github2gerrit 0.1.14__py3-none-any.whl → 0.1.16__py3-none-any.whl

github2gerrit/cli.py

@@ -36,6 +36,7 @@ from .github_api import get_pr_title_body
 from .github_api import get_pull
 from .github_api import get_repo_from_env
 from .github_api import iter_open_pulls
+from .gitutils import CommandError
 from .gitutils import run_cmd
 from .models import GitHubContext
 from .models import Inputs
@@ -51,6 +52,7 @@ from .ssh_common import build_non_interactive_ssh_env
 from .utils import append_github_output
 from .utils import env_bool
 from .utils import env_str
+from .utils import is_verbose_mode
 from .utils import log_exception_conditionally
 from .utils import parse_bool_env
 
@@ -245,7 +247,7 @@ if "--help" in sys.argv or _is_github_actions_context():
 
 app: typer.Typer = typer.Typer(
     add_completion=False,
-    no_args_is_help=False,
+    no_args_is_help=True,
     cls=cast(Any, _SingleUsageGroup),
     rich_markup_mode="rich",
     help="Tool to convert GitHub pull requests into Gerrit changes",
@@ -989,9 +991,60 @@ def _process_single(
                 else:
                     progress_tracker.change_updated()
         except Exception as exc:
+            # Enhanced error handling for CommandError to show git command
+            # details
+            if isinstance(exc, CommandError):
+                # Always show the basic error message
+                cmd_str = " ".join(exc.cmd) if exc.cmd else "unknown command"
+                basic_error = f"Git command failed: {cmd_str}"
+                if exc.returncode is not None:
+                    basic_error += f" (exit code: {exc.returncode})"
+
+                # In verbose mode, show detailed stdout/stderr
+                if is_verbose_mode():
+                    detailed_msg = basic_error
+                    if exc.stdout and exc.stdout.strip():
+                        detailed_msg += f"\nGit stdout: {exc.stdout.strip()}"
+                    if exc.stderr and exc.stderr.strip():
+                        detailed_msg += f"\nGit stderr: {exc.stderr.strip()}"
+
+                    # Show debugging suggestion for merge failures
+                    if "merge --squash" in " ".join(exc.cmd or []):
+                        detailed_msg += (
+                            "\n💡 For local debugging: python "
+                            "test_merge_failure.py --verbose"
+                        )
+
+                    safe_console_print(f"❌ {detailed_msg}", style="red")
+                    if progress_tracker:
+                        progress_tracker.add_error(basic_error)
+                        if exc.stderr and exc.stderr.strip():
+                            progress_tracker.add_error(
+                                f"Details: {exc.stderr.strip()}"
+                            )
+                else:
+                    # In non-verbose mode, show basic error with hint to enable
+                    # verbose
+                    hint_msg = (
+                        basic_error
+                        + "\n💡 Run with VERBOSE=true for detailed git output"
+                    )
+                    safe_console_print(f"❌ {hint_msg}", style="red")
+                    if progress_tracker:
+                        progress_tracker.add_error(basic_error)
+            else:
+                # For other exceptions, use original handling
+                error_msg = str(exc)
+                if progress_tracker:
+                    progress_tracker.add_error(f"Execution failed: {error_msg}")
+                else:
+                    safe_console_print(f"❌ Error: {error_msg}", style="red")
+
             log.debug("Execution failed; continuing to write outputs: %s", exc)
-            if progress_tracker:
-                progress_tracker.add_error("Execution failed")
+
+            # In verbose mode, also log the full exception with traceback
+            if is_verbose_mode():
+                log.exception("Full exception details:")
 
             result = SubmissionResult(
                 change_urls=[], change_numbers=[], commit_shas=[]

github2gerrit/core.py

@@ -69,7 +69,7 @@ from .reconcile_matcher import LocalCommit
 from .reconcile_matcher import create_local_commit
 from .ssh_common import merge_known_hosts_content
 from .utils import env_bool
-from .utils import log_exception_conditionally
+from .utils import is_verbose_mode
 
 
 try:
@@ -708,6 +708,8 @@ class Orchestrator:
         self._ssh_known_hosts_path: Path | None = None
         self._ssh_agent_manager: SSHAgentManager | None = None
         self._use_ssh_agent: bool = False
+        # Secure temporary directory for SSH files (outside workspace)
+        self._ssh_temp_dir: Path | None = None
         # Store inputs for access by helper methods
         self._inputs: Inputs | None = None
 
@@ -865,6 +867,9 @@ class Orchestrator:
 
         self._comment_on_pull_request(gh, gerrit, result)
 
+        # Validate that no unexpected files were committed
+        self._validate_committed_files(gh, result)
+
         self._close_pull_request_if_required(gh)
 
         log.debug("Pipeline complete: %s", result)
@@ -1111,10 +1116,15 @@ class Orchestrator:
 
         Does not modify user files.
         """
+        log.debug(
+            "Starting SSH setup for Gerrit %s:%d", gerrit.host, gerrit.port
+        )
         if not inputs.gerrit_ssh_privkey_g2g:
             log.debug("SSH private key not provided, skipping SSH setup")
             return
 
+        log.debug("SSH private key provided, proceeding with SSH configuration")
+
         # Check for ssh-keyscan availability early if auto-discovery needed
         if (
             auto_discover_gerrit_host_keys is not None
@@ -1259,16 +1269,25 @@ class Orchestrator:
 
