sase-github 0.2.8__tar.gz → 0.2.10__tar.gz

sase_github-0.2.10/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.2.10"
+}

{sase_github-0.2.8 → sase_github-0.2.10}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.2.10](https://github.com/sase-org/sase-github/compare/v0.2.9...v0.2.10) (2026-09-08)
+
+
+### Bug Fixes
+
+* **gh:** reject non-github setup workspaces ([f032e91](https://github.com/sase-org/sase-github/commit/f032e91b0b10a5a71af913b7d2ad424e1700b93c))
+
+## [0.2.9](https://github.com/sase-org/sase-github/compare/v0.2.8...v0.2.9) (2026-08-29)
+
+
+### Features
+
+* **workspace:** identity-check #gh release and skip on handoff ([2571c9d](https://github.com/sase-org/sase-github/commit/2571c9d7466d4c6020a87b6ee86068c12170cdab))
+
 ## [0.2.8](https://github.com/sase-org/sase-github/compare/v0.2.7...v0.2.8) (2026-08-29)
 
 

{sase_github-0.2.8 → sase_github-0.2.10}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: sase-github
-Version: 0.2.8
+Version: 0.2.10
 Summary: GitHub VCS plugin for sase
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: sase>=0.11.0
+Requires-Dist: sase>=0.17.0
 Provides-Extra: dev
 Requires-Dist: mypy; extra == 'dev'
 Requires-Dist: pytest; extra == 'dev'

{sase_github-0.2.8 → sase_github-0.2.10}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sase-github"
-version = "0.2.8"
+version = "0.2.10"
 description = "GitHub VCS plugin for sase"
 requires-python = ">=3.12"
 license = "MIT"
 license-files = ["LICENSE"]
-dependencies = ["sase>=0.11.0"]
+dependencies = ["sase>=0.17.0"]
 
 [project.optional-dependencies]
 dev = [

sase_github-0.2.10/src/sase_github/scripts/gh_release.py

@@ -0,0 +1,27 @@
+"""Release step for the #gh xprompt workflow."""
+
+from sase.workspace_provider.vcs_release import VcsReleaseResult, release_vcs_workspace
+
+_CALLER_TAG = "gh-release"
+
+
+def main(
+    *,
+    project_file: str,
+    workspace_num: int,
+    workspace_dir: str,
+    workflow_name: str,
+    cl_name: str | None,
+) -> None:
+    """Identity-checked, handoff-aware release of the #gh workspace claim."""
+    result: VcsReleaseResult = release_vcs_workspace(
+        project_file=project_file,
+        workspace_num=workspace_num,
+        workspace_dir=workspace_dir,
+        workflow_name=workflow_name,
+        cl_name=cl_name,
+        caller_tag=_CALLER_TAG,
+    )
+    print(f"released={'true' if result.released else 'false'}")
+    if result.skip_reason:
+        print(f"skip_reason={result.skip_reason}")

{sase_github-0.2.8 → sase_github-0.2.10}/src/sase_github/scripts/gh_setup.py

@@ -1,6 +1,7 @@
 """Setup step for the #gh xprompt workflow."""
 
 import os
+import subprocess
 import sys
 
 from sase.core.occupancy_guard import OccupancyCaller, ensure_workspace_not_occupied
@@ -84,6 +85,22 @@ def main(
                 pinned=not release,
             )
 
+    try:
+        _assert_github_vcs_provider(
+            workspace_dir=workspace_dir,
+            primary_workspace_dir=resolved.primary_workspace_dir,
+        )
+    except Exception:
+        if not pre_allocated:
+            release_workspace(
+                project_file,
+                workspace_num,
+                workflow_name,
+                cl_name,
+                caller_tag=_CALLER_TAG,
+            )
+        raise
+
     # Refuse to hand this checkout to `prepare`/`checkout` if another live
     # agent still occupies it. Runs on the pre_allocated branch too: the
     # launcher already wrote its own occupant record, and the conflict
@@ -254,6 +271,47 @@ def _materialize_or_release(
     return workspace_dir
 
