Seed the shared CI tools

Split out of the four repos per weblib-archive#44. All three files were
byte-identical across every repo at this moment, which will not stay true --
they converged only because four twin PRs landed within hours today, and
report_job_log.py had already drifted once before that.

Taken from weblib-archive, verified identical to every other copy first:

  with-nixpkgs.sh       ca43fa20  (cfbypass, archive, fs)
  report_job_log.py     aaef8f62  (cfbypass, archive)
  sync_blocked_label.py e6ddb21d  (all four)

action.yml is included so the `uses:` question can be re-measured now the repo
is public; it did not work while private.

Co-authored-by: bit <bit@das-labor.org>

report_job_log.py

@@ -0,0 +1,162 @@
+#!/usr/bin/env python3
+"""Post the tail of a build log as a pull request comment.
+
+Gitea 1.25.2 returns 500 from `actions/jobs/{id}/logs` for **every** id, so a
+red job reports `Failing after 48s` and nothing else. Every hypothesis about
+why then costs a push, a wait, and a one-bit answer. This puts the log where it
+can be read, next to the change that caused it.
+
+Standard library only, like `sync_blocked_label.py`, so it needs nothing but an
+interpreter.
+
+Usage, from a workflow step guarded by `if: failure()`:
+
+    report_job_log.py /tmp/build.log
+
+Everything else comes from the Actions environment: `GITHUB_REPOSITORY`,
+`GITHUB_EVENT_PATH` (for the PR number), `GITEA_TOKEN`/`GITHUB_TOKEN`, and
+`GITHUB_SERVER_URL`.
+
+Remove this once the instance is updated and logs can be read directly.
+"""
+
+import argparse
+import json
+import os
+import re
+import sys
+import urllib.error
+import urllib.request
+
+DEFAULT_HOST = "https://git.chaosbit.de"
+
+# Gitea renders a comment body wholesale; a full nix log is megabytes and the
+# failure is always at the end.
+DEFAULT_TAIL = 12000
+
+# nix colours its output, and the raw escapes are noise in Markdown.
+ANSI = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
+
+
+def pull_request_number(event_path):
+    """The PR this job is running for, from the event payload, or None."""
+    if not event_path or not os.path.exists(event_path):
+        return None
+    with open(event_path) as fh:
+        event = json.load(fh)
+    pr = event.get("pull_request") or {}
+    return pr.get("number")
+
+
+def pull_request_for_branch(host, repo, token, branch):
+    """The open PR whose head is `branch`, or None.
+
+    Only a `pull_request` event carries the PR in its payload. A
+    `workflow_dispatch` or `schedule` run does not, and the first version of
+    this script simply printed "not a pull request build" and exited 0 -- so a
+    dispatched run that failed stayed exactly as silent as the one this script
+    exists to fix. Looking the branch up covers those.
+
+    A push to a branch with no PR still has nowhere to comment, which is
+    honest: there is no thread for it.
+    """
+    if not branch:
+        return None
+    url = (f"{host.rstrip('/')}/api/v1/repos/{repo}/pulls"
+           f"?state=open&limit=50")
+    req = urllib.request.Request(url)
+    req.add_header("Authorization", f"token {token}")
+    try:
+        with urllib.request.urlopen(req, timeout=30) as res:
+            pulls = json.loads(res.read() or b"[]")
+    except (urllib.error.URLError, OSError, ValueError):
+        # A reporter that raises reports nothing. HTTPError is a URLError, and
+        # ValueError covers a body that is not JSON.
+        return None
+    for pull in pulls:
+        if ((pull.get("head") or {}).get("ref")) == branch:
+            return pull.get("number")
+    return None
+
+
+def tail(path, limit):
+    with open(path, "rb") as fh:
+        try:
+            fh.seek(0, os.SEEK_END)
+            size = fh.tell()
+            fh.seek(max(0, size - limit * 4))
+        except OSError:                     # not seekable; read it all
+            size = None
+        raw = fh.read()
+    text = ANSI.sub("", raw.decode("utf-8", "replace"))
+    if len(text) > limit:
+        text = text[-limit:]
+        # Do not start mid-line; it reads as corruption rather than truncation.
+        text = text.split("\n", 1)[-1]
+        text = "[…truncated…]\n" + text
+    return text
+
+
+def comment(host, repo, number, token, body):
+    url = f"{host.rstrip('/')}/api/v1/repos/{repo}/issues/{number}/comments"
+    req = urllib.request.Request(url, data=json.dumps({"body": body}).encode(),
+                                 method="POST")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Authorization", f"token {token}")
+    with urllib.request.urlopen(req, timeout=30) as res:
+        return json.loads(res.read() or b"null")
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__,
+                                 formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("log", help="path to the captured build log")
+    ap.add_argument("--repo", default=os.environ.get("GITHUB_REPOSITORY"))
+    ap.add_argument("--host", default=os.environ.get("GITEA_HOST")
+                    or os.environ.get("GITHUB_SERVER_URL") or DEFAULT_HOST)
+    ap.add_argument("--token", default=os.environ.get("GITEA_TOKEN")
+                    or os.environ.get("GITHUB_TOKEN"))
+    ap.add_argument("--pr", type=int, default=None)
+    ap.add_argument("--job", default=os.environ.get("GITHUB_JOB") or "job")
+    ap.add_argument("--tail", type=int, default=DEFAULT_TAIL)
+    args = ap.parse_args(argv)
+
+    if not args.repo or not args.token:
+        print("no repo or no token; set GITHUB_REPOSITORY and GITEA_TOKEN")
+        return 0
+
+    number = args.pr or pull_request_number(os.environ.get("GITHUB_EVENT_PATH"))
+    if number is None:
+        branch = (os.environ.get("GITHUB_HEAD_REF")
+                  or os.environ.get("GITHUB_REF_NAME"))
+        number = pull_request_for_branch(args.host, args.repo, args.token, branch)
+    if number is None:
+        print("no pull request for this run: nothing to comment on")
+        return 0
+
+    if not os.path.exists(args.log):
+        text = ("The step produced no log file at "
+                f"`{args.log}` — it failed before the build started.")
+    else:
+        text = "```\n" + tail(args.log, args.tail).rstrip() + "\n```"
+
+    sha = (os.environ.get("GITHUB_SHA") or "")[:8]
+    body = (f"**`{args.job}` failed**{f' on `{sha}`' if sha else ''}.\n\n"
+            "Job logs return 500 on this Gitea, so here is the tail of the "
+            "build output, posted by `tools/report_job_log.py`.\n\n"
+            f"{text}\n")
+
+    # A failure to report a failure must not itself be silent, but it also must
+    # not mask the real one: the step is already `if: failure()`.
+    try:
+        result = comment(args.host, args.repo, number, args.token, body)
+    except urllib.error.HTTPError as e:
+        print(f"could not comment: {e.code} "
+              f"{e.read()[:300].decode('utf-8', 'replace')}", file=sys.stderr)
+        return 0
+    print(f"reported to {args.repo}#{number}: {(result or {}).get('html_url')}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())