check 1459

.github/workflows/codecov.yml

@@ -22,5 +22,6 @@ jobs:
       - run: mvn install -Pjacoco
       - uses: codecov/codecov-action@v4
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           file: ./target/site/jacoco/jacoco.xml
           fail_ci_if_error: true

src/main/java/com/rultor/agents/github/qtn/CheckablePull.java

@@ -0,0 +1,96 @@
+/**
+ * Copyright (c) 2009-2024 Yegor Bugayenko
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met: 1) Redistributions of source code must retain the above
+ * copyright notice, this list of conditions and the following
+ * disclaimer. 2) Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following
+ * disclaimer in the documentation and/or other materials provided
+ * with the distribution. 3) Neither the name of the rultor.com nor
+ * the names of its contributors may be used to endorse or promote
+ * products derived from this software without specific prior written
+ * permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT
+ * NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+package com.rultor.agents.github.qtn;
+
+import com.jcabi.aspects.Immutable;
+import com.jcabi.github.Check;
+import com.jcabi.github.Pull;
+import java.io.IOException;
+import javax.json.JsonObject;
+import lombok.EqualsAndHashCode;
+import lombok.ToString;
+
+/**
+ * Checkable pull request.
+ *
+ * @author Natalia Pozhidaeva ([email protected])
+ * @version $Id$
+ * @since 2.0
+ */
+@Immutable
+@ToString
+@EqualsAndHashCode
+final class CheckablePull {
+    /**
+     * Pull request.
+     */
+    private final transient Pull pull;
+
+    /**
+     * Ctor.
+     * @param ghpull Pull to validate
+     */
+    public CheckablePull(final Pull ghpull) {
+        this.pull = ghpull;
+    }
+
+    /**
+     * Checks if all checks are successful.
+     * @return True if all checks are successful
+     * @throws IOException If fails
+     */
+    public boolean allChecksSuccessful() throws IOException {
+        boolean result = true;
+        for (final Check check : this.pull.checks().all()) {
+            if (!check.successful()) {
+                result = false;
+                break;
+            }
+        }
+        return result;
+    }
+
+    /**
+     * Checks if file is affected by pull request.
+     * @param file File name to check
+     * @return True if all checks are successful
+     * @throws IOException If fails
+     */
+    public boolean containsFile(final String file) throws IOException {
+        boolean result = false;
+        for (final JsonObject pullfile : this.pull.files()) {
+            if (pullfile.getString("filename").equalsIgnoreCase(file)) {
+                result = true;
+                break;
+            }
+        }
+        return result;
+    }
+}

src/main/java/com/rultor/agents/github/qtn/QnMerge.java

@@ -30,7 +30,6 @@
 package com.rultor.agents.github.qtn;
 
 import com.jcabi.aspects.Immutable;
-import com.jcabi.github.Check;
 import com.jcabi.github.Comment;
 import com.jcabi.github.Issue;
 import com.jcabi.github.Pull;
@@ -77,25 +76,39 @@ public Req understand(final Comment.Smart comment,
                 this, "merge request found in %s#%d, comment #%d",
                 issue.repo().coordinates(), issue.number(), comment.number()
             );
-            if (QnMerge.allChecksSuccessful(issue.pull())) {
+            final CheckablePull pull = new CheckablePull(issue.pull());
+            final String sysfile = ".rultor.yml";
+            if (pull.containsFile(sysfile)) {
                 new Answer(comment).post(
-                    true,
+                    false,
                     String.format(
-                        QnMerge.PHRASES.getString("QnMerge.start"),
-                        home.toASCIIString()
+                        QnMerge.PHRASES.getString(
+                            "QnMerge.system-files-affected"
+                        ),
+                        sysfile
                     )
                 );
-                req = QnMerge.pack(
-                    comment,
-                    issue.repo().pulls().get(issue.number())
-                );
-            } else {
-                new Answer(comment).post(
-                    false,
-                    QnMerge.PHRASES.getString("QnMerge.checks-are-failed")
-                );
                 req = Req.DONE;
-            }
+            } else
+                if (pull.allChecksSuccessful()) {
+                    new Answer(comment).post(
+                        true,
+                        String.format(
+                                QnMerge.PHRASES.getString("QnMerge.start"),
+                                home.toASCIIString()
+                        )
+                    );
+                    req = QnMerge.pack(
+                        comment,
+                        issue.repo().pulls().get(issue.number())
+                    );
+                } else {
+                    new Answer(comment).post(
+                        false,
+                        QnMerge.PHRASES.getString("QnMerge.checks-are-failed")
+                    );
+                    req = Req.DONE;
+                }
         } else {
             new Answer(comment).post(
                 false,
@@ -173,22 +186,4 @@ private static Req pack(final Comment.Smart comment,
         return req;
     }
 
-    /**
-     * Checks if all checks are successful.
-     * @param pull Pull
-     * @return True if all checks are successful
-     * @throws IOException If fails
-     */
-    private static boolean allChecksSuccessful(final Pull pull)
-        throws IOException {
-        boolean result = true;
-        for (final Check check : pull.checks().all()) {
-            if (!check.successful()) {
-                result = false;
-                break;
-            }
-        }
-        return result;
-    }
-
 }

src/main/resources/phrases_en_US.properties

@@ -36,6 +36,11 @@ QnMerge.checks-are-failed=Can't merge it. Some CI checks were failed. \
                           Apparently, the pull request is not ready to be \
                           merged since it has some problems. \
                           Please, fix them first.
+QnMerge.system-files-affected=Can't merge this pull requests, because the file \
+                              `%s` was modified. This is a security threat. \
+                              Make a separate pull request with the \
+                              modification of this particular file and ask \
+                              project architect to merge it manually.
 
 QnDeploy.start=OK, I'll try to deploy now. You can check the progress [here](%s)
 

src/test/java/com/rultor/agents/github/qtn/QnMergeTest.java

@@ -41,10 +41,15 @@
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.util.LinkedList;
+import java.util.List;
 import java.util.ResourceBundle;
+import javax.json.Json;
+import javax.json.JsonObject;
 import org.hamcrest.MatcherAssert;
 import org.hamcrest.Matchers;
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 import org.xembly.Directives;
 import org.xembly.Xembler;
@@ -186,6 +191,48 @@ public void continuesBecauseCiChecksSuccessful()
         );
     }
 
+    /**
+     * QnMerge can not build a request because .rultor file is changed.
+     * @todo #1459 Enable this test after com.jcabi.github.mock.MkPull
+     *  changed to allow to work with the files in Pull according to
+     *  https://github.com/jcabi/jcabi-github/issues/1720
+     * @throws IOException In case of I/O error
+     * @throws URISyntaxException In case of URI error
+     */
+    @Test
+    @Disabled
+    public void stopsBecauseSystemFilesAffected()
+            throws IOException, URISyntaxException {
+        final MkChecks checks = (MkChecks) this.pull.checks();
+        checks.create(Check.Status.COMPLETED, Check.Conclusion.SUCCESS);
+        final List<JsonObject> files = new LinkedList<>();
+        files.add(Json.createObjectBuilder()
+                .add("sha", "ef36558cbd")
+                .add("filename", "README.md")
+                .add("status", "modified")
+                .build()
+        );
+        files.add(Json.createObjectBuilder()
+                .add("sha", "ef3857cad")
+                .add("filename", ".rultor.yml")
+                .add("status", "modified")
+                .build()
+        );
+        this.mergeRequest();
+        MatcherAssert.assertThat(
+                new Comment.Smart(this.comments.get(1)).body(),
+                Matchers.is(QnMergeTest.COMMAND)
+        );
+        MatcherAssert.assertThat(
+                new Comment.Smart(this.comments.get(2)).body(),
+                Matchers.containsString(
+                    QnMergeTest.PHRASES.getString(
+                        "QnMerge.system-files-affected"
+                    )
+                )
+        );
+    }
+
     /**
      * Merge request directives.
      * @return Directives