hyperi-ci 2.7.1__tar.gz → 2.7.2__tar.gz

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/.github/workflows/_release-tail.yml

@@ -70,6 +70,10 @@ on:
         type: string
         default: "stable"
         description: "Rust toolchain (only used when language=rust)"
+      submodules:
+        type: string
+        default: ""
+        description: "Space-separated submodule paths to init before the container build (e.g. 'schemas'), so a Dockerfile can bake submodule content. Empty (default) inits nothing."
 
 env:
   HYPERCI_INSTALL: uvx --no-cache --refresh hyperi-ci
@@ -108,6 +112,12 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
 
+      - name: Init submodules
+        if: ${{ inputs.submodules != '' }}
+        env:
+          SUBMODULES: ${{ inputs.submodules }}
+        run: git submodule update --init --depth 1 $SUBMODULES
+
       - name: Install uv
         # Needed to run the resolve step below. Cheap, no Docker Hub —
         # so a library never pays the Buildx/Docker-Hub cost (issue #33).

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/.github/workflows/ci.yml

@@ -70,6 +70,33 @@ jobs:
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages -- dogfoods the same job
+    # the reusable <lang>-ci.yml workflows now ship. Deliberately NOT gated on
+    # plan.outputs.run-checks: it must validate what actually reaches main on
+    # EVERY merge, not only publish-worthy pushes. Fatal on push to main (what
+    # lands); advisory on pull_request. Runs the LOCAL branch code (uv run) so
+    # this repo's own PRs exercise the change. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install dependencies
+        run: uv sync --no-sources
+      - name: Validate commit messages
+        run: uv run --no-sources hyperi-ci check-commits
+
   quality:
     name: Quality
     runs-on: ubuntu-latest

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/.github/workflows/go-ci.yml

@@ -155,6 +155,30 @@ jobs:
           fi
           echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -200,12 +224,11 @@ jobs:
       - name: Install native dependencies
         run: ${{ env.HYPERCI_INSTALL }} install-native-deps golang
 
-      - name: Deepen history for commit validation
-        # The quality checkout is depth-1; commit validation (issue #52) needs
-        # the pushed range before..after, which includes `before` and any
-        # merge-imported commits. Deepen so the range resolves. Harmless on an
-        # already-full clone. If skipped, the quality stage validates HEAD only
-        # and warns loudly -- it never silently passes having checked nothing.
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
         if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
         run: git fetch --deepen=200 origin
 
@@ -356,4 +379,5 @@ jobs:
       from-head: ${{ inputs.from-head }}
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/.github/workflows/python-ci.yml

@@ -140,6 +140,30 @@ jobs:
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -174,12 +198,11 @@ jobs:
       - name: Install dependencies
         run: uv sync --frozen --all-extras
 
-      - name: Deepen history for commit validation
-        # The quality checkout is depth-1; commit validation (issue #52) needs
-        # the pushed range before..after, which includes `before` and any
-        # merge-imported commits. Deepen so the range resolves. Harmless on an
-        # already-full clone. If skipped, the quality stage validates HEAD only
-        # and warns loudly -- it never silently passes having checked nothing.
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
         if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
         run: git fetch --deepen=200 origin
 
@@ -354,4 +377,5 @@ jobs:
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
       python-version: ${{ inputs.python-version }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/.github/workflows/rust-ci.yml

@@ -173,6 +173,30 @@ jobs:
           fi
           echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -226,12 +250,11 @@ jobs:
       - name: Setup osv-scanner
         uses: hyperi-io/hyperi-ci/.github/actions/setup-osv-scanner@main
 
-      - name: Deepen history for commit validation
-        # The quality checkout is depth-1; commit validation (issue #52) needs
-        # the pushed range before..after, which includes `before` and any
-        # merge-imported commits. Deepen so the range resolves. Harmless on an
-        # already-full clone. If skipped, the quality stage validates HEAD only
-        # and warns loudly -- it never silently passes having checked nothing.
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
         if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
         run: git fetch --deepen=200 origin
 
