github2gerrit 2.3.0__tar.gz → 2.4.0__tar.gz

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github2gerrit
-Version: 2.3.0
+Version: 2.4.0
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action
@@ -145,6 +145,9 @@ on:
   # pull_request_review runs on fork PRs.
   issue_comment:
     types: [created]
+  # Optional: transfer approved fork PRs without anyone commenting.
+  # schedule:
+  #   - cron: "17 * * * *"
   push:
     branches: [main, master]
   workflow_dispatch:
@@ -189,6 +192,12 @@ which closes a human-authored pull request before the approval gate
 sees it, so leaving it set would make the fork path unreachable. Drop
 both if the repository only ever receives automation PRs.
 
+The optional `schedule` trigger does the comment's job unattended: each
+run transfers fork pull requests whose current commit a maintainer has
+approved, one job per pull request, and leaves every other pull request
+alone. See
+[scheduled sweeps](docs/features.md#which-triggers-can-lift-the-gate).
+
 Repositories using the Gerrit-side dispatch integration should also
 declare `GERRIT_CHANGE_URL`, `GERRIT_EVENT_TYPE`, and `GERRIT_BRANCH`
 as dispatch inputs and forward them the same way.
@@ -263,7 +272,8 @@ A composite action cannot start jobs, so here a bulk `workflow_dispatch`
 (`PR_NUMBER` of `0`) still processes every open pull request in one job. That
 job does not serialise against the per-pull-request runs events start, so
 avoid triggering one while pull request activity is in flight, or use the
-reusable workflow, which fans the sweep out.
+reusable workflow, which fans the sweep out. For the same reason a `schedule`
+trigger works only through the reusable workflow.
 
 ### Option C: command-line tool
 

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/README.md

@@ -98,6 +98,9 @@ on:
   # pull_request_review runs on fork PRs.
   issue_comment:
     types: [created]
+  # Optional: transfer approved fork PRs without anyone commenting.
+  # schedule:
+  #   - cron: "17 * * * *"
   push:
     branches: [main, master]
   workflow_dispatch:
@@ -142,6 +145,12 @@ which closes a human-authored pull request before the approval gate
 sees it, so leaving it set would make the fork path unreachable. Drop
 both if the repository only ever receives automation PRs.
 
+The optional `schedule` trigger does the comment's job unattended: each
+run transfers fork pull requests whose current commit a maintainer has
+approved, one job per pull request, and leaves every other pull request
+alone. See
+[scheduled sweeps](docs/features.md#which-triggers-can-lift-the-gate).
+
 Repositories using the Gerrit-side dispatch integration should also
 declare `GERRIT_CHANGE_URL`, `GERRIT_EVENT_TYPE`, and `GERRIT_BRANCH`
 as dispatch inputs and forward them the same way.
@@ -216,7 +225,8 @@ A composite action cannot start jobs, so here a bulk `workflow_dispatch`
 (`PR_NUMBER` of `0`) still processes every open pull request in one job. That
 job does not serialise against the per-pull-request runs events start, so
 avoid triggering one while pull request activity is in flight, or use the
-reusable workflow, which fans the sweep out.
+reusable workflow, which fans the sweep out. For the same reason a `schedule`
+trigger works only through the reusable workflow.
 
 ### Option C: command-line tool
 

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/action.yaml

@@ -293,17 +293,22 @@ runs:
         fi
 
     - name: "Validate PR_NUMBER usage"
+      # A scheduled sweep names its pull request the same way a dispatch
+      # does: the reusable workflow fans the schedule out to one job per
+      # pull request, each passing that pull request's number.
       # yamllint disable-line rule:line-length
-      if: ${{ steps.disabled-check.outputs.disabled != 'true' && github.event_name != 'workflow_dispatch' && inputs.PR_NUMBER != '' && inputs.PR_NUMBER != '0' }}
+      if: ${{ steps.disabled-check.outputs.disabled != 'true' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule' && inputs.PR_NUMBER != '' && inputs.PR_NUMBER != '0' }}
       shell: bash
       run: |
         # Validate PR_NUMBER usage
         set -euo pipefail
-        echo "Error: PR_NUMBER only valid during workflow_dispatch events."
+        echo "Error: PR_NUMBER only valid during workflow_dispatch events," \
+          "or on schedule for one job of a scheduled sweep."
         exit 2
 
