github2gerrit 0.1.5__py3-none-any.whl → 0.1.7__py3-none-any.whl

github2gerrit/core.py

@@ -29,6 +29,7 @@ from __future__ import annotations
 import logging
 import os
 import re
+import shlex
 import stat
 import urllib.parse
 import urllib.request
@@ -38,6 +39,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
+from .commit_normalization import normalize_commit_title
+from .gerrit_urls import create_gerrit_url_builder
 from .github_api import build_client
 from .github_api import close_pr
 from .github_api import create_pr_comment
@@ -48,6 +51,7 @@ from .github_api import get_repo_from_env
 from .github_api import iter_open_pulls
 from .gitutils import CommandError
 from .gitutils import GitError
+from .gitutils import _parse_trailers
 from .gitutils import git_cherry_pick
 from .gitutils import git_commit_amend
 from .gitutils import git_commit_new
@@ -57,6 +61,10 @@ from .gitutils import git_show
 from .gitutils import run_cmd
 from .models import GitHubContext
 from .models import Inputs
+from .pr_content_filter import filter_pr_body
+from .ssh_common import merge_known_hosts_content
+from .utils import env_bool
+from .utils import log_exception_conditionally
 
 
 try:
@@ -74,20 +82,19 @@ except ImportError:
     auto_discover_gerrit_host_keys = None  # type: ignore[assignment]
     SSHDiscoveryError = Exception  # type: ignore[misc,assignment]
 
+try:
+    from .ssh_agent_setup import SSHAgentManager
+    from .ssh_agent_setup import setup_ssh_agent_auth
+except ImportError:
+    # Fallback if ssh_agent_setup module is not available
+    from typing import TYPE_CHECKING
 
-def _is_verbose_mode() -> bool:
-    """Check if verbose mode is enabled via environment variable."""
-    return os.getenv("G2G_VERBOSE", "").lower() in ("true", "1", "yes")
-
-
-def _log_exception_conditionally(
-    logger: logging.Logger, message: str, *args: Any
-) -> None:
-    """Log exception with traceback only if verbose mode is enabled."""
-    if _is_verbose_mode():
-        logger.exception(message, *args)
+    if TYPE_CHECKING:
+        from .ssh_agent_setup import SSHAgentManager
+        from .ssh_agent_setup import setup_ssh_agent_auth
     else:
-        logger.error(message, *args)
+        SSHAgentManager = None
+        setup_ssh_agent_auth = None
 
 
 log = logging.getLogger("github2gerrit.core")
@@ -125,10 +132,7 @@ def _insert_issue_id_into_commit_message(message: str, issue_id: str) -> str:
         raise ValueError(_MSG_ISSUE_ID_MULTILINE)
 
     # Format as proper Issue-ID trailer
-    if cleaned_issue_id.startswith("Issue-ID:"):
-        issue_line = cleaned_issue_id
-    else:
-        issue_line = f"Issue-ID: {cleaned_issue_id}"
+    issue_line = cleaned_issue_id if cleaned_issue_id.startswith("Issue-ID:") else f"Issue-ID: {cleaned_issue_id}"
 
     lines = message.splitlines()
     if not lines:
@@ -169,11 +173,22 @@ def _match_first_group(pattern: str, text: str) -> str | None:
 
 
 def _is_valid_change_id(value: str) -> bool:
-    # Gerrit Change-Id usually matches I<40-hex> but the shell workflow
-    # uses a looser grep. Keep validation permissive for now.
+    # Gerrit Change-Id should match I<40-hex-chars> format
+    # Be more strict to avoid accepting invalid Change-IDs
     if not value:
         return False
-    return bool(re.fullmatch(r"[A-Za-z0-9._-]+", value))
+    # Standard Gerrit format: I followed by exactly 40 hex characters
+    if len(value) == 41 and re.fullmatch(r"I[0-9a-fA-F]{40}", value):
+        return True
+    # Fallback for legacy or non-standard formats (keep some permissiveness)
+    # but require it to start with 'I' and be reasonable length (10-40 chars)
+    # and NOT look like a malformed hex ID
+    return (
+        value.startswith("I")
+        and 10 <= len(value) <= 40
+        and not re.fullmatch(r"I[0-9a-fA-F]+", value)  # Exclude hex-like patterns
+        and bool(re.fullmatch(r"I[A-Za-z0-9._-]+", value))
+    )
 
 
 @dataclass(frozen=True)
@@ -234,6 +249,8 @@ class Orchestrator:
         # SSH configuration paths (set by _setup_ssh)
         self._ssh_key_path: Path | None = None
         self._ssh_known_hosts_path: Path | None = None
+        self._ssh_agent_manager: SSHAgentManager | None = None
+        self._use_ssh_agent: bool = False
 
     # ---------------
     # Public API
@@ -249,6 +266,10 @@ class Orchestrator:
         This method defines the high-level call order. Sub-steps are
         placeholders and must be implemented with real logic. Until then,
         this raises NotImplementedError after logging the intended plan.
+
+        Note: This method is "pure" with respect to external outputs (no direct
+        GitHub output writes), but does perform internal environment mutations
+        (e.g., G2G_TMP_BRANCH) for subprocess coordination within the workflow.
         """
         log.info("Starting PR -> Gerrit pipeline")
         self._guard_pull_request_context(gh)
@@ -259,18 +280,41 @@ class Orchestrator:
 
         gitreview = self._read_gitreview(self.workspace / ".gitreview", gh)
         repo_names = self._derive_repo_names(gitreview, gh)
+        log.debug("execute: inputs.dry_run=%s, inputs.ci_testing=%s", inputs.dry_run, inputs.ci_testing)
         gerrit = self._resolve_gerrit_info(gitreview, inputs, repo_names)
 
+        log.debug("execute: resolved gerrit info: %s", gerrit)
         if inputs.dry_run:
+            log.debug("execute: entering dry-run mode due to inputs.dry_run=True")
             # Perform preflight validations and exit without making changes
-            self._dry_run_preflight(
-                gerrit=gerrit, inputs=inputs, gh=gh, repo=repo_names
-            )
+            self._dry_run_preflight(gerrit=gerrit, inputs=inputs, gh=gh, repo=repo_names)
             log.info("Dry run complete; skipping write operations to Gerrit")
-            return SubmissionResult(
-                change_urls=[], change_numbers=[], commit_shas=[]
-            )
+            return SubmissionResult(change_urls=[], change_numbers=[], commit_shas=[])
         self._setup_ssh(inputs, gerrit)
+        # Establish baseline non-interactive SSH/Git environment
+        # for all child processes
+        os.environ.update(self._ssh_env())
+
+        # Ensure commit/tag signing is disabled before any commit operations
+        # to avoid agent prompts
+        try:
+            git_config(
+                "commit.gpgsign",
+                "false",
+                global_=False,
+                cwd=self.workspace,
+            )
+        except GitError:
+            git_config("commit.gpgsign", "false", global_=True)
+        try:
+            git_config(
+                "tag.gpgsign",
+                "false",
+                global_=False,
+                cwd=self.workspace,
+            )
+        except GitError:
+            git_config("tag.gpgsign", "false", global_=True)
 
         if inputs.submit_single_commits:
             prep = self._prepare_single_commits(inputs, gh, gerrit)
@@ -354,13 +398,8 @@ class Orchestrator:
                 repo_obj: Any = get_repo_from_env(client)
                 # Prefer a specific ref when available; otherwise default branch
                 ref = os.getenv("GITHUB_HEAD_REF") or os.getenv("GITHUB_SHA")
-                if ref:
-                    content = repo_obj.get_contents(".gitreview", ref=ref)
-                else:
-                    content = repo_obj.get_contents(".gitreview")
-                text_remote = (
-                    getattr(content, "decoded_content", b"") or b""
-                ).decode("utf-8")
+                content = repo_obj.get_contents(".gitreview", ref=ref) if ref else repo_obj.get_contents(".gitreview")
+                text_remote = (getattr(content, "decoded_content", b"") or b"").decode("utf-8")
                 info_remote = self._parse_gitreview_text(text_remote)
                 if info_remote:
                     log.debug("Parsed remote .gitreview: %s", info_remote)
@@ -370,14 +409,7 @@ class Orchestrator:
                 log.debug("Remote .gitreview not available: %s", exc)
             # Attempt raw.githubusercontent.com as a fallback
             try:
-                repo_full = (
-                    (
-                        gh.repository
-                        if gh
-                        else os.getenv("GITHUB_REPOSITORY", "")
-                    )
-                    or ""
-                ).strip()
+                repo_full = ((gh.repository if gh else os.getenv("GITHUB_REPOSITORY", "")) or "").strip()
                 branches: list[str] = []
                 # Prefer PR head/base refs via GitHub API when running
                 # from a direct URL when a token is available
@@ -391,18 +423,8 @@ class Orchestrator:
                         client = build_client()
                         repo_obj = get_repo_from_env(client)
                         pr_obj = get_pull(repo_obj, int(gh.pr_number))
-                        api_head = str(
-                            getattr(
-                                getattr(pr_obj, "head", object()), "ref", ""
-                            )
-                            or ""
-                        )
-                        api_base = str(
-                            getattr(
-                                getattr(pr_obj, "base", object()), "ref", ""
-                            )
-                            or ""
-                        )
+                        api_head = str(getattr(getattr(pr_obj, "head", object()), "ref", "") or "")
+                        api_base = str(getattr(getattr(pr_obj, "base", object()), "ref", "") or "")
                         if api_head:
                             branches.append(api_head)
                         if api_base:
@@ -422,15 +444,9 @@ class Orchestrator:
                     if not br or br in tried:
                         continue
                     tried.add(br)
-                    url = (
-                        f"https://raw.githubusercontent.com/"
-                        f"{repo_full}/refs/heads/{br}/.gitreview"
-                    )
+                    url = f"https://raw.githubusercontent.com/{repo_full}/refs/heads/{br}/.gitreview"
                     parsed = urllib.parse.urlparse(url)
-                    if (
-                        parsed.scheme != "https"
-                        or parsed.netloc != "raw.githubusercontent.com"
-                    ):
+                    if parsed.scheme != "https" or parsed.netloc != "raw.githubusercontent.com":
                         continue
                     log.info("Fetching .gitreview via raw URL: %s", url)
                     with urllib.request.urlopen(url, timeout=5) as resp:  # noqa: S310
@@ -496,7 +512,16 @@ class Orchestrator:
         repo: RepoNames,
     ) -> GerritInfo:
         """Resolve Gerrit connection info from .gitreview or inputs."""
+        log.debug("_resolve_gerrit_info: inputs.ci_testing=%s", inputs.ci_testing)
+        log.debug("_resolve_gerrit_info: gitreview=%s", gitreview)
+
+        # If CI testing flag is set, ignore .gitreview and use environment
+        if inputs.ci_testing:
+            log.info("CI_TESTING enabled: ignoring .gitreview file")
+            gitreview = None
+
         if gitreview:
+            log.debug("Using .gitreview settings: %s", gitreview)
             return gitreview
 
         host = inputs.gerrit_server.strip()
@@ -545,45 +570,126 @@ class Orchestrator:
             log.debug("SSH private key not provided, skipping SSH setup")
             return
 
