codna 0.2.74__tar.gz → 0.2.75__tar.gz

{codna-0.2.74 → codna-0.2.75}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.74
+Version: 0.2.75
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.74 → codna-0.2.75}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.74"
+__version__ = "0.2.75"

{codna-0.2.74 → codna-0.2.75}/codna/webhook_github.py

@@ -22,8 +22,15 @@ _API = "https://api.github.com"
 # round-trip happens once, not per job.
 _WORKFLOWS_GRANTED: dict[str, bool] = {}
 
+# installation id -> whether the App has the `statuses` permission there (Commit statuses: read),
+# learned the same way from the first review-token request per process. Requesting a permission the
+# installation never granted makes GitHub refuse the WHOLE mint (422), so an installation without it
+# gets a review token without `statuses` -- the review then sees check runs but no commit statuses
+# (a Vercel deployment reports as one), and the operator log says so once.
+_STATUSES_GRANTED: dict[str, bool] = {}
 
-def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, str]:
+
+def token_permissions_for(kind: str, *, workflows: bool = False, statuses: bool = False) -> dict[str, str]:
     """Least-privilege installation-token permissions for a job kind.
 
     fix needs to push a branch + open a PR; secure only reads code + code-scanning results.
@@ -32,6 +39,11 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
     .github/workflows files differ from the default branch -- which is every PR branch that
     predates a workflow change on main (thyn-ai/algenta#1003, 2026-09-17), even though the fix
     commit itself never touches a workflow.
+
+    ``statuses=True`` adds `statuses: read` to a review token: the PR head's ``statusCheckRollup``
+    (review_github.failing_required_checks) lists commit statuses -- a Vercel deployment reports as
+    one -- only to a token that may read them; without it the review sees check runs alone and
+    approved thyn-ai/codna-site#57 with no word about its FAILED required `Vercel` status.
     """
     if kind == "fix":
         perms = {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
@@ -42,7 +54,10 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
         return {"contents": "read", "security_events": "read", "checks": "write", "issues": "write"}
     if kind == "review":
         # Read code, write PR review comments + a check. No contents:write — review never pushes.
-        return {"contents": "read", "pull_requests": "write", "checks": "write"}
+        perms = {"contents": "read", "pull_requests": "write", "checks": "write"}
+        if statuses:
+            perms["statuses"] = "read"
+        return perms
     if kind == "queue":
         # Read the PR head + its check runs, write ONE check on the merge-group commit.
         return {"pull_requests": "read", "checks": "write"}
@@ -57,10 +72,12 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
     raise WebhookError("unknown_job_kind", f"no token scope for job kind {kind!r}")
 
 
-def scoped_token_request(repo_full_name: str, kind: str, *, workflows: bool = False) -> dict[str, Any]:
+def scoped_token_request(repo_full_name: str, kind: str, *, workflows: bool = False,
+                         statuses: bool = False) -> dict[str, Any]:
     """Body for POST /app/installations/{id}/access_tokens — scoped to the one repo + minimal perms."""
     repo_name = repo_full_name.split("/", 1)[-1]
-    return {"repositories": [repo_name], "permissions": token_permissions_for(kind, workflows=workflows)}
+    return {"repositories": [repo_name],
+            "permissions": token_permissions_for(kind, workflows=workflows, statuses=statuses)}
 
 
 def normalize_private_key_pem(private_key_pem: str) -> str:
@@ -125,22 +142,39 @@ def installation_token(
     except Exception as exc:  # noqa: BLE001
         raise WebhookError("github_app_auth_unavailable", f"cannot sign App JWT: {exc}") from exc
 
-    def _mint(with_workflows: bool):
+    def _mint(*, with_workflows: bool, with_statuses: bool):
         return httpx.post(
             f"{_API}/app/installations/{installation_id}/access_tokens",
             headers={"Authorization": f"Bearer {jwt}", "Accept": "application/vnd.github+json"},
-            json=scoped_token_request(repo_full_name, kind, workflows=with_workflows),
+            json=scoped_token_request(repo_full_name, kind, workflows=with_workflows, statuses=with_statuses),
             timeout=30.0, follow_redirects=True,
         )
 