 
+def _assert_github_vcs_provider(
+    *,
+    workspace_dir: str,
+    primary_workspace_dir: str,
+) -> None:
+    provider_name = _detect_vcs_provider_name(workspace_dir)
+    if provider_name == "github":
+        return
+    actual_origin = _origin_url(workspace_dir)
+    expected_origin = _origin_url(primary_workspace_dir)
+    raise RuntimeError(
+        "GitHub workflow refused workspace because its VCS provider resolved "
+        f"to {provider_name or 'unknown'!r}, not 'github'. "
+        f"workspace origin: {actual_origin or '<unreadable>'}; "
+        f"expected GitHub origin: {expected_origin or '<unreadable>'}"
+    )
+
+
+def _detect_vcs_provider_name(workspace_dir: str) -> str | None:
+    from sase.vcs_provider import detect_vcs
+
+    return detect_vcs(workspace_dir)
+
+
+def _origin_url(workspace_dir: str) -> str | None:
+    try:
+        result = subprocess.run(
+            ["git", "config", "--get", "remote.origin.url"],
+            cwd=workspace_dir,
+            capture_output=True,
+            text=True,
+            check=False,
+            timeout=10,
+        )
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+        return None
+    if result.returncode != 0:
+        return None
+    return result.stdout.strip() or None
+
+
 def _describe_workspace_occupant(project_file: str, workspace_num: int) -> str | None:
     occupants = [
         claim

{sase_github-0.2.8 → sase_github-0.2.10}/src/sase_github/scripts/new_pr_desc_get_context.py

@@ -7,10 +7,7 @@ from pathlib import Path
 
 from sase.workspace_provider.utils import get_default_branch, parse_workspace_dir
 
-try:
-    from sase.ace.patch import find_all_patches
-except ImportError:  # Older supported SASE releases expose only ChangeSpec names.
-    from sase.ace.changespec import find_all_changespecs as find_all_patches
+from sase.ace.patch import find_all_patches
 
 try:
     from sase.core.paths import (  # type: ignore[attr-defined]

{sase_github-0.2.8 → sase_github-0.2.10}/src/sase_github/workspace_plugin.py

@@ -17,19 +17,8 @@ from collections.abc import Mapping, Sequence
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Literal
 
-try:
-    from sase.ace.patch import Patch, find_all_patches
-    from sase.ace.patch.project_spec_path import preferred_project_spec_path
-except ImportError:  # Older supported SASE releases expose only ChangeSpec names.
-    from sase.ace.changespec import (  # type: ignore[no-redef]
-        # Legacy import names are adapted to canonical Patch locals.
-        ChangeSpec as Patch,
-        # Legacy import names are adapted to canonical Patch locals.
-        find_all_changespecs as find_all_patches,
-    )
-    from sase.ace.changespec.project_spec_path import (  # type: ignore[no-redef]
-        preferred_project_spec_path,
-    )
+from sase.ace.patch import Patch, find_all_patches
+from sase.ace.patch.project_spec_path import preferred_project_spec_path
 from sase.workspace_provider import (
     ExternalRepoCloneResult,
     ResolvedRef,

{sase_github-0.2.8 → sase_github-0.2.10}/src/sase_github/xprompts/gh.yml

@@ -1,5 +1,4 @@
 description: Check out a GitHub ref in an isolated workspace and show resulting changes.
-wraps_all: true
 tags: vcs, rollover
 
 input:
@@ -120,18 +119,15 @@ steps:
     finally: true
     if: "{{ setup.should_release }}"
     python: |
-      from sase.running_field import release_workspace
-      from sase.workspace_provider.occupant import clear_occupant_record
+      from sase_github.scripts.gh_release import main
 
-      release_workspace(
-          {{ setup.project_file | tojson }},
-          {{ setup.workspace_num }},
-          {{ setup.workflow_name | tojson }},
-          {{ gh_ref | tojson }} if "/" not in {{ gh_ref | tojson }} else None,
-          caller_tag="gh-release",
+      main(
+          project_file={{ setup.project_file | tojson }},
+          workspace_num={{ setup.workspace_num }},
+          workspace_dir={{ setup.workspace_dir | tojson }},
+          workflow_name={{ setup.workflow_name | tojson }},
+          cl_name={{ gh_ref | tojson }} if "/" not in {{ gh_ref | tojson }} else None,
       )
-      clear_occupant_record({{ setup.workspace_dir | tojson }})
-      print("released=true")
     output: { released: bool }
 
   - name: diff

{sase_github-0.2.8 → sase_github-0.2.10}/tests/test_gh_workspace_claims.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import os
+from collections.abc import Iterator
 from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
@@ -23,12 +24,18 @@ from sase.workspace_provider.occupant import (
     write_occupant_record,
 )
 