-        # Auto-discover host keys if not provided
+        # Auto-discover or augment host keys (merge missing types/[host]:port entries)
         effective_known_hosts = inputs.gerrit_known_hosts
-        if (
-            not effective_known_hosts
-            and auto_discover_gerrit_host_keys is not None
-        ):
-            log.info(
-                "GERRIT_KNOWN_HOSTS not provided, attempting auto-discovery..."
-            )
+        if auto_discover_gerrit_host_keys is not None:
             try:
-                discovered_keys = auto_discover_gerrit_host_keys(
-                    gerrit_hostname=gerrit.host,
-                    gerrit_port=gerrit.port,
-                    organization=inputs.organization,
-                    save_to_config=True,
-                )
-                if discovered_keys:
-                    effective_known_hosts = discovered_keys
-                    log.info(
-                        "Successfully auto-discovered SSH host keys for %s:%d",
-                        gerrit.host,
-                        gerrit.port,
+                if not effective_known_hosts:
+                    log.info("GERRIT_KNOWN_HOSTS not provided, attempting auto-discovery...")
+                    discovered_keys = auto_discover_gerrit_host_keys(
+                        gerrit_hostname=gerrit.host,
+                        gerrit_port=gerrit.port,
+                        organization=inputs.organization,
+                        save_to_config=True,
                     )
+                    if discovered_keys:
+                        effective_known_hosts = discovered_keys
+                        log.info(
+                            "Successfully auto-discovered SSH host keys for %s:%d",
+                            gerrit.host,
+                            gerrit.port,
+                        )
+                    else:
+                        log.warning("Auto-discovery failed, SSH host key verification may fail")
                 else:
-                    log.warning(
-                        "Auto-discovery failed, SSH host key verification may "
-                        "fail"
-                    )
+                    # Provided known_hosts exists; ensure it contains [host]:port entries and modern key types
+                    lower = effective_known_hosts.lower()
+                    bracket_host = f"[{gerrit.host}]:{gerrit.port}"
+                    bracket_lower = bracket_host.lower()
+                    needs_discovery = False
+                    if bracket_lower not in lower:
+                        needs_discovery = True
+                    else:
+                        # Confirm at least one known key type exists for the bracketed host
+                        if (
+                            f"{bracket_lower} ssh-ed25519" not in lower
+                            and f"{bracket_lower} ecdsa-sha2" not in lower
+                            and f"{bracket_lower} ssh-rsa" not in lower
+                        ):
+                            needs_discovery = True
+                    if needs_discovery:
+                        log.info(
+                            "Augmenting provided GERRIT_KNOWN_HOSTS with discovered entries for %s:%d",
+                            gerrit.host,
+                            gerrit.port,
+                        )
+                        discovered_keys = auto_discover_gerrit_host_keys(
+                            gerrit_hostname=gerrit.host,
+                            gerrit_port=gerrit.port,
+                            organization=inputs.organization,
+                            save_to_config=True,
+                        )
+                        if discovered_keys:
+                            # Use centralized merging logic
+                            effective_known_hosts = merge_known_hosts_content(effective_known_hosts, discovered_keys)
+                            log.info(
+                                "Known hosts augmented with discovered entries for %s:%d",
+                                gerrit.host,
+                                gerrit.port,
+                            )
+                        else:
+                            log.warning("Auto-discovery returned no keys; known_hosts not augmented")
             except Exception as exc:
-                log.warning("SSH host key auto-discovery failed: %s", exc)
+                log.warning("SSH host key auto-discovery/augmentation failed: %s", exc)
 
         if not effective_known_hosts:
-            log.debug(
-                "No SSH host keys available (manual or auto-discovered), "
-                "skipping SSH setup"
-            )
+            log.debug("No SSH host keys available (manual or auto-discovered), skipping SSH setup")
             return
 
-        log.info("Setting up temporary SSH configuration for Gerrit")
+        # Check if SSH agent authentication is preferred
+        use_ssh_agent = env_bool("G2G_USE_SSH_AGENT", default=True)
+
+        if use_ssh_agent and setup_ssh_agent_auth is not None:
+            # Try SSH agent first as it's more secure and avoids file permission issues
+            if self._try_ssh_agent_setup(inputs, effective_known_hosts):
+                return
+
+            # Fall back to file-based SSH if agent setup fails
+            log.info("Falling back to file-based SSH authentication")
+
+        self._setup_file_based_ssh(inputs, effective_known_hosts)
+
+    def _try_ssh_agent_setup(self, inputs: Inputs, effective_known_hosts: str) -> bool:
+        """Try to setup SSH agent-based authentication.
+
+        Args:
+            inputs: Validated input configuration
+            effective_known_hosts: Known hosts content
+
+        Returns:
+            True if SSH agent setup succeeded, False otherwise
+        """
+        if setup_ssh_agent_auth is None:
+            log.debug("SSH agent module not available, falling back to file-based SSH")  # type: ignore[unreachable]
+            return False
+
+        try:
+            log.info("Setting up SSH agent-based authentication (more secure)")
+            self._ssh_agent_manager = setup_ssh_agent_auth(
+                workspace=self.workspace,
+                private_key_content=inputs.gerrit_ssh_privkey_g2g,
+                known_hosts_content=effective_known_hosts,
+            )
+            self._use_ssh_agent = True
+            log.info("SSH agent authentication configured successfully")
+
+        except Exception as exc:
+            log.warning("SSH agent setup failed, falling back to file-based SSH: %s", exc)
+            if self._ssh_agent_manager:
+                self._ssh_agent_manager.cleanup()
+                self._ssh_agent_manager = None
+            return False
+        else:
+            return True
+
+    def _setup_file_based_ssh(self, inputs: Inputs, effective_known_hosts: str) -> None:
+        """Setup file-based SSH authentication as fallback.
+
+        Args:
+            inputs: Validated input configuration
+            effective_known_hosts: Known hosts content
+        """
+        log.info("Setting up file-based SSH configuration for Gerrit")
         log.debug("Using workspace-specific SSH files to avoid user changes")
 
         # Create tool-specific SSH directory in workspace to avoid touching
@@ -591,13 +697,26 @@ class Orchestrator:
         tool_ssh_dir = self.workspace / ".ssh-g2g"
         tool_ssh_dir.mkdir(mode=0o700, exist_ok=True)
 
-        # Write SSH private key to tool-specific location
+        # Write SSH private key to tool-specific location with secure permissions
         key_path = tool_ssh_dir / "gerrit_key"
-        with open(key_path, "w", encoding="utf-8") as f:
-            f.write(inputs.gerrit_ssh_privkey_g2g.strip() + "\n")
-        key_path.chmod(0o600)
-        log.debug("SSH private key written to %s", key_path)
-        log.debug("Key file is tool-specific and won't interfere with user SSH")
+
+        # Use a more robust approach for creating the file with secure permissions
+        key_content = inputs.gerrit_ssh_privkey_g2g.strip() + "\n"
+
+        # Multiple strategies to create secure key file
+        success = self._create_secure_key_file(key_path, key_content)
+
+        if not success:
+            # If all permission strategies fail, create in memory directory
+            success = self._create_key_in_memory_fs(key_path, key_content)
+
+        if not success:
+            msg = (
+                "Failed to create SSH key file with secure permissions. "
+                "This may be due to CI environment restrictions. "
+                "Consider using G2G_USE_SSH_AGENT=true (default) for SSH agent authentication."
+            )
+            raise RuntimeError(msg)
 
         # Write known hosts to tool-specific location
         known_hosts_path = tool_ssh_dir / "known_hosts"
@@ -611,32 +730,200 @@ class Orchestrator:
         self._ssh_key_path = key_path
         self._ssh_known_hosts_path = known_hosts_path
 
+    def _create_secure_key_file(self, key_path: Path, key_content: str) -> bool:
+        """Try multiple strategies to create a secure SSH key file.
+
+        Args:
+            key_path: Path where to create the key file
+            key_content: SSH key content
+
+        Returns:
+            True if successful, False otherwise
+        """
+
+        strategies = [
+            ("touch+chmod", self._strategy_touch_chmod),
+            ("open+fchmod", self._strategy_open_fchmod),
+            ("umask+open", self._strategy_umask_open),
+            ("stat_constants", self._strategy_stat_constants),
+        ]
+
+        for strategy_name, strategy_func in strategies:
+            try:
+                log.debug("Trying SSH key creation strategy: %s", strategy_name)
+
+                # Remove file if it exists to start fresh
+                if key_path.exists():
+                    key_path.unlink()
+
+                # Try the strategy
+                strategy_func(key_path, key_content)
+
+                # Verify permissions
+                actual_perms = oct(key_path.stat().st_mode)[-3:]
+                if actual_perms == "600":
+                    log.debug("SSH key created successfully with strategy: %s", strategy_name)
+                    return True
+                else:
+                    log.debug("Strategy %s resulted in permissions %s", strategy_name, actual_perms)
+
+            except Exception as exc:
+                log.debug("Strategy %s failed: %s", strategy_name, exc)
+                if key_path.exists():
+                    try:
+                        key_path.unlink()
+                    except Exception as cleanup_exc:
+                        log.debug("Failed to cleanup key file: %s", cleanup_exc)
+
+        return False
+
+    def _strategy_touch_chmod(self, key_path: Path, key_content: str) -> None:
+        """Strategy: touch with mode, then write, then chmod."""
+        key_path.touch(mode=0o600)
+        with open(key_path, "w", encoding="utf-8") as f:
+            f.write(key_content)
+        key_path.chmod(0o600)
+
+    def _strategy_open_fchmod(self, key_path: Path, key_content: str) -> None:
+        """Strategy: open with os.open and specific flags, then fchmod."""
+        import os
+        import stat
+
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+        mode = stat.S_IRUSR | stat.S_IWUSR  # 0o600
+
+        fd = os.open(str(key_path), flags, mode)
+        try:
+            os.fchmod(fd, mode)
+            os.write(fd, key_content.encode("utf-8"))
+        finally:
+            os.close(fd)
+
+    def _strategy_umask_open(self, key_path: Path, key_content: str) -> None:
+        """Strategy: set umask, create file, restore umask."""
+        import os
+
+        original_umask = os.umask(0o077)  # Only owner can read/write
+        try:
+            with open(key_path, "w", encoding="utf-8") as f:
+                f.write(key_content)
+            key_path.chmod(0o600)
+        finally:
+            os.umask(original_umask)
+
+    def _strategy_stat_constants(self, key_path: Path, key_content: str) -> None:
+        """Strategy: use stat constants for permission setting."""
+        import os
+        import stat
+
+        with open(key_path, "w", encoding="utf-8") as f:
+            f.write(key_content)
+
+        # Try multiple permission setting approaches
+        mode = stat.S_IRUSR | stat.S_IWUSR
+        os.chmod(str(key_path), mode)
+        key_path.chmod(mode)
+
+    def _create_key_in_memory_fs(self, key_path: Path, key_content: str) -> bool:
+        """Fallback: try to create key in memory filesystem."""
+        import shutil
+        import tempfile
+
+        try:
+            # Try to create in memory filesystem if available
+            # Use secure temporary directories
+            import tempfile
+
+            temp_dir = tempfile.gettempdir()
+            memory_dirs = [temp_dir]
+
+            # Only add /dev/shm if it exists and is accessible
+            import os
+
+            dev_shm = Path("/dev/shm")  # noqa: S108
+            if dev_shm.exists() and os.access("/dev/shm", os.W_OK):  # noqa: S108
+                memory_dirs.insert(0, "/dev/shm")  # noqa: S108
+
+            for memory_dir in memory_dirs:
+                if not Path(memory_dir).exists():
+                    continue
+
+                tmp_path = None
+                try:
+                    with tempfile.NamedTemporaryFile(
+                        mode="w", dir=memory_dir, prefix="g2g_key_", suffix=".tmp", delete=False
+                    ) as tmp_file:
+                        tmp_file.write(key_content)
+                        tmp_path = Path(tmp_file.name)
+
+                    # Try to set permissions
+                    tmp_path.chmod(0o600)
+                    actual_perms = oct(tmp_path.stat().st_mode)[-3:]
+
+                    if actual_perms == "600":
+                        # Move to final location
+                        shutil.move(str(tmp_path), str(key_path))
+                        log.debug("Successfully created SSH key using memory filesystem: %s", memory_dir)
+                        return True
+                    else:
+                        tmp_path.unlink()
+
+                except Exception as exc:
+                    log.debug("Memory filesystem strategy failed for %s: %s", memory_dir, exc)
+                    try:
+                        if tmp_path is not None and tmp_path.exists():
+                            tmp_path.unlink()
+                    except Exception as cleanup_exc:
+                        log.debug("Failed to cleanup temporary key file: %s", cleanup_exc)
+
+        except Exception as exc:
+            log.debug("Memory filesystem fallback failed: %s", exc)
+
+        return False
+
     @property
-    def _git_ssh_command(self) -> str | None:
+    def _build_git_ssh_command(self) -> str | None:
         """Generate GIT_SSH_COMMAND for secure, isolated SSH configuration.
 
