github2gerrit 1.4.3__tar.gz → 2.0.0__tar.gz

github2gerrit-2.0.0/.aislop/config.yml

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+
+# aislop quality gate configuration.
+#
+# The pre-commit hook and CI both run `aislop ci` against this config.
+# Overly long functions and deeply nested code are refactored in the
+# source tree into focused helpers rather than suppressed.
+#
+# maxFileLoc is raised from the 400 default to 900: this codebase is
+# organised into cohesive single-responsibility modules (SSH discovery
+# and setup, gerrit REST/query, reconciliation, config, etc.) that
+# naturally sit in the 450-900 line range. 900 still flags egregiously
+# oversized modules.
+#
+# Three orchestration god-files remain above this threshold: core.py,
+# cli.py and gerrit_pr_closer.py. Their overly long functions and deep
+# nesting are decomposed here, but a full module/class split is a large,
+# self-contained refactor tracked as dedicated follow-up work; each
+# carries an in-file `aislop-ignore-file complexity/file-too-large` with
+# that rationale so the gate stays green in the meantime.
+version: 1
+
+quality:
+  maxFileLoc: 900
+
+ci:
+  failBelow: 100

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/.pre-commit-config.yaml

@@ -3,7 +3,12 @@
 # SPDX-FileCopyrightText: 2025 The Linux Foundation
 
 ci:
-  skip: [pytest, gha-workflow-linter]
+  autofix_prs: false
+  # pre-commit.ci sandbox prevents network calls; aislop runs engines
+  # that can call the network at scan time, so it cannot run there
+  # either. gha-workflow-linter validates action calls over the
+  # network; pytest runs the full suite.
+  skip: [pytest, gha-workflow-linter, aislop]
   autofix_commit_msg: |
     Chore: pre-commit autofixes
 
@@ -59,7 +64,7 @@ repos:
         types: [yaml]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 01a675ea018f2fb714478a5ffb83fcea8374bb06  # frozen: v0.15.21
+    rev: 65dbdb59d2f2d9c3bdc343c566821ad3319ddaa3  # frozen: v0.16.3
     hooks:
       - id: ruff
         files: ^(src|scripts|tests)/.+\.py$
@@ -68,7 +73,7 @@ repos:
         files: ^(src|scripts|tests)/.+\.py$
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 41e691678310dfd3833f7ab4e180ddb014310356  # frozen: v2.3.0
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee  # frozen: v2.3.1
     hooks:
       - id: mypy
         files: ^src/.+\.py$
@@ -89,7 +94,7 @@ repos:
       - id: shellcheck
 
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: a4d5d37e66ebcd6b3705204a1d6dbb56dea66338  # frozen: v0.49.0
+    rev: 5b5dddc4fb0f83c3ea1fc5616fa63e115dce83e0  # frozen: v0.49.1
     hooks:
       - id: markdownlint
         args: ["--fix", "--config", ".markdownlint.yaml"]
@@ -109,24 +114,40 @@ repos:
 
   # Check for misspellings in documentation files
   - repo: https://github.com/codespell-project/codespell
-    rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a  # frozen: v2.4.2
+    rev: 57b21406f092110c18776e39b0bda50d37c945c8  # frozen: v2.4.3
     hooks:
       - id: codespell
 
   # Requires a mirror, primary repo lacks .pre-commit-hooks.yaml
   - repo: https://github.com/DetachHead/basedpyright-prek-mirror
-    rev: d55eabd2531b4f4a4c49c30fba627ce3a636ab79  # frozen: 1.39.9
+    rev: 3c94d276aa3005fa1f5a977946c9dc106135c083  # frozen: 1.39.10
     hooks:
       - id: basedpyright
         files: ^src/.+\.py$
 
   - repo: https://github.com/lfreleng-actions/gha-workflow-linter
-    rev: 4c3079dcb6e9e3c295f961ce5bd5b8585db698ca  # frozen: v1.2.2
+    rev: 7f11ad46be1cd2b3d778428d40fcb09309bb3be5  # frozen: v1.4.1
     hooks:
       - id: gha-workflow-linter
 
+  # Catch AI slop developer-side before it reaches a pull request.
+  # Runs the full-repository quality gate, scored against
+  # .aislop/config.yml. A local hook installing the published npm
+  # package: the scanaislop/aislop git repository does not ship the
+  # built dist/, so its bundled pre-commit hook cannot install. Bump
+  # the pinned version here manually when new aislop releases ship.
+  - repo: local
+    hooks:
+      - id: aislop
+        name: aislop
+        entry: aislop ci --human
+        language: node
+        additional_dependencies: ["aislop@0.14.1"]
+        pass_filenames: false
+        always_run: true
+
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 1a4bb160cab6417b3045e1b37b6b72449243e658  # frozen: 0.37.4
+    rev: c4654a7e007c9619a5eb63c39a456572a0fa1851  # frozen: 0.38.0
     hooks:
       - id: check-github-actions
       - id: check-github-workflows

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: github2gerrit
-Version: 1.4.3
+Version: 2.0.0
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action
@@ -235,7 +235,7 @@ uvx github2gerrit https://github.com/onap/portal-ng-bff/pull/33
 | `GERRIT_HTTP_PASSWORD`      | No       | `""`             | Gerrit HTTP password/token for REST queries                    |
 | `ORGANIZATION`              | No       | repository owner | GitHub organization/owner used for credential derivation       |
 | `PR_NUMBER`                 | No       | `"0"`            | PR number to process; `0` processes all open PRs (dispatch)    |
-| `FETCH_DEPTH`               | No       | `"10"`           | Fetch depth for checkout                                       |
+| `FETCH_DEPTH`               | No       | `"10"`           | Git history depth: PR fetch, push checkout, reconciliation     |
 | `SUBMIT_SINGLE_COMMITS`     | No       | `"false"`        | Submit one commit at a time to Gerrit                          |
 | `USE_PR_AS_COMMIT`          | No       | `"false"`        | Use PR title and body as the commit message                    |
 | `PRESERVE_GITHUB_PRS`       | No       | `"true"`         | Do not close GitHub PRs after pushing to Gerrit                |
@@ -312,7 +312,7 @@ Input defaults match the composite action defaults.
 | `G2G_USE_SSH_AGENT`         | boolean | `true`           | Use SSH agent instead of file-based keys         |
 | `ORGANIZATION`              | string  | repository owner | GitHub organization/owner                        |
 | `PR_NUMBER`                 | string  | `"0"`            | PR to process on dispatch; `0` processes all     |
-| `FETCH_DEPTH`               | string  | `"10"`           | Fetch depth for checkout                         |
+| `FETCH_DEPTH`               | string  | `"10"`           | Git depth: PR, push, reconciliation              |
 | `SUBMIT_SINGLE_COMMITS`     | boolean | `false`          | Submit one commit at a time                      |
 | `USE_PR_AS_COMMIT`          | boolean | `false`          | Use PR title and body as the commit message      |
 | `PRESERVE_GITHUB_PRS`       | boolean | `true`           | Do not close GitHub PRs after pushing            |

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/README.md

@@ -189,7 +189,7 @@ uvx github2gerrit https://github.com/onap/portal-ng-bff/pull/33
 | `GERRIT_HTTP_PASSWORD`      | No       | `""`             | Gerrit HTTP password/token for REST queries                    |
 | `ORGANIZATION`              | No       | repository owner | GitHub organization/owner used for credential derivation       |
 | `PR_NUMBER`                 | No       | `"0"`            | PR number to process; `0` processes all open PRs (dispatch)    |
-| `FETCH_DEPTH`               | No       | `"10"`           | Fetch depth for checkout                                       |
+| `FETCH_DEPTH`               | No       | `"10"`           | Git history depth: PR fetch, push checkout, reconciliation     |
 | `SUBMIT_SINGLE_COMMITS`     | No       | `"false"`        | Submit one commit at a time to Gerrit                          |
 | `USE_PR_AS_COMMIT`          | No       | `"false"`        | Use PR title and body as the commit message                    |
 | `PRESERVE_GITHUB_PRS`       | No       | `"true"`         | Do not close GitHub PRs after pushing to Gerrit                |
@@ -266,7 +266,7 @@ Input defaults match the composite action defaults.
 | `G2G_USE_SSH_AGENT`         | boolean | `true`           | Use SSH agent instead of file-based keys         |
 | `ORGANIZATION`              | string  | repository owner | GitHub organization/owner                        |
 | `PR_NUMBER`                 | string  | `"0"`            | PR to process on dispatch; `0` processes all     |
-| `FETCH_DEPTH`               | string  | `"10"`           | Fetch depth for checkout                         |
+| `FETCH_DEPTH`               | string  | `"10"`           | Git depth: PR, push, reconciliation              |
 | `SUBMIT_SINGLE_COMMITS`     | boolean | `false`          | Submit one commit at a time                      |
 | `USE_PR_AS_COMMIT`          | boolean | `false`          | Use PR title and body as the commit message      |
 | `PRESERVE_GITHUB_PRS`       | boolean | `true`           | Do not close GitHub PRs after pushing            |

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/action.yaml

@@ -19,18 +19,13 @@ inputs:
     required: false
     default: "false"
   FETCH_DEPTH:
-    description: "Fetch depth for checkout"
-    required: false
-    default: "10"
-  SKIP_CHECKOUT:
     description: >-
-      Skip the internal repository checkout. Set when the caller has
-      already checked out the target repository at the desired ref
-      (e.g. the bundled reusable workflow, which also checks out this
-      action into the workspace and must not have it deleted by a
-      nested checkout)
+      Depth of git history fetched. Applied to the tool's own fetch of
+      refs/pull/<N>/head, to the push-event checkout, and as the git log
+      window used to find merged commits during PR reconciliation, so
+      raising it widens how far back a merged change is matched
     required: false
-    default: "false"
+    default: "10"
   PR_NUMBER:
     description: "Pull request number to process, use 0 to process all open"
     required: false
@@ -213,31 +208,44 @@ runs:
           echo "disabled=false" >> "$GITHUB_OUTPUT"
         fi
 
-    - name: "Checkout repository"
-      # yamllint disable-line rule:line-length
-      if: steps.disabled-check.outputs.disabled != 'true' && inputs.SKIP_CHECKOUT != 'true'
+    - name: "Checkout repository (push events)"
+      # Push runs reconcile merged Gerrit changes back to their GitHub
+      # PRs, which reads commit trailers with a local `git show` in the
+      # working directory. Pull request runs need no checkout: the tool
+      # fetches refs/pull/<N>/head into its own temporary directory, and
+      # checking a fork head out here would both fail under
+      # pull_request_target and expose a fork-controlled .gitreview.
+      if: >-
+        steps.disabled-check.outputs.disabled != 'true'
+        && github.event_name == 'push'
       # yamllint disable-line rule:line-length
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: ${{ inputs.FETCH_DEPTH }}
-        # Ensure we are on the PR's head SHA when triggered by PR events
-        ref: ${{ github.event.pull_request.head.sha || github.sha }}
-        # The action authenticates to Gerrit over SSH and to GitHub via an
-        # explicit GITHUB_TOKEN env var, so the checkout token does not need
-        # to be persisted into the local git config.
+        # The action authenticates to Gerrit over SSH and to GitHub via
+        # an explicit GITHUB_TOKEN env var, so the checkout token does
+        # not need to be persisted into the local git config.
         persist-credentials: false
+        # Callers may place files in the workspace that this action
+        # depends on. The bundled reusable workflow checks the action
+        # itself out to .g2g-action and then runs it from there, so a
+        # cleaning checkout would delete the action mid-run. That
+        # workflow also seeds the workspace root with the target
+        # repository first, because actions/checkout wipes a directory
+        # that is not already a git repository whatever `clean` says.
+        clean: false
 
     - name: "Setup Python"
       if: steps.disabled-check.outputs.disabled != 'true'
       # yamllint disable-line rule:line-length
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version-file: '${{ github.action_path }}/pyproject.toml'
 
     - name: "Setup uv"
       if: steps.disabled-check.outputs.disabled != 'true'
       # yamllint disable-line rule:line-length
-      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
       with:
         enable-cache: false
 
@@ -396,6 +404,11 @@ runs:
         GITHUB_SHA: ${{ github.sha }}
         GITHUB_BASE_REF: ${{ github.base_ref }}
         GITHUB_HEAD_REF: ${{ github.head_ref }}
+        # Full owner/repo of the PR head. Differs from GITHUB_REPOSITORY
+        # for fork pull requests, whose tree must not influence Gerrit
+        # target resolution.
+        # yamllint disable-line rule:line-length
+        PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
         GITHUB_ACTOR: ${{ github.actor }}
         SYNC_ALL_OPEN_PRS: ${{ steps.extract.outputs.sync_all }}
         PR_NUMBER: ${{ steps.extract.outputs.pr_number }}

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/docs/cli.md

@@ -84,7 +84,7 @@ set by GitHub Actions) and undergo proper boolean parsing.
 | `--preserve-github-prs/--no-preserve-github-prs` | `PRESERVE_GITHUB_PRS`   | `true`  | Do not close GitHub PRs after pushing to Gerrit                                |
 | `--close-merged-prs/--no-close-merged-prs`       | `CLOSE_MERGED_PRS`      | `true`  | Close GitHub PRs when corresponding Gerrit changes merge                       |
 | `--force`                                        | `FORCE`                 | `false` | Force PR closure regardless of Gerrit change status (abandoned, etc.)          |
-| `--fetch-depth INTEGER`                          | `FETCH_DEPTH`           | `10`    | Fetch depth for checkout                                                       |
+| `--fetch-depth INTEGER`                          | `FETCH_DEPTH`           | `10`    | Git history depth: PR fetch, push checkout, reconciliation window              |
 | `--reviewers-email TEXT`                         | `REVIEWERS_EMAIL`       | `""`    | Email address(es) of reviewers (comma-separated)                               |
 | `--organization TEXT`                            | `ORGANIZATION`          | unset   | Organization (defaults to `GITHUB_REPOSITORY_OWNER` when unset)                |
 | `--github-actor TEXT`                            | `GITHUB_ACTOR`          | `""`    | GitHub actor (username) who triggered the workflow                             |

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/docs/features.md

@@ -16,6 +16,7 @@ action in detail. For a quick start and the full inputs table, see the
 - [Closing Merged PRs](#closing-merged-prs)
 - [Automatic Cleanup](#automatic-cleanup)
 - [Restricting PRs to Automation Tools](#restricting-prs-to-automation-tools)
+- [Fork Pull Requests](#fork-pull-requests)
 - [Duplicate Detection](#duplicate-detection)
 - [Commit Message Normalization](#commit-message-normalization)
 - [Change-ID Reconciliation](#change-id-reconciliation)
@@ -284,6 +285,74 @@ Set `AUTOMATION_ONLY: "false"` to accept PRs from all users:
     GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
 ```
 
+## Fork Pull Requests
+
+A pull request raised from a fork carries a tree that someone without write
+access to the base repository wrote. The tool treats that tree as untrusted
+input.
+
+### No runner checkout for pull requests
+
+The action does not check the target repository out into the runner workspace
+for pull request events. It fetches `refs/pull/<N>/head` into a private
+temporary directory instead. That ref lives on the base repository and resolves
+fork pull request heads, so the tool never contacts the fork directly.
+
+This sidesteps the `pull_request_target` checkout restriction that
+`actions/checkout` enforces, and keeps fork content out of the working
+directory, where the tool might otherwise read it as configuration.
+
+Push events still check the repository out. Those runs reconcile merged Gerrit
+changes back to their GitHub pull requests, which reads commit trailers from
+the working directory. A push carries no fork content, so the checkout is safe
+there.
+
+### Gerrit target resolution
+
+For fork pull requests the tool ignores any `.gitreview` in the pull request
+tree and resolves against the **base repository** instead. A fork could
+otherwise redirect the push to a different Gerrit project simply by editing
+`.gitreview`.
+
+The tool applies the same treatment when it cannot establish where the pull
+request head lives. Specific-PR `workflow_dispatch` runs and direct URL
+invocations carry no pull request payload, and GitHub reports a null head
+repository for a deleted fork. The tool resolves provenance through the API
+where it can, and treats whatever remains unresolved as untrusted, so a missing
+signal never earns a fork unwarranted trust.
+
+Resolution order for a fork pull request:
+
+1. `.gitreview` from the base repository at the pull request's base branch,
+   via the GitHub API or `raw.githubusercontent.com`
+2. Explicit `GERRIT_SERVER` / `GERRIT_SERVER_PORT` / `GERRIT_PROJECT` inputs
+3. Per-organization configuration file
+4. Derivation from the organization name (`gerrit.[org].org`)
+
+The lookup stops at the base branch. It does not fall back to the repository
+default branch, and it does not read `.gitreview` through the API without an
+authoritative base ref, because either would answer for a branch the pull
+request does not target — and `.gitreview` outranks the explicit inputs.
+
+The base repository's copy carries the same authority and lies outside an
+attacker's reach, so this costs no accuracy. Skipping straight to derivation
+would instead guess the Gerrit project name, and that guess goes wrong for
+repositories whose name contains a hyphen that does not mark a path separator.
+
+For the same reason, the tool drops branch names that originate in the fork
+(`GITHUB_HEAD_REF` and the pull request head ref) from base-repository
+lookups. Duplicate detection, which resolves `.gitreview` independently and
+earlier, applies the same rule.
+
+Same-repository pull requests keep their previous behaviour and still read
+`.gitreview` from the pull request tree.
+
+### Approval gating
+
+The tool does not yet require a maintainer approval before it transfers a fork
+pull request to Gerrit. Until it does, use `AUTOMATION_ONLY` (see above) to
+control which pull requests the tool accepts.
+
 ## Duplicate Detection
 
 Duplicate detection uses a scoring-based approach. The detector compares the

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/pyproject.toml

@@ -139,6 +139,11 @@ ignore = [
 "sitecustomize.py" = ["S110", "SIM103", "SIM105", "PLW2901"]
 "src/github2gerrit/duplicate_detection.py" = ["S310"]
 "src/github2gerrit/gerrit_rest.py" = ["S310", "TRY301"]
+# S310 audits urlopen for non-HTTP schemes such as file:. This module
+# builds the URL from a literal https://raw.githubusercontent.com/ prefix
+# and passes it through _validate_raw_url, which requires scheme https and
+# host raw.githubusercontent.com before the fetch runs.
+"src/github2gerrit/gitreview.py" = ["S310"]
 
 [tool.ruff.lint.isort]
 known-first-party = ["github2gerrit"]

{github2gerrit-1.4.3 → github2gerrit-2.0.0}/sitecustomize.py

@@ -55,6 +55,7 @@ def _debug_enabled() -> bool:
 def _dbg(msg: str) -> None:
     if _debug_enabled():
         try:
+            # aislop-ignore-next-line python-print-debug -- gated debug logger
             print(f"[sitecustomize] {msg}", file=sys.stderr)
         except Exception:
             # Debug logging must never disrupt interpreter startup; if
@@ -90,17 +91,17 @@ def _clean_stale_coverage_files(
     for base in bases:
         try:
             base = base.resolve()
-        except Exception:
+        except Exception as exc:
             # Use as-is if resolution fails
-            pass
+            _dbg(f"Failed to resolve base {base}: {exc}")
         for candidate in _iter_cov_candidates(base):
             try:
                 # Skip the protected target if present in candidates
                 if protected and str(candidate.resolve()) == protected:
                     continue
-            except Exception:
+            except Exception as exc:
                 # If resolve fails, fall through and try to remove
-                pass
+                _dbg(f"Failed to resolve candidate {candidate}: {exc}")
             _remove_path(candidate)
 
 
@@ -110,9 +111,9 @@ def _ensure_unique_coverage_file() -> Path:
     if existing:
         try:
             return Path(existing)
-        except Exception:
+        except Exception as exc:
             # Fall through to create a sane default
-            pass
+            _dbg(f"Invalid COVERAGE_FILE {existing!r}: {exc}")
     unique = (
         Path(tempfile.gettempdir())
         / f".coverage.pytest.{os.getpid()}.{uuid.uuid4().hex}"