github2gerrit 2.3.0__tar.gz → 2.4.1__tar.gz

github2gerrit-2.4.1/.pre-commit-config.yaml

@@ -0,0 +1,241 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2025 The Linux Foundation
+
+ci:
+  autofix_prs: false
+  skip:
+    - pytest
+    - gha-workflow-linter
+    - aislop
+    - eslint
+    - go-fmt
+    - go-vet
+    - go-mod-tidy
+    - golangci-lint
+  autofix_commit_msg: |
+    Chore: Pre-commit autofixes
+
+    Signed-off-by: pre-commit-ci[bot] <pre-commit-ci@users.noreply.github.com>
+  autoupdate_commit_msg: |
+    Chore: Pre-commit autoupdate
+
+    Signed-off-by: pre-commit-ci[bot] <pre-commit-ci@users.noreply.github.com>
+
+default_install_hook_types: [pre-commit, commit-msg]
+default_stages: [pre-commit]
+
+exclude: |
+  (?x)^(docs/conf.py|
+        \.mypy_cache/|
+        \.pytest_cache/|
+        \.ruff_cache/|
+        dist/|
+        build/|
+        coverage_html_report/|
+        \.venv/)
+
+repos:
+  - repo: local
+    hooks:
+      - id: frozen-rev-is-a-release
+        name: frozen revs name a release
+        language: pygrep
+        # yamllint disable-line rule:line-length
+        entry: '^[ \t]*rev:[ \t]*\S+[ \t]+#[ \t]*frozen:(?![ \t]+v?[0-9]+(\.[0-9]+)*(-[0-9]+)?[ \t]*$)'
+        files: '^\.pre-commit-config\.yaml$'
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: check-added-large-files
+      - id: check-ast
+      - id: check-json
+      - id: check-merge-conflict
+      - id: check-xml
+      - id: check-yaml
+      - id: debug-statements
+      - id: end-of-file-fixer
+      - id: requirements-txt-fixer
+      - id: mixed-line-ending
+        args: ["--fix=lf"]
+      - id: no-commit-to-branch
+        args:
+          - --branch=dev
+          - --branch=master
+          - --branch=main
+          - --branch=rc
+          - --branch=production
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: 2ca41cc1372d1e939a6a879f18cdc19fc1cac1ce  # frozen: v8.30.0
+    hooks:
+      - id: gitleaks
+        always_run: true
+
+  - repo: https://github.com/jorisroovers/gitlint
+    rev: acc9d9de6369b76d22cb4167029d2035e8730b98  # frozen: v0.19.1
+    hooks:
+      - id: gitlint
+
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: cba56bcde1fdd01c1deb3f945e69764c291a6530  # frozen: v1.38.0
+    hooks:
+      - id: yamllint
+        types: [yaml]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: a56c0b927e6465d37cae3e97d35d4d18ab2b96cd  # frozen: v0.16.9
+    hooks:
+      - id: ruff
+        files: ^(src|scripts|tests)/.+\.py$|^sitecustomize\.py$
+        args: [--fix, --exit-non-zero-on-fix]
+      - id: ruff-format
+        files: ^(src|scripts|tests)/.+\.py$|^sitecustomize\.py$
+
+  - repo: local
+    hooks:
+      - id: sync-mypy-pins
+        name: sync mypy hook pins with uv.lock
+        entry: python3 scripts/sync_mypy_pins.py
+        language: system
+        files: ^(\.pre-commit-config\.yaml|uv\.lock)$
+        pass_filenames: false
+
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee  # frozen: v2.3.1
+    hooks:
+      - id: mypy
+        files: ^(src|scripts|tests)/.+\.py$|^sitecustomize\.py$
+        additional_dependencies:
+          - mypy==2.3.1
+          - click==8.5.0
+          - pytest==9.1.1
+          - responses==0.26.3
+          - rich==15.0.0
+          - typer==0.27.2
+          - types-PyYAML==6.0.12.20260906
+          - types-requests==2.33.0.20260906
+
+  - repo: https://github.com/btford/write-good
+    rev: ab66ce10136dfad5146e69e70f82a3efac8842c1  # frozen: v1.0.8
+    hooks:
+      - id: write-good
+        files: "\\.(rst|md|markdown|mdown|mkdn)$"
+        args: ["--no-adverb"]
+
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: a6564f5d57444e123433a5c9af733e3975c77229  # frozen: v0.11.0.1-1
+    hooks:
+      - id: shellcheck
+
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: 5b5dddc4fb0f83c3ea1fc5616fa63e115dce83e0  # frozen: v0.49.1
+    hooks:
+      - id: markdownlint
+        args: ["--fix", "--config", ".markdownlint.yaml"]
+        exclude: "GERRIT_URL_CENTRALIZATION.md"
+
+  - repo: https://github.com/fsfe/reuse-tool
+    rev: 9fabf9eb815a57aac116b435e8346c200cdb8604  # frozen: v6.2.0
+    hooks:
+      - id: reuse
+
+  - repo: https://github.com/kjanat/actionlint
+    rev: 2da2ceb4af2c7ecc48f5b9311d85080c3971b5f0  # frozen: v1.17.0
+    hooks:
+      - id: actionlint-shellcheck
+
+  - repo: https://github.com/codespell-project/codespell
+    rev: 57b21406f092110c18776e39b0bda50d37c945c8  # frozen: v2.4.3
