GITHUB_OUTPUT": str(out)},
-                          capture_output=True, text=True, check=False)
-    assert proc.returncode == 0, proc.stderr
-    return out.read_text()
-
-
-def test_webhook_slo_absent_gauges_do_not_alert(tmp_path):
-    # On the sqlite backend dead_total / scaler_errors_total are not rendered at all: the gauge
-    # reader yields "" and that must read as 0 (it alerted as "dead-lettered job(s)" on 2026-09-20).
-    assert "alert=false" in _run_decide(tmp_path)
-
-
-def test_webhook_slo_present_conditions_still_alert(tmp_path):
-    body = _run_decide(tmp_path, DEAD="2", SCALER_ERRORS="1")
-    assert "alert=true" in body and "2 dead-lettered job(s)" in body and "scaler errors: 1" in body
-    body = _run_decide(tmp_path, BACKEND="postgres", PG_UP="0", SPOOL="3")
-    assert "alert=true" in body and "pg_up 0" in body and "spooling 3" in body