         # Check if SSH agent authentication is preferred
         use_ssh_agent = env_bool("G2G_USE_SSH_AGENT", default=True)
+        log.debug(
+            "SSH agent preference: use_ssh_agent=%s, "
+            "setup_ssh_agent_auth available=%s",
+            use_ssh_agent,
+            setup_ssh_agent_auth is not None,
+        )
 
         if use_ssh_agent and setup_ssh_agent_auth is not None:
             # Try SSH agent first as it's more secure and avoids file
             # permission issues
+            log.debug("Attempting SSH agent-based authentication")
             if self._try_ssh_agent_setup(inputs, effective_known_hosts):
+                log.debug("SSH agent setup successful")
                 return
 
             # Fall back to file-based SSH if agent setup fails
             log.info("Falling back to file-based SSH authentication")
 
+        log.debug("Using file-based SSH authentication")
         self._setup_file_based_ssh(inputs, effective_known_hosts)
 
     def _try_ssh_agent_setup(
@@ -1288,8 +1307,36 @@ class Orchestrator:
 
         try:
             log.debug("Setting up SSH agent-based authentication (more secure)")
+            log.debug("Workspace: %s", self.workspace)
+            log.debug(
+                "Private key length: %d characters",
+                len(inputs.gerrit_ssh_privkey_g2g),
+            )
+            log.debug(
+                "Known hosts length: %d characters", len(effective_known_hosts)
+            )
+
+            # Create secure separate temp directory for SSH agent if needed
+            import secrets
+            import tempfile
+
+            if not self._ssh_temp_dir:
+                # Use secure random suffix to prevent predictable paths
+                secure_suffix = secrets.token_hex(8)
+                self._ssh_temp_dir = Path(
+                    tempfile.mkdtemp(
+                        prefix=f"g2g_ssh_{secure_suffix}_",
+                        dir=tempfile.gettempdir(),
+                    )
+                )
+                # Ensure directory has restrictive permissions
+                self._ssh_temp_dir.chmod(0o700)
+                log.debug(
+                    "Created secure SSH temp directory: %s", self._ssh_temp_dir
+                )
+
             self._ssh_agent_manager = setup_ssh_agent_auth(
-                workspace=self.workspace,
+                workspace=self._ssh_temp_dir,
                 private_key_content=inputs.gerrit_ssh_privkey_g2g,
                 known_hosts_content=effective_known_hosts,
             )
@@ -1297,6 +1344,7 @@ class Orchestrator:
             log.debug("SSH agent authentication configured successfully")
 
         except Exception as exc:
+            log.debug("SSH agent setup failed: %s", exc)
             log.warning(
                 "SSH agent setup failed, falling back to file-based SSH: %s",
                 exc,
@@ -1317,28 +1365,60 @@ class Orchestrator:
             inputs: Validated input configuration
             effective_known_hosts: Known hosts content
         """
-        log.info("Setting up file-based SSH configuration for Gerrit")
-        log.debug("Using workspace-specific SSH files to avoid user changes")
+        log.debug("Using file-based SSH configuration for Gerrit")
+        log.debug(
+            "Using secure temporary SSH files outside workspace to prevent "
+            "artifacts"
+        )
+        log.debug(
+            "Private key length: %d characters",
+            len(inputs.gerrit_ssh_privkey_g2g),
+        )
+        log.debug(
+            "Known hosts length: %d characters", len(effective_known_hosts)
+        )
+
+        # Create secure tool-specific SSH directory outside workspace to prevent
+        # SSH artifacts from being accidentally committed
+        import secrets
+        import tempfile
 
-        # Create tool-specific SSH directory in workspace to avoid touching
-        # user files
-        tool_ssh_dir = self.workspace / ".ssh-g2g"
+        if not self._ssh_temp_dir:
+            # Use secure random suffix to prevent predictable paths
+            secure_suffix = secrets.token_hex(8)
+            self._ssh_temp_dir = Path(
+                tempfile.mkdtemp(
+                    prefix=f"g2g_ssh_{secure_suffix}_",
+                    dir=tempfile.gettempdir(),
+                )
+            )
+            # Ensure directory has restrictive permissions
+            self._ssh_temp_dir.chmod(0o700)
+            log.debug(
+                "Created secure SSH temp directory: %s", self._ssh_temp_dir
+            )
+        tool_ssh_dir = self._ssh_temp_dir
         tool_ssh_dir.mkdir(mode=0o700, exist_ok=True)
 
         # Write SSH private key to tool-specific location with secure
         # permissions
         key_path = tool_ssh_dir / "gerrit_key"
+        log.debug("SSH key file path: %s", key_path)
 
         # Use a more robust approach for creating the file with secure
         # permissions
         key_content = inputs.gerrit_ssh_privkey_g2g.strip() + "\n"
 
         # Multiple strategies to create secure key file
+        log.debug("Attempting to create secure key file")
         success = self._create_secure_key_file(key_path, key_content)
+        log.debug("Secure key file creation success: %s", success)
 
         if not success:
             # If all permission strategies fail, create in memory directory
+            log.debug("Falling back to memory-based key file creation")
             success = self._create_key_in_memory_fs(key_path, key_content)
+            log.debug("Memory-based key file creation success: %s", success)
 
         if not success:
             msg = (
@@ -1347,8 +1427,11 @@ class Orchestrator:
                 "Consider using G2G_USE_SSH_AGENT=true (default) for SSH "
                 "agent authentication."
             )
+            log.error("SSH key file creation failed: %s", msg)
             raise RuntimeError(msg)
 