+    hooks:
+      - id: codespell
+
+  - repo: https://github.com/DetachHead/basedpyright-prek-mirror
+    rev: 706e6acebe9e88c2c28d1527d3085a14b11794c4  # frozen: 1.40.1
+    hooks:
+      - id: basedpyright
+        files: ^(src|scripts|tests)/.+\.py$|^sitecustomize\.py$
+
+  - repo: https://github.com/lfreleng-actions/gha-workflow-linter
+    rev: 0c582e431022f1c7004196fb4ea32744d1fe4843  # frozen: v1.7.0
+    hooks:
+      - id: gha-workflow-linter
+
+  - repo: local
+    hooks:
+      - id: aislop
+        name: aislop
+        entry: aislop ci --human
+        language: node
+        additional_dependencies: ["aislop@0.14.1"]
+        pass_filenames: false
+        always_run: true
+
+  - repo: local
+    hooks:
+      - id: eslint
+        name: eslint
+        # yamllint disable-line rule:line-length
+        entry: bash -c 'export GUARD_EXCLUDE="(^|/)(dist|build|coverage|node_modules)/|(^|/)eslint[.]config[.](m|c)?js$"; sh .github/hooks/manifest-guard.sh package.json "*.js" "*.jsx" "*.mjs" "*.cjs" "*.ts" "*.tsx" "*.mts" "*.cts"; rc=$?; case "$rc" in 3|4) ;; *) exit "$rc";; esac; v=$(npx --no-install eslint --version 2>/dev/null | sed "s/^v//; s/[.].*$//"); if [ -z "$v" ]; then echo "eslint not installed - add eslint >=9 to devDependencies" >&2; exit 1; fi; if [ "$v" -lt 9 ]; then echo "eslint $v cannot load a flat config reliably - upgrade to >=9" >&2; exit 1; fi; if ! git ls-files -- eslint.config.mjs | grep -q .; then echo "eslint.config.mjs is not tracked - copy it from actions-template, or ESLint would lint against a config outside this repository" >&2; exit 1; fi; { sh .github/hooks/manifest-guard.sh --list package.json "*.js" "*.jsx" "*.mjs" "*.cjs" "*.ts" "*.tsx" "*.mts" "*.cts"; printf "eslint.config.mjs\0"; } | xargs -0 env ESLINT_USE_FLAT_CONFIG=true npx --no-install eslint --no-config-lookup --config eslint.config.mjs --fix'
+        language: system
+        always_run: true
+        pass_filenames: false
+
+  - repo: local
+    hooks:
+      - id: go-fmt
+        name: go format (gofmt + goimports)
+        # yamllint disable-line rule:line-length
+        entry: bash -c 'sh .github/hooks/manifest-guard.sh go.mod "*.go"; rc=$?; case "$rc" in 3) ;; 4) exit 0;; *) exit "$rc";; esac; command -v golangci-lint >/dev/null 2>&1 || { echo "golangci-lint not installed - see https://golangci-lint.run/welcome/install/" >&2; exit 1; }; sh .github/hooks/manifest-guard.sh --list go.mod "*.go" | xargs -0 golangci-lint fmt'
+        language: system
+        always_run: true
+        pass_filenames: false
+      - id: go-mod-tidy
+        name: go mod tidy
+        # yamllint disable-line rule:line-length
+        entry: bash -c 'sh .github/hooks/manifest-guard.sh go.mod "*.go"; rc=$?; case "$rc" in 3|4) ;; *) exit "$rc";; esac; go mod tidy'
+        language: system
+        always_run: true
+        pass_filenames: false
+      - id: go-vet
+        name: go vet
+        # yamllint disable-line rule:line-length
+        entry: bash -c 'sh .github/hooks/manifest-guard.sh go.mod "*.go"; rc=$?; case "$rc" in 3) ;; 4) exit 0;; *) exit "$rc";; esac; go vet ./...'
+        language: system
+        always_run: true
+        pass_filenames: false
+      - id: golangci-lint
+        name: golangci-lint
+        # yamllint disable-line rule:line-length
+        entry: bash -c 'sh .github/hooks/manifest-guard.sh go.mod "*.go"; rc=$?; case "$rc" in 3) ;; 4) exit 0;; *) exit "$rc";; esac; command -v golangci-lint >/dev/null 2>&1 || { echo "golangci-lint not installed - see https://golangci-lint.run/welcome/install/" >&2; exit 1; }; golangci-lint run --timeout=5m'
+        language: system
+        always_run: true
+        pass_filenames: false
+
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 4f85d46a92dc17713078e5de73f8a13190edf6fc  # frozen: 0.38.2
+    hooks:
+      - id: check-github-actions
+      - id: check-github-workflows
+      - id: check-jsonschema
+        name: Check GitHub Workflows set timeout-minutes
+        args:
+          - --builtin-schema
+          - github-workflows-require-timeout
+        files: ^\.github/workflows/[^/]+$
+        types:
+          - yaml
+      - id: check-readthedocs
+
+  - repo: local
+    hooks:
+      - id: pytest
+        name: pytest
+        entry: uv
+        args: [run, pytest, --tb=short, -q, -v, --strict-markers, --maxfail=5]
+        language: system
+        pass_filenames: false
+        always_run: true
+        require_serial: true

