Codeflow history API endpoint by adamzip · Pull Request #5295 · dotnet/arcade-services

adamzip · 2025-09-23T10:02:44Z

No description provided.

adamzip · 2026-01-20T12:49:30Z

...rvice/Microsoft.DotNet.ProductConstructionService.Client/Generated/Models/CodeflowHistory.cs

+        [JsonProperty("description")]
+        public string Description { get; }
+
+        [JsonProperty("sourceRepoFlowSha")]


Rename to "codeflowSourceSha" ?

adamzip · 2026-01-22T16:26:18Z

Marking this as ready to get the PR summary from copilot

Copilot

Pull request overview

This PR introduces a new API endpoint for retrieving codeflow history between repositories and the VMR (Virtual Mono Repository), including a visualization component in the BarViz UI. The implementation adds Redis-based caching for commit history and integrates GitHub API calls to fetch blame and commit data for tracking forward flows and backflows.

Changes:

Adds /api/subscriptions/{id}/codeflowhistory endpoint to fetch and visualize code flow between repositories
Implements CodeflowHistoryManager with Redis caching for commit history and codeflow metadata
Extends DarcLib with new methods for fetching commits and determining last incoming flows via GitHub GraphQL and REST APIs

Reviewed changes

Copilot reviewed 17 out of 20 changed files in this pull request and generated 35 comments.

Show a summary per file

File	Description
PullRequestUpdater.cs	Adds placeholder TODO comments and unused Kusto.Ingest import for future codeflow synchronization
CodeflowHistoryManager.cs	New service implementing Redis-based caching and GitHub API integration for codeflow history tracking
CodeflowHistoryResult.cs	API response model for codeflow history data
SubscriptionsController.cs (v2018_07_16)	Adds base implementation of GetCodeflowHistory endpoint with logic to fetch and format commit graphs
SubscriptionsController.cs (v2019_01_16)	Adds commented-out endpoint stub for this API version
SubscriptionsController.cs (v2020_02_20)	Adds public endpoint definition delegating to base implementation
SubscriptionDetailDialog.razor	Replaces subscription details table with codeflow history graph visualization
CodeflowHistoryGraph.razor	New SVG-based visualization component for rendering commit history with flow arrows
PcsStartup.cs	Registers CodeflowHistoryManager as scoped service
Subscriptions.cs (Generated Client)	Adds generated client method for calling the new API endpoint
CodeflowHistory.cs (Generated Models)	Generated client models for API responses
IRemote.cs, IRemoteGitRepo.cs	Extends interfaces with methods for fetching commits and determining last flows
Remote.cs	Wrapper methods delegating to RemoteGitClient implementations
GitHubClient.cs	Implements commit fetching, blame API calls, and codeflow detection via source manifests and version details
AzureDevOpsClient.cs	Stub implementations throwing NotImplementedException
GitRepoFactory.cs, RemoteFactory.cs (multiple)	Updates to pass IVersionDetailsParser dependency to GitHubClient
appsettings.Development.json	Formatting-only change to comment alignment

Copilot · 2026-01-22T16:36:15Z

...structionService/ProductConstructionService.Common/CodeflowHistory/CodeflowHistoryManager.cs

+    ConfigurationOptions options) : ICodeflowHistoryManager
+{
+    private readonly IRemoteFactory _remoteFactory = remoteFactory;
+    private readonly IConnectionMultiplexer _connection = ConnectionMultiplexer.Connect(options);


The IConnectionMultiplexer is created in the constructor but is never disposed. This class should implement IDisposable or IAsyncDisposable to properly dispose of the Redis connection, or the connection should be managed as a singleton with a different lifetime strategy.

Copilot · 2026-01-22T16:36:15Z

...structionService/ProductConstructionService.Common/CodeflowHistory/CodeflowHistoryManager.cs

+        if (commitValues.Any(val => !val.HasValue))
+        {
+            await ClearCodeflowCacheAsync(subscriptionId);
+            throw new InvalidOperationException($"Corrupted commit data encountered for subscription `{subscriptionId}`.");


The cache is cleared when corrupted commit data is encountered, but the exception thrown immediately after means the cache clear operation may not persist if there's a transaction or if the method caller doesn't handle this properly. Consider logging this condition and whether the cache clear should happen before or after throwing.