-from sase_github.scripts import gh_setup
+from sase_github.scripts import gh_release, gh_setup
 from sase_github.workspace_plugin import GitHubWorkspacePlugin
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
+@pytest.fixture(autouse=True)
+def _github_provider_guard_passes() -> Iterator[None]:
+    with patch("sase_github.scripts.gh_setup._assert_github_vcs_provider"):
+        yield
+
+
 def _write_project_file(
     tmp_path: Path, running_claims: list[WorkspaceClaim] | None = None
 ) -> str:
@@ -939,16 +946,99 @@ class TestWsSubmitAtomicClaim:
         )
 
 
-def test_gh_release_step_tags_caller() -> None:
+def test_gh_release_step_delegates_to_gh_release() -> None:
     text = (ROOT / "src" / "sase_github" / "xprompts" / "gh.yml").read_text(
         encoding="utf-8"
     )
-    assert 'caller_tag="gh-release"' in text
+    assert "from sase_github.scripts.gh_release import main" in text
+    assert "workspace_dir={{ setup.workspace_dir | tojson }}" in text
+    assert "release_workspace(" not in text
+    assert "clear_occupant_record(" not in text
 
 
-def test_gh_release_step_clears_occupant_record() -> None:
-    text = (ROOT / "src" / "sase_github" / "xprompts" / "gh.yml").read_text(
+def test_gh_release_caller_tag() -> None:
+    source = (ROOT / "src" / "sase_github" / "scripts" / "gh_release.py").read_text(
         encoding="utf-8"
     )
-    assert "clear_occupant_record(" in text
-    assert "setup.workspace_dir" in text.split("clear_occupant_record(", 1)[1]
+    assert '_CALLER_TAG = "gh-release"' in source
+
+
+def test_gh_release_step_releases_owned_claim_and_occupant(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    runner_pid = os.getppid()
+    project_file = _write_project_file(
+        tmp_path,
+        running_claims=[WorkspaceClaim(23, "gh-acme/widget", None, pid=runner_pid)],
+    )
+    workspace_dir = tmp_path / "widget_23"
+    workspace_dir.mkdir()
+    write_occupant_record(
+        str(workspace_dir),
+        new_occupant_record(
+            pid=runner_pid,
+            workflow="gh-acme/widget",
+            project="gh_acme__widget",
+            workspace_num=23,
+        ),
+    )
+
+    with _isolate_ledger(tmp_path):
+        gh_release.main(
+            project_file=project_file,
+            workspace_num=23,
+            workspace_dir=str(workspace_dir),
+            workflow_name="gh-acme/widget",
+            cl_name=None,
+        )
+
+    out = capsys.readouterr().out
+    assert "released=true" in out
+    assert get_claimed_workspaces(project_file) == []
+    assert read_occupant_record(str(workspace_dir)) is None
+
+
+def test_gh_release_step_skips_on_handoff(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    runner_pid = os.getppid()
+    project_file = _write_project_file(
+        tmp_path,
+        running_claims=[WorkspaceClaim(23, "gh-acme/widget", None, pid=runner_pid)],
+    )
+    workspace_dir = tmp_path / "widget_23"
+    workspace_dir.mkdir()
+    write_occupant_record(
+        str(workspace_dir),
+        new_occupant_record(
+            pid=runner_pid,
+            workflow="gh-acme/widget",
+            project="gh_acme__widget",
+            workspace_num=23,
+        ),
+    )
+    artifacts = tmp_path / "artifacts"
+    artifacts.mkdir()
+    (artifacts / ".sase_monitor_pending").write_text("{}", encoding="utf-8")
+
+    with (
+        _isolate_ledger(tmp_path),
+        patch.dict(os.environ, {"SASE_ARTIFACTS_DIR": str(artifacts)}),
+    ):
+        gh_release.main(
+            project_file=project_file,
+            workspace_num=23,
+            workspace_dir=str(workspace_dir),
+            workflow_name="gh-acme/widget",
+            cl_name=None,
+        )
+
+    out = capsys.readouterr().out
+    assert "released=false" in out
+    assert "skip_reason=handoff" in out
+    assert [claim.workspace_num for claim in get_claimed_workspaces(project_file)] == [
+        23
+    ]
+    occupant = read_occupant_record(str(workspace_dir))
+    assert occupant is not None
+    assert occupant.pid == runner_pid