     - name: "Normalize PR_NUMBER"
-      if: ${{ steps.disabled-check.outputs.disabled != 'true' && github.event_name == 'workflow_dispatch' }}
+      # yamllint disable-line rule:line-length
+      if: ${{ steps.disabled-check.outputs.disabled != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
       id: normalize
       shell: bash
       env:
@@ -347,7 +352,18 @@ runs:
         fi
 
         # Honor PR_NUMBER or sync-all from workflow_dispatch normalization
-        if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+        if [[ "${GITHUB_EVENT_NAME}" == "schedule" ]]; then
+          # One job of a scheduled sweep, which names its pull request.
+          # A schedule sweeping every pull request in one job would race
+          # the runs events start for them (#421), so it is refused.
+          if [[ -n "${DISPATCH_SYNC_ALL:-}" || -z "${DISPATCH_PR_NUMBER:-}" ]]; then
+            echo "Error: a scheduled run needs PR_NUMBER naming one pull request."
+            echo "The reusable workflow fans a schedule out to one job per pull"
+            echo "request; a composite action cannot start jobs of its own."
+            exit 2
+          fi
+          echo "pr_number=${DISPATCH_PR_NUMBER}" >> "$GITHUB_OUTPUT"
+        elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
           if [[ -n "${DISPATCH_SYNC_ALL:-}" ]]; then
             echo "Processing all open pull requests via workflow_dispatch."
             echo "sync_all=true" >> "$GITHUB_OUTPUT"

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/docs/features.md

@@ -505,7 +505,8 @@ decides *whether* to proceed, and the tool always re-reads it from the pull
 request's reviews. So no trigger, and nobody who fires one, can grant
 anything.
 
-Of the privileged triggers, this mechanism uses `issue_comment`.
+Of the privileged triggers, this mechanism uses `issue_comment` and, through
+the reusable workflow, `schedule`.
 
 **A comment** is the privileged re-check. Subscribe to `issue_comment`:
 
@@ -531,13 +532,38 @@ This trigger needs `AUTOMATION_ONLY: false`. It defaults to `true` and closes
 a human-authored pull request before the gate sees it, which would leave
 nothing to unblock.
 
-A zero-touch variant — a periodic sweep that notices the approval without
-anyone commenting — remains open as
-[#421](https://github.com/lfreleng-actions/github2gerrit-action/issues/421).
-It can build on two pieces that bulk dispatch now uses: a job per pull
-request, so each transfer takes that pull request's own lock, and the
-transfer record described below, so an already-transferred head gets no
-second visit.
+**A schedule** removes the comment. A maintainer approves in the ordinary way
+and the next sweep transfers the change. Add a `schedule` trigger to a caller
+of the reusable workflow:
+
+```yaml
+on:
+  schedule:
+    - cron: "17 * * * *"  # hourly, off the top of the hour
+```
+
+A scheduled run lists the open pull requests and starts one job for each that
+the gate could be holding back: a head not known to be in this repository,
+with an approving review of its current commit. Same-repository pull requests
+never enter a sweep. That also covers every automation pull request, which
+the events already handle. The sweep still visits a head whose repository no
+longer exists, since the gate applies to it. The approval check only narrows
+the list; the job's own gate still decides whether that approval counts.
+
+Each job runs in its pull request's concurrency group, so it queues behind a
+comment re-check or a push for the same pull request rather than racing it.
+Once a pull request has transferred, the transfer record described below has
+later sweeps pass it over until its head moves. A pull request approved but
+not yet transferred gets a job on every run until it transfers, so pick an
+interval to match: hourly suits most projects.
+
+The same caveats apply as for comments: the trigger needs
+`AUTOMATION_ONLY: false`, and a scheduled workflow runs from the default
+branch. A composite action cannot start jobs of its own, so a scheduled run
+calling it directly fails with an error saying so, rather than sweeping every
+pull request in one job and racing the runs events start for them. GitHub
+suspends schedules in a public repository after 60 days without activity; the
+comment re-check keeps working regardless.
 