Copilot · 2026-01-22T16:36:15Z

...structionService/ProductConstructionService.Common/CodeflowHistory/CodeflowHistoryManager.cs

+using Maestro.Data.Models;
+using Microsoft.DotNet.DarcLib;
+using Microsoft.DotNet.DarcLib.Models.VirtualMonoRepo;
+using Pipelines.Sockets.Unofficial.Arenas;


The unused import Pipelines.Sockets.Unofficial.Arenas should be removed as it's not used anywhere in this file.

Suggested change

using Pipelines.Sockets.Unofficial.Arenas;

src/Microsoft.DotNet.Darc/DarcLib/AzureDevOpsClient.cs

...tConstructionService/ProductConstructionService.BarViz/Components/CodeflowHistoryGraph.razor

Copilot · 2026-01-22T16:36:23Z

...ervice/ProductConstructionService.Api/Api/v2018_07_16/Controllers/SubscriptionsController.cs

+            .Where(sub =>
+                sub.SourceRepository == subscription.TargetRepository
+                && sub.TargetRepository == subscription.SourceRepository)
+            .FirstOrDefaultAsync(sub => sub.SourceEnabled == true);


The expression 'A == true' can be simplified to 'A'.

Copilot · 2026-01-22T16:36:24Z

...ervice/ProductConstructionService.Api/Api/v2018_07_16/Controllers/SubscriptionsController.cs

+    {
+        var subscription = await _context.Subscriptions
+            .Include(sub => sub.LastAppliedBuild)
+            .FirstOrDefaultAsync(sub => sub.Id == id && sub.SourceEnabled == true);


The expression 'A == true' can be simplified to 'A'.

Copilot · 2026-01-22T16:36:24Z

...tConstructionService/ProductConstructionService.BarViz/Components/CodeflowHistoryGraph.razor

+        new("b3n5n7", "Grace", "Remove unused code", null),
+    };
+
+    private List<CodeflowGraphCommit> _vmrCommits = new List<CodeflowGraphCommit>


Field '_vmrCommits' can be 'readonly'.

Suggested change

private List<CodeflowGraphCommit> _vmrCommits = new List<CodeflowGraphCommit>

private readonly List<CodeflowGraphCommit> _vmrCommits = new List<CodeflowGraphCommit>

Copilot · 2026-01-22T16:36:24Z

...tConstructionService/ProductConstructionService.BarViz/Components/CodeflowHistoryGraph.razor

+        return result;
+    }
+
+    private List<CodeflowGraphCommit> _repoCommits = new List<CodeflowGraphCommit>


Field '_repoCommits' can be 'readonly'.

Suggested change

private List<CodeflowGraphCommit> _repoCommits = new List<CodeflowGraphCommit>

private readonly List<CodeflowGraphCommit> _repoCommits = new List<CodeflowGraphCommit>

Copilot · 2026-01-22T16:36:25Z

...tConstructionService/ProductConstructionService.BarViz/Components/CodeflowHistoryGraph.razor