sase_github-0.2.10/tests/test_new_pr_desc_get_context.py

@@ -0,0 +1,68 @@
+"""Tests for the #new_pr_desc xprompt's get-context script."""
+
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+
+from sase_github.scripts import new_pr_desc_get_context
+
+
+def test_main_reports_context_for_found_patch(
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """The script resolves the Patch through the canonical ``sase.ace.patch`` API."""
+    workspace_dir = tmp_path / "workspace"
+    workspace_dir.mkdir()
+    diff_dir = tmp_path / "gh-diffs"
+    diff_dir.mkdir()
+    entry = SimpleNamespace(
+        name="feature",
+        file_path=str(workspace_dir / "feature.sase"),
+        description="Add feature",
+    )
+
+    with (
+        patch(
+            "sase_github.scripts.new_pr_desc_get_context.find_all_patches",
+            return_value=[entry],
+        ),
+        patch(
+            "sase_github.scripts.new_pr_desc_get_context.parse_workspace_dir",
+            return_value=str(workspace_dir),
+        ),
+        patch(
+            "sase_github.scripts.new_pr_desc_get_context.get_default_branch",
+            return_value="origin/main",
+        ),
+        patch(
+            "sase_github.scripts.new_pr_desc_get_context.subprocess.run",
+            return_value=SimpleNamespace(returncode=0, stdout=""),
+        ),
+        patch(
+            "sase_github.scripts.new_pr_desc_get_context.get_sase_managed_tmpdir",
+            return_value=str(diff_dir),
+        ),
+    ):
+        new_pr_desc_get_context.main(name="feature")
+
+    out = capsys.readouterr().out
+    assert "error=\n" in out
+    assert "description=Add feature\n" in out
+    assert "default_branch=main\n" in out
+    assert "branch_name=feature\n" in out
+
+
+def test_main_reports_error_for_missing_patch(
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    with patch(
+        "sase_github.scripts.new_pr_desc_get_context.find_all_patches",
+        return_value=[],
+    ):
+        new_pr_desc_get_context.main(name="missing")
+
+    out = capsys.readouterr().out
+    assert "error=Patch 'missing' not found\n" in out

{sase_github-0.2.8 → sase_github-0.2.10}/tests/test_workspace_plugin.py

@@ -2096,6 +2096,7 @@ class TestGhSetup:
                 "sase_github.scripts.gh_setup.materialize_sdd_store",
                 side_effect=materialize,
             ) as materialize_mock,
+            patch("sase_github.scripts.gh_setup._assert_github_vcs_provider"),
         ):
             gh_setup.main(gh_ref="acme/widget", n=None, release=False)
 
@@ -2142,6 +2143,60 @@ class TestGhSetup:
             caller_tag="gh-setup",
         )
 
+    def test_non_github_workspace_provider_releases_claimed_slot(self) -> None:
+        from sase_github.scripts import gh_setup
+
+        resolved = ResolvedRef(
+            project_file="/tmp/gh_acme__widget.sase",
+            project_name="gh_acme__widget",
+            primary_workspace_dir="/work/widget/",
+            checkout_target="origin/main",
+            canonical_ref="gh_acme__widget",
+        )
+
+        with (
+            patch("sase_github.scripts.gh_setup.resolve_ref", return_value=resolved),
+            patch.dict(os.environ, {"SASE_GH_PRE_ALLOCATED": "0"}),
+            patch(
+                "sase_github.scripts.gh_setup.ensure_workspace_checkout",
+                return_value="/work/widget_7/",
+            ),
+            patch(
+                "sase_github.scripts.gh_setup.claim_next_axe_workspace",
+                return_value=7,
+            ),
+            patch(
+                "sase_github.scripts.gh_setup.materialize_sdd_store",
+                return_value=None,
+            ),
+            patch(
+                "sase_github.scripts.gh_setup._detect_vcs_provider_name",
+                return_value="bare_git",
+            ),
+            patch(
+                "sase_github.scripts.gh_setup._origin_url",
+                side_effect=lambda path: {
+                    "/work/widget_7/": "/work/widget/",
+                    "/work/widget/": "git@github.com:acme/widget.git",
+                }[path],
+            ),
+            patch("sase_github.scripts.gh_setup.release_workspace") as release,
+            pytest.raises(RuntimeError) as exc_info,
+        ):
+            gh_setup.main(gh_ref="acme/widget", n=None, release=False)
+
+        message = str(exc_info.value)
+        assert "VCS provider resolved to 'bare_git'" in message
+        assert "workspace origin: /work/widget/" in message
+        assert "expected GitHub origin: git@github.com:acme/widget.git" in message
+        release.assert_called_once_with(
+            "/tmp/gh_acme__widget.sase",
+            7,
+            "gh-acme/widget",
+            None,
+            caller_tag="gh-setup",
+        )
+
 
 # ── detect_workflow_type (via plugin) ────────────────────────────────
 

sase_github-0.2.8/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.2.8"
-}