{github2gerrit-2.3.0 → github2gerrit-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: github2gerrit
-Version: 2.3.0
+Version: 2.4.1
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action
@@ -145,6 +145,9 @@ on:
   # pull_request_review runs on fork PRs.
   issue_comment:
     types: [created]
+  # Optional: transfer approved fork PRs without anyone commenting.
+  # schedule:
+  #   - cron: "17 * * * *"
   push:
     branches: [main, master]
   workflow_dispatch:
@@ -189,6 +192,12 @@ which closes a human-authored pull request before the approval gate
 sees it, so leaving it set would make the fork path unreachable. Drop
 both if the repository only ever receives automation PRs.
 
+The optional `schedule` trigger does the comment's job unattended: each
+run transfers fork pull requests whose current commit a maintainer has
+approved, one job per pull request, and leaves every other pull request
+alone. See
+[scheduled sweeps](docs/features.md#which-triggers-can-lift-the-gate).
+
 Repositories using the Gerrit-side dispatch integration should also
 declare `GERRIT_CHANGE_URL`, `GERRIT_EVENT_TYPE`, and `GERRIT_BRANCH`
 as dispatch inputs and forward them the same way.
@@ -263,7 +272,8 @@ A composite action cannot start jobs, so here a bulk `workflow_dispatch`
 (`PR_NUMBER` of `0`) still processes every open pull request in one job. That
 job does not serialise against the per-pull-request runs events start, so
 avoid triggering one while pull request activity is in flight, or use the
-reusable workflow, which fans the sweep out.
+reusable workflow, which fans the sweep out. For the same reason a `schedule`
+trigger works only through the reusable workflow.
 
 ### Option C: command-line tool
 

{github2gerrit-2.3.0 → github2gerrit-2.4.1}/README.md

@@ -98,6 +98,9 @@ on:
   # pull_request_review runs on fork PRs.
   issue_comment:
     types: [created]
+  # Optional: transfer approved fork PRs without anyone commenting.
+  # schedule:
+  #   - cron: "17 * * * *"
   push:
     branches: [main, master]
   workflow_dispatch:
@@ -142,6 +145,12 @@ which closes a human-authored pull request before the approval gate
 sees it, so leaving it set would make the fork path unreachable. Drop
 both if the repository only ever receives automation PRs.
 
+The optional `schedule` trigger does the comment's job unattended: each
+run transfers fork pull requests whose current commit a maintainer has
+approved, one job per pull request, and leaves every other pull request
+alone. See
+[scheduled sweeps](docs/features.md#which-triggers-can-lift-the-gate).
+
 Repositories using the Gerrit-side dispatch integration should also
 declare `GERRIT_CHANGE_URL`, `GERRIT_EVENT_TYPE`, and `GERRIT_BRANCH`
 as dispatch inputs and forward them the same way.
@@ -216,7 +225,8 @@ A composite action cannot start jobs, so here a bulk `workflow_dispatch`
 (`PR_NUMBER` of `0`) still processes every open pull request in one job. That
 job does not serialise against the per-pull-request runs events start, so
 avoid triggering one while pull request activity is in flight, or use the
-reusable workflow, which fans the sweep out.
+reusable workflow, which fans the sweep out. For the same reason a `schedule`
+trigger works only through the reusable workflow.
 
 ### Option C: command-line tool
 

{github2gerrit-2.3.0 → github2gerrit-2.4.1}/action.yaml

@@ -293,17 +293,22 @@ runs:
         fi
 
     - name: "Validate PR_NUMBER usage"
+      # A scheduled sweep names its pull request the same way a dispatch
+      # does: the reusable workflow fans the schedule out to one job per
+      # pull request, each passing that pull request's number.
       # yamllint disable-line rule:line-length
-      if: ${{ steps.disabled-check.outputs.disabled != 'true' && github.event_name != 'workflow_dispatch' && inputs.PR_NUMBER != '' && inputs.PR_NUMBER != '0' }}
+      if: ${{ steps.disabled-check.outputs.disabled != 'true' && github.event_name != 'workflow_dispatch' && github.event_name != 'schedule' && inputs.PR_NUMBER != '' && inputs.PR_NUMBER != '0' }}
       shell: bash
       run: |
         # Validate PR_NUMBER usage
         set -euo pipefail
-        echo "Error: PR_NUMBER only valid during workflow_dispatch events."
+        echo "Error: PR_NUMBER only valid during workflow_dispatch events," \
+          "or on schedule for one job of a scheduled sweep."
         exit 2
 
     - name: "Normalize PR_NUMBER"
-      if: ${{ steps.disabled-check.outputs.disabled != 'true' && github.event_name == 'workflow_dispatch' }}
+      # yamllint disable-line rule:line-length
+      if: ${{ steps.disabled-check.outputs.disabled != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
       id: normalize
       shell: bash
       env:
@@ -347,7 +352,18 @@ runs:
         fi
 
         # Honor PR_NUMBER or sync-all from workflow_dispatch normalization
-        if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+        if [[ "${GITHUB_EVENT_NAME}" == "schedule" ]]; then
+          # One job of a scheduled sweep, which names its pull request.
+          # A schedule sweeping every pull request in one job would race
+          # the runs events start for them (#421), so it is refused.
+          if [[ -n "${DISPATCH_SYNC_ALL:-}" || -z "${DISPATCH_PR_NUMBER:-}" ]]; then
+            echo "Error: a scheduled run needs PR_NUMBER naming one pull request."
+            echo "The reusable workflow fans a schedule out to one job per pull"
+            echo "request; a composite action cannot start jobs of its own."
+            exit 2
+          fi
+          echo "pr_number=${DISPATCH_PR_NUMBER}" >> "$GITHUB_OUTPUT"
+        elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
           if [[ -n "${DISPATCH_SYNC_ALL:-}" ]]; then
             echo "Processing all open pull requests via workflow_dispatch."
             echo "sync_all=true" >> "$GITHUB_OUTPUT"

{github2gerrit-2.3.0 → github2gerrit-2.4.1}/docs/features.md

@@ -505,7 +505,8 @@ decides *whether* to proceed, and the tool always re-reads it from the pull
 request's reviews. So no trigger, and nobody who fires one, can grant
 anything.
 
-Of the privileged triggers, this mechanism uses `issue_comment`.
+Of the privileged triggers, this mechanism uses `issue_comment` and, through
+the reusable workflow, `schedule`.
 
 **A comment** is the privileged re-check. Subscribe to `issue_comment`:
 
@@ -531,13 +532,38 @@ This trigger needs `AUTOMATION_ONLY: false`. It defaults to `true` and closes
 a human-authored pull request before the gate sees it, which would leave
 nothing to unblock.
 