-    want_workflows = kind == "fix" and _WORKFLOWS_GRANTED.get(str(installation_id), True)
-    resp = _mint(want_workflows)
-    if want_workflows and resp.status_code == 422 and "permission" in resp.text.lower():
-        # The App has not been granted `workflows` on this installation: remember, mint without it.
-        _WORKFLOWS_GRANTED[str(installation_id)] = False
-        resp = _mint(False)
-    elif want_workflows and resp.status_code < 300:
-        _WORKFLOWS_GRANTED[str(installation_id)] = True
+    # The one OPTIONAL permission a kind asks for -- `workflows` (fix) or `statuses` (review) -- is
+    # requested until this installation says it never granted it; GitHub answers 422 for the whole
+    # mint then, so the token is minted once more without it and the answer is remembered per process.
+    inst = str(installation_id)
+    want_workflows = kind == "fix" and _WORKFLOWS_GRANTED.get(inst, True)
+    want_statuses = kind == "review" and _STATUSES_GRANTED.get(inst, True)
+    resp = _mint(with_workflows=want_workflows, with_statuses=want_statuses)
+    if (want_workflows or want_statuses) and resp.status_code == 422 and "permission" in resp.text.lower():
+        if want_workflows:
+            # The App has not been granted `workflows` on this installation: remember, mint without it.
+            _WORKFLOWS_GRANTED[inst] = False
+        if want_statuses:
+            # Not granted `Commit statuses: read` here (multi-tenant: each installation grants the
+            # App's new permissions on its own schedule). The review runs on check runs alone; a
+            # failed commit status such as Vercel cannot be named until the installation grants it.
+            _STATUSES_GRANTED[inst] = False
+            _warn("statuses_permission_missing", installation_id=inst, repo=repo_full_name, kind=kind,
+                  effect="commit statuses (e.g. Vercel) are invisible to the review's red-head check",
+                  remedy="accept the App's 'Commit statuses: read' permission on this installation")
+        resp = _mint(with_workflows=False, with_statuses=False)
+    elif (want_workflows or want_statuses) and resp.status_code < 300:
+        if want_workflows:
+            _WORKFLOWS_GRANTED[inst] = True
+        if want_statuses:
+            _STATUSES_GRANTED[inst] = True
     if resp.status_code >= 300:
         raise WebhookError("installation_token_failed", f"installation token: {resp.status_code} {resp.text[:200]}")
     token = resp.json().get("token")

{codna-0.2.74 → codna-0.2.75}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.74
+Version: 0.2.75
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.74 → codna-0.2.75}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.74"
+version = "0.2.75"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.74 → codna-0.2.75}/tests/test_review_red_head.py

@@ -115,6 +115,35 @@ def test_failing_required_checks_walks_a_rollup_longer_than_one_page(monkeypatch
     assert rg.failing_required_checks("o/r", 1, "tok") is None
 
 
+def test_a_failed_commit_status_alone_is_named_in_the_red_head_note(monkeypatch):
+    """The codna-site#57 case end to end: the head's only red required context is a StatusContext
+    (Vercel, FAILURE -- a deployment, not a check run). With a token that may read commit statuses the
+    rollup carries it, and the note names it as `Vercel` (failure)."""
+    nodes = [_green("full / security gate"), _green("codna review"),
+             {"__typename": "StatusContext", "context": "Vercel", "state": "FAILURE", "isRequired": True},
+             {"__typename": "StatusContext", "context": "Vercel – preview", "state": "SUCCESS", "isRequired": True}]
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _Resp(_rollup(nodes)))
+    red = rg.failing_required_checks("thyn-ai/codna-site", 57, "tok-with-statuses-read")
+    assert red == [{"name": "Vercel", "state": "FAILURE", "head_sha": HEAD}]
+    note = rg.red_head_note(red)
+    assert "`Vercel` (failure)" in note and "head 615e29ce is red" in note
+    # an ERROR status is red too; a PENDING or SUCCESS one is not
+    nodes[2]["state"] = "ERROR"
+    assert rg.red_head_note(rg.failing_required_checks("thyn-ai/codna-site", 57, "tok")).count("`Vercel` (error)") == 1
+    nodes[2]["state"] = "PENDING"
+    assert rg.failing_required_checks("thyn-ai/codna-site", 57, "tok") == []
+
+
+def test_a_token_without_statuses_read_sees_no_commit_status_and_the_note_stays_silent(monkeypatch):
+    """What the review saw on codna-site#57 before the App had Commit statuses: read: GitHub lists the
+    check runs only, the rollup is certain-and-green, and nothing is said -- the reason the review
+    token now asks for `statuses: read` (webhook_github.token_permissions_for)."""
+    check_runs_only = [n for n in SITE_57 if n["__typename"] == "CheckRun"]
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _Resp(_rollup(check_runs_only)))
+    assert rg.failing_required_checks("thyn-ai/codna-site", 57, "tok-without-statuses") == []
+    assert rg.red_head_note([]) == ""
+
+
 def test_red_head_note_is_one_line_naming_the_checks_and_the_head():
     note = rg.red_head_note([{"name": "Vercel", "state": "FAILURE", "head_sha": HEAD},
                              {"name": "ci / cli tests", "state": "TIMED_OUT", "head_sha": HEAD}])

{codna-0.2.74 → codna-0.2.75}/tests/test_webhook.py

@@ -240,6 +240,11 @@ def test_review_token_scope_has_no_contents_write():
     perms = token_permissions_for("review")
     assert perms == {"contents": "read", "pull_requests": "write", "checks": "write"}
     assert perms["contents"] == "read"  # review NEVER pushes code
+    # with Commit statuses granted the review token may also READ commit statuses (a failed Vercel
+    # deployment is one); nothing else changes, and nothing becomes writable
+    with_statuses = token_permissions_for("review", statuses=True)
+    assert with_statuses == {**perms, "statuses": "read"}
+    assert [v for k, v in with_statuses.items() if k != "pull_requests" and k != "checks"] == ["read", "read"]
 
