Merge pull request #53 from OpenRailAssociation/fix-github-tag-detection

Catch error when searching for commit SHA in Github tags

Author: mxmehl

purltools/_git.py

@@ -22,36 +22,30 @@ def is_sha1(sha: str) -> bool:
     return len(sha) == 40 and all(c in "0123456789abcdef" for c in sha.lower())
 
 
-def github_tag_to_commit(owner: str, repo: str, tag: str) -> str:
-    """Convert a GitHub tag to a commit hash.
-
+def _get_github_tag_info(owner: str, repo: str, tag: str, headers: dict) -> dict:
+    """
+    Get information about a GitHub tag using GitHub's REST API.
     Args:
-        tag (str): The GitHub tag.
+        owner (str): Repository owner
+        repo (str): Repository name
+        tag (str): Tag name/reference
+        headers (dict): Headers to include in the API request
 
     Returns:
-        str: The commit hash corresponding to the tag.
-    """
-    return get_tag_commit_sha(owner, repo, tag)
-
-
-def validate_tag_url(url: str) -> None:
-    """Validate a GitHub API URL to prevent server-side request forgery"""
-    if not url.startswith("https://api.github.com"):
-        raise ValueError(f"Invalid GitHub API URL '{url}")
-    if not is_sha1(url.split("/")[-1]):
-        raise ValueError(f"Invalid SHA1 hash in URL '{url}'")
+        dict: The JSON response from the GitHub API
 
+    Raises:
+        requests.exceptions.RequestException: If the API request fails
+    """
+    logging.debug("Resolving GitHub tag %s in repo %s/%s to commit SHA", tag, owner, repo)
 
-def get_github_token() -> str | None:
-    """Get GitHub token from environment variable if available"""
-    if "GITHUB_TOKEN" in os.environ and os.environ["GITHUB_TOKEN"]:
-        logging.debug("GitHub token found in environment")
-        return str(os.environ["GITHUB_TOKEN"])
-    logging.debug("No GitHub token found, proceeding unauthenticated")
-    return None
+    url = f"https://api.github.com/repos/{owner}/{repo}/git/ref/tags/{tag}"
+    response = requests.get(url, headers=headers, timeout=30)
+    response.raise_for_status()
+    return response.json()
 
 
-def get_tag_commit_sha(owner: str, repo: str, tag: str) -> str:
+def github_tag_to_commit(owner: str, repo: str, tag: str) -> str:
     """Convert a GitHub tag to a commit hash using GitHub's REST API.
 
     Args:
@@ -65,16 +59,31 @@ def get_tag_commit_sha(owner: str, repo: str, tag: str) -> str:
     Raises:
         requests.exceptions.RequestException: If the API request fails
     """
-    token = get_github_token()
+    # Set Headers for GitHub API request
     headers = {"Accept": "application/vnd.github.v3+json"}
+    token = get_github_token()
     if token:
         headers["Authorization"] = f"Bearer {token}"
 
-    url = f"https://api.github.com/repos/{owner}/{repo}/git/ref/tags/{tag}"
-    response = requests.get(url, headers=headers, timeout=30)
-    response.raise_for_status()
+    # First try to get the tag info directly
+    try:
+        data = _get_github_tag_info(owner, repo, tag, headers)
+    # If the tag is not found and does not start with 'v', try again with 'v' prefix. Needed for
+    # GitHub actions and cdxgen
+    except requests.exceptions.RequestException as e:
+        status_code = getattr(e.response, "status_code", None)
+        if status_code == 404 and not tag.startswith("v"):
+            logging.debug("Tag %s not found, retrying with 'v' prefix", tag)
+            try:
+                data = _get_github_tag_info(owner, repo, f"v{tag}", headers)
+            except requests.exceptions.RequestException:
+                if getattr(e.response, "status_code", None) == 404:
+                    logging.error("Tag %s (or v%s) not found in repo %s/%s", tag, tag, owner, repo)
+                    return tag
+                raise e from e
+        else:
+            raise
 
-    data = response.json()
     # Tag refs point to annotated tags first, which then point to commits
     if data["object"]["type"] == "tag":
         # Get the commit URL from the annotated tag
@@ -86,3 +95,20 @@ def get_tag_commit_sha(owner: str, repo: str, tag: str) -> str:
 
     # Lightweight tags point directly to commits
     return data["object"]["sha"]
+
+
+def validate_tag_url(url: str) -> None:
+    """Validate a GitHub API URL to prevent server-side request forgery"""
+    if not url.startswith("https://api.github.com"):
+        raise ValueError(f"Invalid GitHub API URL '{url}")
+    if not is_sha1(url.split("/")[-1]):
+        raise ValueError(f"Invalid SHA1 hash in URL '{url}'")
+
+
+def get_github_token() -> str | None:
+    """Get GitHub token from environment variable if available"""
+    if "GITHUB_TOKEN" in os.environ and os.environ["GITHUB_TOKEN"]:
+        logging.debug("GitHub token found in environment")
+        return str(os.environ["GITHUB_TOKEN"])
+    logging.debug("No GitHub token found, proceeding unauthenticated")
+    return None

tests/test_git.py

@@ -0,0 +1,68 @@
+# SPDX-FileCopyrightText: 2025 DB Systel GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""Test _git.py module functions"""
+
+from unittest.mock import Mock, patch
+
+import requests
+
+from purltools._git import github_tag_to_commit
+
+
+class TestGitHubTagToCommit:
+    """Test cases for github_tag_to_commit function"""
+
+    @patch("purltools._git.requests.get")
+    @patch("purltools._git.get_github_token")
+    def test_github_purl_tag_not_found_retry_success(self, mock_token, mock_get):
+        """Test pkg:github/actions/checkout@5 scenario - tag '5' not found, 'v5' found"""
+        mock_token.return_value = None
+
+        # First call for tag '5' fails with 404
+        first_response = Mock()
+        first_error = requests.exceptions.HTTPError()
+        first_error.response = Mock()
+        first_error.response.status_code = 404
+        first_response.raise_for_status.side_effect = first_error
+
+        # Second call for tag 'v5' succeeds
+        second_response = Mock()
+        second_response.json.return_value = {
+            "object": {"type": "commit", "sha": "08c6903cd8c0fde910a37f88322edcfb5dd907a8"}
+        }
+
+        mock_get.side_effect = [first_response, second_response]
+
+        result = github_tag_to_commit("actions", "checkout", "5")
+
+        assert result == "08c6903cd8c0fde910a37f88322edcfb5dd907a8"
+        assert mock_get.call_count == 2
+
+    @patch("purltools._git.requests.get")
+    @patch("purltools._git.get_github_token")
+    def test_github_purl_tag_not_found_retry_also_fails(self, mock_token, mock_get):
+        """Test pkg:github/actions/checkout@5 scenario - both '5' and 'v5' not found"""
+        mock_token.return_value = None
+
+        # Both calls fail with 404
+        first_response = Mock()
+        first_error = requests.exceptions.HTTPError()
+        first_error.response = Mock()
+        first_error.response.status_code = 404
+        first_response.raise_for_status.side_effect = first_error
+
+        second_response = Mock()
+        second_error = requests.exceptions.HTTPError()
+        second_error.response = Mock()
+        second_error.response.status_code = 404
+        second_response.raise_for_status.side_effect = second_error
+
+        mock_get.side_effect = [first_response, second_response]
+
+        result = github_tag_to_commit("actions", "checkout", "5")
+
+        # Should return the original tag name as fallback
+        assert result == "5"
+        assert mock_get.call_count == 2