Compare commits
1 Commits
fix/1430
...
burn/1480-
| Author | SHA1 | Date | |
|---|---|---|---|
|
5d878179d1 |
@@ -1,49 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Commit-msg hook: warn about shell injection risks
|
||||
# Install: cp .githooks/commit-msg .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg
|
||||
|
||||
COMMIT_MSG_FILE="$1"
|
||||
COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
|
||||
|
||||
# Check for dangerous patterns
|
||||
DANGEROUS_PATTERNS=(
|
||||
'`' # Backticks
|
||||
'$(' # Command substitution
|
||||
'${' # Variable expansion
|
||||
'\\`' # Escaped backticks
|
||||
'eval ' # eval command
|
||||
'exec ' # exec command
|
||||
'source ' # source command
|
||||
'|' # Pipe
|
||||
'&&' # AND operator
|
||||
'||' # OR operator
|
||||
';' # Semicolon
|
||||
'>' # Redirect
|
||||
'<' # Input redirect
|
||||
)
|
||||
|
||||
FOUND_ISSUES=()
|
||||
for pattern in "${DANGEROUS_PATTERNS[@]}"; do
|
||||
if echo "$COMMIT_MSG" | grep -q "$pattern"; then
|
||||
FOUND_ISSUES+=("$pattern")
|
||||
fi
|
||||
done
|
||||
|
||||
if [ ${#FOUND_ISSUES[@]} -gt 0 ]; then
|
||||
echo "⚠️ WARNING: Commit message contains potentially dangerous patterns:"
|
||||
for issue in "${FOUND_ISSUES[@]}"; do
|
||||
echo " - $issue"
|
||||
done
|
||||
echo ""
|
||||
echo "This could trigger shell execution during git operations."
|
||||
echo ""
|
||||
echo "Safe alternatives:"
|
||||
echo " 1. Use: git commit -F <file> instead of git commit -m"
|
||||
echo " 2. Escape special characters in commit messages"
|
||||
echo " 3. Use the safe_commit() function from bin/safe_commit.py"
|
||||
echo ""
|
||||
echo "To proceed anyway, use: git commit --no-verify"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -1,307 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Safe commit message handler to prevent shell injection.
|
||||
|
||||
Issue #1430: [IMPROVEMENT] memory_mine.py ran during git commit — shell injection from commit message
|
||||
|
||||
This script provides safe ways to commit with code-containing messages.
|
||||
"""
|
||||
|
||||
import os
|
||||
import sys
|
||||
import subprocess
|
||||
import tempfile
|
||||
import re
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def escape_shell_chars(text: str) -> str:
|
||||
"""
|
||||
Escape shell-sensitive characters in text.
|
||||
|
||||
This prevents shell injection when text is used in shell commands.
|
||||
"""
|
||||
# Characters that need escaping in shell
|
||||
shell_chars = ['$', '`', '\\', '"', "'", '!', '(', ')', '{', '}', '[', ']',
|
||||
'|', '&', ';', '<', '>', '*', '?', '~', '#']
|
||||
|
||||
escaped = text
|
||||
for char in shell_chars:
|
||||
escaped = escaped.replace(char, '\\' + char)
|
||||
|
||||
return escaped
|
||||
|
||||
|
||||
def safe_commit_message(message: str) -> str:
|
||||
"""
|
||||
Create a safe commit message by escaping shell-sensitive characters.
|
||||
|
||||
Args:
|
||||
message: The commit message
|
||||
|
||||
Returns:
|
||||
Escaped commit message safe for shell use
|
||||
"""
|
||||
return escape_shell_chars(message)
|
||||
|
||||
|
||||
def commit_with_file(message: str, branch: str = None) -> bool:
|
||||
"""
|
||||
Commit using a temporary file instead of -m flag.
|
||||
|
||||
This is the safest way to commit messages containing code or special characters.
|
||||
|
||||
Args:
|
||||
message: The commit message
|
||||
branch: Optional branch name
|
||||
|
||||
Returns:
|
||||
True if successful, False otherwise
|
||||
"""
|
||||
# Create temporary file for commit message
|
||||
with tempfile.NamedTemporaryFile(mode='w', suffix='.txt', delete=False) as f:
|
||||
f.write(message)
|
||||
temp_file = f.name
|
||||
|
||||
try:
|
||||
# Build git command
|
||||
cmd = ['git', 'commit', '-F', temp_file]
|
||||
if branch:
|
||||
cmd.extend(['-b', branch])
|
||||
|
||||
# Execute git commit
|
||||
result = subprocess.run(cmd, capture_output=True, text=True)
|
||||
|
||||
if result.returncode == 0:
|
||||
print(f"✅ Committed successfully using file: {temp_file}")
|
||||
return True
|
||||
else:
|
||||
print(f"❌ Commit failed: {result.stderr}")
|
||||
return False
|
||||
|
||||
finally:
|
||||
# Clean up temporary file
|
||||
try:
|
||||
os.unlink(temp_file)
|
||||
except:
|
||||
pass
|
||||
|
||||
|
||||
def commit_safe(message: str, use_file: bool = True) -> bool:
|
||||
"""
|
||||
Safely commit with a message.
|
||||
|
||||
Args:
|
||||
message: The commit message
|
||||
use_file: If True, use -F <file> instead of -m
|
||||
|
||||
Returns:
|
||||
True if successful, False otherwise
|
||||
"""
|
||||
if use_file:
|
||||
return commit_with_file(message)
|
||||
else:
|
||||
# Use escaped message with -m flag
|
||||
escaped_message = safe_commit_message(message)
|
||||
cmd = ['git', 'commit', '-m', escaped_message]
|
||||
|
||||
result = subprocess.run(cmd, capture_output=True, text=True)
|
||||
|
||||
if result.returncode == 0:
|
||||
print("✅ Committed successfully with escaped message")
|
||||
return True
|
||||
else:
|
||||
print(f"❌ Commit failed: {result.stderr}")
|
||||
return False
|
||||
|
||||
|
||||
def check_commit_message_safety(message: str) -> dict:
|
||||
"""
|
||||
Check if a commit message contains potentially dangerous patterns.
|
||||
|
||||
Args:
|
||||
message: The commit message to check
|
||||
|
||||
Returns:
|
||||
Dictionary with safety analysis
|
||||
"""
|
||||
dangerous_patterns = [
|
||||
(r'`[^`]*`', 'Backticks (shell command substitution)'),
|
||||
(r'\$\([^)]*\)', 'Command substitution $(...)'),
|
||||
(r'\$\{[^}]*\}', 'Variable expansion ${...}'),
|
||||
(r'\\`', 'Escaped backticks'),
|
||||
(r'eval\s+', 'eval command'),
|
||||
(r'exec\s+', 'exec command'),
|
||||
(r'source\s+', 'source command'),
|
||||
(r'\.\s+', 'dot command'),
|
||||
(r'\|\s*', 'Pipe character'),
|
||||
(r'&&', 'AND operator'),
|
||||
(r'\|\|', 'OR operator'),
|
||||
(r';', 'Semicolon (command separator)'),
|
||||
(r'>', 'Redirect operator'),
|
||||
(r'<', 'Input redirect'),
|
||||
]
|
||||
|
||||
findings = []
|
||||
for pattern, description in dangerous_patterns:
|
||||
matches = re.findall(pattern, message)
|
||||
if matches:
|
||||
findings.append({
|
||||
'pattern': pattern,
|
||||
'description': description,
|
||||
'matches': matches,
|
||||
'count': len(matches)
|
||||
})
|
||||
|
||||
return {
|
||||
'safe': len(findings) == 0,
|
||||
'findings': findings,
|
||||
'recommendation': 'Use commit_with_file() or escape_shell_chars()' if findings else 'Message appears safe'
|
||||
}
|
||||
|
||||
|
||||
def create_commit_hook_guard():
|
||||
"""
|
||||
Create a commit-msg hook that warns about dangerous patterns.
|
||||
"""
|
||||
hook_content = '''#!/usr/bin/env bash
|
||||
# Commit-msg hook: warn about shell injection risks
|
||||
# Install: cp .githooks/commit-msg .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg
|
||||
|
||||
COMMIT_MSG_FILE="$1"
|
||||
COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
|
||||
|
||||
# Check for dangerous patterns
|
||||
DANGEROUS_PATTERNS=(
|
||||
'`' # Backticks
|
||||
'$(' # Command substitution
|
||||
'${' # Variable expansion
|
||||
'\\`' # Escaped backticks
|
||||
'eval ' # eval command
|
||||
'exec ' # exec command
|
||||
'source ' # source command
|
||||
'|' # Pipe
|
||||
'&&' # AND operator
|
||||
'||' # OR operator
|
||||
';' # Semicolon
|
||||
'>' # Redirect
|
||||
'<' # Input redirect
|
||||
)
|
||||
|
||||
FOUND_ISSUES=()
|
||||
for pattern in "${DANGEROUS_PATTERNS[@]}"; do
|
||||
if echo "$COMMIT_MSG" | grep -q "$pattern"; then
|
||||
FOUND_ISSUES+=("$pattern")
|
||||
fi
|
||||
done
|
||||
|
||||
if [ ${#FOUND_ISSUES[@]} -gt 0 ]; then
|
||||
echo "⚠️ WARNING: Commit message contains potentially dangerous patterns:"
|
||||
for issue in "${FOUND_ISSUES[@]}"; do
|
||||
echo " - $issue"
|
||||
done
|
||||
echo ""
|
||||
echo "This could trigger shell execution during git operations."
|
||||
echo ""
|
||||
echo "Safe alternatives:"
|
||||
echo " 1. Use: git commit -F <file> instead of git commit -m"
|
||||
echo " 2. Escape special characters in commit messages"
|
||||
echo " 3. Use the safe_commit() function from bin/safe_commit.py"
|
||||
echo ""
|
||||
echo "To proceed anyway, use: git commit --no-verify"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exit 0
|
||||
'''
|
||||
|
||||
return hook_content
|
||||
|
||||
|
||||
def install_commit_hook():
|
||||
"""
|
||||
Install the commit-msg hook to warn about dangerous patterns.
|
||||
"""
|
||||
hook_path = Path('.git/hooks/commit-msg')
|
||||
hook_content = create_commit_hook_guard()
|
||||
|
||||
# Check if .git/hooks exists
|
||||
if not hook_path.parent.exists():
|
||||
print("❌ .git/hooks directory not found")
|
||||
return False
|
||||
|
||||
# Write hook
|
||||
with open(hook_path, 'w') as f:
|
||||
f.write(hook_content)
|
||||
|
||||
# Make executable
|
||||
os.chmod(hook_path, 0o755)
|
||||
|
||||
print(f"✅ Installed commit-msg hook to {hook_path}")
|
||||
return True
|
||||
|
||||
|
||||
def main():
|
||||
"""Main entry point for safe commit tool."""
|
||||
import argparse
|
||||
|
||||
parser = argparse.ArgumentParser(description="Safe commit message handling")
|
||||
parser.add_argument("--message", "-m", help="Commit message")
|
||||
parser.add_argument("--file", "-F", help="Read commit message from file")
|
||||
parser.add_argument("--check", action="store_true", help="Check message safety")
|
||||
parser.add_argument("--install-hook", action="store_true", help="Install commit-msg hook")
|
||||
parser.add_argument("--escape", action="store_true", help="Escape shell characters in message")
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
if args.install_hook:
|
||||
if install_commit_hook():
|
||||
print("Commit hook installed successfully")
|
||||
else:
|
||||
print("Failed to install commit hook")
|
||||
sys.exit(1)
|
||||
return
|
||||
|
||||
if args.check:
|
||||
if args.message:
|
||||
safety = check_commit_message_safety(args.message)
|
||||
print(f"Message safety check:")
|
||||
print(f" Safe: {safety['safe']}")
|
||||
print(f" Recommendation: {safety['recommendation']}")
|
||||
if safety['findings']:
|
||||
print(f" Findings:")
|
||||
for finding in safety['findings']:
|
||||
print(f" - {finding['description']}: {finding['count']} matches")
|
||||
else:
|
||||
print("Please provide a message with --message")
|
||||
return
|
||||
|
||||
if args.escape:
|
||||
if args.message:
|
||||
escaped = safe_commit_message(args.message)
|
||||
print(f"Escaped message:")
|
||||
print(escaped)
|
||||
else:
|
||||
print("Please provide a message with --message")
|
||||
return
|
||||
|
||||
if args.file:
|
||||
# Read message from file
|
||||
with open(args.file, 'r') as f:
|
||||
message = f.read()
|
||||
commit_with_file(message)
|
||||
elif args.message:
|
||||
# Check if message has dangerous patterns
|
||||
safety = check_commit_message_safety(args.message)
|
||||
if safety['safe']:
|
||||
commit_safe(args.message, use_file=False)
|
||||
else:
|
||||
print("⚠️ Message contains potentially dangerous patterns")
|
||||
print("Using file-based commit for safety...")
|
||||
commit_safe(args.message, use_file=True)
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
72
docs/duplicate-pr-prevention.md
Normal file
72
docs/duplicate-pr-prevention.md
Normal file
@@ -0,0 +1,72 @@
|
||||
# Duplicate PR Prevention
|
||||
|
||||
## Problem
|
||||
|
||||
The burn loop creates duplicate PRs for the same issue because it doesn't check for existing PRs before creating new ones.
|
||||
|
||||
## Solution
|
||||
|
||||
Two scripts:
|
||||
|
||||
### 1. Preflight Check (`scripts/preflight-pr-check.sh`)
|
||||
|
||||
Run BEFORE creating a PR:
|
||||
|
||||
```bash
|
||||
./scripts/preflight-pr-check.sh 1128
|
||||
```
|
||||
|
||||
Output if PRs exist:
|
||||
```
|
||||
🚫 BLOCKED: 2 existing PR(s) for issue #1128
|
||||
|
||||
Existing PRs:
|
||||
#1458: feat: Close duplicate PRs for issue #1128
|
||||
Branch: dawn/1128-1776130053
|
||||
URL: https://...
|
||||
|
||||
Options:
|
||||
1. Review and merge an existing PR
|
||||
2. Close duplicates and proceed
|
||||
3. Use --force to bypass (NOT RECOMMENDED)
|
||||
```
|
||||
|
||||
Exit code 1 = blocked. Exit code 0 = safe to proceed.
|
||||
|
||||
### 2. Cleanup Script (`scripts/cleanup-duplicate-prs.sh`)
|
||||
|
||||
Close duplicate PRs:
|
||||
|
||||
```bash
|
||||
# Dry run (show what would be closed)
|
||||
./scripts/cleanup-duplicate-prs.sh 1128
|
||||
|
||||
# Actually close duplicates (keeps oldest)
|
||||
./scripts/cleanup-duplicate-prs.sh 1128 --close
|
||||
```
|
||||
|
||||
## Integration
|
||||
|
||||
### In burn loop
|
||||
|
||||
Add preflight check before PR creation:
|
||||
|
||||
```bash
|
||||
# Before: git push && curl ... /pulls
|
||||
./scripts/preflight-pr-check.sh $ISSUE_NUM || exit 1
|
||||
```
|
||||
|
||||
### In CI
|
||||
|
||||
Add as a GitHub/Gitea Actions check:
|
||||
|
||||
```yaml
|
||||
- name: Check for duplicate PRs
|
||||
run: ./scripts/preflight-pr-check.sh ${{ github.event.issue.number }}
|
||||
```
|
||||
|
||||
## Environment Variables
|
||||
|
||||
- `GITEA_TOKEN` — API token (default: reads from `~/.config/gitea/token`)
|
||||
- `GITEA_URL` — Forge URL (default: `https://forge.alexanderwhitestone.com`)
|
||||
- `GITEA_REPO` — Repository (default: `Timmy_Foundation/the-nexus`)
|
||||
@@ -1,159 +0,0 @@
|
||||
# Safe Commit Practices
|
||||
|
||||
**Issue:** #1430 - [IMPROVEMENT] memory_mine.py ran during git commit — shell injection from commit message
|
||||
|
||||
## Problem
|
||||
|
||||
During commit for #1124, the commit message contained Python code examples that triggered shell execution of memory_mine.py. The backtick-wrapped code in the commit message was interpreted by the shell during git commit processing.
|
||||
|
||||
This is a potential vector for unintended code execution.
|
||||
|
||||
## Safe Commit Methods
|
||||
|
||||
### 1. Use `git commit -F <file>` (Recommended)
|
||||
|
||||
The safest way to commit messages containing code or special characters:
|
||||
|
||||
```bash
|
||||
# Create a file with your commit message
|
||||
echo "Fix: implement memory_mine.py with backtick example
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This commit adds memory mining functionality." > /tmp/commit-msg.txt
|
||||
|
||||
# Commit using the file
|
||||
git commit -F /tmp/commit-msg.txt
|
||||
```
|
||||
|
||||
### 2. Use the Safe Commit Tool
|
||||
|
||||
```bash
|
||||
# Safe commit with automatic escaping
|
||||
python3 bin/safe_commit.py -m "Fix: implement memory_mine.py with backtick example"
|
||||
|
||||
# Safe commit using file
|
||||
python3 bin/safe_commit.py -F /tmp/commit-msg.txt
|
||||
|
||||
# Check if a message is safe
|
||||
python3 bin/safe_commit.py --check -m "Example: \`python3 bin/memory_mine.py\`"
|
||||
```
|
||||
|
||||
### 3. Escape Shell Characters Manually
|
||||
|
||||
If you must use `git commit -m`, escape special characters:
|
||||
|
||||
```bash
|
||||
# Escape backticks and other shell characters
|
||||
git commit -m "Fix: implement memory_mine.py with backtick example
|
||||
|
||||
Example: \\`python3 bin/memory_mine.py --days 7\\`
|
||||
|
||||
This commit adds memory mining functionality."
|
||||
```
|
||||
|
||||
## Dangerous Patterns to Avoid
|
||||
|
||||
The following patterns in commit messages can trigger shell execution:
|
||||
|
||||
- **Backticks**: `` `command` `` → Executes command
|
||||
- **Command substitution**: `$(command)` → Executes command
|
||||
- **Variable expansion**: `${variable}` → Expands variable
|
||||
- **Pipes**: `command1 | command2` → Pipes output
|
||||
- **Operators**: `&&`, `||`, `;` → Command chaining
|
||||
- **Redirects**: `>`, `<` → File operations
|
||||
|
||||
## Installation
|
||||
|
||||
### Install the Commit Hook
|
||||
|
||||
To automatically warn about dangerous patterns:
|
||||
|
||||
```bash
|
||||
# Install the commit-msg hook
|
||||
python3 bin/safe_commit.py --install-hook
|
||||
|
||||
# Or manually
|
||||
cp .githooks/commit-msg .git/hooks/commit-msg
|
||||
chmod +x .git/hooks/commit-msg
|
||||
```
|
||||
|
||||
### Configure Git Hooks Path
|
||||
|
||||
If using the `.githooks` directory:
|
||||
|
||||
```bash
|
||||
git config core.hooksPath .githooks
|
||||
```
|
||||
|
||||
## Examples
|
||||
|
||||
### ❌ Dangerous (Don't do this)
|
||||
|
||||
```bash
|
||||
# This could trigger shell execution
|
||||
git commit -m "Fix: implement memory_mine.py
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This mines sessions into MemPalace."
|
||||
```
|
||||
|
||||
### ✅ Safe (Do this instead)
|
||||
|
||||
```bash
|
||||
# Method 1: Use file
|
||||
echo "Fix: implement memory_mine.py
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This mines sessions into MemPalace." > /tmp/commit-msg.txt
|
||||
git commit -F /tmp/commit-msg.txt
|
||||
|
||||
# Method 2: Use safe commit tool
|
||||
python3 bin/safe_commit.py -m "Fix: implement memory_mine.py
|
||||
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
|
||||
This mines sessions into MemPalace."
|
||||
|
||||
# Method 3: Escape manually
|
||||
git commit -m "Fix: implement memory_mine.py
|
||||
|
||||
Example: \\`python3 bin/memory_mine.py --days 7\\`
|
||||
|
||||
This mines sessions into MemPalace."
|
||||
```
|
||||
|
||||
## What Happened in Issue #1430
|
||||
|
||||
During commit for #1124, a commit message contained:
|
||||
```
|
||||
Example: \`python3 bin/memory_mine.py --days 7\`
|
||||
```
|
||||
|
||||
The backticks were interpreted by the shell during git commit processing, causing memory_mine.py to execute. While the outcome was positive (26 sessions mined), this is a security risk.
|
||||
|
||||
## Prevention
|
||||
|
||||
1. **Always use `git commit -F <file>`** for messages containing code
|
||||
2. **Install the commit-msg hook** to warn about dangerous patterns
|
||||
3. **Use the safe_commit.py tool** for automatic escaping
|
||||
4. **Document safe patterns** in team guidelines
|
||||
|
||||
## Related Issues
|
||||
|
||||
- **Issue #1430:** This improvement
|
||||
- **Issue #1124:** Original issue that triggered the problem
|
||||
|
||||
## Files
|
||||
|
||||
- `bin/safe_commit.py` - Safe commit tool
|
||||
- `.githooks/commit-msg` - Commit hook (to be installed)
|
||||
- `docs/safe-commit-practices.md` - This documentation
|
||||
|
||||
## Conclusion
|
||||
|
||||
Shell injection in commit messages is a real security risk. By using safe commit practices, we can prevent unintended code execution while still allowing code examples in commit messages.
|
||||
|
||||
**Remember:** When in doubt, use `git commit -F <file>` instead of `git commit -m`.
|
||||
@@ -1,170 +1,101 @@
|
||||
#!/usr/bin/env bash
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
# cleanup-duplicate-prs.sh — Identify and close duplicate open PRs
|
||||
#
|
||||
# This script identifies PRs that are duplicates (same issue number
|
||||
# or very similar titles) and closes the older ones.
|
||||
# cleanup-duplicate-prs.sh — Close duplicate PRs for a given issue
|
||||
#
|
||||
# Usage:
|
||||
# ./scripts/cleanup-duplicate-prs.sh [--dry-run] [--close]
|
||||
# ./scripts/cleanup-duplicate-prs.sh <issue_number> [--close]
|
||||
#
|
||||
# Options:
|
||||
# --dry-run Show what would be done without making changes
|
||||
# --close Actually close duplicate PRs (default is dry-run)
|
||||
#
|
||||
# Designed for issue #1128: Forge Cleanup
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
# Without --close: dry run (show what would be closed)
|
||||
# With --close: actually close the duplicates
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# ─── Configuration ──────────────────────────────────────────
|
||||
ISSUE_NUM="${1:?Usage: cleanup-duplicate-prs.sh <issue_number> [--close]}"
|
||||
CLOSE_MODE="${2:-}"
|
||||
GITEA_URL="${GITEA_URL:-https://forge.alexanderwhitestone.com}"
|
||||
GITEA_TOKEN="${GITEA_TOKEN:?Set GITEA_TOKEN env var}"
|
||||
REPO="${REPO:-Timmy_Foundation/the-nexus}"
|
||||
DRY_RUN="${DRY_RUN:-true}"
|
||||
GITEA_TOKEN="${GITEA_TOKEN:-$(cat ~/.config/gitea/token 2>/dev/null || echo '')}"
|
||||
REPO="${GITEA_REPO:-Timmy_Foundation/the-nexus}"
|
||||
|
||||
# Parse command line arguments
|
||||
for arg in "$@"; do
|
||||
case $arg in
|
||||
--dry-run)
|
||||
DRY_RUN="true"
|
||||
;;
|
||||
--close)
|
||||
DRY_RUN="false"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
if [ -z "$GITEA_TOKEN" ]; then
|
||||
echo "ERROR: GITEA_TOKEN not set"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
API="$GITEA_URL/api/v1"
|
||||
AUTH="token $GITEA_TOKEN"
|
||||
REPO_API="${GITEA_URL}/api/v1/repos/${REPO}"
|
||||
|
||||
log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*"; }
|
||||
# Fetch open PRs
|
||||
PRS=$(curl -sf -H "Authorization: token ${GITEA_TOKEN}" "${REPO_API}/pulls?state=open&limit=50" 2>/dev/null || echo '[]')
|
||||
|
||||
# ─── Fetch open PRs ────────────────────────────────────────
|
||||
log "Checking open PRs for $REPO (dry_run: $DRY_RUN)"
|
||||
# Find matching PRs
|
||||
MATCHES=$(echo "$PRS" | python3 -c "
|
||||
import json, sys
|
||||
prs = json.load(sys.stdin)
|
||||
issue = '${ISSUE_NUM}'
|
||||
matches = []
|
||||
for pr in prs:
|
||||
title = pr.get('title', '')
|
||||
body = pr.get('body', '')
|
||||
ref = pr.get('head', {}).get('ref', '')
|
||||
if f'#{issue}' in title or f'#{issue}' in body or issue in ref:
|
||||
matches.append(pr)
|
||||
json.dump(matches, sys.stdout)
|
||||
" 2>/dev/null || echo '[]')
|
||||
|
||||
OPEN_PRS=$(curl -s -H "$AUTH" "$API/repos/$REPO/pulls?state=open&limit=50")
|
||||
COUNT=$(echo "$MATCHES" | python3 -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null || echo '0')
|
||||
|
||||
if [ -z "$OPEN_PRS" ] || [ "$OPEN_PRS" = "null" ]; then
|
||||
log "No open PRs found or API error"
|
||||
if [ "$COUNT" -eq 0 ]; then
|
||||
echo "No PRs found for issue #$ISSUE_NUM"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Count PRs
|
||||
PR_COUNT=$(echo "$OPEN_PRS" | jq length)
|
||||
log "Found $PR_COUNT open PRs"
|
||||
echo "Found $COUNT PR(s) for issue #$ISSUE_NUM:"
|
||||
echo "$MATCHES" | python3 -c "
|
||||
import json, sys
|
||||
prs = json.load(sys.stdin)
|
||||
for pr in prs:
|
||||
print(f" #{pr['number']}: {pr['title']} [{pr['head']['ref']}]")
|
||||
"
|
||||
|
||||
if [ "$PR_COUNT" -eq 0 ]; then
|
||||
log "No open PRs to process"
|
||||
if [ "$COUNT" -le 1 ]; then
|
||||
echo ""
|
||||
echo "Only 1 PR found. No cleanup needed."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ─── Extract issue numbers from PR titles ──────────────────
|
||||
# Create a temporary file for PR data
|
||||
TEMP_FILE=$(mktemp)
|
||||
echo "$OPEN_PRS" | jq -r '.[] | "\(.number)\t\(.title)\t\(.created_at)\t\(.head.ref)"' > "$TEMP_FILE"
|
||||
# Keep the oldest PR, close the rest
|
||||
echo "$MATCHES" | python3 -c "
|
||||
import json, sys
|
||||
prs = json.load(sys.stdin)
|
||||
prs.sort(key=lambda p: p['number'])
|
||||
keep = prs[0]
|
||||
close = prs[1:]
|
||||
print(f'KEEP: #{keep["number"]}: {keep["title"]}')
|
||||
for pr in close:
|
||||
print(f'CLOSE: #{pr["number"]}: {pr["title"]}')
|
||||
"
|
||||
|
||||
# Group PRs by issue number using temporary files
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
trap "rm -rf $TEMP_DIR" EXIT
|
||||
|
||||
while IFS=$'\t' read -r pr_number pr_title pr_created pr_branch; do
|
||||
# Extract issue number from title (look for #123 pattern)
|
||||
if [[ $pr_title =~ \#([0-9]+) ]]; then
|
||||
issue_num="${BASH_REMATCH[1]}"
|
||||
echo "$pr_number,$pr_created,$pr_branch" >> "$TEMP_DIR/issue_$issue_num.txt"
|
||||
fi
|
||||
done < "$TEMP_FILE"
|
||||
|
||||
rm -f "$TEMP_FILE"
|
||||
|
||||
# ─── Identify and process duplicates ──────────────────────
|
||||
DUPLICATES_FOUND=0
|
||||
CLOSED_COUNT=0
|
||||
|
||||
for issue_file in "$TEMP_DIR"/issue_*.txt; do
|
||||
[ -f "$issue_file" ] || continue
|
||||
|
||||
issue_num=$(basename "$issue_file" .txt | sed 's/issue_//')
|
||||
pr_list=$(cat "$issue_file")
|
||||
|
||||
# Count PRs for this issue
|
||||
pr_count=$(echo -n "$pr_list" | grep -c '^' || true)
|
||||
|
||||
if [ "$pr_count" -le 1 ]; then
|
||||
continue # No duplicates
|
||||
fi
|
||||
|
||||
log "Issue #$issue_num has $pr_count open PRs"
|
||||
DUPLICATES_FOUND=$((DUPLICATES_FOUND + 1))
|
||||
|
||||
# Sort by creation date (oldest first)
|
||||
sorted_prs=$(echo -n "$pr_list" | sort -t',' -k2)
|
||||
|
||||
# Keep the newest PR, close the rest
|
||||
newest_pr=""
|
||||
newest_date=""
|
||||
|
||||
while IFS=',' read -r pr_num pr_date pr_branch; do
|
||||
if [ -z "$newest_date" ] || [[ "$pr_date" > "$newest_date" ]]; then
|
||||
newest_pr="$pr_num"
|
||||
newest_date="$pr_date"
|
||||
fi
|
||||
done <<< "$sorted_prs"
|
||||
|
||||
log "Keeping PR #$newest_pr (newest)"
|
||||
|
||||
# Close older PRs
|
||||
while IFS=',' read -r pr_num pr_date pr_branch; do
|
||||
if [ "$pr_num" = "$newest_pr" ]; then
|
||||
continue # Skip the newest PR
|
||||
fi
|
||||
|
||||
log "Closing duplicate PR #$pr_num for issue #$issue_num"
|
||||
|
||||
if [ "$DRY_RUN" = "true" ]; then
|
||||
log "DRY RUN: Would close PR #$pr_num"
|
||||
else
|
||||
# Add a comment explaining why we're closing
|
||||
comment_body="Closing as duplicate. PR #$newest_pr is newer and addresses the same issue (#$issue_num)."
|
||||
|
||||
curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" -d "{\"body\": \"$comment_body\"}" "$API/repos/$REPO/issues/$pr_num/comments" > /dev/null
|
||||
|
||||
# Close the PR
|
||||
curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" -d '{"state": "closed"}' "$API/repos/$REPO/pulls/$pr_num" > /dev/null
|
||||
|
||||
log "Closed PR #$pr_num"
|
||||
CLOSED_COUNT=$((CLOSED_COUNT + 1))
|
||||
fi
|
||||
done <<< "$sorted_prs"
|
||||
done
|
||||
|
||||
# ─── Summary ──────────────────────────────────────────────
|
||||
log "Cleanup complete:"
|
||||
log " Duplicate issue groups found: $DUPLICATES_FOUND"
|
||||
log " PRs closed: $CLOSED_COUNT"
|
||||
log " Dry run: $DRY_RUN"
|
||||
|
||||
if [ "$DUPLICATES_FOUND" -eq 0 ]; then
|
||||
log "No duplicate PRs found"
|
||||
if [ "$CLOSE_MODE" != "--close" ]; then ""
|
||||
echo ""
|
||||
echo "DRY RUN: Add --close to actually close duplicates"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ─── Additional cleanup: Stale PRs ────────────────────────
|
||||
# Check for PRs older than 30 days with no activity
|
||||
log "Checking for stale PRs (older than 30 days)..."
|
||||
# Close duplicates
|
||||
echo "$MATCHES" | python3 -c "
|
||||
import json, sys, urllib.request, os
|
||||
prs = json.load(sys.stdin)
|
||||
prs.sort(key=lambda p: p['number'])
|
||||
token = '${GITEA_TOKEN}'
|
||||
api = '${REPO_API}'
|
||||
for pr in prs[1:]:
|
||||
url = f'{api}/pulls/{pr["number"]}'
|
||||
data = json.dumps({'state': 'closed'}).encode()
|
||||
req = urllib.request.Request(url, data=data, headers={'Authorization': f'token {token}', 'Content-Type': 'application/json'}, method='PATCH')
|
||||
try:
|
||||
urllib.request.urlopen(req)
|
||||
print(f'Closed PR #{pr["number"]}')
|
||||
except Exception as e:
|
||||
print(f'Error closing #{pr["number"]}: {e}')
|
||||
"
|
||||
|
||||
THIRTY_DAYS_AGO=$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ)
|
||||
|
||||
STALE_PRS=$(echo "$OPEN_PRS" | jq -r --arg cutoff "$THIRTY_DAYS_AGO" '.[] | select(.created_at < $cutoff) | "\(.number)\t\(.title)\t\(.created_at)"')
|
||||
|
||||
if [ -n "$STALE_PRS" ]; then
|
||||
STALE_COUNT=$(echo -n "$STALE_PRS" | grep -c '^' || true)
|
||||
log "Found $STALE_COUNT stale PRs (older than 30 days)"
|
||||
|
||||
echo "$STALE_PRS" | while IFS=$'\t' read -r pr_num pr_title pr_created; do
|
||||
log "Stale PR #$pr_num: $pr_title (created: $pr_created)"
|
||||
done
|
||||
else
|
||||
log "No stale PRs found"
|
||||
fi
|
||||
|
||||
log "Script complete"
|
||||
echo ""
|
||||
echo "Cleanup complete."
|
||||
|
||||
82
scripts/preflight-pr-check.sh
Executable file
82
scripts/preflight-pr-check.sh
Executable file
@@ -0,0 +1,82 @@
|
||||
#!/usr/bin/env bash
|
||||
# preflight-pr-check.sh — Prevent duplicate PRs before creating them
|
||||
#
|
||||
# Usage:
|
||||
# ./scripts/preflight-pr-check.sh <issue_number>
|
||||
#
|
||||
# Exit codes:
|
||||
# 0 = safe to proceed (no existing PRs)
|
||||
# 1 = BLOCKED (existing PRs found)
|
||||
# 2 = error
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ISSUE_NUM="${1:?Usage: preflight-pr-check.sh <issue_number>}"
|
||||
GITEA_URL="${GITEA_URL:-https://forge.alexanderwhitestone.com}"
|
||||
GITEA_TOKEN="${GITEA_TOKEN:-$(cat ~/.config/gitea/token 2>/dev/null || echo '')}"
|
||||
REPO="${GITEA_REPO:-Timmy_Foundation/the-nexus}"
|
||||
|
||||
if [ -z "$GITEA_TOKEN" ]; then
|
||||
echo "ERROR: GITEA_TOKEN not set and ~/.config/gitea/token not found"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# Get repo info
|
||||
REPO_API="${GITEA_URL}/api/v1/repos/${REPO}"
|
||||
|
||||
# Fetch open PRs
|
||||
PRS=$(curl -sf -H "Authorization: token ${GITEA_TOKEN}" "${REPO_API}/pulls?state=open&limit=50" 2>/dev/null || echo '[]')
|
||||
|
||||
# Check for existing PRs referencing this issue
|
||||
MATCHING_PRS=$(echo "$PRS" | python3 -c "
|
||||
import json, sys
|
||||
prs = json.load(sys.stdin)
|
||||
issue = '${ISSUE_NUM}'
|
||||
matches = []
|
||||
for pr in prs:
|
||||
title = pr.get('title', '')
|
||||
body = pr.get('body', '')
|
||||
ref = pr.get('head', {}).get('ref', '')
|
||||
if f'#{issue}' in title or f'#{issue}' in body or issue in ref:
|
||||
matches.append({
|
||||
'number': pr['number'],
|
||||
'title': title,
|
||||
'branch': ref,
|
||||
'url': pr.get('html_url', '')
|
||||
})
|
||||
json.dump(matches, sys.stdout)
|
||||
" 2>/dev/null || echo '[]')
|
||||
|
||||
COUNT=$(echo "$MATCHING_PRS" | python3 -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null || echo '0')
|
||||
|
||||
if [ "$COUNT" -gt 0 ]; then
|
||||
echo "╔══════════════════════════════════════════════════════════════╗"
|
||||
echo "║ 🚫 BLOCKED: $COUNT existing PR(s) for issue #$ISSUE_NUM"
|
||||
echo "╚══════════════════════════════════════════════════════════════╝"
|
||||
echo ""
|
||||
echo "Existing PRs:"
|
||||
echo "$MATCHING_PRS" | python3 -c "
|
||||
import json, sys
|
||||
prs = json.load(sys.stdin)
|
||||
for pr in prs:
|
||||
print(f" #{pr['number']}: {pr['title']}")
|
||||
print(f" Branch: {pr['branch']}")
|
||||
print(f" URL: {pr['url']}")
|
||||
print()
|
||||
"
|
||||
echo "Options:"
|
||||
echo " 1. Review and merge an existing PR"
|
||||
echo " 2. Close duplicates and proceed"
|
||||
echo " 3. Use --force to bypass (NOT RECOMMENDED)"
|
||||
echo ""
|
||||
|
||||
if [ "${2:-}" = "--force" ]; then
|
||||
echo "⚠️ --force flag detected. Bypassing duplicate check."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
exit 1
|
||||
else
|
||||
echo "✅ Safe to proceed: No existing PRs for issue #$ISSUE_NUM"
|
||||
exit 0
|
||||
fi
|
||||
Reference in New Issue
Block a user