Claude
a531323865
~23% of reviews were failing open with `diff fetch failed: gitea GET
/{owner}/{repo}/compare/{before}...{after}.diff -> 404`. Probing the live
forge (Gitea 1.27.1) showed the web compare route answers 404 for ALL refs
on private repos — it does not honor `Authorization: token` and resolves as
anonymous — while the API compare (JSON) and per-commit
/git/commits/{sha}.diff endpoints succeed for the exact same sha pairs.
It also 404s legitimately when `before` is unknown (force-push, rebase).
fetchDiff now walks a fallback chain instead of failing open on the first
404 (any non-404 error still propagates immediately):
PR job: pulls/{n}.diff -> git/commits/{head}.diff
range push: web compare {before}...{after}.diff
-> web compare {defaultBranch}...{after}.diff
-> API compare commit list (falls back to the webhook's
commitShas) -> concatenated per-commit git/commits/{sha}.diff,
stopping past maxDiffBytes so the existing truncation cap
(verdict capped at 'warn') kicks in
-> git/commits/{after}.diff alone
new branch: git/commits/{after}.diff (unchanged)
Only when every source is exhausted does the review fail open, and the log
line now lists every URL tried. Webhook jobs carry the repo default_branch
so the fallback needs no extra API call; getRepo() covers recovered jobs
persisted before this change.
Verified against the live forge for the exact failing pair from today's
service.log (Nirlabinc/shreai 481d8663...46696b50): the chain recovers a
full-range 8,993-byte diff via 2/2 per-commit diffs.
Co-Authored-By: Claude Fable 5 <[email protected]>
65 lines
2.4 KiB
JavaScript
65 lines
2.4 KiB
JavaScript
import { createHmac, timingSafeEqual } from 'node:crypto';
|
|
|
|
export function verifySignature(rawBody, signature, secret) {
|
|
if (!secret) return false;
|
|
if (!signature) return false;
|
|
const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
|
|
const a = Buffer.from(expected, 'utf8');
|
|
const b = Buffer.from(String(signature), 'utf8');
|
|
return a.length === b.length && timingSafeEqual(a, b);
|
|
}
|
|
|
|
const ZERO_SHA = /^0+$/;
|
|
|
|
// Turn a Gitea webhook (event header + payload) into a review job, or null if
|
|
// the event is not reviewable.
|
|
export function jobFromWebhook(event, payload) {
|
|
if (event === 'push') {
|
|
const after = payload.after;
|
|
if (!after || ZERO_SHA.test(after)) return null; // branch delete
|
|
const [owner, repo] = String(payload.repository?.full_name || '').split('/');
|
|
if (!owner || !repo) return null;
|
|
const commits = Array.isArray(payload.commits) ? payload.commits : [];
|
|
if (commits.length === 0) return null; // e.g. tag push / empty
|
|
return {
|
|
event: 'push',
|
|
owner, repo,
|
|
sha: after,
|
|
ref: payload.ref,
|
|
before: payload.before,
|
|
defaultBranch: payload.repository?.default_branch || null,
|
|
prIndex: null,
|
|
prTitle: null,
|
|
pusher: payload.pusher?.username || payload.pusher?.login || null,
|
|
authors: dedupe(commits.map(c => c.author?.name || c.author?.email).filter(Boolean)),
|
|
commitShas: commits.map(c => c.id).filter(Boolean),
|
|
commitMessages: commits.map(c => c.message || '')
|
|
};
|
|
}
|
|
if (event === 'pull_request') {
|
|
const action = payload.action;
|
|
if (!['opened', 'synchronize', 'synchronized', 'reopened'].includes(action)) return null;
|
|
const pr = payload.pull_request;
|
|
if (!pr) return null;
|
|
const [owner, repo] = String(payload.repository?.full_name || '').split('/');
|
|
if (!owner || !repo) return null;
|
|
return {
|
|
event: `pull_request/${action}`,
|
|
owner, repo,
|
|
sha: pr.head?.sha,
|
|
ref: pr.head?.ref,
|
|
before: null,
|
|
defaultBranch: payload.repository?.default_branch || null,
|
|
prIndex: pr.number,
|
|
prTitle: pr.title || null,
|
|
pusher: payload.sender?.username || payload.sender?.login || null,
|
|
authors: dedupe([pr.user?.username || pr.user?.login].filter(Boolean)),
|
|
commitShas: [pr.head?.sha].filter(Boolean),
|
|
commitMessages: [pr.title || '', pr.body || '']
|
|
};
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function dedupe(a) { return [...new Set(a)]; }
|