)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"4c7e534a519bb9390ef2222e818414449e529dc5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Parent:     faed7f9d (Merge \"Add MetricDataCache and integrate it into DataSourceBase\")"},{"line_number":2,"context_line":"Author:     Douglas Viroel \u003cviroel@gmail.com\u003e"},{"line_number":3,"context_line":"AuthorDate: 2026-07-28 15:19:55 -0300"},{"line_number":4,"context_line":"Commit:     Douglas Viroel \u003cviroel@gmail.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"8f954083_a7b80809","line":1,"updated":"2026-08-19 15:33:12.000000000","message":"The commit message body reads \"This patch introduce a new webhook policy module with a webhook:trigger rule\", where the subject-verb disagreement (\u0027introduce\u0027 instead of \u0027introduces\u0027) is a clear grammar error in the permanent change history. The intended meaning remains obvious, so this is a low-impact wording defect rather than an ambiguity.\n\n**Severity**: SUGGESTION | **Confidence**: 0.92\n\n**Impact**: Minor: permanent history readability for a security-relevant change; no effect on code behavior or merge safety.\n\n**Recommendation**:\nAmend the commit message to \"This patch introduces a new webhook policy module...\" before merging.","commit_id":"58177acea05b08f5a1137492df3189d61908cac2"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"5d626cdb33cf87e5e0690f3c95d4ebc1d042c819","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"806f5984_66af6d36","updated":"2026-08-19 15:31:53.000000000","message":"ack for master only this revsion was required because fo \nhttps://review.opendev.org/c/openstack/watcher/+/995382 which merged since the inial version fo the patch was created","commit_id":"58177acea05b08f5a1137492df3189d61908cac2"}],"watcher/tests/unit/api/v1/test_webhooks.py":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"dc24c6a4d390165d2940ccb1c9e03f9be79ae470","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        self.assertEqual(HTTPStatus.FORBIDDEN, response.status_int)"},{"line_number":137,"context_line":"        mock_trigger_audit.assert_not_called()"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    @mock.patch.object(watcher_context, \u0027make_context\u0027)"},{"line_number":140,"context_line":"    @mock.patch.object(deapi.DecisionEngineAPI, \u0027trigger_audit\u0027)"},{"line_number":141,"context_line":"    @ddt.data(\"admin\", \"service\")"},{"line_number":142,"context_line":"    def test_trigger_policy_allowed_with_role("}],"source_content_type":"text/x-python","patch_set":1,"id":"0becc1cd_0730c564","line":139,"updated":"2026-08-19 14:26:27.000000000","message":"The two new tests test_trigger_policy_allowed_with_role_1_admin and _2_service fail. They patch watcher.common.context.make_context to build a context with the desired role, but the API request path never calls make_context: watcher/api/hooks.py ContextHook builds the request context with watcher.common.context.RequestContext.from_environ (watcher/api/hooks.py:37-43), which the shared test base already patches with a side effect returning a context with roles\u003d[\u0027member\u0027] (watcher/tests/unit/base.py:87-106). The request context therefore always carries the member role, the webhook:trigger rule (set to \u0027rule:admin_or_service_api\u0027 \u003d \u0027role:admin or role:administrator or role:service\u0027) rejects it, and the tests receive 403 while expecting 202 ACCEPTED.\n\n**Severity**: HIGH | **Confidence**: 0.97\n\n**Impact**: The change cannot pass the project\u0027s unit test gate as written. Additionally, the two disallowed-role variants (member/reader) pass only coincidentally: the reader variant actually exercises a member context because the mock is inert, so rejection of the reader role is not really tested.\n\n**Priority**: Before merge\n**Recommendation**:\nPatch the attribute the request path actually uses, e.g. replace @mock.patch.object(watcher_context, \u0027make_context\u0027) with @mock.patch.object(watcher_context.RequestContext, \u0027from_environ\u0027) and set its side_effect to self._make_context_with_roles([role]) (the base class already patches from_environ, so overriding it per test is the correct seam). Verify locally with stestr/pytest that both allowed variants return 202 and that each disallowed role (member, reader) is actually delivered to the policy check.","commit_id":"c4e44309c4b60dd01211a910407671bfb765636a"}]}