@@ -411,4 +434,5 @@ jobs:
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
       rust-toolchain: ${{ inputs.rust-toolchain }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/.github/workflows/ts-ci.yml

@@ -137,6 +137,30 @@ jobs:
           from-head: ${{ inputs.from-head }}
           bump: ${{ inputs.bump }}
 
+  commit-check:
+    name: Commit messages
+    # Landing gate for conventional-commit messages. Deliberately NOT gated
+    # on plan.outputs.run-checks: a cheap git-log + regex check must validate
+    # what actually reaches main on EVERY merge, not only publish-worthy
+    # pushes (all the quality job covers). Fatal on push to main (what lands);
+    # advisory on pull_request (branch commits may be squashed away -- see
+    # commit_validation.run). Feature-branch pushes skip it, so the fast
+    # chore-skip path is untouched. See CLAUDE.md CI gate doctrine.
+    if: >-
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: false
+      - name: Validate commit messages
+        run: ${{ env.HYPERCI_INSTALL }} check-commits
+
   quality:
     name: Quality
     needs: [plan]
@@ -197,12 +221,11 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           "$HOME/.local/bin/osv-scanner" --version
 
-      - name: Deepen history for commit validation
-        # The quality checkout is depth-1; commit validation (issue #52) needs
-        # the pushed range before..after, which includes `before` and any
-        # merge-imported commits. Deepen so the range resolves. Harmless on an
-        # already-full clone. If skipped, the quality stage validates HEAD only
-        # and warns loudly -- it never silently passes having checked nothing.
+      - name: Deepen history for secret scan
+        # gitleaks scans the branch git log for committed secrets; a depth-1
+        # checkout would only see HEAD. Deepen so the scan covers the pushed
+        # range. Conventional-commit validation moved to the commit-check job
+        # (its own fetch-depth: 0 checkout). Harmless on an already-full clone.
         if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
         run: git fetch --deepen=200 origin
 
@@ -364,4 +387,5 @@ jobs:
       from-head: ${{ inputs.from-head }}
       bump: ${{ inputs.bump }}
       publish-target: ${{ inputs.publish-target }}
+      submodules: ${{ inputs.submodules }}
     secrets: inherit

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hyperi-ci
-Version: 2.7.1
+Version: 2.7.2
 Summary: HyperI CI/CD CLI tool — multi-language build, test, and publish automation
 Project-URL: Homepage, https://github.com/hyperi-io/hyperi-ci
 Project-URL: Repository, https://github.com/hyperi-io/hyperi-ci

hyperi_ci-2.7.2/VERSION

@@ -0,0 +1 @@
+2.7.2

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/docs/ARCHITECTURE.md

@@ -82,11 +82,21 @@ the single place language divergence is allowed.
 | Job | needs | if | Purpose |
 |---|---|---|---|
 | `plan` | — | always | Decide if this run is publish-worthy; emit gate outputs |
+| `commit-check` | — | push-to-main OR `pull_request` | Conventional-commit **landing gate** — fatal on push to main (validates what lands), advisory on PRs. NOT `run-checks`-gated (see below) |
 | `quality` | `[plan]` | `run-checks` | Lint / typecheck / security scan |
 | `test` | `[plan]` | `run-checks` | Unit + integration tests |
 | `build` | `[plan, quality, test]` | `run-build` | Compile binaries / wheels / packages, stamp version, upload `dist/` |
 | `release-tail` | `[plan, build]` | own gates | Container + tag-and-publish, via shared `_release-tail.yml` |
 
