Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 135 additions & 0 deletions scripts/agy-review-selftest.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,135 @@
#!/usr/bin/env bash
#
# agy-review-selftest.sh -- guards the comment-selection logic in `agy-review.sh`.
#
# Why this exists: that filter decides which PR comments the bot DELETES, and it has been wrong
# twice, both times invisibly.
#
# 1. The just-posted comment was not reliably excluded. `new_comment_id` came from re-querying
# the comment list, which races GitHub's read replication; on a miss the exclusion became
# `select(.id != null)`, true for every id, and the run deleted the review it had just
# published.
# 2. jq's `--arg`/`--argjson` were handed to `gh api`, which has no such flags. It exited
# non-zero, `2>/dev/null` hid the message, and `set -o pipefail` + `set -e` killed the script
# AFTER posting — so stale comments silently accumulated and the job went red with nothing in
# the log explaining why.
#
# Neither was catchable by looking at the review the bot posted: both times it posted fine. So the
# filter is tested here directly, offline, against fixtures — no network, no `gh`, no runner.
#
# Run: bash scripts/agy-review-selftest.sh

set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"

# Source the constants out of the reviewer without running it. `agy-review.sh` does its work at
# top level, so it cannot simply be sourced; the two values under test are lifted by pattern
# instead. That coupling is deliberate: if either declaration is renamed or reshaped, this test
# fails loudly rather than silently checking a stale copy of the filter.
extract_marker() {
sed -n 's/^MARKER="\(.*\)"$/\1/p' "$SCRIPT_DIR/agy-review.sh" | head -n 1
}
extract_filter() {
sed -n "/^SELECT_STALE_JQ='/,/'\$/p" "$SCRIPT_DIR/agy-review.sh" \
| sed "1s/^SELECT_STALE_JQ='//; \$s/'\$//"
}

MARKER="$(extract_marker)"
FILTER="$(extract_filter)"

[ -n "$MARKER" ] || { echo "FAIL: could not extract MARKER from agy-review.sh" >&2; exit 1; }
[ -n "$FILTER" ] || { echo "FAIL: could not extract SELECT_STALE_JQ from agy-review.sh" >&2; exit 1; }

# A non-empty extraction is not the same as a COMPLETE one. The `sed` range above ends at the
# first line closing with a quote, so a filter whose body ever ends a line that way would be
# truncated — and a truncated jq program can still be valid and still return ids, which is the
# silent-wrong-answer this whole file exists to prevent. Two independent guards:
#
# 1. it must compile (a truncated program is usually, though not always, a syntax error);
# 2. it must END with the projection, which is what makes it a complete pipeline rather than a
# prefix of one.
# The named args must be supplied here too: the filter references `$marker`/`$new_id`, and jq
# rejects an undefined variable at COMPILE time — so omitting them fails a perfectly good program.
if ! printf '[]' | jq --arg marker x --argjson new_id 0 "$FILTER" >/dev/null 2>&1; then
echo "FAIL: extracted SELECT_STALE_JQ is not a valid jq program (truncated?):" >&2
printf '%s\n' "$FILTER" >&2
exit 1
fi
case "$(printf '%s' "$FILTER" | tr -d '[:space:]')" in
*'|.id') : ;;
*) echo "FAIL: extracted SELECT_STALE_JQ does not end in '| .id'; extraction truncated" >&2
printf '%s\n' "$FILTER" >&2
exit 1 ;;
esac

fixture() {
cat <<JSON
[
{"id": 111, "user": {"type": "Bot", "login": "github-actions[bot]"}, "body": "$MARKER\nold review"},
{"id": 222, "user": {"type": "Bot", "login": "github-actions[bot]"}, "body": "$MARKER\nolder still"},
{"id": 333, "user": {"type": "User", "login": "someone"}, "body": "$MARKER\nnot ours"},
{"id": 444, "user": {"type": "Bot", "login": "other-bot"}, "body": "$MARKER\nwrong bot"},
{"id": 555, "user": {"type": "Bot", "login": "github-actions[bot]"}, "body": "an ordinary bot comment"},
{"id": 999, "user": {"type": "Bot", "login": "github-actions[bot]"}, "body": "$MARKER\nJUST POSTED"}
]
JSON
}

# Ids as a single space-separated line, with no trailing space — so the expected values below read
# as what they are rather than carrying padding an assertion would have to mirror.
select_ids() {
fixture | jq -r --arg marker "$MARKER" --argjson new_id "$1" "$FILTER" | sort -n | paste -sd' ' -
}

fails=0
check() {
local name="$1" want="$2" got="$3"
if [ "$got" = "$want" ]; then
echo " ok $name"
else
echo " FAIL $name"
echo " want: [$want]"
echo " got: [$got]"
fails=$((fails + 1))
fi
}

echo "agy-review comment-selection self-test"

# The whole point: the comment just published is never selected for deletion.
check "excludes the just-posted comment" "111 222" "$(select_ids 999)"

# The author filter is a security control, not tidiness: without it any user could paste the
# marker into a comment and have the bot delete comments on the next run.
check "ignores other users and other bots" "111 222" "$(select_ids 999)"

# A bot comment without the marker is somebody else's feature (a CI summary, a deploy note).
check "ignores bot comments without the marker" "111 222" "$(select_ids 999)"

# Regression #1, pinned: an unknown id must not select everything. The caller now refuses to run
# the delete at all in this case, but the filter itself is checked so the two guards are
# independent rather than one relying on the other.
check "an id of 0 still excludes nothing real" "111 222 999" "$(select_ids 0)"

# A different id in the set behaves the same way, so the exclusion is genuinely by value.
check "excludes whichever id it is given" "222 999" "$(select_ids 111)"

# Regression #2, pinned: `--arg`/`--argjson` belong to jq. If they are ever moved onto `gh api`
# again, that command exits non-zero — assert the flags are not passed to `gh api` in the script.
# Line continuations are folded first: `--arg` moved onto a continuation line would otherwise sit
# on a different physical line from `gh api`, and a line-by-line grep would report a false pass on
# exactly the mistake this check exists to catch.
if sed -e ':a' -e '/\\$/{N;s/\\\n//;ba' -e '}' "$SCRIPT_DIR/agy-review.sh" \
| grep -qE 'gh api[^|]*--(arg|argjson)'; then
echo " FAIL --arg/--argjson passed to \`gh api\` (jq flags; gh api rejects them)"
fails=$((fails + 1))
else
echo " ok --arg/--argjson are not passed to \`gh api\`"
fi

if [ "$fails" -ne 0 ]; then
echo "$fails check(s) failed" >&2
exit 1
fi
echo "all checks passed"
138 changes: 107 additions & 31 deletions scripts/agy-review.sh
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,22 @@ AGY_RETRIES="${AGY_RETRIES:-3}" # attempts to get a usable agy respon
AGY_RETRY_DELAY="${AGY_RETRY_DELAY:-15}" # base backoff seconds between retries (grows per attempt)
MARKER="<!-- antigravity-pr-review -->"

# The jq program that picks which prior review comments to delete. Named, and exercised directly
# by `scripts/agy-review-selftest.sh`, because this filter has now been wrong TWICE in ways
# nothing observed: first the just-posted comment was not excluded (so it deleted itself), then
# jq's `--arg` was handed to `gh api`, which has no such flag (so the whole step died silently and
# stale comments accumulated). Both were invisible from the outside — the review still posted.
#
# The two `select`s that matter: the AUTHOR filter (without it, any user could put the marker in a
# comment and have this bot delete arbitrary comments) and the ID exclusion (without it, the run
# deletes the comment it just published).
SELECT_STALE_JQ='.[]
| select(.user.type == "Bot" and .user.login == "github-actions[bot]")
| select(.body | contains($marker))
| select(.id != $new_id)
| .id'
readonly SELECT_STALE_JQ

REPO="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY not set}"

# --- resolve the PR number from the triggering event --------------------------
Expand Down Expand Up @@ -411,16 +427,30 @@ here="$(cd "$(dirname "$0")" && pwd)"
# Serialize agy across concurrent review jobs on this host. agy runs a SINGLETON
# local language-server + conversation store per user, so two `--print` calls at
# once collide (one reports the backend "unavailable"). flock makes jobs queue
# instead of failing. Best-effort: if the lock can't be taken, proceed anyway.
if command -v flock >/dev/null 2>&1; then
# Create the lock dir first: a failed `exec 9>` redirection is a FATAL shell error (it aborts
# before the `|| log` fallback can run), so ensure the parent exists on a fresh runner. `>>` opens
# for append rather than truncating the lockfile — flock uses the fd, not the contents.
mkdir -p "$(dirname "$AGY_LOCK")" 2>/dev/null || true
exec 9>>"$AGY_LOCK" 2>/dev/null \
&& flock -w "$AGY_LOCK_WAIT" 9 \
|| log "agy lock unavailable or timed out (${AGY_LOCK_WAIT}s); proceeding unserialized"
# instead of failing. FAIL CLOSED: if flock is missing, or the lock can't be
# taken/times out, exit rather than let two agy processes race each other --
# a fail-open here made the exact collision this lock exists to prevent still
# reachable (one run can burn the whole ${AGY_RETRIES}x${AGY_LOCK_WAIT}s wait).
command -v flock >/dev/null 2>&1 || {
log "flock is required to serialize agy; refusing to run unserialized"
exit 1
}
# Create the lock dir first: a failed `exec 9>` redirection is a FATAL shell error (it aborts
# before the `|| log` fallback can run), so ensure the parent exists on a fresh runner. `>>` opens
# for append rather than truncating the lockfile — flock uses the fd, not the contents.
# Validated before use: an empty `AGY_LOCK` (an env override set to "") would make `dirname`
# yield "." and the redirection below fail with an obscure shell error, at the one point where a
# clear message matters -- this is the guard that keeps two agy runs off each other.
if [ -z "$AGY_LOCK" ]; then
log "AGY_LOCK is empty; refusing to run unserialized"
exit 1
fi
mkdir -p "$(dirname "$AGY_LOCK")"
exec 9>>"$AGY_LOCK"
flock -w "$AGY_LOCK_WAIT" 9 || {
log "agy lock timed out after ${AGY_LOCK_WAIT}s"
exit 1
}

# Retry the whole agy attempt on empty/failed output: transient "agy is down"
# (backend rate-limit / local-server contention) usually clears within seconds.
Expand Down Expand Up @@ -512,31 +542,77 @@ body_file="$(mktemp)"
printf '\n\n<sub>Automated first-pass review by `agy` on a self-hosted runner -- not a human review.</sub>\n'
} > "$body_file"

# --- replace any prior review comment, then post fresh -------------------------
# A failed delete is logged, not swallowed: silently ignoring it would let a transient API/perms
# error leave the old comment in place AND post a new one, so runs accumulate duplicates.
# The author filter is load-bearing, not cosmetic: without it, ANY user could put the
# marker (an HTML comment) in a PR comment and have this bot delete arbitrary comments on
# the next run. Only ever delete OUR OWN bot's prior review comments.
gh api "repos/${REPO}/issues/${PR}/comments" --paginate \
--jq ".[] | select(.user.type == \"Bot\" and .user.login == \"github-actions[bot]\") | select(.body | contains(\"${MARKER}\")) | .id" 2>/dev/null \
| while read -r cid; do
[ -n "$cid" ] || continue
if ! gh api -X DELETE "repos/${REPO}/issues/comments/${cid}" >/dev/null 2>&1; then
log "warning: could not delete prior review comment ${cid}; a duplicate may result"
fi
done

# Final hard guard — the last line of defense, and UNCONDITIONAL. Layer 1 (the retry loop)
# already rejects a lapsed-session capture, but a public PR comment must NEVER carry a live
# OAuth authorization URL, whatever any upstream change does to the body — and with no "looks
# like a review" exemption that a header alongside a URL could disarm. A genuine review that
# merely discusses auth or quotes this script's bare regex has no live URL and posts normally;
# only an actual authorization URL blocks the post.
# Final hard guard — the last line of defense, and UNCONDITIONAL, run BEFORE anything is
# deleted or posted. Layer 1 (the retry loop) already rejects a lapsed-session capture, but
# a public PR comment must NEVER carry a live OAuth authorization URL, whatever any upstream
# change does to the body — and with no "looks like a review" exemption that a header
# alongside a URL could disarm. A genuine review that merely discusses auth or quotes this
# script's bare regex has no live URL and posts normally; only an actual authorization URL
# blocks the post.
if oauth_url_present "$body_file"; then
log "refusing to post: the assembled comment body contains a live OAuth authorization URL. Re-authenticate agy on the runner host."
exit 1
fi

gh pr comment "$PR" --repo "$REPO" --body-file "$body_file"
# --- post fresh, THEN replace any prior review comment --------------------------
# Publish-before-delete, deliberately: if this ordering were reversed and posting failed
# afterward (a transient gh/API error), the PR would be left with NO review comment at all
# instead of the still-valid prior one. Posting first means a failure here can only ever
# leave a harmless duplicate, never a silent loss of the last review.
# The posted comment's id comes from the POST itself, not from a read-back. `gh pr comment`
# prints the new comment's URL, whose trailing `#issuecomment-<id>` is authoritative the instant
# it returns. Re-querying the comment list to find "the newest one with our marker" raced with
# GitHub's own read replication: right after posting, the list can still omit it, and then the
# exclusion below matched nothing and the script deleted the comment it had just published --
# turning publish-before-delete into publish-then-destroy, the exact failure the ordering exists
# to prevent.
if ! post_output="$(gh pr comment "$PR" --repo "$REPO" --body-file "$body_file" 2>&1)"; then
# Nothing is deleted when the post fails: the prior review comment is still the best
# information the PR has, and removing it would leave no review at all.
log "failed to post review to ${REPO}#${PR}: ${post_output}"
exit 1
fi
log "posted review to ${REPO}#${PR}"
new_comment_id="$(printf '%s\n' "$post_output" | sed -n 's/.*#issuecomment-\([0-9][0-9]*\).*/\1/p' | tail -n 1)"

# A failed delete is logged, not swallowed: silently ignoring it would let a transient API/perms
# error leave the old comment in place alongside the new one, so runs accumulate duplicates.
# The author filter is load-bearing, not cosmetic: without it, ANY user could put the
# marker (an HTML comment) in a PR comment and have this bot delete arbitrary comments on
# the next run. Only ever delete OUR OWN bot's prior review comments -- and only ones from
# BEFORE this run (the just-posted comment's own id is excluded so it can never delete itself).
if [ -z "$new_comment_id" ]; then
# FAIL CLOSED. Without a known id there is no way to tell the new comment from the old ones,
# and the safe direction is unambiguous: a leftover duplicate is noise, deleting the review
# that was just posted is data loss.
log "warning: could not determine the posted comment id; leaving prior review comments in place"
else
# `--arg`/`--argjson` rather than shell interpolation into the filter: the marker is an HTML
# comment today, but a quote or a backslash in it would otherwise break the jq program itself
# rather than simply not matching.
#
# Those are JQ flags, so the JSON is fetched raw and piped into a real `jq` — `gh api` has no
# `--arg`/`--argjson` of its own and rejects them. Handing them to `gh api --jq` made it exit
# non-zero on every run; with the old `2>/dev/null` swallowing the message and `set -o pipefail`
# in force, the script then died *after* posting, so the stale comments were never deleted and
# the job went red for a reason nothing printed. stderr is kept this time for exactly that
# reason. (`--paginate` without `--jq` emits one JSON array per page; `jq` reads that stream
# fine, applying `.[]` to each.)
stale_ids="$(
gh api "repos/${REPO}/issues/${PR}/comments" --paginate \
| jq -r --arg marker "$MARKER" --argjson new_id "$new_comment_id" "$SELECT_STALE_JQ"
)" || {
log "warning: could not list prior review comments; leaving them in place"
stale_ids=""
}
while read -r cid; do
[ -n "$cid" ] || continue
if ! gh api -X DELETE "repos/${REPO}/issues/comments/${cid}" >/dev/null 2>&1; then
log "warning: could not delete prior review comment ${cid}; a duplicate may result"
fi
done <<< "$stale_ids"
fi
Comment on lines +576 to +614

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Does gh pr commentprint the new comment's URL (with#issuecomment-<id>) to stdout on success?

💡 Result:

No, the gh pr comment command does not print the URL of the newly created comment to stdout upon success [1][2]. While gh pr comment is designed to add a comment to a pull request, the official GitHub CLI documentation and manual pages do not list the output of a comment URL as part of its standard behavior [1][2]. In many cases, the command executes silently on success, or may provide minimal feedback depending on the terminal environment, but it does not return the structured URL (such as ...#issuecomment-<id>) that some users might expect for automation or scripting purposes [1][2]. If you require the URL of a newly created comment, you may need to use an alternative approach, such as: 1. Using gh api to perform the request directly, which allows you to inspect the full JSON response containing the html_url field [3][4]. 2. Listing the comments after the command has executed to retrieve the most recent one [5][6]. For programmatic workflows where the URL is needed, leveraging the gh api command with the appropriate REST API endpoint (typically /repos/{owner}/{repo}/issues/{pull_number}/comments) is the recommended way to retrieve the created comment's metadata, including its URL [3][7][8].

Citations:


🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- workflow references ---'
rg -n -C 3 'gh |gh-version|GH_VERSION|setup-gh|cli/cli|antigravity-review' .github/workflows/antigravity-review.yml .github 2>/dev/null || true

printf '%s\n' '--- script context ---'
sed -n '520,630p' scripts/agy-review.sh

printf '%s\n' '--- comment-posting calls ---'
rg -n -C 4 'gh pr comment|post_output|new_comment_id|SELECT_STALE_JQ' scripts/agy-review.sh

Repository: doublegate/RustyN64

Length of output: 18075


🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- complete review workflow ---'
cat -n .github/workflows/antigravity-review.yml | sed -n '1,110p'

printf '%s\n' '--- local gh availability ---'
if command -v gh >/dev/null 2>&1; then
  gh --version
else
  printf '%s\n' 'gh is not installed in the verifier sandbox'
fi

printf '%s\n' '--- repository references to gh versioning ---'
rg -n -i 'gh([ _-]?cli)?|github[ /]cli|cli/cli' \
  .github/workflows scripts README.md .tool-versions .github 2>/dev/null || true

Repository: doublegate/RustyN64

Length of output: 18191


🌐 Web query:

site:github.com/cli/cli gh pr comment source output URL NewComment

💡 Result:

The gh pr comment command does not natively output the URL of a newly created comment to standard output in a simple, direct format by default [1]. However, you can obtain the URL of a newly created comment by using the command in combination with shell utilities or by capturing its output if the specific version of gh you are using supports it [2]. 1. Capture the output: Recent updates to gh have improved the behavior of command output. When running gh pr comment, you can often pipe or capture the output to verify the URL [2]. For example, in automated environments, you might see the URL printed to stdout if the command is executed successfully [2]. 2. Alternative Approach (Manual Retrieval): If the command does not provide the URL directly in your environment, you can retrieve it by querying the pull request's comments immediately after creation using gh pr view combined with jq [3][4]. Example using jq to find the most recent comment: gh pr view --json comments --jq '.comments[-1].url' 3. Best Practice for Automation: If you are working in CI/CD or scripts, the most reliable way to get the URL is to use the gh JSON output capabilities to inspect the PR state or to use the GitHub API directly via gh api to create the comment, which returns the full comment object including the html_url [3][5][1]. If you find that the command is not outputting the URL as expected, it is recommended to check your version of the GitHub CLI (gh --version) and use the gh pr view method for deterministic results in scripts [3][4].

Citations:


🌐 Web query:

site:cli.github.com/manual/gh_pr_comment "URL" output

💡 Result:

gh pr comment accepts a pull-request URL as its argument:

gh pr comment https://github.com/OWNER/REPO/pull/123 --body "Comment text"

The command’s output behavior is not documented as returning a URL; it adds, edits, or deletes a comment. (cli.github.com)

Citations:


🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- gh 2.96.0 command help ---'
gh pr comment --help | sed -n '1,120p'

printf '%s\n' '--- gh 2.96.0 source references ---'
for path in \
  pkg/cmd/pr/comment/comment.go \
  pkg/cmd/pr/comment/comment_test.go
do
  url="https://raw.githubusercontent.com/cli/cli/v2.96.0/${path}"
  printf '%s\n' "--- ${url} ---"
  curl -fsSL "$url" | rg -n -C 5 'Print|URL|html_url|NewComment|comment' | sed -n '1,180p' || true
done

Repository: doublegate/RustyN64

Length of output: 10533


Pin or assert the GitHub CLI version

gh v2.96.0 prints the created comment URL on stdout. The workflow does not pin gh, so this output format is not guaranteed on the self-hosted runner. Pin or assert the CLI version to preserve determinism.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/agy-review.sh` around lines 576 - 614, Pin the GitHub CLI version
used by scripts/agy-review.sh, or add an explicit version assertion before the
comment-posting flow that parses post_output and new_comment_id. Ensure the
workflow fails or stops safely when the installed gh version is unsupported,
preserving deterministic extraction of the created comment URL.


# The delete loop above is the last real work; end on a defined status so a stray non-zero from
# it can never be mistaken for "the review failed" once the comment is already published.
exit 0