codna 0.2.74__tar.gz → 0.2.76__tar.gz

{codna-0.2.74 → codna-0.2.76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.74
+Version: 0.2.76
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.74 → codna-0.2.76}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.74"
+__version__ = "0.2.76"

{codna-0.2.74 → codna-0.2.76}/codna/webhook_github.py

@@ -22,8 +22,15 @@ _API = "https://api.github.com"
 # round-trip happens once, not per job.
 _WORKFLOWS_GRANTED: dict[str, bool] = {}
 
+# installation id -> whether the App has the `statuses` permission there (Commit statuses: read),
+# learned the same way from the first review-token request per process. Requesting a permission the
+# installation never granted makes GitHub refuse the WHOLE mint (422), so an installation without it
+# gets a review token without `statuses` -- the review then sees check runs but no commit statuses
+# (a Vercel deployment reports as one), and the operator log says so once.
+_STATUSES_GRANTED: dict[str, bool] = {}
 
-def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, str]:
+
+def token_permissions_for(kind: str, *, workflows: bool = False, statuses: bool = False) -> dict[str, str]:
     """Least-privilege installation-token permissions for a job kind.
 
     fix needs to push a branch + open a PR; secure only reads code + code-scanning results.
@@ -32,6 +39,11 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
     .github/workflows files differ from the default branch -- which is every PR branch that
     predates a workflow change on main (thyn-ai/algenta#1003, 2026-09-17), even though the fix
     commit itself never touches a workflow.
+
+    ``statuses=True`` adds `statuses: read` to a review token: the PR head's ``statusCheckRollup``
+    (review_github.failing_required_checks) lists commit statuses -- a Vercel deployment reports as
+    one -- only to a token that may read them; without it the review sees check runs alone and
+    approved thyn-ai/codna-site#57 with no word about its FAILED required `Vercel` status.
     """
     if kind == "fix":
         perms = {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
@@ -42,7 +54,10 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
         return {"contents": "read", "security_events": "read", "checks": "write", "issues": "write"}
     if kind == "review":
         # Read code, write PR review comments + a check. No contents:write — review never pushes.
-        return {"contents": "read", "pull_requests": "write", "checks": "write"}
+        perms = {"contents": "read", "pull_requests": "write", "checks": "write"}
+        if statuses:
+            perms["statuses"] = "read"
+        return perms
     if kind == "queue":
         # Read the PR head + its check runs, write ONE check on the merge-group commit.
         return {"pull_requests": "read", "checks": "write"}
@@ -57,10 +72,12 @@ def token_permissions_for(kind: str, *, workflows: bool = False) -> dict[str, st
     raise WebhookError("unknown_job_kind", f"no token scope for job kind {kind!r}")
 
 
-def scoped_token_request(repo_full_name: str, kind: str, *, workflows: bool = False) -> dict[str, Any]:
+def scoped_token_request(repo_full_name: str, kind: str, *, workflows: bool = False,
+                         statuses: bool = False) -> dict[str, Any]:
     """Body for POST /app/installations/{id}/access_tokens — scoped to the one repo + minimal perms."""
     repo_name = repo_full_name.split("/", 1)[-1]
-    return {"repositories": [repo_name], "permissions": token_permissions_for(kind, workflows=workflows)}
+    return {"repositories": [repo_name],
+            "permissions": token_permissions_for(kind, workflows=workflows, statuses=statuses)}
 
 
 def normalize_private_key_pem(private_key_pem: str) -> str:
@@ -125,22 +142,39 @@ def installation_token(
     except Exception as exc:  # noqa: BLE001
         raise WebhookError("github_app_auth_unavailable", f"cannot sign App JWT: {exc}") from exc
 
-    def _mint(with_workflows: bool):
+    def _mint(*, with_workflows: bool, with_statuses: bool):
         return httpx.post(
             f"{_API}/app/installations/{installation_id}/access_tokens",
             headers={"Authorization": f"Bearer {jwt}", "Accept": "application/vnd.github+json"},
-            json=scoped_token_request(repo_full_name, kind, workflows=with_workflows),
+            json=scoped_token_request(repo_full_name, kind, workflows=with_workflows, statuses=with_statuses),
             timeout=30.0, follow_redirects=True,
         )
 