+`commit-check` is deliberately **independent of `plan` / `run-checks`**: that
+gate skips the quality job on ordinary (non-publish) merges to main, so a bad
+conventional-commit message could otherwise land unvalidated. It is a cheap
+git-log + regex check (no compile/publish), fatal on the push that actually
+reaches main and advisory on PRs (branch commits may be squashed away — only
+the squash subject lands). Feature-branch pushes skip it, preserving the
+chore-skip fast path. Logic: `hyperi_ci.quality.commit_validation.run`; the
+local `hyperi-ci check` runs the same validation over `origin/main..HEAD`.
+
 ### Gate outputs (computed in `plan`)
 
 | Output | True when | Effect |
@@ -115,13 +125,14 @@ flowchart LR
 
 ### What runs when
 
-| Push type | plan | quality | test | build | container | tag+publish |
-|---|---|---|---|---|---|---|
-| `chore:` / `docs:` to main | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
-| `feat:`/`fix:` to main, no `Publish:` trailer | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
-| `feat:`/`fix:` to main + `Publish: true` | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
-| Pull request | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ |
-| `workflow_dispatch` (retroactive publish) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Push type | plan | commit-check | quality | test | build | container | tag+publish |
+|---|---|---|---|---|---|---|---|
+| `chore:` / `docs:` to main | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `feat:`/`fix:` to main, no `Publish:` trailer | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
+| `feat:`/`fix:` to main + `Publish: true` | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Pull request | ✓ | ✓ advisory | ✓ | ✓ | ✗ | ✗ | ✗ |
+| `workflow_dispatch` (retroactive publish) | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| push to a feature branch | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
 
 Tag-on-publish doctrine: a commit landing on main produces no tag and no
 artefacts. The operator opts in with `hyperi-ci push --publish` (adds the

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/docs/LESSONS.md

@@ -299,10 +299,12 @@ build to ensure fresh artifacts, also via `hyperi-ci run build`.
 - Detection: directory-based > marker-based > conftest-based
 - Coverage: separate `.coverage.<tier>` files, combine at end
 - No test directory: exit 0 (graceful skip)
-- Submodule-dependent tests:
+- Submodule-dependent tests or container builds:
   - Public submodule: declare `submodules: schemas` in `.hyperi-ci.yaml`;
     `hyperi-ci init` renders it as the reusable-workflow `submodules` input
-    in `ci.yml`, and the test job checks it out so the tests run.
+    in `ci.yml`. The test job checks it out so the tests run, and the
+    container build checks it out so a Dockerfile can bake submodule
+    content into the image.
   - Private submodule (e.g. `dfe-schemas` while private): GITHUB_TOKEN can't
     clone it, so mark dependent tests with
     `@pytest.mark.skipif(not schemas_dir.exists(), reason="submodule not checked out")`

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/src/hyperi_ci/cli.py

@@ -674,6 +674,23 @@ def check_commit_cmd(
     raise typer.Exit(1)
 
 
+@app.command(name="check-commits")
+def check_commits_cmd() -> None:
+    """Validate the conventional-commit messages in the CI push/PR range.
+
+    Landing-gate counterpart to `check-commit` (single message, local
+    commit-msg hook). Resolves the range from the CI event -- push
+    before..after (what lands on main) or PR base..HEAD -- validates each
+    commit, and is FATAL on push but ADVISORY on pull_request (branch
+    commits may be squashed away). CI-only; a no-op locally. Driven by the
+    dedicated `commit-check` workflow job, NOT the run-checks-gated quality
+    job -- so a merge to main is validated even when it is not a publish.
+    """
+    from hyperi_ci.quality.commit_validation import run
+
+    raise typer.Exit(run())
+
+
 def _publish_impl(
     tag: str | None,
     list_tags: bool,

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/src/hyperi_ci/dispatch.py

@@ -169,22 +169,30 @@ def stage_setup(language: str, config: CIConfig) -> int:
     return rc
 
 
-def stage_quality(language: str, config: CIConfig) -> int:
+def stage_quality(language: str, config: CIConfig, *, local: bool = False) -> int:
     """Quality checks — gitleaks + language-specific checks."""
     if not config.get("quality.enabled", True):
         info("Quality checks disabled in configuration")
         return 0
 