         This prevents SSH from scanning the user's SSH agent or using
         unintended keys by setting IdentitiesOnly=yes and specifying
         exact key and known_hosts files.
         """
+        if self._use_ssh_agent and self._ssh_agent_manager:
+            return self._ssh_agent_manager.get_git_ssh_command()
+
         if not self._ssh_key_path or not self._ssh_known_hosts_path:
             return None
 
-        # Build SSH command with strict options to prevent key scanning
-        ssh_options = [
-            f"-i {self._ssh_key_path}",
-            f"-o UserKnownHostsFile={self._ssh_known_hosts_path}",
-            "-o IdentitiesOnly=yes",  # Critical: prevents SSH agent scanning
-            "-o StrictHostKeyChecking=yes",
-            "-o PasswordAuthentication=no",
-            "-o PubkeyAcceptedKeyTypes=+ssh-rsa",
-            "-o ConnectTimeout=10",
-        ]
+        # Delegate to centralized SSH command builder
+        from .ssh_common import build_git_ssh_command
+
+        return build_git_ssh_command(
+            key_path=self._ssh_key_path,
+            known_hosts_path=self._ssh_known_hosts_path,
+        )
+
+    def _ssh_env(self) -> dict[str, str]:
+        """Centralized non-interactive SSH/Git environment."""
+        from .ssh_common import build_non_interactive_ssh_env
+
+        env = build_non_interactive_ssh_env()
 
-        ssh_cmd = f"ssh {' '.join(ssh_options)}"
-        masked_cmd = ssh_cmd.replace(str(self._ssh_key_path), "[KEY_PATH]")
-        log.debug("Generated SSH command: %s", masked_cmd)
-        return ssh_cmd
+        # Set GIT_SSH_COMMAND based on available configuration
+        cmd = self._build_git_ssh_command
+        if cmd:
+            env["GIT_SSH_COMMAND"] = cmd
+        else:
+            # Fallback to basic non-interactive SSH command
+            from .ssh_common import build_git_ssh_command
+
+            env["GIT_SSH_COMMAND"] = build_git_ssh_command()
+
+        # Override SSH agent settings if using SSH agent
+        if self._use_ssh_agent and self._ssh_agent_manager:
+            env.update(self._ssh_agent_manager.get_ssh_env())
+
+        return env
 
     def _cleanup_ssh(self) -> None:
         """Clean up temporary SSH files created by this tool.
@@ -644,21 +931,22 @@ class Orchestrator:
         Removes the workspace-specific .ssh-g2g directory and all contents.
         This ensures no temporary files are left behind.
         """
-        if not hasattr(self, "_ssh_key_path") or not hasattr(
-            self, "_ssh_known_hosts_path"
-        ):
-            return
+        log.debug("Cleaning up temporary SSH configuration files")
 
         try:
+            # Clean up SSH agent if we used it
+            if self._ssh_agent_manager:
+                self._ssh_agent_manager.cleanup()
+                self._ssh_agent_manager = None
+                self._use_ssh_agent = False
+
             # Remove temporary SSH directory and all contents
             tool_ssh_dir = self.workspace / ".ssh-g2g"
             if tool_ssh_dir.exists():
                 import shutil
 
                 shutil.rmtree(tool_ssh_dir)
-                log.debug(
-                    "Cleaned up temporary SSH directory: %s", tool_ssh_dir
-                )
+                log.debug("Cleaned up temporary SSH directory: %s", tool_ssh_dir)
         except Exception as exc:
             log.warning("Failed to clean up temporary SSH files: %s", exc)
 
@@ -678,9 +966,7 @@ class Orchestrator:
                 cwd=self.workspace,
             )
         except GitError:
-            git_config(
-                "gitreview.username", inputs.gerrit_ssh_user_g2g, global_=True
-            )
+            git_config("gitreview.username", inputs.gerrit_ssh_user_g2g, global_=True)
         try:
             git_config(
                 "user.name",
@@ -698,9 +984,26 @@ class Orchestrator:
                 cwd=self.workspace,
             )
         except GitError:
+            git_config("user.email", inputs.gerrit_ssh_user_g2g_email, global_=True)
+        # Disable GPG signing to avoid interactive prompts for signing keys
+        try:
+            git_config(
+                "commit.gpgsign",
+                "false",
+                global_=False,
+                cwd=self.workspace,
+            )
+        except GitError:
+            git_config("commit.gpgsign", "false", global_=True)
+        try:
             git_config(
-                "user.email", inputs.gerrit_ssh_user_g2g_email, global_=True
+                "tag.gpgsign",
+                "false",
+                global_=False,
+                cwd=self.workspace,
             )
+        except GitError:
+            git_config("tag.gpgsign", "false", global_=True)
 
         # Ensure git-review host/port/project are configured
         # when .gitreview is absent
@@ -736,16 +1039,10 @@ class Orchestrator:
             )
         except CommandError:
             ssh_user = inputs.gerrit_ssh_user_g2g.strip()
-            remote_url = (
-                f"ssh://{ssh_user}@{gerrit.host}:{gerrit.port}/{gerrit.project}"
-            )
+            remote_url = f"ssh://{ssh_user}@{gerrit.host}:{gerrit.port}/{gerrit.project}"
             log.info("Adding 'gerrit' remote: %s", remote_url)
             # Use our specific SSH configuration for adding remote
-            env = (
-                {"GIT_SSH_COMMAND": self._git_ssh_command}
-                if self._git_ssh_command
-                else None
-            )
+            env = self._ssh_env()
             run_cmd(
                 ["git", "remote", "add", "gerrit", remote_url],
                 check=False,
@@ -754,9 +1051,7 @@ class Orchestrator:
             )
 
         # Workaround for submodules commit-msg hook
-        hooks_path = run_cmd(
-            ["git", "rev-parse", "--show-toplevel"], cwd=self.workspace
-        ).stdout.strip()
+        hooks_path = run_cmd(["git", "rev-parse", "--show-toplevel"], cwd=self.workspace).stdout.strip()
         try:
             git_config(
                 "core.hooksPath",
@@ -772,11 +1067,7 @@ class Orchestrator:
         # Initialize git-review (copies commit-msg hook)
         try:
             # Use our specific SSH configuration for git-review setup
-            env = (
-                {"GIT_SSH_COMMAND": self._git_ssh_command}
-                if self._git_ssh_command
-                else None
-            )
+            env = self._ssh_env()
             run_cmd(["git", "review", "-s", "-v"], cwd=self.workspace, env=env)
         except CommandError as exc:
             msg = f"Failed to initialize git-review: {exc}"
@@ -794,12 +1085,12 @@ class Orchestrator:
         # Determine commit range: commits in HEAD not in base branch
         base_ref = f"origin/{branch}"
         # Use our SSH command for git operations that might need SSH
-        env = (
-            {"GIT_SSH_COMMAND": self._git_ssh_command}
-            if self._git_ssh_command
-            else None
+
+        run_cmd(
+            ["git", "fetch", "origin", branch],
+            cwd=self.workspace,
+            env=self._ssh_env(),
         )
-        run_cmd(["git", "fetch", "origin", branch], cwd=self.workspace, env=env)
         revs = run_cmd(
             ["git", "rev-list", "--reverse", f"{base_ref}..HEAD"],
             cwd=self.workspace,
@@ -809,14 +1100,10 @@ class Orchestrator:
             log.info("No commits to submit; returning empty PreparedChange")
             return PreparedChange(change_ids=[], commit_shas=[])
         # Create temp branch from base sha; export for downstream
-        base_sha = run_cmd(
-            ["git", "rev-parse", base_ref], cwd=self.workspace
-        ).stdout.strip()
+        base_sha = run_cmd(["git", "rev-parse", base_ref], cwd=self.workspace).stdout.strip()
         tmp_branch = f"g2g_tmp_{gh.pr_number or 'pr'!s}_{os.getpid()}"
         os.environ["G2G_TMP_BRANCH"] = tmp_branch
-        run_cmd(
-            ["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace
-        )
+        run_cmd(["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace)
         change_ids: list[str] = []
         for csha in commit_list:
             run_cmd(["git", "checkout", tmp_branch], cwd=self.workspace)
@@ -826,13 +1113,9 @@ class Orchestrator:
                 ["git", "show", "-s", "--pretty=format:%an <%ae>", csha],
                 cwd=self.workspace,
             ).stdout.strip()
-            git_commit_amend(
-                author=author, no_edit=True, signoff=True, cwd=self.workspace
-            )
+            git_commit_amend(author=author, no_edit=True, signoff=True, cwd=self.workspace)
             # Extract newly added Change-Id from last commit trailers
-            trailers = git_last_commit_trailers(
-                keys=["Change-Id"], cwd=self.workspace
-            )
+            trailers = git_last_commit_trailers(keys=["Change-Id"], cwd=self.workspace)
             for cid in trailers.get("Change-Id", []):
                 if cid:
                     change_ids.append(cid)
@@ -854,7 +1137,10 @@ class Orchestrator:
                 ", ".join(uniq_ids),
             )
         else:
-            log.warning("No Change-IDs generated for PR #%s", gh.pr_number)
+            log.debug(
+                "No Change-IDs collected during preparation for PR #%s (will be ensured via commit-msg hook)",
+                gh.pr_number,
+            )
         return PreparedChange(change_ids=uniq_ids, commit_shas=[])
 
     def _prepare_squashed_commit(
@@ -866,26 +1152,20 @@ class Orchestrator:
         """Squash PR commits into a single commit and handle Change-Id."""
         log.info("Preparing squashed commit for PR #%s", gh.pr_number)
         branch = self._resolve_target_branch()
-        env = (
-            {"GIT_SSH_COMMAND": self._git_ssh_command}
-            if self._git_ssh_command
-            else None
+
+        run_cmd(
+            ["git", "fetch", "origin", branch],
+            cwd=self.workspace,
+            env=self._ssh_env(),
         )
-        run_cmd(["git", "fetch", "origin", branch], cwd=self.workspace, env=env)
         base_ref = f"origin/{branch}"
-        base_sha = run_cmd(
-            ["git", "rev-parse", base_ref], cwd=self.workspace
-        ).stdout.strip()
-        head_sha = run_cmd(
-            ["git", "rev-parse", "HEAD"], cwd=self.workspace
-        ).stdout.strip()
+        base_sha = run_cmd(["git", "rev-parse", base_ref], cwd=self.workspace).stdout.strip()
+        head_sha = run_cmd(["git", "rev-parse", "HEAD"], cwd=self.workspace).stdout.strip()
 
