github2gerrit 1.2.0__py3-none-any.whl → 1.2.2__py3-none-any.whl

github2gerrit/cli.py

@@ -2226,7 +2226,7 @@ def _process() -> None:
             ):
                 try:
                     log.debug(
-                        "🔍 Checking for Gerrit change to abandon for PR #%s",
+                        "Checking for Gerrit change to abandon for PR #%s",
                         gh.pr_number,
                     )
                     change_number = abandon_gerrit_change_for_closed_pr(
@@ -2238,16 +2238,29 @@ def _process() -> None:
                         progress_tracker=None,
                     )
                     if change_number:
-                        gerrit_change_url = (
-                            f"https://{data.gerrit_server}/c/"
-                            f"{data.gerrit_project}/+/{change_number}"
-                        )
-                        log.debug(
-                            "✅ Successfully abandoned Gerrit change %s "
-                            "for pull request #%s",
-                            gerrit_change_url,
-                            gh.pr_number,
-                        )
+                        try:
+                            from .gerrit_urls import create_gerrit_url_builder
+
+                            _url_builder = create_gerrit_url_builder(
+                                data.gerrit_server
+                            )
+                            gerrit_change_url = _url_builder.change_url(
+                                data.gerrit_project,
+                                int(change_number),
+                            )
+                            log.debug(
+                                "Successfully abandoned Gerrit "
+                                "change %s for pull request #%s",
+                                gerrit_change_url,
+                                gh.pr_number,
+                            )
+                        except Exception:
+                            log.debug(
+                                "Successfully abandoned Gerrit "
+                                "change %s for pull request #%s",
+                                change_number,
+                                gh.pr_number,
+                            )
                         # Console output already done by
                         # abandon_gerrit_change_for_closed_pr
                     else:
@@ -2295,7 +2308,7 @@ def _process() -> None:
                     log.warning("Gerrit cleanup failed: %s", exc)
 
             log.debug(
-                "✅ Cleanup operations completed for closed PR #%s",
+                "Cleanup operations completed for closed PR #%s",
                 gh.pr_number or "unknown",
             )
             return

github2gerrit/commit_normalization.py

@@ -401,8 +401,9 @@ class CommitNormalizer:
         # Remove trailing ellipsis
         title = re.sub(r"\s*[.]{3,}.*$", "", title)
 
-        # Remove markdown formatting
-        title = re.sub(r"[*_`]", "", title)
+        # Remove markdown bold/code formatting but preserve underscores
+        # (which appear in package names and filesystem paths).
+        title = re.sub(r"[*`]", "", title)
 
         # For dependabot titles, extract the essential information
         for pattern in DEPENDABOT_PATTERNS:

github2gerrit/core.py

@@ -154,6 +154,93 @@ def _clean_ellipses_from_message(message: str) -> str:
     return "\n".join(cleaned_lines)
 
 
+def _clean_squash_title_line(title_line: str | None) -> str:
+    """Clean and truncate a squashed commit title line.
+
+    Handles markdown removal, separator splitting, and length
+    truncation while preserving conventional commit prefixes
+    and underscores in package/path names.
+
+    Args:
+        title_line: Raw title line from git log output.
+
+    Returns:
+        Cleaned title line, safe for use as a commit subject.
+    """
+    from .similarity import CC_PREFIX_RE
+
+    if not title_line:
+        return ""
+
+    # Remove markdown links
+    title_line = re.sub(r"\[([^\]]+)\]\([^)]+\)", r"\1", title_line)
+    # Remove trailing ellipsis/truncation
+    title_line = re.sub(r"\s*[.]{3,}.*$", "", title_line)
+    # Split on common separators to avoid leaking body content
+    for separator in [". Bumps ", " Bumps ", ". - ", " - "]:
+        if separator in title_line:
+            title_line = title_line.split(separator)[0].strip()
+            break
+    # Remove markdown bold/code formatting but preserve underscores
+    # (which appear in package names and filesystem paths).
+    title_line = re.sub(r"[*`]", "", title_line).strip()
+
+    if len(title_line) > 100:
+        # Detect conventional commit prefix length so that the
+        # ": " break-point does not split on the prefix separator
+        # (e.g. "Build(deps): " should not be treated as a sentence
+        # break).
+        cc_match = CC_PREFIX_RE.match(title_line)
+        cc_prefix_len = cc_match.end() if cc_match else 0
+
+        break_points = [". ", "! ", "? ", " - ", ": "]
+        max_bp_len = max(len(bp) for bp in break_points)
+        truncated = False
+        for bp in break_points:
+            # For the ": " break-point, start searching after the
+            # conventional commit prefix to avoid splitting there.
+            search_start = cc_prefix_len if bp == ": " else 0
+            # Extend the slice by (max_bp_len - 1) so that a
+            # break-point starting just before position 100 is
+            # still detected even if it spans across the boundary.
+            candidate_end = min(len(title_line), 100 + max_bp_len - 1)
+            candidate = title_line[search_start:candidate_end]
+            bp_offset = candidate.find(bp)
+            if bp_offset != -1:
+                bp_idx = search_start + bp_offset
+                # Only use this break-point if it starts within
+                # the 100-char limit.
+                if bp_idx >= 100:
+                    continue
+                # Punctuation break-points (". ", ": ") — include
+                # the punctuation mark.  Separator break-points
+                # (" - ") — truncate before the separator.
+                if bp[0].isspace():
+                    title_line = title_line[:bp_idx].rstrip()
+                else:
+                    title_line = title_line[
+                        : bp_idx + len(bp.rstrip())
+                    ].rstrip()
+                truncated = True
+                break
+
+        if not truncated and cc_prefix_len == 0:
+            # Non-CC title with no break-point found: fall back
+            # to word-boundary truncation at 100 characters.
+            words = title_line[:100].split()
+            title_line = (
+                " ".join(words[:-1])
+                if len(words) > 1
+                else title_line[:100].rstrip()
+            )
+        # For CC titles with no break-point: pass through the
+        # full title.  The length is inherent to the structured
+        # subject (e.g. long dependency paths), not body-content
+        # leakage.
+
+    return title_line
+
+
 # ---------------------
 # Utility functions
 # ---------------------
@@ -678,6 +765,9 @@ class Orchestrator:
         2. GitHub-Hash trailer matching
         3. GitHub-PR trailer URL matching
         4. Mapping comment parsing from PR comments
+        5. Dependency package match — find an open change that
+           bumps the same dependency (for Dependabot / Renovate
+           supersession).
 
         Args:
             gh: GitHub context containing PR information
@@ -793,6 +883,10 @@ class Orchestrator:
             except Exception as exc:
                 log.debug("GitHub-Hash trailer query failed: %s", exc)
 
+        # Cache the PR title for reuse across strategies 4 and 5
+        # so we don't duplicate GitHub API requests.
+        cached_pr_title: str = ""
+
         # Strategy 4: Parse mapping comments from PR
         try:
             from .mapping_comment import parse_mapping_comments
@@ -800,6 +894,7 @@ class Orchestrator:
             client_gh = build_client()
             repo = get_repo_from_env(client_gh)
             pr_obj = get_pull(repo, int(gh.pr_number))
+            cached_pr_title = getattr(pr_obj, "title", "") or ""
 
             issue = pr_obj.as_issue()
             comments = list(issue.get_comments())
@@ -830,6 +925,110 @@ class Orchestrator:
         except Exception as exc:
             log.debug("Mapping comment parsing failed: %s", exc)
 
+        # Strategy 5: Dependency package match (supersession)
+        # When a new Dependabot/Renovate PR bumps the same dependency
+        # as an existing open Gerrit change, reuse that Change-Id so
+        # the push creates a new patchset instead of a duplicate change.
+        try:
+            from .gerrit_query import GerritChange
+            from .gerrit_query import query_open_changes_by_project
+            from .gerrit_rest import build_client_for_host
+            from .similarity import extract_dependency_package_from_subject
+            from .trailers import GITHUB_PR_TRAILER
+            from .trailers import parse_trailers
+
+            # Reuse PR title cached by Strategy 4 to avoid a
+            # duplicate GitHub API request.
+            pr_title = cached_pr_title
+            if not pr_title:
+                log.debug(
+                    "Strategy 5: PR title cache miss, fetching from GitHub API",
+                )
+                try:
+                    gh_client = build_client()
+                    gh_repo = get_repo_from_env(gh_client)
+                    pr_obj = get_pull(gh_repo, int(gh.pr_number))
+                    pr_title = getattr(pr_obj, "title", "") or ""
+                except Exception:
+                    pr_title = ""
+
+            current_pkg = extract_dependency_package_from_subject(pr_title)
+            if current_pkg:
+                log.debug(
+                    "Strategy 5: searching for open changes that "
+                    "bump dependency '%s'",
+                    current_pkg,
+                )
+                dep_client = build_client_for_host(gerrit.host)
+                open_changes = query_open_changes_by_project(
+                    dep_client,
+                    gerrit.project,
+                    branch=gh.base_ref,
+                    max_results=200,
+                )
+
+                # Collect all matching changes, then select the
+                # oldest one (lowest change number) to avoid
+                # "downgrading" a newer change by uploading an
+                # older patchset to it.
+                candidates: list[tuple[int, GerritChange]] = []
+                for change in open_changes:
+                    candidate_pkg = extract_dependency_package_from_subject(
+                        change.subject
+                    )
+                    if candidate_pkg and candidate_pkg == current_pkg:
+                        # Verify this is a GitHub2Gerrit change
+                        commit_msg = change.commit_message or ""
+                        trailers = parse_trailers(commit_msg)
+                        if GITHUB_PR_TRAILER not in trailers:
+                            log.debug(
+                                "Strategy 5: skipping change %s "
+                                "(no GitHub2Gerrit metadata)",
+                                change.number,
+                            )
+                            continue
+                        try:
+                            change_num = int(change.number)
+                        except (TypeError, ValueError):
+                            log.debug(
+                                "Strategy 5: skipping change with "
+                                "invalid number %r for subject %r",
+                                change.number,
+                                change.subject,
+                            )
+                            continue
+                        candidates.append((change_num, change))
+
+                if candidates:
+                    # Prefer the oldest open change so the newest
+                    # PR always updates the original change and
+                    # the post-push sweep abandons the rest.
+                    candidates.sort(key=lambda t: t[0])
+                    _, oldest = candidates[0]
+                    change_ids = [oldest.change_id]
+                    log.info(
+                        "Found superseding target by dependency "
+                        "package '%s': change %s (%s) "
+                        "(oldest of %d candidate(s))",
+                        current_pkg,
+                        oldest.number,
+                        oldest.subject,
+                        len(candidates),
+                    )
+                    return change_ids
+
+                log.debug(
+                    "No open changes found for dependency '%s'",
+                    current_pkg,
+                )
+            else:
+                log.debug(
+                    "Strategy 5 skipped: could not extract dependency "
+                    "package from PR title"
+                )
+        except Exception as exc:
+            log.debug("Dependency package strategy failed: %s", exc)
+
         log.warning(
             "⚠️  No existing Gerrit changes found for PR #%s",
             gh.pr_number,
@@ -1936,6 +2135,49 @@ class Orchestrator:
         # Validate that no unexpected files were committed
         self._validate_committed_files(gh, result)
 
+        # Post-push supersession sweep (Option A fallback).
+        # After a successful push, check whether other open Gerrit
+        # changes in the same project bump the same dependency
+        # package.  If Strategy 5 already reused the old Change-Id
+        # (update-in-place), no duplicates should exist.  If that
+        # path was skipped (e.g. non-dependency PR, or the query
+        # failed), this sweep catches and abandons stale changes.
+        if not inputs.dry_run and gerrit and prep.change_ids:
+            try:
+                from .gerrit_pr_closer import (
+                    abandon_superseded_dependency_changes,
+                )
+
+                # Derive the subject from the pushed commit,
+                # regardless of whether change URL lookup
+                # succeeded.
+                push_subject = ""
+                try:
+                    push_subject = run_cmd(
+                        [
+                            "git",
+                            "show",
+                            "-s",
+                            "--pretty=format:%s",
+                            "HEAD",
+                        ],
+                        cwd=self.workspace,
+                    ).stdout.strip()
+                except Exception:
+                    push_subject = ""
+
+                if push_subject:
+                    abandon_superseded_dependency_changes(
+                        gerrit_server=gerrit.host,
+                        gerrit_project=gerrit.project,
+                        current_subject=push_subject,
+                        exclude_change_ids=prep.change_ids,
+                        dry_run=False,
+                        target_branch=self._resolve_target_branch(),
+                    )
+            except Exception as exc:
+                log.debug("Post-push supersession sweep skipped: %s", exc)
+
         self._close_pull_request_if_required(gh)
 
         log.debug("Pipeline complete: %s", result)
@@ -3564,32 +3806,7 @@ class Orchestrator:
             return message_lines, signed_off, change_ids
 
         def _clean_title_line(title_line: str) -> str:
-            # Remove markdown links
-            title_line = re.sub(r"\[([^\]]+)\]\([^)]+\)", r"\1", title_line)
-            # Remove trailing ellipsis/truncation
-            title_line = re.sub(r"\s*[.]{3,}.*$", "", title_line)
-            # Split on common separators to avoid leaking body content
-            for separator in [". Bumps ", " Bumps ", ". - ", " - "]:
-                if separator in title_line:
-                    title_line = title_line.split(separator)[0].strip()
-                    break
-            # Remove simple markdown/formatting artifacts
-            title_line = re.sub(r"[*_`]", "", title_line).strip()
-            if len(title_line) > 100:
-                break_points = [". ", "! ", "? ", " - ", ": "]
-                for bp in break_points:
-                    if bp in title_line[:100]:
-                        title_line = title_line[
-                            : title_line.index(bp) + len(bp.strip())
-                        ]
-                        break
-                else:
-                    words = title_line[:100].split()
-                    title_line = (
-                        " ".join(words[:-1])
-                        if len(words) > 1
-                        else title_line[:100].rstrip()
-                    )
+            title_line = _clean_squash_title_line(title_line)
 
             # Apply conventional commit normalization if enabled
             if inputs.normalise_commit and gh.pr_number:

github2gerrit/gerrit_pr_closer.py

@@ -54,6 +54,32 @@ FORCE_ABANDONED_CLEANUP = _env_bool("CLEANUP_ABANDONED", True)
 FORCE_GERRIT_CLEANUP = _env_bool("CLEANUP_GERRIT", True)
 
 
+def _build_gerrit_change_url(
+    gerrit_server: str,
+    gerrit_project: str,
+    change_number: str,
+) -> str | None:
+    """Build a Gerrit change URL from a change number string.
+
+    Returns the URL string, or ``None`` when URL generation fails.
+    """
+    try:
+        from .gerrit_urls import create_gerrit_url_builder
+
+        url_builder = create_gerrit_url_builder(gerrit_server)
+        return url_builder.change_url(gerrit_project, int(change_number))
+    except Exception:
+        log.debug(
+            "Could not build Gerrit change URL for server=%r, project=%r, "
+            "change_number=%r; skipping URL generation",
+            gerrit_server,
+            gerrit_project,
+            change_number,
+            exc_info=True,
+        )
+        return None
+
+
 def extract_change_number_from_url(
     gerrit_change_url: str,
 ) -> tuple[str, str] | None:
@@ -1078,7 +1104,7 @@ def abandon_gerrit_change_for_closed_pr(
         (or would be in dry-run), None otherwise
     """
     log.debug(
-        "🔍 Looking for Gerrit change associated with PR #%d",
+        "Looking for Gerrit change associated with PR #%d",
         pr_number,
     )
 
@@ -1232,24 +1258,35 @@ def abandon_gerrit_change_for_closed_pr(
 
             # Abandon the Gerrit change
             if not dry_run:
-                gerrit_change_url = (
-                    f"https://{gerrit_server}/c/"
-                    f"{gerrit_project}/+/{change_number}"
+                gerrit_change_url = _build_gerrit_change_url(
+                    gerrit_server, gerrit_project, change_number
                 )
                 _abandon_gerrit_change(
                     gerrit_client,
                     change_number,
                     abandon_message,
                 )
-                log.debug(
-                    "✅ Abandoned Gerrit change %s: %s",
-                    change_number,
-                    gerrit_change_url,
-                )
-                safe_console_print(
-                    f"✅ Abandoned Gerrit change {gerrit_change_url} "
-                    f"for pull request #{pr_number}"
-                )
+                if gerrit_change_url:
+                    log.debug(
+                        "Abandoned Gerrit change %s: %s",
+                        change_number,
+                        gerrit_change_url,
+                    )
+                    safe_console_print(
+                        f"✅ Abandoned Gerrit change "
+                        f"{gerrit_change_url} "
+                        f"for pull request #{pr_number}"
+                    )
+                else:
+                    log.debug(
+                        "Abandoned Gerrit change %s",
+                        change_number,
+                    )
+                    safe_console_print(
+                        f"✅ Abandoned Gerrit change "
+                        f"{change_number} "
+                        f"for pull request #{pr_number}"
+                    )
             else:
                 log.debug(
                     "DRY-RUN: Would abandon Gerrit change %s",
@@ -1274,9 +1311,8 @@ def abandon_gerrit_change_for_closed_pr(
             )
 
             if not dry_run:
-                gerrit_change_url = (
-                    f"https://{gerrit_server}/c/"
-                    f"{gerrit_project}/+/{change_number}"
+                gerrit_change_url = _build_gerrit_change_url(
+                    gerrit_server, gerrit_project, change_number
                 )
                 _abandon_gerrit_change(
                     gerrit_client,
@@ -1284,10 +1320,18 @@ def abandon_gerrit_change_for_closed_pr(
                     simple_message,
                 )
                 log.debug("Abandoned Gerrit change %s", change_number)
-                safe_console_print(
-                    f"✅ Abandoned Gerrit change {gerrit_change_url} "
-                    f"for pull request #{pr_number}"
-                )
+                if gerrit_change_url:
+                    safe_console_print(
+                        f"✅ Abandoned Gerrit change "
+                        f"{gerrit_change_url} "
+                        f"for pull request #{pr_number}"
+                    )
+                else:
+                    safe_console_print(
+                        f"✅ Abandoned Gerrit change "
+                        f"{change_number} "
+                        f"for pull request #{pr_number}"
+                    )
             else:
                 log.debug(
                     "DRY-RUN: Would abandon Gerrit change %s",
@@ -1454,20 +1498,25 @@ def cleanup_closed_github_prs(
 