+        log.debug("SSH key file created successfully: %s", key_path)
+
         # Write known hosts to tool-specific location
         known_hosts_path = tool_ssh_dir / "known_hosts"
         with open(known_hosts_path, "w", encoding="utf-8") as f:
@@ -1360,6 +1443,7 @@ class Orchestrator:
         # Store paths for later use in git commands
         self._ssh_key_path = key_path
         self._ssh_known_hosts_path = known_hosts_path
+        log.debug("File-based SSH setup completed successfully")
 
     def _create_secure_key_file(self, key_path: Path, key_content: str) -> bool:
         """Try multiple strategies to create a secure SSH key file.
@@ -1564,29 +1648,46 @@ class Orchestrator:
         """Centralized non-interactive SSH/Git environment."""
         from .ssh_common import build_non_interactive_ssh_env
 
+        log.debug("Building SSH environment for git operations")
         env = build_non_interactive_ssh_env()
 
         # Set GIT_SSH_COMMAND based on available configuration
         cmd = self._build_git_ssh_command
         if cmd:
+            log.debug("Using custom GIT_SSH_COMMAND: %s", cmd)
             env["GIT_SSH_COMMAND"] = cmd
         else:
             # Fallback to basic non-interactive SSH command
             from .ssh_common import build_git_ssh_command
 
-            env["GIT_SSH_COMMAND"] = build_git_ssh_command()
+            fallback_cmd = build_git_ssh_command()
+            log.debug("Using fallback GIT_SSH_COMMAND: %s", fallback_cmd)
+            env["GIT_SSH_COMMAND"] = fallback_cmd
 
         # Override SSH agent settings if using SSH agent
         if self._use_ssh_agent and self._ssh_agent_manager:
-            env.update(self._ssh_agent_manager.get_ssh_env())
+            log.debug("Applying SSH agent environment variables")
+            agent_env = self._ssh_agent_manager.get_ssh_env()
+            log.debug(
+                "SSH agent environment: %s",
+                {k: v for k, v in agent_env.items() if "SSH" in k},
+            )
+            env.update(agent_env)
+        else:
+            log.debug(
+                "Not using SSH agent (use_ssh_agent=%s, manager=%s)",
+                self._use_ssh_agent,
+                self._ssh_agent_manager is not None,
+            )
 
+        log.debug("Final SSH environment contains %d variables", len(env))
         return env
 
     def _cleanup_ssh(self) -> None:
         """Clean up temporary SSH files created by this tool.
 
-        Removes the workspace-specific .ssh-g2g directory and all contents.
-        This ensures no temporary files are left behind.
+        Securely removes the separate SSH temporary directory and all contents.
+        This ensures no temporary files or credentials are left behind.
         """
         log.debug("Cleaning up temporary SSH configuration files")
 
@@ -1597,15 +1698,47 @@ class Orchestrator:
                 self._ssh_agent_manager = None
                 self._use_ssh_agent = False
 
-            # Remove temporary SSH directory and all contents
-            tool_ssh_dir = self.workspace / ".ssh-g2g"
-            if tool_ssh_dir.exists():
+            # Securely remove separate SSH temporary directory and all contents
+            if self._ssh_temp_dir and self._ssh_temp_dir.exists():
+                import os
                 import shutil
 
-                shutil.rmtree(tool_ssh_dir)
+                # First, overwrite any key files to prevent recovery
+                try:
+                    for root, _dirs, files in os.walk(self._ssh_temp_dir):
+                        for file in files:
+                            file_path = Path(root) / file
+                            if file_path.exists() and file_path.is_file():
+                                # Overwrite file with random data
+                                try:
+                                    size = file_path.stat().st_size
+                                    if size > 0:
+                                        import secrets
+
+                                        with open(file_path, "wb") as f:
+                                            f.write(secrets.token_bytes(size))
+                                            # Sync to ensure write completes
+                                            os.fsync(f.fileno())
+                                except Exception as overwrite_exc:
+                                    log.debug(
+                                        "Failed to overwrite %s: %s",
+                                        file_path,
+                                        overwrite_exc,
+                                    )
+                except Exception as walk_exc:
+                    log.debug(
+                        "Failed to walk SSH temp directory for secure "
+                        "cleanup: %s",
+                        walk_exc,
+                    )
+
+                # Remove the directory tree
+                shutil.rmtree(self._ssh_temp_dir)
                 log.debug(
-                    "Cleaned up temporary SSH directory: %s", tool_ssh_dir
+                    "Securely cleaned up temporary SSH directory: %s",
+                    self._ssh_temp_dir,
                 )
+                self._ssh_temp_dir = None
         except Exception as exc:
             log.warning("Failed to clean up temporary SSH files: %s", exc)
 
