Give a push-triggered job somewhere to report a failure

report_job_log.py only ever commented on an open PR, so a push to
development/main -- the shape of a publish pipeline, which has no
pull_request trigger -- had nowhere to post: the branch pushed to is the
merge's target, not the already-closed PR that produced it. Combined with
job logs 500ing on this Gitea, that made a push-triggered failure completely
invisible (weblib-viewer run 1769, diagnosed only by hardcoding --pr on a
throwaway commit).

A GitHub-style commit-comment endpoint, the first thing tried, does not
exist on this Gitea: 404, and absent from /swagger.v1.json entirely. What
does exist and was verified live: GET commits/{sha}/pull resolves the PR
that produced a given commit, open or closed, across both merge styles this
org uses -- so the closed PR the push actually came from can still be found
and commented on as before. When even that finds nothing (a commit that was
never part of any PR), fall back to a commit status, since that endpoint is
already proven to work here.

No CLI changes; existing callers are unaffected.

Closes #14

Co-authored-by: bit <bit@das-labor.org>

report_job_log.py

@@ -28,6 +28,16 @@ Everything else comes from the Actions environment: `GITHUB_REPOSITORY`,
 `GITHUB_EVENT_PATH` (for the PR number), `GITEA_TOKEN`/`GITHUB_TOKEN`,
 `GITHUB_SERVER_URL`, and `JOB_STATUS` if `--status` is not passed.
 
+A `push` event has no open PR to comment on -- the common case is that a PR
+just merged into `development`/`main` and closed, so `GITHUB_HEAD_REF` is the
+target branch, not the one that was merged (weblib-ci#14). Before giving up,
+this asks Gitea which PR produced `GITHUB_SHA`
+(`GET .../commits/{sha}/pull`, which resolves a closed PR from its merge
+commit -- verified against both merge styles this org uses). If that also
+comes up empty -- a commit that was never part of any PR -- the log itself has
+nowhere to go, so a commit status is posted instead: shorter, but still
+readable next to the commit, unlike silence.
+
 Remove this once the instance is updated and logs can be read directly.
 """
 
@@ -48,6 +58,12 @@ DEFAULT_TAIL = 12000
 # nix colours its output, and the raw escapes are noise in Markdown.
 ANSI = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
 
+# A commit status is UI chrome (a line in a list), not a page -- measured
+# against this Gitea: it accepted a 3000-char description unchanged, so
+# nothing here truncates it server-side, but that does not make a wall of log
+# a good idea to put there. Keep it to a snippet.
+STATUS_TAIL = 500
+
 # The header used to hardcode "failed". Every caller guards the step with
 # `if: failure()`, so that was true by construction -- until an `if: always()`
 # probe in weblib-viewer#10 posted a failure report for a job that had passed.
@@ -68,6 +84,18 @@ STATUS_PHRASES = {
     "skipped": "was skipped",
 }
 
+# Gitea's status `state` enum is not the same vocabulary as the header
+# phrases above (`pending, success, error, failure, warning, skipped`).
+# A phrase this table has not heard of -- the "finished with status `X`"
+# fallback -- maps to `error`: the honest reading is "something unusual
+# happened", not a guess at pass or fail.
+STATUS_STATE = {
+    "failed": "failure",
+    "passed": "success",
+    "was cancelled": "warning",
+    "was skipped": "skipped",
+}
+
 
 def status_phrase(status):
     """The verb for the comment header.
@@ -119,8 +147,9 @@ def pull_request_for_branch(host, repo, token, branch):
     dispatched run that failed stayed exactly as silent as the one this script
     exists to fix. Looking the branch up covers those.
 
-    A push to a branch with no PR still has nowhere to comment, which is
-    honest: there is no thread for it.
+    Only finds an **open** PR. A push whose branch's PR has already merged and
+    closed (the common shape for `development`/`main`) is `pull_request_for_sha`'s
+    job, tried next.
     """
     if not branch:
         return None
@@ -141,6 +170,44 @@ def pull_request_for_branch(host, repo, token, branch):
     return None
 
 
+def pull_request_for_sha(host, repo, token, sha):
+    """The PR that produced this commit, open or closed, or None.
+
+    Covers what `pull_request_for_branch` cannot: a `push` to
+    `development`/`main` is almost always a merge landing, and by the time
+    the job runs, the PR that produced it is already **closed** -- so no
+    *open* PR has the pushed branch as its head (weblib-ci#14, found via
+    weblib-viewer#27). Gitea still remembers which PR a given commit came
+    from, independent of the PR's state:
+    `GET repos/{repo}/commits/{sha}/pull`. Verified against both merge
+    styles used in this org -- an explicit merge commit (weblib-ci#13) and a
+    fast-forward promotion, where the "merge commit" is just the PR branch's
+    own tip (weblib-fs#27) -- both resolve correctly.
+
+    This needs the **full** 40-character sha. A short/abbreviated sha (the
+    kind used for display, e.g. `GITHUB_SHA[:8]`) gets exactly the same
+    `{"message": "pull request does not exist [id: 0, ...]"}` 404 shape as a
+    commit that genuinely has no PR -- so passing one silently looks
+    identical to "not found" rather than erroring. `GITHUB_SHA` itself is
+    already the full sha; this just must not be truncated before it gets
+    here.
+    """
+    if not sha:
+        return None
+    url = f"{host.rstrip('/')}/api/v1/repos/{repo}/commits/{sha}/pull"
+    req = urllib.request.Request(url)
+    req.add_header("Authorization", f"token {token}")
+    try:
+        with urllib.request.urlopen(req, timeout=30) as res:
+            pull = json.loads(res.read() or b"null")
+    except (urllib.error.URLError, OSError, ValueError):
+        # Same reasoning as pull_request_for_branch: a 404 (no PR for this
+        # commit) is the expected outcome for most calls, not an error to
+        # surface, and a reporter that raises reports nothing.
+        return None
+    return (pull or {}).get("number")
+
+
 def tail(path, limit):
     with open(path, "rb") as fh:
         try:
@@ -169,6 +236,28 @@ def comment(host, repo, number, token, body):
         return json.loads(res.read() or b"null")
 
 
+def status_description(job, phrase, raw_text, limit=STATUS_TAIL):
+    """The one-line-ish body for a commit status, when there is no PR to post
+    the full log to. `raw_text` is plain text (no code fence, no ANSI) --
+    either a log tail or `missing_log_note`'s message."""
+    snippet = (raw_text or "").strip().replace("\n", " ").strip()
+    if len(snippet) > limit:
+        snippet = "…" + snippet[-limit:]
+    return f"{job} {phrase}: {snippet}" if snippet else f"{job} {phrase}"
+
+
+def report_status(host, repo, sha, token, state, description, target_url):
+    url = f"{host.rstrip('/')}/api/v1/repos/{repo}/statuses/{sha}"
+    payload = {"context": "report_job_log", "state": state,
+               "description": description, "target_url": target_url}
+    req = urllib.request.Request(url, data=json.dumps(payload).encode(),
+                                 method="POST")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Authorization", f"token {token}")
+    with urllib.request.urlopen(req, timeout=30) as res:
+        return json.loads(res.read() or b"null")
+
+
 def main(argv=None):
     ap = argparse.ArgumentParser(description=__doc__,
                                  formatter_class=argparse.RawDescriptionHelpFormatter)
@@ -192,38 +281,70 @@ def main(argv=None):
         print("no repo or no token; set GITHUB_REPOSITORY and GITEA_TOKEN")
         return 0
 
+    full_sha = os.environ.get("GITHUB_SHA") or ""
+    sha = full_sha[:8]
+
     number = args.pr or pull_request_number(os.environ.get("GITHUB_EVENT_PATH"))
     if number is None:
         branch = (os.environ.get("GITHUB_HEAD_REF")
                   or os.environ.get("GITHUB_REF_NAME"))
         number = pull_request_for_branch(args.host, args.repo, args.token, branch)
     if number is None:
-        print("no pull request for this run: nothing to comment on")
-        return 0
+        # A push to development/main has no *open* PR for the branch it
+        # pushed to -- that branch is the target, not the one that was
+        # merged and closed. Ask Gitea which PR this exact commit came from
+        # instead (weblib-ci#14).
+        number = pull_request_for_sha(args.host, args.repo, args.token, full_sha)
 
     phrase = status_phrase(args.status)
 
-    if not os.path.exists(args.log):
-        text = missing_log_note(args.log, phrase)
+    log_exists = os.path.exists(args.log)
+    if not log_exists:
+        raw = missing_log_note(args.log, phrase)
     else:
-        text = "```\n" + tail(args.log, args.tail).rstrip() + "\n```"
+        raw = tail(args.log, args.tail).rstrip()
 
-    sha = (os.environ.get("GITHUB_SHA") or "")[:8]
-    body = (f"**`{args.job}` {phrase}**{f' on `{sha}`' if sha else ''}.\n\n"
-            "Job logs return 500 on this Gitea, so here is the tail of the "
-            "build output, posted by [`report_job_log.py`]"
-            "(https://git.chaosbit.de/weblib/weblib-ci).\n\n"
-            f"{text}\n")
+    if number is not None:
+        text = ("```\n" + raw + "\n```") if log_exists else raw
+        body = (f"**`{args.job}` {phrase}**{f' on `{sha}`' if sha else ''}.\n\n"
+                "Job logs return 500 on this Gitea, so here is the tail of the "
+                "build output, posted by [`report_job_log.py`]"
+                "(https://git.chaosbit.de/weblib/weblib-ci).\n\n"
+                f"{text}\n")
 
-    # A failure to report a failure must not itself be silent, but it also must
-    # not mask the real one: the step is already `if: failure()`.
+        # A failure to report a failure must not itself be silent, but it also
+        # must not mask the real one: the step is already `if: failure()`.
+        try:
+            result = comment(args.host, args.repo, number, args.token, body)
+        except urllib.error.HTTPError as e:
+            print(f"could not comment: {e.code} "
+                  f"{e.read()[:300].decode('utf-8', 'replace')}", file=sys.stderr)
+            return 0
+        print(f"reported to {args.repo}#{number}: {(result or {}).get('html_url')}")
+        return 0
+
+    # No PR anywhere -- a commit that was never part of one (a direct push,
+    # or the lookups above genuinely found nothing). There is still no log
+    # endpoint to point at, but a commit status is a channel that does not
+    # need a thread to post into, and this repo's Actions already post
+    # statuses that people read.
+    if not full_sha:
+        print("no pull request and no commit sha for this run: nothing to "
+              "report")
+        return 0
+
+    state = STATUS_STATE.get(phrase, "error")
+    description = status_description(args.job, phrase, raw)
+    target_url = f"{args.host.rstrip('/')}/{args.repo}/commit/{full_sha}"
     try:
-        result = comment(args.host, args.repo, number, args.token, body)
+        report_status(args.host, args.repo, full_sha, args.token, state,
+                      description, target_url)
     except urllib.error.HTTPError as e:
-        print(f"could not comment: {e.code} "
+        print(f"could not report status: {e.code} "
               f"{e.read()[:300].decode('utf-8', 'replace')}", file=sys.stderr)
         return 0
-    print(f"reported to {args.repo}#{number}: {(result or {}).get('html_url')}")
+    print(f"reported to {args.repo}@{sha} as a commit status "
+          "(no pull request found)")
     return 0