Compare commits
1 Commits
fix/1430
...
burn/1460-
| Author | SHA1 | Date | |
|---|---|---|---|
|
34e004e842 |
72
.gitea/workflows/duplicate-pr-check.yml
Normal file
72
.gitea/workflows/duplicate-pr-check.yml
Normal file
@@ -0,0 +1,72 @@
|
||||
# .gitea/workflows/duplicate-pr-check.yml
|
||||
# CI workflow to check for duplicate PRs
|
||||
|
||||
name: Check for Duplicate PRs
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened]
|
||||
|
||||
jobs:
|
||||
check-duplicates:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v4
|
||||
with:
|
||||
python-version: '3.11'
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
# No additional dependencies needed
|
||||
|
||||
- name: Check for duplicate PRs
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||
run: |
|
||||
# Extract issue number from PR title or branch name
|
||||
PR_TITLE="${{ github.event.pull_request.title }}"
|
||||
BRANCH_NAME="${{ github.head_ref }}"
|
||||
|
||||
# Try to extract issue number from title or branch
|
||||
ISSUE_NUM=$(echo "$PR_TITLE" | grep -oE '#[0-9]+' | head -1 | tr -d '#')
|
||||
|
||||
if [ -z "$ISSUE_NUM" ]; then
|
||||
ISSUE_NUM=$(echo "$BRANCH_NAME" | grep -oE '[0-9]+' | head -1)
|
||||
fi
|
||||
|
||||
if [ -z "$ISSUE_NUM" ]; then
|
||||
echo "No issue number found in PR title or branch name"
|
||||
echo "Skipping duplicate check"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Checking for duplicate PRs for issue #$ISSUE_NUM"
|
||||
|
||||
# Save token to file for the script
|
||||
echo "$GITEA_TOKEN" > /tmp/gitea_token.txt
|
||||
export TOKEN_PATH=/tmp/gitea_token.txt
|
||||
|
||||
# Run the duplicate checker
|
||||
python bin/duplicate_pr_prevention.py --repo the-nexus --issue "$ISSUE_NUM" --check
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo ""
|
||||
echo "❌ Duplicate PRs detected for issue #$ISSUE_NUM"
|
||||
echo "This PR should be closed in favor of an existing one."
|
||||
echo ""
|
||||
echo "To see details, run:"
|
||||
echo " python bin/duplicate_pr_prevention.py --repo the-nexus --issue $ISSUE_NUM --report"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ No duplicate PRs found"
|
||||
|
||||
- name: Clean up
|
||||
if: always()
|
||||
run: |
|
||||
rm -f /tmp/gitea_token.txt
|
||||
@@ -1,49 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Commit-msg hook: warn about shell injection risks
|
||||
# Install: cp .githooks/commit-msg .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg
|
||||
|
||||
COMMIT_MSG_FILE="$1"
|
||||
COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
|
||||
|
||||
# Check for dangerous patterns
|
||||
DANGEROUS_PATTERNS=(
|
||||
'`' # Backticks
|
||||
'$(' # Command substitution
|
||||
'${' # Variable expansion
|
||||
'\\`' # Escaped backticks
|
||||
'eval ' # eval command
|
||||
'exec ' # exec command
|
||||
'source ' # source command
|
||||
'|' # Pipe
|
||||
'&&' # AND operator
|
||||
'||' # OR operator
|
||||
';' # Semicolon
|
||||
'>' # Redirect
|
||||
'<' # Input redirect
|
||||
)
|
||||
|
||||
FOUND_ISSUES=()
|
||||
for pattern in "${DANGEROUS_PATTERNS[@]}"; do
|
||||
if echo "$COMMIT_MSG" | grep -q "$pattern"; then
|
||||
FOUND_ISSUES+=("$pattern")
|
||||
fi
|
||||
done
|
||||
|
||||
if [ ${#FOUND_ISSUES[@]} -gt 0 ]; then
|
||||
echo "⚠️ WARNING: Commit message contains potentially dangerous patterns:"
|
||||
for issue in "${FOUND_ISSUES[@]}"; do
|
||||
echo " - $issue"
|
||||
done
|
||||
echo ""
|
||||
echo "This could trigger shell execution during git operations."
|
||||
echo ""
|
||||
echo "Safe alternatives:"
|
||||
echo " 1. Use: git commit -F <file> instead of git commit -m"
|
||||
echo " 2. Escape special characters in commit messages"
|
||||
echo " 3. Use the safe_commit() function from bin/safe_commit.py"
|
||||
echo ""
|
||||
echo "To proceed anyway, use: git commit --no-verify"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
241
DUPLICATE_PR_PREVENTION.md
Normal file
241
DUPLICATE_PR_PREVENTION.md
Normal file
@@ -0,0 +1,241 @@
|
||||
# Duplicate PR Prevention System
|
||||
|
||||
**Issue:** #1460 - [META] I keep creating duplicate PRs for issue #1128
|
||||
**Solution:** Comprehensive prevention system with tools, hooks, and CI checks
|
||||
|
||||
## Problem Statement
|
||||
|
||||
Issue #1460 describes a meta-problem: creating 7 duplicate PRs for issue #1128, which was itself about cleaning up duplicate PRs. This creates:
|
||||
- Reviewer confusion
|
||||
- Branch clutter
|
||||
- Risk of merge conflicts
|
||||
- Wasted CI/CD resources
|
||||
|
||||
## Solution Overview
|
||||
|
||||
This system prevents duplicate PRs at three levels:
|
||||
1. **Local Prevention** — Git hooks that check before pushing
|
||||
2. **CI/CD Prevention** — Workflows that check when PRs are created
|
||||
3. **Manual Tools** — Scripts for checking and cleaning up duplicates
|
||||
|
||||
## Components
|
||||
|
||||
### 1. `bin/duplicate_pr_prevention.py`
|
||||
Main prevention script with three modes:
|
||||
|
||||
**Check for duplicates:**
|
||||
```bash
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --check
|
||||
```
|
||||
|
||||
**Clean up duplicates:**
|
||||
```bash
|
||||
# Dry run (see what would be closed)
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --cleanup --dry-run
|
||||
|
||||
# Actually close duplicates
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --cleanup
|
||||
```
|
||||
|
||||
**Generate report:**
|
||||
```bash
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --report
|
||||
```
|
||||
|
||||
### 2. `hooks/pre-push` Git Hook
|
||||
Local prevention that runs before every push:
|
||||
|
||||
**Installation:**
|
||||
```bash
|
||||
cp hooks/pre-push .git/hooks/pre-push
|
||||
chmod +x .git/hooks/pre-push
|
||||
```
|
||||
|
||||
**How it works:**
|
||||
1. Extracts issue number from branch name (e.g., `fix/1128-something` → `1128`)
|
||||
2. Checks for existing PRs for that issue
|
||||
3. Blocks push if duplicates found
|
||||
4. Provides instructions for resolution
|
||||
|
||||
### 3. `.gitea/workflows/duplicate-pr-check.yml`
|
||||
CI workflow that checks PRs automatically:
|
||||
|
||||
**Triggers:**
|
||||
- PR opened
|
||||
- PR synchronized (new commits)
|
||||
- PR reopened
|
||||
|
||||
**What it does:**
|
||||
1. Extracts issue number from PR title or branch name
|
||||
2. Checks for existing PRs
|
||||
3. Fails CI if duplicates found
|
||||
4. Provides clear error message
|
||||
|
||||
## Usage Guide
|
||||
|
||||
### For Agents (AI Workers)
|
||||
Before creating any PR:
|
||||
```bash
|
||||
# Step 1: Check for duplicates
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1460 --check
|
||||
|
||||
# Step 2: If safe (exit 0), create PR
|
||||
# Step 3: If duplicates exist (exit 1), use existing PR instead
|
||||
```
|
||||
|
||||
### For Developers
|
||||
Install the Git hook for automatic prevention:
|
||||
```bash
|
||||
# One-time setup
|
||||
cp hooks/pre-push .git/hooks/pre-push
|
||||
chmod +x .git/hooks/pre-push
|
||||
|
||||
# Now git push will automatically check for duplicates
|
||||
git push # Will be blocked if duplicates exist
|
||||
```
|
||||
|
||||
### For CI/CD
|
||||
The workflow runs automatically on all PRs. No setup needed.
|
||||
|
||||
## Examples
|
||||
|
||||
### Check for duplicates:
|
||||
```bash
|
||||
$ python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --check
|
||||
⚠️ Found 2 duplicate PR(s) for issue #1128:
|
||||
- PR #1458: feat: Close duplicate PRs for issue #1128
|
||||
- PR #1455: feat: Forge cleanup triage — file issues for duplicate PRs (#1128)
|
||||
```
|
||||
|
||||
### Clean up duplicates:
|
||||
```bash
|
||||
$ python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --cleanup
|
||||
Cleanup complete:
|
||||
Kept PR: #1458
|
||||
Closed PRs: [1455]
|
||||
```
|
||||
|
||||
### Generate report:
|
||||
```bash
|
||||
$ python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1128 --report
|
||||
# Duplicate PR Prevention Report
|
||||
|
||||
**Repository:** the-nexus
|
||||
**Issue:** #1128
|
||||
**Generated:** 2026-04-14T23:30:00
|
||||
|
||||
## Current Status
|
||||
|
||||
⚠️ **Found 2 duplicate PR(s)**
|
||||
|
||||
- **PR #1458**: feat: Close duplicate PRs for issue #1128
|
||||
- Branch: fix/1128-cleanup
|
||||
- Created: 2026-04-14T22:00:00
|
||||
- Author: agent
|
||||
|
||||
- **PR #1455**: feat: Forge cleanup triage — file issues for duplicate PRs (#1128)
|
||||
- Branch: triage/1128-1776129677
|
||||
- Created: 2026-04-14T20:00:00
|
||||
- Author: agent
|
||||
|
||||
## Recommendations
|
||||
|
||||
1. **Review existing PRs** — Check which one is the best solution
|
||||
2. **Keep the newest** — Usually the most up-to-date
|
||||
3. **Close duplicates** — Use cleanup_duplicate_prs.py
|
||||
4. **Prevent future duplicates** — Use check_duplicate_pr.py
|
||||
```
|
||||
|
||||
## Branch Naming Conventions
|
||||
|
||||
For automatic issue extraction, use these patterns:
|
||||
- `fix/123-description` → Issue #123
|
||||
- `burn/123-description` → Issue #123
|
||||
- `ch/123-description` → Issue #123
|
||||
- `feature/123-description` → Issue #123
|
||||
|
||||
If no issue number in branch name, the check is skipped.
|
||||
|
||||
## Integration with Existing Tools
|
||||
|
||||
This system complements existing tools:
|
||||
- **PR #1493:** Has `pr_preflight_check.py` — similar functionality
|
||||
- **PR #1497:** Has `check_duplicate_pr.py` — similar functionality
|
||||
|
||||
This system provides additional features:
|
||||
1. **Git hooks** for local prevention
|
||||
2. **CI workflows** for automated checking
|
||||
3. **Cleanup tools** for closing duplicates
|
||||
4. **Comprehensive reporting**
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Hook not working?
|
||||
```bash
|
||||
# Check if hook is installed
|
||||
ls -la .git/hooks/pre-push
|
||||
|
||||
# Make sure it's executable
|
||||
chmod +x .git/hooks/pre-push
|
||||
|
||||
# Test it manually
|
||||
./.git/hooks/pre-push
|
||||
```
|
||||
|
||||
### CI failing?
|
||||
1. Check if `GITEA_TOKEN` secret is set
|
||||
2. Verify issue number can be extracted from PR title/branch
|
||||
3. Check workflow logs for details
|
||||
|
||||
### False positives?
|
||||
If the script incorrectly identifies duplicates:
|
||||
1. Check PR titles and bodies for issue references
|
||||
2. Use `--report` to see what's being detected
|
||||
3. Manually close incorrect PRs if needed
|
||||
|
||||
## Prevention Strategy
|
||||
|
||||
### 1. **Always Check First**
|
||||
```bash
|
||||
# Before creating any PR
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1460 --check
|
||||
```
|
||||
|
||||
### 2. **Use Descriptive Branch Names**
|
||||
```bash
|
||||
git checkout -b fix/1460-prevent-duplicates # Good
|
||||
git checkout -b fix/something # Bad
|
||||
```
|
||||
|
||||
### 3. **Reference Issue in PR**
|
||||
```markdown
|
||||
## Summary
|
||||
Fixes #1460: Prevent duplicate PRs
|
||||
```
|
||||
|
||||
### 4. **Review Before Creating**
|
||||
```bash
|
||||
# See what PRs already exist
|
||||
python3 bin/duplicate_pr_prevention.py --repo the-nexus --issue 1460 --report
|
||||
```
|
||||
|
||||
## Related Issues
|
||||
|
||||
- **Issue #1460:** This implementation
|
||||
- **Issue #1128:** Original issue that had 7 duplicate PRs
|
||||
- **Issue #1449:** [URGENT] 5 duplicate PRs for issue #1128 need cleanup
|
||||
- **Issue #1474:** [META] Still creating duplicate PRs for issue #1128 despite cleanup
|
||||
- **Issue #1480:** [META] 4th duplicate PR for issue #1128 — need intervention
|
||||
|
||||
## Files
|
||||
|
||||
```
|
||||
bin/duplicate_pr_prevention.py # Main prevention script
|
||||
hooks/pre-push # Git hook for local prevention
|
||||
.gitea/workflows/duplicate-pr-check.yml # CI workflow
|
||||
DUPLICATE_PR_PREVENTION.md # This documentation
|
||||
```
|
||||
|
||||
## License
|
||||
|
||||
Part of the Timmy Foundation project.
|
||||
230
bin/duplicate_pr_prevention.py
Executable file
230
bin/duplicate_pr_prevention.py
Executable file
@@ -0,0 +1,230 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Duplicate PR Prevention System for Timmy Foundation
|
||||
Prevents the issue described in #1460: creating duplicate PRs for the same issue.
|
||||
"""
|
||||
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import urllib.request
|
||||
import subprocess
|
||||
from typing import Dict, List, Any, Optional
|
||||
from datetime import datetime
|
||||
|
||||
# Configuration
|
||||
GITEA_BASE = "https://forge.alexanderwhitestone.com/api/v1"
|
||||
TOKEN_PATH = os.path.expanduser("~/.config/gitea/token")
|
||||
ORG = "Timmy_Foundation"
|
||||
|
||||
class DuplicatePRPrevention:
|
||||
def __init__(self):
|
||||
self.token = self._load_token()
|
||||
|
||||
def _load_token(self) -> str:
|
||||
"""Load Gitea API token."""
|
||||
try:
|
||||
with open(TOKEN_PATH, "r") as f:
|
||||
return f.read().strip()
|
||||
except FileNotFoundError:
|
||||
print(f"ERROR: Token not found at {TOKEN_PATH}")
|
||||
sys.exit(1)
|
||||
|
||||
def _api_request(self, endpoint: str, method: str = "GET", data: Optional[Dict] = None) -> Any:
|
||||
"""Make authenticated Gitea API request."""
|
||||
url = f"{GITEA_BASE}{endpoint}"
|
||||
headers = {
|
||||
"Authorization": f"token {self.token}",
|
||||
"Content-Type": "application/json"
|
||||
}
|
||||
|
||||
req = urllib.request.Request(url, headers=headers, method=method)
|
||||
if data:
|
||||
req.data = json.dumps(data).encode()
|
||||
|
||||
try:
|
||||
with urllib.request.urlopen(req) as resp:
|
||||
if resp.status == 204: # No content
|
||||
return {"status": "success", "code": resp.status}
|
||||
return json.loads(resp.read())
|
||||
except urllib.error.HTTPError as e:
|
||||
error_body = e.read().decode() if e.fp else "No error body"
|
||||
print(f"API Error {e.code}: {error_body}")
|
||||
return {"error": e.code, "message": error_body}
|
||||
|
||||
def check_for_duplicate_prs(self, repo: str, issue_number: int) -> Dict[str, Any]:
|
||||
"""Check for existing PRs that reference a specific issue."""
|
||||
# Get all open PRs
|
||||
endpoint = f"/repos/{ORG}/{repo}/pulls?state=open"
|
||||
prs = self._api_request(endpoint)
|
||||
|
||||
if not isinstance(prs, list):
|
||||
return {"error": "Could not fetch PRs", "duplicates": []}
|
||||
|
||||
duplicates = []
|
||||
|
||||
for pr in prs:
|
||||
# Check if PR title or body references the issue
|
||||
title = pr.get('title', '').lower()
|
||||
body = pr.get('body', '').lower() if pr.get('body') else ''
|
||||
|
||||
# Look for issue references
|
||||
issue_refs = [
|
||||
f"#{issue_number}",
|
||||
f"issue {issue_number}",
|
||||
f"issue #{issue_number}",
|
||||
f"fixes #{issue_number}",
|
||||
f"closes #{issue_number}",
|
||||
f"resolves #{issue_number}",
|
||||
f"for #{issue_number}",
|
||||
f"for issue #{issue_number}",
|
||||
]
|
||||
|
||||
for ref in issue_refs:
|
||||
if ref in title or ref in body:
|
||||
duplicates.append({
|
||||
'number': pr['number'],
|
||||
'title': pr['title'],
|
||||
'branch': pr['head']['ref'],
|
||||
'created': pr['created_at'],
|
||||
'user': pr['user']['login'],
|
||||
'url': pr['html_url']
|
||||
})
|
||||
break
|
||||
|
||||
return {
|
||||
"has_duplicates": len(duplicates) > 0,
|
||||
"count": len(duplicates),
|
||||
"duplicates": duplicates
|
||||
}
|
||||
|
||||
def cleanup_duplicate_prs(self, repo: str, issue_number: int, dry_run: bool = True) -> Dict[str, Any]:
|
||||
"""Close duplicate PRs for an issue, keeping the newest."""
|
||||
duplicates = self.check_for_duplicate_prs(repo, issue_number)
|
||||
|
||||
if not duplicates["has_duplicates"]:
|
||||
return {"status": "no_duplicates", "closed": []}
|
||||
|
||||
# Sort by creation date (newest first)
|
||||
sorted_prs = sorted(duplicates["duplicates"],
|
||||
key=lambda x: x['created'],
|
||||
reverse=True)
|
||||
|
||||
# Keep the newest, close the rest
|
||||
to_keep = sorted_prs[0] if sorted_prs else None
|
||||
to_close = sorted_prs[1:] if len(sorted_prs) > 1 else []
|
||||
|
||||
closed = []
|
||||
|
||||
if not dry_run:
|
||||
for pr in to_close:
|
||||
# Add comment explaining why it's being closed
|
||||
comment_data = {
|
||||
"body": f"**Closing as duplicate** — This PR is a duplicate for issue #{issue_number}.\n\n"
|
||||
f"Keeping PR #{to_keep['number']} instead.\n\n"
|
||||
f"This is an automated cleanup to prevent duplicate PRs.\n"
|
||||
f"See issue #1460 for context."
|
||||
}
|
||||
|
||||
# Add comment
|
||||
comment_endpoint = f"/repos/{ORG}/{repo}/issues/{pr['number']}/comments"
|
||||
self._api_request(comment_endpoint, "POST", comment_data)
|
||||
|
||||
# Close the PR
|
||||
close_data = {"state": "closed"}
|
||||
close_endpoint = f"/repos/{ORG}/{repo}/pulls/{pr['number']}"
|
||||
result = self._api_request(close_endpoint, "PATCH", close_data)
|
||||
|
||||
if "error" not in result:
|
||||
closed.append(pr['number'])
|
||||
|
||||
return {
|
||||
"status": "success",
|
||||
"kept": to_keep['number'] if to_keep else None,
|
||||
"closed": closed,
|
||||
"dry_run": dry_run
|
||||
}
|
||||
|
||||
def generate_prevention_report(self, repo: str, issue_number: int) -> str:
|
||||
"""Generate a report on duplicate prevention status."""
|
||||
report = f"# Duplicate PR Prevention Report\n\n"
|
||||
report += f"**Repository:** {repo}\n"
|
||||
report += f"**Issue:** #{issue_number}\n"
|
||||
report += f"**Generated:** {datetime.now().isoformat()}\n\n"
|
||||
|
||||
# Check for duplicates
|
||||
duplicates = self.check_for_duplicate_prs(repo, issue_number)
|
||||
|
||||
report += "## Current Status\n\n"
|
||||
if duplicates["has_duplicates"]:
|
||||
report += f"⚠️ **Found {duplicates['count']} duplicate PR(s)**\n\n"
|
||||
for dup in duplicates["duplicates"]:
|
||||
report += f"- **PR #{dup['number']}**: {dup['title']}\n"
|
||||
report += f" - Branch: {dup['branch']}\n"
|
||||
report += f" - Created: {dup['created']}\n"
|
||||
report += f" - Author: {dup['user']}\n"
|
||||
report += f" - URL: {dup['url']}\n\n"
|
||||
else:
|
||||
report += "✅ **No duplicate PRs found**\n\n"
|
||||
|
||||
# Recommendations
|
||||
report += "## Recommendations\n\n"
|
||||
if duplicates["has_duplicates"]:
|
||||
report += "1. **Review existing PRs** — Check which one is the best solution\n"
|
||||
report += "2. **Keep the newest** — Usually the most up-to-date\n"
|
||||
report += "3. **Close duplicates** — Use cleanup_duplicate_prs.py\n"
|
||||
report += "4. **Prevent future duplicates** — Use check_duplicate_pr.py\n"
|
||||
else:
|
||||
report += "1. **Safe to create PR** — No duplicates exist\n"
|
||||
report += "2. **Use prevention tools** — Always check before creating PRs\n"
|
||||
report += "3. **Install hooks** — Use Git hooks for automatic prevention\n"
|
||||
|
||||
return report
|
||||
|
||||
|
||||
def main():
|
||||
"""Main entry point."""
|
||||
import argparse
|
||||
|
||||
parser = argparse.ArgumentParser(description="Duplicate PR Prevention System")
|
||||
parser.add_argument("--repo", required=True, help="Repository name (e.g., the-nexus)")
|
||||
parser.add_argument("--issue", required=True, type=int, help="Issue number")
|
||||
parser.add_argument("--check", action="store_true", help="Check for duplicates")
|
||||
parser.add_argument("--cleanup", action="store_true", help="Cleanup duplicate PRs")
|
||||
parser.add_argument("--dry-run", action="store_true", help="Dry run for cleanup")
|
||||
parser.add_argument("--report", action="store_true", help="Generate report")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
prevention = DuplicatePRPrevention()
|
||||
|
||||
if args.check:
|
||||
result = prevention.check_for_duplicate_prs(args.repo, args.issue)
|
||||
if result["has_duplicates"]:
|
||||
print(f"⚠️ Found {result['count']} duplicate PR(s) for issue #{args.issue}:")
|
||||
for dup in result["duplicates"]:
|
||||
print(f" - PR #{dup['number']}: {dup['title']}")
|
||||
sys.exit(1)
|
||||
else:
|
||||
print(f"✅ No duplicate PRs found for issue #{args.issue}")
|
||||
sys.exit(0)
|
||||
|
||||
elif args.cleanup:
|
||||
result = prevention.cleanup_duplicate_prs(args.repo, args.issue, args.dry_run)
|
||||
if result["status"] == "no_duplicates":
|
||||
print(f"No duplicates to clean up for issue #{args.issue}")
|
||||
else:
|
||||
print(f"Cleanup {'(dry run) ' if args.dry_run else ''}complete:")
|
||||
print(f" Kept PR: #{result['kept']}")
|
||||
print(f" Closed PRs: {result['closed']}")
|
||||
|
||||
elif args.report:
|
||||
report = prevention.generate_prevention_report(args.repo, args.issue)
|
||||
print(report)
|
||||
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,307 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Safe commit message handler to prevent shell injection.
|
||||
|
||||
Issue #1430: [IMPROVEMENT] memory_mine.py ran during git commit — shell injection from commit message
|
||||
|
||||
This script provides safe ways to commit with code-containing messages.
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import subprocess
|
||||
import tempfile
|
||||
import re
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def escape_shell_chars(text: str) -> str:
|
||||
"""
|
||||
Escape shell-sensitive characters in text.
|
||||
|
||||
This prevents shell injection when text is used in shell commands.
|
||||
"""
|
||||
# Characters that need escaping in shell
|
||||
shell_chars = ['$', '`', '\\', '"', "'", '!', '(', ')', '{', '}', '[', ']',
|
||||
'|', '&', ';', '<', '>', '*', '?', '~', '#']
|
||||
|
||||
escaped = text
|
||||
for char in shell_chars:
|
||||
escaped = escaped.replace(char, '\\' + char)
|
||||
|
||||
return escaped
|
||||
|
||||
|
||||
def safe_commit_message(message: str) -> str:
|
||||
"""
|
||||
Create a safe commit message by escaping shell-sensitive characters.
|
||||
|
||||
Args:
|
||||
message: The commit message
|
||||
|
||||
Returns:
|
||||
Escaped commit message safe for shell use
|
||||
"""
|
||||
return escape_shell_chars(message)
|
||||
|
||||
|
||||
def commit_with_file(message: str, branch: str = None) -> bool:
|
||||
"""
|
||||
Commit using a temporary file instead of -m flag.
|
||||
|
||||
This is the safest way to commit messages containing code or special characters.
|
||||
|
||||
Args:
|
||||
message: The commit message
|
||||
branch: Optional branch name
|
||||
|
||||
Returns:
|
||||
True if successful, False otherwise
|
||||
"""
|
||||
# Create temporary file for commit message
|
||||
with tempfile.NamedTemporaryFile(mode='w', suffix='.txt', delete=False) as f:
|
||||
f.write(message)
|
||||
temp_file = f.name
|
||||
|
||||
try:
|
||||
# Build git command
|
||||
cmd = ['git', 'commit', '-F', temp_file]
|
||||
if branch:
|
||||
cmd.extend(['-b', branch])
|
||||
|
||||
# Execute git commit
|
||||
result = subprocess.run(cmd, capture_output=True, text=True)
|
||||
|
||||
if result.returncode == 0:
|
||||
print(f"✅ Committed successfully using file: {temp_file}")
|
||||
return True
|
||||
else:
|
||||
print(f"❌ Commit failed: {result.stderr}")
|
||||
return False
|
||||
|
||||
finally:
|
||||
# Clean up temporary file
|
||||
try:
|
||||
os.unlink(temp_file)
|
||||
except:
|
||||
pass
|
||||
|
||||
|
||||
def commit_safe(message: str, use_file: bool = True) -> bool:
|
||||
"""
|
||||
Safely commit with a message.
|
||||
|
||||
Args:
|
||||
message: The commit message
|
||||
use_file: If True, use -F <file> instead of -m
|
||||
|
||||
Returns:
|
||||
True if successful, False otherwise
|
||||
"""
|
||||
if use_file:
|
||||
return commit_with_file(message)
|
||||
else:
|
||||
# Use escaped message with -m flag
|
||||
escaped_message = safe_commit_message(message)
|
||||
cmd = ['git', 'commit', '-m', escaped_message]
|
||||
|
||||
result = subprocess.run(cmd, capture_output=True, text=True)
|
||||
|
||||
if result.returncode == 0:
|
||||
print("✅ Committed successfully with escaped message")
|
||||
return True
|
||||
else:
|
||||
print(f"❌ Commit failed: {result.stderr}")
|
||||
return False
|
||||
|
||||
|
||||
def check_commit_message_safety(message: str) -> dict:
|
||||
"""
|
||||
Check if a commit message contains potentially dangerous patterns.
|
||||
|
||||
Args:
|
||||
message: The commit message to check
|
||||
|
||||
Returns:
|
||||
Dictionary with safety analysis
|
||||
"""
|
||||
dangerous_patterns = [
|
||||
(r'`[^`]*`', 'Backticks (shell command substitution)'),
|
||||
(r'\$\([^)]*\)', 'Command substitution $(...)'),
|
||||
(r'\$\{[^}]*\}', 'Variable expansion ${...}'),
|
||||
(r'\\`', 'Escaped backticks'),
|
||||
(r'eval\s+', 'eval command'),
|
||||
(r'exec\s+', 'exec command'),
|
||||
(r'source\s+', 'source command'),
|
||||
(r'\.\s+', 'dot command'),
|
||||
(r'\|\s*', 'Pipe character'),
|
||||
(r'&&', 'AND operator'),
|
||||
(r'\|\|', 'OR operator'),
|
||||
(r';', 'Semicolon (command separator)'),
|
||||
(r'>', 'Redirect operator'),
|
||||
(r'<', 'Input redirect'),
|
||||
]
|
||||
|
||||
findings = []
|
||||
for pattern, description in dangerous_patterns:
|
||||
matches = re.findall(pattern, message)
|
||||
if matches:
|
||||
findings.append({
|
||||
'pattern': pattern,
|
||||
'description': description,
|
||||
'matches': matches,
|
||||
'count': len(matches)
|
||||
})
|
||||
|
||||
return {
|
||||
'safe': len(findings) == 0,
|
||||
'findings': findings,
|
||||
'recommendation': 'Use commit_with_file() or escape_shell_chars()' if findings else 'Message appears safe'
|
||||
}
|
||||
|
||||
|
||||
def create_commit_hook_guard():
|
||||
"""
|
||||
Create a commit-msg hook that warns about dangerous patterns.
|
||||
"""
|
||||
hook_content = '''#!/usr/bin/env bash
|
||||
# Commit-msg hook: warn about shell injection risks
|
||||
# Install: cp .githooks/commit-msg .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg
|
||||
|
||||
COMMIT_MSG_FILE="$1"
|
||||
COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
|
||||
|
||||
# Check for dangerous patterns
|
||||
DANGEROUS_PATTERNS=(
|
||||
'`' # Backticks
|
||||
'$(' # Command substitution
|
||||
'${' # Variable expansion
|
||||
'\\`' # Escaped backticks
|
||||
'eval ' # eval command
|
||||
'exec ' # exec command
|
||||
'source ' # source command
|
||||
'|' # Pipe
|
||||
'&&' # AND operator
|
||||
'||' # OR operator
|
||||
';' # Semicolon
|
||||
'>' # Redirect
|
||||
'<' # Input redirect
|
||||
)
|
||||
|
||||
FOUND_ISSUES=()
|
||||
for pattern in "${DANGEROUS_PATTERNS[@]}"; do
|
||||
if echo "$COMMIT_MSG" | grep -q "$pattern"; then
|
||||
FOUND_ISSUES+=("$pattern")
|
||||
fi
|
||||
done
|
||||
|
||||
if [ ${#FOUND_ISSUES[@]} -gt 0 ]; then
|
||||
echo "⚠️ WARNING: Commit message contains potentially dangerous patterns:"
|
||||
for issue in "${FOUND_ISSUES[@]}"; do
|
||||
echo " - $issue"
|
||||
done
|
||||
echo ""
|
||||
echo "This could trigger shell execution during git operations."
|
||||
echo ""
|
||||
echo "Safe alternatives:"
|
||||
echo " 1. Use: git commit -F <file> instead of git commit -m"
|
||||
echo " 2. Escape special characters in commit messages"
|
||||
echo " 3. Use the safe_commit() function from bin/safe_commit.py"
|
||||
echo ""
|
||||
echo "To proceed anyway, use: git commit --no-verify"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
'''
|
||||
|
||||
return hook_content
|
||||
|
||||
|
||||
def install_commit_hook():
|
||||
"""
|
||||
Install the commit-msg hook to warn about dangerous patterns.
|
||||
"""
|
||||
hook_path = Path('.git/hooks/commit-msg')
|
||||
hook_content = create_commit_hook_guard()
|
||||
|
||||
# Check if .git/hooks exists
|
||||
if not hook_path.parent.exists():
|
||||
print("❌ .git/hooks directory not found")
|
||||
return False
|
||||
|
||||
# Write hook
|
||||
with open(hook_path, 'w') as f:
|
||||
f.write(hook_content)
|
||||
|
||||
# Make executable
|
||||
os.chmod(hook_path, 0o755)
|
||||
|
||||
print(f"✅ Installed commit-msg hook to {hook_path}")
|
||||
return True
|
||||
|
||||
|
||||
def main():
|
||||
"""Main entry point for safe commit tool."""
|
||||
import argparse
|
||||
|
||||
parser = argparse.ArgumentParser(description="Safe commit message handling")
|
||||
parser.add_argument("--message", "-m", help="Commit message")
|
||||
parser.add_argument("--file", "-F", help="Read commit message from file")
|
||||
parser.add_argument("--check", action="store_true", help="Check message safety")
|
||||
parser.add_argument("--install-hook", action="store_true", help="Install commit-msg hook")
|
||||
parser.add_argument("--escape", action="store_true", help="Escape shell characters in message")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.install_hook:
|
||||
if install_commit_hook():
|
||||
print("Commit hook installed successfully")
|
||||
else:
|
||||
print("Failed to install commit hook")
|
||||
sys.exit(1)
|
||||
return
|
||||
|
||||
if args.check:
|
||||
if args.message:
|
||||
safety = check_commit_message_safety(args.message)
|
||||
print(f"Message safety check:")
|
||||
print(f" Safe: {safety['safe']}")
|
||||
print(f" Recommendation: {safety['recommendation']}")
|
||||
if safety['findings']:
|
||||
print(f" Findings:")
|
||||
for finding in safety['findings']:
|
||||
print(f" - {finding['description']}: {finding['count']} matches")
|
||||
else:
|
||||
print("Please provide a message with --message")
|
||||
return
|
||||
|
||||
if args.escape:
|
||||
if args.message:
|
||||
escaped = safe_commit_message(args.message)
|
||||
print(f"Escaped message:")
|
||||
print(escaped)
|
||||
else:
|
||||
print("Please provide a message with --message")
|
||||
return
|
||||
|
||||
if args.file:
|
||||
# Read message from file
|
||||
with open(args.file, 'r') as f:
|
||||
message = f.read()
|
||||
commit_with_file(message)
|
||||
elif args.message:
|
||||
# Check if message has dangerous patterns
|
||||
safety = check_commit_message_safety(args.message)
|
||||
if safety['safe']:
|
||||
commit_safe(args.message, use_file=False)
|
||||
else:
|
||||
print("⚠️ Message contains potentially dangerous patterns")
|
||||
print("Using file-based commit for safety...")
|
||||
commit_safe(args.message, use_file=True)
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -1,159 +0,0 @@
|
||||
# Safe Commit Practices
|
||||
|
||||
**Issue:** #1430 - [IMPROVEMENT] memory_mine.py ran during git commit — shell injection from commit message
|
||||
|
||||
## Problem
|
||||
|
||||
During commit for #1124, the commit message contained Python code examples that triggered shell execution of memory_mine.py. The backtick-wrapped code in the commit message was interpreted by the shell during git commit processing.
|
||||
|
||||
This is a potential vector for unintended code execution.
|
||||
|
||||
## Safe Commit Methods
|
||||
|
||||
### 1. Use `git commit -F <file>` (Recommended)
|
||||
|
||||
The safest way to commit messages containing code or special characters:
|
||||
|
||||
```bash
|
||||
# Create a file with your commit message
|
||||
echo "Fix: implement memory_mine.py with backtick example
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This commit adds memory mining functionality." > /tmp/commit-msg.txt
|
||||
|
||||
# Commit using the file
|
||||
git commit -F /tmp/commit-msg.txt
|
||||
```
|
||||
|
||||
### 2. Use the Safe Commit Tool
|
||||
|
||||
```bash
|
||||
# Safe commit with automatic escaping
|
||||
python3 bin/safe_commit.py -m "Fix: implement memory_mine.py with backtick example"
|
||||
|
||||
# Safe commit using file
|
||||
python3 bin/safe_commit.py -F /tmp/commit-msg.txt
|
||||
|
||||
# Check if a message is safe
|
||||
python3 bin/safe_commit.py --check -m "Example: \`python3 bin/memory_mine.py\`"
|
||||
```
|
||||
|
||||
### 3. Escape Shell Characters Manually
|
||||
|
||||
If you must use `git commit -m`, escape special characters:
|
||||
|
||||
```bash
|
||||
# Escape backticks and other shell characters
|
||||
git commit -m "Fix: implement memory_mine.py with backtick example
|
||||
|
||||
Example: \\`python3 bin/memory_mine.py --days 7\\`
|
||||
|
||||
This commit adds memory mining functionality."
|
||||
```
|
||||
|
||||
## Dangerous Patterns to Avoid
|
||||
|
||||
The following patterns in commit messages can trigger shell execution:
|
||||
|
||||
- **Backticks**: `` `command` `` → Executes command
|
||||
- **Command substitution**: `$(command)` → Executes command
|
||||
- **Variable expansion**: `${variable}` → Expands variable
|
||||
- **Pipes**: `command1 | command2` → Pipes output
|
||||
- **Operators**: `&&`, `||`, `;` → Command chaining
|
||||
- **Redirects**: `>`, `<` → File operations
|
||||
|
||||
## Installation
|
||||
|
||||
### Install the Commit Hook
|
||||
|
||||
To automatically warn about dangerous patterns:
|
||||
|
||||
```bash
|
||||
# Install the commit-msg hook
|
||||
python3 bin/safe_commit.py --install-hook
|
||||
|
||||
# Or manually
|
||||
cp .githooks/commit-msg .git/hooks/commit-msg
|
||||
chmod +x .git/hooks/commit-msg
|
||||
```
|
||||
|
||||
### Configure Git Hooks Path
|
||||
|
||||
If using the `.githooks` directory:
|
||||
|
||||
```bash
|
||||
git config core.hooksPath .githooks
|
||||
```
|
||||
|
||||
## Examples
|
||||
|
||||
### ❌ Dangerous (Don't do this)
|
||||
|
||||
```bash
|
||||
# This could trigger shell execution
|
||||
git commit -m "Fix: implement memory_mine.py
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This mines sessions into MemPalace."
|
||||
```
|
||||
|
||||
### ✅ Safe (Do this instead)
|
||||
|
||||
```bash
|
||||
# Method 1: Use file
|
||||
echo "Fix: implement memory_mine.py
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This mines sessions into MemPalace." > /tmp/commit-msg.txt
|
||||
git commit -F /tmp/commit-msg.txt
|
||||
|
||||
# Method 2: Use safe commit tool
|
||||
python3 bin/safe_commit.py -m "Fix: implement memory_mine.py
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This mines sessions into MemPalace."
|
||||
|
||||
# Method 3: Escape manually
|
||||
git commit -m "Fix: implement memory_mine.py
|
||||
|
||||
Example: \\`python3 bin/memory_mine.py --days 7\\`
|
||||
|
||||
This mines sessions into MemPalace."
|
||||
```
|
||||
|
||||
## What Happened in Issue #1430
|
||||
|
||||
During commit for #1124, a commit message contained:
|
||||
```
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
```
|
||||
|
||||
The backticks were interpreted by the shell during git commit processing, causing memory_mine.py to execute. While the outcome was positive (26 sessions mined), this is a security risk.
|
||||
|
||||
## Prevention
|
||||
|
||||
1. **Always use `git commit -F <file>`** for messages containing code
|
||||
2. **Install the commit-msg hook** to warn about dangerous patterns
|
||||
3. **Use the safe_commit.py tool** for automatic escaping
|
||||
4. **Document safe patterns** in team guidelines
|
||||
|
||||
## Related Issues
|
||||
|
||||
- **Issue #1430:** This improvement
|
||||
- **Issue #1124:** Original issue that triggered the problem
|
||||
|
||||
## Files
|
||||
|
||||
- `bin/safe_commit.py` - Safe commit tool
|
||||
- `.githooks/commit-msg` - Commit hook (to be installed)
|
||||
- `docs/safe-commit-practices.md` - This documentation
|
||||
|
||||
## Conclusion
|
||||
|
||||
Shell injection in commit messages is a real security risk. By using safe commit practices, we can prevent unintended code execution while still allowing code examples in commit messages.
|
||||
|
||||
**Remember:** When in doubt, use `git commit -F <file>` instead of `git commit -m`.
|
||||
59
hooks/pre-push
Normal file
59
hooks/pre-push
Normal file
@@ -0,0 +1,59 @@
|
||||
#!/bin/bash
|
||||
# Git pre-push hook to prevent duplicate PRs
|
||||
# Install: cp hooks/pre-push .git/hooks/pre-push && chmod +x .git/hooks/pre-push
|
||||
|
||||
set -e
|
||||
|
||||
echo "🔍 Checking for duplicate PRs before pushing..."
|
||||
|
||||
# Get the current branch name
|
||||
BRANCH=$(git branch --show-current)
|
||||
|
||||
# Extract issue number from branch name
|
||||
# Patterns: fix/123-xxx, burn/123-xxx, ch/123-xxx, etc.
|
||||
ISSUE_NUM=$(echo "$BRANCH" | grep -oE '[0-9]+' | head -1)
|
||||
|
||||
if [ -z "$ISSUE_NUM" ]; then
|
||||
echo "ℹ️ No issue number found in branch name: $BRANCH"
|
||||
echo " Skipping duplicate check..."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "📋 Found issue #$ISSUE_NUM in branch name"
|
||||
|
||||
# Get repository name from git remote
|
||||
REMOTE_URL=$(git config --get remote.origin.url)
|
||||
if [[ "$REMOTE_URL" == *"Timmy_Foundation/"* ]]; then
|
||||
REPO=$(echo "$REMOTE_URL" | sed 's/.*Timmy_Foundation\///' | sed 's/\.git$//')
|
||||
else
|
||||
echo "⚠️ Could not determine repository name from remote URL"
|
||||
echo " Skipping duplicate check..."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "📦 Repository: $REPO"
|
||||
|
||||
# Run the duplicate checker
|
||||
if [ -f "bin/duplicate_pr_prevention.py" ]; then
|
||||
python3 bin/duplicate_pr_prevention.py --repo "$REPO" --issue "$ISSUE_NUM" --check
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
echo ""
|
||||
echo "❌ PUSH BLOCKED: Duplicate PRs exist for issue #$ISSUE_NUM"
|
||||
echo ""
|
||||
echo "To resolve:"
|
||||
echo " 1. Review existing PRs: python3 bin/duplicate_pr_prevention.py --repo $REPO --issue $ISSUE_NUM --report"
|
||||
echo " 2. Use existing PR instead of creating a new one"
|
||||
echo " 3. Or clean up duplicates: python3 bin/duplicate_pr_prevention.py --repo $REPO --issue $ISSUE_NUM --cleanup"
|
||||
echo ""
|
||||
echo "To bypass (NOT recommended):"
|
||||
echo " git push --no-verify"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "⚠️ duplicate_pr_prevention.py not found in bin/"
|
||||
echo " Skipping duplicate check..."
|
||||
fi
|
||||
|
||||
echo "✅ No duplicate PRs found. Proceeding with push..."
|
||||
exit 0
|
||||
Reference in New Issue
Block a user