 `pull_request_review` should be **removed** from any workflow that still
 carries it. It can no longer transfer anything: on a fork pull request it runs
@@ -598,15 +624,16 @@ transferred pull request does not keep displaying a stale block. After the
 transfer succeeds it edits the comment once more to say so, recording the
 transferred commit in a hidden marker.
 
-A bulk sweep (`PR_NUMBER` of `0`) reads that marker and passes over a pull
-request whose current head it names, rather than submitting the same commit
-again. Through the reusable workflow each pull request in a sweep runs as a
-job of its own, and the marker behaves the same there. Anything less means the sweep processes the pull request as before:
-no comment, no marker, a comment it cannot read, or a head that has moved
-since. Only a run that pushes records anything: a dry run does not, nor does
-one that finds the pull request's changes already merged or abandoned and
-acts on GitHub instead. Neither does a pull request approved before its
-first run, which never had a comment to edit. Only sweeps consult
+A sweep reads that marker and passes over a pull request whose current head it
+names, rather than submitting the same commit again. Sweeps are the bulk
+dispatch (`PR_NUMBER` of `0`) and the scheduled run; through the reusable
+workflow each pull request in either runs as a job of its own, and the marker
+behaves the same there. Anything less means the sweep processes the pull
+request as before: no comment, no marker, a comment it cannot read, or a head
+that has moved since. Only a run that pushes records anything: a dry run does
+not, nor does one that finds the pull request's changes already merged or
+abandoned and acts on GitHub instead. Neither does a pull request approved
+before its first run, which never had a comment to edit. Only sweeps consult
 the marker. A dispatch naming the pull request, a push and a
 `@github2gerrit check` comment transfer whatever it says.
 

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/src/github2gerrit/models.py

@@ -27,18 +27,21 @@ RECHECK_EVENTS: frozenset[str] = frozenset(
     {
         "issue_comment",
         "pull_request_review",
+        "schedule",
     }
 )
 """Events that ask the tool to look at a pull request again.
 
-Neither changes the pull request's code, so each maps to UPDATE: an
+None changes the pull request's code, so each maps to UPDATE: an
 existing Gerrit change should gain a patchset rather than a sibling.
 
 They exist because the fork approval gate needs a **privileged** run to
 notice that a maintainer has approved.  GitHub withholds secrets from
 ``pull_request_review`` on a fork pull request, so the approval itself
 cannot be the run that acts on it (see
-:func:`github2gerrit.cli._skip_unprivileged_fork_run`).
+:func:`github2gerrit.cli._skip_unprivileged_fork_run`).  A comment
+asks for the re-check; a schedule makes it without anyone asking, one
+pull request per job of the reusable workflow's sweep (#421).
 
 The important property is that these are *triggers only*.  They decide
 when to re-evaluate, never whether to proceed: authorisation is always

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/tests/test_bulk_fan_out.py

@@ -18,12 +18,9 @@ from __future__ import annotations
 
 import copy
 import json
-import math
-import os
-import re
 import shutil
 import subprocess
-from collections.abc import Callable
+from collections.abc import Sequence
 from pathlib import Path
 from typing import Any
 from unittest.mock import MagicMock
@@ -31,7 +28,15 @@ from unittest.mock import patch
 
 import pytest
 import typer
-import yaml
+from workflow_harness import REPO
+from workflow_harness import Page
+from workflow_harness import evaluate as _evaluate
+from workflow_harness import load_jobs
+from workflow_harness import matrix_of
+from workflow_harness import render as _render
+from workflow_harness import request_of
+from workflow_harness import run_enumeration
+from workflow_harness import truthy as _truthy
 
 from github2gerrit.cli import _check_automation_only
 from github2gerrit.cli import _check_single_pr_duplicates
@@ -45,13 +50,6 @@ from github2gerrit.models import PROperationMode
 from github2gerrit.pr_approval import render_transferred_comment
 