 
 # ---- @codna fix wedge: route a review finding into a verified fix PR ---------------------------

{codna-0.2.74 → codna-0.2.75}/tests/test_webhook_github.py

@@ -359,11 +359,83 @@ def test_fix_token_falls_back_without_workflows_when_github_says_not_granted(mon
 
 def test_review_tokens_never_ask_for_workflows(monkeypatch):
     webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
     sent = _fake_post(monkeypatch, [_Resp(201, {"token": "r"})])
     webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review")
     assert "workflows" not in sent[0]["permissions"] and "contents" in sent[0]["permissions"]
 
 
+# --- review tokens ask for `statuses: read` (Commit statuses) so the PR head's failed commit statuses
+# --- -- a Vercel deployment reports as one -- are visible to failing_required_checks; an installation
+# --- that never granted it makes GitHub refuse the whole mint (422), so the token is minted once more
+# --- without it, the answer is remembered, and the operator log says so (thyn-ai/codna-site#57).
+
+def test_review_token_requests_statuses_read_and_remembers_it_is_granted(monkeypatch, capsys):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [_Resp(201, {"token": "r1"})])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review") == "r1"
+    assert len(sent) == 1  # one mint, no fallback round-trip
+    assert sent[0]["permissions"] == {"contents": "read", "pull_requests": "write", "checks": "write", "statuses": "read"}
+    assert sent[0]["repositories"] == ["app"]
+    assert webhook_github._STATUSES_GRANTED["42"] is True
+    assert "statuses_permission_missing" not in capsys.readouterr().err
+
+
+def test_review_token_falls_back_without_statuses_when_github_says_not_granted(monkeypatch, capsys):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [
+        _Resp(422, text='{"message":"The permissions requested are not granted to this installation."}'),
+        _Resp(201, {"token": "r2"}),
+    ])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review") == "r2"
+    assert sent[0]["permissions"]["statuses"] == "read" and "statuses" not in sent[1]["permissions"]
+    # every other permission is identical on the retry: only the ungranted one is dropped
+    assert {k: v for k, v in sent[0]["permissions"].items() if k != "statuses"} == sent[1]["permissions"]
+    assert sent[1]["permissions"] == {"contents": "read", "pull_requests": "write", "checks": "write"}
+    assert webhook_github._STATUSES_GRANTED["42"] is False
+    err = capsys.readouterr().err
+    import json as _json
+    logged = _json.loads(next(ln for ln in err.splitlines() if "statuses_permission_missing" in ln))
+    assert logged["event"] == "statuses_permission_missing" and logged["level"] == "warning"
+    assert logged["installation_id"] == "42" and logged["repo"] == "acme/app" and logged["kind"] == "review"
+    assert "Commit statuses: read" in logged["remedy"]
+    assert "r2" not in err and "jwt" not in err  # never a token in the log
+    # the next mint for that installation does not ask again, and does not log again
+    sent2 = _fake_post(monkeypatch, [_Resp(201, {"token": "r3"})])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review") == "r3"
+    assert len(sent2) == 1 and "statuses" not in sent2[0]["permissions"]
+    assert "statuses_permission_missing" not in capsys.readouterr().err
+    # a DIFFERENT installation is asked on its own account (multi-tenant: grants are per installation)
+    sent3 = _fake_post(monkeypatch, [_Resp(201, {"token": "r4"})])
+    webhook_github.installation_token("1", "pem", 43, repo_full_name="other/app", kind="review")
+    assert sent3[0]["permissions"]["statuses"] == "read" and webhook_github._STATUSES_GRANTED["43"] is True
+
+
+def test_review_mint_422_for_another_reason_is_still_an_error_not_a_silent_retry(monkeypatch):
+    """A 422 that is not about permissions (a repository the installation cannot see) is raised as
+    before: the fallback exists for the one ungranted permission, not to mask every refusal."""
+    webhook_github._STATUSES_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [
+        _Resp(422, text='{"message":"There is at least one repository that does not exist or is not accessible to the parent installation."}'),
+    ])
+    with pytest.raises(WebhookError) as exc:
+        webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/gone", kind="review")
+    assert exc.value.code == "installation_token_failed" and len(sent) == 1
+    assert "42" not in webhook_github._STATUSES_GRANTED  # nothing learned from an unrelated refusal
+
+
+def test_fix_and_other_tokens_never_ask_for_statuses(monkeypatch):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
+    for kind in ("fix", "secure", "queue", "ci_triage", "ci_rerun"):
+        sent = _fake_post(monkeypatch, [_Resp(201, {"token": "t"})])
+        webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind=kind)
+        assert "statuses" not in sent[0]["permissions"], kind
+    assert token_permissions_for("fix", statuses=True) == token_permissions_for("fix")  # the flag is review-only
+
+
 
 def test_workflows_differ_compares_path_and_blob_sha_sets(monkeypatch):
     import httpx