Publish curated projectbrain source from 0244fbf232898e6dc076ff2159d96a6da55ab5b5

backend/test/gitea-integration.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from "vitest";
 import { loadEnv } from "../src/config/env.js";
 import { GiteaClient, GiteaApiError } from "../src/integrations/gitea/client.js";
-import { assertChatGptBranch, assertExpectedFileSha, assertFileSize, assertProjectBrainBranch, assertReadablePath, assertSuccessfulActionRuns, normalizeRepositoryPath } from "../src/integrations/gitea/policy.js";
+import { assertChatGptBranch, assertExpectedFileSha, assertFileSize, assertProjectBrainBranch, assertReadablePath, assertSuccessfulActionRuns, assertSuccessfulPullRequestFullActionRun, normalizeRepositoryPath } from "../src/integrations/gitea/policy.js";
 import type { GiteaActionRun } from "../src/integrations/gitea/types.js";
 import { exchangeAuthorizationCode, exchangeRefreshToken, issueAuthorizationCode, registerOAuthClient, verifyMcpAccessToken } from "../src/security/mcpOAuth.js";
 import { createHash, createHmac } from "node:crypto";
@@ -295,7 +295,7 @@ describe("Gitea API client", () => {
     await client.mergePullRequest("Acme", "Repo", 17, { method: "merge", headCommitId: "b".repeat(40) });
     await client.mergePullRequest("Acme", "Repo", 18, { method: "squash", headCommitId: "c".repeat(40) });
 
-    expect(fetcher.mock.calls.filter(([input]) => String(input).endsWith("/version"))).toHaveLength(1);
+    expect(fetcher.mock.calls.filter(([input]) => String(input).endsWith("/version"))).toHaveLength(2);
     const firstBody = JSON.parse(String(fetcher.mock.calls[1][1]?.body)) as Record<string, unknown>;
     expect(firstBody[strategyKey]).toBe("merge");
     expect(firstBody[strategyKey === "Do" ? "do" : "Do"]).toBeUndefined();
@@ -539,4 +539,27 @@ describe("ChatGPT feature delivery approval", () => {
     expect(() => assertSuccessfulActionRuns([run(1, "success"), run(2, "failure")], "chatgpt/feature", "current-sha")).toThrow("FEATURE_DELIVERY_FULL_VALIDATION_REQUIRED");
     expect(() => assertSuccessfulActionRuns([run(1, "success", "stale-sha")], "chatgpt/feature", "current-sha")).toThrow("FEATURE_DELIVERY_CI_NOT_SUCCESSFUL");
   });
+
+  it("requires a successful canonical pull-request full run on the exact head before merge", () => {
+    const headSha = "a".repeat(40);
+    const branch = "chatgpt/feature";
+    const run = (overrides: Partial<GiteaActionRun> = {}): GiteaActionRun => ({
+      id: 10,
+      run_number: 10,
+      display_title: "Managed validation / full",
+      path: ".gitea/workflows/managed-validation.yml",
+      event: "pull_request",
+      head_sha: headSha,
+      head_branch: branch,
+      status: "completed",
+      conclusion: "success",
+      html_url: "https://gitea.example.com/runs/10",
+      ...overrides,
+    });
+
+    expect(assertSuccessfulPullRequestFullActionRun([run()], branch, headSha)).toMatchObject({ event: "pull_request", head_sha: headSha, conclusion: "success" });
+    expect(() => assertSuccessfulPullRequestFullActionRun([run({ head_sha: "b".repeat(40) })], branch, headSha)).toThrow("FEATURE_DELIVERY_PULL_REQUEST_FULL_VALIDATION_REQUIRED");
+    expect(() => assertSuccessfulPullRequestFullActionRun([run({ event: "workflow_dispatch" })], branch, headSha)).toThrow("FEATURE_DELIVERY_PULL_REQUEST_FULL_VALIDATION_REQUIRED");
+    expect(() => assertSuccessfulPullRequestFullActionRun([run({ conclusion: "failure" })], branch, headSha)).toThrow("FEATURE_DELIVERY_PULL_REQUEST_FULL_VALIDATION_REQUIRED");
+  });
 });