 
-WORKFLOW = (
-    Path(__file__).parent.parent
-    / ".github"
-    / "workflows"
-    / "github2gerrit.yaml"
-)
-REPO = "opendaylight/mdsal"
 HEAD_SHA = "0b2abdcf7bb2fb5ed6620f214968ae2b3c5e70e6"
 ACTION_STEP = "Run github2gerrit composite action"
 LEG_ONLY = {
@@ -62,172 +60,6 @@ LEG_ONLY = {
 """The action-step keys that make a sweep leg, and all that may differ."""
 
 
-# ---------------------------------------------------------------------
-# A small evaluator for the subset of GitHub expressions the workflow's
-# conditions and concurrency groups use. Comparing the expressions as
-# strings could not tell whether two groups actually render the same.
-# ---------------------------------------------------------------------
-
-_TOKEN = re.compile(
-    r"\s*(?:(?P<op>\|\||&&|==|!=|!|\(|\)|,)"
-    r"|'(?P<str>(?:[^']|'')*)'"
-    r"|(?P<num>\d+)"
-    r"|(?P<name>[A-Za-z_][\w-]*(?:\.[\w-]+)*))"
-)
-_TEMPLATE = re.compile(r"\$\{\{(.*?)\}\}", re.DOTALL)
-
-
-def _truthy(value: Any) -> bool:
-    if isinstance(value, float) and math.isnan(value):
-        return False
-    return value not in (None, False, 0, "")
-
-
-def _as_number(value: Any) -> float:
-    if value is None:
-        return 0.0
-    if isinstance(value, bool):
-        return float(value)
-    if isinstance(value, (int, float)):
-        return float(value)
-    try:
-        return float(str(value).strip() or 0)
-    except ValueError:
-        return math.nan
-
-
-def _equal(left: Any, right: Any) -> bool:
-    # GitHub compares strings case-insensitively and coerces mixed types
-    # to numbers.
-    if isinstance(left, str) and isinstance(right, str):
-        return left.lower() == right.lower()
-    if type(left) is type(right):
-        return bool(left == right)
-    return _as_number(left) == _as_number(right)
-
-
-def _contains(haystack: Any, needle: Any) -> bool:
-    if isinstance(haystack, list):
-        return any(_equal(item, needle) for item in haystack)
-    return str(needle or "").lower() in str(haystack or "").lower()
-
-
-def _format(template: str, *args: Any) -> str:
-    return re.sub(
-        r"\{(\d+)\}", lambda m: _render_value(args[int(m.group(1))]), template
-    )
-
-
-_FUNCTIONS: dict[str, Callable[..., Any]] = {
-    "contains": _contains,
-    "format": _format,
-    "fromJSON": json.loads,
-}
-
-
-class _Expression:
-    """Recursive descent over ``||``, ``&&``, ``==``/``!=``, ``!``."""
-
-    def __init__(self, text: str, context: dict[str, Any]) -> None:
-        self.tokens = [m for m in _TOKEN.finditer(text) if m.group().strip()]
-        assert "".join(m.group() for m in self.tokens).strip() == text.strip()
-        self.pos = 0
-        self.context = context
-
-    def evaluate(self) -> Any:
-        value = self._or()
-        assert self.pos == len(self.tokens), "trailing tokens"
-        return value
-
-    def _peek(self, op: str) -> bool:
-        return (
-            self.pos < len(self.tokens)
-            and self.tokens[self.pos].group("op") == op
-        )
-
-    def _take(self, op: str) -> None:
-        assert self._peek(op), f"expected {op!r}"
-        self.pos += 1
-
-    def _or(self) -> Any:
-        value = self._and()
-        while self._peek("||"):
-            self._take("||")
-            right = self._and()
-            value = value if _truthy(value) else right
-        return value
-
-    def _and(self) -> Any:
-        value = self._compare()
-        while self._peek("&&"):
-            self._take("&&")
-            right = self._compare()
-            value = right if _truthy(value) else value
-        return value
-
-    def _compare(self) -> Any:
-        value = self._unary()
-        while self._peek("==") or self._peek("!="):
-            negate = self._peek("!=")
-            self.pos += 1
-            right = self._unary()
-            value = _equal(value, right) != negate
-        return value
-
-    def _unary(self) -> Any:
-        if self._peek("!"):
-            self._take("!")
-            return not _truthy(self._unary())
-        return self._primary()
-
-    def _primary(self) -> Any:
-        if self._peek("("):
-            self._take("(")
-            value = self._or()
-            self._take(")")
-            return value
-        token = self.tokens[self.pos]
-        self.pos += 1
-        if token.group("str") is not None:
-            return token.group("str").replace("''", "'")
-        if token.group("num") is not None:
-            return int(token.group("num"))
-        name = token.group("name")
-        if self._peek("("):
-            return _FUNCTIONS[name](*self._arguments())
-        literals = {"true": True, "false": False, "null": None}
-        return literals.get(name, self.context.get(name))
-
-    def _arguments(self) -> list[Any]:
-        self._take("(")
-        args = [self._or()]
-        while self._peek(","):
-            self._take(",")
-            args.append(self._or())
-        self._take(")")
-        return args
-
-
-def _evaluate(expression: str, context: dict[str, Any]) -> Any:
-    match = _TEMPLATE.fullmatch(expression.strip())
-    inner = match.group(1) if match else expression
-    return _Expression(inner, {"github.repository": REPO, **context}).evaluate()
-
-
-def _render_value(value: Any) -> str:
-    if value is None:
-        return ""
-    if isinstance(value, bool):
-        return "true" if value else "false"
-    return str(value)
-
-
-def _render(template: str, context: dict[str, Any]) -> str:
-    return _TEMPLATE.sub(
-        lambda m: _render_value(_evaluate(m.group(1), context)), template
-    )
-
-
 class TestTheEvaluatorItself:
     """Enough confidence in the evaluator for the tests built on it."""
 