         # Create temp branch from base and merge-squash PR head
         tmp_branch = f"g2g_tmp_{gh.pr_number or 'pr'!s}_{os.getpid()}"
         os.environ["G2G_TMP_BRANCH"] = tmp_branch
-        run_cmd(
-            ["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace
-        )
+        run_cmd(["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace)
         run_cmd(["git", "merge", "--squash", head_sha], cwd=self.workspace)
 
         def _collect_log_lines() -> list[str]:
@@ -913,23 +1193,17 @@ class Orchestrator:
             message_lines: list[str] = []
             in_metadata_section = False
             for ln in lines:
-                if ln.strip() in ("---", "```") or ln.startswith(
-                    "updated-dependencies:"
-                ):
+                if ln.strip() in ("---", "```") or ln.startswith("updated-dependencies:"):
                     in_metadata_section = True
                     continue
                 if in_metadata_section:
                     if ln.startswith(("- dependency-", "  dependency-")):
                         continue
-                    if (
-                        not ln.startswith(("  ", "-", "dependency-"))
-                        and ln.strip()
-                    ):
+                    if not ln.startswith(("  ", "-", "dependency-")) and ln.strip():
                         in_metadata_section = False
+                # Skip Change-Id lines from body - they should only be in footer
                 if ln.startswith("Change-Id:"):
-                    cid = ln.split(":", 1)[1].strip()
-                    if cid:
-                        change_ids.append(cid)
+                    log.debug("Skipping Change-Id from commit body: %s", ln.strip())
                     continue
                 if ln.startswith("Signed-off-by:"):
                     signed_off.append(ln)
@@ -955,17 +1229,25 @@ class Orchestrator:
                 break_points = [". ", "! ", "? ", " - ", ": "]
                 for bp in break_points:
                     if bp in title_line[:100]:
-                        title_line = title_line[
-                            : title_line.index(bp) + len(bp.strip())
-                        ]
+                        title_line = title_line[: title_line.index(bp) + len(bp.strip())]
                         break
                 else:
                     words = title_line[:100].split()
-                    title_line = (
-                        " ".join(words[:-1])
-                        if len(words) > 1
-                        else title_line[:100].rstrip()
-                    )
+                    title_line = " ".join(words[:-1]) if len(words) > 1 else title_line[:100].rstrip()
+
+            # Apply conventional commit normalization if enabled
+            if inputs.normalise_commit and gh.pr_number:
+                try:
+                    # Get PR author for normalization context
+                    client = build_client()
+                    repo = get_repo_from_env(client)
+                    pr_obj = get_pull(repo, int(gh.pr_number))
+                    author = getattr(pr_obj, "user", {})
+                    author_login = getattr(author, "login", "") if author else ""
+                    title_line = normalize_commit_title(title_line, author_login, self.workspace)
+                except Exception as e:
+                    log.debug("Failed to apply commit normalization in squash mode: %s", e)
+
             return title_line
 
         def _build_clean_message_lines(message_lines: list[str]) -> list[str]:
@@ -975,10 +1257,7 @@ class Orchestrator:
             out: list[str] = [title_line]
             if len(message_lines) > 1:
                 body_start = 1
-                while (
-                    body_start < len(message_lines)
-                    and not message_lines[body_start].strip()
-                ):
+                while body_start < len(message_lines) and not message_lines[body_start].strip():
                     body_start += 1
                 if body_start < len(message_lines):
                     out.append("")
@@ -987,9 +1266,7 @@ class Orchestrator:
 
         def _maybe_reuse_change_id(pr_str: str) -> str:
             reuse = ""
-            sync_all_prs = (
-                os.getenv("SYNC_ALL_OPEN_PRS", "false").lower() == "true"
-            )
+            sync_all_prs = os.getenv("SYNC_ALL_OPEN_PRS", "false").lower() == "true"
             if (
                 not sync_all_prs
                 and gh.event_name == "pull_request_target"
@@ -999,9 +1276,7 @@ class Orchestrator:
                     client = build_client()
                     repo = get_repo_from_env(client)
                     pr_obj = get_pull(repo, int(pr_str))
-                    cand = get_recent_change_ids_from_comments(
-                        pr_obj, max_comments=50
-                    )
+                    cand = get_recent_change_ids_from_comments(pr_obj, max_comments=50)
                     if cand:
                         reuse = cand[-1]
                         log.debug(
@@ -1023,23 +1298,23 @@ class Orchestrator:
             signed_off: list[str],
             reuse_cid: str,
         ) -> str:
-            from .duplicate_detection import DuplicateDetector
-
             msg = "\n".join(lines_in).strip()
             msg = _insert_issue_id_into_commit_message(msg, inputs.issue_id)
-            github_hash = DuplicateDetector._generate_github_change_hash(gh)
-            msg += f"\n\nGitHub-Hash: {github_hash}"
+
+            # Build footer with proper trailer ordering
+            footer_parts = []
             if signed_off:
-                msg += "\n\n" + "\n".join(signed_off)
+                footer_parts.extend(signed_off)
             if reuse_cid:
-                msg += f"\n\nChange-Id: {reuse_cid}"
+                footer_parts.append(f"Change-Id: {reuse_cid}")
+
+            if footer_parts:
+                msg += "\n\n" + "\n".join(footer_parts)
             return msg
 
         # Build message parts
         raw_lines = _collect_log_lines()
-        message_lines, signed_off, _existing_cids = _parse_message_parts(
-            raw_lines
-        )
+        message_lines, signed_off, _existing_cids = _parse_message_parts(raw_lines)
         clean_lines = _build_clean_message_lines(message_lines)
         pr_str = str(gh.pr_number or "").strip()
         reuse_cid = _maybe_reuse_change_id(pr_str)
@@ -1073,7 +1348,19 @@ class Orchestrator:
                 ", ".join(cids),
             )
         else:
-            log.warning("No Change-ID generated for PR #%s", gh.pr_number)
+            # Fallback detection: re-scan commit message for Change-Id trailers
+            msg_after = run_cmd(["git", "show", "-s", "--pretty=format:%B", "HEAD"], cwd=self.workspace).stdout
+
+            found = [m.strip() for m in re.findall(r"(?mi)^Change-Id:\s*([A-Za-z0-9._-]+)\s*$", msg_after)]
+            if found:
+                log.info(
+                    "Detected Change-ID(s) after amend for PR #%s: %s",
+                    gh.pr_number,
+                    ", ".join(found),
+                )
+                cids = found
+            else:
+                log.warning("No Change-Id detected for PR #%s", gh.pr_number)
         return PreparedChange(change_ids=cids, commit_shas=[])
 
     def _apply_pr_title_body_if_requested(
@@ -1097,6 +1384,11 @@ class Orchestrator:
         title = (title or "").strip()
         body = (body or "").strip()
 
+        # Filter PR body content for Dependabot and other automated PRs
+        author = getattr(pr_obj, "user", {})
+        author_login = getattr(author, "login", "") if author else ""
+        body = filter_pr_body(title, body, author_login)
+
         # Clean up title to ensure it's a proper first line for commit message
         if title:
             # Remove markdown links like [text](url) and keep just the text
@@ -1113,29 +1405,59 @@ class Orchestrator:
             title = re.sub(r"[*_`]", "", title)
             title = title.strip()
 
-        # Compose message; preserve any Signed-off-by lines
-        current_body = git_show("HEAD", fmt="%B")
-        signed = [
-            ln
-            for ln in current_body.splitlines()
-            if ln.startswith("Signed-off-by:")
-        ]
+            # Apply conventional commit normalization if enabled
+            if inputs.normalise_commit:
+                title = normalize_commit_title(title, author_login, self.workspace)
+
+        # Compose message; preserve existing trailers at footer
+        # (Signed-off-by, Change-Id)
+        current_body = git_show("HEAD", fmt="%B", cwd=self.workspace)
+        # Extract existing trailers from current commit body
+        lines_cur = current_body.splitlines()
+        signed_lines = [ln for ln in lines_cur if ln.startswith("Signed-off-by:")]
+        change_id_lines = [ln for ln in lines_cur if ln.startswith("Change-Id:")]
+        github_hash_lines = [ln for ln in lines_cur if ln.startswith("GitHub-Hash:")]
+
         msg_parts = [title, "", body] if title or body else [current_body]
         commit_message = "\n".join(msg_parts).strip()
 
         # Add Issue-ID if provided
-        commit_message = _insert_issue_id_into_commit_message(
-            commit_message, inputs.issue_id
-        )
+        commit_message = _insert_issue_id_into_commit_message(commit_message, inputs.issue_id)
+
+        # Ensure GitHub-Hash is part of the body (not trailers)
+        # to keep a blank line before Signed-off-by/Change-Id trailers.
+        if github_hash_lines:
+            gh_hash_line = github_hash_lines[-1]
+        else:
+            from .duplicate_detection import DuplicateDetector
+
+            gh_val = DuplicateDetector._generate_github_change_hash(gh)
+            gh_hash_line = f"GitHub-Hash: {gh_val}"
+
+        commit_message += "\n\n" + gh_hash_line
+
+        # Build trailers: Signed-off-by first, Change-Id last.
+        trailers_out: list[str] = []
+        if signed_lines:
+            seen_so: set[str] = set()
+            for ln in signed_lines:
+                if ln not in seen_so:
+                    trailers_out.append(ln)
+                    seen_so.add(ln)
+        if change_id_lines:
+            trailers_out.append(change_id_lines[-1])
+        if trailers_out:
+            commit_message += "\n\n" + "\n".join(trailers_out)
 