-    want_workflows = kind == "fix" and _WORKFLOWS_GRANTED.get(str(installation_id), True)
-    resp = _mint(want_workflows)
-    if want_workflows and resp.status_code == 422 and "permission" in resp.text.lower():
-        # The App has not been granted `workflows` on this installation: remember, mint without it.
-        _WORKFLOWS_GRANTED[str(installation_id)] = False
-        resp = _mint(False)
-    elif want_workflows and resp.status_code < 300:
-        _WORKFLOWS_GRANTED[str(installation_id)] = True
+    # The one OPTIONAL permission a kind asks for -- `workflows` (fix) or `statuses` (review) -- is
+    # requested until this installation says it never granted it; GitHub answers 422 for the whole
+    # mint then, so the token is minted once more without it and the answer is remembered per process.
+    inst = str(installation_id)
+    want_workflows = kind == "fix" and _WORKFLOWS_GRANTED.get(inst, True)
+    want_statuses = kind == "review" and _STATUSES_GRANTED.get(inst, True)
+    resp = _mint(with_workflows=want_workflows, with_statuses=want_statuses)
+    if (want_workflows or want_statuses) and resp.status_code == 422 and "permission" in resp.text.lower():
+        if want_workflows:
+            # The App has not been granted `workflows` on this installation: remember, mint without it.
+            _WORKFLOWS_GRANTED[inst] = False
+        if want_statuses:
+            # Not granted `Commit statuses: read` here (multi-tenant: each installation grants the
+            # App's new permissions on its own schedule). The review runs on check runs alone; a
+            # failed commit status such as Vercel cannot be named until the installation grants it.
+            _STATUSES_GRANTED[inst] = False
+            _warn("statuses_permission_missing", installation_id=inst, repo=repo_full_name, kind=kind,
+                  effect="commit statuses (e.g. Vercel) are invisible to the review's red-head check",
+                  remedy="accept the App's 'Commit statuses: read' permission on this installation")
+        resp = _mint(with_workflows=False, with_statuses=False)
+    elif (want_workflows or want_statuses) and resp.status_code < 300:
+        if want_workflows:
+            _WORKFLOWS_GRANTED[inst] = True
+        if want_statuses:
+            _STATUSES_GRANTED[inst] = True
     if resp.status_code >= 300:
         raise WebhookError("installation_token_failed", f"installation token: {resp.status_code} {resp.text[:200]}")
     token = resp.json().get("token")

{codna-0.2.74 → codna-0.2.76}/codna/webhook_ops.py

@@ -6,7 +6,13 @@ One implementation of every verb (:func:`run_verb`) behind three fronts:
 * HTTP on the ingress, ``Authorization: Bearer $CODNA_WEBHOOK_OPS_TOKEN`` (its own secret,
   compared in constant time; the webhook HMAC secret is NOT reused -- ``/debug/queue`` used to,
   and stops here);
-* the CLI, run inside a machine with ``DATABASE_URL`` (``fly ssh console -C "codna webhook ops …"``);
+* the CLI, run inside a machine with ``DATABASE_URL`` (``fly ssh console -C "codna webhook ops …"``).
+  A verb whose answer is the SERVING process's state rather than a table (:data:`LIVE_VERBS`:
+  ``scaler``) is asked of the running server over its own loopback ``/ops/<verb>``, with the
+  machine's ``CODNA_WEBHOOK_OPS_TOKEN`` -- a separate CLI process builds no Scaler, so its own
+  view could only ever say "not configured" (it did, 2026-09-20, while the token was set). The
+  answer carries ``"view": "live"``; when that call cannot be made the CLI's own view is printed
+  with ``"view": "cli-rebuild"`` and the reason;
 * ``webhook-ops.yml`` (``workflow_dispatch``), which wraps the CLI so nobody needs a Fly login.
 
 Every mutation records its ``actor`` in ``job_events``. Nothing here is reachable on the
@@ -29,6 +35,10 @@ from .webhook_pg_queue import PostgresQueue
 OPS_TOKEN_ENV = "CODNA_WEBHOOK_OPS_TOKEN"
 VERBS = ("jobs", "job", "cancel", "retry-now", "reprioritize", "tenant", "tenants", "workers", "drain", "undrain",
          "scaler", "slo", "dead", "metrics", "redeliver-sweep", "events")
+# Verbs whose answer is the state of the serving process (its Scaler thread), not a row in the
+# shared table: a separate CLI process has none of it, so the CLI asks the live server instead.
+LIVE_VERBS = ("scaler",)
+LIVE_PORT_ENV = "CODNA_WEBHOOK_PORT"
 
 
 def ops_authorized(headers: Mapping[str, str], environ: Mapping[str, str] | None = None) -> bool:
@@ -185,6 +195,46 @@ def handle_ops_get(path: str, headers: Mapping[str, str], *, queue: Any, actor_e
 
