gitlab_mr_check 1.4.2__tar.gz → 1.6.0__tar.gz

{gitlab_mr_check-1.4.2 → gitlab_mr_check-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab_mr_check
-Version: 1.4.2
+Version: 1.6.0
 Summary: GitLab Merge Request 4-Eyes Approval Audit Tool
 Author: Yorick Hoorneman
 Author-email: Yorick Hoorneman <yhoorneman@schubergphilis.com>
@@ -30,7 +30,7 @@ Description-Content-Type: text/markdown
 [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)
 [![Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog%201.1.0-orange)](https://keepachangelog.com/en/1.1.0/)
 [![Build](https://img.shields.io/badge/build-passing-brightgreen)]()
-[![Coverage](https://img.shields.io/badge/coverage-35%25-red)](https://coverage.readthedocs.io/)
+[![Coverage](https://img.shields.io/badge/coverage-45%25-red)](https://coverage.readthedocs.io/)
 [![pyscn quality](https://img.shields.io/badge/pyscn-not%20rated-lightgrey)](https://pyscn.ludo-tech.org)
 
 GitLab Merge Request 4-Eyes Approval Audit Tool

{gitlab_mr_check-1.4.2 → gitlab_mr_check-1.6.0}/README.md

@@ -15,7 +15,7 @@
 [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)
 [![Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog%201.1.0-orange)](https://keepachangelog.com/en/1.1.0/)
 [![Build](https://img.shields.io/badge/build-passing-brightgreen)]()
-[![Coverage](https://img.shields.io/badge/coverage-35%25-red)](https://coverage.readthedocs.io/)
+[![Coverage](https://img.shields.io/badge/coverage-45%25-red)](https://coverage.readthedocs.io/)
 [![pyscn quality](https://img.shields.io/badge/pyscn-not%20rated-lightgrey)](https://pyscn.ludo-tech.org)
 
 GitLab Merge Request 4-Eyes Approval Audit Tool

{gitlab_mr_check-1.4.2 → gitlab_mr_check-1.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitlab_mr_check"
-version = "1.4.2"
+version = "1.6.0"
 description = "GitLab Merge Request 4-Eyes Approval Audit Tool"
 readme = "README.md"
 authors = [
@@ -63,13 +63,13 @@ test = [
     # Pin uv to match [tool.uv] required-version — tox-uv depends on the uv
     # Python package, which installs a uv binary into .venv/bin that would
     # otherwise shadow the image's /usr/local/bin/uv and break the check.
-    "uv==0.11.7",
+    "uv==0.11.16",
     "tox>=4.21",
     "tox-uv>=1.16",
 ]
 
 [build-system]
-requires = ["uv_build>=0.8.15,<=0.11.7"]
+requires = ["uv_build>=0.8.15,<=0.11.16"]
 build-backend = "uv_build"
 
 [tool.pyscn.complexity]
@@ -254,7 +254,7 @@ branch = true
 [tool.coverage.report]
 show_missing = true
 skip_covered = true
-fail_under = 35
+fail_under = 45
 exclude_lines = [
     "pragma: no cover",
     "if __name__ == .__main__.",
@@ -274,7 +274,7 @@ directory = "reports/coverage"
 
 
 [tool.uv]
-required-version = "==0.11.7"
+required-version = "==0.11.16"
 exclude-newer = "1 week"
 
 [tool.tox]
@@ -294,6 +294,6 @@ commands = [["pytest", { replace = "posargs", default = [], extend = true }]]
 # strings below are kept consistent with that version by hand (uv is mentioned in each).
 # `alpine-image` is mirrored literally in .gitlab-ci.yml's variables: block — GitLab
 # cannot evaluate `image:` from pyproject at pipeline-creation time.
-base-image = "ghcr.io/astral-sh/uv:0.11.7-python3.13-trixie-slim"
-uv-image = "ghcr.io/astral-sh/uv:0.11.7"
-alpine-image = "ghcr.io/astral-sh/uv:0.11.7-alpine3.22"
+base-image = "ghcr.io/astral-sh/uv:0.11.16-python3.13-trixie-slim"
+uv-image = "ghcr.io/astral-sh/uv:0.11.16"
+alpine-image = "ghcr.io/astral-sh/uv:0.11.16-alpine3.22"