@@ -257,7 +89,7 @@ class TestTheEvaluatorItself:
 
 @pytest.fixture(scope="module")
 def jobs() -> dict[str, Any]:
-    return dict(yaml.safe_load(WORKFLOW.read_text())["jobs"])
+    return load_jobs()
 
 
 def _dispatch(pr_number: str, change_url: str = "") -> dict[str, Any]:
@@ -465,97 +297,22 @@ class TestTheLegIsTheSingleJob:
 # The enumeration script, executed out of the workflow
 # ---------------------------------------------------------------------
 
-_CURL_STUB = r"""#!/usr/bin/env bash
-# Stands in for the GraphQL endpoint. Cursors here are page numbers;
-# the real ones are opaque, which the script must not rely on either way.
-python3 -c 'import json, sys; print(json.dumps(sys.argv[1:]))' "$@" \
-  >> "${CURL_LOG}"
-args=("$@")
-data=''
-for ((i = 0; i < ${#args[@]}; i++)); do
-  if [[ "${args[i]}" == "--data" ]]; then data="${args[i + 1]}"; fi
-done
-if [[ -n "${CURL_FAIL:-}" ]]; then
-  echo '{"message": "Bad credentials"}'
-  exit 22
-fi
-if [[ -n "${GRAPHQL_ERRORS:-}" ]]; then
-  echo '{"data": null, "errors": [{"message": "Resource not accessible"}]}'
-  exit 0
-fi
-page=$(( $(jq -r '.variables.after // "0"' <<< "${data}") + 1 ))
-pages=$(find "${CURL_PAGES}" -name '*.json' | wc -l)
-if (( page < pages )); then next=true; else next=false; fi
-jq -nc --slurpfile nodes "${CURL_PAGES}/${page}.json" \
-  --argjson next "${next}" --arg cursor "${page}" \
-  '{data: {repository: {pullRequests: {nodes: $nodes[0],
-    pageInfo: {hasNextPage: $next, endCursor: $cursor}}}}}'
-"""
-
 
