github2gerrit 2.2.1__tar.gz → 2.3.0__tar.gz

{github2gerrit-2.2.1 → github2gerrit-2.3.0}/.pre-commit-config.yaml

@@ -64,7 +64,7 @@ repos:
         types: [yaml]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: e8f7d69b957a30acb2c875078d5fd012de24b64c  # frozen: v0.16.7
+    rev: 2eeb5678de71a00c0902cbda7105d328432f72cb  # frozen: v0.16.8
     hooks:
       - id: ruff
         files: ^(src|scripts|tests)/.+\.py$|^sitecustomize\.py$
@@ -72,6 +72,24 @@ repos:
       - id: ruff-format
         files: ^(src|scripts|tests)/.+\.py$|^sitecustomize\.py$
 
+  - repo: local
+    hooks:
+      - id: sync-mypy-pins
+        # Rewrites the mypy hook's exact pins below to the versions
+        # uv.lock records, so the two cannot drift. Ordered ahead of the
+        # mypy hook so the pins are corrected before mypy is reached,
+        # though pre-commit reads this file and builds hook environments
+        # before any hook runs: a rewrite fails this run, as any
+        # modifying hook does, and the corrected pins take effect on the
+        # rerun. Both files come from the same checkout, so the verdict
+        # is the same locally and in CI, and a Dependabot lockfile bump
+        # fails here on its own pull request rather than on main.
+        name: sync mypy hook pins with uv.lock
+        entry: python3 scripts/sync_mypy_pins.py
+        language: system
+        files: ^(\.pre-commit-config\.yaml|uv\.lock)$
+        pass_filenames: false
+
   - repo: https://github.com/pre-commit/mirrors-mypy
     rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee  # frozen: v2.3.1
     hooks:
@@ -100,10 +118,16 @@ repos:
         # nobody runs locally. That drift is not theoretical: CI once
         # resolved typer 0.27.2 against a lockfile holding 0.27.1, and the
         # two disagreed about which module typer.Exit lives in.
-        # Every version here must equal the one uv.lock records for that
-        # package, so update both together (after `uv lock --upgrade`, for
-        # instance). tests/test_precommit_mypy_pins.py compares the two
-        # files and fails if they diverge in either direction.
+        # The versions are not maintained by hand: the sync-mypy-pins hook
+        # above rewrites them from uv.lock, so after `uv lock --upgrade` a
+        # `prek run sync-mypy-pins --all-files` brings them into step
+        # (--all-files, because neither file is staged at that point and
+        # the hook would otherwise not be selected). The tests in
+        # tests/test_precommit_mypy_pins.py check the list is exact and
+        # complete against the imports; they deliberately do not compare
+        # versions to the lockfile, since a pull request is tested as
+        # merged into main and would otherwise fail for a dependency that
+        # moved there, not for anything on the branch.
         #
         # These pins do not freeze the whole resolved closure: pip still
         # picks transitive versions at build time, and listing every
@@ -119,8 +143,9 @@ repos:
         # runs, and nothing otherwise ties it to the locked one, so an
         # autoupdate of the mirror or a lockfile-only mypy upgrade would
         # leave the hook running a different checker in silence. With the
-        # pin present, the test compares it against uv.lock, and a mirror
-        # whose rev disagrees fails to install rather than quietly winning.
+        # pin present, the sync hook keeps it at the locked version, and a
+        # mirror whose rev disagrees fails to install rather than quietly
+        # winning.
         additional_dependencies:
           - mypy==2.3.1
           - click==8.5.0

{github2gerrit-2.2.1 → github2gerrit-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github2gerrit
-Version: 2.2.1
+Version: 2.3.0
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action
@@ -195,11 +195,14 @@ as dispatch inputs and forward them the same way.
 
 Pin `@main` to a release tag or commit SHA for production use.
 
-A bulk `workflow_dispatch` (`PR_NUMBER` of `0`) processes every open
-pull request in one run, which does not serialise against the
-per-pull-request runs that events start. Avoid triggering one while
-pull request activity is in flight; see
-[#422](https://github.com/lfreleng-actions/github2gerrit-action/issues/422).
+A bulk `workflow_dispatch` (`PR_NUMBER` of `0`) fans out: the reusable
+workflow lists the open pull requests and runs one job per pull request,
+four at a time, each in that pull request's own concurrency group, so a sweep
+queues behind the runs that events start for the same pull request
+instead of racing them. One further job runs the repository-wide cleanup once.
+A sweep covers at most 255 open pull requests, one fewer than GitHub's 256-job
+matrix limit; beyond that it fails, and you dispatch individual `PR_NUMBER`
+values instead. A bulk dispatch sets no workflow outputs.
 