+        @((MarkupString)$"<text x=\"0\" y=\"-10\" fill=\"#000\">{_leftColumnName}</text>")
+        <line x1="60" y1="0" x2="60" y2="@((_leftColumn.Count - 1) * (BOX_HEIGHT + BOX_Y_MARGIN))" stroke="#bbb" stroke-width="1.5" />
+        @for (int i = 0; i < _leftColumn.Count; i++)
+        {
+            if (!_leftColumn[i].Contains("hidden"))
+            {
+                <use href="#commitBox" x="0" y="@(i * (BOX_HEIGHT + BOX_Y_MARGIN))" />
+                @((MarkupString)$"<text x=\"{BOX_WIDTH / 2}\" y=\"{i * (BOX_HEIGHT + BOX_Y_MARGIN) + 32}\" text-anchor=\"middle\" fill=\"#000\">{_leftColumn[i]}</text>")
+                ;
+            }
+            else
+            {
+
+                <use href="#whiteBox" x="-20" y="@(i * (BOX_HEIGHT + BOX_Y_MARGIN))" />
+                var firstLine = _leftColumn[i].Split('(')[0];
+                var secondLine = "(" + _leftColumn[i].Split('(')[1];
+                @((MarkupString)$"<text x=\"{BOX_WIDTH / 2}\" y=\"{i * (BOX_HEIGHT + BOX_Y_MARGIN) + 22}\" text-anchor=\"middle\" fill=\"#000\">{firstLine}</text>")
+                ;
+                @((MarkupString)$"<text x=\"{BOX_WIDTH / 2}\" y=\"{i * (BOX_HEIGHT + BOX_Y_MARGIN) + 42}\" text-anchor=\"middle\" fill=\"#000\">{secondLine}</text>")
+                ;
+            }
+        }
+    </g>
+
+    <!-- RIGHT COLUMN -->
+    <g class="column right" transform="translate(@(COL_SPACE), 50)">
+        @((MarkupString)$"<text x=\"0\" y=\"-10\" fill=\"#000\">{_rightColumnName}</text>")
+        <line x1="60" y1="0" x2="60" y2="@((_rightColumn.Count - 1) * (BOX_HEIGHT + BOX_Y_MARGIN))" stroke="#bbb" stroke-width="1.5" />
+        @for (int i = 0; i < _rightColumn.Count; i++)
+        {
+            if (!_rightColumn[i].Contains("hidden"))
+            {
+                <use href="#commitBox" x="0" y="@(i * (BOX_HEIGHT + BOX_Y_MARGIN))" />
+                @((MarkupString)$"<text x=\"{BOX_WIDTH / 2}\" y=\"{i * (BOX_HEIGHT + BOX_Y_MARGIN) + 32}\" text-anchor=\"middle\" fill=\"#000\">{_rightColumn[i]}</text>")
+                ;


This component uses MarkupString to inject _leftColumnName, _rightColumnName, and commit IDs directly into SVG <text> elements without HTML encoding, while those values are populated from the CodeflowHistory API (e.g., RepoName, which ultimately comes from subscription configuration). An attacker who can control subscription data (such as SourceDirectory or TargetBranch) could supply values containing HTML like </text><script>...</script> and achieve stored XSS against any user viewing this graph. Replace MarkupString usage with standard Blazor text rendering or explicitly HTML-encode/sanitize all dynamic values before constructing markup so that user-controlled data cannot break out of the intended <text> context.

adamzip changed the title ~~Codeflow history controller~~ Codeflow history API endpoint Sep 23, 2025

adamzip force-pushed the codeflow-history-controller branch from 375cfae to 6189c3d Compare November 16, 2025 15:17

adamzip added 12 commits December 18, 2025 18:26

Add controller for codeflow history

1ce149c

update codeflow history controller

29ba129

Rename Maestro.Data.Models.Subscription references

e208448

Codeflow graphs WIP

4670295

remove unused file

e20a1aa

get codeflows WIP

a8ef01a

codeflow graph WIP

6f2aa65

codeflow graph improvements

bb2fd0f

add codeflow cache clear

c566f9d

Trim off tail end of cache

f5df5ef

Fix codeflow loop

3c52313

fix build

cbe3261

adamzip force-pushed the codeflow-history-controller branch from 590bba8 to cbe3261 Compare December 18, 2025 18:38

adamzip added 7 commits December 18, 2025 19:41

fix build 2

64b3112

Final changes

326ce93

Graphs frontend WIP

b77dba5

connect front and back

6b51f12

temp

e2943d4

controller bugfix + return short SHAs

7094306

improve graph layout

ede1dd1

adamzip commented Jan 20, 2026

View reviewed changes

adamzip marked this pull request as ready for review January 22, 2026 16:26

Copilot AI review requested due to automatic review settings January 22, 2026 16:26

Copilot started reviewing on behalf of adamzip January 22, 2026 16:26 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Codeflow history API endpoint#5295

Codeflow history API endpoint#5295
adamzip wants to merge 19 commits intodotnet:mainfrom
adamzip:codeflow-history-controller

adamzip commented Sep 23, 2025

Uh oh!

adamzip Jan 20, 2026

Uh oh!

adamzip commented Jan 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

	private List<CodeflowGraphCommit> _vmrCommits = new List<CodeflowGraphCommit>
	private readonly List<CodeflowGraphCommit> _vmrCommits = new List<CodeflowGraphCommit>

	private List<CodeflowGraphCommit> _repoCommits = new List<CodeflowGraphCommit>
	private readonly List<CodeflowGraphCommit> _repoCommits = new List<CodeflowGraphCommit>

Conversation

adamzip commented Sep 23, 2025

Uh oh!

adamzip Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

adamzip commented Jan 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments