github2gerrit 1.3.1__tar.gz → 1.3.3__tar.gz

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: github2gerrit
-Version: 1.3.1
+Version: 1.3.3
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/sitecustomize.py

@@ -57,6 +57,8 @@ def _dbg(msg: str) -> None:
         try:
             print(f"[sitecustomize] {msg}", file=sys.stderr)
         except Exception:
+            # Debug logging must never disrupt interpreter startup; if
+            # writing to stderr fails, silently drop the message.
             pass
 
 
@@ -125,6 +127,8 @@ def _collect_base_dirs(repo_root: Path) -> set[Path]:
     try:
         bases.add(Path.cwd())
     except Exception:
+        # CWD may be unavailable (e.g. deleted); skip it and continue
+        # collecting the remaining base directories.
         pass
     # Repository root (directory containing this file)
     bases.add(repo_root)
@@ -134,6 +138,8 @@ def _collect_base_dirs(repo_root: Path) -> set[Path]:
         try:
             bases.add(Path(gw))
         except Exception:
+            # A malformed GITHUB_WORKSPACE value should not abort cleanup;
+            # skip it and continue with the other base directories.
             pass
     return bases
 

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/cli.py

@@ -385,12 +385,15 @@ else:
 
 
 class _FormatterProto(Protocol):
-    def write_usage(self, prog: str, args: str, prefix: str = ...) -> None: ...
+    def write_usage(self, prog: str, args: str, prefix: str = ...) -> None:
+        """Write the program usage line."""
 
 
 class _ContextProto(Protocol):
     @property
-    def command_path(self) -> str: ...
+    def command_path(self) -> str:
+        """Return the full command path."""
+        raise NotImplementedError
 
 
 class _SingleUsageGroup(BaseGroup):
@@ -471,14 +474,23 @@ def _resolve_issue_id_from_json(json_str: str, github_actor: str) -> str:
     return ""
 
 
-# Show version information when --help is used or in GitHub Actions mode
-if "--help" in sys.argv or _is_github_actions_context():
+def _print_version_banner() -> None:
+    """Print the resolved package version, or a fallback notice.
+
+    Defined as a function so the ``print`` calls do not execute at module
+    scope during import; the banner is only emitted when explicitly invoked.
+    """
     try:
         app_version = get_version("github2gerrit")
         print(f"🏷️  github2gerrit version {app_version}")
     except Exception:
         print("⚠️  github2gerrit version information not available")
 
+
+# Show version information when --help is used or in GitHub Actions mode
+if "--help" in sys.argv or _is_github_actions_context():
+    _print_version_banner()
+
 app: typer.Typer = typer.Typer(
     add_completion=False,
     no_args_is_help=False,

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/core.py

@@ -80,19 +80,10 @@ from .utils import is_verbose_mode
 
 
 try:
-    from pygerrit2 import GerritRestAPI
-    from pygerrit2 import HTTPBasicAuth
-except ImportError:
-    GerritRestAPI = None
-    HTTPBasicAuth = None
-
-try:
-    from .ssh_discovery import SSHDiscoveryError
     from .ssh_discovery import auto_discover_gerrit_host_keys
 except ImportError:
     # Fallback if ssh_discovery module is not available
     auto_discover_gerrit_host_keys = None  # type: ignore[assignment]
-    SSHDiscoveryError = Exception  # type: ignore[misc,assignment]
 
 try:
     from .ssh_agent_setup import SSHAgentManager
@@ -113,7 +104,6 @@ log = logging.getLogger("github2gerrit.core")
 
 
 # Error message constants to comply with TRY003
-_MSG_ISSUE_ID_MULTILINE = "Issue ID must be single line"
 _MSG_MISSING_PR_CONTEXT = "missing PR context"
 _MSG_BAD_REPOSITORY_CONTEXT = "bad repository context"
 _MSG_MISSING_GERRIT_SERVER = (
@@ -121,10 +111,6 @@ _MSG_MISSING_GERRIT_SERVER = (
     "input/environment variable, .gitreview file, or action configuration."
 )
 _MSG_MISSING_GERRIT_PROJECT = "missing GERRIT_PROJECT"
-_MSG_PYGERRIT2_REQUIRED_REST = "pygerrit2 is required to query Gerrit REST API"
-_MSG_PYGERRIT2_REQUIRED_AUTH = "pygerrit2 is required for HTTP authentication"
-_MSG_PYGERRIT2_MISSING = "pygerrit2 missing"
-_MSG_PYGERRIT2_AUTH_MISSING = "pygerrit2 auth missing"
 _MSG_DNS_RESOLUTION_FAILED = "DNS resolution failed for '%s'"
 
 
@@ -4429,7 +4415,6 @@ class Orchestrator:
             List of email addresses that were not found in Gerrit
         """
         combined_output = f"{exc.stdout}\n{exc.stderr}"
-        import re
 
         # Pattern to match: Account 'email@domain.com' not found
         pattern = r"Account\s+'([^']+)'\s+not\s+found"
@@ -4903,7 +4888,6 @@ class Orchestrator:
             # Extract specific rejection reason from output
             # Handle multiline rejection messages by looking in normalized
             # output
-            import re
 
             # Look for the rejection pattern in the normalized output
             rejection_match = re.search(
@@ -5299,7 +5283,6 @@ class Orchestrator:
         self, workspace: Path, gh: GitHubContext, inputs: Inputs
     ) -> None:
         """Fallback to GitHub API archive download (ported from CLI)."""
-        import json
         import zipfile
 
         repo_full = gh.repository.strip() if gh.repository else ""

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/duplicate_detection.py

@@ -32,15 +32,6 @@ from .rich_display import safe_console_print
 from .trailers import extract_github_metadata
 
 
-# Optional Gerrit REST API support
-try:
-    from pygerrit2 import GerritRestAPI
-    from pygerrit2 import HTTPBasicAuth
-except ImportError:
-    GerritRestAPI = None
-    HTTPBasicAuth = None
-
-
 log = logging.getLogger(__name__)
 
 __all__ = [

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/external_api.py

@@ -327,7 +327,7 @@ def external_api_call(
                 policy=policy,
             )
 
-            last_exc: BaseException | None = None
+            last_exc: Exception | None = None
 
             for attempt in range(1, policy.max_attempts + 1):
                 context.attempt = attempt
@@ -347,7 +347,7 @@ def external_api_call(
 
                     # Call the actual function
                     result = func(*args, **kwargs)
-                except BaseException as exc:
+                except Exception as exc:
                     last_exc = exc
                     duration = time.time() - context.start_time
 

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/gerrit_rest.py

@@ -68,19 +68,6 @@ _MSG_PYGERRIT2_REQUIRED_AUTH: Final[str] = (
     "pygerrit2 is required for HTTP authentication"
 )
 
-_TRANSIENT_ERR_SUBSTRINGS: Final[tuple[str, ...]] = (
-    "timed out",
-    "temporarily unavailable",
-    "temporary failure",
-    "connection reset",
-    "connection aborted",
-    "broken pipe",
-    "connection refused",
-    "bad gateway",
-    "service unavailable",
-    "gateway timeout",
-)
-
 # HTTP status codes that indicate an authentication/authorization problem
 # rather than a transient fault or a bug. These are expected when no
 # Gerrit REST credentials are available (or they are insufficient for the

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/github_api.py

@@ -23,7 +23,6 @@ from collections.abc import Iterable
 from importlib import import_module
 from typing import Any
 from typing import Protocol
-from typing import TypeVar
 from typing import cast
 
 from .error_codes import ExitCode
@@ -35,8 +34,6 @@ from .external_api import external_api_call
 
 # Error message constants to comply with TRY003
 _MSG_PYGITHUB_REQUIRED = "PyGithub required"
-_MSG_MISSING_GITHUB_TOKEN = "missing GITHUB_TOKEN"  # noqa: S105
-_MSG_BAD_GITHUB_REPOSITORY = "bad GITHUB_REPOSITORY"
 
 
 class GithubExceptionType(Exception):
@@ -82,8 +79,12 @@ class GhIssueComment(Protocol):
 
 
 class GhIssue(Protocol):
-    def get_comments(self) -> Iterable[GhIssueComment]: ...
-    def create_comment(self, body: str) -> None: ...
+    def get_comments(self) -> Iterable[GhIssueComment]:
+        """Return the comments on the issue."""
+        raise NotImplementedError
+
+    def create_comment(self, body: str) -> None:
+        """Create a new comment on the issue."""
 
 
 class GhPullRequest(Protocol):
@@ -91,17 +92,28 @@ class GhPullRequest(Protocol):
     title: str | None
     body: str | None
 
-    def as_issue(self) -> GhIssue: ...
-    def edit(self, *, state: str) -> None: ...
+    def as_issue(self) -> GhIssue:
+        """Return the issue view of this pull request."""
+        raise NotImplementedError
+
+    def edit(self, *, state: str) -> None:
+        """Edit the pull request state."""
 
 
 class GhRepository(Protocol):
-    def get_pull(self, number: int) -> GhPullRequest: ...
-    def get_pulls(self, state: str) -> Iterable[GhPullRequest]: ...
+    def get_pull(self, number: int) -> GhPullRequest:
+        """Return the pull request with the given number."""
+        raise NotImplementedError
+
+    def get_pulls(self, state: str) -> Iterable[GhPullRequest]:
+        """Return the pull requests with the given state."""
+        raise NotImplementedError
 
 
 class GhClient(Protocol):
-    def get_repo(self, full: str) -> GhRepository: ...
+    def get_repo(self, full: str) -> GhRepository:
+        """Return the repository for the given full name."""
+        raise NotImplementedError
 
 
 __all__ = [
@@ -120,8 +132,6 @@ __all__ = [
 
 log = logging.getLogger("github2gerrit.github_api")
 
-_T = TypeVar("_T")
-
 
 def _getenv_str(name: str) -> str:
     val = os.getenv(name, "")

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/gitreview.py

@@ -151,11 +151,6 @@ def derive_base_path(host: str) -> str | None:
     return _KNOWN_BASE_PATHS.get(host.lower().strip())
 
 
-# Keep a private alias so internal callers don't break if they were
-# referencing the underscore-prefixed name during development.
-_derive_base_path = derive_base_path
-
-
 # ───────────────────────────────────────────────────────────────────────
 # Pure parser
 # ───────────────────────────────────────────────────────────────────────

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/gitutils.py

@@ -555,6 +555,8 @@ def git_commit_amend(
                 if committer_email and _has_committer_signoff(body):
                     effective_signoff = False
             except GitError:
+                # Unable to read the current commit body (e.g. no HEAD yet);
+                # fall back to honoring the requested signoff setting.
                 pass
     except Exception:
         # Best effort only; default to requested signoff
@@ -613,7 +615,6 @@ def git_commit_new(
             _tf.flush()
             tmp_path = Path(_tf.name)
         message_file = tmp_path
-        message = None
 
     # Determine whether to add -s; only suppress if message already has a
     # sign-off for current committer

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/src/github2gerrit/ssh_discovery.py

@@ -379,7 +379,6 @@ def save_host_keys_to_config(
             new_lines.append(f"[{organization}]")
             escaped_keys = host_keys.replace("\n", "\\n")
             new_lines.append(f'GERRIT_KNOWN_HOSTS = "{escaped_keys}"')
-            gerrit_known_hosts_updated = True
 
         # If section existed but didn't have GERRIT_KNOWN_HOSTS, add it
         elif not gerrit_known_hosts_updated:

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/tests/test_dependency_supersession.py