-        if signed:
-            commit_message += "\n\n" + "\n".join(signed)
         author = run_cmd(
-            ["git", "show", "-s", "--pretty=format:%an <%ae>", "HEAD"]
+            ["git", "show", "-s", "--pretty=format:%an <%ae>", "HEAD"],
+            cwd=self.workspace,
+            env=self._ssh_env(),
         ).stdout.strip()
         git_commit_amend(
+            cwd=self.workspace,
             no_edit=False,
-            signoff=not bool(signed),
+            signoff=not bool(signed_lines),
             author=author,
             message=commit_message,
         )
@@ -1163,10 +1485,11 @@ class Orchestrator:
             run_cmd(["git", "checkout", tmp_branch], cwd=self.workspace)
         prefix = os.getenv("G2G_TOPIC_PREFIX", "GH").strip() or "GH"
         pr_num = os.getenv("PR_NUMBER", "").strip()
-        if pr_num:
-            topic = f"{prefix}-{repo.project_github}-{pr_num}"
-        else:
-            topic = f"{prefix}-{repo.project_github}"
+        topic = f"{prefix}-{repo.project_github}-{pr_num}" if pr_num else f"{prefix}-{repo.project_github}"
+
+        # Use our specific SSH configuration
+        env = self._ssh_env()
+
         try:
             args = [
                 "git",
@@ -1176,33 +1499,30 @@ class Orchestrator:
                 "-t",
                 topic,
             ]
-            revs = [
-                r.strip() for r in (reviewers or "").split(",") if r.strip()
-            ]
+            revs = [r.strip() for r in (reviewers or "").split(",") if r.strip() and "@" in r and r.strip() != branch]
             for r in revs:
                 args.extend(["--reviewer", r])
             # Branch as positional argument (not a flag)
             args.append(branch)
 
-            # Use our specific SSH configuration
-            env = (
-                {"GIT_SSH_COMMAND": self._git_ssh_command}
-                if self._git_ssh_command
-                else None
-            )
+            if env_bool("CI_TESTING", False):
+                log.info("CI_TESTING enabled: using synthetic orphan commit push path")
+                self._create_orphan_commit_and_push(gerrit, repo, branch, reviewers, topic, env)
+                return
             log.debug("Executing git review command: %s", " ".join(args))
             run_cmd(args, cwd=self.workspace, env=env)
             log.info("Successfully pushed changes to Gerrit")
         except CommandError as exc:
+            # Check if this is a "no common ancestry" error in CI_TESTING mode
+            if self._should_handle_unrelated_history(exc):
+                log.info("Detected unrelated repository history. Creating orphan commit for CI testing...")
+                self._create_orphan_commit_and_push(gerrit, repo, branch, reviewers, topic, env)
+                return
+
             # Analyze the specific failure reason from git review output
             error_details = self._analyze_gerrit_push_failure(exc)
-            _log_exception_conditionally(
-                log, "Gerrit push failed: %s", error_details
-            )
-            msg = (
-                f"Failed to push changes to Gerrit with git-review: "
-                f"{error_details}"
-            )
+            log_exception_conditionally(log, "Gerrit push failed: %s", error_details)
+            msg = f"Failed to push changes to Gerrit with git-review: {error_details}"
             raise OrchestratorError(msg) from exc
         # Cleanup temporary branch used during preparation
         tmp_branch = (os.getenv("G2G_TMP_BRANCH", "") or "").strip()
@@ -1212,13 +1532,122 @@ class Orchestrator:
                 ["git", "checkout", f"origin/{branch}"],
                 check=False,
                 cwd=self.workspace,
+                env=env,
             )
             run_cmd(
                 ["git", "branch", "-D", tmp_branch],
                 check=False,
                 cwd=self.workspace,
+                env=env,
             )
 
+    def _should_handle_unrelated_history(self, exc: CommandError) -> bool:
+        """Check if we should handle unrelated repository history in CI testing mode."""
+        if not env_bool("CI_TESTING", False):
+            return False
+
+        stdout = exc.stdout or ""
+        stderr = exc.stderr or ""
+        combined_output = f"{stdout}\n{stderr}"
+
+        combined_lower = combined_output.lower()
+        phrases = (
+            "no common ancestry",
+            "no common ancestor",
+            "do not have a common ancestor",
+            "have no common ancestor",
+            "have no commits in common",
+            "refusing to merge unrelated histories",
+            "unrelated histories",
+            "unrelated history",
+            "no merge base",
+        )
+        return any(p in combined_lower for p in phrases)
+
+    def _create_orphan_commit_and_push(
+        self, gerrit: GerritInfo, repo: RepoNames, branch: str, reviewers: str, topic: str, env: dict[str, str]
+    ) -> None:
+        """Create a synthetic commit on top of the remote base with the PR tree (CI testing mode)."""
+        log.info("CI_TESTING: Creating synthetic commit on top of remote base for unrelated repository")
+
+        try:
+            # Capture the current PR commit message and tree
+            commit_msg = run_cmd(["git", "log", "--format=%B", "-n", "1", "HEAD"], cwd=self.workspace).stdout.strip()
+            pr_tree = run_cmd(["git", "show", "--quiet", "--format=%T", "HEAD"], cwd=self.workspace).stdout.strip()
+
+            # Create/update a synthetic branch based on the remote base branch
+            synth_branch = f"synth-{topic}"
+            # Ensure remote ref exists locally (best-effort)
+            run_cmd(["git", "fetch", "gerrit", branch], cwd=self.workspace, env=env, check=False)
+            run_cmd(["git", "checkout", "-B", synth_branch, f"remotes/gerrit/{branch}"], cwd=self.workspace, env=env)
+
+            # Replace working tree contents with the PR tree
+            # 1) Remove current tracked files (ignore errors if none)
+            run_cmd(["git", "rm", "-r", "--quiet", "."], cwd=self.workspace, env=env, check=False)
+            # 2) Clean untracked files/dirs (preserve our SSH known_hosts dir)
+            run_cmd(
+                ["git", "clean", "-fdx", "-e", ".ssh-g2g", "-e", ".ssh-g2g/**"],
+                cwd=self.workspace,
+                env=env,
+                check=False,
+            )
+            # 3) Checkout the PR tree into working directory
+            run_cmd(["git", "checkout", pr_tree, "--", "."], cwd=self.workspace, env=env)
+            run_cmd(["git", "add", "-A"], cwd=self.workspace, env=env)
+
+            # Commit synthetic change with the same message (should already include Change-Id)
+            import tempfile as _tempfile
+            from pathlib import Path as _Path
+
+            with _tempfile.NamedTemporaryFile("w", delete=False, encoding="utf-8") as _tf:
+                # Ensure Signed-off-by for current committer (uploader) is present in the footer
+                try:
+                    committer_name = run_cmd(
+                        ["git", "config", "--get", "user.name"],
+                        cwd=self.workspace,
+                    ).stdout.strip()
+                except Exception:
+                    committer_name = ""
+                try:
+                    committer_email = run_cmd(
+                        ["git", "config", "--get", "user.email"],
+                        cwd=self.workspace,
+                    ).stdout.strip()
+                except Exception:
+                    committer_email = ""
+                msg_to_write = commit_msg
+                if committer_name and committer_email:
+                    sob_line = f"Signed-off-by: {committer_name} <{committer_email}>"
+                    if sob_line not in msg_to_write:
+                        if not msg_to_write.endswith("\n"):
+                            msg_to_write += "\n"
+                        if not msg_to_write.endswith("\n\n"):
+                            msg_to_write += "\n"
+                        msg_to_write += sob_line
+                _tf.write(msg_to_write)
+                _tf.flush()
+                _tmp_msg_path = _Path(_tf.name)
+            try:
+                run_cmd(["git", "commit", "-F", str(_tmp_msg_path)], cwd=self.workspace, env=env)
+            finally:
+                from contextlib import suppress
+
+                with suppress(Exception):
+                    _tmp_msg_path.unlink(missing_ok=True)
+
+            # Push directly to refs/for/<branch> with topic and reviewers to avoid rebase behavior
+            push_ref = f"refs/for/{branch}%topic={topic}"
+            revs = [r.strip() for r in (reviewers or "").split(",") if r.strip() and "@" in r and r.strip() != branch]
+            for r in revs:
+                push_ref += f",r={r}"
+            run_cmd(["git", "push", "--no-follow-tags", "gerrit", f"HEAD:{push_ref}"], cwd=self.workspace, env=env)
+            log.info("Successfully pushed synthetic commit to Gerrit")
+
+        except CommandError as orphan_exc:
+            error_details = self._analyze_gerrit_push_failure(orphan_exc)
+            msg = f"Failed to push orphan commit to Gerrit: {error_details}"
+            raise OrchestratorError(msg) from orphan_exc
+
     def _analyze_gerrit_push_failure(self, exc: CommandError) -> str:
         """Analyze git review failure and provide helpful error message."""
         stdout = exc.stdout or ""
@@ -1242,10 +1671,7 @@ class Orchestrator:
                 "'ssh-keyscan -p 29418 <gerrit-host>' "
                 "to get the current host keys."
             )
-        elif (
-            "authenticity of host" in combined_lower
-            and "can't be established" in combined_lower
-        ):
+        elif "authenticity of host" in combined_lower and "can't be established" in combined_lower:
             return (
                 "SSH host key unknown. The GERRIT_KNOWN_HOSTS value does not "
                 "contain the host key for the Gerrit server. "
@@ -1255,37 +1681,18 @@ class Orchestrator:
                 "'ssh-keyscan -p 29418 <gerrit-host>' to get the host keys."
             )
         # Check for specific SSH key issues before general permission denied
-        elif (
-            "key_load_public" in combined_lower
-            and "invalid format" in combined_lower
-        ):
-            return (
-                "SSH key format is invalid. Check that the SSH private key "
-                "is properly formatted."
-            )
+        elif "key_load_public" in combined_lower and "invalid format" in combined_lower:
+            return "SSH key format is invalid. Check that the SSH private key is properly formatted."
         elif "no matching host key type found" in combined_lower:
-            return (
-                "SSH key type not supported by server. The server may not "
-                "accept this SSH key algorithm."
-            )
+            return "SSH key type not supported by server. The server may not accept this SSH key algorithm."
         elif "authentication failed" in combined_lower:
-            return (
-                "SSH authentication failed - check SSH key, username, and "
-                "server configuration"
-            )
+            return "SSH authentication failed - check SSH key, username, and server configuration"
         # Check for connection timeout/refused before "could not read" check
-        elif (
-            "connection timed out" in combined_lower
-            or "connection refused" in combined_lower
-        ):
-            return (
-                "Connection failed - check network connectivity and "
-                "Gerrit server availability"
-            )
+        elif "connection timed out" in combined_lower or "connection refused" in combined_lower:
+            return "Connection failed - check network connectivity and Gerrit server availability"
         # Check for specific SSH publickey-only authentication failures
         elif "permission denied (publickey)" in combined_lower and not any(
-            auth_method in combined_lower
-            for auth_method in ["gssapi", "password", "keyboard"]
+            auth_method in combined_lower for auth_method in ["gssapi", "password", "keyboard"]
         ):
             return (
                 "SSH public key authentication failed. The SSH key may be "
@@ -1295,19 +1702,13 @@ class Orchestrator:
         elif "permission denied" in combined_lower:
             return "SSH permission denied - check SSH key and user permissions"
         elif "could not read from remote repository" in combined_lower:
-            return (
-                "Could not read from remote repository - check SSH "
-                "authentication and repository access permissions"
-            )
+            return "Could not read from remote repository - check SSH authentication and repository access permissions"
         # Check for Gerrit-specific issues
         elif "missing issue-id" in combined_lower:
             return "Missing Issue-ID in commit message."
         elif "commit not associated to any issue" in combined_lower:
             return "Commit not associated to any issue."
-        elif (
-            "remote rejected" in combined_lower
-            and "refs/for/" in combined_lower
-        ):
+        elif "remote rejected" in combined_lower and "refs/for/" in combined_lower:
             # Extract specific rejection reason from output
             lines = combined_output.split("\n")
             for line in lines:
@@ -1330,28 +1731,34 @@ class Orchestrator:
     ) -> SubmissionResult:
         """Query Gerrit for change URL/number and patchset sha via REST."""
         log.info("Querying Gerrit for submitted change(s) via REST")
-        # Build Gerrit REST client (prefer HTTP basic auth if provided)
-        base_path = os.getenv("GERRIT_HTTP_BASE_PATH", "").strip().strip("/")
-        base_url = (
-            f"https://{gerrit.host}/"
-            if not base_path
-            else f"https://{gerrit.host}/{base_path}/"
-        )
-        http_user = (
-            os.getenv("GERRIT_HTTP_USER", "").strip()
-            or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
-        )
+
+        # pygerrit2 netrc filter is already applied in execute() unless verbose mode
+
+        # Create centralized URL builder (auto-discovers base path)
+        url_builder = create_gerrit_url_builder(gerrit.host)
+
+        # Get authentication credentials
+        http_user = os.getenv("GERRIT_HTTP_USER", "").strip() or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
         http_pass = os.getenv("GERRIT_HTTP_PASSWORD", "").strip()
+
+        # Build Gerrit REST client (prefer HTTP basic auth if provided)
         if GerritRestAPI is None:
             raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_REST)
-        if http_user and http_pass:
-            if HTTPBasicAuth is None:
-                raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_AUTH)
-            rest = GerritRestAPI(
-                url=base_url, auth=HTTPBasicAuth(http_user, http_pass)
-            )
-        else:
-            rest = GerritRestAPI(url=base_url)
+
+        def _create_rest_client(base_url: str) -> Any:
+            """Helper to create REST client with optional auth."""
+            if http_user and http_pass:
+                if HTTPBasicAuth is None:
+                    raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_AUTH)
+                if GerritRestAPI is None:
+                    raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_REST)
+                return GerritRestAPI(url=base_url, auth=HTTPBasicAuth(http_user, http_pass))
+            else:
+                if GerritRestAPI is None:
+                    raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_REST)
+                return GerritRestAPI(url=base_url)
+
+        # Try API URLs in order of preference (client creation happens in retry loop)
         urls: list[str] = []
         nums: list[str] = []
         shas: list[str] = []
@@ -1362,76 +1769,54 @@ class Orchestrator:
             # include current revision
             query = f"limit:1 is:open project:{repo.project_gerrit} {cid}"
             path = f"/changes/?q={query}&o=CURRENT_REVISION&n=1"
+            # Build single API base URL via centralized discovery
+            api_base_url = url_builder.api_url()
+            # Build Gerrit REST client with retry/timeout
+            from .gerrit_rest import build_client_for_host
+
+            client = build_client_for_host(
+                gerrit.host,
+                timeout=8.0,
+                max_attempts=5,
+                http_user=http_user or None,
+                http_password=http_pass or None,
+            )
             try:
-                changes = rest.get(path)
+                log.debug("Gerrit API base URL (discovered): %s", api_base_url)
+                changes = client.get(path)
             except Exception as exc:
-                status = getattr(
-                    getattr(exc, "response", None), "status_code", None
-                )
-                if not base_path and status == 404:
-                    try:
-                        fallback_url = f"https://{gerrit.host}/r/"
-                        if GerritRestAPI is None:
-                            log.warning(
-                                "pygerrit2 missing; skipping REST fallback"
-                            )
-                            continue
-                        if http_user and http_pass:
-                            if HTTPBasicAuth is None:
-                                log.warning(
-                                    "pygerrit2 auth missing; skipping fallback"
-                                )
-                                continue
-                            rest_fallback = GerritRestAPI(
-                                url=fallback_url,
-                                auth=HTTPBasicAuth(http_user, http_pass),
-                            )
-                        else:
-                            rest_fallback = GerritRestAPI(url=fallback_url)
-                        changes = rest_fallback.get(path)
-                    except Exception as exc2:
-                        log.warning(
-                            "Failed to query change via REST for %s "
-                            "(including '/r' fallback): %s",
-                            cid,
-                            exc2,
-                        )
-                        continue
-                else:
-                    log.warning(
-                        "Failed to query change via REST for %s: %s", cid, exc
-                    )
-                    continue
+                log.warning("Failed to query change via REST for %s: %s", cid, exc)
+                continue
             if not changes:
                 continue
             change = changes[0]
-            num = str(change.get("_number", ""))
-            current_rev = change.get("current_revision", "")
+            # Type guard to ensure mapping-like before dict access
+            if isinstance(change, dict):
+                num = str(change.get("_number", ""))
+                current_rev = change.get("current_revision", "")
+            else:
+                # Unexpected type; skip this result
+                continue
             # Construct a stable web URL for the change
             if num:
-                urls.append(
-                    f"https://{gerrit.host}/c/{repo.project_gerrit}/+/{num}"
-                )
+                change_url = url_builder.change_url(repo.project_gerrit, int(num))
+                urls.append(change_url)
                 nums.append(num)
             if current_rev:
                 shas.append(current_rev)
-        # Export env variables (compat)
-        if urls:
-            os.environ["GERRIT_CHANGE_REQUEST_URL"] = "\n".join(urls)
-        if nums:
-            os.environ["GERRIT_CHANGE_REQUEST_NUM"] = "\n".join(nums)
-        if shas:
-            os.environ["GERRIT_COMMIT_SHA"] = "\n".join(shas)
-        return SubmissionResult(
-            change_urls=urls, change_numbers=nums, commit_shas=shas
-        )
+
+        return SubmissionResult(change_urls=urls, change_numbers=nums, commit_shas=shas)
 
     def _setup_git_workspace(self, inputs: Inputs, gh: GitHubContext) -> None:
         """Initialize and set up git workspace for PR processing."""
         from .gitutils import run_cmd
 
-        # Initialize git repository
-        run_cmd(["git", "init"], cwd=self.workspace)
+        # Try modern git init with explicit branch first
+        try:
+            run_cmd(["git", "init", "--initial-branch=master"], cwd=self.workspace)
+        except Exception:
+            # Fallback for older git versions (hint filtered at logging level)
+            run_cmd(["git", "init"], cwd=self.workspace)
 
         # Add GitHub remote
         repo_full = gh.repository.strip() if gh.repository else ""
@@ -1445,10 +1830,7 @@ class Orchestrator:
 
         # Fetch PR head
         if gh.pr_number:
-            pr_ref = (
-                f"refs/pull/{gh.pr_number}/head:"
-                f"refs/remotes/origin/pr/{gh.pr_number}/head"
-            )
+            pr_ref = f"refs/pull/{gh.pr_number}/head:refs/remotes/origin/pr/{gh.pr_number}/head"
             run_cmd(
                 [
                     "git",
@@ -1468,62 +1850,235 @@ class Orchestrator:
 
     def _install_commit_msg_hook(self, gerrit: GerritInfo) -> None:
         """Manually install commit-msg hook from Gerrit."""
-        from .gitutils import run_cmd
+        from .external_api import curl_download
 
         hooks_dir = self.workspace / ".git" / "hooks"
         hooks_dir.mkdir(exist_ok=True)
         hook_path = hooks_dir / "commit-msg"
 
-        # Download commit-msg hook using SSH
+        # Download commit-msg hook using centralized curl framework
         try:
-            # Use curl to download the hook (more reliable than scp)
-            curl_cmd = [
-                "curl",
-                "-o",
-                str(hook_path),
-                f"https://{gerrit.host}/r/tools/hooks/commit-msg",
-            ]
-            run_cmd(curl_cmd, cwd=self.workspace)
+            # Create centralized URL builder for hook URLs
+            url_builder = create_gerrit_url_builder(gerrit.host)
+            hook_url = url_builder.hook_url("commit-msg")
+
+            # Localized error raiser and short messages to satisfy TRY rules
+            def _raise_orch(msg: str) -> None:
+                raise OrchestratorError(msg)  # noqa: TRY301
+
+            _MSG_HOOK_SIZE_BOUNDS = "commit-msg hook size outside expected bounds"
+            _MSG_HOOK_READ_FAILED = "failed reading commit-msg hook"
+            _MSG_HOOK_NO_SHEBANG = "commit-msg hook missing shebang"
+            _MSG_HOOK_BAD_CONTENT = "commit-msg hook content lacks expected markers"
+
+            # Use centralized curl download with retry/logging/metrics
+            return_code, status_code = curl_download(
+                url=hook_url,
+                output_path=str(hook_path),
+                timeout=30.0,
+                follow_redirects=True,
+                silent=True,
+            )
+
+            size = hook_path.stat().st_size
+            log.debug(
+                "curl fetch of commit-msg: url=%s http_status=%s size=%dB rc=%s",
+                hook_url,
+                status_code,
+                size,
+                return_code,
+            )
+            # Sanity checks on size
+            if size < 128 or size > 65536:
+                _raise_orch(_MSG_HOOK_SIZE_BOUNDS)
 
-            # Make hook executable
+            # Validate content characteristics
+            text_head = ""
+            try:
+                with open(hook_path, "rb") as fh:
+                    head = fh.read(2048)
+                text_head = head.decode("utf-8", errors="ignore")
+            except Exception:
+                _raise_orch(_MSG_HOOK_READ_FAILED)
+
+            if not text_head.startswith("#!"):
+                _raise_orch(_MSG_HOOK_NO_SHEBANG)
+            # Look for recognizable strings
+            if not any(m in text_head for m in ("Change-Id", "Gerrit Code Review", "add_change_id")):
+                _raise_orch(_MSG_HOOK_BAD_CONTENT)
+
+            # Make hook executable (single chmod)
             hook_path.chmod(hook_path.stat().st_mode | stat.S_IEXEC)
-            log.debug("Successfully installed commit-msg hook via curl")
+            log.debug("Successfully installed commit-msg hook from %s", hook_url)
 
         except Exception as exc:
-            log.warning("Failed to install commit-msg hook via curl: %s", exc)
+            log.warning("Failed to install commit-msg hook via centralized curl: %s", exc)
             msg = f"Could not install commit-msg hook: {exc}"
             raise OrchestratorError(msg) from exc
 
-    def _ensure_change_id_present(
-        self, gerrit: GerritInfo, author: str
-    ) -> list[str]:
+    def _ensure_change_id_present(self, gerrit: GerritInfo, author: str) -> list[str]:
         """Ensure the last commit has a Change-Id.
 