 
 # --- the CLI front (webhook_cli.cmd_webhook dispatches here) ----------------------------------------
+def _live_client() -> Any:
+    import httpx
+
+    return httpx.Client(timeout=5.0)
+
+
+def live_verb(verb: str, args: Mapping[str, Any], *, actor: str,
+              environ: Mapping[str, str] | None = None) -> tuple[dict[str, Any] | None, str]:
+    """The RUNNING server's answer to ``verb``: its own loopback ``/ops/<verb>``, authenticated with
+    the ``CODNA_WEBHOOK_OPS_TOKEN`` of this environment (the ingress machine holds it for its HTTP
+    front). Returns ``(payload + {"view": "live"}, "")``, or ``(None, reason)`` when the call cannot
+    be made -- no ops token here, nothing listening on the port, a non-200 -- where the reason names
+    an exception class or a status code and never the token."""
+    import httpx
+
+    e = os.environ if environ is None else environ
+    token = (e.get(OPS_TOKEN_ENV) or "").strip()
+    if not token:
+        return None, f"{OPS_TOKEN_ENV} is not set in this process's environment"
+    port = (e.get(LIVE_PORT_ENV) or "8080").strip()
+    params = {k: str(v) for k, v in args.items() if v not in (None, "")}
+    params["actor"] = actor
+    try:
+        with _live_client() as client:
+            resp = client.get(f"http://127.0.0.1:{port}/ops/{verb}", params=params,
+                              headers={"Authorization": f"Bearer {token}"})
+    except (httpx.HTTPError, httpx.InvalidURL) as exc:
+        # InvalidURL is not an HTTPError: a CODNA_WEBHOOK_PORT that is not a port lands here too.
+        return None, f"loopback /ops/{verb} unreachable: {type(exc).__name__}"
+    if resp.status_code != 200:
+        return None, f"loopback /ops/{verb} answered HTTP {resp.status_code}"
+    try:
+        payload = resp.json()
+    except ValueError:
+        return None, f"loopback /ops/{verb} answered a non-JSON body"
+    if not isinstance(payload, dict):
+        return None, f"loopback /ops/{verb} answered a non-object body"
+    return {**payload, "view": "live"}, ""
+
+
 def add_ops_parser(pw_sub: argparse._SubParsersAction) -> None:
     """``codna webhook ops <verb> [options]`` + ``migrate`` + ``queue export|import``."""
     po = pw_sub.add_parser("ops", help="Operate the hosted webhook queue (Postgres backend; needs DATABASE_URL).")
@@ -215,16 +265,27 @@ def add_ops_parser(pw_sub: argparse._SubParsersAction) -> None:
 def cli_ops(args: argparse.Namespace) -> int:
     from .webhook_pg_schema import database_url
 
+    params = {k: getattr(args, k) for k in ("id", "priority", "status", "kind", "repo", "installation", "action",
+                                              "value", "owner", "reason", "limit") if getattr(args, k, None) is not None}
+    who = args.actor or os.environ.get("USER") or "operator"
+    live_unavailable = ""
+    if args.verb in LIVE_VERBS:
+        live, live_unavailable = live_verb(args.verb, params, actor=who)
+        if live is not None:
+            print(json.dumps(live, indent=2, sort_keys=True, default=str))
+            return 0
     url = database_url()
     if not url:
         print("codna: `codna webhook ops` needs DATABASE_URL (or CODNA_WEBHOOK_DATABASE_URL)", file=sys.stderr)
         return 2
     queue = PostgresQueue(url, heartbeat_s=0, pool_max=2)
     try:
-        params = {k: getattr(args, k) for k in ("id", "priority", "status", "kind", "repo", "installation", "action",
-                                                  "value", "owner", "reason", "limit") if getattr(args, k, None) is not None}
-        actor = f"ops-cli:{args.actor or os.environ.get('USER') or 'operator'}"
+        actor = f"ops-cli:{who}"
         out = run_verb(queue, args.verb, params, actor=actor)
+        if args.verb in LIVE_VERBS:
+            # This process built no Scaler, so its own answer says nothing about the serving one.
+            out = {**out, "view": "cli-rebuild", "live_unavailable": live_unavailable,
+                   "hint": "the serving process answers GET /ops/scaler on the ingress; this CLI process has no Scaler of its own"}
         if args.verb == "metrics":
             sys.stdout.write(str(out["text"]))
         else:

{codna-0.2.74 → codna-0.2.76}/codna/webhook_scaler.py

@@ -391,11 +391,28 @@ class Scaler:
             pass
 
 
+# The autoscaler's Machines API credential: a deploy token scoped to the WORKER app (`fly tokens
+# create deploy -a codna-webhook-worker`), set as a secret on the ingress. The service's own name
+# is read first; FLY_API_TOKEN -- flyctl's login variable and the name Fly's Machines API docs use
+# -- stays a fallback so an ingress configured under that name keeps its scaler.
+FLY_TOKEN_ENVS = ("CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN")
+
+
+def fly_token_from_env(environ: Any = None) -> str | None:
+    """The first non-blank value among :data:`FLY_TOKEN_ENVS`, or None when neither is set."""
+    e = os.environ if environ is None else environ
+    for name in FLY_TOKEN_ENVS:
+        value = (e.get(name) or "").strip()
+        if value:
+            return value
+    return None
+
+
 def machines_client_from_env(environ: Any = None) -> FlyMachinesClient | None:
-    """None when no ``FLY_API_TOKEN`` is configured -- the scaler then does not run at all, and the
-    floor machines serve alone (exactly today's shape)."""
+    """None when no Fly token is configured under either name in :data:`FLY_TOKEN_ENVS` -- the
+    scaler then does not run at all, and the floor machines serve alone (exactly today's shape)."""
     e = os.environ if environ is None else environ
-    token = e.get("FLY_API_TOKEN")
+    token = fly_token_from_env(e)
     if not token:
         return None
     return FlyMachinesClient(e.get("CODNA_WEBHOOK_WORKER_APP", "codna-webhook-worker"), token,

{codna-0.2.74 → codna-0.2.76}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.74
+Version: 0.2.76
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.74 → codna-0.2.76}/codna.egg-info/SOURCES.txt

@@ -225,6 +225,7 @@ tests/test_webhook_github_ci.py
 tests/test_webhook_lease.py
 tests/test_webhook_metering.py
 tests/test_webhook_ops.py
+tests/test_webhook_ops_cli.py
 tests/test_webhook_pg_queue.py
 tests/test_webhook_queue.py
 tests/test_webhook_queued_check.py

{codna-0.2.74 → codna-0.2.76}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.74"
+version = "0.2.76"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.74 → codna-0.2.76}/tests/test_review_red_head.py

@@ -115,6 +115,35 @@ def test_failing_required_checks_walks_a_rollup_longer_than_one_page(monkeypatch
     assert rg.failing_required_checks("o/r", 1, "tok") is None
 
 
+def test_a_failed_commit_status_alone_is_named_in_the_red_head_note(monkeypatch):
+    """The codna-site#57 case end to end: the head's only red required context is a StatusContext
+    (Vercel, FAILURE -- a deployment, not a check run). With a token that may read commit statuses the
+    rollup carries it, and the note names it as `Vercel` (failure)."""
+    nodes = [_green("full / security gate"), _green("codna review"),
+             {"__typename": "StatusContext", "context": "Vercel", "state": "FAILURE", "isRequired": True},
+             {"__typename": "StatusContext", "context": "Vercel – preview", "state": "SUCCESS", "isRequired": True}]
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _Resp(_rollup(nodes)))
+    red = rg.failing_required_checks("thyn-ai/codna-site", 57, "tok-with-statuses-read")
+    assert red == [{"name": "Vercel", "state": "FAILURE", "head_sha": HEAD}]
+    note = rg.red_head_note(red)
+    assert "`Vercel` (failure)" in note and "head 615e29ce is red" in note
+    # an ERROR status is red too; a PENDING or SUCCESS one is not
+    nodes[2]["state"] = "ERROR"
+    assert rg.red_head_note(rg.failing_required_checks("thyn-ai/codna-site", 57, "tok")).count("`Vercel` (error)") == 1
+    nodes[2]["state"] = "PENDING"
+    assert rg.failing_required_checks("thyn-ai/codna-site", 57, "tok") == []
+
+
+def test_a_token_without_statuses_read_sees_no_commit_status_and_the_note_stays_silent(monkeypatch):
+    """What the review saw on codna-site#57 before the App had Commit statuses: read: GitHub lists the
+    check runs only, the rollup is certain-and-green, and nothing is said -- the reason the review
+    token now asks for `statuses: read` (webhook_github.token_permissions_for)."""
+    check_runs_only = [n for n in SITE_57 if n["__typename"] == "CheckRun"]
+    monkeypatch.setattr(httpx, "post", lambda url, **k: _Resp(_rollup(check_runs_only)))
+    assert rg.failing_required_checks("thyn-ai/codna-site", 57, "tok-without-statuses") == []
+    assert rg.red_head_note([]) == ""
+
+
 def test_red_head_note_is_one_line_naming_the_checks_and_the_head():
     note = rg.red_head_note([{"name": "Vercel", "state": "FAILURE", "head_sha": HEAD},
                              {"name": "ci / cli tests", "state": "TIMED_OUT", "head_sha": HEAD}])