@@ -1821,8 +1954,8 @@ class Orchestrator:
                     cur_msg = _clean_ellipses_from_message(cur_msg)
                     needed = [m for m in meta if m not in cur_msg]
                     if needed:
-                        new_msg = (
-                            cur_msg.rstrip() + "\n" + "\n".join(needed) + "\n"
+                        new_msg = Orchestrator._append_missing_trailers(
+                            cur_msg, needed
                         )
                         git_commit_amend(
                             message=new_msg,
@@ -1895,10 +2028,99 @@ class Orchestrator:
         # Create temp branch from base and merge-squash PR head
         tmp_branch = f"g2g_tmp_{gh.pr_number or 'pr'!s}_{os.getpid()}"
         os.environ["G2G_TMP_BRANCH"] = tmp_branch
+
+        log.debug(
+            "Git merge preparation: base_sha=%s, head_sha=%s, tmp_branch=%s",
+            base_sha,
+            head_sha,
+            tmp_branch,
+        )
+
+        # Check if we have any commits to merge
+        try:
+            merge_base = run_cmd(
+                ["git", "merge-base", base_sha, head_sha], cwd=self.workspace
+            ).stdout.strip()
+            log.debug("Merge base: %s", merge_base)
+
+            # Check if there are any commits between base and head
+            commits_to_merge = run_cmd(
+                ["git", "rev-list", f"{base_sha}..{head_sha}"],
+                cwd=self.workspace,
+            ).stdout.strip()
+            if not commits_to_merge:
+                log.warning(
+                    "No commits found between base (%s) and head (%s)",
+                    base_sha,
+                    head_sha,
+                )
+            else:
+                commit_count = len(commits_to_merge.splitlines())
+                log.debug("Found %d commits to merge", commit_count)
+
+        except Exception as debug_exc:
+            log.warning("Failed to analyze merge situation: %s", debug_exc)
+
         run_cmd(
             ["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace
         )
-        run_cmd(["git", "merge", "--squash", head_sha], cwd=self.workspace)
+
+        # Show git status before attempting merge
+        try:
+            status_output = run_cmd(
+                ["git", "status", "--porcelain"], cwd=self.workspace
+            ).stdout
+            if status_output.strip():
+                log.debug(
+                    "Git status before merge (modified files detected):\n%s",
+                    status_output,
+                )
+            else:
+                log.debug("Git status before merge: working directory clean")
+
+            # Show current branch
+            current_branch = run_cmd(
+                ["git", "branch", "--show-current"], cwd=self.workspace
+            ).stdout.strip()
+            log.debug("Current branch before merge: %s", current_branch)
+
+        except Exception as status_exc:
+            log.warning("Failed to get git status before merge: %s", status_exc)
+
+        log.debug("About to run: git merge --squash %s", head_sha)
+        try:
+            run_cmd(["git", "merge", "--squash", head_sha], cwd=self.workspace)
+        except CommandError as merge_exc:
+            # Enhanced error handling for git merge failures
+            error_details = self._analyze_merge_failure(
+                merge_exc, base_sha, head_sha
+            )
+
+            # Try to provide recovery suggestions
+            recovery_msg = self._suggest_merge_recovery(
+                merge_exc, base_sha, head_sha
+            )
+
+            # Log detailed error information
+            log.exception("Git merge --squash failed: %s", error_details)
+            if recovery_msg:
+                log.exception("Suggested recovery: %s", recovery_msg)
+
+            # Enhanced debugging if verbose mode is enabled
+            from .utils import is_verbose_mode
+
+            if is_verbose_mode():
+                self._debug_merge_failure_context(base_sha, head_sha)
+
+            # Re-raise with enhanced context
+            raise OrchestratorError(
+                f"Failed to merge PR commits: {error_details}"
+                + (
+                    f"\nSuggested recovery: {recovery_msg}"
+                    if recovery_msg
+                    else ""
+                )
+            ) from merge_exc
 
         def _collect_log_lines() -> list[str]:
             body = run_cmd(
@@ -2113,7 +2335,9 @@ class Orchestrator:
             if meta:
                 needed = [m for m in meta if m not in commit_msg]
                 if needed:
-                    commit_msg = commit_msg.rstrip() + "\n" + "\n".join(needed)
+                    commit_msg = Orchestrator._append_missing_trailers(
+                        commit_msg, needed
+                    )
         except Exception as meta_exc:
             log.debug(
                 "Skipping metadata trailer injection (squash path): %s",
@@ -2314,7 +2538,9 @@ class Orchestrator:
                 ).stdout
                 needed = [m for m in meta if m not in cur_msg]
                 if needed:
-                    new_msg = cur_msg.rstrip() + "\n" + "\n".join(needed) + "\n"
+                    new_msg = Orchestrator._append_missing_trailers(
+                        cur_msg, needed
+                    )
                     git_commit_amend(
                         cwd=self.workspace,
                         no_edit=False,
@@ -2327,6 +2553,32 @@ class Orchestrator:
                 "Skipping post-apply metadata trailer ensure: %s", meta_exc
             )
 
+    @staticmethod
+    def _append_missing_trailers(
+        message: str, trailers: list[str], *, ensure_final_newline: bool = True
+    ) -> str:
+        """Append missing trailers to a commit message with proper formatting.
+
+        Args:
+            message: The base commit message
+            trailers: List of trailer lines to potentially append
+            ensure_final_newline: Whether to ensure the message ends with a
+                newline
+
+        Returns:
+            The message with missing trailers appended, properly formatted
+        """
+        needed = [trailer for trailer in trailers if trailer not in message]
+        if not needed:
+            return message
+
+        result = message.rstrip() + "\n\n" + "\n".join(needed)
+
+        if ensure_final_newline:
+            result = result.rstrip("\n") + "\n"
+
+        return result
+
     def _push_to_gerrit(
         self,
         *,
@@ -2369,6 +2621,7 @@ class Orchestrator:
                 "-t",
                 topic,
             ]
+            log.debug("Building git review command with topic: %s", topic)
             collected_change_ids: list[str] = []
             if prepared:
                 collected_change_ids.extend(prepared.all_change_ids())
@@ -2396,7 +2649,15 @@ class Orchestrator:
                     gerrit, repo, branch, reviewers, topic, env
                 )
                 return
-            log.debug("Executing git review command: %s", " ".join(args))
+
+            log.debug("Final git review command: %s", " ".join(args))
+            log.debug(
+                "Git review environment variables: %s",
+                {k: v for k, v in env.items() if "SSH" in k or "GIT" in k},
+            )
+            log.debug("Working directory: %s", self.workspace)
+
+            # Execute the git review command
             run_cmd(args, cwd=self.workspace, env=env)
             log.debug("Successfully pushed changes to Gerrit")
         except CommandError as exc:
@@ -2498,9 +2759,33 @@ class Orchestrator:
 
             # Analyze the specific failure reason from git review output
             error_details = self._analyze_gerrit_push_failure(exc)
-            log_exception_conditionally(
-                log, "Gerrit push failed: %s", error_details
-            )
+
+            # Always log the error details, even if not in verbose mode
+            log.exception("Gerrit push failed: %s", error_details)
+
+            # In debug mode, also show the raw command output
+            if is_verbose_mode():
+                log.debug("Git review command: %s", " ".join(exc.cmd or []))
+                log.debug("Return code: %s", exc.returncode)
+                if exc.stdout:
+                    log.debug("Command stdout:\n%s", exc.stdout)
+                if exc.stderr:
+                    log.debug("Command stderr:\n%s", exc.stderr)
+
+            # Include raw output in error message if analysis didn't provide
+            # useful info
+            has_raw_output = exc.stdout or exc.stderr
+            if error_details.startswith("Unknown error") and has_raw_output:
+                raw_output = ""
+                if exc.stdout:
+                    raw_output += f"stdout: {exc.stdout.strip()}\n"
+                if exc.stderr:
+                    raw_output += f"stderr: {exc.stderr.strip()}"
+                if raw_output:
+                    error_details = (
+                        f"{error_details}\nRaw output:\n{raw_output}"
+                    )
+
             msg = (
                 f"Failed to push changes to Gerrit with git-review: "
                 f"{error_details}"
@@ -2758,9 +3043,10 @@ class Orchestrator:
                 env=env,
                 check=False,
             )
-            # 2) Clean untracked files/dirs (preserve our SSH known_hosts dir)
+            # 2) Clean untracked files/dirs (SSH files are now outside
+            # workspace)
             run_cmd(
-                ["git", "clean", "-fdx", "-e", ".ssh-g2g", "-e", ".ssh-g2g/**"],
+                ["git", "clean", "-fdx"],
                 cwd=self.workspace,
                 env=env,
                 check=False,
@@ -2968,7 +3254,15 @@ class Orchestrator:
                     return f"Gerrit rejected the push: {line.strip()}"
             return "Gerrit rejected the push for an unknown reason"
         else:
-            return f"Unknown error: {exc}"
+            # For unknown errors, include more context
+            context_parts = []
+            if exc.returncode is not None:
+                context_parts.append(f"exit code {exc.returncode}")
+            if exc.cmd:
+                context_parts.append(f"command: {' '.join(exc.cmd)}")
+
+            context = f" ({', '.join(context_parts)})" if context_parts else ""
+            return f"Unknown error{context}: {exc}"
 
     def _query_gerrit_for_results(
         self,
@@ -3933,6 +4227,295 @@ class Orchestrator:
             out.append(c)
         return out
 
