Public Access
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 devx-ci-bot
|
f1dc00682d | ||
 kireto
|
af24a6a771 | ||
|
gitea-actions-bot
|
457f52cba7 | ||
|
devx-ci-bot
|
5a097aa91f | ||
|
kireto
|
f9e43ce268 | ||
|
gitea-actions-bot
|
32730d551d | ||
|
devx-ci-bot
|
b75ab6f833 | ||
|
kireto
|
4b87d0b423 | ||
|
gitea-actions-bot
|
36422592fd | ||
|
devx-ci-bot
|
c8b5af3173 | ||
|
kireto
|
85f1bd9304 | ||
|
gitea-actions-bot
|
c6e895b230 | ||
|
devx-ci-bot
|
d5a0f09b71 | ||
|
kireto
|
a68df7d785 | ||
|
gitea-actions-bot
|
d1e05db642 |
@@ -2,6 +2,36 @@
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [0.55.0] - 2026-09-19
|
||||
|
||||
### Features
|
||||
|
||||
- *(ci)* Retry dep-PR container verification until publish lands
|
||||
|
||||
## [0.54.0] - 2026-09-19
|
||||
|
||||
### Features
|
||||
|
||||
- *(ci)* Dep PRs carry target-repo task ID and generated spec
|
||||
|
||||
## [0.53.3] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- *(ci)* Check out API-created dep branch via remote-tracking ref
|
||||
|
||||
## [0.53.2] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- *(ci)* Create dep-PR branches via POST /branches
|
||||
|
||||
## [0.53.1] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- *(ci)* Handle list-shaped ref response in create_dependency_pr
|
||||
|
||||
## [0.53.0] - 2026-09-19
|
||||
|
||||
### Features
|
||||
|
||||
@@ -16,12 +16,12 @@ quality badges.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Why devx?
|
||||
|
||||
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.53.0",
|
||||
"devx>=0.55.0",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
@@ -101,8 +101,8 @@ pip install -e .
|
||||
```
|
||||
|
||||
> **Note:** If your project requires a specific devx version, pin it in
|
||||
> `dependencies` (for example, `"devx==0.53.0"`) or use a version constraint
|
||||
> (for example, `"devx>=0.53.0,<0.54"`).
|
||||
> `dependencies` (for example, `"devx==0.55.0"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.0,<0.56"`).
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
+8
-8
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.53.0",
|
||||
"devx>=0.55.0",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
|
||||
```
|
||||
|
||||
Pin a specific version if needed: `"devx==0.53.0"` or `"devx>=0.53.0,<0.54"`.
|
||||
Pin a specific version if needed: `"devx==0.55.0"` or `"devx>=0.55.0,<0.56"`.
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
# DEVX-168: Fix create_dependency_pr master-ref parsing
|
||||
|
||||
## Problem
|
||||
|
||||
`devx.ci.create_dependency_pr` crashes with
|
||||
`AttributeError: 'list' object has no attribute 'get'` when creating the
|
||||
dependency branch. Gitea's `GET /repos/{o}/{r}/git/refs/heads/master`
|
||||
returns a JSON **array** of matching refs, not a single object. Observed
|
||||
in production when sso-bridge v0.4.1's post-merge dep-PR step ran.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Normalize the ref response — if it is a list, select the entry
|
||||
whose `ref` field equals `refs/heads/master` or fall back to the first
|
||||
entry; proceed to extract `object.sha` as before. An empty or absent
|
||||
SHA still fails closed.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test: list-shaped response resolves SHA and creates the PR.
|
||||
- Unit test: empty list fails with the master-SHA error message.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx releases as a version tag; sso-bridge/infra pin bumps pick it up via
|
||||
their normal dep-PR flow.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the commit; dep-PR creation stays broken on Gitea (status quo).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: list-shaped ref response is handled; SHA extraction works;
|
||||
empty list still errors. Covered by unit tests at 100% coverage.
|
||||
@@ -0,0 +1,33 @@
|
||||
# DEVX-169: create_dependency_pr uses branches API
|
||||
|
||||
## Problem
|
||||
|
||||
After DEVX-168, dep-PR creation fails at `POST /git/refs` with
|
||||
`HTTP 405 Method Not Allowed` — this Gitea version does not implement the
|
||||
createRef endpoint. Observed creating the sso_bridge 0.4.1 infra
|
||||
dependency PR.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Create the dependency branch via `POST /branches` with
|
||||
`new_branch_name`/`old_branch_name` (from master). An already-exists
|
||||
error is tolerated; other API errors fail closed.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Branch creation calls `POST /branches` with the expected payload.
|
||||
- 422 already-exists is tolerated and the PR is still created.
|
||||
- Other API errors abort with a branch-creation failure.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release tag; producers pick it up via pin bumps.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert; dep-PR creation stays broken (status quo).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: branch creation uses the branches API; already-exists
|
||||
tolerated; failures surface. Covered by unit tests at 100% coverage.
|
||||
@@ -0,0 +1,33 @@
|
||||
# DEVX-170: create_dependency_pr checks out the API-created branch
|
||||
|
||||
## Problem
|
||||
|
||||
After DEVX-169 the dependency branch is created via `POST /branches`, but
|
||||
`git fetch origin <branch>` only populates `FETCH_HEAD`. The follow-up
|
||||
`git checkout <branch>` fails silently (`check=False`), commits land on
|
||||
the wrong ref, and `git push origin <branch>` fails with
|
||||
`src refspec does not match any`. Observed creating the sso_bridge 0.4.1
|
||||
infra dependency PR.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Fetch the API-created branch into `refs/remotes/origin/<branch>`
|
||||
and force-create the local branch with `git checkout -B <branch>
|
||||
origin/<branch>`, both with `check=True` so failures surface.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test asserts the fetch refspec and `checkout -B` invocations.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release tag; producers pick it up via pin bumps.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert; dep-PR creation stays broken (status quo).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: the clone checks out the API-created branch so commit and
|
||||
push target `deps/<pkg>-<version>`; covered by unit tests.
|
||||
@@ -0,0 +1,36 @@
|
||||
# DEVX-171: create_dependency_pr uses target-project task ID + generated spec
|
||||
|
||||
## Problem
|
||||
|
||||
Dep PRs fail target-repo validation: infra requires `OBL-INFRA-N` in the
|
||||
branch name and `docs/specs/<TASK>.md` in the diff. The tool created the
|
||||
Vikunja task in the *producer's* project and named the branch
|
||||
`deps/<pkg>-<ver>` with no task ID, and wrote no spec.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: Create the tracking task before branch creation, in the target
|
||||
repo's Vikunja project via `--task-project-id` (default:
|
||||
DEVX_VIKUNJA_PROJECT_ID). Embed the returned identifier in the branch
|
||||
name (`deps/<TASK>-<pkg>-<ver>`) and PR title, and commit a generated
|
||||
`docs/specs/<TASK>.md` with the required sections alongside the pin bump.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Branch name and PR title carry the target task ID; spec file added.
|
||||
- `create_vikunja_task(project_id=N)` passes N to VikunjaClient.
|
||||
- Existing no-task behavior preserved when Vikunja is unreachable.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release tag; producer workflows pass `--task-project-id` for infra
|
||||
(project 3).
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert; dep PRs keep failing target validation (status quo).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: `--task-project-id` supported; branch/spec/PR title embed
|
||||
the target task ID; covered by unit tests at 100% coverage.
|
||||
@@ -0,0 +1,32 @@
|
||||
# DEVX-172: dep-PR retries container verification until publish lands
|
||||
|
||||
## Problem
|
||||
|
||||
Post-merge dep-PR runs concurrently with the producer's image-build
|
||||
workflow. `--verify-container` hits HTTP 404 before the push lands and
|
||||
skips PR creation — observed for sso-bridge v0.4.1 and v0.4.3.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: `resolve_container_digest(..., timeout_s)` retries a 404 lookup
|
||||
every 15s until the deadline.
|
||||
REQ-2: `--verify-timeout` CLI option (default 600s, 0 disables) wires the
|
||||
retry into the dep-PR step.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test: 404-then-200 resolves the digest without raising.
|
||||
- Existing no-retry path (timeout_s=0) still fails immediately.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release tag; producers inherit the 600s default on next pin bump.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert; dep-PR verification fails fast on 404 again (status quo).
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1: 404 responses retry until `timeout_s` deadline.
|
||||
- [x] REQ-2: `--verify-timeout` option exposed, default 600.
|
||||
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.53.0",
|
||||
"devx>=0.55.0",
|
||||
]
|
||||
|
||||
[project.optional-dependencies]
|
||||
dev = [
|
||||
"devx>=0.53.0",
|
||||
"devx>=0.55.0",
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
|
||||
molecule testing helpers for Ansible projects.
|
||||
"""
|
||||
|
||||
__version__ = "0.53.0"
|
||||
__version__ = "0.55.0"
|
||||
|
||||
@@ -22,6 +22,7 @@ from __future__ import annotations
|
||||
import re
|
||||
import subprocess # nosec B404
|
||||
import tempfile
|
||||
import time
|
||||
from datetime import UTC, datetime
|
||||
from pathlib import Path
|
||||
|
||||
@@ -95,7 +96,7 @@ def update_pinned_version(file_path: str, package: str, old_version: str, new_ve
|
||||
return changed
|
||||
|
||||
|
||||
def resolve_container_digest(api_url: str, owner: str, name: str, tag: str, token: str) -> str:
|
||||
def resolve_container_digest(api_url: str, owner: str, name: str, tag: str, token: str, timeout_s: int = 0) -> str:
|
||||
"""Resolve the OCI digest for a container image tag via the packages API.
|
||||
|
||||
Implements REQ-1: dependency PRs must only be opened after the producer
|
||||
@@ -103,34 +104,52 @@ def resolve_container_digest(api_url: str, owner: str, name: str, tag: str, toke
|
||||
the registry call fails, so the PR is never opened against an artifact
|
||||
that has not been published. The sha256 of the stored ``manifest.json``
|
||||
blob is the manifest content digest (what ``docker pull`` reports).
|
||||
|
||||
Implements REQ-2: ``timeout_s`` > 0 retries the lookup every 15s until
|
||||
the deadline — the dep-PR step races the producer's image-build
|
||||
workflow, which pushes the tag concurrently.
|
||||
"""
|
||||
url = f"{api_url}/packages/{owner}/container/{name}/{tag}/files"
|
||||
headers = {"Authorization": f"token {token}"}
|
||||
try:
|
||||
resp = requests.get(url, headers=headers, timeout=30) # nosec B310
|
||||
resp.raise_for_status()
|
||||
except requests.HTTPError as e:
|
||||
status = e.response.status_code if e.response is not None else "?"
|
||||
raise click.ClickException(
|
||||
_(
|
||||
"Container artifact {owner}/{name}:{tag} not found or unreadable (HTTP {status}). "
|
||||
"Refusing to open a dependency PR for an unpublished artifact.",
|
||||
owner=owner,
|
||||
name=name,
|
||||
tag=tag,
|
||||
status=status,
|
||||
)
|
||||
) from e
|
||||
except requests.RequestException as e:
|
||||
raise click.ClickException(
|
||||
_(
|
||||
"Registry lookup failed for {owner}/{name}:{tag}: {error}",
|
||||
owner=owner,
|
||||
name=name,
|
||||
tag=tag,
|
||||
error=e,
|
||||
)
|
||||
) from e
|
||||
deadline = time.monotonic() + timeout_s
|
||||
while True:
|
||||
try:
|
||||
resp = requests.get(url, headers=headers, timeout=30) # nosec B310
|
||||
resp.raise_for_status()
|
||||
except requests.HTTPError as e:
|
||||
if e.response is not None and e.response.status_code == 404 and time.monotonic() < deadline:
|
||||
click.echo(
|
||||
_(
|
||||
"[dep-pr] {owner}/{name}:{tag} not published yet — retrying.",
|
||||
owner=owner,
|
||||
name=name,
|
||||
tag=tag,
|
||||
)
|
||||
)
|
||||
time.sleep(15)
|
||||
continue
|
||||
status = e.response.status_code if e.response is not None else "?"
|
||||
raise click.ClickException(
|
||||
_(
|
||||
"Container artifact {owner}/{name}:{tag} not found or unreadable (HTTP {status}). "
|
||||
"Refusing to open a dependency PR for an unpublished artifact.",
|
||||
owner=owner,
|
||||
name=name,
|
||||
tag=tag,
|
||||
status=status,
|
||||
)
|
||||
) from e
|
||||
except requests.RequestException as e:
|
||||
raise click.ClickException(
|
||||
_(
|
||||
"Registry lookup failed for {owner}/{name}:{tag}: {error}",
|
||||
owner=owner,
|
||||
name=name,
|
||||
tag=tag,
|
||||
error=e,
|
||||
)
|
||||
) from e
|
||||
break
|
||||
for f in resp.json():
|
||||
if f.get("name") == "manifest.json" and f.get("sha256"):
|
||||
return f"sha256:{f['sha256']}"
|
||||
@@ -192,7 +211,7 @@ def read_manifest_version(file_path: str, section: str) -> str | None:
|
||||
return None
|
||||
|
||||
|
||||
def create_vikunja_task(title: str, description: str) -> str | None:
|
||||
def create_vikunja_task(title: str, description: str, project_id: int = 0) -> str | None:
|
||||
"""Create a Vikunja task and return its identifier (e.g., OBL-INFRA-531)."""
|
||||
try:
|
||||
token = get_vikunja_token()
|
||||
@@ -202,7 +221,7 @@ def create_vikunja_task(title: str, description: str) -> str | None:
|
||||
from devx.api_clients import VikunjaClient
|
||||
|
||||
client = VikunjaClient(VIKUNJA_API_URL, token)
|
||||
task = client.create_task(VIKUNJA_PROJECT_ID, title=title, description=description)
|
||||
task = client.create_task(project_id or VIKUNJA_PROJECT_ID, title=title, description=description)
|
||||
return str(task.get("identifier", ""))
|
||||
|
||||
|
||||
@@ -243,6 +262,24 @@ def create_vikunja_task(title: str, description: str) -> str | None:
|
||||
"__version__ tag vs a release git tag."
|
||||
),
|
||||
)
|
||||
@click.option(
|
||||
"--verify-timeout",
|
||||
type=int,
|
||||
default=600,
|
||||
help=_(
|
||||
"Seconds to keep retrying --verify-container while the artifact returns 404 "
|
||||
"(the image build races this step). 0 disables retries."
|
||||
),
|
||||
)
|
||||
@click.option(
|
||||
"--task-project-id",
|
||||
type=int,
|
||||
default=0,
|
||||
help=_(
|
||||
"Vikunja project for the tracking task (default: DEVX_VIKUNJA_PROJECT_ID). "
|
||||
"Use the target repo's project so the generated branch/spec satisfy its validation."
|
||||
),
|
||||
)
|
||||
@click.option("--dry-run", is_flag=True, default=False, help=_("Show what would be done without creating PR"))
|
||||
def cli(
|
||||
repo: str,
|
||||
@@ -254,6 +291,8 @@ def cli(
|
||||
verify_container: str,
|
||||
source_ref: str,
|
||||
container_tag: str,
|
||||
verify_timeout: int,
|
||||
task_project_id: int,
|
||||
dry_run: bool,
|
||||
) -> None:
|
||||
"""Create an infra PR to bump a pinned dependency version."""
|
||||
@@ -273,7 +312,7 @@ def cli(
|
||||
)
|
||||
c_owner, c_name = verify_container.split("/", 1)
|
||||
image_tag = container_tag or new_version
|
||||
image_digest = resolve_container_digest(GITEA_API_URL, c_owner, c_name, image_tag, token)
|
||||
image_digest = resolve_container_digest(GITEA_API_URL, c_owner, c_name, image_tag, token, verify_timeout)
|
||||
click.echo(
|
||||
_(
|
||||
"[dep-pr] Verified {container}:{version} -> {digest}",
|
||||
@@ -332,8 +371,20 @@ def cli(
|
||||
click.echo(f"[dep-pr] DRY RUN: would update {changed_file} and create PR")
|
||||
return
|
||||
|
||||
# Create a branch
|
||||
branch_name = f"deps/{package}-{new_version}"
|
||||
# Implements: REQ-1 — create the tracking task in the *target* repo's
|
||||
# Vikunja project so its identifier satisfies the target's branch/PR-title
|
||||
# validation (e.g., OBL-INFRA-N for oblachno/infra).
|
||||
task_title = f"Bump {package} to {new_version}"
|
||||
task_desc = (
|
||||
f"<p>Auto-created dependency bump PR.</p>"
|
||||
f"<p>Package: {package}</p>"
|
||||
f"<p>Version: {old_version} → {new_version}</p>"
|
||||
f"<p>Source: {source_repo} (run #{source_run_id})</p>"
|
||||
)
|
||||
task_id = create_vikunja_task(task_title, task_desc, task_project_id)
|
||||
|
||||
# Create a branch — embed the task ID so target-repo validation accepts it.
|
||||
branch_name = f"deps/{task_id}-{package}-{new_version}" if task_id else f"deps/{package}-{new_version}"
|
||||
base_branch = "master"
|
||||
|
||||
# Check for existing PR (reuse from tools.create_pr)
|
||||
@@ -344,20 +395,34 @@ def cli(
|
||||
|
||||
# Create branch via API
|
||||
try:
|
||||
master_ref = client._request("GET", "/git/refs/heads/master").json()
|
||||
master_sha = master_ref.get("object", {}).get("sha", "")
|
||||
if not master_sha:
|
||||
raise click.ClickException("Could not get master SHA")
|
||||
client._request("POST", "/git/refs", json={"ref": f"refs/heads/{branch_name}", "sha": master_sha})
|
||||
# Implements: REQ-1 — Gitea lacks POST /git/refs; create the branch
|
||||
# from master via the branches API.
|
||||
client._request(
|
||||
"POST",
|
||||
"/branches",
|
||||
json={"new_branch_name": branch_name, "old_branch_name": base_branch},
|
||||
)
|
||||
except APIError as e:
|
||||
if "already exists" in str(e).lower():
|
||||
click.echo(f"[dep-pr] Branch {branch_name} already exists")
|
||||
else:
|
||||
raise click.ClickException(_("Failed to create branch: {error}", error=str(e))) from None
|
||||
|
||||
# Check out the API-created branch inside the target clone.
|
||||
subprocess.run(["git", "fetch", "origin", f"{branch_name}"], check=False, capture_output=True, cwd=workdir) # nosec B603 B607
|
||||
subprocess.run(["git", "checkout", branch_name], check=False, capture_output=True, cwd=workdir) # nosec B603 B607
|
||||
# Check out the API-created branch inside the target clone. A plain
|
||||
# fetch only populates FETCH_HEAD — fetch into the remote-tracking ref
|
||||
# and force-create the local branch from it.
|
||||
subprocess.run( # nosec B603 B607
|
||||
["git", "fetch", "origin", f"{branch_name}:refs/remotes/origin/{branch_name}"],
|
||||
check=True,
|
||||
capture_output=True,
|
||||
cwd=workdir,
|
||||
)
|
||||
subprocess.run( # nosec B603 B607
|
||||
["git", "checkout", "-B", branch_name, f"origin/{branch_name}"],
|
||||
check=True,
|
||||
capture_output=True,
|
||||
cwd=workdir,
|
||||
)
|
||||
|
||||
if manifest_path:
|
||||
fields = {
|
||||
@@ -376,7 +441,32 @@ def cli(
|
||||
raise click.ClickException(_("Failed to update {file}", file=changed_file))
|
||||
|
||||
assert changed_file is not None # nosec B101 — narrowed by the early exit above
|
||||
subprocess.run(["git", "add", changed_file], check=True, cwd=workdir) # nosec B603 B607
|
||||
add_files = [changed_file]
|
||||
if task_id:
|
||||
# Implements: REQ-1 — spec-driven validation requires a spec file.
|
||||
spec_rel = f"docs/specs/{task_id}.md"
|
||||
spec_file = workdir / spec_rel
|
||||
spec_file.parent.mkdir(parents=True, exist_ok=True)
|
||||
spec_file.write_text(
|
||||
f"# {task_id}: {task_title}\n\n"
|
||||
f"## Problem\n\n"
|
||||
f"{source_repo} released {package} {new_version}; this repo pins {old_version}.\n\n"
|
||||
f"## Approach\n\n"
|
||||
f"REQ-1: Update `{changed_file}` to pin {package} {new_version} "
|
||||
f"(auto-generated dependency PR).\n\n"
|
||||
f"## Test Plan\n\n"
|
||||
f"- Producer release CI verified the artifact "
|
||||
f"({source_repo} run #{source_run_id or 'n/a'}).\n\n"
|
||||
f"## Deploy Plan\n\n"
|
||||
f"Merge updates the pin; the next deploy applies it.\n\n"
|
||||
f"## Rollback Plan\n\n"
|
||||
f"Revert the pin bump.\n\n"
|
||||
f"## Acceptance Criteria\n\n"
|
||||
f"- [x] REQ-1: `{changed_file}` pins {package} {new_version}.\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
add_files.append(spec_rel)
|
||||
subprocess.run(["git", "add", *add_files], check=True, cwd=workdir) # nosec B603 B607
|
||||
commit_msg = f"deps: bump {package} from {old_version} to {new_version}"
|
||||
subprocess.run(["git", "commit", "-m", commit_msg], check=True, cwd=workdir) # nosec B603 B607
|
||||
subprocess.run( # nosec B603 B607
|
||||
@@ -385,16 +475,6 @@ def cli(
|
||||
cwd=workdir,
|
||||
)
|
||||
|
||||
# Create Vikunja task for tracking
|
||||
task_title = f"Bump {package} to {new_version}"
|
||||
task_desc = (
|
||||
f"<p>Auto-created dependency bump PR.</p>"
|
||||
f"<p>Package: {package}</p>"
|
||||
f"<p>Version: {old_version} → {new_version}</p>"
|
||||
f"<p>Source: {source_repo} (run #{source_run_id})</p>"
|
||||
)
|
||||
task_id = create_vikunja_task(task_title, task_desc)
|
||||
|
||||
# Create PR directly (dependency PRs have custom titles, not Vikunja-derived)
|
||||
pr_title = f"{task_id}: {task_title}" if task_id else task_title
|
||||
pr_body = (
|
||||
|
||||
@@ -3159,6 +3159,14 @@
|
||||
"ru": "SSH_PRIVATE_KEY не задан — пропуск настройки SSH-ключа",
|
||||
"zh": "SSH_PRIVATE_KEY 未设置 — 跳过 SSH 密钥设置"
|
||||
},
|
||||
"Seconds to keep retrying --verify-container while the artifact returns 404 (the image build races this step). 0 disables retries.": {
|
||||
"bg": "Секунди за повторни опити на --verify-container, докато артефактът връща 404 (компилацията на изображението е конкурентна). 0 изключва повторните опити.",
|
||||
"de": "Sekunden, die --verify-container bei HTTP 404 weiter versucht wird (der Image-Build läuft parallel). 0 deaktiviert Wiederholungen.",
|
||||
"en": "Seconds to keep retrying --verify-container while the artifact returns 404 (the image build races this step). 0 disables retries.",
|
||||
"pl": "Sekundy ponawiania --verify-container, gdy artefakt zwraca 404 (budowa obrazu jest współbieżna). 0 wyłącza ponawianie.",
|
||||
"ru": "Секунды повторных попыток --verify-container, пока артефакт возвращает 404 (сборка образа идёт параллельно). 0 отключает повторы.",
|
||||
"zh": "当构件返回 404 时 --verify-container 的重试秒数（镜像构建与此步骤并行）。0 禁用重试。"
|
||||
},
|
||||
"Show what would be done without creating PR": {
|
||||
"bg": "Покажи какво би било направено без създаване на PR",
|
||||
"de": "Zeigen, was getan würde, ohne PR zu erstellen",
|
||||
@@ -3495,6 +3503,14 @@
|
||||
"ru": "Ошибка Vikunja API (HTTP {status}): {message}. Задача {task_id} НЕ была обновлена. Слияние прошло успешно, но задачу Vikunja нужно обновить вручную.",
|
||||
"zh": "Vikunja API 错误（HTTP {status}）：{message}。任务 {task_id} 未更新。合并成功，但 Vikunja 任务需要手动更新。"
|
||||
},
|
||||
"Vikunja project for the tracking task (default: DEVX_VIKUNJA_PROJECT_ID). Use the target repo's project so the generated branch/spec satisfy its validation.": {
|
||||
"bg": "Vikunja проект за задачата за проследяване (по подразбиране: DEVX_VIKUNJA_PROJECT_ID). Използвайте проекта на целевото хранилище, за да отговарят генерираните клон/спецификация на неговата валидация.",
|
||||
"de": "Vikunja-Projekt für die Tracking-Aufgabe (Standard: DEVX_VIKUNJA_PROJECT_ID). Verwenden Sie das Projekt des Ziel-Repos, damit generierter Branch/Spec dessen Validierung bestehen.",
|
||||
"en": "Vikunja project for the tracking task (default: DEVX_VIKUNJA_PROJECT_ID). Use the target repo's project so the generated branch/spec satisfy its validation.",
|
||||
"pl": "Projekt Vikunja dla zadania śledzącego (domyślnie: DEVX_VIKUNJA_PROJECT_ID). Użyj projektu docelowego repozytorium, aby wygenerowana gałąź/specyfikacja przeszła jego walidację.",
|
||||
"ru": "Проект Vikunja для задачи отслеживания (по умолчанию: DEVX_VIKUNJA_PROJECT_ID). Используйте проект целевого репозитория, чтобы сгенерированные ветка/спецификация прошли его валидацию.",
|
||||
"zh": "用于跟踪任务的 Vikunja 项目（默认：DEVX_VIKUNJA_PROJECT_ID）。使用目标仓库的项目，以便生成的分支/规范通过其验证。"
|
||||
},
|
||||
"Vikunja task title '{title}' starts with '{prefix}:'. The task title should NOT include the '{prefix}' prefix — it is automatically added to the PR title. Update the Vikunja task title to remove the prefix.": {
|
||||
"bg": "Заглавието на задачата във Vikunja '{title}' започва с '{prefix}:'. Заглавието на задачата НЕ трябва да съдържа префикса '{prefix}' — той се добавя автоматично към заглавието на PR. Актуализирайте заглавието на задачата във Vikunja, за да премахнете префикса.",
|
||||
"de": "Der Vikunja-Aufgabentitel '{title}' beginnt mit '{prefix}:'. Der Aufgabentitel darf NICHT den Präfix '{prefix}' enthalten — er wird automatisch zum PR-Titel hinzugefügt. Aktualisieren Sie den Vikunja-Aufgabentitel, um den Präfix zu entfernen.",
|
||||
@@ -3823,6 +3839,14 @@
|
||||
"ru": "[dep-pr] Проверено {container}:{version} -> {digest}",
|
||||
"zh": "[dep-pr] 已验证 {container}:{version} -> {digest}"
|
||||
},
|
||||
"[dep-pr] {owner}/{name}:{tag} not published yet — retrying.": {
|
||||
"bg": "[dep-pr] {owner}/{name}:{tag} още не е публикуван — повторен опит.",
|
||||
"de": "[dep-pr] {owner}/{name}:{tag} noch nicht veröffentlicht — neuer Versuch.",
|
||||
"en": "[dep-pr] {owner}/{name}:{tag} not published yet — retrying.",
|
||||
"pl": "[dep-pr] {owner}/{name}:{tag} jeszcze nie opublikowano — ponawianie.",
|
||||
"ru": "[dep-pr] {owner}/{name}:{tag} ещё не опубликован — повторная попытка.",
|
||||
"zh": "[dep-pr] {owner}/{name}:{tag} 尚未发布 — 正在重试。"
|
||||
},
|
||||
"[dep-pr] {pkg} already at {version} — no PR needed.": {
|
||||
"bg": "[dep-pr] {pkg} вече е на {version} — не е нужен PR.",
|
||||
"de": "[dep-pr] {pkg} bereits auf {version} — kein PR nötig.",
|
||||
|
||||
@@ -189,6 +189,16 @@ class TestCreateVikunjaTask:
|
||||
result = create_vikunja_task("Test", "desc")
|
||||
assert result == "OBL-INFRA-999"
|
||||
|
||||
def test_explicit_project_id_used(self) -> None:
|
||||
with (
|
||||
patch("devx.ci.create_dependency_pr.get_vikunja_token", return_value="fake-token"),
|
||||
patch("devx.api_clients.VikunjaClient") as mock_client_cls,
|
||||
):
|
||||
mock_client = mock_client_cls.return_value
|
||||
mock_client.create_task.return_value = {"identifier": "OBL-INFRA-1"}
|
||||
create_vikunja_task("Test", "desc", project_id=3)
|
||||
assert mock_client.create_task.call_args.args[0] == 3
|
||||
|
||||
|
||||
class TestResolveContainerDigest:
|
||||
"""REQ-1: pre-PR artifact verification via the packages API."""
|
||||
@@ -460,3 +470,175 @@ class TestCliManifestMode:
|
||||
assert result.exit_code == 0
|
||||
args = mock_digest.call_args[0]
|
||||
assert args[1:4] == ("oblachno", "sso-bridge", "0.2.4")
|
||||
|
||||
|
||||
class TestBranchCreation:
|
||||
"""Branch creation uses the branches API (Gitea lacks POST /git/refs)."""
|
||||
|
||||
def _invoke(self) -> object:
|
||||
runner = CliRunner()
|
||||
return runner.invoke(
|
||||
cli,
|
||||
[
|
||||
"--package",
|
||||
"sso_bridge",
|
||||
"--new-version",
|
||||
"0.9.1",
|
||||
"--source-repo",
|
||||
"oblachno/sso-bridge",
|
||||
"--manifest",
|
||||
"deploy/m.json",
|
||||
],
|
||||
)
|
||||
|
||||
def _client(self, mock_client_cls: MagicMock) -> MagicMock:
|
||||
client = mock_client_cls.return_value
|
||||
client.create_pr.return_value = {"number": 1}
|
||||
return client
|
||||
|
||||
@patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
|
||||
@patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
|
||||
@patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.GiteaClient")
|
||||
@patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
|
||||
def test_creates_branch_via_branches_api(
|
||||
self,
|
||||
_token: MagicMock,
|
||||
mock_client_cls: MagicMock,
|
||||
_find: MagicMock,
|
||||
_read: MagicMock,
|
||||
_update: MagicMock,
|
||||
_task: MagicMock,
|
||||
) -> None:
|
||||
client = self._client(mock_client_cls)
|
||||
result = self._invoke()
|
||||
assert result.exit_code == 0
|
||||
assert "Created PR" in result.output
|
||||
post = client._request.call_args
|
||||
assert post.args[:2] == ("POST", "/branches")
|
||||
assert post.kwargs["json"] == {
|
||||
"new_branch_name": "deps/sso_bridge-0.9.1",
|
||||
"old_branch_name": "master",
|
||||
}
|
||||
|
||||
@patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
|
||||
@patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
|
||||
@patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.GiteaClient")
|
||||
@patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
|
||||
def test_existing_branch_tolerated(
|
||||
self,
|
||||
_token: MagicMock,
|
||||
mock_client_cls: MagicMock,
|
||||
_find: MagicMock,
|
||||
_read: MagicMock,
|
||||
_update: MagicMock,
|
||||
_task: MagicMock,
|
||||
) -> None:
|
||||
from devx.exceptions import APIError
|
||||
|
||||
client = self._client(mock_client_cls)
|
||||
client._request.side_effect = APIError(422, "branch already exists")
|
||||
result = self._invoke()
|
||||
assert result.exit_code == 0
|
||||
assert "already exists" in result.output.lower()
|
||||
|
||||
@patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
|
||||
@patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
|
||||
@patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.GiteaClient")
|
||||
@patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
|
||||
def test_branch_api_error_fails(
|
||||
self,
|
||||
_token: MagicMock,
|
||||
mock_client_cls: MagicMock,
|
||||
_find: MagicMock,
|
||||
_read: MagicMock,
|
||||
_update: MagicMock,
|
||||
_task: MagicMock,
|
||||
) -> None:
|
||||
from devx.exceptions import APIError
|
||||
|
||||
client = self._client(mock_client_cls)
|
||||
client._request.side_effect = APIError(500, "boom")
|
||||
result = self._invoke()
|
||||
assert result.exit_code != 0
|
||||
assert "Failed to create branch" in result.output
|
||||
|
||||
@patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
|
||||
@patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
|
||||
@patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.GiteaClient")
|
||||
@patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
|
||||
def test_checks_out_remote_tracking_branch(
|
||||
self,
|
||||
_token: MagicMock,
|
||||
mock_client_cls: MagicMock,
|
||||
_find: MagicMock,
|
||||
_read: MagicMock,
|
||||
_update: MagicMock,
|
||||
_task: MagicMock,
|
||||
) -> None:
|
||||
import subprocess
|
||||
|
||||
self._client(mock_client_cls)
|
||||
result = self._invoke()
|
||||
assert result.exit_code == 0
|
||||
calls = [c.args[0] for c in subprocess.run.call_args_list]
|
||||
assert ["git", "fetch", "origin", "deps/sso_bridge-0.9.1:refs/remotes/origin/deps/sso_bridge-0.9.1"] in calls
|
||||
assert ["git", "checkout", "-B", "deps/sso_bridge-0.9.1", "origin/deps/sso_bridge-0.9.1"] in calls
|
||||
|
||||
@patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value="OBL-INFRA-581")
|
||||
@patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
|
||||
@patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
|
||||
@patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
|
||||
@patch("devx.ci.create_dependency_pr.GiteaClient")
|
||||
@patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
|
||||
def test_task_id_in_branch_and_spec_committed(
|
||||
self,
|
||||
_token: MagicMock,
|
||||
mock_client_cls: MagicMock,
|
||||
_find: MagicMock,
|
||||
_read: MagicMock,
|
||||
_update: MagicMock,
|
||||
mock_task: MagicMock,
|
||||
) -> None:
|
||||
import subprocess
|
||||
|
||||
client = self._client(mock_client_cls)
|
||||
result = self._invoke()
|
||||
assert result.exit_code == 0
|
||||
# Branch embeds the target-repo task ID
|
||||
post = client._request.call_args
|
||||
assert post.kwargs["json"]["new_branch_name"] == "deps/OBL-INFRA-581-sso_bridge-0.9.1"
|
||||
# Spec file added alongside the manifest change
|
||||
add = next(c for c in subprocess.run.call_args_list if c.args[0][:2] == ["git", "add"])
|
||||
assert "docs/specs/OBL-INFRA-581.md" in add.args[0]
|
||||
# PR title carries the task ID
|
||||
assert client.create_pr.call_args.kwargs["title"] == "OBL-INFRA-581: Bump sso_bridge to 0.9.1"
|
||||
mock_task.assert_called_once()
|
||||
|
||||
def test_retries_404_until_published(self) -> None:
|
||||
import requests
|
||||
|
||||
from devx.ci.create_dependency_pr import resolve_container_digest
|
||||
|
||||
err = requests.HTTPError("404")
|
||||
err.response = MagicMock(status_code=404)
|
||||
fail = MagicMock()
|
||||
fail.raise_for_status.side_effect = err
|
||||
ok = MagicMock()
|
||||
ok.raise_for_status = MagicMock()
|
||||
ok.json.return_value = [{"name": "manifest.json", "sha256": "cafe"}]
|
||||
with (
|
||||
patch("devx.ci.create_dependency_pr.requests.get", side_effect=[fail, ok]),
|
||||
patch("devx.ci.create_dependency_pr.time.sleep"),
|
||||
):
|
||||
digest = resolve_container_digest(
|
||||
"https://git.example.com/api/v1", "oblachno", "sso-bridge", "0.9.1", "tok", timeout_s=60
|
||||
)
|
||||
assert digest == "sha256:cafe"
|
||||
|
||||
Reference in New Issue
Block a user