{codna-0.2.74 → codna-0.2.76}/tests/test_webhook.py

@@ -240,6 +240,11 @@ def test_review_token_scope_has_no_contents_write():
     perms = token_permissions_for("review")
     assert perms == {"contents": "read", "pull_requests": "write", "checks": "write"}
     assert perms["contents"] == "read"  # review NEVER pushes code
+    # with Commit statuses granted the review token may also READ commit statuses (a failed Vercel
+    # deployment is one); nothing else changes, and nothing becomes writable
+    with_statuses = token_permissions_for("review", statuses=True)
+    assert with_statuses == {**perms, "statuses": "read"}
+    assert [v for k, v in with_statuses.items() if k != "pull_requests" and k != "checks"] == ["read", "read"]
 
 
 # ---- @codna fix wedge: route a review finding into a verified fix PR ---------------------------

{codna-0.2.74 → codna-0.2.76}/tests/test_webhook_github.py

@@ -359,11 +359,83 @@ def test_fix_token_falls_back_without_workflows_when_github_says_not_granted(mon
 
 def test_review_tokens_never_ask_for_workflows(monkeypatch):
     webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
     sent = _fake_post(monkeypatch, [_Resp(201, {"token": "r"})])
     webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review")
     assert "workflows" not in sent[0]["permissions"] and "contents" in sent[0]["permissions"]
 
 
+# --- review tokens ask for `statuses: read` (Commit statuses) so the PR head's failed commit statuses
+# --- -- a Vercel deployment reports as one -- are visible to failing_required_checks; an installation
+# --- that never granted it makes GitHub refuse the whole mint (422), so the token is minted once more
+# --- without it, the answer is remembered, and the operator log says so (thyn-ai/codna-site#57).
+
+def test_review_token_requests_statuses_read_and_remembers_it_is_granted(monkeypatch, capsys):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [_Resp(201, {"token": "r1"})])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review") == "r1"
+    assert len(sent) == 1  # one mint, no fallback round-trip
+    assert sent[0]["permissions"] == {"contents": "read", "pull_requests": "write", "checks": "write", "statuses": "read"}
+    assert sent[0]["repositories"] == ["app"]
+    assert webhook_github._STATUSES_GRANTED["42"] is True
+    assert "statuses_permission_missing" not in capsys.readouterr().err
+
+
+def test_review_token_falls_back_without_statuses_when_github_says_not_granted(monkeypatch, capsys):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [
+        _Resp(422, text='{"message":"The permissions requested are not granted to this installation."}'),
+        _Resp(201, {"token": "r2"}),
+    ])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review") == "r2"
+    assert sent[0]["permissions"]["statuses"] == "read" and "statuses" not in sent[1]["permissions"]
+    # every other permission is identical on the retry: only the ungranted one is dropped
+    assert {k: v for k, v in sent[0]["permissions"].items() if k != "statuses"} == sent[1]["permissions"]
+    assert sent[1]["permissions"] == {"contents": "read", "pull_requests": "write", "checks": "write"}
+    assert webhook_github._STATUSES_GRANTED["42"] is False
+    err = capsys.readouterr().err
+    import json as _json
+    logged = _json.loads(next(ln for ln in err.splitlines() if "statuses_permission_missing" in ln))
+    assert logged["event"] == "statuses_permission_missing" and logged["level"] == "warning"
+    assert logged["installation_id"] == "42" and logged["repo"] == "acme/app" and logged["kind"] == "review"
+    assert "Commit statuses: read" in logged["remedy"]
+    assert "r2" not in err and "jwt" not in err  # never a token in the log
+    # the next mint for that installation does not ask again, and does not log again
+    sent2 = _fake_post(monkeypatch, [_Resp(201, {"token": "r3"})])
+    assert webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind="review") == "r3"
+    assert len(sent2) == 1 and "statuses" not in sent2[0]["permissions"]
+    assert "statuses_permission_missing" not in capsys.readouterr().err
+    # a DIFFERENT installation is asked on its own account (multi-tenant: grants are per installation)
+    sent3 = _fake_post(monkeypatch, [_Resp(201, {"token": "r4"})])
+    webhook_github.installation_token("1", "pem", 43, repo_full_name="other/app", kind="review")
+    assert sent3[0]["permissions"]["statuses"] == "read" and webhook_github._STATUSES_GRANTED["43"] is True
+
+
+def test_review_mint_422_for_another_reason_is_still_an_error_not_a_silent_retry(monkeypatch):
+    """A 422 that is not about permissions (a repository the installation cannot see) is raised as
+    before: the fallback exists for the one ungranted permission, not to mask every refusal."""
+    webhook_github._STATUSES_GRANTED.clear()
+    sent = _fake_post(monkeypatch, [
+        _Resp(422, text='{"message":"There is at least one repository that does not exist or is not accessible to the parent installation."}'),
+    ])
+    with pytest.raises(WebhookError) as exc:
+        webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/gone", kind="review")
+    assert exc.value.code == "installation_token_failed" and len(sent) == 1
+    assert "42" not in webhook_github._STATUSES_GRANTED  # nothing learned from an unrelated refusal
+
+
+def test_fix_and_other_tokens_never_ask_for_statuses(monkeypatch):
+    webhook_github._WORKFLOWS_GRANTED.clear()
+    webhook_github._STATUSES_GRANTED.clear()
+    for kind in ("fix", "secure", "queue", "ci_triage", "ci_rerun"):
+        sent = _fake_post(monkeypatch, [_Resp(201, {"token": "t"})])
+        webhook_github.installation_token("1", "pem", 42, repo_full_name="acme/app", kind=kind)
+        assert "statuses" not in sent[0]["permissions"], kind
+    assert token_permissions_for("fix", statuses=True) == token_permissions_for("fix")  # the flag is review-only
+
+
 