@@ -17,6 +17,7 @@ Covers two mechanisms:
 
 from __future__ import annotations
 
+import hashlib
 from dataclasses import dataclass
 from typing import Any
 from unittest.mock import MagicMock
@@ -31,6 +32,7 @@ from github2gerrit.gerrit_query import query_open_changes_by_project
 from github2gerrit.gitreview import GerritInfo
 from github2gerrit.models import GitHubContext
 from github2gerrit.similarity import extract_dependency_package_from_subject
+from github2gerrit.utils import reset_warning_once
 
 
 # -------------------------------------------------------------------
@@ -38,6 +40,46 @@ from github2gerrit.similarity import extract_dependency_package_from_subject
 # -------------------------------------------------------------------
 
 
+# Dependency fixture values reused across the supersession tests.
+# Centralising them documents which data is significant to the logic under
+# test (the *package name* must match for a change to be superseded) versus
+# which is arbitrary (the exact version strings).
+_DEP_PACKAGE = "requests"
+_DEP_VERSION_OLD = "2.31.0"
+_DEP_VERSION_NEW = "2.32.0"
+_DEP_VERSION_INTERMEDIATE = "2.31.5"
+_DEP_BUMP_TITLE = (
+    f"Bump {_DEP_PACKAGE} from {_DEP_VERSION_OLD} to {_DEP_VERSION_NEW}"
+)
+
+
+@pytest.fixture(autouse=True)
+def _reset_warning_once_state() -> None:
+    """Reset the one-time warning cache before each test.
+
+    Several tests assert warn-once behaviour (for example the truncation
+    warning emitted by the anonymous fallback), which relies on process-wide
+    global state. Resetting it automatically keeps every test isolated so
+    individual tests no longer need to call ``reset_warning_once`` by hand.
+    """
+    reset_warning_once()
+
+
+def _make_change_id(seed: str) -> str:
+    """Return a valid-looking Gerrit Change-Id derived from ``seed``.
+
+    A real Gerrit Change-Id is the letter ``I`` followed by 40 hexadecimal
+    characters (a SHA-1 digest). Tests previously used mnemonic but invalid
+    values such as ``Iexist00...`` that contain non-hex characters. This
+    helper instead derives a truncated SHA-256 digest from a human-readable
+    seed: the exact hash algorithm is unimportant, it only needs to match
+    the ``I`` + 40-hex-character format while keeping failures easy to
+    trace.
+    """
+    digest = hashlib.sha256(seed.encode("utf-8")).hexdigest()[:40]
+    return f"I{digest}"
+
+
 def _gerrit_change(
     *,
     change_id: str = "Iaaaa000000000000000000000000000000000000",
@@ -202,10 +244,6 @@ class TestQueryOpenChangesByProject:
         to drive the anonymous fallback, the helper must short-circuit and
         never issue the request, returning an empty list.
         """
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         fake_client = MagicMock()
         fake_client.is_authenticated = False
 
@@ -232,10 +270,6 @@ class TestQueryOpenChangesByProject:
         The query must NOT use owner:self, and only changes whose
         GitHub-PR trailer targets the current repository are returned.
         """
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         ours = _raw_change(
             100,
             "chore: bump requests from 2.31.0 to 2.32.0",
@@ -262,10 +296,6 @@ class TestQueryOpenChangesByProject:
 
     def test_anonymous_fallback_repo_match_is_case_insensitive(self) -> None:
         """Repo trailer matching ignores case differences."""
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         ours = _raw_change(
             200,
             "chore: bump requests from 2.31.0 to 2.32.0",
@@ -283,10 +313,6 @@ class TestQueryOpenChangesByProject:
 
     def test_anonymous_fallback_matches_ghes_host(self) -> None:
         """The host is ignored, so GitHub Enterprise URLs still match."""
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         ours = _raw_change(
             210,
             "chore: bump requests from 2.31.0 to 2.32.0",
@@ -310,10 +336,6 @@ class TestQueryOpenChangesByProject:
         repo in its query string, a non-URL value, and a relative path
         (e.g. ``/org/repo/pull/1``) are all correctly excluded.
         """
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         other = _raw_change(
             220,
             "chore: bump requests from 2.31.0 to 2.32.0",
@@ -346,10 +368,6 @@ class TestQueryOpenChangesByProject:
         GitHub2Gerrit changes (which carry the GitHub-PR trailer) so busy
         projects do not truncate before the relevant changes are seen.
         """
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         fake_client = MagicMock()
         fake_client.is_authenticated = False
         fake_client.get.return_value = []
@@ -369,10 +387,6 @@ class TestQueryOpenChangesByProject:
         """Hitting the result cap emits a one-time truncation warning."""
         import logging
 
