From f4b162fa5cb6f806ad49f53a8f4e6b65564542b5 Mon Sep 17 00:00:00 2001 From: be-coder-08 Date: Wed, 5 Aug 2026 18:19:53 -0500 Subject: [PATCH] feat(pr-merge): preserve linked co-authors on squash --- docs/scratchpads/pr-merge-message-field.md | 45 ++ infra/fleet/tools/git/pr-merge.sh | 462 ++++++++++++++++-- .../tools/git/test-pr-merge-message-field.sh | 225 ++++++++- 3 files changed, 673 insertions(+), 59 deletions(-) diff --git a/docs/scratchpads/pr-merge-message-field.md b/docs/scratchpads/pr-merge-message-field.md index 210db0b8..cff5e6d3 100644 --- a/docs/scratchpads/pr-merge-message-field.md +++ b/docs/scratchpads/pr-merge-message-field.md @@ -36,3 +36,48 @@ Add an optional, identity-checked Gitea squash message to `pr-merge.sh` so genui ## Evidence - RED against the byte-identical deployed baseline (`sha256 08a65e8584c5…`): rc 1 with eight named failures. The wrapper rejected `--co-author-trailers`; the null-login path emitted none of the required BLOCK facts/principal; and both verified/ordinary API paths failed the stdin-config credential assertion (ordinary path exposed the fixture token through curl argv). Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-message-field-red.log`. +- GREEN after implementation: verified linked multi-author payload, null-login BLOCK, required named principal, unchanged ordinary `{ "Do": "squash" }` payload, hard non-squash refusal, stdin-config token transport, and absence of `/users` lookup all passed. Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-message-field-green.log`. +- Provider capability probe against `git.mosaicstack.dev`: authenticated `be-coder-08` POST to deliberately nonexistent PR `2147483647` with both message fields returned JSON HTTP 404; the unauthenticated same request returned JSON HTTP 401 (not the charter's predicted 403). The authenticated-vs-unauthenticated differential proves write authorization resolved while no mergeable subject existed. `tl-mosaic` ruled the literal non-load-bearing: preserve the observed 404/401 pair and do not manufacture a 403 case. No cause was inferred and no real PR was targeted. +- Provider-generated trailer behavior is not treated as exclusive or absent. The wrapper's VERIFIED/BLOCK decision binds each requested non-poster trailer to commit `author.login` plus that commit's email; it does not assume `MergeMessageField` is the squash's only trailer source. The poster is omitted from the constructed list because the resulting squash author already records the poster; any additional provider-generated trailer is outside this change's unmeasured mechanism. +- An early candidate SHA-256 `5de32876990e4f26920448cb3220cc7f1146d558b4dd2bc1ee1a2abee2f2cbe6` passed the initial harness, then author-side review found credential-fallback and argv-exposure defects. The live deployed wrapper was atomically restored to baseline SHA-256 `08a65e8584c52c6d41ea1c686f8b95585c21e4b37320a2447eba09359a0e02c1`; the remediated candidate remains only in the worktree. + +## Remediation and current review state + +1. Token and Basic Auth now use stdin curl configuration, not argv. PR title, contributor email, and the JSON payload also remain out of child argv. +2. Each credential attempt binds commit inspection and merge. A token failure during either inspection or mutation causes Basic fallback to repeat inspection before mutation; the payload pins the inspected `head_commit_id`. +3. Focused tests cover both fallback seams, metadata/credential argv absence, null-login BLOCK, explicit squash, unchanged ordinary payload, and retained log-safe provider diagnostics. +4. Codex review rounds 3–5 requested retained provider error text, log-safe provider diagnostics, fail-closed credential fallback, stable value-option parsing, and PR-title trailer-injection prevention. These are remediated with regression assertions. A post-remediation independent review is still required. +5. **Accepted linkage limitation:** `author.login` resolution proves that the commit address maps to a registered provider account. It does not prove that the named principal authored the commit because Git author metadata is self-asserted. This gate checks attribution linkage, not authorship; commit signing is out of scope and currently unadopted. Coordinators explicitly ruled that this does not add a third state. +6. Codex's sandbox could not execute the harness because its checkout was read-only; that environmental limitation is recorded separately from host-side test results. + +## Disposable provider fixture still required + +- Use a retained scratch repository only, with two branch authors and `author != committer` on at least one commit. +- Arm A supplies a message-field trailer and classifies the landed squash object as `APPENDS`, `OVERWRITES`, or `REPLACES`; its absence control must also be demonstrated. +- Arm B includes a registered foreign branch trailer and classifies it as `SURVIVES` or `DROPPED`; verify that identity through an existing commit whose `author.login` resolves. Demonstrate an absence control. +- Parse landed trailers key-agnostically with `^[A-Za-z-]+-[Bb]y:` and record generated poster pair presence/absence plus resulting poster attribution. +- Record `/users/` status and raw email only as non-gating estate telemetry. Never read `active`, `visibility`, or any profile field as an identity gate. +- Use distinct principals: poster `be-coder-08`, merger `Mos`, Arm A `be-coder-07`, and Arm B `be-coder-06`. Capture every trailer-shaped line verbatim and in order. Zero trailer lines means the generator did not fire and the run is `VOID`, not evidence that either arm dropped. +- Report the same read-back evidence to `mos-claude` on socket `default` and `tl-mosaic` on socket `mosaic-fleet`. Stop on `OVERWRITES`, `REPLACES`, or any poster-attribution regression. + +## Fixture preflight + +- Retained public repository: `mosaicstack/prmerge-trailer-fixture`; PR `#1`, posted by `be-coder-08` and reserved for merge by `Mos`. +- Existing `mosaicstack/stack` commits resolve `be-coder-07` and `be-coder-06` through `author.login`; exact addresses are `be-coder-07@fleet.mosaicstack.dev` and `be-coder-06@fleet.mosaicstack.dev`. +- Non-gating HOMELAB telemetry for authenticated reader `be-coder-08`: `/api/v1/users/be-coder-06` returned HTTP 200 with raw `email` value `be-coder-06@fleet.mosaicstack.dev`. +- Provider preflight showed PR commit enumeration is newest-first. A new RED test proved that deriving `head_commit_id` from the final array element selected the wrong commit. The candidate now reads `.head.sha` from the authenticated PR endpoint before enumeration, verifies it appears in the commit set, and atomically pins that SHA in the explicit squash payload. RED: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-head-order-red.log`. +- Fixture PR head `f6ba6e5105031fa21f5ff7bd8e4379d99c16e1de` has `author.login=be-coder-07`, `committer.login=be-coder-08`, and branch-message trailer `Co-authored-by: be-coder-06 `. + +## Fixture result + +- `Mos` merged retained fixture PR `#1` through staged candidate SHA-256 `60e779a85fd13b729d859ea7c986d1e9b1641b97991611329226c1b3113ffb6e`; resulting squash commit: `3f550715d9bc716426fd355a65fe997b3a90fa7d` with one parent. +- Provider read-back: poster/commit author `be-coder-08`, committer/merger `Mos`. The run is non-void. +- Trailer-shaped lines, verbatim and in order: + 1. `Co-authored-by: be-coder-07 ` + 2. `Co-authored-by: be-coder-08 ` +- Arm A supplied field value (`be-coder-07`) landed. Arm B branch trailer (`be-coder-06`) dropped. Both fabricated absence controls remained absent. No `Co-committed-by:` line landed. +- The candidate payload construction explicitly excludes the poster and supplied only the Arm A `be-coder-07` line. Therefore the landed poster line was provider-generated, not candidate-composed. The raw result supports `FIELD LANDS`, `BRANCH DROPS`, and `POSTER GENERATED`; it does not support a claim that candidate code supplied the poster. Evidence: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-fixture-readback.log` and the retained provider object. + +## Current hold point + +No delivery branch push or PR exists. The deployed wrapper remains on its original baseline bytes. Implementation and disposable end-to-end read-back are green; final review disposition, commit/rebase, and delivery gates remain. diff --git a/infra/fleet/tools/git/pr-merge.sh b/infra/fleet/tools/git/pr-merge.sh index 222260c6..45967d24 100755 --- a/infra/fleet/tools/git/pr-merge.sh +++ b/infra/fleet/tools/git/pr-merge.sh @@ -1,6 +1,6 @@ #!/bin/bash # pr-merge.sh - Merge pull requests on Gitea or GitHub -# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--skip-queue-guard] +# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--co-author-trailers --escalate-to PRINCIPAL] set -euo pipefail @@ -14,6 +14,8 @@ MERGE_METHOD="squash" DELETE_BRANCH=false SKIP_QUEUE_GUARD=false DRY_RUN=false +CO_AUTHOR_TRAILERS=false +ESCALATE_TO="" usage() { cat <&2 + exit 1 + fi + ESCALATE_TO="$2" + shift 2 + ;; -h|--help) usage 0 ;; @@ -86,9 +103,23 @@ if [[ "$MERGE_METHOD" != "squash" ]]; then echo "Error: Mosaic policy enforces squash merge only. Received '$MERGE_METHOD'." >&2 exit 1 fi +if [[ "$CO_AUTHOR_TRAILERS" == true && -z "$ESCALATE_TO" ]]; then + echo "Error: --co-author-trailers requires --escalate-to with a named principal." >&2 + exit 1 +fi +if [[ -n "$ESCALATE_TO" && ! "$ESCALATE_TO" =~ ^[A-Za-z0-9_.-]+$ ]]; then + echo "Error: --escalate-to must be one exact principal name." >&2 + exit 1 +fi +if [[ "$CO_AUTHOR_TRAILERS" != true && -n "$ESCALATE_TO" ]]; then + echo "Error: --escalate-to is valid only with --co-author-trailers." >&2 + exit 1 +fi PR_METADATA="$("$SCRIPT_DIR/pr-metadata.sh" -n "$PR_NUMBER")" BASE_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("baseRefName") or "").strip())')" +PR_TITLE="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("title") or "").strip())')" +PR_AUTHOR="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("author") or ""; print((value.get("login") or "").strip() if isinstance(value, dict) else str(value).strip())')" if [[ "$BASE_BRANCH" != "main" ]]; then echo "Error: Mosaic policy allows merges only for PRs targeting 'main' (found '$BASE_BRANCH')." >&2 exit 1 @@ -125,60 +156,397 @@ raise SystemExit(0 if known_empty_identity else 1) PY } -merge_gitea_with_api() { - local host="$1" api_url token basic_auth body_file raw_code payload +write_curl_auth_config() { + local mode="$1" credential="$2" + printf '%s' "$credential" | python3 -c ' +import sys +mode = sys.argv[1] +credential = sys.stdin.read() +if not credential or any(char in credential for char in "\r\n"): + raise