 def test_workflows_differ_compares_path_and_blob_sha_sets(monkeypatch):
     import httpx

codna-0.2.76/tests/test_webhook_ops_cli.py

@@ -0,0 +1,143 @@
+"""The CLI front of the operator surface, without a database: the autoscaler's token precedence
+(``CODNA_WEBHOOK_FLY_TOKEN`` first, ``FLY_API_TOKEN`` as the fallback) and ``codna webhook ops
+scaler`` answering for the SERVING process through its loopback ``/ops/scaler`` (``"view": "live"``),
+falling back to its own view marked ``"view": "cli-rebuild"`` with the reason. The live path never
+opens the queue and the fallback runs against a stand-in, so none of this needs Postgres."""
+from __future__ import annotations
+
+import argparse
+import json
+
+import httpx
+import pytest
+
+from codna import webhook_ops
+from codna.webhook_ops import LIVE_VERBS, cli_ops, live_verb
+from codna.webhook_scaler import FLY_TOKEN_ENVS, fly_token_from_env, machines_client_from_env
+
+TOKEN = "ops-bearer-for-tests"
+
+
+# --- the Machines API credential -------------------------------------------------------------------------
+
+def test_fly_token_precedence_is_the_services_own_name_then_flyctls():
+    assert FLY_TOKEN_ENVS == ("CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN")
+    assert fly_token_from_env({}) is None
+    assert fly_token_from_env({"FLY_API_TOKEN": "legacy"}) == "legacy"                                   # the fallback still works
+    assert fly_token_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "ours", "FLY_API_TOKEN": "legacy"}) == "ours"
+    assert fly_token_from_env({"CODNA_WEBHOOK_FLY_TOKEN": " \n", "FLY_API_TOKEN": "legacy"}) == "legacy"  # blank = unset
+    assert machines_client_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "", "FLY_API_TOKEN": ""}) is None
+    client = machines_client_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "ours", "FLY_API_TOKEN": "legacy", "CODNA_WEBHOOK_WORKER_APP": "w"})
+    assert client is not None and (client._token, client._app) == ("ours", "w")
+
+
+# --- the live view ---------------------------------------------------------------------------------------
+
+def _client(handler):
+    return lambda: httpx.Client(transport=httpx.MockTransport(handler), timeout=5.0)
+
+
+def _refuse(request):
+    raise httpx.ConnectError("connection refused", request=request)
+
+
+def _never(request):
+    raise AssertionError("no request may be made here")
+
+
+def test_live_verb_asks_the_serving_process_with_the_ops_bearer_and_marks_the_view(monkeypatch):
+    seen = {}
+
+    def handler(request):
+        seen["url"] = httpx.URL(str(request.url))
+        seen["auth"] = request.headers.get("authorization")
+        return httpx.Response(200, json={"configured": True, "paused": False, "scaler_leader": 1})
+
+    monkeypatch.setattr(webhook_ops, "_live_client", _client(handler))
+    env = {"CODNA_WEBHOOK_OPS_TOKEN": TOKEN, "CODNA_WEBHOOK_PORT": "8181"}
+    out, why = live_verb("scaler", {"action": "status", "limit": 50, "value": None}, actor="github-actions:octocat", environ=env)
+    assert why == "" and out == {"configured": True, "paused": False, "scaler_leader": 1, "view": "live"}
+    assert seen["auth"] == f"Bearer {TOKEN}"
+    assert (seen["url"].host, seen["url"].port, seen["url"].path) == ("127.0.0.1", 8181, "/ops/scaler")
+    assert dict(seen["url"].params) == {"action": "status", "limit": "50", "actor": "github-actions:octocat"}  # None dropped
+
+
+@pytest.mark.parametrize("env, handler, expect", [
+    ({}, _never, "CODNA_WEBHOOK_OPS_TOKEN is not set"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, _refuse, "loopback /ops/scaler unreachable: ConnectError"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN, "CODNA_WEBHOOK_PORT": "eighty"}, _never, "unreachable: InvalidURL"),  # not an HTTPError
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, lambda r: httpx.Response(401, json={"error": "unauthorized"}), "answered HTTP 401"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, lambda r: httpx.Response(200, text="not json"), "non-JSON body"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, lambda r: httpx.Response(200, json=[1, 2]), "non-object body"),
+])
+def test_live_verb_says_why_it_could_not_ask_and_never_the_token(monkeypatch, env, handler, expect):
+    monkeypatch.setattr(webhook_ops, "_live_client", _client(handler))
+    out, why = live_verb("scaler", {}, actor="t", environ=env)
+    assert out is None and expect in why
+    assert TOKEN not in why
+
+
+# --- `codna webhook ops` -------------------------------------------------------------------------------
+
+def _ns(verb, **overrides):
+    ns = dict(verb=verb, id=None, priority=None, status=None, kind=None, repo=None, installation=None,
+              action=None, value=None, owner=None, reason="operator", limit=50, actor="github-actions:octocat")
+    ns.update(overrides)
+    return argparse.Namespace(**ns)
+
+
+class _NeverBuilt:
+    def __init__(self, *args, **kwargs):
+        raise AssertionError("the live view must not open the queue")
+
+
+class _StandIn:
+    """Stands in for the PostgresQueue the CLI opens; the verbs exercised here never touch it."""
+
+    def __init__(self, *args, **kwargs):
+        pass
+
+    def close(self):
+        pass
+
+
+def test_cli_ops_scaler_prints_the_live_view_without_a_database(monkeypatch, capsys):
+    monkeypatch.setenv("CODNA_WEBHOOK_OPS_TOKEN", TOKEN)
+    monkeypatch.delenv("DATABASE_URL", raising=False)
+    monkeypatch.delenv("CODNA_WEBHOOK_DATABASE_URL", raising=False)
+    monkeypatch.setattr(webhook_ops, "_live_client",
+                        _client(lambda r: httpx.Response(200, json={"configured": True, "cap": 4, "paused": False})))
+    monkeypatch.setattr(webhook_ops, "PostgresQueue", _NeverBuilt)
+    assert cli_ops(_ns("scaler", action="status")) == 0
+    assert json.loads(capsys.readouterr().out) == {"cap": 4, "configured": True, "paused": False, "view": "live"}
+
+
+def test_cli_ops_scaler_falls_back_to_its_own_view_marked_cli_rebuild(monkeypatch, capsys):
+    monkeypatch.setenv("CODNA_WEBHOOK_OPS_TOKEN", TOKEN)
+    monkeypatch.setenv("DATABASE_URL", "postgresql://stand-in/db")
+    monkeypatch.setattr(webhook_ops, "_live_client", _client(_refuse))
+    monkeypatch.setattr(webhook_ops, "PostgresQueue", _StandIn)
+    assert cli_ops(_ns("scaler")) == 0
+    out = json.loads(capsys.readouterr().out)
+    assert out["view"] == "cli-rebuild" and out["configured"] is False
+    assert out["live_unavailable"] == "loopback /ops/scaler unreachable: ConnectError"
+    assert "GET /ops/scaler" in out["hint"]
+    assert TOKEN not in json.dumps(out)
+
+
+def _no_loopback():
+    raise AssertionError("a table read must not go to loopback")
+
+
+def test_cli_ops_table_verbs_never_go_to_loopback(monkeypatch, capsys):
+    assert LIVE_VERBS == ("scaler",)
+    monkeypatch.setenv("CODNA_WEBHOOK_OPS_TOKEN", TOKEN)
+    monkeypatch.setenv("DATABASE_URL", "postgresql://stand-in/db")
+    monkeypatch.setattr(webhook_ops, "_live_client", _no_loopback)
+    monkeypatch.setattr(webhook_ops, "PostgresQueue", _StandIn)
+    seen = []
+    monkeypatch.setattr(webhook_ops, "run_verb",
+                        lambda queue, verb, params, **kw: seen.append((verb, params, kw["actor"])) or {"jobs": []})
+    assert cli_ops(_ns("jobs", status="dead")) == 0
+    assert seen == [("jobs", {"status": "dead", "reason": "operator", "limit": 50}, "ops-cli:github-actions:octocat")]
+    assert json.loads(capsys.readouterr().out) == {"jobs": []}                       # no view marker on a table read

{codna-0.2.74 → codna-0.2.76}/tests/test_webhook_scaler.py

@@ -49,6 +49,8 @@ def test_no_fly_token_means_no_machines_client():
     assert machines_client_from_env({}) is None
     client = machines_client_from_env({"FLY_API_TOKEN": "t", "CODNA_WEBHOOK_WORKER_APP": "w"})
     assert client is not None and client._app == "w"
+    ours = machines_client_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "ours", "FLY_API_TOKEN": "t"})
+    assert ours is not None and ours._token == "ours"           # the service's own name wins
 
 
 class _Held:

{codna-0.2.74 → codna-0.2.76}/tests/test_webhook_service.py

@@ -52,7 +52,8 @@ def test_default_flag_builds_todays_shape(tmp_path, monkeypatch):
     monkeypatch.setenv("CODNA_WEBHOOK_QUEUE", str(tmp_path / "queue.db"))
     monkeypatch.setenv("CODNA_RUNTIME_ROOT", str(tmp_path / "rt"))
     monkeypatch.setenv("TMPDIR", str(tmp_path / "tmp"))
-    for var in ("CODNA_WEBHOOK_QUEUE_BACKEND", "CODNA_WEBHOOK_ROLE", "DATABASE_URL", "FLY_API_TOKEN", "CODNA_WEBHOOK_REDELIVER"):
+    for var in ("CODNA_WEBHOOK_QUEUE_BACKEND", "CODNA_WEBHOOK_ROLE", "DATABASE_URL", "CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN",
+                "CODNA_WEBHOOK_REDELIVER"):
         monkeypatch.delenv(var, raising=False)
     svc = build_service(pool_factory=_Pool)
     assert (svc.backend, svc.role) == ("sqlite", "all")
@@ -256,6 +257,7 @@ def test_a_lost_lease_cancels_the_job_this_process_runs(make_pg_queue, tmp_path,
     monkeypatch.setenv("TMPDIR", str(tmp_path / "tmp"))
     monkeypatch.setenv("CODNA_WEBHOOK_QUEUE_BACKEND", "postgres")
     monkeypatch.setenv("CODNA_WEBHOOK_ROLE", "worker")
+    monkeypatch.delenv("CODNA_WEBHOOK_FLY_TOKEN", raising=False)
     monkeypatch.delenv("FLY_API_TOKEN", raising=False)
     build_service(queue=pg, pool_factory=_Pool)                     # the injected queue gets the handler too
     assert pg.enqueue(WebhookJob("review", "acme/app", ref="old", pr_number=7, installation_id=42, reason="t"), delivery_id="d1")

{codna-0.2.74 → codna-0.2.76}/tests/test_workflows.py

@@ -151,11 +151,22 @@ def test_webhook_ops_worker_secrets_refuses_a_partial_set_and_copies_exactly_the
     names = re.search(r'names="([^"]+)"', run).group(1).split()
     assert set(names) == {"GITHUB_APP_ID", "GITHUB_APP_PRIVATE_KEY", "CODNA_ENGINE_URL", "CODNA_WEBHOOK_INTERNAL_SECRET"}
     assert all(f"`{n}`" in runbook for n in names)
-    for forbidden in ("FLY_API_TOKEN", "CODNA_GITHUB_WEBHOOK_SECRET", "CODNA_WEBHOOK_OPS_TOKEN"):
+    for forbidden in ("CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN", "CODNA_GITHUB_WEBHOOK_SECRET", "CODNA_WEBHOOK_OPS_TOKEN"):
         assert forbidden not in names
     assert "refusing to configure" in run and run.index("refusing to configure") < run.index("flyctl secrets set")
 
 
+def test_webhook_ops_worker_token_sets_the_name_the_scaler_reads_first():
+    from codna.webhook_scaler import FLY_TOKEN_ENVS
+
+    run = _ops_step("worker-token")["run"]
+    assert FLY_TOKEN_ENVS[0] == "CODNA_WEBHOOK_FLY_TOKEN"
+    assert 'flyctl secrets set -a "$APP" "CODNA_WEBHOOK_FLY_TOKEN=$token"' in run
+    assert "FLY_API_TOKEN=$token" not in run                    # the flyctl login name is only a fallback the service reads
+    runbook = (ROOT / "infra" / "README-webhook-deploy.md").read_text(encoding="utf-8")
+    assert "CODNA_WEBHOOK_FLY_TOKEN=$(fly tokens create deploy -a codna-webhook-worker)" in runbook
+
+
 def test_webhook_ops_mpg_steps_redact_the_connection_string_flyctl_prints():
     for action in ("mpg-create", "mpg-attach"):
         run = _ops_step(action)["run"].replace("\\\n", " ")  # join shell continuation lines