Marcos
8c491a7626
The reviewer runs an opencode agent with `bash: "*": allow` over a checkout of the PR author's branch, and the pod holds a Gitea Write credential. Those two facts had no wall between them. Security - _build_env now allow-lists the subprocess environment instead of inheriting it, so PRAGENT_BOT_TOKEN and WEBHOOK_SECRET never reach the agent. This was the live hole: a PR body or an AGENTS.md could ask the agent to `curl` the token out, and it had both the value and the tool. - sanitize_workdir deletes author-controlled agent-instruction files from the checkout before opencode starts (AGENTS.md at any depth, CLAUDE.md, .cursorrules, a repo opencode.json/.opencode, copilot-instructions.md). opencode loads nested AGENTS.md as instructions, so a PR could otherwise ship its own system prompt. They are still reviewed, as data. - The brief fences PR title/body and diff in --- UNTRUSTED --- markers under a trust-boundary preamble; the pragent agent, the three lens subagents and the review-methodology skill now treat injection attempts as a critical finding to report rather than an instruction to obey. - .pr-review.json is read from the PR's base branch, not the head sha. Its `instructions` field is spliced into the reviewer's prompt, so head-ref reading let any author rewrite the reviewer's rules. Fields are length-capped. - Untar rejects escaping symlinks, parent traversal, and writes through a planted symlink (tar-slip). - The image runs as uid 10001 instead of root. Robustness - Bounded review concurrency (PRAGENT_MAX_CONCURRENT_REVIEWS, default 2). Each review forks an opencode process; a thread per delivery was a fork bomb on a burst of labels or Gitea retries. - An in-flight (repo, index, sha) claim closes the check-then-act race in the sha-marker dedupe, where two deliveries a second apart both read "not yet reviewed" and both posted. - Request bodies are capped before being read into memory. Correctness - parse_diff_anchors counts a whitespace-stripped blank context line. Skipping it desynced the new-line counter for the rest of the hunk and silently misplaced every later inline comment in that file. - post_inline_review's body-only fallback folds the anchored findings into the body. It previously posted a summary saying "N inline comment(s) below" with no comments and no findings — losing them all on the one path that matters. - fetch_pr_diff's files-endpoint fallback emits real a// b/ prefixes (so changed_files and the anchor parser work on it) and reports both HTTP statuses in its error instead of the same one twice. - The CI workflow template pins PRAGENT_ENGINE=ollama; review_pr defaults to opencode, which does not exist on a Gitea Actions runner. Tests: 68 -> 101, covering each of the above. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B11e8TZZxJyzHW7jj7KWUN
137 lines
3.9 KiB
Python
137 lines
3.9 KiB
Python
"""Unit tests for the webhook receiver's gating, dedupe and limits. No network."""
|
|
import os
|
|
import sys
|
|
import threading
|
|
|
|
HERE = os.path.dirname(os.path.abspath(__file__))
|
|
ROOT = os.path.abspath(os.path.join(HERE, "..", ".."))
|
|
sys.path.insert(0, os.path.join(ROOT, "pilot"))
|
|
|
|
import webhook_server as ws # noqa: E402
|
|
|
|
|
|
def _payload(**over):
|
|
pr = {
|
|
"number": 7,
|
|
"title": "t",
|
|
"body": "b",
|
|
"labels": [{"name": "AI-REVIEW"}],
|
|
"head": {"sha": "a" * 40},
|
|
"base": {"ref": "main"},
|
|
}
|
|
pr.update(over.pop("pr", {}))
|
|
p = {"action": "opened", "pull_request": pr, "repository": {"full_name": "o/r"}}
|
|
p.update(over)
|
|
return p
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# label gating
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_labels_have_matches_dicts_and_strings():
|
|
assert ws._labels_have([{"name": "AI-REVIEW"}], "AI-REVIEW")
|
|
assert ws._labels_have(["AI-REVIEW"], "AI-REVIEW")
|
|
assert not ws._labels_have([{"name": "other"}], "AI-REVIEW")
|
|
assert not ws._labels_have(None, "AI-REVIEW")
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# in-flight claim — the check-then-act race around the sha-marker dedupe
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_claim_is_exclusive_then_released():
|
|
key = ("o/r", "7", "abc")
|
|
ws._release(key)
|
|
assert ws._claim(key) is True
|
|
assert ws._claim(key) is False
|
|
ws._release(key)
|
|
assert ws._claim(key) is True
|
|
ws._release(key)
|
|
|
|
|
|
def test_claim_is_thread_safe():
|
|
key = ("o/r", "9", "def")
|
|
ws._release(key)
|
|
wins = []
|
|
barrier = threading.Barrier(8)
|
|
|
|
def go():
|
|
barrier.wait()
|
|
if ws._claim(key):
|
|
wins.append(1)
|
|
|
|
threads = [threading.Thread(target=go) for _ in range(8)]
|
|
for t in threads:
|
|
t.start()
|
|
for t in threads:
|
|
t.join()
|
|
assert len(wins) == 1
|
|
ws._release(key)
|
|
|
|
|
|
def test_duplicate_delivery_for_same_sha_is_not_reviewed_twice(monkeypatch):
|
|
started = []
|
|
monkeypatch.setattr(ws, "BOT_TOKEN", "tok")
|
|
|
|
class FakeThread:
|
|
def __init__(self, target, args, daemon):
|
|
self.args = args
|
|
|
|
def start(self):
|
|
started.append(self.args)
|
|
|
|
monkeypatch.setattr(ws.threading, "Thread", FakeThread)
|
|
ws._release(("o/r", "7", "a" * 40))
|
|
|
|
s1, _ = ws._handle_pull_request(_payload())
|
|
s2, m2 = ws._handle_pull_request(_payload(action="edited"))
|
|
assert s1 == 202
|
|
assert s2 == 200 and "in flight" in m2
|
|
assert len(started) == 1
|
|
ws._release(("o/r", "7", "a" * 40))
|
|
|
|
|
|
def test_base_ref_is_passed_to_the_review_thread(monkeypatch):
|
|
started = []
|
|
monkeypatch.setattr(ws, "BOT_TOKEN", "tok")
|
|
|
|
class FakeThread:
|
|
def __init__(self, target, args, daemon):
|
|
self.args = args
|
|
|
|
def start(self):
|
|
started.append(self.args)
|
|
|
|
monkeypatch.setattr(ws.threading, "Thread", FakeThread)
|
|
ws._release(("o/r", "7", "a" * 40))
|
|
ws._handle_pull_request(_payload(pr={"base": {"ref": "release/v2"}}))
|
|
assert started[0][-1] == "release/v2"
|
|
ws._release(("o/r", "7", "a" * 40))
|
|
|
|
|
|
def test_closed_action_is_ignored(monkeypatch):
|
|
monkeypatch.setattr(ws, "BOT_TOKEN", "tok")
|
|
status, msg = ws._handle_pull_request(_payload(action="closed"))
|
|
assert status == 200
|
|
assert "ignore" in msg
|
|
|
|
|
|
def test_missing_label_is_ignored(monkeypatch):
|
|
monkeypatch.setattr(ws, "BOT_TOKEN", "tok")
|
|
status, msg = ws._handle_pull_request(_payload(pr={"labels": [{"name": "wip"}]}))
|
|
assert status == 200
|
|
assert "AI-REVIEW" in msg
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# concurrency bound
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
def test_review_slots_bound_matches_config():
|
|
assert ws.MAX_CONCURRENT >= 1
|
|
assert ws._review_slots._value <= ws.MAX_CONCURRENT
|