+    def _validate_committed_files(
+        self, gh: GitHubContext, result: SubmissionResult
+    ) -> None:
+        """Validate that only expected files from the GitHub PR were
+        committed to Gerrit.
+
+        This is a safety check to ensure no tool artifacts (like SSH keys) were
+        accidentally included in the Gerrit change.
+        """
+        if not gh.pr_number or not result.commit_shas:
+            log.debug("Skipping file validation - no PR number or commit SHAs")
+            return
+
+        try:
+            # Get files changed in the GitHub PR
+            from .github_api import build_client
+            from .github_api import get_pull
+            from .github_api import get_repo_from_env
+
+            client = build_client()
+            repo = get_repo_from_env(client)
+            pr_obj = get_pull(repo, int(gh.pr_number))
+
+            # Get list of files changed in the PR
+            github_files = set()
+            for file in pr_obj.get_files():  # type: ignore[attr-defined]
+                github_files.add(file.filename)
+
+            log.debug(
+                "GitHub PR files (%d): %s",
+                len(github_files),
+                sorted(github_files),
+            )
+
+            # Check files in each commit SHA that was pushed to Gerrit
+            for commit_sha in result.commit_shas:
+                try:
+                    # Get files changed in the Gerrit commit
+                    from .gitutils import run_cmd
+
+                    files_output = run_cmd(
+                        [
+                            "git",
+                            "show",
+                            "--name-only",
+                            "--pretty=format:",
+                            commit_sha,
+                        ],
+                        cwd=self.workspace,
+                    ).stdout.strip()
+
+                    if not files_output:
+                        continue
+
+                    gerrit_files = {
+                        f.strip() for f in files_output.split("\n") if f.strip()
+                    }
+                    log.debug(
+                        "Gerrit commit %s files (%d): %s",
+                        commit_sha[:8],
+                        len(gerrit_files),
+                        sorted(gerrit_files),
+                    )
+
+                    # Check for unexpected files
+                    unexpected_files = gerrit_files - github_files
+                    if unexpected_files:
+                        # Filter out known safe files that might legitimately
+                        # differ
+                        suspicious_files = []
+                        for f in unexpected_files:
+                            # Skip files that are legitimately different
+                            if f in [".gitreview", ".gitignore"]:
+                                continue
+                            # Flag SSH artifacts and other suspicious files
+                            if (
+                                ".ssh" in f
+                                or "known_hosts" in f
+                                or f.startswith("gerrit_key")
+                            ):
+                                suspicious_files.append(f)
+                            else:
+                                # Other unexpected files - log but don't error
+                                log.warning(
+                                    "Unexpected file in Gerrit commit: %s", f
+                                )
+
+                        if suspicious_files:
+                            log.error(
+                                "❌ CRITICAL: SSH artifacts detected in Gerrit "
+                                "commit %s: %s",
+                                commit_sha[:8],
+                                suspicious_files,
+                            )
+                            log.error(
+                                "This indicates a serious bug where tool "
+                                "artifacts were committed. The Gerrit change "
+                                "may need manual cleanup."
+                            )
+                            # Don't fail the pipeline, but log prominently for
+                            # monitoring
+
+                    # Also check if we're missing expected files
+                    missing_files = github_files - gerrit_files
+                    if missing_files:
+                        log.warning(
+                            "Files in GitHub PR but not in Gerrit commit "
+                            "%s: %s",
+                            commit_sha[:8],
+                            sorted(missing_files),
+                        )
+
+                except Exception as commit_exc:
+                    log.debug(
+                        "Failed to validate files for commit %s: %s",
+                        commit_sha[:8],
+                        commit_exc,
+                    )
+
+        except Exception as exc:
+            log.debug("File validation failed (non-critical): %s", exc)
+
+    def _analyze_merge_failure(
+        self, merge_exc: CommandError, base_sha: str, head_sha: str
+    ) -> str:
+        """Analyze git merge failure and provide detailed error information."""
+        error_parts = []
+
+        # Include basic command info
+        if merge_exc.cmd:
+            error_parts.append(f"Command: {' '.join(merge_exc.cmd)}")
+        if merge_exc.returncode is not None:
+            error_parts.append(f"Exit code: {merge_exc.returncode}")
+
+        # Analyze stderr for common patterns
+        stderr = merge_exc.stderr or ""
+        if "conflict" in stderr.lower():
+            error_parts.append("Merge conflicts detected")
+        if "abort" in stderr.lower():
+            error_parts.append("Merge was aborted")
+        if "fatal" in stderr.lower():
+            error_parts.append("Fatal git error occurred")
+
+        # Include actual git output
+        if merge_exc.stdout and merge_exc.stdout.strip():
+            error_parts.append(f"Git output: {merge_exc.stdout.strip()}")
+        if stderr and stderr.strip():
+            error_parts.append(f"Git error: {stderr.strip()}")
+
+        return (
+            "; ".join(error_parts) if error_parts else "Unknown merge failure"
+        )
+
+    def _suggest_merge_recovery(
+        self, merge_exc: CommandError, base_sha: str, head_sha: str
+    ) -> str:
+        """Suggest recovery actions based on merge failure analysis."""
+        stderr = (merge_exc.stderr or "").lower()
+
+        if "conflict" in stderr:
+            return "Check for merge conflicts in the PR files and resolve them"
+        elif "fatal: refusing to merge unrelated histories" in stderr:
+            return (
+                "The branches have unrelated histories - check if the PR "
+                "branch is based on the correct target"
+            )
+        elif "nothing to commit" in stderr:
+            return (
+                "No changes to merge - the PR may already be merged or have "
+                "no differences"
+            )
+        elif "abort" in stderr:
+            return (
+                "Previous merge operation may have been interrupted - check "
+                "repository state"
+            )
+
+        # Try to provide generic guidance
+        try:
+            # Check if commits exist between base and head
+            commits_cmd = ["git", "rev-list", f"{base_sha}..{head_sha}"]
+            commits_result = run_cmd(
+                commits_cmd, cwd=self.workspace, check=False
+            )
+            if (
+                commits_result.returncode == 0
+                and not commits_result.stdout.strip()
+            ):
+                return (
+                    "No commits found between base and head - PR may be empty "
+                    "or already merged"
+                )
+        except Exception as e:
+            log.debug(
+                "Failed to check commit range for recovery suggestion: %s", e
+            )
+
+        return (
+            "Review git repository state and ensure PR branch is properly "
+            "synchronized with target"
+        )
+
+    def _debug_merge_failure_context(
+        self, base_sha: str, head_sha: str
+    ) -> None:
+        """Provide extensive debugging context for merge failures when verbose mode is enabled."""  # noqa: E501
+        log.error("=== VERBOSE MODE: Extended merge failure analysis ===")
+
+        try:
+            # Show detailed git log between base and head
+            log_result = run_cmd(
+                [
+                    "git",
+                    "log",
+                    "--oneline",
+                    "--graph",
+                    f"{base_sha}..{head_sha}",
+                ],
+                cwd=self.workspace,
+                check=False,
+            )
+            if log_result.returncode == 0:
+                log.error("Commits to be merged:\n%s", log_result.stdout)
+            else:
+                log.error("Failed to get commit log: %s", log_result.stderr)
+
+            # Show file differences
+            diff_result = run_cmd(
+                ["git", "diff", "--name-status", base_sha, head_sha],
+                cwd=self.workspace,
+                check=False,
+            )
+            if diff_result.returncode == 0:
+                log.error(
+                    "Files changed between base and head:\n%s",
+                    diff_result.stdout,
+                )
+
+            # Show merge-base information
+            merge_base_result = run_cmd(
+                ["git", "merge-base", "--is-ancestor", base_sha, head_sha],
+                cwd=self.workspace,
+                check=False,
+            )
+            if merge_base_result.returncode == 0:
+                log.error(
+                    "Base SHA %s is an ancestor of head SHA %s",
+                    base_sha[:8],
+                    head_sha[:8],
+                )
+            else:
+                log.error(
+                    "Base SHA %s is NOT an ancestor of head SHA %s",
+                    base_sha[:8],
+                    head_sha[:8],
+                )
+
+            # Show current repository state
+            status_result = run_cmd(
+                ["git", "status", "--porcelain"],
+                cwd=self.workspace,
+                check=False,
+            )
+            if status_result.stdout.strip():
+                log.error(
+                    "Repository has uncommitted changes:\n%s",
+                    status_result.stdout,
+                )
+
+            # Show current branch and HEAD
+            branch_result = run_cmd(
+                ["git", "branch", "--show-current"],
+                cwd=self.workspace,
+                check=False,
+            )
+            if branch_result.returncode == 0:
+                log.error("Current branch: %s", branch_result.stdout.strip())
+
+            head_result = run_cmd(
+                ["git", "rev-parse", "HEAD"], cwd=self.workspace, check=False
+            )
+            if head_result.returncode == 0:
+                log.error("Current HEAD: %s", head_result.stdout.strip())
+
+        except Exception:
+            log.exception("Failed to gather debug context")
+
+        log.error("=== End verbose merge failure analysis ===")
+
 
 # ---------------------
 # Utility functions

github2gerrit/ssh_agent_setup.py

@@ -53,7 +53,8 @@ class SSHAgentManager:
         """Initialize SSH agent manager.
 
         Args:
-            workspace: The workspace directory for storing temporary files
+            workspace: Secure temporary directory for storing SSH files (outside
+                git workspace)
         """
         self.workspace = workspace
         self.agent_pid: int | None = None
@@ -160,7 +161,9 @@ class SSHAgentManager:
             known_hosts_content: The known hosts content
         """
         try:
-            # Create tool-specific SSH directory
+            # Create tool-specific SSH directory in secure temp location
+            # Note: workspace is now a separate secure temp directory outside
+            # git workspace
             tool_ssh_dir = self.workspace / ".ssh-g2g"
             tool_ssh_dir.mkdir(mode=0o700, exist_ok=True)
 
@@ -259,7 +262,7 @@ class SSHAgentManager:
             return result.stdout
 
     def cleanup(self) -> None:
-        """Clean up SSH agent and temporary files."""
+        """Securely clean up SSH agent and temporary files."""
         try:
             # Kill SSH agent if we started it
             if self.agent_pid:
@@ -276,14 +279,44 @@ class SSHAgentManager:
                 elif key in os.environ:
                     del os.environ[key]
 
-            # Clean up temporary files
+            # Securely clean up temporary files
             tool_ssh_dir = self.workspace / ".ssh-g2g"
             if tool_ssh_dir.exists():
                 import shutil
 
+                # First, overwrite any key files to prevent recovery
+                try:
+                    for root, _dirs, files in os.walk(tool_ssh_dir):
+                        for file in files:
+                            file_path = Path(root) / file
+                            if file_path.exists() and file_path.is_file():
+                                # Overwrite file with random data
+                                try:
+                                    size = file_path.stat().st_size
+                                    if size > 0:
+                                        import secrets
+
+                                        with open(file_path, "wb") as f:
+                                            f.write(secrets.token_bytes(size))
+                                            # Sync to ensure write completes
+                                            os.fsync(f.fileno())
+                                except Exception as overwrite_exc:
+                                    log.debug(
+                                        "Failed to overwrite %s: %s",
+                                        file_path,
+                                        overwrite_exc,
+                                    )
+                except Exception as walk_exc:
+                    log.debug(
+                        "Failed to walk SSH temp directory for secure "
+                        "cleanup: %s",
+                        walk_exc,
+                    )
+
                 shutil.rmtree(tool_ssh_dir)
                 log.debug(
-                    "Cleaned up temporary SSH directory: %s", tool_ssh_dir
+                    "Securely cleaned up temporary SSH directory: %s",
+                    tool_ssh_dir,
                 )
 
         except Exception as exc:
@@ -300,7 +333,8 @@ def setup_ssh_agent_auth(
     """Setup SSH agent-based authentication.
 
     Args:
-        workspace: The workspace directory
+        workspace: Secure temporary directory for SSH files (outside git
+            workspace)
         private_key_content: SSH private key content
         known_hosts_content: Known hosts content
 

{github2gerrit-0.1.14.dist-info → github2gerrit-0.1.16.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github2gerrit
-Version: 0.1.14
+Version: 0.1.16
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit

{github2gerrit-0.1.14.dist-info → github2gerrit-0.1.16.dist-info}/RECORD

@@ -1,8 +1,8 @@
 github2gerrit/__init__.py,sha256=N1Vj1HJ28LKCJLAynQdm5jFGQQAz9YSMzZhEfvbBgow,886
-github2gerrit/cli.py,sha256=iJ8s15Wslgt9FfHjUEELlrP5JGLDqn9j5GoH5aNZxVU,65286
+github2gerrit/cli.py,sha256=edQGODSo0A1RfvO0C7zAjWwIZCnt4RT67BnJwgL0MAY,67843
 github2gerrit/commit_normalization.py,sha256=5HqUJ7p3WQzUYNTkganIsu82aW1wZrh7J7ivQvdCYXw,17033
 github2gerrit/config.py,sha256=khuXAfmOc2wqO4r1Cpp8PYk04AO-JpmnJvSWQZ3fdL8,22315
-github2gerrit/core.py,sha256=b6cmEX7Aa2LpcdqXm8VIKM9cqd4wi50vKeYXEo1H_Ek,149356
+github2gerrit/core.py,sha256=hf7XDZ83PD_dYu79u-9u_pboDqu_iL9TpdIaa64_q-0,172360
 github2gerrit/duplicate_detection.py,sha256=HSL1IpyfPk0yLkzCKA8mWadYB3qENR6Ar3AfiH59lCI,28766
 github2gerrit/external_api.py,sha256=9483kkgIs1ECOl_f0lcGb8GrJQF9IfYmWfBQwUJT9hk,18480
 github2gerrit/gerrit_query.py,sha256=7AR9UEwZxtTb9V-l17UDdtWvlvROlnIeJVMa57ilf6s,8343
@@ -17,15 +17,15 @@ github2gerrit/reconcile_matcher.py,sha256=UpFAGqOD0NSKJKqKN_ErpNtqG0MEXxVEMywnKW
 github2gerrit/rich_display.py,sha256=hA2lXdbG3FOPozI_JTyU52o67oCS9LMUyc2odEpaAjo,15466
 github2gerrit/rich_logging.py,sha256=AEcPksmg2kj3eFOZHuU-_kWzGCKh-m__ZgDzwECBtaY,10281
 github2gerrit/similarity.py,sha256=-YHnscTrVh1jdfA3JRLPkbVjaZ5FpFdmXe8UPlTG1ss,15888
-github2gerrit/ssh_agent_setup.py,sha256=Wni94Zs86AVYalmVKfZ8lRzBnWybtJUwDltdpMC4Qnw,12864
+github2gerrit/ssh_agent_setup.py,sha256=dwEP7b2EAd0QXm4mCdgbdbGMqmYWk8z1U_EswBAySnI,14610
 github2gerrit/ssh_common.py,sha256=ClABtIqXiYIfUn58Shw7uHZ6Ham1ysHn0EpcUHjQ8D8,8261
 github2gerrit/ssh_discovery.py,sha256=g8acjEczGEtYuAJzIRsLDAHTQzyS9RaHOoQV5dAMoes,17754
 github2gerrit/trailers.py,sha256=9w0vIxPNBNQp56sIy-MF62d22Rm6vY-msh9ao1lX0rQ,8384
 github2gerrit/utils.py,sha256=1CKTsQo_FO3eyVjzNUT3XyFnyObIxyEFLeSmVKzavVo,3397
 github2gerrit/orchestrator/__init__.py,sha256=HAEcdCAHOFr8LsdIwAdcIcFZn_ayMbX9rdVUULp8410,864
 github2gerrit/orchestrator/reconciliation.py,sha256=qLhmjnIblSa_PVmBblWJ1gSvJ6Gto2AIVOVdYvT6zbk,18364
-github2gerrit-0.1.14.dist-info/METADATA,sha256=YPSKTfw0f9j33f7uybQvkbeRqnSRdA4lLAxk1fkBw7s,33833
-github2gerrit-0.1.14.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-github2gerrit-0.1.14.dist-info/entry_points.txt,sha256=MxN2_liIKo3-xJwtAulAeS5GcOS6JS96nvwOQIkP3W8,56
-github2gerrit-0.1.14.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-github2gerrit-0.1.14.dist-info/RECORD,,
+github2gerrit-0.1.16.dist-info/METADATA,sha256=02ry4GJBvmh4lqF27joxLA_s9be7UqOv95-89plq_fQ,33833
+github2gerrit-0.1.16.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+github2gerrit-0.1.16.dist-info/entry_points.txt,sha256=MxN2_liIKo3-xJwtAulAeS5GcOS6JS96nvwOQIkP3W8,56
+github2gerrit-0.1.16.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+github2gerrit-0.1.16.dist-info/RECORD,,