-A zero-touch variant — a periodic sweep that notices the approval without
-anyone commenting — remains open as
-[#421](https://github.com/lfreleng-actions/github2gerrit-action/issues/421).
-It can build on two pieces that bulk dispatch now uses: a job per pull
-request, so each transfer takes that pull request's own lock, and the
-transfer record described below, so an already-transferred head gets no
-second visit.
+**A schedule** removes the comment. A maintainer approves in the ordinary way
+and the next sweep transfers the change. Add a `schedule` trigger to a caller
+of the reusable workflow:
+
+```yaml
+on:
+  schedule:
+    - cron: "17 * * * *"  # hourly, off the top of the hour
+```
+
+A scheduled run lists the open pull requests and starts one job for each that
+the gate could be holding back: a head not known to be in this repository,
+with an approving review of its current commit. Same-repository pull requests
+never enter a sweep. That also covers every automation pull request, which
+the events already handle. The sweep still visits a head whose repository no
+longer exists, since the gate applies to it. The approval check only narrows
+the list; the job's own gate still decides whether that approval counts.
+
+Each job runs in its pull request's concurrency group, so it queues behind a
+comment re-check or a push for the same pull request rather than racing it.
+Once a pull request has transferred, the transfer record described below has
+later sweeps pass it over until its head moves. A pull request approved but
+not yet transferred gets a job on every run until it transfers, so pick an
+interval to match: hourly suits most projects.
+
+The same caveats apply as for comments: the trigger needs
+`AUTOMATION_ONLY: false`, and a scheduled workflow runs from the default
+branch. A composite action cannot start jobs of its own, so a scheduled run
+calling it directly fails with an error saying so, rather than sweeping every
+pull request in one job and racing the runs events start for them. GitHub
+suspends schedules in a public repository after 60 days without activity; the
+comment re-check keeps working regardless.
 
 `pull_request_review` should be **removed** from any workflow that still
 carries it. It can no longer transfer anything: on a fork pull request it runs
@@ -598,15 +624,16 @@ transferred pull request does not keep displaying a stale block. After the
 transfer succeeds it edits the comment once more to say so, recording the
 transferred commit in a hidden marker.
 
-A bulk sweep (`PR_NUMBER` of `0`) reads that marker and passes over a pull
-request whose current head it names, rather than submitting the same commit
-again. Through the reusable workflow each pull request in a sweep runs as a
-job of its own, and the marker behaves the same there. Anything less means the sweep processes the pull request as before:
-no comment, no marker, a comment it cannot read, or a head that has moved
-since. Only a run that pushes records anything: a dry run does not, nor does
-one that finds the pull request's changes already merged or abandoned and
-acts on GitHub instead. Neither does a pull request approved before its
-first run, which never had a comment to edit. Only sweeps consult
+A sweep reads that marker and passes over a pull request whose current head it
+names, rather than submitting the same commit again. Sweeps are the bulk
+dispatch (`PR_NUMBER` of `0`) and the scheduled run; through the reusable
+workflow each pull request in either runs as a job of its own, and the marker
+behaves the same there. Anything less means the sweep processes the pull
+request as before: no comment, no marker, a comment it cannot read, or a head
+that has moved since. Only a run that pushes records anything: a dry run does
+not, nor does one that finds the pull request's changes already merged or
+abandoned and acts on GitHub instead. Neither does a pull request approved
+before its first run, which never had a comment to edit. Only sweeps consult
 the marker. A dispatch naming the pull request, a push and a
 `@github2gerrit check` comment transfer whatever it says.
 

{github2gerrit-2.3.0 → github2gerrit-2.4.1}/src/github2gerrit/models.py

@@ -27,18 +27,21 @@ RECHECK_EVENTS: frozenset[str] = frozenset(
     {
         "issue_comment",
         "pull_request_review",
+        "schedule",
     }
 )
 """Events that ask the tool to look at a pull request again.
 
-Neither changes the pull request's code, so each maps to UPDATE: an
+None changes the pull request's code, so each maps to UPDATE: an
 existing Gerrit change should gain a patchset rather than a sibling.
 
 They exist because the fork approval gate needs a **privileged** run to
 notice that a maintainer has approved.  GitHub withholds secrets from
 ``pull_request_review`` on a fork pull request, so the approval itself
 cannot be the run that acts on it (see
-:func:`github2gerrit.cli._skip_unprivileged_fork_run`).
+:func:`github2gerrit.cli._skip_unprivileged_fork_run`).  A comment
+asks for the re-check; a schedule makes it without anyone asking, one
+pull request per job of the reusable workflow's sweep (#421).
 
 The important property is that these are *triggers only*.  They decide
 when to re-evaluate, never whether to proceed: authorisation is always