diff --git a/README.md b/README.md index e42471e..677a639 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,8 @@ jobs: pr-title: ${{ github.event.pull_request.title }} pr-author: ${{ github.event.pull_request.user.login }} pr-body: ${{ github.event.pull_request.body }} + server-url: ${{ github.server_url }} + token: ${{ github.token }} base-sha: ${{ github.event.pull_request.base.sha }} head-sha: ${{ github.event.pull_request.head.sha }} ``` @@ -52,12 +54,14 @@ job — the step still fails, but the job cannot block the PR. | `pr-title` | yes | PR title — `github.event.pull_request.title` | | `pr-author` | no | PR author login — `github.event.pull_request.user.login`; `dfritz` is exempt | | `pr-body` | yes | PR description — `github.event.pull_request.body` | +| `server-url` | yes | Gitea server URL — `github.server_url` | +| `token` | yes | Gitea Actions token — `github.token` | | `base-sha` | yes | Base commit — `github.event.pull_request.base.sha` | | `head-sha` | yes | Head commit — `github.event.pull_request.head.sha` | ## Behavior -The check validates four things for a Bug-backed Agent PR: +The check validates four things for every non-break-glass Agent PR: 1. **Branch form** — must be `/bug-/` or `chore/`. Unknown roles, missing `bug-` segment, uppercase bug-ids, and empty @@ -67,12 +71,17 @@ The check validates four things for a Bug-backed Agent PR: `[bug-] `. For a `chore` branch the title must have no `[bug-id]` prefix. If both carry a bug-id they must match. -3. **Tracking and attribution** — `## Tracking` contains both the literal +3. **Tracking and attribution** — on Bug-backed work, `## Tracking` contains both the literal `Fixes bug-` automation token and the matching navigable - `https://agenthub.fritzlab.net/bug-` URL. A separate `## Attribution` - section contains the canonical `Authored-By` product/model watermark. + `https://agenthub.fritzlab.net/bug-` URL. Every PR has a separate + `## Attribution` section containing the canonical `Authored-By` + product/model watermark. The action asks Gitea to render the body with a + bounded 5-second connection and 15-second total wait, then checks visible + `

` sections outside collapsed `
` content. Fenced, commented, + scripted, or collapsed copies do not satisfy the visible provenance contract. -4. **Commit attribution** — every commit in `base-sha..head-sha` ends with +4. **Commit attribution** — every commit in `base-sha..head-sha`, including + commits on `chore/` branches, ends with the canonical `Authored-By` trailer, separated from the message body by a blank line. The naming job must check out full history before this action. diff --git a/action.yaml b/action.yaml index 0e5c2f8..4208d19 100644 --- a/action.yaml +++ b/action.yaml @@ -29,6 +29,12 @@ inputs: pr-body: description: PR description — github.event.pull_request.body. required: true + server-url: + description: Gitea server URL — github.server_url. + required: true + token: + description: Gitea Actions token — github.token. + required: true base-sha: description: Base commit SHA — github.event.pull_request.base.sha. required: true @@ -46,6 +52,8 @@ runs: PR_TITLE: ${{ inputs.pr-title }} PR_AUTHOR: ${{ inputs.pr-author }} PR_BODY: ${{ inputs.pr-body }} + GITEA_SERVER_URL: ${{ inputs.server-url }} + GITEA_TOKEN: ${{ inputs.token }} BASE_SHA: ${{ inputs.base-sha }} HEAD_SHA: ${{ inputs.head-sha }} run: bash "${{ github.action_path }}/check.sh" diff --git a/check.sh b/check.sh index a664607..f6355fa 100755 --- a/check.sh +++ b/check.sh @@ -10,6 +10,8 @@ AUTHOR="${PR_AUTHOR:-}" BODY="${PR_BODY:-}" BASE="${BASE_SHA:-}" HEAD="${HEAD_SHA:-}" +SERVER_URL="${GITEA_SERVER_URL:-}" +TOKEN="${GITEA_TOKEN:-}" # Break-glass: dfritz is exempt from all naming checks. if [ "${AUTHOR}" = "dfritz" ]; then @@ -21,6 +23,64 @@ FAILED=0 BRANCH_KIND="invalid" BRANCH_BUG="" +# Gitea's renderer is the visibility contract. Validate its output instead of +# maintaining a second Markdown parser in this action. +RENDERED_BODY="" +if [ -z "${SERVER_URL}" ] || [ -z "${TOKEN}" ]; then + echo "FAIL[check-naming]: server-url and token are required to render the PR body" + FAILED=1 +elif ! RENDERED_BODY=$(printf '%s' "${BODY}" | + jq -Rs '{Text: ., Mode: "gfm"}' | + curl --fail --silent --show-error \ + --connect-timeout 5 \ + --max-time 15 \ + --header "Authorization: token ${TOKEN}" \ + --header "Content-Type: application/json" \ + --data-binary @- "${SERVER_URL%/}/api/v1/markdown"); then + echo "FAIL[check-naming]: Gitea could not render the PR body" + FAILED=1 +fi + +# A collapsed disclosure is valid supporting content, but provenance inside one +# is not visible by default. Remove only collapsed details subtrees; an open +# disclosure remains visible unless one of its ancestors is collapsed. +VISIBLE_BODY=$(printf '%s\n' "${RENDERED_BODY}" | + awk ' + { + line=$0 "\n" + for (i=1; i<=length(line); i++) { + char=substr(line, i, 1) + if (in_tag) { + tag=tag char + if (char == ">") { + lower=tolower(tag) + if (lower ~ /^])/) { + attributes=lower + gsub(/"[^"]*"/, "", attributes) + parent_hidden=(details_depth > 0 && hidden[details_depth]) + details_depth++ + hidden[details_depth]=(parent_hidden || attributes !~ /[[:space:]]open([[:space:]=>]|$)/) + } + else if (lower ~ /^<\/details([[:space:]>])/) { + if (details_depth > 0) { + delete hidden[details_depth] + details_depth-- + } + } + else if (!hidden[details_depth]) printf "%s", tag + in_tag=0 + tag="" + } + } + else if (char == "<") { + in_tag=1 + tag=char + } + else if (!hidden[details_depth]) printf "%s", char + } + } + ') + # ---- branch form ---- # /bug-/ if echo "${BRANCH}" | grep -qE "^(dev|ux|ops|security|perf|architect|support)/bug-[a-z0-9]+/[a-z0-9][a-z0-9-]*$"; then @@ -53,16 +113,16 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then FAILED=1 fi - tracking=$(printf '%s\n' "${BODY}" | awk ' - /^## Tracking[[:space:]]*$/ { in_section=1; next } - /^## / && in_section { exit } + tracking=$(printf '%s\n' "${VISIBLE_BODY}" | awk ' + /]*>Tracking<\/h2>/ { in_section=1; next } + /]*>/ && in_section { exit } in_section { print } ') if [ -z "${tracking}" ]; then echo "FAIL[check-naming]: PR body must contain a non-empty ## Tracking section" FAILED=1 else - if ! printf '%s\n' "${tracking}" | grep -qE "(^|[[:space:]])Fixes[[:space:]]+${BRANCH_BUG}([^a-z0-9]|$)"; then + if ! printf '%s\n' "${tracking}" | grep -qE "(^|[[:space:]>])Fixes[[:space:]]+${BRANCH_BUG}([^a-z0-9]|$)"; then echo "FAIL[check-naming]: ## Tracking must contain the literal token 'Fixes ${BRANCH_BUG}'" FAILED=1 fi @@ -72,12 +132,18 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then fi fi - attribution=$(printf '%s\n' "${BODY}" | awk ' - /^## Attribution[[:space:]]*$/ { in_section=1; next } - /^## / && in_section { exit } +elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then + echo "FAIL[check-naming]: chore branch should not carry a [bug-id] title prefix" + FAILED=1 +fi + +if [ "${BRANCH_KIND}" != "invalid" ]; then + attribution=$(printf '%s\n' "${VISIBLE_BODY}" | awk ' + /]*>Attribution<\/h2>/ { in_section=1; next } + /]*>/ && in_section { exit } in_section { print } ') - watermark_re='^[-*]?[[:space:]]*Authored-By: .+ \(.+\) $' + watermark_re='Authored-By: .+ \(.+\) ]*>noreply@[[:alnum:].-]+' if ! printf '%s\n' "${attribution}" | grep -qE "${watermark_re}"; then echo "FAIL[check-naming]: ## Attribution must contain an Authored-By product/model watermark" FAILED=1 @@ -118,9 +184,6 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then echo "FAIL[check-naming]: base-sha and head-sha must be lowercase hexadecimal commit SHAs" FAILED=1 fi -elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then - echo "FAIL[check-naming]: chore branch should not carry a [bug-id] title prefix" - FAILED=1 fi if [ "${FAILED}" -eq 0 ]; then diff --git a/tests/bin/curl b/tests/bin/curl new file mode 100755 index 0000000..3832ec0 --- /dev/null +++ b/tests/bin/curl @@ -0,0 +1,87 @@ +#!/usr/bin/env bash +# Deterministic Gitea Markdown renderer stub for check.sh contract tests. +set -euo pipefail + +connect_timeout=0 +total_timeout=0 +while [ "$#" -gt 0 ]; do + case "$1" in + --connect-timeout) + [ "${2:-}" = "5" ] || exit 2 + connect_timeout=1 + shift 2 + ;; + --max-time) + [ "${2:-}" = "15" ] || exit 2 + total_timeout=1 + shift 2 + ;; + *) shift ;; + esac +done +[ "${connect_timeout}" -eq 1 ] && [ "${total_timeout}" -eq 1 ] || exit 2 + +if printf '%s\n' "${PR_BODY}" | grep -Fq '[[stall-renderer]]'; then + exit 28 +fi + +if printf '%s\n' "${PR_BODY}" | grep -Fq '' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "comment removal cannot synthesize section headings" \ + $'## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) ' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "four-space indented backticks do not expose comments" \ + $' ````\n' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "unequal backtick runs do not expose comments" \ + $'`' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "invalid backtick fence info does not expose comments" \ + $'```html`oops\n' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "invalid fence closer does not expose comments" \ + $'```html\n```oops\n```\n' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "fences inside comments do not expose provenance" \ + $'' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "escaped backticks do not hide a comment opener" \ + $'\\`' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "fenced provenance does not satisfy the visible contract" \ + $'```\n```oops\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) ' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "indented fence closer does not expose provenance" \ + $'```\n ```\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) \n```' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract_pass "fenced code examples remain available" \ + $'```html\n\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) ' \ + "$BASE" "$GOOD_HEAD" +check_contract "details cannot collapse provenance" \ + $'
Release notes\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) \n
' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract_pass "open details preserve visible provenance" \ + $'
Release notes\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) \n
' \ + "$BASE" "$GOOD_HEAD" +check_contract "open details inside collapsed details remain hidden" \ + $'
Release notes\n
Visible only after expansion\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) \n
\n
' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "open text in another details attribute remains collapsed" \ + $'
Release notes\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) \n
' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract_pass "unrelated collapsed details remain available" \ + $'
Logs\n\nSupporting output\n
\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) ' \ + "$BASE" "$GOOD_HEAD" +check_contract "script cannot suppress provenance" \ + $'' \ + "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section" +check_contract "stalled renderer fails closed at the curl timeout" \ + "$(canonical_body bug-x7k2m9)"$'\n[[stall-renderer]]' \ + "$BASE" "$GOOD_HEAD" "Gitea could not render the PR body" git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change" BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD) check_contract "agenthub 779 commits reject missing watermark" "$BODY" "$GOOD_HEAD" "$BAD_HEAD" "must end with an Authored-By" +check_chore_contract "chore requires PR attribution" "" "$BASE" "$GOOD_HEAD" "## Attribution must contain" +check_chore_contract "chore commits require watermark" "$(canonical_body bug-unused)" "$GOOD_HEAD" "$BAD_HEAD" "must end with an Authored-By" git -C "${FIXTURES}" commit --allow-empty -q -m $'misplaced trailer\nAuthored-By: Codex (GPT-5) ' MISPLACED_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)