{gitlab_mr_check-1.4.2 → gitlab_mr_check-1.6.0}/src/gitlab_mr_check/__init__.py

@@ -29,12 +29,14 @@ from .gitlab_mr_check import (
     MRApprovalResult,
     ProjectMRAuditResult,
     audit,
+    evaluate_mr_4eyes,
     evaluate_mrs_4eyes_per_project,
     filter_empty_results_by_field,
     get_groups_recursive,
     get_mrs_by_project,
     get_mrs_by_projects,
     has_4eyes_approval,
+    mr_is_indirect_merge,
     mr_is_merged,
     mr_updated_in_years,
     sort_results_by_field,
@@ -57,12 +59,14 @@ __all__ = [
     'MRApprovalResult',
     'ProjectMRAuditResult',
     'audit',
+    'evaluate_mr_4eyes',
     'evaluate_mrs_4eyes_per_project',
     'filter_empty_results_by_field',
     'get_groups_recursive',
     'get_mrs_by_project',
     'get_mrs_by_projects',
     'has_4eyes_approval',
+    'mr_is_indirect_merge',
     'mr_is_merged',
     'mr_updated_in_years',
     'parse_config_file',

{gitlab_mr_check-1.4.2 → gitlab_mr_check-1.6.0}/src/gitlab_mr_check/cli.py

@@ -94,7 +94,13 @@ def main() -> None:
         sys.exit(f'Invalid config: {exc}')
     results = audit(url=args.url, token=args.token, config=config)
     rows = [
-        {'project': r.name, 'iid': mr.iid, 'passed': mr.passed, 'reasoning': mr.reasoning}
+        {
+            'project': r.name,
+            'iid': mr.iid,
+            'passed': mr.passed,
+            'indirect_merge': mr.indirect_merge,
+            'reasoning': mr.reasoning,
+        }
         for r in results
         for mr in r.mr_results
     ]

{gitlab_mr_check-1.4.2 → gitlab_mr_check-1.6.0}/src/gitlab_mr_check/gitlab_mr_check.py

@@ -18,7 +18,6 @@
 import logging
 from dataclasses import asdict, dataclass, field
 from datetime import datetime
-from functools import partial
 from typing import Any
 
 import gitlab
@@ -40,6 +39,11 @@ LOGGER_BASENAME = 'gitlab-mr-check'
 LOGGER = logging.getLogger(LOGGER_BASENAME)
 LOGGER.addHandler(logging.NullHandler())
 
+# System-note text GitLab attaches when an MR's commits reached the target branch
+# by another route (sibling branch/MR, direct push, or a git merge outside the UI).
+# Verify this against the target instance; the merge-field short-circuit is the fallback.
+INDIRECT_MERGE_NOTE = 'merged manually'
+
 
 @dataclass
 class MRApprovalResult:
@@ -53,6 +57,7 @@ class MRApprovalResult:
     state: str = ''
     created_at: str = ''
     updated_at: str = ''
+    indirect_merge: bool = False
 
 
 @dataclass
@@ -64,29 +69,37 @@ class ProjectMRAuditResult:
 
     @property
     def passed(self) -> bool:
-        """Return True if all MRs in this project passed the 4-eyes check."""
-        return all(mr.passed for mr in self.mr_results) if self.mr_results else True
+        """Return True if all non-indirect MRs in this project passed the 4-eyes check."""
+        return all(mr.passed for mr in self.mr_results if not mr.indirect_merge)
 
     @property
     def mrs_passed(self) -> list[MRApprovalResult]:
-        """Return the list of MRs that passed."""
-        return [mr for mr in self.mr_results if mr.passed]
+        """Return the list of MRs that passed (excluding indirect merges)."""
+        return [mr for mr in self.mr_results if mr.passed and not mr.indirect_merge]
 
     @property
     def mrs_failed(self) -> list[MRApprovalResult]:
-        """Return the list of MRs that failed."""
-        return [mr for mr in self.mr_results if not mr.passed]
+        """Return the list of MRs that failed (excluding indirect merges)."""
+        return [mr for mr in self.mr_results if not mr.passed and not mr.indirect_merge]
+
+    @property
+    def mrs_indirect(self) -> list[MRApprovalResult]:
+        """Return the list of MRs that were merged indirectly (informational, not pass/fail)."""
+        return [mr for mr in self.mr_results if mr.indirect_merge]
 