-    # Cross-language checks first
+    # Cross-language checks first.
     with group("Gitleaks secret scanning"):
         rc = gitleaks.run(config)
         if rc != 0:
             return rc
 
-    with group("Commit message validation"):
-        rc = commit_validation.run(config)
-        if rc != 0:
-            return rc
+    # Commit-message validation. In CI this is the dedicated `commit-check`
+    # workflow job -- it runs on every merge to main (not just the
+    # publish-worthy pushes the run-checks-gated quality job covers) and is
+    # advisory on PRs. There is no such job for a LOCAL `hyperi-ci check`,
+    # so run it here over the unpushed range (origin/main..HEAD) as a
+    # pre-push backstop -- catch a bad message before the push, not after.
+    # See hyperi_ci.quality.commit_validation.run + CLAUDE.md CI gate doctrine.
+    if local:
+        with group("Commit message validation"):
+            rc = commit_validation.run(config, local=True)
+            if rc != 0:
+                return rc
 
     extra_env: dict[str, str] = {}
     if language == "rust":
@@ -440,9 +448,11 @@ def run_stage(
         info(f"Project status: {status}{_STATUS_CLARIFIER.get(status, '')}")
 
     handler = _STAGE_HANDLERS[stage]
-    if stage == "build":
-        # The build handler takes `local`; the others do not. _STAGE_HANDLERS
-        # is typed to the common (no-local) signature, so cast for this branch.
+    if stage in ("build", "quality"):
+        # build + quality take `local` (build skips cross-targets; quality
+        # runs the commit-message backstop only for a local `hyperi-ci
+        # check`). _STAGE_HANDLERS is typed to the common (no-local)
+        # signature, so cast for this branch.
         rc = cast("Any", handler)(language, config, local=local)
     else:
         rc = handler(language, config)

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/src/hyperi_ci/quality/commit_validation.py

@@ -498,12 +498,35 @@ def _get_commits_to_validate() -> tuple[list[tuple[str, str]], bool]:
     return [], False
 
 
-def run(config: CIConfig, extra_env: dict[str, str] | None = None) -> int:
-    """Validate commit messages in the current branch.
-
-    Only runs inside CI (is_ci() guard). Returns 0 on success, 1 on failure.
+def run(
+    config: CIConfig | None = None,
+    extra_env: dict[str, str] | None = None,
+    *,
+    local: bool = False,
+) -> int:
+    """Validate commit messages in the CI push/PR range (or the local range).
+
+    ``config`` is unused (kept for call-site symmetry) so the CLI
+    ``check-commits`` command can call ``run()`` bare.
+
+    Behaviour by event:
+
+    - ``push`` (what lands on main) -> FATAL: a failing commit returns 1.
+      This is the real landing gate -- the run-checks gate skips the
+      quality job on non-publish main pushes, so this dedicated check is
+      where merge-to-main enforcement lives.
+    - ``pull_request`` -> ADVISORY: failures are warned, returns 0. The
+      branch commits validated on a PR may be discarded by a squash-merge
+      (only the squash subject lands) and are never re-validated on the
+      merge push, so a PR gets feedback rather than a hard red.
+
+    ``local=True`` runs the same check outside CI (``hyperi-ci check``
+    pre-push backstop): with no CI event the range falls back to
+    ``origin/main..HEAD`` (the unpushed commits) and is FATAL, so a bad
+    message is caught before the push, not after. Without ``local`` the
+    check is a no-op outside CI (the commit-msg hook covers authoring).
     """
-    if not is_ci():
+    if not local and not is_ci():
         info("Skipping commit message validation (not in CI)")
         return 0
 