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         c1 = _raw_change(
             300,
             "chore: bump x from 1 to 2",
@@ -406,9 +420,6 @@ class TestQueryOpenChangesByProject:
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
         """Disabling the fallback flag skips even when repo is known."""
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
         monkeypatch.setenv("G2G_ANON_SUPERSEDE_FALLBACK", "false")
 
         fake_client = MagicMock()
@@ -422,10 +433,6 @@ class TestQueryOpenChangesByProject:
 
     def test_anonymous_fallback_whitespace_repo_skips(self) -> None:
         """A blank/whitespace-only repository must not trigger a query."""
-        from github2gerrit.utils import reset_warning_once
-
-        reset_warning_once()
-
         fake_client = MagicMock()
         fake_client.is_authenticated = False
 
@@ -446,7 +453,16 @@ class TestQueryOpenChangesByProject:
     new=lambda *_a, **_kw: "",
 )
 class TestAbandonSupersededDependencyChanges:
-    """Tests for the post-push abandon sweep."""
+    """Tests for the post-push abandon sweep.
+
+    The class-level ``@patch`` stubs
+    ``gerrit_urls._discover_base_path_for_host`` to return an empty base
+    path for *every* test method below, so URL construction does not attempt
+    host discovery (a network call). The patch is intentionally applied at
+    the class level because all methods exercise URL building; it is not
+    injected as a method argument because the stubbed value is never
+    inspected by the tests.
+    """
 
     @patch("github2gerrit.gerrit_rest.build_client_for_host")
     @patch("github2gerrit.gerrit_query.query_open_changes_by_project")
@@ -789,7 +805,7 @@ class TestStrategy5Integration:
         # Set up GitHub mocks — strategies 1-4 should all fail
         mock_get_pull.return_value = _FakePullRequest(
             number=42,
-            title="Bump requests from 2.31.0 to 2.32.0",
+            title=_DEP_BUMP_TITLE,
             user=_FakeGitHubUser(),
         )
         mock_get_repo.return_value = MagicMock()
@@ -803,10 +819,14 @@ class TestStrategy5Integration:
         mock_gerrit_client.return_value = fake_gerrit
 
         # Strategy 5 — return an open change bumping the same package
+        existing_change_id = _make_change_id("strategy5-existing")
         existing_change = _gerrit_change(
-            change_id="Iexist00000000000000000000000000000000000",
+            change_id=existing_change_id,
             number="999",
-            subject="chore: bump requests from 2.31.0 to 2.31.5",
+            subject=(
+                f"chore: bump {_DEP_PACKAGE} from "
+                f"{_DEP_VERSION_OLD} to {_DEP_VERSION_INTERMEDIATE}"
+            ),
         )
         mock_query_open.return_value = [existing_change]
 
@@ -832,7 +852,7 @@ class TestStrategy5Integration:
         )
 
         result = orch._find_existing_change_for_pr(gh, gerrit)
-        assert result == ["Iexist00000000000000000000000000000000000"]
+        assert result == [existing_change_id]
 
     @patch("github2gerrit.core.build_client")
     @patch("github2gerrit.core.get_repo_from_env")
@@ -956,7 +976,14 @@ class TestStrategy5Integration:
     new=lambda *_a, **_kw: "",
 )
 class TestRealWorldScenarios:
-    """Scenarios taken directly from the issue report."""
+    """Scenarios taken directly from the issue report.
+
+    As with :class:`TestAbandonSupersededDependencyChanges`, the class-level
+    ``@patch`` stubs ``gerrit_urls._discover_base_path_for_host`` for every
+    method so URL construction avoids host discovery. The stub uses ``new=``
+    rather than a mock argument because its return value is fixed and never
+    asserted on.
+    """
 
