gerrit-clone 2.0.2__tar.gz → 2.2.0__tar.gz

{gerrit_clone-2.0.2 → gerrit_clone-2.2.0}/.pre-commit-config.yaml

@@ -51,7 +51,7 @@ repos:
         types: [yaml]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 77039ccbba72c8aede339c5f8ae29b42aced0a2e  # frozen: v0.15.18
+    rev: 01a675ea018f2fb714478a5ffb83fcea8374bb06  # frozen: v0.15.21
     hooks:
       - id: ruff
         files: ^(scripts|tests|custom_components)/.+\.py$
@@ -60,7 +60,7 @@ repos:
         files: ^(scripts|tests|custom_components)/.+\.py$
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: d2823d321df3af8f878f7ee3414dc94d037145b9  # frozen: v2.1.0
+    rev: 41e691678310dfd3833f7ab4e180ddb014310356  # frozen: v2.3.0
     hooks:
       - id: mypy
         additional_dependencies:
@@ -109,17 +109,17 @@ repos:
 
   # Requires a mirror, primary repo lacks .pre-commit-hooks.yaml
   - repo: https://github.com/DetachHead/basedpyright-prek-mirror
-    rev: 5f6f2cb9fa8aec15105f77fd21e8dfe29838b16d  # frozen: 1.39.8
+    rev: d55eabd2531b4f4a4c49c30fba627ce3a636ab79  # frozen: 1.39.9
     hooks:
       - id: basedpyright
 
   - repo: https://github.com/lfreleng-actions/gha-workflow-linter
-    rev: bfc5489483353425f8e023902d91c3ae3584f955  # frozen: v1.2.0
+    rev: 4c3079dcb6e9e3c295f961ce5bd5b8585db698ca  # frozen: v1.2.2
     hooks:
       - id: gha-workflow-linter
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 8ef330cbb7204d388aa7a620f9549bcea8009663  # frozen: 0.37.3
+    rev: 1a4bb160cab6417b3045e1b37b6b72449243e658  # frozen: 0.37.4
     hooks:
       - id: check-github-actions
       - id: check-github-workflows

{gerrit_clone-2.0.2 → gerrit_clone-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gerrit-clone
-Version: 2.0.2
+Version: 2.2.0
 Summary: A multi-threaded CLI tool for bulk cloning repositories from Gerrit servers
 Project-URL: Homepage, https://github.com/lfreleng-actions/gerrit-clone-action
 Project-URL: Documentation, https://github.com/lfreleng-actions/gerrit-clone-action#readme
@@ -57,16 +57,18 @@ reliability, speed, and CI/CD compatibility.
 - **Bulk Repository Discovery**: Fetches all projects via Gerrit REST API with
   intelligent filtering
 - **Multi-threaded Cloning**: Concurrent operations with auto-scaling thread
-  pools (up to 32 workers for Gerrit, 64 for GitHub with 2x multiplier for
-  network-limited operations)
+  pools (Gerrit uses a conservative auto-default of at most 8 concurrent SSH
+  sessions to avoid server-side throttling; GitHub uses up to 64 with a 2x
+  multiplier; override either with `--threads`)
 - **Hierarchy Preservation**: Maintains complete Gerrit project folder
   structure without flattening
 - **Complete Metadata Cloning**: Uses `git clone --mirror` by default to
   capture all refs, tags, and branches for complete repository backups
 - **GitHub Mirroring**: Mirror Gerrit repositories to GitHub organizations
   with automatic name transformation
-- **Robust Retry Logic**: Exponential backoff with jitter for transient
-  network and server failures
+- **Robust Retry Logic**: Exponential backoff with full jitter for transient
+  network and server failures, including a small bounded retry for Gerrit SSH
+  throttling that can surface as a transient "Permission denied" rejection
 - **SSH Integration**: Full SSH agent, identity file, and config support
 - **CI/CD Ready**: Non-interactive operation with structured JSON manifests
 - **Smart Filtering**: Automatically excludes system repos and archived
@@ -253,6 +255,25 @@ Automatically stash uncommitted changes before refresh:
 gerrit-clone refresh --output-path ~/onap --auto-stash
 ```
 
+Force refresh (stash local changes, fix detached HEAD, restore feature-branch
+checkouts to the default branch):
+
+```bash
+gerrit-clone refresh --output-path ~/onap --force
+```
+
+Hard reset: make local content exactly match the remote, discarding local-only
+commits and any divergence. This is the single, explicit way to force-reset
+local content and is a strict superset of `--force`:
+
+```bash
+gerrit-clone refresh --output-path ~/onap --force-hard
+```
+
+> **Note:** `--force-hard` is destructive: it permanently discards
+> local-only commits on the default branch. It leaves other local
+> branches untouched.
+
 Use rebase strategy instead of merge:
 
 ```bash

{gerrit_clone-2.0.2 → gerrit_clone-2.2.0}/README.md

@@ -16,16 +16,18 @@ reliability, speed, and CI/CD compatibility.
 - **Bulk Repository Discovery**: Fetches all projects via Gerrit REST API with
   intelligent filtering
 - **Multi-threaded Cloning**: Concurrent operations with auto-scaling thread
-  pools (up to 32 workers for Gerrit, 64 for GitHub with 2x multiplier for
-  network-limited operations)
+  pools (Gerrit uses a conservative auto-default of at most 8 concurrent SSH
+  sessions to avoid server-side throttling; GitHub uses up to 64 with a 2x
+  multiplier; override either with `--threads`)
 - **Hierarchy Preservation**: Maintains complete Gerrit project folder
   structure without flattening
 - **Complete Metadata Cloning**: Uses `git clone --mirror` by default to
   capture all refs, tags, and branches for complete repository backups
 - **GitHub Mirroring**: Mirror Gerrit repositories to GitHub organizations
   with automatic name transformation
-- **Robust Retry Logic**: Exponential backoff with jitter for transient
-  network and server failures
+- **Robust Retry Logic**: Exponential backoff with full jitter for transient
+  network and server failures, including a small bounded retry for Gerrit SSH
+  throttling that can surface as a transient "Permission denied" rejection
 - **SSH Integration**: Full SSH agent, identity file, and config support
 - **CI/CD Ready**: Non-interactive operation with structured JSON manifests
 - **Smart Filtering**: Automatically excludes system repos and archived
@@ -212,6 +214,25 @@ Automatically stash uncommitted changes before refresh:
 gerrit-clone refresh --output-path ~/onap --auto-stash
 ```
 
+Force refresh (stash local changes, fix detached HEAD, restore feature-branch
+checkouts to the default branch):
+
+```bash
+gerrit-clone refresh --output-path ~/onap --force
+```
+
+Hard reset: make local content exactly match the remote, discarding local-only
+commits and any divergence. This is the single, explicit way to force-reset
+local content and is a strict superset of `--force`:
+
+```bash
+gerrit-clone refresh --output-path ~/onap --force-hard
+```
+
+> **Note:** `--force-hard` is destructive: it permanently discards
+> local-only commits on the default branch. It leaves other local
+> branches untouched.
+
 Use rebase strategy instead of merge:
 
 ```bash

{gerrit_clone-2.0.2 → gerrit_clone-2.2.0}/action.yaml

@@ -232,6 +232,29 @@ inputs:
     description: "File logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL)"
     required: false
     default: "DEBUG"
+  remove-files:
+    description: >-
+      Comma-separated list of file path patterns to remove
+      from cloned repositories. Supports shell-style globs
+      (e.g. '.github/**', '*.jar') and regex patterns
+      (prefix with 'regex:'). Uses git filter-repo when
+      available, falls back to worktree-based removal.
+    required: false
+  git-filter:
+    description: >-
+      Replace tokens in git history for matching projects.
+      Format: 'project:token1,token2;project2:token3'.
+      Semicolons separate project entries. Colons separate
+      project patterns from comma-separated tokens.
+    required: false
+  redact-secrets:
+    description: >-
+      Scan repository content for well-known credential
+      patterns (e.g. GitLab PATs, GitHub PATs, AWS keys)
+      and replace them with safe placeholder values.
+      Uses git filter-repo to rewrite history.
+    required: false
+    default: "false"
   build-from-source:
     description: >-
       Build CLI from the action's own source instead of
@@ -460,6 +483,13 @@ runs:
         INPUT_LOG_FILE: ${{ inputs.log-file }}
         INPUT_DISABLE_LOG_FILE: ${{ inputs.disable-log-file }}
         INPUT_LOG_LEVEL: ${{ inputs.log-level }}
+        INPUT_REMOVE_FILES: ${{ inputs.remove-files }}
+        # Passed straight to the CLI via its GERRIT_GIT_FILTER envvar
+        # rather than as a --git-filter argument, so the value (which
+        # may embed credential tokens) is never echoed in the command
+        # line logged below.
+        GERRIT_GIT_FILTER: ${{ inputs.git-filter }}
+        INPUT_REDACT_SECRETS: ${{ inputs.redact-secrets }}
       run: |
         # WARNING: Do NOT use literal empty expression syntax (dollar
         # brace-brace with nothing inside) anywhere in this run block,
@@ -470,7 +500,7 @@ runs:
         # Use action-managed SSH agent socket if it exists; otherwise,
         # fall back to any existing SSH_AUTH_SOCK on the runner so that
         # SSH-based clones using the runner's default agent/keys still work.
-        SSH_AGENT_SOCK="/tmp/ssh_agent_${{ github.run_id }}.sock"
+        SSH_AGENT_SOCK="/tmp/ssh_agent_${GITHUB_RUN_ID}.sock"
         if [ -S "$SSH_AGENT_SOCK" ]; then
           export SSH_AUTH_SOCK="$SSH_AGENT_SOCK"
         fi
@@ -638,6 +668,19 @@ runs:
           cmd+=(--config-file "${INPUT_CONFIG_FILE}")
         fi
 
+        # Content filtering options
+        if [ -n "$INPUT_REMOVE_FILES" ]; then
+          cmd+=(--remove-files "$INPUT_REMOVE_FILES")
+        fi
+
+        # The git filter value is supplied to the CLI through the
+        # GERRIT_GIT_FILTER environment variable (set in the step env
+        # above) so it never appears in the echoed command line.
+
+        if [ "$INPUT_REDACT_SECRETS" = "true" ]; then
+          cmd+=(--redact-secrets)
+        fi
+
         # Add include-projects options (supports multiple)
         # Use env var to avoid shell injection from expression
         # interpolation in command substitutions; normalize

{gerrit_clone-2.0.2 → gerrit_clone-2.2.0}/pyproject.toml

@@ -346,9 +346,3 @@ dev = [
     "pytest-mock>=3.15.1",
     "types-pyyaml>=6.0.12.20250915",
 ]
-
-[tool.uv]
-# Supply-chain cooldown: do not resolve anything published in the last
-# 7 days (rolling window; uv records it as a relative span in uv.lock).
-# Requires uv >= 0.9.17 for the relative-duration ("7 days") form.
-exclude-newer = "7 days"