Merge branch 'main' into fix/flaky-submit-msg.e2e

Author: manishdait

.github/scripts/bot-assignment-check.sh

@@ -1,6 +1,13 @@
 #!/bin/bash
 set -Eeuo pipefail
 
+# Configuration for labels (overridable from workflow env)
+MENTOR_LABEL="${MENTOR_LABEL:-notes: mentor-duty}"
+if [ -z "${MENTOR_LABEL}" ]; then
+  echo "Error: Missing required environment variable (MENTOR_LABEL)." >&2
+  exit 1
+fi
+
 # Validate required env vars
 if [ -z "${ASSIGNEE:-}" ] || [ -z "${ISSUE_NUMBER:-}" ] || [ -z "${REPO:-}" ]; then
   echo "Error: Missing required environment variables (ASSIGNEE, ISSUE_NUMBER, REPO)."
@@ -36,20 +43,20 @@ issue_has_gfi() {
 }
 
 # Count open assignments for a user
-# For triage users (mentors), excludes issues with 'mentor-duty' label
+# For triage users (mentors), excludes issues with '${MENTOR_LABEL}' label
 # This allows mentors to be assigned to mentorship issues without consuming their assignment limit
 assignments_count() {
   local permission="${1:-none}"
 
   if [[ "$permission" == "triage" ]]; then
-    echo "Triage user detected — excluding mentor-duty issues from count." >&2
-    # For triage users, exclude issues with 'mentor-duty' label
+    echo "Triage user detected — excluding ${MENTOR_LABEL} issues from count." >&2
+    # For triage users, exclude issues with the configured mentor label
      gh api "repos/${REPO}/issues?per_page=100&page=1" \
        -f assignee="${ASSIGNEE}" \
        -f state=open \
-       --jq '.[]
+       --jq --arg mentor_label "$MENTOR_LABEL" '.[]
             | select(.pull_request == null)
-            | select(any(.labels[]; .name == "mentor-duty") | not)
+            | select(any(.labels[]; .name == $mentor_label) | not)
             | .number' | grep -c . || echo 0
   else
     # For non-triage users, count all open assignments

.github/scripts/bot-p0-issues-notify-team.js

@@ -1,31 +1,37 @@
 // Script to notify the team when a P0 issue is created.
 
+const CRITICAL_LABEL = 'priority: critical';
 const marker = '<!-- P0 Issue Notification -->';
 
-  async function notifyTeam(github, owner, repo, issue, marker) {
-    const comment = `${marker} :rotating_light: Attention Team :rotating_light:
+async function notifyTeam(github, owner, repo, issue, marker) {
+  const safeTitle = String(issue.title || '(no title)')
+    .replace(/[\r\n]+/g, ' ')
+    .replace(/@/g, '@\u200b')
+    .trim();
+
+  const comment = `${marker} :rotating_light: Attention Team :rotating_light:
 @hiero-ledger/hiero-sdk-python-maintainers @hiero-ledger/hiero-sdk-python-committers @hiero-ledger/hiero-sdk-python-triage
 
-A new P0 issue has been created: #${issue.number} - ${issue.title || '(no title)'}
+A new critical priority issue has been created: #${issue.number} - ${safeTitle}
 Please prioritize this issue accordingly.
 
 Best Regards,
 Automated Notification System`;
 
-    try {
-      await github.rest.issues.createComment({
-        owner,
-        repo,
-        issue_number: issue.number,
-        body: comment,
-      });
-      console.log(`Notified team about P0 issue #${issue.number}`);
-      return true;
-    } catch (commentErr) {
-      console.log(`Failed to notify team about P0 issue #${issue.number}:`, commentErr.message || commentErr);
-      return false;
-    }
+  try {
+    await github.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number: issue.number,
+      body: comment,
+    });
+    console.log(`Notified team about ${CRITICAL_LABEL} issue #${issue.number}`);
+    return true;
+  } catch (commentErr) {
+    console.log(`Failed to notify team about ${CRITICAL_LABEL} issue #${issue.number}:`, commentErr.message || commentErr);
+    return false;
   }
+}
 
 module.exports = async ({ github, context }) => {
   try {
@@ -34,8 +40,8 @@ module.exports = async ({ github, context }) => {
 
     // Validations
     if (!issue?.number) return console.log('No issue in payload');
-    if (label?.name?.toLowerCase() !== 'p0') return;
-    if (!issue.labels?.some(l => l?.name?.toLowerCase() === 'p0')) return;
+    if (label?.name?.toLowerCase() !== CRITICAL_LABEL.toLowerCase()) return;
+    if (!issue.labels?.some((l) => l?.name?.toLowerCase() === CRITICAL_LABEL.toLowerCase())) return;
 
     // Check for existing comment
     const comments = await github.paginate(github.rest.issues.listComments, {
@@ -44,7 +50,7 @@ module.exports = async ({ github, context }) => {
     if (comments.some(c => c.body?.includes(marker))) {
       return console.log(`Notification already exists for #${issue.number}`);
     }
-  // Post notification
+    // Post notification
     await notifyTeam(github, owner, repo, issue, marker);
 
     console.log('=== Summary ===');

.github/scripts/coderabbit_plan_trigger.js

@@ -2,14 +2,9 @@
 
 const CODERABBIT_MARKER = '<!-- CodeRabbit Plan Trigger -->';
 
-async function triggerCodeRabbitPlan(github, owner, repo, issue, marker = CODERABBIT_MARKER, isDryRun = false) {
+async function triggerCodeRabbitPlan(github, owner, repo, issue, marker = CODERABBIT_MARKER) {
   const comment = `${marker} @coderabbitai plan`;
 
-  if (isDryRun) {
-    console.log(`[DRY RUN] Would trigger CodeRabbit plan for issue #${issue.number}`);
-    return true;
-  }
-
   try {
     await github.rest.issues.createComment({
       owner,
@@ -105,11 +100,8 @@ async function main({ github, context }) {
       return console.log(`CodeRabbit plan already triggered for #${issue.number}`);
     }
 
-    // Check for dry run (default to true if not specified, for safety)
-    const isDryRun = (process.env.DRY_RUN || 'true').toLowerCase() === 'true';
-
     // Post CodeRabbit plan trigger
-    await triggerCodeRabbitPlan(github, owner, repo, issue, CODERABBIT_MARKER, isDryRun);
+    await triggerCodeRabbitPlan(github, owner, repo, issue, CODERABBIT_MARKER);
 
     logSummary(owner, repo, issue);
   } catch (err) {

.github/scripts/cron-admin-update-spam-list.js

@@ -8,10 +8,19 @@
  */
 
 const fs = require('fs').promises;
+const { LABEL_AUTOMATED } = require('./labels.js');
 
 const SPAM_LIST_PATH = '.github/spam-list.txt';
 const dryRun = (process.env.DRY_RUN || 'false').toString().toLowerCase() === 'true';
 
+/**
+ * These constants control the GitHub label names used by the spam automation.
+ * To rename labels, update only the constant values here.
+ * Ensure corresponding labels exist in the GitHub repository settings.
+ */
+const LABEL_SPAM = 'notes: spam';
+const LABEL_SPAM_LIST_UPDATE = 'notes: spam-list-update';
+
 // Load current spam list and compute updates based on spam vs rehabilitated users
 
 async function computeSpamListUpdates(spamUsers, rehabilitatedUsers) {
@@ -121,7 +130,7 @@ module.exports = async ({github, context, core}) => {
     const searches = [
       {
         name: 'spam PRs',
-        query: `repo:${owner}/${repo} is:pr is:closed -is:merged label:spam`,
+        query: `repo:${owner}/${repo} is:pr is:closed -is:merged label:"${LABEL_SPAM}"`,
         process: async (pr) => {
           if (!pr.user?.login) {
             console.log(`Skipping PR #${pr.number}: user account unavailable`);
@@ -208,7 +217,7 @@ module.exports = async ({github, context, core}) => {
         const { data: existing } = await github.rest.issues.listForRepo({
           owner,
           repo,
-          labels: 'spam-list-update',
+          labels: LABEL_SPAM_LIST_UPDATE,
           state: 'open',
           per_page: 1
         });
@@ -221,7 +230,7 @@ module.exports = async ({github, context, core}) => {
           repo,
           title,
           body,
-          labels: ['spam-list-update', 'automated']
+          labels: [LABEL_SPAM_LIST_UPDATE, LABEL_AUTOMATED]
         });
         console.log('Issue created successfully');
       }

.github/scripts/labels.js

@@ -0,0 +1,11 @@
+/**
+ * Central location for label definitions to facilitate future changes.
+ * This file serves as the single source of truth for all GitHub label names used by automated workflows.
+ */
+const LABEL_BROKEN_MARKDOWN_LINKS = 'notes: broken markdown links';
+const LABEL_AUTOMATED = 'notes: automated';
+
+module.exports = {
+  LABEL_BROKEN_MARKDOWN_LINKS,
+  LABEL_AUTOMATED
+};

.github/scripts/pr-check-test-files.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+const { execSync } = require("child_process");
+const fs = require("fs");
+
+// These are the directories we want to check for correct naming
+const TEST_DIRS = ["tests/unit", "tests/integration", "tests/tck", "tests/fuzz"];
+
+// These are the excluded paths and file names inside the TEST_DIRS
+const IGNORED = ["tests/fuzz/support"];
+const EXCEPTIONS = ["conftest.py", "__init__.py", "init.py", "mock_server.py", "utils.py"];
+
+// Collect naming errors to report at the end
+const nameErrors = [];
+
+// Use "git ls-files" to get all tracked files in the repository
+const output = execSync("git ls-files", { encoding: "utf-8" });
+// Split output into lines and filter out empty lines for easy manipulation
+// e.g. output = "tests/unit/my_test.py\ntests/integration/other_test.py"
+const files = output.split("\n").filter(Boolean);
+
+for (const file of files) {
+  // --- PATH FILTERING ---
+  // Skip files that are not in any of the specified test directories
+  if (!TEST_DIRS.some(dir => file.startsWith(dir))) continue;
+
+  // Skip ignored paths (e.g. helpers)
+  if (IGNORED.some(path => file.startsWith(path))) continue;
+
+  // Now we have file paths that we need to check for correct naming
+  // e.g. file = "tests/unit/my_test.py"
+
+  // --- Correct PATH now apply NAMING checks ---
+
+  // Extract the file name from the path
+  // e.g. from file = "tests/unit/my_test.py" get name = "my_test.py"
+  const name = file.split("/").pop();
+
+  // Skip allowed special files
+  if (EXCEPTIONS.includes(name)) continue;
+
+  // Enforce naming rule on files
+  if (!name.endsWith("_test.py")) {
+    console.error(`Invalid test file name: ${file}`);
+    console.error(`::error file=${file}::Must end with '_test.py'`);
+    nameErrors.push(file);
+  }
+}
+
+// Generate a summary of the results for the GitHub Actions UI
+const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+
+if (summaryPath) {
+  let summary = `## 🧪 Test File Naming Check\n\n`;
+
+  if (nameErrors.length === 0) {
+    summary += `✅ All test files are correctly named\n`;
+  } else {
+    // Counts and lists all the incorrectly named test files
+    summary += `❌ Found ${nameErrors.length} incorrectly named test files:\n\n`;
+    nameErrors.forEach(f => {
+      summary += `- \`${f}\`\n`;
+    });
+  }
+
+  fs.appendFileSync(summaryPath, summary);
+}
+
+// Fail job if needed
+if (nameErrors.length > 0) {
+  process.exit(1);
+}

.github/scripts/pr-check-test-files.sh

@@ -28,7 +28,7 @@ jobs:
     runs-on: hl-sdk-py-lin-md
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/bot-advanced-check.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: hl-sdk-py-lin-md
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 
@@ -25,6 +25,7 @@ jobs:
           ASSIGNEE: ${{ github.event.assignee.login }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           REPO: ${{ github.repository }}
+          MENTOR_LABEL: "notes: mentor-duty"
         run: |
           # Make script executable (just in case permissions were lost during checkout)
           chmod +x .github/scripts/bot-assignment-check.sh