     @property
     def percentage(self) -> float:
-        """Return the pass percentage across all MRs."""
-        total = len(self.mr_results)
+        """Return the pass percentage across all non-indirect MRs."""
+        total = len(self.mrs_passed) + len(self.mrs_failed)
         return (len(self.mrs_passed) / total * 100) if total else 0
 
     @property
     def summary(self) -> str:
         """Return a human-readable summary line."""
-        return f'Passed: {len(self.mrs_passed)}, Failed: {len(self.mrs_failed)}, Percentage: {self.percentage:.2f}%'
+        return (
+            f'Passed: {len(self.mrs_passed)}, Failed: {len(self.mrs_failed)}, '
+            f'Indirect: {len(self.mrs_indirect)}, Percentage: {self.percentage:.2f}%'
+        )
 
     def to_dict(self) -> dict:
         """Serialise this result including all computed properties."""
@@ -133,27 +146,85 @@ def mr_is_merged(mr: gitlab.v4.objects.ProjectMergeRequest) -> bool:
     return mr.state == 'merged'
 
 
+def mr_is_indirect_merge(mr: gitlab.v4.objects.ProjectMergeRequest) -> bool:
+    """Return True if the MR was merged indirectly rather than through GitLab.
+
+    An indirect merge is one where the MR's commits reached the target branch by
+    another route (a sibling branch/MR with the same commits, a direct push, or a
+    git merge outside the UI). GitLab flips such an MR to ``merged`` without
+    recording a merge user or merge commit, and attaches a "merged manually"
+    system note. The MR therefore has no approvals of its own, so its 4-eyes
+    result is meaningless and should be reported as informational.
+
+    To keep API calls low we short-circuit on fields already present: if GitLab
+    recorded a merge user or merge/squash commit, it was a real merge and we skip
+    the extra notes call.
+    """
+    if any(getattr(mr, name, None) for name in ('merge_user', 'merge_commit_sha', 'squash_commit_sha')):
+        return False
+    return any(
+        getattr(note, 'system', False) and INDIRECT_MERGE_NOTE in (getattr(note, 'body', '') or '').lower()
+        for note in mr.notes.list(all=True)
+    )
+
+
 def mr_updated_in_years(mr: gitlab.v4.objects.ProjectMergeRequest, years: list[int]) -> bool:
     """Return True if the MR was last updated in one of the given calendar years."""
     return datetime.fromisoformat(mr.updated_at).year in years
 
 
-def get_mrs_by_project(project: gitlab.v4.objects.Project, filters: list[Any]) -> list[Any]:
-    """Return all MRs from a project that pass every filter predicate."""
-    return [mr for mr in project.mergerequests.list(all=True) if all(f(mr) for f in filters)]
+def get_mrs_by_project(project: gitlab.v4.objects.Project, **list_kwargs: Any) -> list[Any]:  # noqa: ANN401
+    """Return all MRs from a project matching the given server-side list filters."""
+    return list(project.mergerequests.list(**list_kwargs))
 
 
-def get_mrs_by_projects(projects: list[tuple[str, Any]], filters: list[Any]) -> dict[str, list[Any]]:
-    """Return a mapping of project name to filtered MR list for each (name, project) pair."""
-    return {name: get_mrs_by_project(project, filters) for name, project in projects}
+def get_mrs_by_projects(projects: list[tuple[str, Any]], **list_kwargs: Any) -> dict[str, list[Any]]:  # noqa: ANN401
+    """Return a mapping of project name to MR list using the given server-side list filters."""
+    return {name: get_mrs_by_project(project, **list_kwargs) for name, project in projects}
 