         Installs the commit-msg hook and amends the commit if needed.
         """
-        trailers = git_last_commit_trailers(
-            keys=["Change-Id"], cwd=self.workspace
-        )
-        if not trailers.get("Change-Id"):
-            log.debug(
-                "No Change-Id found, installing commit-msg hook and amending "
-                "commit"
-            )
+        trailers = git_last_commit_trailers(keys=["Change-Id"], cwd=self.workspace)
+        existing_change_ids = trailers.get("Change-Id", [])
+
+        if existing_change_ids:
+            log.debug("Found existing Change-Id(s) in footer: %s", existing_change_ids)
+            # Clean up any duplicate Change-IDs in the message body
+            self._clean_change_ids_from_body(author)
+            return [c for c in existing_change_ids if c]
+
+        log.debug("No Change-Id found; attempting to install commit-msg hook and amend commit")
+        try:
             self._install_commit_msg_hook(gerrit)
             git_commit_amend(
-                no_edit=True, signoff=True, author=author, cwd=self.workspace
+                no_edit=True,
+                signoff=True,
+                author=author,
+                cwd=self.workspace,
+            )
+        except Exception as exc:
+            log.warning(
+                "Commit-msg hook installation failed, falling back to direct Change-Id injection: %s",
+                exc,
             )
-            # Debug: Check commit message after amend
-            actual_msg = run_cmd(
+            # Fallback: generate a Change-Id and append to the commit
+            # message directly
+            import time
+
+            current_msg = run_cmd(
                 ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
                 cwd=self.workspace,
-            ).stdout.strip()
-            log.debug("Commit message after amend:\n%s", actual_msg)
-            trailers = git_last_commit_trailers(
-                keys=["Change-Id"], cwd=self.workspace
+            ).stdout
+            seed = f"{current_msg}\n{time.time()}"
+            import hashlib as _hashlib  # local alias to satisfy linters
+
+            change_id = "I" + _hashlib.sha256(seed.encode("utf-8")).hexdigest()[:40]
+
+            # Clean message and ensure proper footer placement
+            cleaned_msg = self._clean_commit_message_for_change_id(current_msg)
+            new_msg = cleaned_msg.rstrip() + "\n\n" + f"Change-Id: {change_id}\n"
+            git_commit_amend(
+                no_edit=False,
+                signoff=True,
+                author=author,
+                message=new_msg,
+                cwd=self.workspace,
             )
+        # Debug: Check commit message after amend
+        actual_msg = run_cmd(
+            ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
+            cwd=self.workspace,
+        ).stdout.strip()
+        log.debug("Commit message after amend:\n%s", actual_msg)
+        trailers = git_last_commit_trailers(keys=["Change-Id"], cwd=self.workspace)
         return [c for c in trailers.get("Change-Id", []) if c]
 
+    def _clean_change_ids_from_body(self, author: str) -> None:
+        """Remove any Change-Id lines from the commit message body, keeping only footer trailers."""
+        current_msg = run_cmd(
+            ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
+            cwd=self.workspace,
+        ).stdout
+
+        cleaned_msg = self._clean_commit_message_for_change_id(current_msg)
+
+        if cleaned_msg != current_msg:
+            log.debug("Cleaned Change-Id lines from commit message body")
+            git_commit_amend(
+                no_edit=False,
+                signoff=True,
+                author=author,
+                message=cleaned_msg,
+                cwd=self.workspace,
+            )
+
+    def _clean_commit_message_for_change_id(self, message: str) -> str:
+        """Remove Change-Id lines from message body while preserving footer trailers."""
+        lines = message.splitlines()
+
+        # Parse proper trailers using the fixed trailer parser
+        trailers = _parse_trailers(message)
+        change_id_trailers = trailers.get("Change-Id", [])
+        signed_off_trailers = trailers.get("Signed-off-by", [])
+        other_trailers = {k: v for k, v in trailers.items() if k not in ["Change-Id", "Signed-off-by"]}
+
+        # Find trailer section by working backwards to find continuous trailer block
+        trailer_start = len(lines)
+
+        # Work backwards to find where trailers start
+        for i in range(len(lines) - 1, -1, -1):
+            line = lines[i].strip()
+            if not line:
+                # Found blank line - trailers are after this
+                trailer_start = i + 1
+                break
+            elif ":" not in line:
+                # Non-trailer line - trailers start after this
+                trailer_start = i + 1
+                break
+            else:
+                # Potential trailer line - check if it's a valid trailer
+                key, val = line.split(":", 1)
+                k = key.strip()
+                v = val.strip()
+                if not (k and v and not k.startswith(" ") and not k.startswith("\t")):
+                    # Invalid trailer format - trailers start after this
+                    trailer_start = i + 1
+                    break
+
+        # Process body lines (before trailers) and remove any Change-Id references
+        body_lines = []
+        for i in range(trailer_start):
+            line = lines[i]
+            # Remove any Change-Id references from body lines
+            if "Change-Id:" in line:
+                # If line starts with Change-Id:, skip it entirely
+                if line.strip().startswith("Change-Id:"):
+                    log.debug("Removing Change-Id line from body: %s", line.strip())
+                    continue
+                else:
+                    # If Change-Id is mentioned within the line, remove that part
+                    original_line = line
+                    # Remove Change-Id: followed by the ID value
+
+                    # Pattern to match "Change-Id: <value>" where value can contain word chars, hyphens, etc.
+                    line = re.sub(r"Change-Id:\s*[A-Za-z0-9._-]+\b", "", line)
+                    # Clean up extra whitespace
+                    line = re.sub(r"\s+", " ", line).strip()
+                    if line != original_line:
+                        log.debug("Cleaned Change-Id reference from body line: %s -> %s", original_line.strip(), line)
+            body_lines.append(line)
+
+        # Remove trailing empty lines from body
+        while body_lines and not body_lines[-1].strip():
+            body_lines.pop()
+
+        result = "\n".join(body_lines)
+
+        # Add proper footer trailers if any exist
+        footer_parts = []
+        if signed_off_trailers:
+            _seen_so: set[str] = set()
+            _uniq_so: list[str] = []
+            for s in signed_off_trailers:
+                if s not in _seen_so:
+                    _uniq_so.append(s)
+                    _seen_so.add(s)
+            footer_parts.extend([f"Signed-off-by: {s}" for s in _uniq_so])
+        # Add other trailers
+        for key, values in other_trailers.items():
+            footer_parts.extend([f"{key}: {v}" for v in values])
+        if change_id_trailers:
+            footer_parts.extend([f"Change-Id: {c}" for c in change_id_trailers])
+
+        if footer_parts:
+            result += "\n\n" + "\n".join(footer_parts)
+
+        return result
+
     def _add_backref_comment_in_gerrit(
         self,
         *,
@@ -1544,21 +2099,14 @@ class Orchestrator:
             "1",
             "yes",
         ):
-            log.info(
-                "Skipping back-reference comments "
-                "(G2G_SKIP_GERRIT_COMMENTS=true)"
-            )
+            log.info("Skipping back-reference comments (G2G_SKIP_GERRIT_COMMENTS=true)")
             return
 
         log.info("Adding back-reference comment in Gerrit")
         user = os.getenv("GERRIT_SSH_USER_G2G", "")
         server = gerrit.host
         pr_url = f"{gh.server_url}/{gh.repository}/pull/{gh.pr_number}"
-        run_url = (
-            f"{gh.server_url}/{gh.repository}/actions/runs/{gh.run_id}"
-            if gh.run_id
-            else "N/A"
-        )
+        run_url = f"{gh.server_url}/{gh.repository}/actions/runs/{gh.run_id}" if gh.run_id else "N/A"
         message = f"GHPR: {pr_url} | Action-Run: {run_url}"
         log.info("Adding back-reference comment: %s", message)
         for csha in commit_shas:
@@ -1566,39 +2114,118 @@ class Orchestrator:
                 continue
             try:
                 log.debug("Executing SSH command for commit %s", csha)
-                # Build SSH command with our configured SSH options
-                ssh_cmd = ["ssh", "-n", "-p", str(gerrit.port)]
-
-                # Add our SSH options if we have custom SSH config
-                if self._git_ssh_command:
-                    # Extract SSH options from GIT_SSH_COMMAND
-                    # Format: "ssh -i /path/to/key -o Option=value ..."
-                    git_ssh_parts = self._git_ssh_command.split()
-                    if len(git_ssh_parts) > 1:  # Skip the "ssh" part
-                        ssh_options = git_ssh_parts[1:]
-                        log.debug("Adding SSH options: %s", ssh_options)
-                        ssh_cmd.extend(ssh_options)
+                # Build SSH command based on available authentication method
+                if self._ssh_key_path and self._ssh_known_hosts_path:
+                    # File-based SSH authentication
+                    ssh_cmd = [
+                        "ssh",
+                        "-F",
+                        "/dev/null",
+                        "-i",
+                        str(self._ssh_key_path),
+                        "-o",
+                        f"UserKnownHostsFile={self._ssh_known_hosts_path}",
+                        "-o",
+                        "IdentitiesOnly=yes",
+                        "-o",
+                        "IdentityAgent=none",
+                        "-o",
+                        "BatchMode=yes",
+                        "-o",
+                        "StrictHostKeyChecking=yes",
+                        "-o",
+                        "PasswordAuthentication=no",
+                        "-o",
+                        "PubkeyAcceptedKeyTypes=+ssh-rsa",
+                        "-n",
+                        "-p",
+                        str(gerrit.port),
+                        f"{user}@{server}",
+                        (
+                            "gerrit review -m "
+                            f"{shlex.quote(message)} "
+                            "--branch "
+                            f"{shlex.quote(branch)} "
+                            "--project "
+                            f"{shlex.quote(repo.project_gerrit)} "
+                            f"{shlex.quote(csha)}"
+                        ),
+                    ]
+                elif self._use_ssh_agent and self._ssh_agent_manager and self._ssh_agent_manager.known_hosts_path:
+                    # SSH agent authentication with known_hosts
+                    ssh_cmd = [
+                        "ssh",
+                        "-F",
+                        "/dev/null",
+                        "-o",
+                        f"UserKnownHostsFile={self._ssh_agent_manager.known_hosts_path}",
+                        "-o",
+                        "IdentitiesOnly=no",
+                        "-o",
+                        "BatchMode=yes",
+                        "-o",
+                        "PreferredAuthentications=publickey",
+                        "-o",
+                        "StrictHostKeyChecking=yes",
+                        "-o",
+                        "PasswordAuthentication=no",
+                        "-o",
+                        "PubkeyAcceptedKeyTypes=+ssh-rsa",
+                        "-o",
+                        "ConnectTimeout=10",
+                        "-n",
+                        "-p",
+                        str(gerrit.port),
+                        f"{user}@{server}",
+                        (
+                            "gerrit review -m "
+                            f"{shlex.quote(message)} "
+                            "--branch "
+                            f"{shlex.quote(branch)} "
+                            "--project "
+                            f"{shlex.quote(repo.project_gerrit)} "
+                            f"{shlex.quote(csha)}"
+                        ),
+                    ]
                 else:
-                    log.debug("No custom SSH config, using default SSH options")
-
-                # Add the target and gerrit command
-                ssh_cmd.extend(
-                    [
+                    # Fallback - minimal SSH command (for tests)
+                    ssh_cmd = [
+                        "ssh",
+                        "-F",
+                        "/dev/null",
+                        "-o",
+                        "IdentitiesOnly=yes",
+                        "-o",
+                        "IdentityAgent=none",
+                        "-o",
+                        "BatchMode=yes",
+                        "-o",
+                        "StrictHostKeyChecking=yes",
+                        "-o",
+                        "PasswordAuthentication=no",
+                        "-o",
+                        "PubkeyAcceptedKeyTypes=+ssh-rsa",
+                        "-n",
+                        "-p",
+                        str(gerrit.port),
                         f"{user}@{server}",
-                        "gerrit",
-                        "review",
-                        "-m",
-                        message,
-                        "--branch",
-                        branch,
-                        "--project",
-                        repo.project_gerrit,
-                        csha,
+                        (
+                            "gerrit review -m "
+                            f"{shlex.quote(message)} "
+                            "--branch "
+                            f"{shlex.quote(branch)} "
+                            "--project "
+                            f"{shlex.quote(repo.project_gerrit)} "
+                            f"{shlex.quote(csha)}"
+                        ),
                     ]
-                )
 
                 log.debug("Final SSH command: %s", " ".join(ssh_cmd))
-                run_cmd(ssh_cmd, cwd=self.workspace)
+                run_cmd(
+                    ssh_cmd,
+                    cwd=self.workspace,
+                    env=self._ssh_env(),
+                )
                 log.info(
                     "Successfully added back-reference comment for %s: %s",
                     csha,
@@ -1606,8 +2233,7 @@ class Orchestrator:
                 )
             except CommandError as exc:
                 log.warning(
-                    "Failed to add back-reference comment for %s "
-                    "(non-fatal): %s",
+                    "Failed to add back-reference comment for %s (non-fatal): %s",
                     csha,
                     exc,
                 )
@@ -1623,14 +2249,11 @@ class Orchestrator:
                 # Continue processing - this is not a fatal error
             except Exception as exc:
                 log.warning(
-                    "Failed to add back-reference comment for %s "
-                    "(non-fatal): %s",
+                    "Failed to add back-reference comment for %s (non-fatal): %s",
                     csha,
                     exc,
                 )
-                log.debug(
-                    "Back-reference comment failure details:", exc_info=True
-                )
+                log.debug("Back-reference comment failure details:", exc_info=True)
                 # Continue processing - this is not a fatal error
 
     def _comment_on_pull_request(
@@ -1640,15 +2263,19 @@ class Orchestrator:
         result: SubmissionResult,
     ) -> None:
         """Post a comment on the PR with the Gerrit change URL(s)."""
+        # Respect CI_TESTING: do not attempt to update the source/origin PR
+        if os.getenv("CI_TESTING", "").strip().lower() in ("1", "true", "yes"):
+            log.debug("Source/origin pull request will NOT be updated with Gerrit change when CI_TESTING set true")
+            return
         log.info("Adding reference comment on PR #%s", gh.pr_number)
         if not gh.pr_number:
             return
         urls = result.change_urls or []
         org = os.getenv("ORGANIZATION", gh.repository_owner)
-        text = (
-            f"The pull-request PR-{gh.pr_number} is submitted to Gerrit "
-            f"[{org}](https://{gerrit.host})!\n\n"
-        )
+        # Create centralized URL builder for organization link
+        url_builder = create_gerrit_url_builder(gerrit.host)
+        org_url = url_builder.web_url()
+        text = f"The pull-request PR-{gh.pr_number} is submitted to Gerrit [{org}]({org_url})!\n\n"
         if urls:
             text += "To follow up on the change visit:\n\n" + "\n".join(urls)
         try:
@@ -1657,6 +2284,13 @@ class Orchestrator:
             # At this point, gh.pr_number is non-None due to earlier guard.
             pr_obj = get_pull(repo, int(gh.pr_number))
             create_pr_comment(pr_obj, text)
+            # Also post a succinct one-line comment
+            # for each Gerrit change URL
+            for u in urls:
+                create_pr_comment(
+                    pr_obj,
+                    f"Change raised in Gerrit by GitHub2Gerrit: {u}",
+                )
         except Exception as exc:
             log.warning("Failed to add PR comment: %s", exc)
 
@@ -1718,20 +2352,15 @@ class Orchestrator:
             "yes",
             "on",
         ):
+            log.info("Dry-run: network checks disabled (G2G_DRYRUN_DISABLE_NETWORK)")
             log.info(
-                "Dry-run: network checks disabled (G2G_DRYRUN_DISABLE_NETWORK)"
-            )
-            log.info(
-                "Dry-run targets: Gerrit project=%s branch=%s "
-                "topic_prefix=GH-%s",
+                "Dry-run targets: Gerrit project=%s branch=%s topic_prefix=GH-%s",
                 repo.project_gerrit,
                 self._resolve_target_branch(),
                 repo.project_github,
             )
             if inputs.reviewers_email:
-                log.info(
-                    "Reviewers (from inputs/config): %s", inputs.reviewers_email
-                )
+                log.info("Reviewers (from inputs/config): %s", inputs.reviewers_email)
             elif os.getenv("REVIEWERS_EMAIL"):
                 log.info(
                     "Reviewers (from environment): %s",
@@ -1742,18 +2371,14 @@ class Orchestrator:
         # DNS resolution for Gerrit host
         try:
             socket.getaddrinfo(gerrit.host, None)
-            log.info(
-                "DNS resolution for Gerrit host '%s' succeeded", gerrit.host
-            )
+            log.info("DNS resolution for Gerrit host '%s' succeeded", gerrit.host)
         except Exception as exc:
             msg = "DNS resolution failed"
             raise OrchestratorError(msg) from exc
 
         # SSH (TCP) reachability on Gerrit port
         try:
-            with socket.create_connection(
-                (gerrit.host, gerrit.port), timeout=5
-            ):
+            with socket.create_connection((gerrit.host, gerrit.port), timeout=5):
                 pass
             log.info(
                 "SSH TCP connectivity to %s:%s verified",
@@ -1766,10 +2391,7 @@ class Orchestrator:
 
         # Gerrit REST reachability and optional auth check
         base_path = os.getenv("GERRIT_HTTP_BASE_PATH", "").strip().strip("/")
-        http_user = (
-            os.getenv("GERRIT_HTTP_USER", "").strip()
-            or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
-        )
+        http_user = os.getenv("GERRIT_HTTP_USER", "").strip() or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
         http_pass = os.getenv("GERRIT_HTTP_PASSWORD", "").strip()
         self._verify_gerrit_rest(gerrit.host, base_path, http_user, http_pass)
 
@@ -1779,9 +2401,7 @@ class Orchestrator:
             repo_obj = get_repo_from_env(client)
             if gh.pr_number is not None:
                 pr_obj = get_pull(repo_obj, gh.pr_number)
-                log.info(
-                    "GitHub PR #%s metadata loaded successfully", gh.pr_number
-                )
+                log.info("GitHub PR #%s metadata loaded successfully", gh.pr_number)
                 try:
                     title, _ = get_pr_title_body(pr_obj)
                     log.info("GitHub PR title: %s", title)
@@ -1807,13 +2427,9 @@ class Orchestrator:
             repo.project_github,
         )
         if inputs.reviewers_email:
-            log.info(
-                "Reviewers (from inputs/config): %s", inputs.reviewers_email
-            )
+            log.info("Reviewers (from inputs/config): %s", inputs.reviewers_email)
         elif os.getenv("REVIEWERS_EMAIL"):
-            log.info(
-                "Reviewers (from environment): %s", os.getenv("REVIEWERS_EMAIL")
-            )
+            log.info("Reviewers (from environment): %s", os.getenv("REVIEWERS_EMAIL"))
 
     def _verify_gerrit_rest(
         self,
@@ -1822,7 +2438,11 @@ class Orchestrator:
         http_user: str,
         http_pass: str,
     ) -> None:
-        """Probe Gerrit REST endpoint with optional auth and '/r' fallback."""
+        """Probe Gerrit REST endpoint with optional auth.
+
+        Uses the centralized URL builder to construct the API endpoint
+        for consistent URL handling across the application.
+        """
 
         def _build_client(url: str) -> Any:
             if http_user and http_pass:
@@ -1830,9 +2450,7 @@ class Orchestrator:
                     raise OrchestratorError(_MSG_PYGERRIT2_MISSING)
                 if HTTPBasicAuth is None:
                     raise OrchestratorError(_MSG_PYGERRIT2_AUTH_MISSING)
-                return GerritRestAPI(
-                    url=url, auth=HTTPBasicAuth(http_user, http_pass)
-                )
+                return GerritRestAPI(url=url, auth=HTTPBasicAuth(http_user, http_pass))
             else:
                 if GerritRestAPI is None:
                     raise OrchestratorError(_MSG_PYGERRIT2_MISSING)
@@ -1850,52 +2468,19 @@ class Orchestrator:
                 _ = rest.get("/dashboard/self")
                 log.info("Gerrit REST endpoint reachable (unauthenticated)")
 
-        base_url = (
-            f"https://{host}/"
-            if not base_path
-            else f"https://{host}/{base_path}/"
-        )
+        # Create centralized URL builder for REST probing
+        url_builder = create_gerrit_url_builder(host, base_path)
+        api_url = url_builder.api_url()
+
         try:
-            _probe(base_url)
+            _probe(api_url)
         except Exception as exc:
-            status = getattr(
-                getattr(exc, "response", None), "status_code", None
-            )
-            if not base_path and status == 404:
-                try:
-                    fallback_url = f"https://{host}/r/"
-                    _probe(fallback_url)
-                except Exception as exc2:
-                    log.warning(
-                        "Gerrit REST probe did not succeed "
-                        "(including '/r' fallback): %s",
-                        exc2,
-                    )
-            else:
-                log.warning("Gerrit REST probe did not succeed: %s", exc)
+            log.warning("Gerrit REST probe failed for %s: %s", api_url, exc)
 
     # ---------------
     # Helpers
     # ---------------
 
-    def _append_github_output(self, outputs: dict[str, str]) -> None:
-        gh_out = os.getenv("GITHUB_OUTPUT")
-        if not gh_out:
-            return
-        try:
-            with open(gh_out, "a", encoding="utf-8") as fh:
-                for key, val in outputs.items():
-                    if not val:
-                        continue
-                    if "\n" in val and os.getenv("GITHUB_ACTIONS") == "true":
-                        fh.write(f"{key}<<G2G\n")
-                        fh.write(f"{val}\n")
-                        fh.write("G2G\n")
-                    else:
-                        fh.write(f"{key}={val}\n")
-        except Exception as exc:
-            log.debug("Failed to write GITHUB_OUTPUT: %s", exc)
-
     def _resolve_target_branch(self) -> str:
         # Preference order:
         # 1) GERRIT_BRANCH (explicit override)