mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-23 16:36:23 +00:00
b9f82ed39f
Replace the static comment-pending + comment-results two-job pattern
with a live-updating comment system that polls the GitHub Actions API
every 15s, re-assembles the review comment from whatever results are
available, and upserts it via the <!-- hermes-ci-review-bot --> marker.
The comment updates in real time as each job finishes — no waiting for
the full pipeline.
Every CI job that wants to appear in the review comment emits a
review_status output — a JSON array of objects, each with a source
and a results array:
[
{
"source": "review-label-gate",
"results": [
{"kind": "action_required", "title": "...", "summary": "...",
"how_to_fix": "..."},
{"kind": "info", "title": "...", "summary": "..."}
]
},
{
"source": "ci timing",
"results": [
{"kind": "warning", "title": "CI timings", "summary": "...",
"detail": "...", "link": "..."}
]
}
]
One job can emit multiple results of different kinds. The source field
is used to exclude the corresponding job from the synthesized error
list (case-insensitive, hyphen-normalized matching against GitHub
Actions job display names).
| job | source | kind (on failure) | section |
|----------------------------|--------------------------|---------------------------|----------------------|
| review-labels | review label gate | action_required / info | Action required |
| lockfile-diff | lockfile-diff | action_required | Action required |
| ci-timings | ci timing | warning / info | Warnings |
| supply-chain scan | supply chain | error / (none) | Job failures |
| supply-chain dep-bounds | supply chain | action_required / (none) | Action required |
| osv-scanner | osv scan | warning / (none) | Warnings |
| uv-lockfile-check | uv.lock check | action_required / (none) | Action required |
| history-check | unrelated histories | action_required | Action required |
| contributor-check | contributor attribution | action_required | Action required |
Jobs that find nothing emit [] (empty array) — no noise info items.
A single comment-live job polls the GitHub Actions API every 15s,
classifies jobs into (completed, pending), assembles the comment, and
upserts it. Merges review_status outputs from all needs jobs via
toJSON(needs.*.outputs.review_status), and downloads the ci-timings
artifact when it becomes available. Shows commit SHA + message below
the header.
The assembler has ZERO job-specific knowledge. It just:
1. collect_from_statuses() — flattens all nested status objects into ReviewItems
2. collect_failed_jobs() — synthesizes errors for failed jobs with no declared status
3. _attach_job_urls() — fills in per-job log links for ALL items
4. render_comment() — groups by severity, renders with group headers
Each item shows links inline next to the title: View report (job-emitted
URL) and View job (auto-attached logs link). Each info item is its own
collapsible <details> block.
# ૮ >ﻌ< ა ci review
running on abc1234 — commit message first line
## ❌ Job failures
### {title} · [View job](url)
{summary}
## ⚠️ Action required
### {title} · [View job](url)
{summary}
**How to fix:**
{how_to_fix}
## ⚠️ Warnings
### {title} · [View report](url) · [View job](url)
{summary}
{detail}
<details><summary>{title}</summary>
{content}
</details>
Still running 3 jobs: ci-timings, docker
- test_assemble_review_comment.py (48 tests): collect_from_statuses,
collect_failed_jobs with exclude_sources, _attach_job_urls,
render_comment (group headers, inline links, commit info, per-item
details, pending footer), assemble integration
- test_live_comment.py (16 tests): classify_jobs pure function
- test_timings_report.py (10 tests): generate_review_status nested format
- test_lockfile_diff.py (6 tests)
- test_classify_changes.py (32 tests, pre-existing)
91 lines
3.6 KiB
YAML
91 lines
3.6 KiB
YAML
name: Contributor Attribution Check
|
|
|
|
on:
|
|
workflow_call:
|
|
outputs:
|
|
review_status:
|
|
description: "JSON array of review status objects"
|
|
value: ${{ jobs.check-attribution.outputs.review_status }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
check-attribution:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
outputs:
|
|
review_status: ${{ steps.check-emails.outputs.review_status }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0 # Full history needed for git log
|
|
|
|
- name: Check for unmapped contributor emails
|
|
id: check-emails
|
|
run: |
|
|
# Get the merge base between this PR and main
|
|
MERGE_BASE=$(git merge-base origin/main HEAD)
|
|
|
|
# Find any new author emails in this PR's commits
|
|
NEW_EMAILS=$(git log ${MERGE_BASE}..HEAD --format='%ae' --no-merges | sort -u)
|
|
|
|
if [ -z "$NEW_EMAILS" ]; then
|
|
echo "No new commits to check."
|
|
echo "review_status=[]" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
# An email is mapped if it has a file in contributors/emails/
|
|
# (one file per email — conflict-free) or an entry in the frozen
|
|
# legacy AUTHOR_MAP in scripts/release.py.
|
|
MISSING=""
|
|
while IFS= read -r email; do
|
|
# Skip teknium and bot emails
|
|
case "$email" in
|
|
*teknium*|*noreply@github.com*|*dependabot*|*github-actions*|*anthropic.com*|*cursor.com*)
|
|
continue ;;
|
|
esac
|
|
|
|
if echo "$email" | grep -qP '\+.*@users\.noreply\.github\.com'; then
|
|
continue # GitHub id+login noreply emails auto-resolve
|
|
fi
|
|
|
|
if [ -f "contributors/emails/${email}" ]; then
|
|
continue # mapped via the contributors directory
|
|
fi
|
|
|
|
if ! grep -qF "\"${email}\"" scripts/release.py 2>/dev/null; then
|
|
AUTHOR=$(git log --author="$email" --format='%an' -1)
|
|
MISSING="${MISSING}\n ${email} (${AUTHOR})"
|
|
fi
|
|
done <<< "$NEW_EMAILS"
|
|
|
|
if [ -n "$MISSING" ]; then
|
|
echo ""
|
|
echo "⚠️ New contributor email(s) without a mapping:"
|
|
echo -e "$MISSING"
|
|
echo ""
|
|
echo "Add a mapping file (do NOT edit AUTHOR_MAP in release.py):"
|
|
echo -e "$MISSING" | while read -r line; do
|
|
email=$(echo "$line" | sed 's/^ *//' | cut -d' ' -f1)
|
|
[ -z "$email" ] && continue
|
|
echo " python3 scripts/add_contributor.py ${email} <github-username>"
|
|
done
|
|
echo ""
|
|
echo "To find the GitHub username for an email:"
|
|
echo " gh api 'search/users?q=EMAIL+in:email' --jq '.items[0].login'"
|
|
|
|
# Emit review_status for unmapped emails
|
|
DETAIL=$(echo -e "$MISSING" | sed '/^$/d; s/^ //')
|
|
HOW_TO_FIX=$'Add mappings to scripts/release.py AUTHOR_MAP:\n```\n"<email>": "<github-username>",\n```\nTo find the GitHub username for an email:\n```\ngh api \'search/users?q=EMAIL+in:email\' --jq \'.items[0].login\'\n```\n'
|
|
REVIEW_STATUS=$(jq -nc \
|
|
--arg detail "$DETAIL" \
|
|
--arg how_to_fix "$HOW_TO_FIX" \
|
|
'[{"source":"contributor attribution","results":[{"kind":"action_required","title":"Unmapped contributor email(s)","summary":"New contributor email(s) are not in AUTHOR_MAP.","detail":$detail,"how_to_fix":$how_to_fix}]}]')
|
|
echo "review_status=$REVIEW_STATUS" >> "$GITHUB_OUTPUT"
|
|
|
|
exit 1
|
|
else
|
|
echo "✅ All contributor emails are mapped."
|
|
fi
|