SystemExit(1) +escaped = credential.replace("\\", "\\\\").replace("\"", "\\\"") +if mode == "token": + print(f"header = \"Authorization: token {escaped}\"") +elif mode == "basic": + print(f"user = \"{escaped}\"") +else: + raise SystemExit(1) +' "$mode" +} + +LAST_GITEA_HTTP_CODE="000" +LAST_GITEA_ERROR="" +MERGE_TEMP_DIRS=() + +format_gitea_error_response() { + local response_file="$1" + python3 - "$response_file" <<'PY' +import json +import sys + +with open(sys.argv[1], "rb") as handle: + raw = handle.read(65536) +try: + response = json.loads(raw.decode("utf-8", errors="replace")) +except (UnicodeDecodeError, json.JSONDecodeError): + message = "non-JSON response omitted" +else: + if isinstance(response, dict): + message = response.get("message") or response.get("error") + if not message and response.get("errors") is not None: + message = json.dumps(response["errors"], separators=(",", ":")) + else: + message = None + if not message: + message = "JSON response contained no error message" +message = str(message) +if len(message) > 500: + message = message[:500] + "..." +print(ascii(message)) +PY +} + +cleanup_merge_temp_dirs() { + local path + for path in "${MERGE_TEMP_DIRS[@]}"; do + [[ -n "$path" ]] && rm -rf -- "$path" + done +} +trap cleanup_merge_temp_dirs EXIT +trap 'exit 130' INT +trap 'exit 143' TERM + +fetch_gitea_pr_head() { + local host="$1" auth_mode="$2" credential="$3" work_root="$4" + local response_file raw_code api_url + response_file=$(mktemp "$work_root/pr-merge-pr.XXXXXX") + api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}" + raw_code=$(write_curl_auth_config "$auth_mode" "$credential" | \ + curl -sS -K - -w '%{http_code}' -o "$response_file" \ + -H "User-Agent: curl/8" "$api_url" || true) + LAST_GITEA_HTTP_CODE="${raw_code:-000}" + if [[ ! "$raw_code" =~ ^2 ]]; then + LAST_GITEA_ERROR=$(format_gitea_error_response "$response_file") + rm -f "$response_file" + return 1 + fi + if ! python3 - "$response_file" <<'PY' +import json +import re +import sys + +with open(sys.argv[1], encoding="utf-8") as handle: + pull = json.load(handle) +head = pull.get("head") if isinstance(pull, dict) else None +sha = str(head.get("sha") or "") if isinstance(head, dict) else "" +if not re.fullmatch(r"[0-9a-fA-F]{40}", sha): + raise SystemExit(1) +print(sha) +PY + then + echo "Error: Gitea PR response has no valid head SHA; refusing merge." >&2 + rm -f "$response_file" + return 1 + fi + rm -f "$response_file" +} + +fetch_gitea_pr_commits() { + local host="$1" auth_mode="$2" credential="$3" work_root="$4" + local page page_file combined_file merged_file raw_code page_count api_url + mkdir -p "$work_root" + combined_file=$(mktemp "$work_root/pr-merge-commits.XXXXXX") + printf '[]' > "$combined_file" + + page=1 + while true; do + page_file=$(mktemp "$work_root/pr-merge-commits-page.XXXXXX") + api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/commits?limit=50&page=${page}" + raw_code=$(write_curl_auth_config "$auth_mode" "$credential" | \ + curl -sS -K - -w '%{http_code}' -o "$page_file" \ + -H "User-Agent: curl/8" "$api_url" || true) + LAST_GITEA_HTTP_CODE="${raw_code:-000}" + if [[ ! "$raw_code" =~ ^2 ]]; then + LAST_GITEA_ERROR=$(format_gitea_error_response "$page_file") + rm -f "$page_file" "$combined_file" + return 1 + fi + + if ! page_count=$(python3 - "$page_file" <<'PY' +import json +import sys + +with open(sys.argv[1], encoding="utf-8") as handle: + page = json.load(handle) +if not isinstance(page, list): + raise SystemExit(1) +print(len(page)) +PY + ); then + echo "Error: Gitea PR commits response is not a JSON array; refusing merge." >&2 + rm -f "$page_file" "$combined_file" + return 1 + fi + + merged_file=$(mktemp "$work_root/pr-merge-commits-merged.XXXXXX") + if ! python3 - "$combined_file" "$page_file" > "$merged_file" <<'PY' +import json +import sys + +with open(sys.argv[1], encoding="utf-8") as handle: + combined = json.load(handle) +with open(sys.argv[2], encoding="utf-8") as handle: + page = json.load(handle) +json.dump(combined + page, sys.stdout, separators=(",", ":")) +PY + then + echo "Error: Could not combine paginated PR commit metadata; refusing merge." >&2 + rm -f "$page_file" "$combined_file" "$merged_file" + return 1 + fi + mv "$merged_file" "$combined_file" + rm -f "$page_file" + + if [[ "$page_count" -lt 50 ]]; then + break + fi + page=$((page + 1)) + if [[ "$page" -gt 1000 ]]; then + echo "Error: PR commit pagination exceeded 1000 pages; refusing merge." >&2 + rm -f "$combined_file" + return 1 + fi + done + + cat "$combined_file" + rm -f "$combined_file" +} + +# LIMITATION: author.login resolution proves the commit address maps to a registered account. +# It does NOT prove the named principal authored the commit — git author metadata is self-asserted. +# This gate checks ATTRIBUTION LINKAGE, not AUTHORSHIP. Commit signing is out of scope and unadopted. +build_coauthor_message_fields() { + local commits_file="$1" context_file="$2" head_file="$3" + python3 - "$commits_file" "$context_file" "$head_file" <<'PY' +import json +import re +import sys + +commits_path, context_path, head_path = sys.argv[1:] +with open(commits_path, encoding="utf-8") as handle: + commits = json.load(handle) +head_sha = open(head_path, encoding="utf-8").read().strip() +context_parts = open(context_path, "rb").read().split(b"\0") +if len(context_parts) != 4 or context_parts[-1] != b"": + raise SystemExit(1) +poster, title, principal = (part.decode("utf-8") for part in context_parts[:3]) + +if not isinstance(commits, list) or not commits: + print( + f"BLOCK: provider returned no PR commits; author identity is unmeasurable. " + f"Refusing merge; escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) +if not poster: + print( + f"BLOCK: PR poster login is empty; refusing merge; " + f"escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) + +if not re.fullmatch(r"[0-9a-fA-F]{40}", head_sha): + print( + f"BLOCK: inspected PR head SHA is invalid; refusing merge; " + f"escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) + +seen = set() +trailers = [] +head_seen = False +for item in commits: + if not isinstance(item, dict): + print(f"BLOCK: malformed PR commit metadata; escalate to named principal '{principal}'.", file=sys.stderr) + raise SystemExit(75) + sha = str(item.get("sha") or "") + if sha == head_sha: + head_seen = True + commit = item.get("commit") if isinstance(item.get("commit"), dict) else {} + commit_author = commit.get("author") if isinstance(commit.get("author"), dict) else {} + email = str(commit_author.get("email") or "").strip() + provider_author = item.get("author") if isinstance(item.get("author"), dict) else {} + login = str(provider_author.get("login") or "").strip() + + if not login: + diagnostic_email = email or "" + print( + f"BLOCK: commit {sha!r} has author.login=NULL while " + f"commit.author.email={diagnostic_email!r}; refusing merge; " + f"escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) + if not re.fullmatch(r"[A-Za-z0-9_.-]+", login) or not re.fullmatch(r"[^<>\s]+@[^<>\s]+", email): + print( + f"BLOCK: commit {sha!r} has unusable linked identity " + f"author.login={login!r}, commit.author.email={email!r}; refusing merge; " + f"escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) + if login == poster or login in seen: + continue + seen.add(login) + trailers.append(f"Co-authored-by: {login} <{email}>") + +if not head_seen: + print( + f"BLOCK: inspected PR head is absent from commit enumeration; refusing merge; " + f"escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) +if not trailers: + print(json.dumps({"head_commit_id": head_sha}, separators=(",", ":"))) + raise SystemExit(0) +if not title: + print( + f"BLOCK: PR title is empty; refusing merge; escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) +if not title.isprintable() or re.match(r"^[A-Za-z-]+-[Bb]y:", title): + print( + f"BLOCK: PR title is not one printable, non-trailer line; refusing merge; " + f"escalate to named principal '{principal}'.", + file=sys.stderr, + ) + raise SystemExit(75) + +print(json.dumps({ + "head_commit_id": head_sha, + "MergeTitleField": title, + "MergeMessageField": "\n".join(trailers), +}, separators=(",", ":"))) +PY +} + +merge_gitea_api_attempt() { + local host="$1" auth_mode="$2" credential="$3" + local api_url attempt_dir body_file raw_code commits_file fields_file context_file head_file payload_file work_root attempt_rc + LAST_GITEA_ERROR="" api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/merge" - mkdir -p "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}" - body_file=$(mktemp "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}/pr-merge-api-response.XXXXXX") - payload='{"Do":"squash"}' + work_root="${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}" + mkdir -p "$work_root" + attempt_dir=$(mktemp -d "$work_root/pr-merge-attempt.XXXXXX") + chmod 0700 "$attempt_dir" + MERGE_TEMP_DIRS+=("$attempt_dir") + body_file=$(mktemp "$attempt_dir/api-response.XXXXXX") + fields_file=$(mktemp "$attempt_dir/message-fields.XXXXXX") + payload_file=$(mktemp "$attempt_dir/payload.XXXXXX") + printf '{}' > "$fields_file" + + if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then + commits_file=$(mktemp "$work_root/pr-merge-commits-input.XXXXXX") + context_file=$(mktemp "$work_root/pr-merge-message-context.XXXXXX") + head_file=$(mktemp "$work_root/pr-merge-head-input.XXXXXX") + printf '%s\0%s\0%s\0' "$PR_AUTHOR" "$PR_TITLE" "$ESCALATE_TO" > "$context_file" + if fetch_gitea_pr_head "$host" "$auth_mode" "$credential" "$attempt_dir" > "$head_file"; then + : + else + attempt_rc=$? + rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file" + return "$attempt_rc" + fi + if fetch_gitea_pr_commits "$host" "$auth_mode" "$credential" "$attempt_dir" > "$commits_file"; then + : + else + attempt_rc=$? + rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file" + return "$attempt_rc" + fi + if build_coauthor_message_fields "$commits_file" "$context_file" "$head_file" > "$fields_file"; then + : + else + attempt_rc=$? + rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file" + return "$attempt_rc" + fi + rm -f "$commits_file" "$context_file" "$head_file" + fi + + if ! python3 - "$fields_file" > "$payload_file" <<'PY' +import json +import sys + +with open(sys.argv[1], encoding="utf-8") as handle: + fields = json.load(handle) +payload = {"Do": "squash"} +payload.update(fields) +if payload.get("Do") != "squash" or set(payload) - {"Do", "head_commit_id", "MergeTitleField", "MergeMessageField"}: + raise SystemExit(1) +print(json.dumps(payload, separators=(",", ":"))) +PY + then + rm -f "$body_file" "$fields_file" "$payload_file" + return 1 + fi + rm -f "$fields_file" + + raw_code=$(write_curl_auth_config "$auth_mode" "$credential" | \ + curl -sS -K - -w '%{http_code}' -o "$body_file" \ + -X POST -H "User-Agent: curl/8" \ + -H 'Content-Type: application/json' \ + --data-binary "@$payload_file" "$api_url" || true) + LAST_GITEA_HTTP_CODE="${raw_code:-000}" + if [[ ! "$raw_code" =~ ^2 ]]; then + LAST_GITEA_ERROR=$(format_gitea_error_response "$body_file") + fi + rm -f "$body_file" "$payload_file" + rm -rf -- "$attempt_dir" + [[ "$raw_code" =~ ^2 ]] +} + +merge_gitea_with_api() { + local host="$1" token basic_auth attempt_rc token=$(get_gitea_token "$host" || true) if [[ -n "$token" ]]; then - raw_code=$(curl -sS -w '%{http_code}' -o "$body_file" \ - -X POST \ - -H "User-Agent: curl/8" \ - -H "Authorization: token $token" \ - -H 'Content-Type: application/json' \ - -d "$payload" \ - "$api_url" || true) - if [[ "$raw_code" =~ ^2 ]]; then - rm -f "$body_file" + if merge_gitea_api_attempt "$host" token "$token"; then return 0 + else + attempt_rc=$? fi + if [[ "$attempt_rc" -eq 75 ]]; then + return 75 + fi + if [[ "$LAST_GITEA_HTTP_CODE" != "401" ]]; then + echo "Error: Gitea API merge failed with token credential (HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR} Basic Auth fallback is allowed only after HTTP 401." >&2 + return 1 + fi + echo "Token credential received HTTP 401; retrying inspection and merge with configured Basic Auth." >&2 fi basic_auth=$(get_gitea_basic_auth "$host" || true) if [[ -n "$basic_auth" ]]; then - raw_code=$(curl -sS -w '%{http_code}' -o "$body_file" \ - -X POST \ - -u "$basic_auth" \ - -H "User-Agent: curl/8" \ - -H 'Content-Type: application/json' \ - -d "$payload" \ - "$api_url" || true) - if [[ "$raw_code" =~ ^2 ]]; then - rm -f "$body_file" + if merge_gitea_api_attempt "$host" basic "$basic_auth"; then return 0 + else + attempt_rc=$? + fi + if [[ "$attempt_rc" -eq 75 ]]; then + return 75 fi fi - python3 - "${raw_code:-000}" "$body_file" <<'PY' >&2 -import json -import sys -code, path = sys.argv[1], sys.argv[2] -try: - with open(path, encoding="utf-8", errors="replace") as handle: - raw = handle.read(500) - data = json.loads(raw) if raw else {} - message = data.get("message") or data.get("error") or raw or "empty response" -except Exception: - try: - message = open(path, encoding="utf-8", errors="replace").read(500) or "empty response" - except Exception: - message = "unreadable response" -print(f"Error: Gitea API merge failed with HTTP {code}: {message}") -PY - rm -f "$body_file" + if [[ -z "$token" && -z "$basic_auth" ]]; then + echo "Error: No Gitea credential is available for the merge operation." >&2 + else + echo "Error: Gitea API merge failed for all configured credentials (last HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR}" >&2 + fi return 1 } @@ -189,7 +557,9 @@ if [[ "$DRY_RUN" == true ]]; then exit 1 } TEA_LOGIN="$(get_gitea_login_for_host "$HOST" || true)" - if [[ -n "$TEA_LOGIN" ]]; then + if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then + echo "Dry run: would verify PR commit authors and merge PR #$PR_NUMBER on $HOST with authenticated Gitea API message fields (base=$BASE_BRANCH, method=squash)." + elif [[ -n "$TEA_LOGIN" ]]; then echo "Dry run: would merge PR #$PR_NUMBER on $HOST with tea login '$TEA_LOGIN' (base=$BASE_BRANCH, method=squash)." else echo "Dry run: would merge PR #$PR_NUMBER on $HOST with authenticated Gitea API fallback (base=$BASE_BRANCH, method=squash)." @@ -202,6 +572,10 @@ fi case "$PLATFORM" in github) + if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then + echo "Error: --co-author-trailers currently requires the Gitea REST message-field contract." >&2 + exit 1 + fi cmd=(gh pr merge "$PR_NUMBER" --squash) [[ "$DELETE_BRANCH" == true ]] && cmd+=(--delete-branch) "${cmd[@]}" @@ -213,7 +587,9 @@ case "$PLATFORM" in } TEA_LOGIN="$(get_gitea_login_for_host "$HOST" || true)" - if [[ -n "$TEA_LOGIN" ]]; then + if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then + merge_gitea_with_api "$HOST" + elif [[ -n "$TEA_LOGIN" ]]; then mkdir -p "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}" TEA_ERROR_FILE=$(mktemp "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}/pr-merge-tea-error.XXXXXX") if tea pr merge "$PR_NUMBER" --style squash --repo "$OWNER/$REPO" --login "$TEA_LOGIN" 2> "$TEA_ERROR_FILE"; then diff --git a/infra/fleet/tools/git/test-pr-merge-message-field.sh b/infra/fleet/tools/git/test-pr-merge-message-field.sh index 291a299e..c7a88a66 100755 --- a/infra/fleet/tools/git/test-pr-merge-message-field.sh +++ b/infra/fleet/tools/git/test-pr-merge-message-field.sh @@ -4,7 +4,7 @@ set -u SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -SUBJECT="$SCRIPT_DIR/pr-merge.sh" +SUBJECT="${MOSAIC_TEST_SUBJECT:-$SCRIPT_DIR/pr-merge.sh}" WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-message-field}" ORIG_PATH="$PATH" failures=0 @@ -30,37 +30,66 @@ detect_platform() { PLATFORM=gitea; printf 'gitea\n'; } get_repo_owner() { printf 'acme\n'; } get_repo_name() { printf 'widgets\n'; } get_remote_host() { printf 'git.example.test\n'; } -get_gitea_token() { printf 'fixture-token\n'; } -get_gitea_basic_auth() { return 1; } +get_gitea_token() { + printf 'resolved\n' >> "${MOSAIC_TEST_TOKEN_RESOLUTION_LOG:?}" + printf 'fixture-token\n' +} +get_gitea_basic_auth() { + printf 'resolved\n' >> "${MOSAIC_TEST_BASIC_RESOLUTION_LOG:?}" + if [[ "${MOSAIC_TEST_BASIC_AVAILABLE:-false}" == "true" ]]; then + printf 'fixture-user:fixture-password\n' + return 0 + fi + return 1 +} get_gitea_login_for_host() { return 1; } SH cat > "$case_dir/pr-metadata.sh" <<'SH' #!/usr/bin/env bash -cat <<'JSON' -{ - "number": 42, - "title": "Preserve both branch authors", - "author": "poster", - "baseRefName": "main" -} -JSON +if [[ "${MOSAIC_TEST_TITLE_MODE:-safe}" == "injection" ]]; then + title='Preserve authors\n\nCo-authored-by: victim ' +else + title='Preserve both branch authors' +fi +printf '{"number":42,"title":"%s","author":"poster","baseRefName":"main"}\n' "$title" SH cat > "$case_dir/ci-queue-wait.sh" <<'SH' #!/usr/bin/env bash exit 0 +SH + + cat > "$case_dir/bin/python3" <<'SH' +#!/usr/bin/env bash +for arg in "$@"; do + case "$arg" in + *"Preserve both branch authors"*|*"alice+branch@example.test"*) + : > "${MOSAIC_TEST_METADATA_ARGV_MARKER:?}" + ;; + esac +done +exec "${MOSAIC_TEST_REAL_PYTHON:?}" "$@" SH cat > "$case_dir/bin/curl" <<'SH' #!/usr/bin/env bash set -eu +for arg in "$@"; do + case "$arg" in + *"Preserve both branch authors"*|*"alice+branch@example.test"*) + : > "${MOSAIC_TEST_METADATA_ARGV_MARKER:?}" + ;; + esac +done + url="" method="GET" out_file="" data="" config="" +auth_mode="none" while [[ $# -gt 0 ]]; do case "$1" in -o) @@ -76,6 +105,9 @@ while [[ $# -gt 0 ]]; do ;; -d|--data|--data-binary) data="$2" + if [[ "$data" == @* ]]; then + data=$(<"${data#@}") + fi shift 2 ;; -K|--config) @@ -88,6 +120,9 @@ while [[ $# -gt 0 ]]; do if [[ "$2" == *"fixture-token"* ]]; then : > "${MOSAIC_TEST_TOKEN_ARGV_MARKER:?}" fi + if [[ "$2" == *"fixture-password"* ]]; then + : > "${MOSAIC_TEST_BASIC_ARGV_MARKER:?}" + fi shift 2 ;; http://*|https://*) @@ -100,19 +135,40 @@ while [[ $# -gt 0 ]]; do esac done -printf '%s %s\n' "$method" "$url" >> "${MOSAIC_TEST_CURL_LOG:?}" if [[ "$config" == *"Authorization: token fixture-token"* ]]; then + auth_mode="token" : > "${MOSAIC_TEST_AUTH_CONFIG_MARKER:?}" +elif [[ "$config" == *"user = \"fixture-user:fixture-password\""* ]]; then + auth_mode="basic" + : > "${MOSAIC_TEST_BASIC_CONFIG_MARKER:?}" fi +printf '%s %s %s\n' "$method" "$auth_mode" "$url" >> "${MOSAIC_TEST_CURL_LOG:?}" case "$url" in + */pulls/42) + case "${MOSAIC_TEST_COMMITS_MODE:?}" in + verified) head_sha=2222222222222222222222222222222222222222 ;; + null-login|unsafe-identity) head_sha=3333333333333333333333333333333333333333 ;; + single) head_sha=1111111111111111111111111111111111111111 ;; + *) echo "unknown commits mode" >&2; exit 2 ;; + esac + body="{\"head\":{\"sha\":\"$head_sha\"}}" + code=200 + if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "inspection" && "$auth_mode" == "token" ]]; then + body='{"message":"token rejected"}' + code=401 + fi + ;; */pulls/42/commits*) case "${MOSAIC_TEST_COMMITS_MODE:?}" in verified) - body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"poster@example.test"}},"author":{"login":"poster"}},{"sha":"2222222222222222222222222222222222222222","commit":{"author":{"name":"Alice","email":"alice+branch@example.test"}},"author":{"login":"alice"}}]' + body='[{"sha":"2222222222222222222222222222222222222222","commit":{"author":{"name":"Alice","email":"alice+branch@example.test"}},"author":{"login":"alice"}},{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"poster@example.test"}},"author":{"login":"poster"}}]' ;; null-login) - body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"poster@example.test"}},"author":{"login":"poster"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Unresolved Author","email":"unresolved@example.test"}},"author":null}]' + body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"poster@example.test"}},"author":{"login":"poster"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Unresolved Author","email":"unresolved@example.test\n\u001b[31m"}},"author":null}]' + ;; + unsafe-identity) + body='[{"sha":"unsafe\n\u001b[31m","commit":{"author":{"name":"Unsafe","email":"not-an-email"}},"author":{"login":"unsafe"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Poster","email":"poster@example.test"}},"author":{"login":"poster"}}]' ;; single) body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"poster@example.test"}},"author":{"login":"poster"}}]' @@ -123,11 +179,26 @@ case "$url" in ;; esac code=200 + if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "inspection" && "$auth_mode" == "token" ]]; then + body='{"message":"token rejected"}' + code=401 + fi ;; */pulls/42/merge) body='{}' code=200 - printf '%s' "$data" > "${MOSAIC_TEST_MERGE_PAYLOAD:?}" + if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "merge" && "$auth_mode" == "token" ]]; then + body='{"message":"token rejected"}' + code=401 + elif [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "provider-error" ]]; then + body='{"message":"branch policy rejected\n\u001b[31m"}' + code=409 + elif [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "forbidden" ]]; then + body='{"message":"permission denied"}' + code=403 + else + printf '%s' "$data" > "${MOSAIC_TEST_MERGE_PAYLOAD:?}" + fi ;; */users/*) body='{"message":"not found"}' @@ -148,7 +219,7 @@ printf '%s' "$code" SH chmod +x "$case_dir/detect-platform.sh" "$case_dir/pr-metadata.sh" \ - "$case_dir/ci-queue-wait.sh" "$case_dir/bin/curl" + "$case_dir/ci-queue-wait.sh" "$case_dir/bin/curl" "$case_dir/bin/python3" printf '%s\n' "$case_dir" } @@ -159,7 +230,13 @@ run_case() { MOSAIC_TEST_CURL_LOG="$case_dir/curl.log" \ MOSAIC_TEST_MERGE_PAYLOAD="$case_dir/merge-payload.json" \ MOSAIC_TEST_TOKEN_ARGV_MARKER="$case_dir/token-in-argv" \ + MOSAIC_TEST_BASIC_ARGV_MARKER="$case_dir/basic-in-argv" \ MOSAIC_TEST_AUTH_CONFIG_MARKER="$case_dir/auth-via-config" \ + MOSAIC_TEST_BASIC_CONFIG_MARKER="$case_dir/basic-via-config" \ + MOSAIC_TEST_TOKEN_RESOLUTION_LOG="$case_dir/token-resolution.log" \ + MOSAIC_TEST_BASIC_RESOLUTION_LOG="$case_dir/basic-resolution.log" \ + MOSAIC_TEST_METADATA_ARGV_MARKER="$case_dir/metadata-in-argv" \ + MOSAIC_TEST_REAL_PYTHON="$(command -v python3)" \ AGENT_WORK_ROOT="$case_dir/agent" \ PATH="$case_dir/bin:$ORIG_PATH" \ "$case_dir/pr-merge.sh" -n 42 "$@" @@ -183,6 +260,7 @@ import sys payload = json.load(open(sys.argv[1], encoding="utf-8")) assert payload == { "Do": "squash", + "head_commit_id": "2222222222222222222222222222222222222222", "MergeTitleField": "Preserve both branch authors", "MergeMessageField": "Co-authored-by: alice ", }, payload @@ -190,10 +268,46 @@ PY fi [[ -e "$verified_dir/auth-via-config" ]] || fail "verified path did not authenticate curl through stdin config" [[ ! -e "$verified_dir/token-in-argv" ]] || fail "verified path placed the Gitea token in curl argv" +[[ ! -e "$verified_dir/metadata-in-argv" ]] || fail "verified path placed PR title or contributor email in child argv" +[[ "$(wc -l < "$verified_dir/token-resolution.log")" -eq 1 ]] || fail "verified path did not bind inspection and merge to one credential resolution" if grep -q '/users/' "$verified_dir/curl.log" 2>/dev/null; then fail "verified path performed a forbidden second /users lookup" fi +# Token rejection during inspection must fall back to Basic Auth, then repeat +# BOTH inspection and merge with that one Basic credential handle. +fallback_inspect_dir=$(make_case fallback-inspection) +set +e +fallback_inspect_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=inspection \ + run_case "$fallback_inspect_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1) +fallback_inspect_rc=$? +set -e +[[ "$fallback_inspect_rc" -eq 0 ]] || fail "inspection fallback expected rc=0, got rc=$fallback_inspect_rc: $fallback_inspect_output" +[[ -s "$fallback_inspect_dir/merge-payload.json" ]] || fail "inspection fallback did not reach the merge API" +[[ -e "$fallback_inspect_dir/basic-via-config" ]] || fail "inspection fallback did not transport Basic Auth through stdin config" +[[ ! -e "$fallback_inspect_dir/basic-in-argv" ]] || fail "inspection fallback exposed Basic Auth in curl argv" +[[ ! -e "$fallback_inspect_dir/metadata-in-argv" ]] || fail "inspection fallback exposed PR metadata in child argv" +[[ "$(wc -l < "$fallback_inspect_dir/token-resolution.log")" -eq 1 ]] || fail "inspection fallback did not resolve token exactly once" +[[ "$(wc -l < "$fallback_inspect_dir/basic-resolution.log")" -eq 1 ]] || fail "inspection fallback did not resolve Basic Auth exactly once" +inspect_sequence=$(awk '{print $1 ":" $2}' "$fallback_inspect_dir/curl.log" | paste -sd, -) +[[ "$inspect_sequence" == "GET:token,GET:basic,GET:basic,POST:basic" ]] || fail "inspection fallback was not bound per credential (calls=$inspect_sequence)" + +# Token rejection at merge is a separate seam: Basic fallback must re-inspect +# instead of reusing evidence gathered under the rejected token. +fallback_merge_dir=$(make_case fallback-merge) +set +e +fallback_merge_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=merge \ + run_case "$fallback_merge_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1) +fallback_merge_rc=$? +set -e +[[ "$fallback_merge_rc" -eq 0 ]] || fail "merge fallback expected rc=0, got rc=$fallback_merge_rc: $fallback_merge_output" +[[ -s "$fallback_merge_dir/merge-payload.json" ]] || fail "merge fallback did not reach a successful merge API payload" +[[ -e "$fallback_merge_dir/basic-via-config" ]] || fail "merge fallback did not transport Basic Auth through stdin config" +[[ ! -e "$fallback_merge_dir/basic-in-argv" ]] || fail "merge fallback exposed Basic Auth in curl argv" +[[ ! -e "$fallback_merge_dir/metadata-in-argv" ]] || fail "merge fallback exposed PR metadata in child argv" +merge_sequence=$(awk '{print $1 ":" $2}' "$fallback_merge_dir/curl.log" | paste -sd, -) +[[ "$merge_sequence" == "GET:token,GET:token,POST:token,GET:basic,GET:basic,POST:basic" ]] || fail "merge fallback reused cross-credential evidence (calls=$merge_sequence)" + # BLOCK path: a commit email exists but author.login is null. It must name both # facts, name the escalation principal, and never reach the merge endpoint. null_dir=$(make_case null-login) @@ -205,9 +319,87 @@ set -e [[ "$null_output" == *"BLOCK"* ]] || fail "null-login author omitted BLOCK diagnostic" [[ "$null_output" == *"author.login=NULL"* ]] || fail "null-login author omitted the null provider fact" [[ "$null_output" == *"unresolved@example.test"* ]] || fail "null-login author omitted the commit email fact" +[[ "$null_output" == *'\n\x1b[31m'* ]] || fail "null-login author diagnostic did not escape control characters" +[[ "$null_output" != *$'\033'* ]] || fail "null-login author diagnostic emitted a raw terminal escape" +[[ "$(printf '%s\n' "$null_output" | wc -l)" -eq 1 ]] || fail "null-login author diagnostic permitted newline injection" [[ "$null_output" == *"tl-mosaic"* ]] || fail "null-login author omitted the named escalation principal" [[ ! -e "$null_dir/merge-payload.json" ]] || fail "null-login BLOCK still reached the merge API" +# Every provider-derived field in alternate BLOCK diagnostics is log-safe too, +# including an invalid non-head SHA that contains control characters. +unsafe_dir=$(make_case unsafe-identity) +set +e +unsafe_output=$(run_case "$unsafe_dir" unsafe-identity --co-author-trailers --escalate-to tl-mosaic 2>&1) +unsafe_rc=$? +set -e +[[ "$unsafe_rc" -ne 0 ]] || fail "unsafe identity expected a non-zero BLOCK" +[[ "$unsafe_output" == *"unusable linked identity"* ]] || fail "unsafe identity omitted its BLOCK reason" +[[ "$unsafe_output" == *'\n\x1b[31m'* ]] || fail "unsafe identity SHA did not escape control characters" +[[ "$unsafe_output" != *$'\033'* ]] || fail "unsafe identity diagnostic emitted a raw terminal escape" +[[ "$(printf '%s\n' "$unsafe_output" | wc -l)" -eq 1 ]] || fail "unsafe identity diagnostic permitted newline injection" +[[ ! -e "$unsafe_dir/merge-payload.json" ]] || fail "unsafe identity BLOCK still reached the merge API" + +# The provider PR title cannot add an unchecked trailer outside the constructed +# message field: multi-line and trailer-shaped titles block before mutation. +title_dir=$(make_case title-injection) +set +e +title_output=$(MOSAIC_TEST_TITLE_MODE=injection \ + run_case "$title_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1) +title_rc=$? +set -e +[[ "$title_rc" -ne 0 ]] || fail "title trailer injection unexpectedly passed" +[[ "$title_output" == *"not one printable, non-trailer line"* ]] || fail "title injection refusal lost its diagnostic" +[[ ! -e "$title_dir/merge-payload.json" ]] || fail "title injection reached the merge API" + +# Provider failures remain diagnosable after their temporary response file is +# removed, but provider-controlled control characters stay log-safe. +error_dir=$(make_case provider-error) +set +e +error_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=provider-error \ + run_case "$error_dir" single 2>&1) +error_rc=$? +set -e +[[ "$error_rc" -ne 0 ]] || fail "provider error unexpectedly passed" +[[ "$error_output" == *"HTTP 409"* ]] || fail "provider error omitted the HTTP status" +[[ "$error_output" == *"branch policy rejected"* ]] || fail "provider error response was discarded" +[[ "$error_output" == *'\n\x1b[31m'* ]] || fail "provider error response did not escape control characters" +[[ "$error_output" != *$'\033'* ]] || fail "provider error response emitted a raw terminal escape" +[[ ! -e "$error_dir/basic-resolution.log" ]] || fail "HTTP 409 policy denial incorrectly triggered Basic Auth fallback" + +# Authorization denials likewise fail closed instead of changing principals. +forbidden_dir=$(make_case forbidden) +set +e +forbidden_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=forbidden \ + run_case "$forbidden_dir" single 2>&1) +forbidden_rc=$? +set -e +[[ "$forbidden_rc" -ne 0 ]] || fail "HTTP 403 authorization denial unexpectedly passed" +[[ "$forbidden_output" == *"HTTP 403"* ]] || fail "authorization denial omitted the HTTP status" +[[ ! -e "$forbidden_dir/basic-resolution.log" ]] || fail "HTTP 403 authorization denial incorrectly triggered Basic Auth fallback" + +# The BLOCK destination cannot be generic or inferred after failure: opting in +# without a named principal is refused before any provider operation. +principal_dir=$(make_case missing-principal) +set +e +principal_output=$(run_case "$principal_dir" verified --co-author-trailers 2>&1) +principal_rc=$? +set -e +[[ "$principal_rc" -ne 0 ]] || fail "co-author mode without a named principal unexpectedly passed" +[[ "$principal_output" == *"requires --escalate-to with a named principal"* ]] || fail "missing-principal refusal lost its diagnostic" +[[ ! -e "$principal_dir/merge-payload.json" ]] || fail "missing-principal refusal reached the merge API" + +# A trailing value-taking option receives a stable CLI diagnostic instead of a +# set -u unbound-variable crash. +value_dir=$(make_case missing-principal-value) +set +e +value_output=$(run_case "$value_dir" verified --co-author-trailers --escalate-to 2>&1) +value_rc=$? +set -e +[[ "$value_rc" -ne 0 ]] || fail "missing --escalate-to value unexpectedly passed" +[[ "$value_output" == *"--escalate-to requires one principal name"* ]] || fail "missing --escalate-to value lost its diagnostic" +[[ "$value_output" != *"unbound variable"* ]] || fail "missing --escalate-to value crashed under set -u" +[[ ! -e "$value_dir/merge-payload.json" ]] || fail "missing --escalate-to value reached the merge API" + # Negative control: ordinary single-author merge remains byte-for-byte payload # compatible and hardcoded to squash, with no optional message fields. single_dir=$(make_case single) @@ -229,6 +421,7 @@ PY fi [[ -e "$single_dir/auth-via-config" ]] || fail "ordinary path did not authenticate curl through stdin config" [[ ! -e "$single_dir/token-in-argv" ]] || fail "ordinary path placed the Gitea token in curl argv" +[[ "$(wc -l < "$single_dir/token-resolution.log")" -eq 1 ]] || fail "ordinary path did not use exactly one credential resolution" # Squash is not defaultable: an explicit non-squash method must remain refused. method_dir=$(make_case method-refusal)