@@ -543,10 +566,25 @@ def run(config: CIConfig, extra_env: dict[str, str] | None = None) -> int:
             failures.append((commit_hash, full_msg, result))
 
     if failures:
+        # Advisory on a PR, fatal on push. See the run() docstring: PR
+        # branch commits may be squashed away and are never re-validated
+        # on the merge-to-main push, so a PR gets feedback -- not a hard
+        # red -- while the push that lands on main stays enforced.
+        advisory = os.environ.get("GITHUB_EVENT_NAME", "") == "pull_request"
+        emit = warn if advisory else error
         for commit_hash, full_msg, result in failures:
             short_hash = commit_hash[:8]
             rejection = format_rejection(result, full_msg)
-            error(f"[{short_hash}] {rejection}")
+            emit(f"[{short_hash}] {rejection}")
+
+        if advisory:
+            warn(
+                f"{len(failures)} commit(s) would fail validation on merge to "
+                "main. Advisory on a PR -- only the commit(s) that LAND on main "
+                "are enforced. If you squash-merge, make the squash subject a "
+                "valid conventional commit (that single line is what lands)."
+            )
+            return 0
 
         error(
             f"{len(failures)} commit(s) failed validation. "

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/tests/unit/test_commit_validation.py

@@ -649,12 +649,17 @@ class TestRunDegraded:
         payload = _write_push_event(tmp_path, "0" * 40, "HEAD")
         monkeypatch.setenv("GITHUB_EVENT_PATH", str(payload))
         monkeypatch.setattr(cv, "is_ci", lambda: True)
+        # Capture the (legitimate) degraded warning so it doesn't leak into
+        # CI logs from the test run itself.
+        warns: list[str] = []
+        monkeypatch.setattr(cv, "warn", lambda m: warns.append(m))
 
         from hyperi_ci.config import CIConfig
 
         rc = cv.run(CIConfig())
         # Degraded, but HEAD is invalid -> must FAIL, not silent-pass.
         assert rc == 1
+        assert any("DEGRADED" in w for w in warns)  # warns loudly, never silent
 
     def test_degraded_head_valid_passes(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
@@ -666,6 +671,7 @@ class TestRunDegraded:
         payload = _write_push_event(tmp_path, "0" * 40, "HEAD")
         monkeypatch.setenv("GITHUB_EVENT_PATH", str(payload))
         monkeypatch.setattr(cv, "is_ci", lambda: True)
+        monkeypatch.setattr(cv, "warn", lambda _m: None)  # capture degraded warning
 
