Copilot commented on code in PR #13063: URL: https://github.com/apache/trafficserver/pull/13063#discussion_r3972262558
########## doc/developer-guide/release-process/index.en.rst: ########## @@ -67,8 +67,8 @@ Build #. Generate or update the CHANGELOG for the next release. :: - ./tools/git/changelog.pl -o apache -r trafficserver -m X.Y.Z > - CHANGELOG-X.Y.Z + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m X.Y.Z --use-gh > CHANGELOG-X.Y.Z Review Comment: The updated release instructions now assume both `uv` and the GitHub CLI are installed and authenticated (`--use-gh`). To keep the release guide actionable, add a brief prerequisite note (how to install/auth `gh`, and that `--use-gh` requires existing `gh auth login`), and/or document the non-`gh` path (token via `GH_TOKEN`) as an alternative command. ########## tools/changelog/changelog.py: ########## @@ -0,0 +1,514 @@ +#!/usr/bin/env python3 +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +"""Generate a changelog from merged PRs in a GitHub milestone. + +Usage: + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.2.0 + +Output is written to stdout in the format used by CHANGELOG-* files: + + Changes with Apache Traffic Server 10.2.0 + #11945 - Make directory operations methods on `Directory` + #12026 - Static link opentelemetry-cpp libraries to otel_tracer plugin + ... + +To generate a changelog file for a release: + + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.2.0 > CHANGELOG-10.2.0 + +Use --doc to include extra metadata (merge commit SHA, PR body, labels) for each +PR, useful for generating release documentation. With --from-git the body is the +commit message body rather than a PR body: + + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.2.0 --doc --format yaml > changelog.yaml + +For security releases whose fixes land directly on a release branch without +public pull requests (and therefore never appear in a milestone), use +--from-git to source the changelog from a git commit range. This is merged +with the milestone PRs (deduplicated by PR number) so the result includes both +the direct-to-branch commits and any milestone PRs. The -m value is still used +as the version label in the output: + + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.1.4 \ + --from-git 10.1.3..upstream/10.1.x + +Requires a GitHub token via GH_TOKEN env var or -a flag to avoid rate limits. +""" + +import argparse +import json +import os +import re +import subprocess +import sys + +import httpx +import yaml + +API_URL = "https://api.github.com"; + + +def gh_cli_available() -> bool: + try: + subprocess.run(["gh", "--version"], capture_output=True, check=True) + return True + except (FileNotFoundError, subprocess.CalledProcessError): + return False + + +def changelog_via_gh(owner: str, repo: str, milestone: str, verbose: bool, doc: bool) -> list[dict]: + """Use the gh CLI to fetch milestone PRs (avoids API rate limits).""" + milestone_id = None + result = subprocess.run( + ["gh", "api", f"/repos/{owner}/{repo}/milestones?state=all", "--paginate"], + capture_output=True, + text=True, + ) + if result.returncode != 0: + print(f"gh api error: {result.stderr}", file=sys.stderr) + sys.exit(1) + + milestones = json.loads(result.stdout) + for ms in milestones: + if ms["title"] == milestone: + milestone_id = ms["number"] + break + + if milestone_id is None: + print(f"Milestone not found: {milestone}", file=sys.stderr) + sys.exit(1) + + print(f"Looking for issues from Milestone {milestone}", file=sys.stderr) + + changelog = [] + page = 1 + while True: + print(f"Page {page}", file=sys.stderr) + result = subprocess.run( + [ + "gh", + "api", + f"/repos/{owner}/{repo}/issues?milestone={milestone_id}&state=closed&page={page}&per_page=100", + ], + capture_output=True, + text=True, + ) + if result.returncode != 0: + print(f"gh api error: {result.stderr}", file=sys.stderr) + sys.exit(1) + + issues = json.loads(result.stdout) + if not issues: + break + + for issue in issues: + number = issue["number"] + title = issue["title"] + if verbose: + print(f"Issue #{number} - {title} ", end="", file=sys.stderr) + + if "pull_request" not in issue: + if verbose: + print("not a PR.", file=sys.stderr) + continue + + if not _gh_is_merged(owner, repo, number): + if verbose: + print("not merged.", file=sys.stderr) + continue + + if verbose: + print("added.", file=sys.stderr) + + entry: dict = {"number": number, "title": title} + if doc: + labels = [label["name"] for label in issue.get("labels", [])] + entry["labels"] = labels + pr_detail = subprocess.run( + ["gh", "api", f"/repos/{owner}/{repo}/pulls/{number}"], + capture_output=True, + text=True, + ) + if pr_detail.returncode != 0: + print(f"gh api error fetching PR #{number}: {pr_detail.stderr.strip()}", file=sys.stderr) + sys.exit(1) + pr_data = json.loads(pr_detail.stdout) + entry["sha"] = pr_data.get("merge_commit_sha", "") + entry["body"] = pr_data.get("body", "") or "" + changelog.append(entry) Review Comment: In `--doc` mode, the `gh` backend makes an additional API call per PR to fetch details (`/pulls/{number}`), which can be very slow for large milestones and increases the chance of hitting secondary rate limits. Consider switching the `--doc` path to a single batched query (e.g., GraphQL via `gh api graphql`) that returns number/title/labels/body/mergeCommitOid in one request, or at least add a `--doc`-specific bulk fetch strategy to avoid the per-PR N+1 pattern. ########## tools/changelog/pyproject.toml: ########## @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +[project] +name = "changelog" +version = "0.1.0" +description = "Generate changelog from GitHub milestones for Apache Traffic Server" +requires-python = ">=3.11" +license = "Apache-2.0" +dependencies = [ + "httpx>=0.27", + "pyyaml>=6.0", +] + +[project.scripts] +changelog = "changelog:main" Review Comment: This `pyproject.toml` defines `[project]` metadata and `[project.scripts]` but lacks a `[build-system]` table. Many Python tooling paths (including packaging/installing the project so the `changelog` script is actually created) require `[build-system]`; without it, installing this tool as a project can fail or behave inconsistently across environments. Add an explicit `[build-system]` (e.g., setuptools or hatchling) and ensure the module is included in the build, or alternatively drop `[project.scripts]` if the intended usage is strictly `python tools/changelog/changelog.py`. ########## tools/changelog/changelog.py: ########## @@ -0,0 +1,514 @@ +#!/usr/bin/env python3 +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +"""Generate a changelog from merged PRs in a GitHub milestone. + +Usage: + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.2.0 + +Output is written to stdout in the format used by CHANGELOG-* files: + + Changes with Apache Traffic Server 10.2.0 + #11945 - Make directory operations methods on `Directory` + #12026 - Static link opentelemetry-cpp libraries to otel_tracer plugin + ... + +To generate a changelog file for a release: + + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.2.0 > CHANGELOG-10.2.0 + +Use --doc to include extra metadata (merge commit SHA, PR body, labels) for each +PR, useful for generating release documentation. With --from-git the body is the +commit message body rather than a PR body: + + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.2.0 --doc --format yaml > changelog.yaml + +For security releases whose fixes land directly on a release branch without +public pull requests (and therefore never appear in a milestone), use +--from-git to source the changelog from a git commit range. This is merged +with the milestone PRs (deduplicated by PR number) so the result includes both +the direct-to-branch commits and any milestone PRs. The -m value is still used +as the version label in the output: + + uv run --project tools/changelog python tools/changelog/changelog.py \ + -o apache -r trafficserver -m 10.1.4 \ + --from-git 10.1.3..upstream/10.1.x + +Requires a GitHub token via GH_TOKEN env var or -a flag to avoid rate limits. +""" + +import argparse +import json +import os +import re +import subprocess +import sys + +import httpx +import yaml + +API_URL = "https://api.github.com"; + + +def gh_cli_available() -> bool: + try: + subprocess.run(["gh", "--version"], capture_output=True, check=True) + return True + except (FileNotFoundError, subprocess.CalledProcessError): + return False + + +def changelog_via_gh(owner: str, repo: str, milestone: str, verbose: bool, doc: bool) -> list[dict]: + """Use the gh CLI to fetch milestone PRs (avoids API rate limits).""" + milestone_id = None + result = subprocess.run( + ["gh", "api", f"/repos/{owner}/{repo}/milestones?state=all", "--paginate"], + capture_output=True, + text=True, + ) + if result.returncode != 0: + print(f"gh api error: {result.stderr}", file=sys.stderr) + sys.exit(1) + + milestones = json.loads(result.stdout) + for ms in milestones: + if ms["title"] == milestone: + milestone_id = ms["number"] + break + + if milestone_id is None: + print(f"Milestone not found: {milestone}", file=sys.stderr) + sys.exit(1) + + print(f"Looking for issues from Milestone {milestone}", file=sys.stderr) + + changelog = [] + page = 1 + while True: + print(f"Page {page}", file=sys.stderr) + result = subprocess.run( + [ + "gh", + "api", + f"/repos/{owner}/{repo}/issues?milestone={milestone_id}&state=closed&page={page}&per_page=100", + ], + capture_output=True, + text=True, + ) + if result.returncode != 0: + print(f"gh api error: {result.stderr}", file=sys.stderr) + sys.exit(1) + + issues = json.loads(result.stdout) + if not issues: + break + + for issue in issues: + number = issue["number"] + title = issue["title"] + if verbose: + print(f"Issue #{number} - {title} ", end="", file=sys.stderr) + + if "pull_request" not in issue: + if verbose: + print("not a PR.", file=sys.stderr) + continue + + if not _gh_is_merged(owner, repo, number): + if verbose: + print("not merged.", file=sys.stderr) + continue + + if verbose: + print("added.", file=sys.stderr) + + entry: dict = {"number": number, "title": title} + if doc: + labels = [label["name"] for label in issue.get("labels", [])] + entry["labels"] = labels + pr_detail = subprocess.run( + ["gh", "api", f"/repos/{owner}/{repo}/pulls/{number}"], + capture_output=True, + text=True, + ) + if pr_detail.returncode != 0: + print(f"gh api error fetching PR #{number}: {pr_detail.stderr.strip()}", file=sys.stderr) + sys.exit(1) + pr_data = json.loads(pr_detail.stdout) + entry["sha"] = pr_data.get("merge_commit_sha", "") + entry["body"] = pr_data.get("body", "") or "" + changelog.append(entry) + + page += 1 + + return changelog + + +def changelog_via_api( + owner: str, + repo: str, + milestone: str, + token: str | None, + verbose: bool, + doc: bool, +) -> list[dict]: + """Use httpx to call the GitHub REST API directly.""" + headers = { + "Accept": "application/vnd.github.v3+json", + "User-Agent": "ATS-Changelog-Tool", + } + if token: + headers["Authorization"] = f"Bearer {token}" + + with httpx.Client(base_url=API_URL, headers=headers, timeout=30) as client: + milestone_id = _lookup_milestone(client, owner, repo, milestone) + if milestone_id is None: + print(f"Milestone not found: {milestone}", file=sys.stderr) + sys.exit(1) + + print(f"Looking for issues from Milestone {milestone}", file=sys.stderr) + + changelog = [] + page = 1 + while True: + print(f"Page {page}", file=sys.stderr) + resp = client.get( + f"/repos/{owner}/{repo}/issues", + params={ + "milestone": milestone_id, + "state": "closed", + "page": page, + "per_page": 100, + }, + ) + _check_rate_limit(resp) + resp.raise_for_status() + issues = resp.json() + + if not issues: + break + + for issue in issues: + number = issue["number"] + title = issue["title"] + if verbose: + print(f"Issue #{number} - {title} ", end="", file=sys.stderr) + + if "pull_request" not in issue: + if verbose: + print("not a PR.", file=sys.stderr) + continue + + if not _is_merged(client, owner, repo, number): + if verbose: + print("not merged.", file=sys.stderr) + continue + + if verbose: + print("added.", file=sys.stderr) + + entry: dict = {"number": number, "title": title} + if doc: + labels = [label["name"] for label in issue.get("labels", [])] + entry["labels"] = labels + pr_resp = client.get(f"/repos/{owner}/{repo}/pulls/{number}") + _check_rate_limit(pr_resp) + pr_resp.raise_for_status() + pr_data = pr_resp.json() + entry["sha"] = pr_data.get("merge_commit_sha", "") + entry["body"] = pr_data.get("body", "") or "" + changelog.append(entry) + + page += 1 + + return changelog + + +def changelog_via_git(git_range: str, verbose: bool, doc: bool) -> list[dict]: + """Build the changelog from a git commit range. + + Used for security releases whose fixes are committed directly to a release + branch without public PRs, so they never appear in a GitHub milestone. Each + commit becomes an entry; a trailing "(#N)" in the subject is captured as the + PR number when present, but is not required. + """ + field_sep = "\x1f" + record_sep = "\x1e" + fmt = f"%H{field_sep}%s{field_sep}%b{record_sep}" + result = subprocess.run( + ["git", "log", "--no-merges", "--reverse", f"--pretty=format:{fmt}", git_range], + capture_output=True, + text=True, + ) + if result.returncode != 0: + print(f"git log error: {result.stderr.strip()}", file=sys.stderr) + sys.exit(1) + + print(f"Reading commits from git range {git_range}", file=sys.stderr) + + changelog = [] + for record in result.stdout.split(record_sep): + record = record.strip("\n") + if not record: + continue + sha, subject, body = record.split(field_sep, 2) + # Only a trailing "(#N)" is a PR number. A bare "#N" anywhere in the subject + # is usually an issue reference, and treating it as a PR number would merge + # unrelated entries in merge_changelogs(). + match = re.search(r"\(#(\d+)\)$", subject) + number = int(match.group(1)) if match else None + if verbose: + label = f"#{number}" if number else sha[:12] + print(f"{label} - {subject} added.", file=sys.stderr) + + entry: dict = {"number": number, "title": subject} + if doc: + entry["sha"] = sha + entry["body"] = body.strip() + changelog.append(entry) + + return changelog + + +def merge_changelogs(milestone_entries: list[dict], git_entries: list[dict]) -> list[dict]: + """Union the milestone-sourced and git-sourced entries, deduplicated by PR number. + + Git commits keep their chronological order and carry commit-derived metadata. + Where a git commit's PR number matches a milestone PR, the milestone labels are + grafted onto the git entry. Milestone PRs with no corresponding commit in the + git range (e.g. folded into a combined backport) are appended, sorted by number. + """ + ms_by_number = {e["number"]: e for e in milestone_entries} + + # A PR can appear more than once in a git range -- a revert and reapply, or the + # same commit cherry-picked twice -- and both commits carry the same trailing + # "(#N)". Keep the first, so the surviving entry is the chronological one. + deduped: list[dict] = [] + seen: set[int] = set() + for ge in git_entries: + num = ge.get("number") + if num is not None: + if num in seen: + continue + seen.add(num) + deduped.append(ge) + + for ge in deduped: + num = ge.get("number") + if num in ms_by_number and ms_by_number[num].get("labels") and "labels" not in ge: + ge["labels"] = ms_by_number[num]["labels"] + + extras = [e for e in milestone_entries if e["number"] not in seen] + extras.sort(key=lambda x: x["number"]) + + return deduped + extras + + +def _lookup_milestone(client: httpx.Client, owner: str, repo: str, title: str) -> int | None: + page = 1 + while True: + resp = client.get(f"/repos/{owner}/{repo}/milestones", params={"state": "all", "per_page": 100, "page": page}) + _check_rate_limit(resp) + resp.raise_for_status() + data = resp.json() + if not data: + break + for ms in data: + if ms["title"] == title: + return ms["number"] + page += 1 + return None + + +def _http_status(response: str) -> int | None: + """Status code from the status line that `gh api --include` prints first.""" + match = re.match(r"HTTP/[\d.]+\s+(\d{3})", response.split("\n", 1)[0]) + return int(match.group(1)) if match else None + + +def _gh_is_merged(owner: str, repo: str, pr_number: int) -> bool: + """Whether pr_number is merged, via the gh CLI. + + gh exits non-zero for any HTTP error, so without the status line --include + supplies, a real 404 is indistinguishable from 403 rate limiting or a 5xx. + Anything but 204/404 is fatal; skipping would drop merged PRs and still exit 0. + """ + result = subprocess.run( + ["gh", "api", "--include", f"/repos/{owner}/{repo}/pulls/{pr_number}/merge"], + capture_output=True, + text=True, + ) + status = _http_status(result.stdout) + if status == 204: + return True + if status == 404: + return False + + print( + f"gh api error checking whether PR #{pr_number} is merged " + f"(HTTP {status if status else 'unknown'}): {result.stderr.strip()}", + file=sys.stderr, + ) + sys.exit(1) + + +def _is_merged(client: httpx.Client, owner: str, repo: str, pr_number: int) -> bool: + resp = client.get(f"/repos/{owner}/{repo}/pulls/{pr_number}/merge") + if resp.status_code == 204: + return True + if resp.status_code == 404: + return False + _check_rate_limit(resp) + resp.raise_for_status() + return False + + +def _check_rate_limit(resp: httpx.Response) -> None: + """Exit if @a resp is a