`;
- github.rest.issues.createComment({ ...context.repo, issue_number: context.issue.number, body });
+ echo "pr-delta-comment.yml is intentionally disabled."
+ echo "Use understand-first-pr-analysis.yml instead."
+ exit 0
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index b87a4a6..dbe973c 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -1,4 +1,5 @@
name: Publish PyPI
+# Sole PyPI publisher (OIDC trusted publishing). Do not re-add twine upload in ci.yml.
on:
workflow_dispatch: {}
release:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bbf3d7..192adab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,10 +34,11 @@ jobs:
echo "" >> dist/RELEASE_NOTES.md
echo "## VSIX SHA256" >> dist/RELEASE_NOTES.md
cat dist/VSIX_SHA256.txt >> dist/RELEASE_NOTES.md
- - name: Build understanding pack
+ - name: Build understanding pack (optional release asset)
+ continue-on-error: true
run: |
python -m pip install -e ".[dev,examples]"
- u pack --publish || true
+ u pack publish
- name: Upload artifacts
uses: softprops/action-gh-release@v2
with:
diff --git a/.github/workflows/tour-must-pass.yml b/.github/workflows/tour-must-pass.yml
index 916eae7..c5ce7b3 100644
--- a/.github/workflows/tour-must-pass.yml
+++ b/.github/workflows/tour-must-pass.yml
@@ -1,3 +1,5 @@
+# Fail-closed tour gate (Wave 3): critical scan/lens/trace/tour steps must succeed.
+# Soft-fail only optional gRPC codegen (HTTP server is required for hot_path).
name: Tour Must Pass
on:
pull_request:
@@ -7,39 +9,78 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
+ with:
+ fetch-depth: 2
+
- uses: actions/setup-python@v5
with:
- python-version: '3.11'
+ python-version: "3.11"
+
- name: Install Python deps
run: |
python -m pip install --upgrade pip
python -m pip install -e ".[dev,examples]"
+
- name: Build repo map
run: |
- u scan . -o maps/repo.json || true
+ mkdir -p maps tours traces
+ u scan . -o maps/repo.json
+
- name: Create lens from PR files
run: |
- CHANGED=$(git diff --name-only HEAD~1 | tr '\n' ' ')
- u lens from-seeds --seed $CHANGED --map maps/repo.json -o maps/lens.json || true
+ CHANGED=$(git diff --name-only HEAD~1 2>/dev/null | tr '\n' ' ' || true)
+ if [ -z "$(echo "$CHANGED" | tr -d '[:space:]')" ]; then
+ CHANGED="examples/app/hot_path.py"
+ fi
+ u lens from-seeds --seed $CHANGED --map maps/repo.json -o maps/lens.json
+ test -f maps/lens.json
+
- name: Generate gRPC Python code
+ continue-on-error: true
run: |
- python -m grpc_tools.protoc -I examples/apis --python_out=examples/apis/gen --grpc_python_out=examples/apis/gen examples/apis/orders.proto
+ python -m grpc_tools.protoc -I examples/apis \
+ --python_out=examples/apis/gen \
+ --grpc_python_out=examples/apis/gen \
+ examples/apis/orders.proto
+
- name: Start HTTP server
run: |
nohup python examples/servers/http_server.py >/tmp/http.log 2>&1 &
sleep 2
+ curl -sf http://127.0.0.1:8000/pets >/dev/null
+
- name: Start gRPC mock
+ continue-on-error: true
run: |
nohup python examples/servers/grpc_server.py >/tmp/grpc.log 2>&1 &
sleep 2
+
- name: Trace hot path (runtime truth)
run: |
u trace module examples/app/hot_path.py run_hot_path -o traces/tour.json
+ test -f traces/tour.json
u lens merge-trace maps/lens.json traces/tour.json -o maps/lens_merged.json
+ test -f maps/lens_merged.json
+
- name: Generate tour (from merged lens)
run: |
- u tour maps/lens_merged.json -o tours/PR.md || true
- - name: Run tour (fixture)
+ u tour maps/lens_merged.json -o tours/PR.md
+ test -f tours/PR.md
+
+ - name: Run tour fixture (fail-closed gate)
run: |
- set -e
u tour_run maps/lens_merged.json -f fixtures
+
+ - name: Upload tour artifacts
+ if: always()
+ uses: actions/upload-artifact@v4
+ with:
+ name: tour-must-pass-artifacts
+ path: |
+ maps/repo.json
+ maps/lens.json
+ maps/lens_merged.json
+ traces/tour.json
+ tours/PR.md
+ retention-days: 14
+ if-no-files-found: warn
diff --git a/.github/workflows/understand-first-commenter.yml b/.github/workflows/understand-first-commenter.yml
index 826905a..1b84a3c 100644
--- a/.github/workflows/understand-first-commenter.yml
+++ b/.github/workflows/understand-first-commenter.yml
@@ -1,201 +1,25 @@
-name: Understand-First Commenter Service
+# DISABLED (P0-01 / P1-06): Inline commenter invoked non-existent `u analyze`
+# and installed only loose pip deps instead of the understand-first package.
+#
+# Active thin PR path:
+# .github/workflows/understand-first-pr-analysis.yml
+# (pip install -e . ; u scan ; u diff --old/--new)
+name: Understand-First Commenter Service (disabled)
on:
- pull_request:
- types: [opened, synchronize, reopened, closed]
workflow_dispatch:
inputs:
- pr_number:
- description: "PR number to analyze"
- required: true
- type: string
+ reason:
+ description: "Disabled workflow — see file header TODO"
+ required: false
+ default: "manual-only"
jobs:
- commenter-service:
+ disabled:
runs-on: ubuntu-latest
- permissions:
- contents: read
- pull-requests: write
- checks: write
- actions: read
- statuses: write
- issues: write
-
steps:
- - name: Checkout code
- uses: actions/checkout@v4
- with:
- fetch-depth: 0
-
- - name: Set up Python
- uses: actions/setup-python@v4
- with:
- python-version: "3.11"
-
- - name: Install dependencies
- run: |
- python -m pip install --upgrade pip
- pip install typer rich aiohttp asyncpg pydantic requests
-
- - name: Run Understand-First Commenter
- env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- PR_NUMBER: ${{ github.event.number || github.event.inputs.pr_number }}
+ - name: Workflow disabled pending real CLI rewrite
run: |
- python -c "
- import os
- import json
- import requests
- from datetime import datetime
-
- # GitHub API setup
- token = os.environ['GITHUB_TOKEN']
- pr_number = os.environ['PR_NUMBER']
- repo = os.environ['GITHUB_REPOSITORY']
-
- headers = {
- 'Authorization': f'token {token}',
- 'Accept': 'application/vnd.github.v3+json'
- }
-
- # Get PR details
- pr_url = f'https://api.github.com/repos/{repo}/pulls/{pr_number}'
- pr_response = requests.get(pr_url, headers=headers)
- pr_data = pr_response.json()
-
- base_sha = pr_data['base']['sha']
- head_sha = pr_data['head']['sha']
-
- print(f'Analyzing PR #{pr_number}: {pr_data[\"title\"]}')
- print(f'Base: {base_sha[:8]} -> Head: {head_sha[:8]}')
-
- # Run analysis on both commits
- os.system(f'u analyze --output base-analysis.json --format json --commit {base_sha}')
- os.system(f'u analyze --output head-analysis.json --format json --commit {head_sha}')
-
- # Generate delta analysis
- os.system('u diff base-analysis.json head-analysis.json --output pr-delta.json --format json --policy-check --verbose')
-
- # Generate comment content
- os.system('u diff base-analysis.json head-analysis.json --output pr-comment.md --format markdown --policy-check')
-
- # Generate mini-map
- os.system('u diff base-analysis.json head-analysis.json --output pr-minimap.svg --format svg')
-
- # Read results
- with open('pr-delta.json', 'r') as f:
- delta_data = json.load(f)
-
- with open('pr-comment.md', 'r') as f:
- comment_content = f.read()
-
- # Read mini-map
- with open('pr-minimap.svg', 'r') as f:
- minimap_svg = f.read()
-
- # Create enhanced comment
- violations = delta_data.get('violations', [])
- policy_passed = len(violations) == 0
-
- # Convert SVG to data URL
- import base64
- minimap_base64 = base64.b64encode(minimap_svg.encode()).decode()
- minimap_data_url = f'data:image/svg+xml;base64,{minimap_base64}'
-
- enhanced_comment = f'''
- ## 🔍 Understand-First PR Analysis
-
- {comment_content}
-
- ### 📊 Mini-Map Visualization
- Generated: {delta['timestamp']}
") - - # Summary - summary = delta["summary"] - html.append("Functions Added: {summary['added_functions']}
") - html.append(f"Functions Removed: {summary['removed_functions']}
") - html.append(f"Functions Modified: {summary['modified_functions']}
") - html.append(f"Complexity Change: {summary['complexity_change']:+d}
") - html.append(f"Side Effects Added: {summary['side_effects_added']}
") - html.append(f"Side Effects Removed: {summary['side_effects_removed']}
") - html.append("Function: {violation['function']}
File: {violation['file']}:{violation['line']}
Message: {violation['message']}
") - html.append("
{func['file']}:{func['line']}"
- )
- html.append(f"