Compare commits
1 Commits
fix/1598
...
fix/1474-d
| Author | SHA1 | Date | |
|---|---|---|---|
|
d1ebfe00cf |
@@ -6,4 +6,3 @@ rules:
|
||||
require_ci_to_merge: false # CI runner dead (issue #915)
|
||||
block_force_pushes: true
|
||||
block_deletions: true
|
||||
block_on_outdated_branch: true
|
||||
|
||||
1
.github/BRANCH_PROTECTION.md
vendored
1
.github/BRANCH_PROTECTION.md
vendored
@@ -12,7 +12,6 @@ All repositories must enforce these rules on the `main` branch:
|
||||
| Require CI to pass | ⚠ Conditional | Only where CI exists |
|
||||
| Block force push | ✅ Enabled | Protect commit history |
|
||||
| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
|
||||
| Require branch up-to-date before merge | ✅ Enabled | Surface conflicts before merge and force contributors to rebase |
|
||||
|
||||
## Default Reviewer Assignments
|
||||
|
||||
|
||||
162
SECURITY.md
162
SECURITY.md
@@ -1,162 +0,0 @@
|
||||
# Security Policy
|
||||
|
||||
## Overview
|
||||
|
||||
The Nexus is a sovereign AI agent system that prioritizes security, privacy, and local-first operation. This document outlines our security practices and how to report vulnerabilities.
|
||||
|
||||
## Security Principles
|
||||
|
||||
1. **Local-first**: All data and processing stays on the user's machine by default
|
||||
2. **Minimal attack surface**: Expose only what's necessary
|
||||
3. **Defense in depth**: Multiple layers of security controls
|
||||
4. **Transparency**: Open source, auditable code
|
||||
5. **User sovereignty**: Users control their data and connections
|
||||
|
||||
## Recent Security Improvements
|
||||
|
||||
### WebSocket Gateway Security (Issue #1504, #1514)
|
||||
|
||||
**Problem**: WebSocket gateway was exposed on `0.0.0.0` without authentication.
|
||||
|
||||
**Solution**:
|
||||
- **Localhost binding by default**: Gateway now binds to `127.0.0.1` by default
|
||||
- **Token authentication**: Optional token-based authentication via `NEXUS_WS_TOKEN`
|
||||
- **Rate limiting**: Connection and message rate limiting
|
||||
- **Configuration via environment variables**:
|
||||
- `NEXUS_WS_HOST`: Host to bind to (default: `127.0.0.1`)
|
||||
- `NEXUS_WS_PORT`: Port to listen on (default: `8765`)
|
||||
- `NEXUS_WS_TOKEN`: Authentication token (empty = no auth)
|
||||
|
||||
### Branch Protection
|
||||
|
||||
**Policy**: All repositories enforce branch protection rules on `main`:
|
||||
- Require pull requests for all changes
|
||||
- Require 1 approval before merge
|
||||
- Dismiss stale approvals on new commits
|
||||
- Block force pushes
|
||||
- Block branch deletion
|
||||
|
||||
### Command Injection Prevention
|
||||
|
||||
**Problem**: Shell injection vulnerabilities in commit messages and Electron IPC.
|
||||
|
||||
**Solution**:
|
||||
- Input validation and sanitization
|
||||
- Use of parameterized commands
|
||||
- Avoid shell execution where possible
|
||||
- Use of safe APIs (e.g., `child_process.execFile` instead of `child_process.exec`)
|
||||
|
||||
### ChromaDB Telemetry Disabled
|
||||
|
||||
**Problem**: ChromaDB enables anonymous telemetry by default, leaking usage patterns.
|
||||
|
||||
**Solution**:
|
||||
- Disabled telemetry in all client creation paths
|
||||
- Added `anonymized_telemetry=False` to all ChromaDB client instances
|
||||
|
||||
## Security Configuration
|
||||
|
||||
### Environment Variables
|
||||
|
||||
| Variable | Default | Description |
|
||||
|----------|---------|-------------|
|
||||
| `NEXUS_WS_HOST` | `127.0.0.1` | WebSocket gateway host |
|
||||
| `NEXUS_WS_PORT` | `8765` | WebSocket gateway port |
|
||||
| `NEXUS_WS_TOKEN` | (empty) | Authentication token |
|
||||
| `GITEA_TOKEN` | (required) | Gitea API token |
|
||||
| `GITEA_URL` | `https://forge.alexanderwhitestone.com` | Gitea instance URL |
|
||||
|
||||
### Secure Deployment
|
||||
|
||||
For production deployments:
|
||||
|
||||
1. **Use authentication**:
|
||||
```bash
|
||||
export NEXUS_WS_TOKEN=$(openssl rand -hex 32)
|
||||
```
|
||||
|
||||
2. **Bind to localhost** (default):
|
||||
```bash
|
||||
export NEXUS_WS_HOST=127.0.0.1
|
||||
```
|
||||
|
||||
3. **Use reverse proxy** for external access:
|
||||
```nginx
|
||||
# nginx example
|
||||
location /ws {
|
||||
proxy_pass http://127.0.0.1:8765;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
```
|
||||
|
||||
4. **Enable HTTPS** for external access
|
||||
|
||||
## Reporting Vulnerabilities
|
||||
|
||||
### Responsible Disclosure
|
||||
|
||||
If you discover a security vulnerability, please follow responsible disclosure:
|
||||
|
||||
1. **Do NOT** create a public issue
|
||||
2. **Email**: security@timmy.foundation (or contact Alexander directly)
|
||||
3. **Include**:
|
||||
- Description of the vulnerability
|
||||
- Steps to reproduce
|
||||
- Potential impact
|
||||
- Suggested fix (if any)
|
||||
|
||||
### Response Timeline
|
||||
|
||||
- **Acknowledgment**: Within 24 hours
|
||||
- **Assessment**: Within 72 hours
|
||||
- **Fix**: Within 7 days for critical issues
|
||||
- **Disclosure**: After fix is deployed
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### For Users
|
||||
|
||||
1. **Keep software updated**: Regularly update The Nexus and dependencies
|
||||
2. **Use strong tokens**: Generate random, long tokens for authentication
|
||||
3. **Limit exposure**: Only expose services that need external access
|
||||
4. **Monitor logs**: Check logs for suspicious activity
|
||||
5. **Backup regularly**: Keep backups of important data
|
||||
|
||||
### For Developers
|
||||
|
||||
1. **Input validation**: Always validate and sanitize user input
|
||||
2. **Parameterized queries**: Use parameterized queries for database access
|
||||
3. **Least privilege**: Run with minimal required permissions
|
||||
4. **Secure defaults**: Default to secure configurations
|
||||
5. **Code review**: All changes require code review
|
||||
|
||||
### For Deployment
|
||||
|
||||
1. **Network segmentation**: Isolate services in network segments
|
||||
2. **Firewall rules**: Restrict access to necessary ports only
|
||||
3. **Regular updates**: Keep OS and dependencies updated
|
||||
4. **Monitoring**: Implement logging and monitoring
|
||||
5. **Backup strategy**: Regular, tested backups
|
||||
|
||||
## Security Audit Log
|
||||
|
||||
| Date | Issue | Description | Status |
|
||||
|------|-------|-------------|--------|
|
||||
| 2026-04-15 | #1504 | WebSocket gateway exposed on 0.0.0.0 | ✅ Fixed |
|
||||
| 2026-04-15 | #1514 | WebSocket security improvements | ✅ Fixed |
|
||||
| 2026-04-15 | #1423 | Command injection in Electron IPC | ✅ Fixed |
|
||||
| 2026-04-15 | #1430 | Shell injection in commit messages | ✅ Fixed |
|
||||
| 2026-04-15 | #1427 | ChromaDB telemetry enabled | ✅ Fixed |
|
||||
|
||||
## Contact
|
||||
|
||||
- **Security Issues**: security@timmy.foundation
|
||||
- **General Issues**: Create an issue on Gitea
|
||||
- **Emergency**: Contact Alexander directly
|
||||
|
||||
## License
|
||||
|
||||
This security policy is part of The Nexus project and is subject to the same license.
|
||||
136
docs/duplicate-pr-prevention.md
Normal file
136
docs/duplicate-pr-prevention.md
Normal file
@@ -0,0 +1,136 @@
|
||||
# Duplicate PR Prevention Tools
|
||||
|
||||
## Problem
|
||||
|
||||
Despite having tools to detect and clean up duplicate PRs, agents were still creating duplicate PRs for the same issue. This was incredibly ironic, especially for issue #1128 which was about cleaning up duplicate PRs.
|
||||
|
||||
## Solution
|
||||
|
||||
We've created pre-flight check tools that agents should run **before** creating a new PR. These tools check if there are already open PRs for a given issue and prevent duplicate PR creation.
|
||||
|
||||
## Tools
|
||||
|
||||
### 1. `check-existing-prs.sh` (Bash)
|
||||
|
||||
Check if PRs already exist for an issue.
|
||||
|
||||
```bash
|
||||
# Check for existing PRs for issue #1128
|
||||
./scripts/check-existing-prs.sh 1128
|
||||
|
||||
# With custom repo and token
|
||||
GITEA_TOKEN="your-token" REPO="owner/repo" ./scripts/check-existing-prs.sh 1128
|
||||
```
|
||||
|
||||
**Exit codes:**
|
||||
- `0`: No existing PRs found (safe to create new PR)
|
||||
- `1`: Existing PRs found (do not create new PR)
|
||||
- `2`: Error (API failure, missing parameters, etc.)
|
||||
|
||||
### 2. `check_existing_prs.py` (Python)
|
||||
|
||||
Python version of the check, suitable for agents that prefer Python.
|
||||
|
||||
```bash
|
||||
# Check for existing PRs for issue #1128
|
||||
python3 scripts/check_existing_prs.py 1128
|
||||
|
||||
# With custom repo and token
|
||||
python3 scripts/check_existing_prs.py 1128 "owner/repo" "your-token"
|
||||
```
|
||||
|
||||
### 3. `pr-safe.sh` (Wrapper)
|
||||
|
||||
User-friendly wrapper that provides guidance.
|
||||
|
||||
```bash
|
||||
# Check and get suggestions
|
||||
./scripts/pr-safe.sh 1128
|
||||
|
||||
# With suggested branch name
|
||||
./scripts/pr-safe.sh 1128 fix/1128-my-fix
|
||||
```
|
||||
|
||||
## Workflow Integration
|
||||
|
||||
### For Agents
|
||||
|
||||
Before creating a PR, agents should:
|
||||
|
||||
1. Run the check: `./scripts/check-existing-prs.sh <issue_number>`
|
||||
2. If exit code is `0`, proceed with PR creation
|
||||
3. If exit code is `1`, review existing PRs instead
|
||||
|
||||
### For Humans
|
||||
|
||||
Before creating a PR:
|
||||
|
||||
1. Run: `./scripts/pr-safe.sh <issue_number>`
|
||||
2. Follow the guidance provided
|
||||
|
||||
## Prevention Strategy
|
||||
|
||||
### 1. Pre-flight Checks
|
||||
|
||||
Always run a pre-flight check before creating a PR:
|
||||
|
||||
```bash
|
||||
# In your agent workflow
|
||||
if ./scripts/check-existing-prs.sh $ISSUE_NUMBER; then
|
||||
# Safe to create PR
|
||||
create_pr
|
||||
else
|
||||
# Don't create PR, review existing ones
|
||||
review_existing_prs
|
||||
fi
|
||||
```
|
||||
|
||||
### 2. GitHub Actions Integration
|
||||
|
||||
The existing `.github/workflows/pr-duplicate-check.yml` workflow can be enhanced to run these checks automatically.
|
||||
|
||||
### 3. Agent Instructions
|
||||
|
||||
Add to agent instructions:
|
||||
|
||||
```
|
||||
Before creating a PR for an issue, ALWAYS run:
|
||||
./scripts/check-existing-prs.sh <issue_number>
|
||||
|
||||
If PRs already exist, DO NOT create a new PR.
|
||||
Instead, review existing PRs and add comments or merge them.
|
||||
```
|
||||
|
||||
## Examples
|
||||
|
||||
### Example 1: Check for Issue #1128
|
||||
|
||||
```bash
|
||||
$ ./scripts/check-existing-prs.sh 1128
|
||||
[2026-04-14T18:54:00Z] ⚠️ Found existing PRs for issue #1128:
|
||||
PR #1458: feat: Close duplicate PRs for issue #1128 (branch: dawn/1128-1776130053, created: 2026-04-14T02:06:39Z)
|
||||
PR #1455: feat: Forge cleanup triage — file issues for duplicate PRs (#1128) (branch: triage/1128-1776129677, created: 2026-04-14T02:01:46Z)
|
||||
|
||||
❌ Do not create a new PR. Review existing PRs first.
|
||||
```
|
||||
|
||||
### Example 2: Safe to Create PR
|
||||
|
||||
```bash
|
||||
$ ./scripts/check-existing-prs.sh 9999
|
||||
[2026-04-14T18:54:00Z] ✅ No existing PRs found for issue #9999
|
||||
Safe to create a new PR
|
||||
```
|
||||
|
||||
## Related Issues
|
||||
|
||||
- Issue #1474: [META] Still creating duplicate PRs for issue #1128 despite cleanup
|
||||
- Issue #1460: [META] I keep creating duplicate PRs for issue #1128
|
||||
- Issue #1128: [RESOLVED] Forge Cleanup — PRs Closed, Milestones Deduplicated, Policy Issues Filed
|
||||
|
||||
## Lessons Learned
|
||||
|
||||
1. **Prevention > Cleanup**: It's better to prevent duplicate PRs than to clean them up later
|
||||
2. **Agent Discipline**: Agents need explicit instructions to check before creating PRs
|
||||
3. **Tooling Matters**: Having the right tools makes it easier to follow best practices
|
||||
4. **Irony Awareness**: Be aware when you're creating the problem you're trying to solve
|
||||
@@ -1,111 +0,0 @@
|
||||
# Night Shift Prediction Report — April 12-13, 2026
|
||||
|
||||
## Starting State (11:36 PM)
|
||||
|
||||
```
|
||||
Time: 11:36 PM EDT
|
||||
Automation: 13 burn loops × 3min + 1 explorer × 10min + 1 backlog × 30min
|
||||
API: Nous/xiaomi/mimo-v2-pro (FREE)
|
||||
Rate: 268 calls/hour
|
||||
Duration: 7.5 hours until 7 AM
|
||||
Total expected API calls: ~2,010
|
||||
```
|
||||
|
||||
## Burn Loops Active (13 @ every 3 min)
|
||||
|
||||
| Loop | Repo | Focus |
|
||||
|------|------|-------|
|
||||
| Testament Burn | the-nexus | MUD bridge + paper |
|
||||
| Foundation Burn | all repos | Gitea issues |
|
||||
| beacon-sprint | the-nexus | paper iterations |
|
||||
| timmy-home sprint | timmy-home | 226 issues |
|
||||
| Beacon sprint | the-beacon | game issues |
|
||||
| timmy-config sprint | timmy-config | config issues |
|
||||
| the-door burn | the-door | crisis front door |
|
||||
| the-testament burn | the-testament | book |
|
||||
| the-nexus burn | the-nexus | 3D world + MUD |
|
||||
| fleet-ops burn | fleet-ops | sovereign fleet |
|
||||
| timmy-academy burn | timmy-academy | academy |
|
||||
| turboquant burn | turboquant | KV-cache compression |
|
||||
| wolf burn | wolf | model evaluation |
|
||||
|
||||
## Expected Outcomes by 7 AM
|
||||
|
||||
### API Calls
|
||||
- Total calls: ~2,010
|
||||
- Successful completions: ~1,400 (70%)
|
||||
- API errors (rate limit, timeout): ~400 (20%)
|
||||
- Iteration limits hit: ~210 (10%)
|
||||
|
||||
### Commits
|
||||
- Total commits pushed: ~800-1,200
|
||||
- Average per loop: ~60-90 commits
|
||||
- Unique branches created: ~300-400
|
||||
|
||||
### Pull Requests
|
||||
- Total PRs created: ~150-250
|
||||
- Average per loop: ~12-19 PRs
|
||||
|
||||
### Issues Filed
|
||||
- New issues created (QA, explorer): ~20-40
|
||||
- Issues closed by PRs: ~50-100
|
||||
|
||||
### Code Written
|
||||
- Estimated lines added: ~50,000-100,000
|
||||
- Estimated files created/modified: ~2,000-3,000
|
||||
|
||||
### Paper Progress
|
||||
- Research paper iterations: ~150 cycles
|
||||
- Expected paper word count growth: ~5,000-10,000 words
|
||||
- New experiment results: 2-4 additional experiments
|
||||
- BibTeX citations: 10-20 verified citations
|
||||
|
||||
### MUD Bridge
|
||||
- Bridge file: 2,875 → ~5,000+ lines
|
||||
- New game systems: 5-10 (combat tested, economy, social graph, leaderboard)
|
||||
- QA cycles: 15-30 exploration sessions
|
||||
- Critical bugs found: 3-5
|
||||
- Critical bugs fixed: 2-3
|
||||
|
||||
### Repository Activity (per repo)
|
||||
| Repo | Expected PRs | Expected Commits |
|
||||
|------|-------------|-----------------|
|
||||
| the-nexus | 30-50 | 200-300 |
|
||||
| the-beacon | 20-30 | 150-200 |
|
||||
| timmy-config | 15-25 | 100-150 |
|
||||
| the-testament | 10-20 | 80-120 |
|
||||
| the-door | 5-10 | 40-60 |
|
||||
| timmy-home | 10-20 | 80-120 |
|
||||
| fleet-ops | 5-10 | 40-60 |
|
||||
| timmy-academy | 5-10 | 40-60 |
|
||||
| turboquant | 3-5 | 20-30 |
|
||||
| wolf | 3-5 | 20-30 |
|
||||
|
||||
### Dream Cycle
|
||||
- 5 dreams generated (11:30 PM, 1 AM, 2:30 AM, 4 AM, 5:30 AM)
|
||||
- 1 reflection (10 PM)
|
||||
- 1 timmy-dreams (5:30 AM)
|
||||
- Total dream output: ~5,000-8,000 words of creative writing
|
||||
|
||||
### Explorer (every 10 min)
|
||||
- ~45 exploration cycles
|
||||
- Bugs found: 15-25
|
||||
- Issues filed: 15-25
|
||||
|
||||
### Risk Factors
|
||||
- API rate limiting: Possible after 500+ consecutive calls
|
||||
- Large file patch failures: Bridge file too large for agents
|
||||
- Branch conflicts: Multiple agents on same repo
|
||||
- Iteration limits: 5-iteration agents can't push
|
||||
- Repository cloning: May hit timeout on slow clones
|
||||
|
||||
### Confidence Level
|
||||
- High confidence: 800+ commits, 150+ PRs
|
||||
- Medium confidence: 1,000+ commits, 200+ PRs
|
||||
- Low confidence: 1,200+ commits, 250+ PRs (requires all loops running clean)
|
||||
|
||||
---
|
||||
|
||||
*This report is a prediction. The 7 AM morning report will compare actual results.*
|
||||
*Generated: 2026-04-12 23:36 EDT*
|
||||
*Author: Timmy (pre-shift prediction)*
|
||||
78
scripts/check-existing-prs.sh
Executable file
78
scripts/check-existing-prs.sh
Executable file
@@ -0,0 +1,78 @@
|
||||
#!/usr/bin/env bash
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
# check-existing-prs.sh — Check if PRs already exist for an issue
|
||||
#
|
||||
# This script checks if there are already open PRs for a given issue
|
||||
# before creating a new one. This prevents duplicate PRs.
|
||||
#
|
||||
# Usage:
|
||||
# ./scripts/check-existing-prs.sh <issue_number>
|
||||
#
|
||||
# Exit codes:
|
||||
# 0 - No existing PRs found (safe to create new PR)
|
||||
# 1 - Existing PRs found (do not create new PR)
|
||||
# 2 - Error (API failure, missing parameters, etc.)
|
||||
#
|
||||
# Designed for issue #1474: Prevent duplicate PRs
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
set -euo pipefail
|
||||
|
||||
# ─── Configuration ──────────────────────────────────────────
|
||||
GITEA_URL="${GITEA_URL:-https://forge.alexanderwhitestone.com}"
|
||||
GITEA_TOKEN="${GITEA_TOKEN:?Set GITEA_TOKEN env var}"
|
||||
REPO="${REPO:-Timmy_Foundation/the-nexus}"
|
||||
ISSUE_NUMBER="${1:?Usage: $0 <issue_number>}"
|
||||
|
||||
API="$GITEA_URL/api/v1"
|
||||
AUTH="Authorization: token $GITEA_TOKEN"
|
||||
|
||||
log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*"; }
|
||||
|
||||
# ─── Validate inputs ──────────────────────────────────────
|
||||
if ! [[ "$ISSUE_NUMBER" =~ ^[0-9]+$ ]]; then
|
||||
log "ERROR: Issue number must be a positive integer"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# ─── Fetch open PRs ────────────────────────────────────────
|
||||
log "Checking for existing PRs for issue #$ISSUE_NUMBER in $REPO"
|
||||
|
||||
OPEN_PRS=$(curl -s -H "$AUTH" "$API/repos/$REPO/pulls?state=open&limit=100")
|
||||
|
||||
if [ -z "$OPEN_PRS" ] || [ "$OPEN_PRS" = "null" ]; then
|
||||
log "No open PRs found or API error"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ─── Check for PRs referencing this issue ──────────────────
|
||||
# Look for PRs that mention the issue number in title or body
|
||||
MATCHING_PRS=$(echo "$OPEN_PRS" | jq -r --arg issue "#$ISSUE_NUMBER" '
|
||||
.[] |
|
||||
select(
|
||||
(.title | test($issue; "i")) or
|
||||
(.body | test($issue; "i"))
|
||||
) |
|
||||
"PR #\(.number): \(.title) (branch: \(.head.ref), created: \(.created_at))"
|
||||
')
|
||||
|
||||
if [ -z "$MATCHING_PRS" ]; then
|
||||
log "✅ No existing PRs found for issue #$ISSUE_NUMBER"
|
||||
log "Safe to create a new PR"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ─── Report existing PRs ───────────────────────────────────
|
||||
log "⚠️ Found existing PRs for issue #$ISSUE_NUMBER:"
|
||||
echo "$MATCHING_PRS"
|
||||
echo ""
|
||||
log "❌ Do not create a new PR. Review existing PRs first."
|
||||
log ""
|
||||
log "Options:"
|
||||
log " 1. Review and merge an existing PR"
|
||||
log " 2. Close duplicates and keep the best one"
|
||||
log " 3. Add comments to existing PRs instead of creating new ones"
|
||||
log ""
|
||||
log "To see details of existing PRs:"
|
||||
log " curl -H \"Authorization: token \$GITEA_TOKEN\" \"$API/repos/$REPO/pulls?state=open\" | jq '.[] | select(.title | test(\"#$ISSUE_NUMBER\"; \"i\"))'"
|
||||
|
||||
exit 1
|
||||
148
scripts/check_existing_prs.py
Executable file
148
scripts/check_existing_prs.py
Executable file
@@ -0,0 +1,148 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Check if PRs already exist for an issue before creating a new one.
|
||||
|
||||
This script prevents duplicate PRs by checking if there are already
|
||||
open PRs for a given issue.
|
||||
|
||||
Usage:
|
||||
python3 scripts/check_existing_prs.py <issue_number>
|
||||
|
||||
Exit codes:
|
||||
0 - No existing PRs found (safe to create new PR)
|
||||
1 - Existing PRs found (do not create new PR)
|
||||
2 - Error (API failure, missing parameters, etc.)
|
||||
|
||||
Designed for issue #1474: Prevent duplicate PRs
|
||||
"""
|
||||
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import urllib.request
|
||||
import urllib.error
|
||||
from datetime import datetime
|
||||
|
||||
|
||||
def check_existing_prs(issue_number: int, repo: str = None, token: str = None) -> int:
|
||||
"""
|
||||
Check if PRs already exist for an issue.
|
||||
|
||||
Args:
|
||||
issue_number: The issue number to check
|
||||
repo: Repository in format "owner/repo" (default: from env or "Timmy_Foundation/the-nexus")
|
||||
token: Gitea API token (default: from GITEA_TOKEN env var)
|
||||
|
||||
Returns:
|
||||
0: No existing PRs found (safe to create new PR)
|
||||
1: Existing PRs found (do not create new PR)
|
||||
2: Error (API failure, missing parameters, etc.)
|
||||
"""
|
||||
# Get configuration from environment
|
||||
gitea_url = os.environ.get('GITEA_URL', 'https://forge.alexanderwhitestone.com')
|
||||
token = token or os.environ.get('GITEA_TOKEN')
|
||||
repo = repo or os.environ.get('REPO', 'Timmy_Foundation/the-nexus')
|
||||
|
||||
if not token:
|
||||
print("ERROR: GITEA_TOKEN environment variable not set", file=sys.stderr)
|
||||
return 2
|
||||
|
||||
# Validate issue number
|
||||
if not isinstance(issue_number, int) or issue_number <= 0:
|
||||
print("ERROR: Issue number must be a positive integer", file=sys.stderr)
|
||||
return 2
|
||||
|
||||
# Build API URL
|
||||
api_url = f"{gitea_url}/api/v1/repos/{repo}/pulls?state=open&limit=100"
|
||||
|
||||
# Make API request
|
||||
try:
|
||||
req = urllib.request.Request(api_url, headers={
|
||||
'Authorization': f'token {token}',
|
||||
'Content-Type': 'application/json'
|
||||
})
|
||||
|
||||
with urllib.request.urlopen(req, timeout=30) as resp:
|
||||
prs = json.loads(resp.read())
|
||||
|
||||
except urllib.error.URLError as e:
|
||||
print(f"ERROR: Failed to fetch PRs: {e}", file=sys.stderr)
|
||||
return 2
|
||||
except json.JSONDecodeError as e:
|
||||
print(f"ERROR: Failed to parse API response: {e}", file=sys.stderr)
|
||||
return 2
|
||||
except Exception as e:
|
||||
print(f"ERROR: Unexpected error: {e}", file=sys.stderr)
|
||||
return 2
|
||||
|
||||
# Check for PRs referencing this issue
|
||||
issue_ref = f"#{issue_number}"
|
||||
matching_prs = []
|
||||
|
||||
for pr in prs:
|
||||
title = pr.get('title', '')
|
||||
body = pr.get('body', '') or ''
|
||||
|
||||
# Check if issue is referenced in title or body
|
||||
if issue_ref in title or issue_ref in body:
|
||||
matching_prs.append(pr)
|
||||
|
||||
# Report results
|
||||
timestamp = datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ")
|
||||
|
||||
if not matching_prs:
|
||||
print(f"[{timestamp}] ✅ No existing PRs found for issue #{issue_number}")
|
||||
print("Safe to create a new PR")
|
||||
return 0
|
||||
|
||||
# Found existing PRs
|
||||
print(f"[{timestamp}] ⚠️ Found existing PRs for issue #{issue_number}:")
|
||||
print()
|
||||
|
||||
for pr in matching_prs:
|
||||
pr_number = pr.get('number')
|
||||
pr_title = pr.get('title')
|
||||
pr_branch = pr.get('head', {}).get('ref', 'unknown')
|
||||
pr_created = pr.get('created_at', 'unknown')
|
||||
pr_url = pr.get('html_url', 'unknown')
|
||||
|
||||
print(f" PR #{pr_number}: {pr_title}")
|
||||
print(f" Branch: {pr_branch}")
|
||||
print(f" Created: {pr_created}")
|
||||
print(f" URL: {pr_url}")
|
||||
print()
|
||||
|
||||
print("❌ Do not create a new PR. Review existing PRs first.")
|
||||
print()
|
||||
print("Options:")
|
||||
print(" 1. Review and merge an existing PR")
|
||||
print(" 2. Close duplicates and keep the best one")
|
||||
print(" 3. Add comments to existing PRs instead of creating new ones")
|
||||
print()
|
||||
print("To see details of existing PRs:")
|
||||
print(f' curl -H "Authorization: token $GITEA_TOKEN" "{gitea_url}/api/v1/repos/{repo}/pulls?state=open" | jq \'.[] | select(.title | test("#{issue_number}"; "i"))\'')
|
||||
|
||||
return 1
|
||||
|
||||
|
||||
def main():
|
||||
"""Main entry point."""
|
||||
if len(sys.argv) < 2:
|
||||
print("Usage: python3 check_existing_prs.py <issue_number>", file=sys.stderr)
|
||||
print(" python3 check_existing_prs.py <issue_number> [repo] [token]", file=sys.stderr)
|
||||
return 2
|
||||
|
||||
try:
|
||||
issue_number = int(sys.argv[1])
|
||||
except ValueError:
|
||||
print("ERROR: Issue number must be an integer", file=sys.stderr)
|
||||
return 2
|
||||
|
||||
repo = sys.argv[2] if len(sys.argv) > 2 else None
|
||||
token = sys.argv[3] if len(sys.argv) > 3 else None
|
||||
|
||||
return check_existing_prs(issue_number, repo, token)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
sys.exit(main())
|
||||
48
scripts/pr-safe.sh
Executable file
48
scripts/pr-safe.sh
Executable file
@@ -0,0 +1,48 @@
|
||||
#!/usr/bin/env bash
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
# pr-safe.sh — Safe PR creation wrapper
|
||||
#
|
||||
# This script checks for existing PRs before creating a new one.
|
||||
# It's a wrapper around check-existing-prs.sh that provides
|
||||
# a user-friendly interface.
|
||||
#
|
||||
# Usage:
|
||||
# ./scripts/pr-safe.sh <issue_number> [branch_name]
|
||||
#
|
||||
# If branch_name is not provided, it will suggest one based on
|
||||
# the issue number and current timestamp.
|
||||
# ═══════════════════════════════════════════════════════════════
|
||||
set -euo pipefail
|
||||
|
||||
ISSUE_NUMBER="${1:?Usage: $0 <issue_number> [branch_name]}"
|
||||
BRANCH_NAME="${2:-}"
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
echo "🔍 Checking for existing PRs for issue #$ISSUE_NUMBER..."
|
||||
echo ""
|
||||
|
||||
# Run the check
|
||||
if "$SCRIPT_DIR/check-existing-prs.sh" "$ISSUE_NUMBER"; then
|
||||
echo ""
|
||||
echo "✅ Safe to create a new PR for issue #$ISSUE_NUMBER"
|
||||
|
||||
if [ -z "$BRANCH_NAME" ]; then
|
||||
TIMESTAMP=$(date +%s)
|
||||
BRANCH_NAME="fix/$ISSUE_NUMBER-$TIMESTAMP"
|
||||
echo "📝 Suggested branch name: $BRANCH_NAME"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "To create a PR:"
|
||||
echo " 1. Create branch: git checkout -b $BRANCH_NAME"
|
||||
echo " 2. Make your changes"
|
||||
echo " 3. Commit: git commit -m 'fix: Description (#$ISSUE_NUMBER)'"
|
||||
echo " 4. Push: git push -u origin $BRANCH_NAME"
|
||||
echo " 5. Create PR via API or web interface"
|
||||
else
|
||||
echo ""
|
||||
echo "❌ Cannot create new PR for issue #$ISSUE_NUMBER"
|
||||
echo " Existing PRs found. Review them first."
|
||||
exit 1
|
||||
fi
|
||||
@@ -4,61 +4,48 @@ Sync branch protection rules from .gitea/branch-protection/*.yml to Gitea.
|
||||
Correctly uses the Gitea 1.25+ API (not GitHub-style).
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import json
|
||||
import urllib.request
|
||||
from pathlib import Path
|
||||
|
||||
import yaml
|
||||
|
||||
GITEA_URL = os.getenv("GITEA_URL", "https://forge.alexanderwhitestone.com")
|
||||
GITEA_TOKEN = os.getenv("GITEA_TOKEN", "")
|
||||
ORG = "Timmy_Foundation"
|
||||
PROJECT_ROOT = Path(__file__).resolve().parent.parent
|
||||
CONFIG_DIR = PROJECT_ROOT / ".gitea" / "branch-protection"
|
||||
CONFIG_DIR = ".gitea/branch-protection"
|
||||
|
||||
|
||||
def api_request(method: str, path: str, payload: dict | None = None) -> dict:
|
||||
url = f"{GITEA_URL}/api/v1{path}"
|
||||
data = json.dumps(payload).encode() if payload else None
|
||||
req = urllib.request.Request(
|
||||
url,
|
||||
data=data,
|
||||
method=method,
|
||||
headers={
|
||||
"Authorization": f"token {GITEA_TOKEN}",
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
)
|
||||
req = urllib.request.Request(url, data=data, method=method, headers={
|
||||
"Authorization": f"token {GITEA_TOKEN}",
|
||||
"Content-Type": "application/json",
|
||||
})
|
||||
with urllib.request.urlopen(req, timeout=30) as resp:
|
||||
return json.loads(resp.read().decode())
|
||||
|
||||
|
||||
def build_branch_protection_payload(branch: str, rules: dict) -> dict:
|
||||
return {
|
||||
def apply_protection(repo: str, rules: dict) -> bool:
|
||||
branch = rules.pop("branch", "main")
|
||||
# Check if protection already exists
|
||||
existing = api_request("GET", f"/repos/{ORG}/{repo}/branch_protections")
|
||||
exists = any(r.get("branch_name") == branch for r in existing)
|
||||
|
||||
payload = {
|
||||
"branch_name": branch,
|
||||
"rule_name": branch,
|
||||
"required_approvals": rules.get("required_approvals", 1),
|
||||
"block_on_rejected_reviews": rules.get("block_on_rejected_reviews", True),
|
||||
"dismiss_stale_approvals": rules.get("dismiss_stale_approvals", True),
|
||||
"block_deletions": rules.get("block_deletions", True),
|
||||
"block_force_push": rules.get("block_force_push", rules.get("block_force_pushes", True)),
|
||||
"block_force_push": rules.get("block_force_push", True),
|
||||
"block_admin_merge_override": rules.get("block_admin_merge_override", True),
|
||||
"enable_status_check": rules.get("require_ci_to_merge", False),
|
||||
"status_check_contexts": rules.get("status_check_contexts", []),
|
||||
"block_on_outdated_branch": rules.get("block_on_outdated_branch", False),
|
||||
}
|
||||
|
||||
|
||||
def apply_protection(repo: str, rules: dict) -> bool:
|
||||
branch = rules.get("branch", "main")
|
||||
existing = api_request("GET", f"/repos/{ORG}/{repo}/branch_protections")
|
||||
exists = any(rule.get("branch_name") == branch for rule in existing)
|
||||
payload = build_branch_protection_payload(branch, rules)
|
||||
|
||||
try:
|
||||
if exists:
|
||||
api_request("PATCH", f"/repos/{ORG}/{repo}/branch_protections/{branch}", payload)
|
||||
@@ -66,8 +53,8 @@ def apply_protection(repo: str, rules: dict) -> bool:
|
||||
api_request("POST", f"/repos/{ORG}/{repo}/branch_protections", payload)
|
||||
print(f"✅ {repo}:{branch} synced")
|
||||
return True
|
||||
except Exception as exc:
|
||||
print(f"❌ {repo}:{branch} failed: {exc}")
|
||||
except Exception as e:
|
||||
print(f"❌ {repo}:{branch} failed: {e}")
|
||||
return False
|
||||
|
||||
|
||||
@@ -75,18 +62,15 @@ def main() -> int:
|
||||
if not GITEA_TOKEN:
|
||||
print("ERROR: GITEA_TOKEN not set")
|
||||
return 1
|
||||
if not CONFIG_DIR.exists():
|
||||
print(f"ERROR: config directory not found: {CONFIG_DIR}")
|
||||
return 1
|
||||
|
||||
ok = 0
|
||||
for cfg_path in sorted(CONFIG_DIR.glob("*.yml")):
|
||||
repo = cfg_path.stem
|
||||
with cfg_path.open() as fh:
|
||||
cfg = yaml.safe_load(fh) or {}
|
||||
rules = cfg.get("rules", {})
|
||||
rules.setdefault("branch", cfg.get("branch", "main"))
|
||||
if apply_protection(repo, rules):
|
||||
for fname in os.listdir(CONFIG_DIR):
|
||||
if not fname.endswith(".yml"):
|
||||
continue
|
||||
repo = fname[:-4]
|
||||
with open(os.path.join(CONFIG_DIR, fname)) as f:
|
||||
cfg = yaml.safe_load(f)
|
||||
if apply_protection(repo, cfg.get("rules", {})):
|
||||
ok += 1
|
||||
|
||||
print(f"\nSynced {ok} repo(s)")
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
REPORT = Path("reports/night-shift-prediction-2026-04-12.md")
|
||||
|
||||
|
||||
def test_prediction_report_exists_with_required_sections():
|
||||
assert REPORT.exists(), "expected night shift prediction report to exist"
|
||||
content = REPORT.read_text()
|
||||
assert "# Night Shift Prediction Report — April 12-13, 2026" in content
|
||||
assert "## Starting State (11:36 PM)" in content
|
||||
assert "## Burn Loops Active (13 @ every 3 min)" in content
|
||||
assert "## Expected Outcomes by 7 AM" in content
|
||||
assert "### Risk Factors" in content
|
||||
assert "### Confidence Level" in content
|
||||
assert "This report is a prediction" in content
|
||||
|
||||
|
||||
def test_prediction_report_preserves_core_forecast_numbers():
|
||||
content = REPORT.read_text()
|
||||
assert "Total expected API calls: ~2,010" in content
|
||||
assert "Total commits pushed: ~800-1,200" in content
|
||||
assert "Total PRs created: ~150-250" in content
|
||||
assert "the-nexus | 30-50 | 200-300" in content
|
||||
assert "Generated: 2026-04-12 23:36 EDT" in content
|
||||
@@ -1,45 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import importlib.util
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
import yaml
|
||||
|
||||
PROJECT_ROOT = Path(__file__).parent.parent
|
||||
|
||||
_spec = importlib.util.spec_from_file_location(
|
||||
"sync_branch_protection_test",
|
||||
PROJECT_ROOT / "scripts" / "sync_branch_protection.py",
|
||||
)
|
||||
_mod = importlib.util.module_from_spec(_spec)
|
||||
sys.modules["sync_branch_protection_test"] = _mod
|
||||
_spec.loader.exec_module(_mod)
|
||||
|
||||
build_branch_protection_payload = _mod.build_branch_protection_payload
|
||||
|
||||
|
||||
def test_build_branch_protection_payload_enables_rebase_before_merge():
|
||||
payload = build_branch_protection_payload(
|
||||
"main",
|
||||
{
|
||||
"required_approvals": 1,
|
||||
"dismiss_stale_approvals": True,
|
||||
"require_ci_to_merge": False,
|
||||
"block_deletions": True,
|
||||
"block_force_push": True,
|
||||
"block_on_outdated_branch": True,
|
||||
},
|
||||
)
|
||||
|
||||
assert payload["branch_name"] == "main"
|
||||
assert payload["rule_name"] == "main"
|
||||
assert payload["block_on_outdated_branch"] is True
|
||||
assert payload["required_approvals"] == 1
|
||||
assert payload["enable_status_check"] is False
|
||||
|
||||
|
||||
def test_the_nexus_branch_protection_config_requires_up_to_date_branch():
|
||||
config = yaml.safe_load((PROJECT_ROOT / ".gitea" / "branch-protection" / "the-nexus.yml").read_text())
|
||||
rules = config["rules"]
|
||||
assert rules["block_on_outdated_branch"] is True
|
||||
Reference in New Issue
Block a user