         from hyperi_ci.config import CIConfig
 
@@ -673,6 +679,94 @@ class TestRunDegraded:
         assert rc == 0
 
 
+def _write_pr_event(tmp_path: Path, base_sha: str) -> Path:
+    payload = tmp_path / "event.json"
+    payload.write_text(json.dumps({"pull_request": {"base": {"sha": base_sha}}}))
+    return payload
+
+
+class TestRunAdvisoryOnPR:
+    """On a pull_request a failing commit is ADVISORY (warn, exit 0): branch
+    commits may be squashed away and are never re-validated on the merge-to-
+    main push. The push path stays FATAL (see TestRunDegraded)."""
+
+    def test_pr_failure_is_advisory(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        repo = _repo(tmp_path)
+        base = _commit(repo, "fix: base")
+        # GitHub branch-normalised squashy subject -> no valid prefix.
+        _git(repo, "commit", "--allow-empty", "-q", "-m", "Feat/bad squashy subject")
+        monkeypatch.chdir(repo)
+        monkeypatch.setenv("GITHUB_EVENT_NAME", "pull_request")
+        monkeypatch.setenv("GITHUB_EVENT_PATH", str(_write_pr_event(tmp_path, base)))
+        monkeypatch.setattr(cv, "is_ci", lambda: True)
+        warns: list[str] = []
+        errors: list[str] = []
+        monkeypatch.setattr(cv, "warn", lambda m: warns.append(m))
+        monkeypatch.setattr(cv, "error", lambda m: errors.append(m))
+
+        from hyperi_ci.config import CIConfig
+
+        rc = cv.run(CIConfig())
+        # Advisory: a bad commit must NOT hard-fail a PR...
+        assert rc == 0
+        # ...but the problem is still surfaced, via warn (not error).
+        assert any("would fail validation on merge to main" in w for w in warns)
+        assert errors == []
+
+    def test_pr_all_valid_passes(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        repo = _repo(tmp_path)
+        base = _commit(repo, "fix: base")
+        _commit(repo, "fix: good change")
+        monkeypatch.chdir(repo)
+        monkeypatch.setenv("GITHUB_EVENT_NAME", "pull_request")
+        monkeypatch.setenv("GITHUB_EVENT_PATH", str(_write_pr_event(tmp_path, base)))
+        monkeypatch.setattr(cv, "is_ci", lambda: True)
+
+        from hyperi_ci.config import CIConfig
+
+        rc = cv.run(CIConfig())
+        assert rc == 0
+
+
+class TestRunLocal:
+    """`local=True` (hyperi-ci check pre-push) validates the unpushed range
+    outside CI and is FATAL -- catch a bad message before the push. Without
+    it, run() is a no-op outside CI."""
+
+    def test_local_validates_range_and_is_fatal(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        repo = _repo(tmp_path)
+        # Simulate origin/main at the base, one unpushed bad commit on top.
+        _commit(repo, "fix: base")
+        _git(repo, "branch", "origin/main")  # local ref standing in for origin
+        _git(repo, "commit", "--allow-empty", "-q", "-m", "Broken No Prefix")
+        monkeypatch.chdir(repo)
+        monkeypatch.delenv("GITHUB_EVENT_NAME", raising=False)
+        monkeypatch.setattr(cv, "is_ci", lambda: False)
+        monkeypatch.setattr(cv, "warn", lambda _m: None)
+        monkeypatch.setattr(cv, "error", lambda _m: None)
+
+        rc = cv.run(local=True)
+        assert rc == 1  # not in CI, but local=True -> fatal on the bad commit
+
+    def test_not_local_and_not_ci_is_noop(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        repo = _repo(tmp_path)
+        _git(repo, "commit", "--allow-empty", "-q", "-m", "Broken No Prefix")
+        monkeypatch.chdir(repo)
+        monkeypatch.delenv("GITHUB_EVENT_NAME", raising=False)
+        monkeypatch.setattr(cv, "is_ci", lambda: False)
+
+        rc = cv.run()  # no local, not CI -> skip entirely
+        assert rc == 0
+
+
 def test_is_zero_sha() -> None:
     assert cv._is_zero_sha("0" * 40) is True
     assert cv._is_zero_sha("0" * 7) is True

{hyperi_ci-2.7.1 → hyperi_ci-2.7.2}/tests/unit/test_quality_ignores.py

@@ -195,7 +195,11 @@ class TestExpires:
         assert len(entries) == 1
         assert entries[0].expires == date.today() + timedelta(days=30)
 
-    def test_past_expiry_is_dropped(self) -> None:
+    def test_past_expiry_is_dropped(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        # Capture the lapse warning so it doesn't leak into CI logs as a false
+        # "quality.ignore lapsed" annotation (the drop is asserted; that the
+        # warning fires is covered by test_lapsed_entry_is_logged).
+        monkeypatch.setattr("hyperi_ci.quality.ignores.warn", lambda _m: None)
         past = (date.today() - timedelta(days=1)).isoformat()
         raw = {
             "quality": {
@@ -252,7 +256,12 @@ class TestExpires:
                 }
             )
 
-    def test_batch_with_expiry_drops_whole_stanza_when_past(self) -> None:
+    def test_batch_with_expiry_drops_whole_stanza_when_past(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        # Capture the lapse warning (see test_past_expiry_is_dropped) so it
+        # doesn't surface as a false CI annotation.
+        monkeypatch.setattr("hyperi_ci.quality.ignores.warn", lambda _m: None)
         past = (date.today() - timedelta(days=5)).isoformat()
         raw = {
             "quality": {