Skip to content

fix(claims): deliver notices without a full Registry crawl - #582

Merged
zerocodefast merged 4 commits into
mainfrom
fix/claim-notice-delivery-20261026
Oct 26, 2026
Merged

zerocodefast merged 4 commits into
mainfrom
fix/claim-notice-delivery-20261026

Conversation

@zerocodefast

@zerocodefast zerocodefast commented Oct 26, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • Fix claim notices that fail while walking the full Registry catalog. Use merged listing evidence and a bounded repository query for optional ownership checks.
  • Keep failed deliveries in the retry queue and clear the pending label after a notice succeeds. Verify merged PR metadata during manual retries and run notification regression tests in CI.
  • Keep claim comments in one paragraph, send verified owners a dashboard confirmation, and update old deferred notices in place.

Testing

  • Regression coverage for catalog pagination failures, ownership lookup outages, duplicate comments, trusted listing evidence, and deferred notice recovery.
  • python3 -m unittest tests/test_post_claim_notice.py tests/test_backfill_claim_notices.py passed all 33 tests in GitHub Actions.
  • Mirror coverage resolves a local alias through its trusted manifest and rejects paths outside the catalog.

@qodo-free-for-open-source-projects

Copy link
Copy Markdown

PR Summary by Qodo

Deliver claim notices from merged catalog listings without a Registry crawl

🐞 Bug fix 🧪 Tests ⚙️ Configuration changes 🕐 20-40 Minutes

Grey Divider

AI Description

• Use merged catalog listings to deliver claim links without waiting for Registry indexing.
Diagram

graph TD
  W["Notice workflow"] --> L["Pending label"] --> C["Existing comments"] --> S["Merged listings"] --> R["Registry query"] --> D{"Deliver notice?"} --> N["Claim comment"]
  D -->|"already delivered"| L
  N -->|"success: clear"| L
  D -->|"delivery fails: retain"| L
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Omit Registry ownership lookups
  • ➕ Eliminates Registry availability and pagination from notice delivery.
  • ➖ Sends redundant claim invitations to authors whose ownership is already verified.

Recommendation: Keep merged listings as the delivery authority and use bounded Registry lookups only to suppress redundant invitations. This preserves delivery during Registry failures without inviting every verified owner.

Files changed (4) +550 / -283

Bug fix (2) +304 / -180
claim-notice.ymlQueue notices before delivery and clear successful retries +17/-3

Queue notices before delivery and clear successful retries

• Makes manually supplied title and author optional because dispatches verify merged PR metadata. Adds the pending label before posting and removes it only after the notice step succeeds.

.github/workflows/claim-notice.yml

post-claim-notice.pyDeliver claims using merged listings and optional ownership evidence +287/-177

Deliver claims using merged listings and optional ownership evidence

• Replaces the full Registry crawl with exact matches against merged README listings and bounded, retried per-repository ownership queries that cannot block delivery when unavailable. Verifies merged PR metadata on manual dispatch, avoids duplicate comments, replaces deferred notices in place, and formats claim links as one paragraph.

scripts/post-claim-notice.py

Tests (2) +246 / -103
validate-contribution.ymlRun claim-notice regressions in contribution CI +6/-0

Run claim-notice regressions in contribution CI

• Triggers validation when notice-related scripts, tests, or workflow configuration change. Runs the claim-notice and backfill unit tests in the validation job.

.github/workflows/validate-contribution.yml

test_post_claim_notice.pyCover delivery, retry, and notice-evidence regressions +240/-103

Cover delivery, retry, and notice-evidence regressions

• Tests bounded ownership queries, rate-limit retries, Registry outages, trusted listing evidence, duplicate prevention, and deferred-comment replacement. Also covers merged metadata checks and single-paragraph claim links.

tests/test_post_claim_notice.py

@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Remediation recommended

1. Mirrored plugins lose claim notices ✓ Resolved
Description
main() intersects GitHub repositories extracted from the PR diff with identities derived from
README links, but catalog_source_repos() treats a local mirror path as if it were the upstream
repository. When a mirrored bundle contains its actual upstream GitHub URL, that URL can be found in
the diff while the README contributes a different identity, so delivery stops at the new listing
gate even if the upstream repository is in the Registry.
Code

scripts/post-claim-notice.py[475]

+        matched = pr_repos & catalog_source_repos()
Evidence
The README lists Changelog Forge at ./plugins/mturac/changelog-forge, while its bundled README
identifies https://github.com/mturac/pluginpool-changelog-forge as the repository to clone. The
diff parser extracts GitHub URLs, but the new source parser turns the local listing into
mturac/changelog-forge; the new intersection therefore cannot match those two identities.
Previously, a repository present in the live Registry could satisfy the notice gate without that
intersection.

README.md[178-178]
plugins/mturac/changelog-forge/README.md[21-21]
scripts/post-claim-notice.py[292-296]
scripts/post-claim-notice.py[345-355]
scripts/post-claim-notice.py[473-480]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The merged-listing intersection rejects mirrored plugins when their local README path differs from the upstream GitHub repository extracted from the PR diff.
## Fix Focus Areas
- scripts/post-claim-notice.py[345-355]
- scripts/post-claim-notice.py[473-480]
## Recommended Fix
Derive the upstream repository identity for local mirrored listings from trusted bundle metadata or an explicit mapping, rather than interpreting the mirror directory name as a GitHub repository. Add a regression test using a local listing and a differently named upstream repository.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Tip of the day
💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

Comment thread scripts/post-claim-notice.py

@kantorcodes kantorcodes left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checks green, review threads resolved, quiet window elapsed at b0d1f6e.

@internet-dot internet-dot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checks green, review threads resolved, quiet window elapsed at b0d1f6e.

@zerocodefast
zerocodefast merged commit 37ee7a3 into main Oct 26, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants