diff --git a/src/queue/processors.ts b/src/queue/processors.ts index 7a04a28365..09f535a6a9 100644 --- a/src/queue/processors.ts +++ b/src/queue/processors.ts @@ -817,6 +817,21 @@ async function maybePublishPrPublicSurface( ): Promise { const author = pr.authorLogin ?? null; const gateEnabled = settings.gateCheckMode === "enabled" && Boolean(advisory.headSha); + // Cheap, network-free skip checks (also avoids the miner lookup when it would be wasted). + const prelim = decidePublicSurface({ + settings, + authorLogin: author, + authorType: webhook.authorType ?? null, + authorAssociation: pr.authorAssociation ?? null, + minerStatus: "not_checked", + }); + if (prelim.skipped) { + await auditPrVisibilitySkip(env, repoFullName, pr.number, author, prelim.skipReason ?? "skipped", webhook.deliveryId); + return; + } + if (!gateEnabled && prelim.actions.length === 1 && prelim.actions[0] === "none") return; + if (!author) return; + if (gateEnabled && (pr.state !== "open" || webhook.action === "closed")) { const gateCheckResult = await createOrUpdateSkippedGateCheckRun(env, installationId, repoFullName, advisory, "PR closed before full evaluation."); if (gateCheckResult?.kind === "permission_missing") { @@ -832,6 +847,34 @@ async function maybePublishPrPublicSurface( ).catch(() => undefined); return; } + const prelimHasPublicOutput = prelim.actions.some((action) => action === "comment" || action === "label" || action === "check_run"); + let official: Awaited> | null = null; + let decision = prelim; + if (prelimHasPublicOutput) { + const requireOfficialMiner = settings.publicAudienceMode === "gittensor_only"; + official = await getCachedOfficialMinerDetection(env, author, { + targetKey: `${repoFullName}#${pr.number}`, + deliveryId: webhook.deliveryId, + }); + if (requireOfficialMiner && official.status === "unavailable") { + await auditPrVisibilitySkip(env, repoFullName, pr.number, author, "miner_detection_unavailable", webhook.deliveryId); + return; + } + if (requireOfficialMiner && official.status !== "confirmed") { + await auditPrVisibilitySkip(env, repoFullName, pr.number, author, "not_official_gittensor_miner", webhook.deliveryId); + return; + } + decision = decidePublicSurface({ + settings, + authorLogin: author, + authorType: webhook.authorType ?? null, + authorAssociation: pr.authorAssociation ?? null, + minerStatus: official.status, + }); + + if (!gateEnabled && decision.actions.length === 1 && decision.actions[0] === "none") return; + } + let pendingGateCheckRunId: number | undefined; if (gateEnabled) { const pendingGateResult = await createOrUpdatePendingGateCheckRun(env, installationId, repoFullName, advisory); @@ -881,41 +924,8 @@ async function maybePublishPrPublicSurface( } } - // Cheap, network-free skip checks (also avoids the miner lookup when it would be wasted). - const prelim = decidePublicSurface({ - settings, - authorLogin: author, - authorType: webhook.authorType ?? null, - authorAssociation: pr.authorAssociation ?? null, - minerStatus: "not_checked", - }); - if (prelim.skipped) { - await auditPrVisibilitySkip(env, repoFullName, pr.number, author, prelim.skipReason ?? "skipped", webhook.deliveryId); - return; - } - if (prelim.actions.length === 1 && prelim.actions[0] === "none") return; - if (!author) return; - - const requireOfficialMiner = settings.publicAudienceMode === "gittensor_only"; - const official = await getCachedOfficialMinerDetection(env, author, { - targetKey: `${repoFullName}#${pr.number}`, - deliveryId: webhook.deliveryId, - }); - if (requireOfficialMiner && official.status === "unavailable") { - await auditPrVisibilitySkip(env, repoFullName, pr.number, author, "miner_detection_unavailable", webhook.deliveryId); - return; - } - if (requireOfficialMiner && official.status !== "confirmed") { - await auditPrVisibilitySkip(env, repoFullName, pr.number, author, "not_official_gittensor_miner", webhook.deliveryId); - return; - } - const decision = decidePublicSurface({ - settings, - authorLogin: author, - authorType: webhook.authorType ?? null, - authorAssociation: pr.authorAssociation ?? null, - minerStatus: official.status, - }); + if (!prelimHasPublicOutput) return; + if (!official) return; const publishCachedContributorActivity = official.status === "confirmed"; const [contributorPullRequests, contributorIssues, github, cachedRepoStats] = await Promise.all([ diff --git a/test/unit/queue.test.ts b/test/unit/queue.test.ts index 4f9cdb4655..97c88382e0 100644 --- a/test/unit/queue.test.ts +++ b/test/unit/queue.test.ts @@ -1338,7 +1338,17 @@ describe("queue processors", () => { autoLabelEnabled: false, checkRunMode: "off", }); - const calls = { fetch: 0 }; + const calls = { fetch: 0, repoWideReads: 0 }; + const originalDb = env.DB; + env.DB = new Proxy(originalDb, { + get(target, prop, receiver) { + if (prop !== "prepare") return Reflect.get(target, prop, receiver); + return (sql: string) => { + if (/from\s+["`]?issues["`]?/i.test(sql) || /from\s+["`]?bounties["`]?/i.test(sql)) calls.repoWideReads += 1; + return target.prepare(sql); + }; + }, + }) as D1Database; vi.stubGlobal("fetch", async () => { calls.fetch += 1; return new Response("unexpected fetch", { status: 500 }); @@ -1356,7 +1366,7 @@ describe("queue processors", () => { }, }); - expect(calls.fetch).toBe(0); + expect(calls).toEqual({ fetch: 0, repoWideReads: 0 }); const skipped = await env.DB.prepare("select actor, target_key, detail, metadata_json from audit_events where event_type = ?").bind("github_app.pr_visibility_skipped").all<{ actor: string; target_key: string;