                     # Abandon the Gerrit change
                     if not dry_run:
-                        gerrit_change_url = (
-                            f"https://{gerrit_server}/c/"
-                            f"{gerrit_project}/+/{change_number}"
+                        gerrit_change_url = _build_gerrit_change_url(
+                            gerrit_server, gerrit_project, change_number
                         )
                         _abandon_gerrit_change(
                             gerrit_client,
                             change_number,
                             abandon_message,
                         )
-                        log.info(
-                            "Abandoned Gerrit change %s: %s",
-                            change_number,
-                            gerrit_change_url,
-                        )
+                        if gerrit_change_url:
+                            log.info(
+                                "Abandoned Gerrit change %s: %s",
+                                change_number,
+                                gerrit_change_url,
+                            )
+                        else:
+                            log.info(
+                                "Abandoned Gerrit change %s",
+                                change_number,
+                            )
                     else:
                         log.info(
                             "DRY-RUN: Would abandon Gerrit change %s",
@@ -1652,3 +1701,157 @@ def _abandon_gerrit_change(
     except Exception:
         log.exception("Failed to abandon Gerrit change %s", change_number)
         raise
+
+
+def abandon_superseded_dependency_changes(
+    gerrit_server: str,
+    gerrit_project: str,
+    current_subject: str,
+    exclude_change_ids: list[str],
+    *,
+    dry_run: bool = False,
+    target_branch: str | None = None,
+) -> list[str]:
+    """Abandon open Gerrit changes superseded by a newer dependency update.
+
+    After pushing a new dependency-update change, this function
+    queries Gerrit for other open changes in the same project that
+    bump the **same** dependency package.  Matches are abandoned
+    with an explanatory message.
+
+    This serves as the "Option A fallback" when the primary
+    update-in-place strategy (Change-Id reuse) could not be
+    applied.
+
+    Args:
+        gerrit_server: Gerrit server hostname.
+        gerrit_project: Gerrit project name.
+        current_subject: Subject of the change that was just pushed.
+        exclude_change_ids: Change-IDs to exclude (the change we
+            just pushed, so we don't abandon ourselves).
+        dry_run: If True, log but do not actually abandon.
+        target_branch: Optional Gerrit branch name.  When provided,
+            only changes targeting this branch are considered.
+
+    Returns:
+        List of Gerrit change numbers that were abandoned
+        (or would be in dry-run mode).
+    """
+    from .gerrit_query import query_open_changes_by_project
+    from .gerrit_rest import build_client_for_host
+    from .gerrit_urls import create_gerrit_url_builder
+    from .similarity import extract_dependency_package_from_subject
+    from .trailers import GITHUB_PR_TRAILER
+    from .trailers import parse_trailers
+
+    current_pkg = extract_dependency_package_from_subject(current_subject)
+    if not current_pkg:
+        log.debug(
+            "Cannot extract dependency package from subject: %s",
+            current_subject,
+        )
+        return []
+
+    log.info(
+        "Checking for superseded dependency changes (package: %s)",
+        current_pkg,
+    )
+
+    abandoned: list[str] = []
+    try:
+        client = build_client_for_host(gerrit_server)
+        open_changes = query_open_changes_by_project(
+            client, gerrit_project, branch=target_branch, max_results=200
+        )
+
+        url_builder = create_gerrit_url_builder(gerrit_server)
+
+        for change in open_changes:
+            # Skip the change(s) we just pushed
+            if change.change_id in exclude_change_ids:
+                continue
+
+            # Only target changes created by GitHub2Gerrit
+            commit_msg = change.commit_message or ""
+            trailers = parse_trailers(commit_msg)
+            if GITHUB_PR_TRAILER not in trailers:
+                log.debug(
+                    "Skipping change %s: no GitHub2Gerrit "
+                    "metadata (missing %s trailer)",
+                    change.number,
+                    GITHUB_PR_TRAILER,
+                )
+                continue
+
+            candidate_pkg = extract_dependency_package_from_subject(
+                change.subject
+            )
+            if not candidate_pkg or candidate_pkg != current_pkg:
+                continue
+
+            # Parse change number for URL construction
+            try:
+                candidate_num = int(change.number)
+            except (TypeError, ValueError):
+                log.debug(
+                    "Skipping change with unparsable number: %r",
+                    change.number,
+                )
+                continue
+
+            change_url = url_builder.change_url(gerrit_project, candidate_num)
+            log.info(
+                "Found superseded change %s (%s)",
+                change.number,
+                change.subject,
+            )
+
+            if dry_run:
+                log.info(
+                    "DRY-RUN: Would abandon superseded change %s",
+                    change_url,
+                )
+                abandoned.append(str(change.number))
+                continue
+
+            superseding_info = f"New change subject: {current_subject}"
+            if exclude_change_ids:
+                superseding_info += "\nChange-Id(s): " + ", ".join(
+                    str(cid) for cid in exclude_change_ids
+                )
+            abandon_msg = (
+                f"Superseded by a newer update for {current_pkg}\n\n"
+                f"{superseding_info}\n\n"
+                "This change was automatically abandoned by "
+                "GitHub2Gerrit because a newer dependency update "
+                "for the same package was pushed."
+            )
+            try:
+                _abandon_gerrit_change(client, str(change.number), abandon_msg)
+                log.info(
+                    "Abandoned superseded change: %s",
+                    change_url,
+                )
+                abandoned.append(str(change.number))
+            except Exception as exc:
+                log.warning(
+                    "Failed to abandon superseded change %s: %s",
+                    change_url,
+                    exc,
+                )
+
+    except Exception as exc:
+        log.warning(
+            "Superseded dependency change sweep failed (non-fatal): %s",
+            exc,
+        )
+
+    if abandoned:
+        log.info(
+            "Supersession sweep complete: abandoned %d change(s)",
+            len(abandoned),
+        )
+    else:
+        log.debug("No superseded dependency changes found")
+
+    return abandoned

github2gerrit/gerrit_query.py

@@ -10,6 +10,7 @@ based on topics, with support for pagination and safe parsing.
 import logging
 from dataclasses import dataclass
 from typing import Any
+from urllib.parse import quote
 
 from .gerrit_rest import GerritRestClient
 
@@ -17,6 +18,20 @@ from .gerrit_rest import GerritRestClient
 log = logging.getLogger(__name__)
 
 
+def _gerrit_quote(value: str) -> str:
+    """Escape a value for safe use inside Gerrit query double-quotes.
+
+    Gerrit query syntax uses double-quoted strings for values
+    containing special characters.  Backslashes and double-quotes
+    inside the value must be escaped to prevent query injection or
+    malformed queries (e.g. branch names containing ``"``).
+
+    Returns:
+        The escaped string (without surrounding quotes).
+    """
+    return value.replace("\\", "\\\\").replace('"', '\\"')
+
+
 @dataclass
 class GerritChange:
     """Represents a Gerrit change from query results."""
@@ -82,7 +97,7 @@ def query_changes_by_topic(
 
     # Build query string
     status_query = " OR ".join(f"status:{status}" for status in statuses)
-    query = f"topic:{topic} AND ({status_query})"
+    query = f'topic:"{_gerrit_quote(topic)}" AND ({status_query})'
 
     log.debug("Querying Gerrit for changes: %s", query)
 
@@ -105,6 +120,56 @@ def query_changes_by_topic(
         return changes
 
 
+def query_open_changes_by_project(
+    client: GerritRestClient,
+    project: str,
+    *,
+    branch: str | None = None,
+    max_results: int = 100,
+) -> list[GerritChange]:
+    """Query open changes owned by the current user in a Gerrit project.
+
+    Used by the supersession sweep to discover open changes that
+    may be superseded by a newer dependency update.  Only returns
+    changes owned by the authenticated user (``owner:self``) to
+    avoid acting on unrelated human-authored changes.
+
+    Args:
+        client: Gerrit REST client.
+        project: Gerrit project name (e.g. ``myorg/myrepo``).
+        branch: Optional Gerrit branch name to scope the query.
+            When provided, only changes targeting this branch are
+            returned.
+        max_results: Maximum number of results to return.
+
+    Returns:
+        List of open ``GerritChange`` objects.
+    """
+    query = f'project:"{_gerrit_quote(project)}" status:open owner:self'
+    if branch:
+        query += f' branch:"{_gerrit_quote(branch)}"'
+    log.debug("Querying Gerrit for open changes: %s", query)
+
+    try:
+        changes = _execute_query_with_pagination(
+            client, query, max_results=max_results
+        )
+        log.debug(
+            "Found %d open changes in project '%s'",
+            len(changes),
+            project,
+        )
+    except Exception as exc:
+        log.warning(
+            "Failed to query open Gerrit changes for project '%s': %s",
+            project,
+            exc,
+        )
+        return []
+    else:
+        return changes
+
+
 def _execute_query_with_pagination(
     client: GerritRestClient,
     query: str,
@@ -135,7 +200,7 @@ def _execute_query_with_pagination(
             # Build query URL with parameters
             # Gerrit REST API: /changes/?q=query&n=limit&S=skip&o=options
             query_params = [
-                f"q={query}",
+                f"q={quote(query, safe='')}",
                 f"n={current_limit}",
                 f"S={start}",
                 "o=CURRENT_REVISION",

github2gerrit/netrc.py

@@ -769,9 +769,8 @@ def resolve_gerrit_credentials(
 
     if env_user and env_pass:
         log.debug(
-            "Using credentials from environment variables %s/%s",
+            "Using credentials from environment variable %s",
             env_username_var,
-            env_password_var,
         )
         return GerritCredentials(
             username=env_user,
@@ -787,9 +786,8 @@ def resolve_gerrit_credentials(
 
         if fallback_user and fallback_pass:
             log.debug(
-                "Using credentials from fallback environment variables %s/%s",
+                "Using credentials from fallback environment variable %s",
                 fallback_env_username_var,
-                fallback_env_password_var,
             )
             return GerritCredentials(
                 username=fallback_user,
@@ -803,9 +801,9 @@ def resolve_gerrit_credentials(
         fallback_user = os.getenv(fallback_env_username_var, "").strip()
         if fallback_user and env_pass:
             log.debug(
-                "Using credentials from mixed environment variables %s/%s",
+                "Using credentials from mixed environment variables"
+                " (%s + primary password)",
                 fallback_env_username_var,
-                env_password_var,
             )
             return GerritCredentials(
                 username=fallback_user,

github2gerrit/pr_content_filter.py

@@ -112,7 +112,7 @@ class DependabotRule(FilterRule):
             "Bumps " in title and " from " in title and " to " in title,
             "Dependabot will resolve any conflicts" in body,
             "<details>" in body and "<summary>" in body,
-            "camo.githubusercontent.com" in body,
+            "https://camo.githubusercontent.com/" in body,
         ]
 
         # Require multiple indicators for confidence

github2gerrit/similarity.py

@@ -33,6 +33,7 @@ from difflib import SequenceMatcher
 
 # Public API surface
 __all__ = [
+    "CC_PREFIX_RE",
     "ScoreResult",
     "ScoringConfig",
     "aggregate_scores",
@@ -48,6 +49,14 @@ __all__ = [
     "sequence_ratio",
 ]
 
+# Compiled conventional-commit prefix regex, shared across modules.
+# Matches types like "feat:", "Fix(scope):", "Build(deps)!:" etc.
+CC_PREFIX_RE = re.compile(
+    r"^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)"
+    r"(?:\([^)]*\))?\s*!?\s*:\s*",
+    re.IGNORECASE,
+)
+
 
