diff --git a/CHANGELOG.md b/CHANGELOG.md index 29b0a95..84addaa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,4 +2,19 @@ Since releasing `v1.0.0`, we've significantly improved the app with stats tracking that shows total pushes and per-repo counts including skipped bot pushes at the `/stats` endpoint, added an improved documentation page with the stats URL, new logo icon, and screenshot example, and created a ping workflow that runs every 5 minutes to keep the Render service from suspending on the free tier. We also fixed a critical security issue by removing an exposed private key from git history using `git filter-repo`, properly set up the `test-repo` as a GitHub submodule with `.gitmodules` configuration, added type annotations to tests for better code quality, and updated the stats to track both user pushes and bot pushes separately. The app has gone through three releases: `v1.0.0` was the initial release, `v1.1.0` added stats tracking, and `v1.2.0` improved stats to include bot push tracking. -Added `REDIS_URL` environment variable support in `v1.3.0` to persist stats across service restarts using Render Key Value, updated the app to serve `docs/index.html` directly at the root `/` endpoint with endpoints `/images/logo.png` and `/app-screenshot.png` to serve images, and simplified the install button text to be more concise. \ No newline at end of file +Added `REDIS_URL` environment variable support in `v1.3.0` to persist stats across service restarts using Render Key Value, updated the app to serve `docs/index.html` directly at the root `/` endpoint with endpoints `/images/logo.png` and `/app-screenshot.png` to serve images, and simplified the install button text to be more concise. + +## Unreleased (2026-04-10) + +- Reduce PR branch history rewriting by only rewriting commit messages when a change is needed, and only for commits unique to the pushed branch (relative to the repository default branch). +- Skip rewriting the repository default branch entirely. +- Push rewritten history using `--force-with-lease` instead of `--force`. +- Update docs and webpage copy to reflect the safer behavior. +- Untrack accidentally committed `__pycache__/*.pyc` files. + +## v1.4.0 (2026-04-09) + +- Only rewrite new commits (relative to the repository default branch). +- Fix tests/mocks around the commit-rewrite behavior. +- Stop tracking Python `__pycache__/*.pyc` artifacts. +- Update changelog for the release. diff --git a/README.md b/README.md index 84c89be..73dc9a7 100644 --- a/README.md +++ b/README.md @@ -6,9 +6,7 @@ To set up the app, start by creating a new GitHub App in your GitHub Settings un Next, install the app on your desired repository or organization. Then, set the required environment variables: `GITHUB_APP_ID` with your app's ID, `GITHUB_PRIVATE_KEY` with the content of the private key file (paste the entire PEM content), and `GITHUB_WEBHOOK_SECRET` with the webhook secret you generated. Run the app locally with `python github_app.py` for testing, or deploy it to a production server like Render, Heroku, or AWS, updating the webhook URL accordingly to ensure it's publicly accessible. -The app operates by receiving push webhooks from GitHub. When a push is made to a repository where the app is installed, GitHub sends a webhook payload to your deployed app endpoint. The app then generates an installation access token using the installation ID from the webhook, clones the repository using that token for authentication, checks out the affected branch, and executes `git filter-branch` to modify commit messages by removing " add ", " Add ", leading "add ", or leading "Add " phrases. Finally, it force pushes the rewritten history back to the branch, skipping actions if the push originated from a bot to prevent infinite loops. - -Be warned that this app rewrites git history, which is a destructive operation that can overwrite remote commits and affect collaborators. Always back up your repository before using it, and communicate with your team to avoid conflicts. +The app operates by receiving push webhooks from GitHub. When a push is made to a repository where the app is installed, GitHub sends a webhook payload to your deployed app endpoint. The app then generates an installation access token using the installation ID from the webhook, clones the repository using that token for authentication, checks out the affected branch, and identifies commits unique to it (relative to the default branch). It then modifies commit messages in these unique commits by removing " add ", " Add ", leading "add ", or leading "Add " phrases. Finally, it pushes the rewritten history back to the branch using `--force-with-lease`, skipping the repository's default branch and actions if the push originated from a bot to prevent infinite loops. The app requires Python 3.8 or later, along with the Flask, PyGitHub, and github-webhook libraries. Install these dependencies using `pip install -r requirements.txt`. @@ -28,4 +26,4 @@ To deploy on Render.com: - `GITHUB_PRIVATE_KEY`: The full content of your private key (PEM format) - `GITHUB_WEBHOOK_SECRET`: Your webhook secret 6. Deploy and note the service URL (e.g., `https://your-app.onrender.com`). -7. Update your GitHub App's webhook URL to `https://your-app.onrender.com/webhook`. \ No newline at end of file +7. Update your GitHub App's webhook URL to `https://your-app.onrender.com/webhook`. diff --git a/__pycache__/github_app.cpython-314.pyc b/__pycache__/github_app.cpython-314.pyc deleted file mode 100644 index 15a9a10..0000000 Binary files a/__pycache__/github_app.cpython-314.pyc and /dev/null differ diff --git a/docs/index.html b/docs/index.html index 172cdcb..07507b8 100644 --- a/docs/index.html +++ b/docs/index.html @@ -172,7 +172,7 @@

Fix

Auto-cleanup for commit messages

- Automatically removes "add" prefixes from commit messages when you push. Keep your git history clean without the manual work. + Automatically removes "add" prefixes from commit messages when you push. Only rewrites commit messages when a change is needed, and targets commits unique to your branch (relative to the repo default branch).

@@ -184,18 +184,19 @@

How it works

- ⚠️ Rewrites git history. Use with caution on shared branches. + ⚠️ May rewrite branch history to fix commit messages. Avoid installing on shared branches and be cautious if others are collaborating on the same branch.
-
+
View stats →
- \ No newline at end of file + diff --git a/github_app.py b/github_app.py index 07d45f2..3ae9702 100644 --- a/github_app.py +++ b/github_app.py @@ -89,15 +89,16 @@ def increment_stats(repo_name: str, *, skipped: bool = False) -> None: def run_command( - cmd: str, + cmd: Union[str, list[str]], cwd: Optional[str] = None, env: Optional[dict] = None, ) -> tuple[int, str, str]: - """Run a shell command.""" + """Run a command and capture output.""" try: + use_shell = isinstance(cmd, str) result = subprocess.run( cmd, - shell=True, + shell=use_shell, # noqa: S603 capture_output=True, text=True, cwd=cwd, @@ -119,12 +120,137 @@ def get_installation_token(installation_id: int) -> Optional[str]: return None -def fix_commit_messages(repo_url: str, token: str, branch: str) -> bool: +def normalize_commit_message(message: str) -> str: + cleaned = message.replace(" add ", " ").replace(" Add ", " ") + return re.sub(r"(?m)^(add|Add) ", "", cleaned) + + +def git(repo_path: str, args: list[str]) -> tuple[int, str, str]: + return run_command(["git", *args], cwd=repo_path) + + +def get_merge_base( + repo_path: str, + *, + branch: str, + default_branch: str, + repo_url: str, +) -> Optional[str]: + ret, _, err = git(repo_path, ["fetch", "origin", default_branch]) + if ret != 0: + logger.warning(f"Failed to fetch origin/{default_branch} for {repo_url}: {err}") + return None + + ret, base_sha, err = git( + repo_path, + ["merge-base", "HEAD", f"origin/{default_branch}"], + ) + if ret != 0 or not base_sha: + logger.warning( + f"Failed to find merge-base for {repo_url} ({branch} vs {default_branch}): {err}", + ) + return None + return base_sha + + +def list_commits( + repo_path: str, + *, + base_sha: str, + branch: str, + repo_url: str, +) -> Optional[list[str]]: + ret, commit_list, err = git( + repo_path, + ["rev-list", "--reverse", f"{base_sha}..HEAD"], + ) + if ret != 0: + logger.warning(f"Failed to list commits for {repo_url} on {branch}: {err}") + return None + + return [c for c in commit_list.splitlines() if c.strip()] + + +def commits_need_rewrite( + repo_path: str, + commits: list[str], + repo_url: str, +) -> Optional[bool]: + for sha in commits: + ret, msg, err = git(repo_path, ["log", "-1", "--format=%B", sha]) + if ret != 0: + logger.warning(f"Failed to read commit message {sha} for {repo_url}: {err}") + return None + if normalize_commit_message(msg) != msg: + return True + return False + + +def write_msg_filter_script(repo_path: str) -> Path: + filter_script_path = Path(repo_path) / ".git" / "msg_filter.sh" + filter_script_path.parent.mkdir(parents=True, exist_ok=True) + filter_script_path.write_text( + """#!/usr/bin/env bash +set -euo pipefail +python3 - <<'PY' +import re +import sys + +msg = sys.stdin.read() +msg = msg.replace(" add ", " ").replace(" Add ", " ") +msg = re.sub(r"(?m)^(add|Add) ", "", msg) +sys.stdout.write(msg) +PY +""", + ) + filter_script_path.chmod(0o700) + return filter_script_path + + +def rewrite_and_push( + repo_path: str, + *, + base_sha: str, + branch: str, + repo_url: str, +) -> bool: + filter_script_path = write_msg_filter_script(repo_path) + + ret, _, err = git( + repo_path, + [ + "filter-branch", + "-f", + "--msg-filter", + str(filter_script_path), + "--", + f"{base_sha}..{branch}", + ], + ) + if ret != 0: + logger.warning(f"git filter-branch failed for {repo_url} on {branch}: {err}") + return False + + ret, _, err = git(repo_path, ["push", "--force-with-lease", "origin", branch]) + if ret != 0: + logger.error(f"Failed to push changes to {repo_url} on {branch}: {err}") + return False + + return True + + +def fix_commit_messages( + repo_url: str, + token: str, + branch: str, + *, + default_branch: str, +) -> bool: """Clone repo, fix commit messages, and push back.""" with tempfile.TemporaryDirectory() as temp_dir: # Clone the repo using token clone_url = repo_url.replace("https://", f"https://x-access-token:{token}@") - ret, _, err = run_command(f"git clone {clone_url} repo", cwd=temp_dir) + ret, _, err = run_command(["git", "clone", clone_url, "repo"], cwd=temp_dir) if ret != 0: logger.error(f"Failed to clone repo {repo_url}: {err}") return False @@ -132,35 +258,52 @@ def fix_commit_messages(repo_url: str, token: str, branch: str) -> bool: repo_path = os.path.join(temp_dir, "repo") # Checkout the branch - ret, _, err = run_command(f"git checkout {branch}", cwd=repo_path) + ret, _, err = git(repo_path, ["checkout", branch]) if ret != 0: logger.error(f"Failed to checkout branch {branch} in {repo_url}: {err}") return False - # Run git filter-branch - filter_cmd = """ -commit_msg=$(cat); -commit_msg=$(echo "$commit_msg" | sed "s/ add / /g"); -commit_msg=$(echo "$commit_msg" | sed "s/ Add / /g"); -commit_msg=$(echo "$commit_msg" | sed "s/^add //"); -commit_msg=$(echo "$commit_msg" | sed "s/^Add //"); -echo "$commit_msg" -""" - cmd = f"git filter-branch -f --msg-filter '{filter_cmd}' {branch}" - ret, _, err = run_command(cmd, cwd=repo_path) - if ret != 0: - logger.warning( - f"git filter-branch failed for {repo_url} on {branch}: {err}", + if branch == default_branch: + logger.info( + f"Skipping commit-message rewriting on default branch {default_branch}", ) + return True + + base_sha = get_merge_base( + repo_path, + branch=branch, + default_branch=default_branch, + repo_url=repo_url, + ) + if not base_sha: return False - # Push force - ret, _, err = run_command(f"git push --force origin {branch}", cwd=repo_path) - if ret != 0: - logger.error(f"Failed to push changes to {repo_url} on {branch}: {err}") + commits = list_commits( + repo_path, + base_sha=base_sha, + branch=branch, + repo_url=repo_url, + ) + if commits is None: + return False + + if not commits: + return True + + needs_rewrite = commits_need_rewrite(repo_path, commits, repo_url) + if needs_rewrite is None: return False - return True + if not needs_rewrite: + logger.info(f"No commit messages to rewrite for {repo_url} on {branch}") + return True + + return rewrite_and_push( + repo_path, + base_sha=base_sha, + branch=branch, + repo_url=repo_url, + ) @app.route("/webhook", methods=["POST"]) @@ -184,6 +327,7 @@ def handle_push() -> tuple[Any, int]: repo = data.get("repository", {}) repo_url = repo.get("clone_url") + default_branch = repo.get("default_branch", "main") branch = data.get("ref", "").replace("refs/heads/", "") installation_id = data.get("installation", {}).get("id") @@ -212,7 +356,12 @@ def handle_push() -> tuple[Any, int]: increment_stats(repo_name) # Fix commit messages - success = fix_commit_messages(repo_url, token, branch) + success = fix_commit_messages( + repo_url, + token, + branch, + default_branch=default_branch, + ) if success: if repo_name: increment_stats(repo_name) diff --git a/tests/__pycache__/__init__.cpython-314.pyc b/tests/__pycache__/__init__.cpython-314.pyc deleted file mode 100644 index 1a781bf..0000000 Binary files a/tests/__pycache__/__init__.cpython-314.pyc and /dev/null differ diff --git a/tests/__pycache__/test_github_app.cpython-314-pytest-7.4.0.pyc b/tests/__pycache__/test_github_app.cpython-314-pytest-7.4.0.pyc deleted file mode 100644 index 8db33b3..0000000 Binary files a/tests/__pycache__/test_github_app.cpython-314-pytest-7.4.0.pyc and /dev/null differ diff --git a/tests/test_github_app.py b/tests/test_github_app.py index b7350b1..15190ff 100644 --- a/tests/test_github_app.py +++ b/tests/test_github_app.py @@ -63,16 +63,21 @@ def test_fix_commit_messages_success(self, mock_run: MagicMock) -> None: mock_run.side_effect = [ (0, "", ""), # clone (0, "", ""), # checkout + (0, "", ""), # fetch default branch + (0, "base_sha", ""), # merge-base + (0, "c1\n", ""), # rev-list + (0, "Add foo", ""), # log message (needs rewrite) (0, "", ""), # filter-branch (0, "", ""), # push ] success = fix_commit_messages( "https://github.com/user/repo.git", "token", - "main", + "feature", + default_branch="main", ) assert success is True - assert mock_run.call_count == 4 + assert mock_run.call_count == 8 @patch("github_app.run_command") def test_fix_commit_messages_clone_failure(self, mock_run: MagicMock) -> None: @@ -80,7 +85,8 @@ def test_fix_commit_messages_clone_failure(self, mock_run: MagicMock) -> None: success = fix_commit_messages( "https://github.com/user/repo.git", "token", - "main", + "feature", + default_branch="main", ) assert success is False @@ -89,13 +95,18 @@ def test_fix_commit_messages_push_failure(self, mock_run: MagicMock) -> None: mock_run.side_effect = [ (0, "", ""), # clone (0, "", ""), # checkout + (0, "", ""), # fetch default branch + (0, "base_sha", ""), # merge-base + (0, "c1\n", ""), # rev-list + (0, "Add foo", ""), # log message (needs rewrite) (0, "", ""), # filter-branch (1, "", "push failed"), # push ] success = fix_commit_messages( "https://github.com/user/repo.git", "token", - "main", + "feature", + default_branch="main", ) assert success is False @@ -105,7 +116,10 @@ def test_handle_push_bot_skip(self) -> None: with app.test_client() as client: data: dict[str, Any] = { "sender": {"type": "Bot"}, - "repository": {"clone_url": "https://github.com/user/repo.git"}, + "repository": { + "clone_url": "https://github.com/user/repo.git", + "default_branch": "main", + }, "ref": "refs/heads/main", "installation": {"id": 123}, } @@ -125,7 +139,10 @@ def test_handle_push_success( with app.test_client() as client: data = { "sender": {"type": "User"}, - "repository": {"clone_url": "https://github.com/user/repo.git"}, + "repository": { + "clone_url": "https://github.com/user/repo.git", + "default_branch": "main", + }, "ref": "refs/heads/main", "installation": {"id": 123}, } @@ -146,7 +163,10 @@ def test_handle_push_token_failure(self, mock_token: MagicMock) -> None: with app.test_client() as client: data = { "sender": {"type": "User"}, - "repository": {"clone_url": "https://github.com/user/repo.git"}, + "repository": { + "clone_url": "https://github.com/user/repo.git", + "default_branch": "main", + }, "ref": "refs/heads/main", "installation": {"id": 123}, } @@ -166,7 +186,10 @@ def test_handle_push_fix_failure( with app.test_client() as client: data = { "sender": {"type": "User"}, - "repository": {"clone_url": "https://github.com/user/repo.git"}, + "repository": { + "clone_url": "https://github.com/user/repo.git", + "default_branch": "main", + }, "ref": "refs/heads/main", "installation": {"id": 123}, }