     @patch("github2gerrit.gerrit_rest.build_client_for_host")
     @patch("github2gerrit.gerrit_query.query_open_changes_by_project")

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/tests/test_external_api_framework.py

@@ -222,6 +222,8 @@ def test_curl_download_success(
                     output_path = Path(cmd[o_index + 1])
                     output_path.write_text("downloaded content")
             except (ValueError, IndexError):
+                # No "-o" flag (or no value after it) in the mocked curl
+                # command; nothing to write, so behave like a no-op download.
                 pass
         return MockCompletedProcess()
 
@@ -278,8 +280,6 @@ def test_log_api_metrics_summary(
     monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
 ) -> None:
     """Test API metrics summary logging."""
-    import logging
-
     # Set up some metrics
     reset_api_metrics()
 

{github2gerrit-1.3.1 → github2gerrit-1.3.3}/tests/test_gitutils_helpers.py

@@ -16,19 +16,40 @@ from github2gerrit.gitutils import run_cmd
 from github2gerrit.gitutils import run_cmd_with_retries
 
 
+# Environment variables that pytest, pytest-cov, and pytest-xdist inject so
+# that coverage measurement and test metadata propagate into subprocesses.
+# When a test spawns the current Python interpreter via ``run_cmd`` we clear
+# these so the child does not start its own coverage run (which can emit
+# warnings or write stray data files) and so its output stays deterministic
+# regardless of how the outer pytest session was invoked.
+#
+#   COV_CORE_SOURCE/CONFIG/DATAFILE  pytest-cov subprocess coverage hooks
+#   COVERAGE_PROCESS_START           triggers coverage startup in children
+#   COVERAGE_FILE / COVERAGE_RCFILE  coverage data / config file locations
+#   PYTEST_ADDOPTS                   extra pytest args inherited by children
+#   PYTEST_CURRENT_TEST              current test id (set per test by pytest)
+#   PYTEST_XDIST_WORKER              xdist worker id when running in parallel
+_COVERAGE_ENV_KEYS = (
+    "COV_CORE_SOURCE",
+    "COV_CORE_CONFIG",
+    "COV_CORE_DATAFILE",
+    "COVERAGE_PROCESS_START",
+    "COVERAGE_FILE",
+    "COVERAGE_RCFILE",
+    "PYTEST_ADDOPTS",
+    "PYTEST_CURRENT_TEST",
+    "PYTEST_XDIST_WORKER",
+)
+
+
 def _no_cov_env() -> dict[str, str]:
-    keys = [
-        "COV_CORE_SOURCE",
-        "COV_CORE_CONFIG",
-        "COV_CORE_DATAFILE",
-        "COVERAGE_PROCESS_START",
-        "COVERAGE_FILE",
-        "COVERAGE_RCFILE",
-        "PYTEST_ADDOPTS",
-        "PYTEST_CURRENT_TEST",
-        "PYTEST_XDIST_WORKER",
-    ]
-    return dict.fromkeys(keys, "")
+    """Return an env mapping that disables coverage in subprocesses.
+
+    Every key in :data:`_COVERAGE_ENV_KEYS` is mapped to an empty string so
+    a spawned child process inherits a clean, coverage-free environment. See
+    that constant for the rationale behind each cleared variable.
+    """
+    return dict.fromkeys(_COVERAGE_ENV_KEYS, "")
 
 
 def test_mask_text_replaces_tokens_and_ignores_empty() -> None:
@@ -93,24 +114,31 @@ def test_run_cmd_with_retries_retries_on_transient_error_then_succeeds(
 
     monkeypatch.setattr("time.sleep", _fake_sleep)
 