 @dataclass(frozen=True)
 class ScoringConfig:
@@ -197,6 +206,7 @@ def extract_dependency_package_from_subject(subject: str) -> str:
     Examples to consider (to be implemented):
     - "Bump requests from 2.31.0 to 2.32.0" -> "requests"
     - "chore: update org/tool from v1.2.3 to v1.2.4" -> "org/tool"
+    - "Build(deps): Bump org/tool from 1.0 to 2.0" -> "org/tool"
 
     Args:
         subject: The (possibly unnormalized) subject line.
@@ -205,15 +215,20 @@ def extract_dependency_package_from_subject(subject: str) -> str:
         Package identifier, or empty string if none could be extracted.
     """
     s = (subject or "").lower()
+    # Strip any conventional-commit prefix before matching
+    cc_match = CC_PREFIX_RE.match(s)
+    if cc_match:
+        s = s[cc_match.end() :]
+
     patterns = [
         # Full version with "from" clause
-        r"(?:chore.*?:\s*)?bump\s+([^\s]+)\s+from\s+",
-        r"(?:chore.*?:\s*)?update\s+([^\s]+)\s+from\s+",
-        r"(?:chore.*?:\s*)?upgrade\s+([^\s]+)\s+from\s+",
+        r"bump\s+([^\s]+)\s+from\s+",
+        r"update\s+([^\s]+)\s+from\s+",
+        r"upgrade\s+([^\s]+)\s+from\s+",
         # Truncated version without "from" clause (for Gerrit subjects)
-        r"(?:chore.*?:\s*)?bump\s+([^\s]+)\s*$",
-        r"(?:chore.*?:\s*)?update\s+([^\s]+)\s*$",
-        r"(?:chore.*?:\s*)?upgrade\s+([^\s]+)\s*$",
+        r"bump\s+([^\s]+)\s*$",
+        r"update\s+([^\s]+)\s*$",
+        r"upgrade\s+([^\s]+)\s*$",
     ]
     for pat in patterns:
         m = re.search(pat, s)

{github2gerrit-1.2.0.dist-info → github2gerrit-1.2.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github2gerrit
-Version: 1.2.0
+Version: 1.2.2
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action
@@ -22,6 +22,7 @@ Classifier: Topic :: Software Development :: Build Tools
 Classifier: Topic :: Software Development :: Version Control
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
+Requires-Dist: click>=8.1.7
 Requires-Dist: cryptography>=46.0.5
 Requires-Dist: git-review>=2.5.0
 Requires-Dist: pygerrit2>=2.0.15

{github2gerrit-1.2.0.dist-info → github2gerrit-1.2.2.dist-info}/RECORD

@@ -1,15 +1,15 @@
 github2gerrit/__init__.py,sha256=N1Vj1HJ28LKCJLAynQdm5jFGQQAz9YSMzZhEfvbBgow,886
-github2gerrit/cli.py,sha256=iPrtQ39YClUmDaTLFrcXbX-Efdkvq9BpLMgy3XmsRQg,118733
-github2gerrit/commit_normalization.py,sha256=5HqUJ7p3WQzUYNTkganIsu82aW1wZrh7J7ivQvdCYXw,17033
+github2gerrit/cli.py,sha256=osLCG6Xshrcp6QBFeA3OoWoH3NywRy6HSo_jYUkMDHU,119341
+github2gerrit/commit_normalization.py,sha256=6FOkNfYvR_wicBAhbd4gcwVlkgnqdVFWvUFQ2cwefYA,17131
 github2gerrit/commit_rules.py,sha256=GMlCYwuZb-RcEP1SwMfI3r4i_Dy2yqK6f0RwnYFMGH4,16297
 github2gerrit/config.py,sha256=nvSc9e_wJM2GS5whFE5R3UwmZjYPZgucaS8s6rrEbjY,26469
 github2gerrit/constants.py,sha256=uCAx-lZiyxlVSHaGmDx6TFbCajkK3VO2ggCOej0EeXk,1306
-github2gerrit/core.py,sha256=7JXt2J9fKt--zd5vwBqzqkS7oB5xRN18cBpD5dkwqpI,245296
+github2gerrit/core.py,sha256=W08u18H9Uhsy1_0cm7hiXZmuXljr6AwGI03ybNcUO-Y,254613
 github2gerrit/duplicate_detection.py,sha256=CTrzD3YLc-AyPmaR5bSC5b22LpBDpCcNbVxMv2X0o7A,32127
 github2gerrit/error_codes.py,sha256=MclL3tiOSR4R61c3J642CYDyJJ10tzEQmI2YW7Wkqjw,19098
 github2gerrit/external_api.py,sha256=9483kkgIs1ECOl_f0lcGb8GrJQF9IfYmWfBQwUJT9hk,18480
-github2gerrit/gerrit_pr_closer.py,sha256=flDGupYls2-9SBLhpUxAUtdP9l7J_GNxMRMIfr4czvs,54432
-github2gerrit/gerrit_query.py,sha256=7AR9UEwZxtTb9V-l17UDdtWvlvROlnIeJVMa57ilf6s,8343
+github2gerrit/gerrit_pr_closer.py,sha256=irsAI4eNJWi66P39q1gRibpV5SdhiVKv11u-G8yD9a0,61591
+github2gerrit/gerrit_query.py,sha256=pn44IN46tgKPq-s48XnGXpS6kfeQyiECQP75CnJSOr8,10472
 github2gerrit/gerrit_rest.py,sha256=FyQAMCSuZmJ7ClLuPRgkwapXbJnhW41TYdgkB6UGKQY,12612
 github2gerrit/gerrit_urls.py,sha256=aoPuUOCysHffVr9qkBRIPCZEUoSBMHmfviydy1U1uSQ,13843
 github2gerrit/github_api.py,sha256=wYKWRMQsYu7zbxyRQRO7N4cTqBvE6vYf8SdN_3C6XTo,11486
@@ -17,13 +17,13 @@ github2gerrit/gitreview.py,sha256=I1FPsYjkPttj6DdjqHI0HkWOwsnInhmijLeGjnD658I,23
 github2gerrit/gitutils.py,sha256=J-pgSeeOslspYSwkzkxHAjej4h7t65s2w15ijDpEHOY,26462
 github2gerrit/mapping_comment.py,sha256=3WAL3KQgjfPnUMZS_-aqNL7qtD0jNXr0VTK_GPEcW3k,9746
 github2gerrit/models.py,sha256=beZ1C3S8v-qA4tD3Niq6trpoHofxLx6q3VQgvOz0WyI,4304
-github2gerrit/netrc.py,sha256=F9_ff2iV8rjN35cY6H1QteHDPGlOawm2VlBE0T4jKNc,27612
+github2gerrit/netrc.py,sha256=x8l53j-t1kl-v1YZEPaDT2Mmf5qUfgP5J0YZzE7fkIY,27534
 github2gerrit/pr_commands.py,sha256=VZNEvzK1MHnXul3SbkjjoY_HW34M9QFyt74RxcRZpQU,12440
-github2gerrit/pr_content_filter.py,sha256=cTikck3rgQSE6612eWpWnfWEcIingPD_MpRgNhblWX4,19269
+github2gerrit/pr_content_filter.py,sha256=WUeYiTTYbIgz4Kb0u8M5e3vEoNU5L2WQ9h27xV1iNwE,19278
 github2gerrit/reconcile_matcher.py,sha256=s7v3LJdv5CZmi7LvhENFoXlQ-GCxFS-CtkuOCUsD5ow,20466
 github2gerrit/rich_display.py,sha256=Y2rtJNLP_EG9zdR29NiSqM3j_o_51gpQVeTNBqZch5o,16038
 github2gerrit/rich_logging.py,sha256=D8yyV4NrsLf74fZH5-AFr1c-Im7MyNyx3LbJTLqepHs,10991
-github2gerrit/similarity.py,sha256=nbmGPGDSwxPKCuBfyJ7lxUwkMPnfURB4qWp0EJw9xe0,16164
+github2gerrit/similarity.py,sha256=UHJI_qQB8wGEdWroyHcH5Nb1f3P-fgUU4XnBr9EzIUU,16582
 github2gerrit/ssh_agent_setup.py,sha256=5nccjdjJuTxbDR9nxnP1ITkSGItbCFD4Owxsrnt8IYc,22613
 github2gerrit/ssh_common.py,sha256=OC20SQsX_AP3yTUJ_tqz6XAN30O5GbgtZwzwUzyX4DQ,8216
 github2gerrit/ssh_config_parser.py,sha256=Yd6yoh95lSfUXHRHw2mrgNlY0yizz1A7GmQod30dCT8,15523
@@ -32,8 +32,8 @@ github2gerrit/trailers.py,sha256=9w0vIxPNBNQp56sIy-MF62d22Rm6vY-msh9ao1lX0rQ,838
 github2gerrit/utils.py,sha256=zNH1qcxyOYdhIn4Ku0o5p9pbwYWdQfboLNqzADDts8A,3804
 github2gerrit/orchestrator/__init__.py,sha256=HAEcdCAHOFr8LsdIwAdcIcFZn_ayMbX9rdVUULp8410,864
 github2gerrit/orchestrator/reconciliation.py,sha256=-JQre_PUx6aZeX8Qs6uHqzujKAXXCj9wNv7Cy-543Z8,19391
-github2gerrit-1.2.0.dist-info/METADATA,sha256=8WHdDf2jYgv2FJqLIjnTfU48Aiw1Ra9f5ifTChs9ljk,70182
-github2gerrit-1.2.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-github2gerrit-1.2.0.dist-info/entry_points.txt,sha256=MxN2_liIKo3-xJwtAulAeS5GcOS6JS96nvwOQIkP3W8,56
-github2gerrit-1.2.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-github2gerrit-1.2.0.dist-info/RECORD,,
+github2gerrit-1.2.2.dist-info/METADATA,sha256=JUrvlCF0qFREPgEa7h_tgro6fp9VT0FO3zUF5c0Jjjs,70210
+github2gerrit-1.2.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+github2gerrit-1.2.2.dist-info/entry_points.txt,sha256=MxN2_liIKo3-xJwtAulAeS5GcOS6JS96nvwOQIkP3W8,56
+github2gerrit-1.2.2.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+github2gerrit-1.2.2.dist-info/RECORD,,