 ### Option B: composite action
 
@@ -256,6 +259,12 @@ jobs:
           AUTOMATION_ONLY: false
 ```
 
+A composite action cannot start jobs, so here a bulk `workflow_dispatch`
+(`PR_NUMBER` of `0`) still processes every open pull request in one job. That
+job does not serialise against the per-pull-request runs events start, so
+avoid triggering one while pull request activity is in flight, or use the
+reusable workflow, which fans the sweep out.
+
 ### Option C: command-line tool
 
 The underlying Python CLI supports local and ad-hoc use (for example,
@@ -277,7 +286,7 @@ uvx github2gerrit https://github.com/onap/portal-ng-bff/pull/33
 | `GERRIT_SSH_USER_G2G`          | No       | `""`             | Gerrit SSH username; derived when not supplied                 |
 | `GERRIT_SSH_USER_G2G_EMAIL`    | No       | `""`             | Gerrit user email address; derived when not supplied           |
 | `GERRIT_SERVER`                | No       | `""`             | Gerrit server hostname; overrides `.gitreview` when set        |
-| `GERRIT_SERVER_PORT`           | No       | `"29418"`        | Gerrit SSH port                                                |
+| `GERRIT_SERVER_PORT`           | No       | `""`             | Gerrit SSH port; `.gitreview`'s when unset, else 29418         |
 | `GERRIT_PROJECT`               | No       | `""`             | Gerrit project name; overrides `.gitreview` when set           |
 | `GERRIT_HTTP_BASE_PATH`        | No       | `""`             | HTTP base path for Gerrit REST API (e.g. `/r`)                 |
 | `GERRIT_HTTP_USER`             | No       | `""`             | Gerrit HTTP user for REST queries                              |
@@ -377,7 +386,7 @@ Input defaults match the composite action defaults.
 | `GERRIT_SSH_USER_G2G`          | string  | `""`             | Gerrit SSH username                              |
 | `GERRIT_SSH_USER_G2G_EMAIL`    | string  | `""`             | Gerrit user email address                        |
 | `GERRIT_SERVER`                | string  | `""`             | Gerrit server hostname                           |
-| `GERRIT_SERVER_PORT`           | string  | `"29418"`        | Gerrit SSH port                                  |
+| `GERRIT_SERVER_PORT`           | string  | `""`             | Gerrit SSH port; `.gitreview`'s when unset       |
 | `GERRIT_PROJECT`               | string  | `""`             | Gerrit project name                              |
 | `GERRIT_HTTP_BASE_PATH`        | string  | `""`             | HTTP base path for Gerrit REST                   |
 | `GERRIT_HTTP_USER`             | string  | `""`             | Gerrit HTTP user for REST queries                |

{github2gerrit-2.2.1 → github2gerrit-2.3.0}/README.md

@@ -148,11 +148,14 @@ as dispatch inputs and forward them the same way.
 
 Pin `@main` to a release tag or commit SHA for production use.
 
-A bulk `workflow_dispatch` (`PR_NUMBER` of `0`) processes every open
-pull request in one run, which does not serialise against the
-per-pull-request runs that events start. Avoid triggering one while
-pull request activity is in flight; see
-[#422](https://github.com/lfreleng-actions/github2gerrit-action/issues/422).
+A bulk `workflow_dispatch` (`PR_NUMBER` of `0`) fans out: the reusable
+workflow lists the open pull requests and runs one job per pull request,
+four at a time, each in that pull request's own concurrency group, so a sweep
+queues behind the runs that events start for the same pull request
+instead of racing them. One further job runs the repository-wide cleanup once.
+A sweep covers at most 255 open pull requests, one fewer than GitHub's 256-job
+matrix limit; beyond that it fails, and you dispatch individual `PR_NUMBER`
+values instead. A bulk dispatch sets no workflow outputs.
 
 ### Option B: composite action
 
@@ -209,6 +212,12 @@ jobs:
           AUTOMATION_ONLY: false
 ```
 
+A composite action cannot start jobs, so here a bulk `workflow_dispatch`
+(`PR_NUMBER` of `0`) still processes every open pull request in one job. That
+job does not serialise against the per-pull-request runs events start, so
+avoid triggering one while pull request activity is in flight, or use the
+reusable workflow, which fans the sweep out.
+
 ### Option C: command-line tool
 
 The underlying Python CLI supports local and ad-hoc use (for example,
@@ -230,7 +239,7 @@ uvx github2gerrit https://github.com/onap/portal-ng-bff/pull/33
 | `GERRIT_SSH_USER_G2G`          | No       | `""`             | Gerrit SSH username; derived when not supplied                 |
 | `GERRIT_SSH_USER_G2G_EMAIL`    | No       | `""`             | Gerrit user email address; derived when not supplied           |
 | `GERRIT_SERVER`                | No       | `""`             | Gerrit server hostname; overrides `.gitreview` when set        |
-| `GERRIT_SERVER_PORT`           | No       | `"29418"`        | Gerrit SSH port                                                |
+| `GERRIT_SERVER_PORT`           | No       | `""`             | Gerrit SSH port; `.gitreview`'s when unset, else 29418         |
 | `GERRIT_PROJECT`               | No       | `""`             | Gerrit project name; overrides `.gitreview` when set           |
 | `GERRIT_HTTP_BASE_PATH`        | No       | `""`             | HTTP base path for Gerrit REST API (e.g. `/r`)                 |
 | `GERRIT_HTTP_USER`             | No       | `""`             | Gerrit HTTP user for REST queries                              |
@@ -330,7 +339,7 @@ Input defaults match the composite action defaults.
 | `GERRIT_SSH_USER_G2G`          | string  | `""`             | Gerrit SSH username                              |
 | `GERRIT_SSH_USER_G2G_EMAIL`    | string  | `""`             | Gerrit user email address                        |
 | `GERRIT_SERVER`                | string  | `""`             | Gerrit server hostname                           |
-| `GERRIT_SERVER_PORT`           | string  | `"29418"`        | Gerrit SSH port                                  |
+| `GERRIT_SERVER_PORT`           | string  | `""`             | Gerrit SSH port; `.gitreview`'s when unset       |
 | `GERRIT_PROJECT`               | string  | `""`             | Gerrit project name                              |
 | `GERRIT_HTTP_BASE_PATH`        | string  | `""`             | HTTP base path for Gerrit REST                   |
 | `GERRIT_HTTP_USER`             | string  | `""`             | Gerrit HTTP user for REST queries                |

{github2gerrit-2.2.1 → github2gerrit-2.3.0}/action.yaml

@@ -133,9 +133,9 @@ inputs:
     required: false
     default: ""
   GERRIT_SERVER_PORT:
-    description: "Gerrit server SSH TCP port"
+    description: "Gerrit server SSH TCP port; .gitreview's when unset, else 29418"
     required: false
-    default: "29418"
+    default: ""
   GERRIT_PROJECT:
     description: "Gerrit project; optional if .gitreview exists"
     required: false
@@ -266,7 +266,7 @@ runs:
     - name: "Setup uv"
       if: steps.disabled-check.outputs.disabled != 'true'
       # yamllint disable-line rule:line-length
-      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
       with:
         enable-cache: false
 

{github2gerrit-2.2.1 → github2gerrit-2.3.0}/docs/cli.md

@@ -101,7 +101,7 @@ set by GitHub Actions) and undergo proper boolean parsing.
 | Flag(s)                              | Env var                     | Default | Description                                                  |
 | ------------------------------------ | --------------------------- | ------- | ------------------------------------------------------------ |
 | `--gerrit-server TEXT`               | `GERRIT_SERVER`             | `""`    | Gerrit server hostname (optional; overrides `.gitreview`)    |
-| `--gerrit-server-port INTEGER`       | `GERRIT_SERVER_PORT`        | `29418` | Gerrit SSH port                                              |
+| `--gerrit-server-port INTEGER`       | `GERRIT_SERVER_PORT`        | unset   | Gerrit SSH port; `.gitreview`'s when unset, else 29418       |
 | `--gerrit-project TEXT`              | `GERRIT_PROJECT`            | `""`    | Gerrit project (optional; overrides `.gitreview` when set)   |
 | `--gerrit-ssh-user-g2g TEXT`         | `GERRIT_SSH_USER_G2G`       | `""`    | Gerrit SSH username (e.g., automation bot account)           |
 | `--gerrit-ssh-user-g2g-email TEXT`   | `GERRIT_SSH_USER_G2G_EMAIL` | `""`    | Email address for the Gerrit SSH user                        |
@@ -206,6 +206,7 @@ forwarded setting treats blank as unset and keeps its documented default.
 | `CLEANUP_GERRIT`                 | `true`                                      | Abandon Gerrit changes for closed GitHub PRs                                      |
 | `PR_NUMBER`                      | unset                                       | Pull request number to process in CI/CD mode (`0` means bulk mode)                |
 | `SYNC_ALL_OPEN_PRS`              | `false`                                     | Process all open PRs in the repository (bulk mode)                                |
+| `G2G_SWEEP_LEG`                  | `false`                                     | Set by the reusable workflow on each job of a fanned-out bulk sweep               |
 | `GERRIT_HTTP_USER`               | unset                                       | Username for the Gerrit REST API (when required)                                  |
 | `GERRIT_HTTP_PASSWORD`           | unset                                       | HTTP password/token for the Gerrit REST API                                       |
 | `GERRIT_HTTP_BASE_PATH`          | unset                                       | Gerrit REST base path for non-standard deployments (e.g., `/r`)                   |

{github2gerrit-2.2.1 → github2gerrit-2.3.0}/docs/features.md

@@ -403,8 +403,12 @@ signal never earns a fork unwarranted trust.
 
 Resolution order for a fork pull request:
 
-1. Explicit `GERRIT_SERVER` / `GERRIT_SERVER_PORT` / `GERRIT_PROJECT` inputs,
-   each for its own field — an operator configured them for this run
+1. Explicit `GERRIT_SERVER` / `GERRIT_SERVER_PORT` / `GERRIT_PROJECT`
+   inputs, each for its own field — an operator configured them for this
+   run. The port input has no default: the action and the CLI pass none
+   when the caller gave none, so a set port is distinguishable from an
+   unset one. 29418 applies only when neither an input nor `.gitreview`
+   names a port.
 2. `.gitreview` from the base repository at the pull request's base branch,
    via the GitHub API or `raw.githubusercontent.com`
 3. Per-organization configuration file
@@ -530,8 +534,10 @@ nothing to unblock.
 A zero-touch variant — a periodic sweep that notices the approval without
 anyone commenting — remains open as
 [#421](https://github.com/lfreleng-actions/github2gerrit-action/issues/421).
-A repository-wide job needs cross-run serialisation that GitHub's per-job
-concurrency groups cannot express, so this mechanism deliberately omits it.
+It can build on two pieces that bulk dispatch now uses: a job per pull
+request, so each transfer takes that pull request's own lock, and the
+transfer record described below, so an already-transferred head gets no
+second visit.
 
 `pull_request_review` should be **removed** from any workflow that still
 carries it. It can no longer transfer anything: on a fork pull request it runs
@@ -588,7 +594,26 @@ covers an earlier commit, the comment says so, so a maintainer who did approve
 is not told that nobody has.
 
 Once approval arrives, the tool edits that comment again to record it, so a
-transferred pull request does not keep displaying a stale block.
+transferred pull request does not keep displaying a stale block. After the
+transfer succeeds it edits the comment once more to say so, recording the
+transferred commit in a hidden marker.
+
+A bulk sweep (`PR_NUMBER` of `0`) reads that marker and passes over a pull
+request whose current head it names, rather than submitting the same commit
+again. Through the reusable workflow each pull request in a sweep runs as a
+job of its own, and the marker behaves the same there. Anything less means the sweep processes the pull request as before:
+no comment, no marker, a comment it cannot read, or a head that has moved
+since. Only a run that pushes records anything: a dry run does not, nor does
+one that finds the pull request's changes already merged or abandoned and
+acts on GitHub instead. Neither does a pull request approved before its
+first run, which never had a comment to edit. Only sweeps consult
+the marker. A dispatch naming the pull request, a push and a
+`@github2gerrit check` comment transfer whatever it says.
+
+The marker proves nothing about who wrote it, and the tool does not assume it
+did. Believing a pasted copy is harmless: skipping transfers nothing, it
+delays only the sweep, and the tool reads the marker only on pull requests
+the gate applies to.
 
 #### If the head moves mid-run