rate-limit response, leaving other errors to the caller. + + A 403 alone does not identify a rate limit -- GitHub also uses it for a missing + token or insufficient scopes, where "try using an auth token" is wrong and hides + the real cause. A primary limit zeroes x-ratelimit-remaining, a secondary limit + sends retry-after, and a 429 is always a limit. Everything else falls through to + the raise_for_status() that follows each call site. + """ + if resp.status_code not in (403, 429): + return + if (resp.status_code == 429 or resp.headers.get("x-ratelimit-remaining") == "0" or "retry-after" in resp.headers): + print( + "You have exceeded your rate limit. Try using an auth token.", + file=sys.stderr, + ) + sys.exit(2) + + +def main() -> None: + parser = argparse.ArgumentParser(description="Generate changelog from merged PRs in a GitHub milestone.") + parser.add_argument("-o", "--owner", required=True, help="Repository owner") + parser.add_argument("-r", "--repo", required=True, help="Repository name") + parser.add_argument("-m", "--milestone", required=True, help="Milestone title") + parser.add_argument( + "-a", + "--auth", + default=None, + help="GitHub auth token. Discouraged: it is visible in ps output and shell history. Prefer GH_TOKEN.", + ) + parser.add_argument("-v", "--verbose", action="store_true", help="Verbose output") + parser.add_argument( + "--doc", + action="store_true", + help="Include extra metadata (merge SHA, PR body, labels) for documentation", + ) + parser.add_argument( + "--format", + choices=["text", "yaml"], + default="text", + help="Output format (default: text)", + ) + parser.add_argument( + "--use-gh", + action="store_true", + help="Use gh CLI instead of direct API calls (avoids rate limits)", + ) + parser.add_argument( + "--from-git", + metavar="RANGE", + default=None, + help="Also source commits from a git range (e.g. 10.1.3..upstream/10.1.x) and merge them " + "with the milestone PRs, deduplicated by PR number. Use for security releases whose fixes " + "land directly on a branch without public PRs. -m is still used as the version label.", + ) + args = parser.parse_args() + + token = args.auth or os.environ.get("GH_TOKEN") + + if not token and not args.use_gh: + print( + "WARNING: No GitHub token provided. Unauthenticated requests are limited\n" + "to 60 per hour, which is usually not enough to generate a full changelog.\n" + "\n" + "Provide a token via -a or the GH_TOKEN environment variable.\n" + "\n" + "To create a token:\n" + " 1. Go to https://github.com/settings/tokens\n"; + " 2. Click 'Generate new token' -> 'Generate new token (classic)'\n" + " 3. Select the 'public_repo' scope (sufficient for public repositories)\n" + " 4. For fine-grained tokens, grant read-only access to Issues and\n" + " Pull Requests on the target repository\n" + "\n" + "Alternatively, use --use-gh to use the gh CLI with its existing auth.\n", + file=sys.stderr, + ) + + if args.use_gh: + if not gh_cli_available(): + print("gh CLI not found. Install it or omit --use-gh.", file=sys.stderr) + sys.exit(1) + changelog = changelog_via_gh(args.owner, args.repo, args.milestone, args.verbose, args.doc) + else: + changelog = changelog_via_api( + args.owner, + args.repo, + args.milestone, + token, + args.verbose, + args.doc, + ) + + if args.from_git: + git_changelog = changelog_via_git(args.from_git, args.verbose, args.doc) + changelog = merge_changelogs(changelog, git_changelog) + + if changelog: + # Milestone-only entries all carry a PR number and sort by it. A merged + # (--from-git) result preserves git's chronological order with milestone-only + # PRs appended, so it must not be re-sorted. + if not args.from_git: + changelog.sort(key=lambda x: x["number"]) + + if args.format == "yaml": + output = { + "milestone": args.milestone, + "owner": args.owner, + "repo": args.repo, + "entries": changelog, + } + yaml.dump(output, sys.stdout, default_flow_style=False, sort_keys=False, allow_unicode=True) Review Comment: Using `yaml.dump` can emit YAML with arbitrary Python tags if non-primitive types ever make it into `output` (now or via future changes), which is generally discouraged. Prefer `yaml.safe_dump` (or `yaml.dump(..., Dumper=yaml.SafeDumper)`) to guarantee the output remains plain YAML without object serialization behavior. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