-    # Script: on first run create a marker and exit non-zero with a transient
-    # error in stderr.
-    # On subsequent runs (marker exists) print success and exit 0.
+    # The helper script creates a marker file and fails with a transient
+    # error on its first run, then succeeds once the marker exists. Writing
+    # the behaviour to a real script file (taking the marker path as an
+    # argument) keeps the test readable and avoids embedding Python source
+    # inside an f-string.
     marker = tmp_path / "attempted"
-
-    code = f"""
-import os, sys, pathlib
-p = pathlib.Path({str(marker)!r})
-if not p.exists():
-    p.write_text("1", encoding="utf-8")
-    print("could not resolve host: example.com", file=sys.stderr)
-    sys.exit(128)
-else:
-    print("ok")
-"""
+    script = tmp_path / "transient_then_succeed.py"
+    script.write_text(
+        "import pathlib\n"
+        "import sys\n"
+        "\n"
+        "marker = pathlib.Path(sys.argv[1])\n"
+        "if not marker.exists():\n"
+        '    marker.write_text("1", encoding="utf-8")\n'
+        '    print("could not resolve host: example.com", file=sys.stderr)\n'
+        "    sys.exit(128)\n"
+        "else:\n"
+        '    print("ok")\n',
+        encoding="utf-8",
+    )
 
     res = run_cmd_with_retries(
-        [sys.executable, "-c", code], cwd=tmp_path, env=_no_cov_env()
+        [sys.executable, str(script), str(marker)],
+        cwd=tmp_path,
+        env=_no_cov_env(),
     )
     # Should succeed after retry, marker must exist, and we should have slept at
     # least once
@@ -222,7 +250,7 @@ def test_git_last_commit_trailers_parsing_edge_cases(
 ) -> None:
     # Patch git_show to return a crafted commit message body with various
     # trailer forms.
-    import github2gerrit.gitutils as gitutils
+    from github2gerrit.gitutils import git_last_commit_trailers
 
     body = (
         "Subject line\n\n"
@@ -235,10 +263,12 @@ def test_git_last_commit_trailers_parsing_edge_cases(
         "Change-Id: Iabc123abc123abc123abc123abc123abc123ab\n"
     )
 
-    monkeypatch.setattr(gitutils, "git_show", lambda rev, **kw: body)
+    monkeypatch.setattr(
+        "github2gerrit.gitutils.git_show", lambda rev, **kw: body
+    )
 
     # Without filter: expect only proper footer trailers collected.
-    trailers_all = gitutils.git_last_commit_trailers()
+    trailers_all = git_last_commit_trailers()
     # Body "Key:" lines should not be extracted as trailers
     assert "Key" not in trailers_all
     # 'Empty' should be ignored due to empty value
@@ -254,7 +284,7 @@ def test_git_last_commit_trailers_parsing_edge_cases(
     ]
 
     # With filter keys: only Change-Id should be returned.
-    trailers_change = gitutils.git_last_commit_trailers(keys=["Change-Id"])
+    trailers_change = git_last_commit_trailers(keys=["Change-Id"])
     assert list(trailers_change.keys()) == ["Change-Id"]
     assert trailers_change["Change-Id"] == [
         "Ideadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
@@ -262,6 +292,24 @@ def test_git_last_commit_trailers_parsing_edge_cases(
     ]
 
 
+def test_git_last_commit_trailers_returns_empty_on_git_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """A failing ``git show`` (e.g. fresh repo) yields an empty mapping."""
+    from github2gerrit.gitutils import GitError
+    from github2gerrit.gitutils import git_last_commit_trailers
+
+    def _raise_git_error(rev: str, **_kw: object) -> str:
+        raise GitError("git show HEAD failed")
+
+    monkeypatch.setattr("github2gerrit.gitutils.git_show", _raise_git_error)
+
+    # The implementation catches GitError and returns an empty dict, both
+    # without and with a key filter.
+    assert git_last_commit_trailers() == {}
+    assert git_last_commit_trailers(keys=["Change-Id"]) == {}
+
+
 def test_git_quiet_suppresses_failure_logging(
     caplog: pytest.LogCaptureFixture, monkeypatch: pytest.MonkeyPatch
 ) -> None: