fix(gitea): fail closed when webhook secret is unset

.github/dependabot.yml

@@ -0,0 +1,88 @@
+version: 2
+
+updates:
+  # Python. `uv` rather than `pip`: it resolves through the uv CLI and rewrites
+  # pyproject.toml alongside uv.lock, so the declared pins here — which carry
+  # policy, not just versions — do not drift away from the lock file.
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      python-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      python-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    commit-message:
+      prefix: chore(deps)
+
+  # GitHub Actions. Every `uses:` here is `@<sha>  # vX.Y.Z` on one line, which
+  # is the format Dependabot rewrites, comment included.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      actions-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - major
+    ignore:
+      # .github/workflows/pr-agent-review.yaml pins this action to a commit on
+      # `main`, not to a release. There is no version to bump to, and the
+      # documented behaviour for an untagged sha is to move it to whatever HEAD
+      # happens to be. Moving the self-review action is a deliberate act.
+      - dependency-name: Codium-ai/pr-agent
+    commit-message:
+      prefix: chore(ci)
+
+  # Base images. The docker file fetcher matches any file whose name contains
+  # "dockerfile", so `/` picks up Dockerfile.github_action_dockerhub and
+  # `/docker` picks up both Dockerfile and Dockerfile.lambda.
+  - package-ecosystem: docker
+    directories:
+      - /
+      - /docker
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    ignore:
+      # Dockerfile.github_action_dockerhub builds FROM this project's own
+      # published image, tracked by a stage tag rather than a version.
+      - dependency-name: pragent/pr-agent
+    commit-message:
+      prefix: chore(docker)
+
+  # Hook revisions in .pre-commit-config.yaml. The `local` repo has no upstream
+  # and is left alone by the ecosystem.
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore(pre-commit)

.github/release-drafter.yml

@@ -10,30 +10,64 @@ template: |
 
 categories:
   - title: '🚀 Features'
-    labels:
-      - feature
-      - enhancement
+    when:
+      labels:
+        - feature
+        - enhancement
   - title: '🐛 Bug Fixes'
-    labels:
-      - bug
-      - 'Bug fix'
-      - 'Bug fix with tests'
+    when:
+      labels:
+        - bug
+        - 'Bug fix'
+        - 'Bug fix with tests'
   - title: '⚡ Performance'
-    labels:
-      - performance
+    when:
+      labels:
+        - performance
   - title: '📚 Documentation'
-    labels:
-      - documentation
-      - 'Includes Documentation'
+    when:
+      labels:
+        - documentation
+        - 'Includes Documentation'
   - title: '🧹 Maintenance'
-    labels:
-      - chore
-      - Refactoring
-      - Configuration
-      - 'Configuration changes'
+    when:
+      labels:
+        - chore
+        - Refactoring
+        - Configuration
+        - 'Configuration changes'
   - title: '⬆️ Dependencies'
-    labels:
-      - dependencies
+    when:
+      labels:
+        - dependencies
+  - type: version-resolver
+    semver-increment: major
+    when:
+      labels:
+        - breaking
+  - type: version-resolver
+    semver-increment: minor
+    when:
+      labels:
+        - feature
+        - enhancement
+  - type: version-resolver
+    semver-increment: patch
+    when:
+      labels:
+        - bug
+        - 'Bug fix'
+        - 'Bug fix with tests'
+        - documentation
+        - 'Includes Documentation'
+        - chore
+        - Refactoring
+        - Configuration
+        - 'Configuration changes'
+        - performance
+        - dependencies
+  - type: version-resolver
+    semver-increment: patch
 
 change-template: '- $TITLE by @$AUTHOR in #$NUMBER'
 change-title-escapes: '\<*_&'
@@ -64,26 +98,3 @@ autolabeler:
   - label: breaking
     title:
       - '/^[a-z]+(\(.+\))?!:/i'
-
-version-resolver:
-  major:
-    labels:
-      - breaking
-  minor:
-    labels:
-      - feature
-      - enhancement
-  patch:
-    labels:
-      - bug
-      - 'Bug fix'
-      - 'Bug fix with tests'
-      - documentation
-      - 'Includes Documentation'
-      - chore
-      - Refactoring
-      - Configuration
-      - 'Configuration changes'
-      - performance
-      - dependencies
-  default: patch

.github/workflows/build-and-test.yaml

@@ -14,15 +14,24 @@ jobs:
 
     steps:
       - id: checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - id: uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+
+      - name: Check uv.lock
+        run: uv lock --check
+
+      - name: Test package artifacts
+        run: uv run pytest -q tests/packaging/test_help_docs_package.py
 
       - id: dockerx
         name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
       - id: build
         name: Build dev docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: ./docker/Dockerfile
@@ -47,15 +56,15 @@ jobs:
             exit 1
           fi
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe  # v5.5.4
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       # Unit tests override CMD, so a broken server launcher never fails CI.
       # Smoke-start github_app (gunicorn + uvicorn) with no secrets; GET / → 200.
       - id: build-smoke
         name: Build github_app docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: ./docker/Dockerfile
@@ -82,3 +91,39 @@ jobs:
           docker logs pr-agent-smoke
           docker rm -f pr-agent-smoke
           exit 1
+
+  # The job above runs entirely inside docker/Dockerfile, whose base moved to
+  # python:3.14.7-slim in #3294. That leaves neither interpreter pyproject
+  # actually claims support for exercised there: not the `requires-python`
+  # floor of 3.12, and not the 3.13 the google-cloud-storage pin applies at.
+  # Installing from PyPI on either was an untested combination. Deliberately
+  # separate from the docker build rather than a matrix over it: the shipped
+  # images track one interpreter on purpose, and matrixing would rebuild every
+  # layer and re-run the smoke test and coverage upload for no extra signal.
+  unit-tests-native:
+    name: Unit tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+
+    steps:
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      # Same uv release the Dockerfile pulls from ghcr.io/astral-sh/uv, via pipx
+      # so there is no additional action to pin. uv provisions the interpreter
+      # itself, so setup-python is not needed either.
+      - id: uv
+        name: Install uv
+        run: pipx install uv==0.12.10
+
+      - id: test
+        name: Test on Python ${{ matrix.python-version }}
+        env:
+          PYTHONPATH: .
+          # See docker/Dockerfile's base stage: pin litellm's bundled cost map so
+          # a remote change to it cannot redden the suite without a version bump.
+          LITELLM_LOCAL_MODEL_COST_MAP: "True"
+        run: uv run --frozen --python ${{ matrix.python-version }} pytest -v tests/unittest

.github/workflows/codeql.yml

@@ -31,14 +31,14 @@ jobs:
           - language: python
             build-mode: none
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: github/codeql-action/init@7fd177fa680c9881b53cdab4d346d32574c9f7f4  # v3.35.4
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           queries: security-extended,security-and-quality
 
-      - uses: github/codeql-action/analyze@7fd177fa680c9881b53cdab4d346d32574c9f7f4  # v3.35.4
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4.38.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/docs-ci.yaml

@@ -12,16 +12,16 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: 3.x
       - run: echo "cache_id=$(date --utc '+%V')" >> "$GITHUB_ENV"
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           key: mkdocs-material-${{ env.cache_id }}
           path: .cache

.github/workflows/e2e_tests.yaml

@@ -11,14 +11,14 @@ jobs:
     name: PR-Agent E2E GitHub App Test
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
       - id: build
         name: Build dev docker
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: ./docker/Dockerfile

.github/workflows/pre-commit.yml

@@ -1,17 +1,19 @@
-# disabled. We might run it manually if needed.
+# Runs every pre-commit hook (ruff, actionlint, YAML/TOML checks, ...) on
+# pull requests, so the hooks are enforced in CI rather than manual-only.
 name: pre-commit
 
 on:
   workflow_dispatch:
-#  pull_request:
+  pull_request:
 #  push:
 #    branches: [main]
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
       # SEE https://github.com/pre-commit/action
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1

.github/workflows/provider-smoke.yaml

@@ -0,0 +1,32 @@
+name: Provider smoke
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+
+jobs:
+  github-provider-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Smoke /describe on a real GitHub PR
+        env:
+          GITHUB.USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: PYTHONPATH=. uv run pytest tests/health_test/test_github_smoke.py -q