cd67042184
gitea_get_branch_head_sha() looked up a branch's head SHA via
`curl -fsSL .../branches/<branch>`. For a branch not yet pushed to the
remote, Gitea returns 404, curl -f fails, stdin is empty, and the
downstream `json.load` raises JSONDecodeError -- crashing the guard.
Since ci-queue-wait.sh is a mandatory pre-push check, every new feature
branch's first push was blocked.
Capture the HTTP status via `curl -sS -w '\n%{http_code}'`:
- 404 -> echo __BRANCH_ABSENT__, return 0 (no in-flight pipeline on a
branch that doesn't exist yet -- queue is clear).
- non-200 -> return 1 (still fail-closed on a genuine API error).
- 200 -> parse the JSON as before (existing-branch behavior unchanged).
The caller checks for the __BRANCH_ABSENT__ sentinel and exits 0 with a
"branch not yet on remote -- queue clear" message.
ci-queue-wait.ps1 had the same bug (Invoke-RestMethod throws on any
non-2xx, including 404, and the catch block exited 1) -- ported the
equivalent fix there via the caught exception's HTTP status code.
Adds a red-first regression harness (test-ci-queue-wait-branch-absent.sh)
covering: 404 branch-absent -> queue clear; 200 existing branch with a
terminal CI state -> unchanged behavior; 500 genuine API error -> still
fail-closed. Verified failing against the unpatched script (crashes with
JSONDecodeError) and passing after the fix. Wired into
package.json's test:framework-shell alongside the existing git-wrapper
regression tests.
Upstreams Mos host-local tooling-patch kit (2026-07-23), Patch 3.
Git provider wrappers
These scripts provide host-aware GitHub and Gitea issue, pull-request, milestone, and CI operations.
Durable review provenance
A successful provider write command—or a wrapper message based only on that command's exit code—is not durable review provenance. Review comments count as durable provenance only after the wrapper reads the created provider record back and verifies that it belongs to the intended repository and pull request and contains the exact submitted body (or verifies the provider-returned record ID).
pr-review.sh therefore fails closed when a Gitea comment cannot be written, its created comment ID cannot be identified, or provider read-back does not match. It reports comment success only after that read-back verification passes.