Merge pull request 'feat(reports): classify git fetch as a git ref mutation (closes #297)' (#344) from feat/issue-297-fetch-ref-mutation into master

2026-07-07 04:07:11 -05:00
parent cbae9a3ecd c41a698a08
commit d7d2f92286
2 changed files with 217 additions and 0 deletions
@@ -3099,3 +3099,119 @@ def assess_email_disclosure(
            for email in emails
        ],
    }
+
+
+# ---------------------------------------------------------------------------
+# Git ref mutations (#297)
+# ---------------------------------------------------------------------------
+
+_GIT_REF_MUTATIONS_FIELD_RE = re.compile(
+    r"^\s*git ref mutations\s*:\s*(.+?)\s*$", re.I | re.M)
+_GIT_WORKTREE_MUTATIONS_NONE_RE = re.compile(
+    r"^\s*git/worktree mutations\s*:\s*none\b", re.I | re.M)
+
+_GIT_REF_MUTATING_FIRST_WORDS = frozenset(
+    {"fetch", "pull", "push", "merge", "update-ref"})
+_GIT_REF_MUTATING_PREFIXES = ("remote update", "branch -d", "branch -D",
+                              "reset --hard")
+
+
+def _command_text(entry):
+    if isinstance(entry, dict):
+        return str(entry.get("command") or "").strip()
+    return str(entry or "").strip()
+
+
+def _git_subcommand_line(command):
+    tokens = command.split()
+    if not tokens or tokens[0] != "git":
+        return None
+    return " ".join(tokens[1:])
+
+
+def git_ref_mutating_commands(command_log):
+    """Return logged commands that update git refs (#297).
+
+    ``git fetch`` and friends edit no files but move refs; they are never
+    read-only diagnostics.
+    """
+    out = []
+    for entry in command_log or []:
+        command = _command_text(entry)
+        rest = _git_subcommand_line(command)
+        if rest is None:
+            continue
+        first = rest.split()[0] if rest.split() else ""
+        if first in _GIT_REF_MUTATING_FIRST_WORDS:
+            out.append(command)
+            continue
+        if any(rest.startswith(prefix) for prefix in _GIT_REF_MUTATING_PREFIXES):
+            out.append(command)
+    return out
+
+
+def _fetch_targets(ref_commands):
+    """Extract ``<remote>/<branch>`` targets from git fetch commands."""
+    targets = []
+    for command in ref_commands:
+        rest = _git_subcommand_line(command) or ""
+        tokens = rest.split()
+        if not tokens or tokens[0] != "fetch":
+            continue
+        args = [t for t in tokens[1:] if not t.startswith("-")]
+        if len(args) >= 2:
+            targets.append(f"{args[0]}/{args[1]}")
+    return targets
+
+
+def assess_git_ref_mutation_report(report_text, *, command_log=None):
+    """#297: ref updates are Git ref mutations, not read-only diagnostics.
+
+    When the command log holds ref-updating commands, the report must carry
+    a non-none ``Git ref mutations`` entry (naming ``fetched
+    <remote>/<branch>`` for targeted fetches), may not claim ``Git/worktree
+    mutations: None``, and may not list the command as read-only.
+    """
+    text = report_text or ""
+    lower = text.lower()
+    reasons = []
+    ref_commands = git_ref_mutating_commands(command_log)
+    fetch_targets = _fetch_targets(ref_commands)
+
+    if ref_commands:
+        field = _GIT_REF_MUTATIONS_FIELD_RE.search(text)
+        value = field.group(1).strip().lower() if field else None
+        if not value or value == "none":
+            reasons.append(
+                "ref-updating commands ran but the report has no "
+                "'Git ref mutations' entry"
+            )
+        for target in fetch_targets:
+            if "fetched" not in lower or target.lower() not in lower:
+                reasons.append(
+                    "git fetch ran; report must state "
+                    f"'Git ref mutations: fetched {target}'"
+                )
+        if _GIT_WORKTREE_MUTATIONS_NONE_RE.search(text):
+            reasons.append(
+                "'Git/worktree mutations: None' rejected: ref-updating "
+                "commands ran"
+            )
+        for line in text.splitlines():
+            if "read-only" not in line.lower():
+                continue
+            for command in ref_commands:
+                if command.lower() in line.lower():
+                    reasons.append(
+                        "read-only diagnostics may not include ref-updating "
+                        f"command '{command}'"
+                    )
+
+    proven = not reasons
+    return {
+        "proven": proven,
+        "block": not proven,
+        "reasons": reasons,
+        "ref_mutating_commands": ref_commands,
+        "fetch_targets": fetch_targets,
+    }