 
-def evaluate_mrs_4eyes_per_project(project_mrs: dict[str, list[Any]]) -> list[ProjectMRAuditResult]:
-    """Evaluate 4-eyes approval for every MR in every project."""
-    return [
-        ProjectMRAuditResult(name=name, mr_results=[has_4eyes_approval(mr) for mr in mrs])
-        for name, mrs in project_mrs.items()
-    ]
+def evaluate_mr_4eyes(
+    mr: gitlab.v4.objects.ProjectMergeRequest,
+    default_branch: str | None = None,
+) -> MRApprovalResult | None:
+    """Evaluate a single MR's 4-eyes approval.
+
+    Returns ``None`` when the MR should be excluded from the audit: a failed MR
+    that did not target the project's ``default_branch`` (the trunk) is not a
+    4-eyes concern and is dropped. Failed MRs that were merged indirectly are
+    kept but flagged as informational (see ``mr_is_indirect_merge``).
+    """
+    result = has_4eyes_approval(mr)
+    if result.passed:
+        return result
+    if default_branch is not None and mr.target_branch != default_branch:
+        return None
+    if mr_is_indirect_merge(mr):
+        result.indirect_merge = True
+        result.reasoning = (
+            f'MR !{mr.iid} merged indirectly (commits reached the target branch '
+            f'via another branch/MR); its own approvals do not apply'
+        )
+    return result
+
+
+def evaluate_mrs_4eyes_per_project(
+    project_mrs: dict[str, list[Any]],
+    default_branches: dict[str, str | None] | None = None,
+) -> list[ProjectMRAuditResult]:
+    """Evaluate 4-eyes approval for every MR in every project.
+
+    ``default_branches`` maps a project name to its default branch; failed MRs
+    that did not target it are excluded. When omitted, no branch filtering is
+    applied.
+    """
+    default_branches = default_branches or {}
+    results = []
+    for name, mrs in project_mrs.items():
+        default_branch = default_branches.get(name)
+        mr_results = [result for mr in mrs if (result := evaluate_mr_4eyes(mr, default_branch)) is not None]
+        results.append(ProjectMRAuditResult(name=name, mr_results=mr_results))
+    return results
 
 
 def filter_empty_results_by_field(items: list[Any], field_name: str) -> list[Any]:
@@ -178,7 +249,7 @@ def audit(url: str, token: str, config: Config) -> list[ProjectMRAuditResult]:
         List of per-project audit results, sorted by pass status, with empty projects excluded.
     """
     LOGGER.info('Starting audit validation for GitLab Merge Requests 4-eyes approval')
-    gl = gitlab.Gitlab(url, token)
+    gl = gitlab.Gitlab(url, token, retry_transient_errors=True, timeout=60)
 
     LOGGER.info('Getting the groups recursively')
     gl_groups = []
@@ -189,21 +260,28 @@ def audit(url: str, token: str, config: Config) -> list[ProjectMRAuditResult]:
 
     LOGGER.info('Getting the projects under the groups')
     gl_projects = []
+    default_branches: dict[str, str | None] = {}
     for group in gl_groups:
         group_projects = group.projects.list(all=True, archived=False)
         LOGGER.info('  Group %s: %d project(s)', group.full_path, len(group_projects))
         for project in group_projects:
-            LOGGER.info('    Project: %s', project.path_with_namespace)
+            LOGGER.info('    Project: %s (default branch: %s)', project.path_with_namespace, project.default_branch)
+            default_branches[project.path_with_namespace] = project.default_branch
             gl_projects.append((project.path_with_namespace, gl.projects.get(project.id, lazy=True)))
     LOGGER.info('Found %d project(s)', len(gl_projects))
 
     LOGGER.info('Getting the merge requests under the projects')
+    years = config.gitlab.audit.years
     gl_project_mrs = get_mrs_by_projects(
         projects=gl_projects,
-        filters=[mr_is_merged, partial(mr_updated_in_years, years=config.gitlab.audit.years)],
+        state='merged',
+        updated_after=f'{min(years)}-01-01T00:00:00Z',
+        updated_before=f'{max(years) + 1}-01-01T00:00:00Z',
+        iterator=True,
+        per_page=50,
     )
 
     LOGGER.info('Evaluating merge requests for 4-eyes approval')
-    results = evaluate_mrs_4eyes_per_project(gl_project_mrs)
+    results = evaluate_mrs_4eyes_per_project(gl_project_mrs, default_branches)
     results = filter_empty_results_by_field(results, 'mr_results')
     return sort_results_by_field(results, 'passed')