From f9720fe651430d9d0db87b42e764c404d8a8361a Mon Sep 17 00:00:00 2001 From: "lightning-it-shared-assets-sync[bot]" <307342877+lightning-it-shared-assets-sync[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 23:29:08 +0000 Subject: [PATCH] chore: sync repository quality assets Shared-Assets-Source-SHA: bb1a9e02bb8a7bbe80f90b2b85f027b3588010f5 Shared-Assets-Source-Run: 32537006800 Shared-Assets-Source-Attempt: 1 Shared-Assets-Sync-App-ID: 4351516 --- .../shared-assets-guarded-automerge.yml | 11 -- scripts/materialize-exact-revision-review.py | 139 ++++-------------- 2 files changed, 32 insertions(+), 118 deletions(-) diff --git a/.github/workflows/shared-assets-guarded-automerge.yml b/.github/workflows/shared-assets-guarded-automerge.yml index 3f00c46..5becc48 100644 --- a/.github/workflows/shared-assets-guarded-automerge.yml +++ b/.github/workflows/shared-assets-guarded-automerge.yml @@ -58,7 +58,6 @@ jobs: PR_HEAD: ${{ github.event.pull_request.head.ref }} PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} - PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }} PR_NUMBER: ${{ github.event.pull_request.number }} PR_TITLE: ${{ github.event.pull_request.title }} REPO: ${{ github.repository }} @@ -69,12 +68,6 @@ jobs: set -euo pipefail readonly SYNC_APP_BOT="lightning-it-shared-assets-sync[bot]" - labels="$(jq -r '.[]' <<<"$PR_LABELS")" - - has_label() { - grep -Fxq "$1" <<<"$labels" - } - trusted=true sync_kind=none expected_subject="" @@ -123,10 +116,6 @@ jobs: trusted=false fi - if ! has_label chore || ! has_label shared-assets-lit; then - trusted=false - fi - live_pr="{}" if ! live_pr="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}")"; then trusted=false diff --git a/scripts/materialize-exact-revision-review.py b/scripts/materialize-exact-revision-review.py index b69db33..e63e0c5 100644 --- a/scripts/materialize-exact-revision-review.py +++ b/scripts/materialize-exact-revision-review.py @@ -109,11 +109,7 @@ def run( command = " ".join(arguments) or "" fail(f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: {command}") if result.returncode != 0: - stderr = ( - result.stderr - if isinstance(result.stderr, str) - else result.stderr.decode(errors="replace") - ) + stderr = result.stderr if isinstance(result.stderr, str) else result.stderr.decode(errors="replace") command = " ".join(arguments) or "" fail(f"Command failed closed: {command}: {stderr.strip()}") return result @@ -159,9 +155,7 @@ def add_error_notes(error: BaseException, notes: Sequence[str]) -> None: add_note(note) -def fail_after_descriptor_cleanup( - message: str, descriptor: int, label: str -) -> NoReturn: +def fail_after_descriptor_cleanup(message: str, descriptor: int, label: str) -> NoReturn: """Raise one proof error after deterministically cleaning up its descriptor.""" cleanup_errors = close_descriptor_after_error(descriptor, label) failure = MaterializationError(message) @@ -169,9 +163,7 @@ def fail_after_descriptor_cleanup( raise failure -def open_owned_parent_directory( - path: Path, name: str, requirement: str -) -> tuple[int, int, int]: +def open_owned_parent_directory(path: Path, name: str, requirement: str) -> tuple[int, int, int]: """Return the final parent fd plus O_NOFOLLOW and O_CLOEXEC flag values.""" no_follow = getattr(os, "O_NOFOLLOW", None) if not isinstance(no_follow, int) or no_follow == 0: @@ -212,9 +204,7 @@ def open_owned_parent_directory( ) ) directory = -1 - failure = MaterializationError( - f"Protected {name} parent cannot be opened safely: {close_error}" - ) + failure = MaterializationError(f"Protected {name} parent cannot be opened safely: {close_error}") add_error_notes(failure, cleanup_errors) raise failure from close_error directory = next_directory @@ -226,9 +216,7 @@ def open_owned_parent_directory( "Current parent directory", ) directory = -1 - failure = MaterializationError( - f"Protected {name} parent cannot be opened safely: {error}" - ) + failure = MaterializationError(f"Protected {name} parent cannot be opened safely: {error}") add_error_notes(failure, cleanup_errors) raise failure from error except BaseException as error: @@ -246,9 +234,7 @@ def open_owned_parent_directory( directory, "Validated parent directory", ) - failure = MaterializationError( - f"Protected {name} parent cannot be inspected safely: {error}" - ) + failure = MaterializationError(f"Protected {name} parent cannot be inspected safely: {error}") add_error_notes(failure, cleanup_errors) raise failure from error if not stat.S_ISDIR(parent_details.st_mode): @@ -313,9 +299,7 @@ def protected_asset_bytes(path: Path, name: str) -> bytes: ) if cleanup_errors: if active_error is None: - failure = MaterializationError( - f"Protected {name} descriptors could not be closed safely." - ) + failure = MaterializationError(f"Protected {name} descriptors could not be closed safely.") add_error_notes(failure, cleanup_errors) raise failure add_error_notes(active_error, cleanup_errors) @@ -362,9 +346,7 @@ def write_owned_regular_file(path: Path, payload: bytes, name: str) -> None: f"Protected {name} existing descriptor", ) if active_error is None and cleanup_errors: - failure = MaterializationError( - f"Protected {name} existing descriptor could not be closed safely." - ) + failure = MaterializationError(f"Protected {name} existing descriptor could not be closed safely.") add_error_notes(failure, cleanup_errors) raise failure if active_error is not None: @@ -408,9 +390,7 @@ def write_owned_regular_file(path: Path, payload: bytes, name: str) -> None: f"Protected {name} temporary descriptor", ) if cleanup_errors: - failure = MaterializationError( - f"Protected {name} temporary descriptor could not be closed safely." - ) + failure = MaterializationError(f"Protected {name} temporary descriptor could not be closed safely.") add_error_notes(failure, cleanup_errors) raise failure @@ -429,9 +409,7 @@ def write_owned_regular_file(path: Path, payload: bytes, name: str) -> None: except OSError: pass except OSError as error: - failure = MaterializationError( - f"Protected {name} cannot be written atomically: {error}" - ) + failure = MaterializationError(f"Protected {name} cannot be written atomically: {error}") add_error_notes(failure, getattr(error, "__notes__", ())) raise failure from error finally: @@ -452,9 +430,7 @@ def write_owned_regular_file(path: Path, payload: bytes, name: str) -> None: except FileNotFoundError: pass except OSError as cleanup_error: - final_cleanup_errors.append( - f"Protected {name} temporary cleanup also failed: {cleanup_error}" - ) + final_cleanup_errors.append(f"Protected {name} temporary cleanup also failed: {cleanup_error}") final_cleanup_errors.extend( close_descriptor_after_error( directory, @@ -463,26 +439,20 @@ def write_owned_regular_file(path: Path, payload: bytes, name: str) -> None: ) if final_cleanup_errors: if active_error is None: - failure = MaterializationError( - f"Protected {name} cleanup failed closed." - ) + failure = MaterializationError(f"Protected {name} cleanup failed closed.") add_error_notes(failure, final_cleanup_errors) raise failure add_error_notes(active_error, final_cleanup_errors) -def bind_protected_assets( - metadata: dict[str, Any], asset_paths: dict[str, Path] -) -> dict[str, Any]: +def bind_protected_assets(metadata: dict[str, Any], asset_paths: dict[str, Path]) -> dict[str, Any]: """Bind every base-controlled review asset into one canonical input hash.""" if set(asset_paths) != set(ASSET_ARGUMENTS): fail("The complete protected review-asset set is required.") bound = dict(metadata) for metadata_key, path in asset_paths.items(): asset_name = metadata_key.removesuffix("_sha256").replace("_", " ") - bound[metadata_key] = hashlib.sha256( - protected_asset_bytes(path, asset_name) - ).hexdigest() + bound[metadata_key] = hashlib.sha256(protected_asset_bytes(path, asset_name)).hexdigest() canonical = json.dumps(bound, sort_keys=True, separators=(",", ":")).encode("utf-8") bound["input_sha256"] = hashlib.sha256(canonical).hexdigest() return bound @@ -512,16 +482,11 @@ def validate_inputs(arguments: argparse.Namespace) -> None: fail("The protected workflow SHA must equal the live pull-request base SHA.") if arguments.trigger not in {"ready_for_review", "app_dispatch"}: fail("Unsupported exact-review trigger.") - if ( - arguments.trigger == "app_dispatch" - and arguments.dispatch_ref != f"refs/heads/{arguments.base_ref}" - ): + if arguments.trigger == "app_dispatch" and arguments.dispatch_ref != f"refs/heads/{arguments.base_ref}": fail("App dispatch must execute from the protected pull-request base ref.") -def read_live_pull_request( - arguments: argparse.Namespace, *, home: Path -) -> dict[str, Any]: +def read_live_pull_request(arguments: argparse.Namespace, *, home: Path) -> dict[str, Any]: gh = executable("gh") result = run( [ @@ -563,9 +528,7 @@ def read_live_pull_request( "head_repository": head_repository.get("full_name"), } if observed != expected: - fail( - f"Live pull-request binding changed or is unauthorized: {json.dumps(observed, sort_keys=True)}" - ) + fail(f"Live pull-request binding changed or is unauthorized: {json.dumps(observed, sort_keys=True)}") return pull_request @@ -612,10 +575,7 @@ def git_output( if remaining <= 0: process.kill() process.wait() - fail( - f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: " - f"{' '.join(command)}" - ) + fail(f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: {' '.join(command)}") for key, _events in selector.select(remaining): if key.data == "stdout": remaining_bytes = max_bytes - len(stdout) @@ -643,19 +603,13 @@ def git_output( if remaining <= 0: process.kill() process.wait() - fail( - f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: " - f"{' '.join(command)}" - ) + fail(f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: {' '.join(command)}") try: return_code = process.wait(timeout=remaining) except subprocess.TimeoutExpired: process.kill() process.wait() - fail( - f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: " - f"{' '.join(command)}" - ) + fail(f"Command timed out after {COMMAND_TIMEOUT_SECONDS} seconds: {' '.join(command)}") finally: selector.close() process.stdout.close() @@ -664,15 +618,9 @@ def git_output( process.kill() process.wait() if limit_exceeded: - fail( - "Exact-revision review input exceeds the protected byte limit " - f"of {max_bytes - 1} bytes." - ) + fail(f"Exact-revision review input exceeds the protected byte limit of {max_bytes - 1} bytes.") if return_code != 0: - fail( - f"Command failed closed: {' '.join(command)}: " - f"{stderr.decode(errors='replace').strip()}" - ) + fail(f"Command failed closed: {' '.join(command)}: {stderr.decode(errors='replace').strip()}") return bytes(stdout) result = run( command, @@ -682,9 +630,7 @@ def git_output( return result.stdout -def materialize( - arguments: argparse.Namespace, output_directory: Path -) -> dict[str, Any]: +def materialize(arguments: argparse.Namespace, output_directory: Path) -> dict[str, Any]: validate_inputs(arguments) if output_directory.exists(): fail(f"Review workspace already exists: {output_directory}") @@ -696,9 +642,7 @@ def materialize( runner_temp = Path(os.environ.get("RUNNER_TEMP", tempfile.gettempdir())).resolve() if not runner_temp.is_dir(): fail("RUNNER_TEMP must identify an existing directory.") - with tempfile.TemporaryDirectory( - prefix="exact-revision-materializer.", dir=runner_temp - ) as temporary: + with tempfile.TemporaryDirectory(prefix="exact-revision-materializer.", dir=runner_temp) as temporary: temporary_root = Path(temporary) home = temporary_root / "home" home.mkdir(mode=0o700) @@ -819,9 +763,7 @@ def materialize( fail("Git returned an invalid diff representation.") review_bytes = len(diff) if review_bytes <= 0 or review_bytes >= MAX_REVIEW_BYTES: - fail( - f"Exact-revision review input must contain 1..{MAX_REVIEW_BYTES - 1} bytes; observed {review_bytes}." - ) + fail(f"Exact-revision review input must contain 1..{MAX_REVIEW_BYTES - 1} bytes; observed {review_bytes}.") diff_sha256 = hashlib.sha256(diff).hexdigest() read_live_pull_request(arguments, home=home) @@ -853,9 +795,7 @@ def materialize( def bind_assets(review_directory: Path, asset_paths: dict[str, Path]) -> dict[str, Any]: metadata_path = review_directory / "review-metadata.json" try: - metadata = json.loads( - protected_asset_bytes(metadata_path, "review metadata").decode("utf-8") - ) + metadata = json.loads(protected_asset_bytes(metadata_path, "review metadata").decode("utf-8")) except (json.JSONDecodeError, UnicodeDecodeError) as error: fail(f"Review metadata is malformed: {error}") if not isinstance(metadata, dict): @@ -879,20 +819,13 @@ def verify( validate_inputs(arguments) patch = review_directory / "change.patch" metadata_path = review_directory / "review-metadata.json" - if ( - not patch.is_file() - or patch.is_symlink() - or not metadata_path.is_file() - or metadata_path.is_symlink() - ): + if not patch.is_file() or patch.is_symlink() or not metadata_path.is_file() or metadata_path.is_symlink(): fail("The review diff and metadata must be regular, non-symlink files.") patch_size = patch.stat().st_size if patch_size <= 0 or patch_size >= MAX_REVIEW_BYTES: fail(f"The review diff must be between 1 and {MAX_REVIEW_BYTES - 1} bytes.") try: - expected_metadata = json.loads( - protected_asset_bytes(metadata_path, "review metadata").decode("utf-8") - ) + expected_metadata = json.loads(protected_asset_bytes(metadata_path, "review metadata").decode("utf-8")) except (json.JSONDecodeError, UnicodeDecodeError) as error: fail(f"Review metadata is malformed: {error}") if not isinstance(expected_metadata, dict): @@ -910,13 +843,9 @@ def verify( runner_temp = Path(os.environ.get("RUNNER_TEMP", tempfile.gettempdir())).resolve() if not runner_temp.is_dir(): fail("RUNNER_TEMP must identify an existing directory.") - with tempfile.TemporaryDirectory( - prefix="exact-revision-recheck.", dir=runner_temp - ) as temporary: + with tempfile.TemporaryDirectory(prefix="exact-revision-recheck.", dir=runner_temp) as temporary: regenerated = Path(temporary) / "review" - actual_metadata = bind_protected_assets( - materialize(arguments, regenerated), asset_paths - ) + actual_metadata = bind_protected_assets(materialize(arguments, regenerated), asset_paths) if protected_asset_bytes(patch, "review diff") != protected_asset_bytes( regenerated / "change.patch", "regenerated diff" ): @@ -936,9 +865,7 @@ def parse_arguments() -> argparse.Namespace: parser.add_argument("--expected-base", required=True) parser.add_argument("--expected-head", required=True) parser.add_argument("--trusted-workflow-sha", required=True) - parser.add_argument( - "--trigger", required=True, choices=("ready_for_review", "app_dispatch") - ) + parser.add_argument("--trigger", required=True, choices=("ready_for_review", "app_dispatch")) parser.add_argument("--dispatch-ref", default="") parser.add_argument("--review-directory", required=True, type=Path) parser.add_argument("--materializer-path", type=Path) @@ -954,9 +881,7 @@ def main() -> int: if arguments.mode == "materialize": metadata = materialize(arguments, arguments.review_directory) elif arguments.mode == "bind-assets": - metadata = bind_assets( - arguments.review_directory, asset_paths_from_arguments(arguments) - ) + metadata = bind_assets(arguments.review_directory, asset_paths_from_arguments(arguments)) else: metadata = verify( arguments,