 @pytest.mark.skipif(shutil.which("jq") is None, reason="needs jq")
 class TestTheEnumeration:
     """The step that builds the sweep's matrix."""
 
-    def _script(self, jobs: dict[str, Any]) -> str:
-        return str(jobs["enumerate"]["steps"][0]["run"])
-
     def _run(
         self,
         jobs: dict[str, Any],
         tmp_path: Path,
-        pages: list[list[int]],
+        pages: Sequence[Page],
         **env: str,
     ) -> tuple[subprocess.CompletedProcess[str], str, list[list[str]]]:
-        stub_dir = tmp_path / "bin"
-        stub_dir.mkdir()
-        curl = stub_dir / "curl"
-        curl.write_text(_CURL_STUB)
-        curl.chmod(0o755)
-        page_dir = tmp_path / "pages"
-        page_dir.mkdir()
-        for index, numbers in enumerate(pages, start=1):
-            (page_dir / f"{index}.json").write_text(
-                json.dumps([{"number": n} for n in numbers])
-            )
-        output = tmp_path / "github_output"
-        output.touch()
-        log = tmp_path / "curl.log"
-        log.touch()
-        result = subprocess.run(
-            ["bash", "-c", self._script(jobs)],
-            capture_output=True,
-            text=True,
-            check=False,
-            # A cursor that never advances must fail the test, not hang it
-            timeout=60,
-            env={
-                **os.environ,
-                "PATH": f"{stub_dir}{os.pathsep}{os.environ['PATH']}",
-                "GITHUB_TOKEN": "t0ken",
-                "GITHUB_GRAPHQL_URL": "https://api.github.example/graphql",
-                "GITHUB_REPOSITORY": REPO,
-                "GITHUB_OUTPUT": str(output),
-                "G2G_DISABLED": "",
-                "CURL_PAGES": str(page_dir),
-                "CURL_LOG": str(log),
-                **env,
-            },
-        )
-        calls = [json.loads(line) for line in log.read_text().splitlines()]
-        return result, output.read_text(), calls
-
-    @staticmethod
-    def _matrix(output: str) -> str:
-        return next(
-            line.split("=", 1)[1]
-            for line in output.splitlines()
-            if line.startswith("matrix=")
-        )
+        return run_enumeration(jobs, tmp_path, pages, **env)
 
-    @staticmethod
-    def _request(call: list[str]) -> dict[str, Any]:
-        return dict(json.loads(call[call.index("--data") + 1]))
+    _matrix = staticmethod(matrix_of)
+    _request = staticmethod(request_of)
 
     def test_a_leg_per_pull_request_and_one_cleanup(
         self, jobs: dict[str, Any], tmp_path: Path

{github2gerrit-2.3.0 → github2gerrit-2.4.0}/tests/test_precommit_mypy_pins.py

@@ -195,6 +195,13 @@ def _third_party_imports() -> set[str]:
     import sys
 
     first_party = {"github2gerrit", "tests", "fixtures", "conftest"}
+    # Shared helpers beside the tests import as top-level modules
+    # (pytest puts tests/ on sys.path), so each is first-party too.
+    first_party |= {
+        Path(relative).stem
+        for relative in _tracked_python_files()
+        if Path(relative).parent == Path("tests")
+    }
     names: set[str] = set()
     for relative in _tracked_python_files():
         if not _scan_selects(relative):