feat: ide-lane hardening (ci ampel in auftragsbuch, hermes auto-bugfix, cleanup)

backend/services/auftragsbuch.py

@@ -26,6 +26,7 @@ import re
 import shutil
 import subprocess
 import time
+import urllib.request
 from pathlib import Path
 
 from config import MODELS_DIR
@@ -60,6 +61,46 @@ _KANDIDAT_RX = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._ -]{0,120}\.md$")
 
 _fetch_cache: dict = {}
 _FETCH_EVERY = 30.0  # s — Gitea nicht bei jedem UI-Poll anfragen
+_CI_CACHE: dict = {}  # { (repo, branch, head_sha): {"status": "success", "ts": time} }
+
+def _gitea_creds() -> tuple | None:
+    try:
+        cred = Path("~/.git-credentials").expanduser()
+        for line in cred.read_text(encoding="utf-8").splitlines():
+            m = re.match(r"https://([^:]+):([^@]+)@git\.tobisniceshomelab", line.strip())
+            if m: return m.group(1), m.group(2)
+    except Exception:
+        pass
+    return None
+
+def _fetch_ci_status(repo: str, branch: str, head_sha: str) -> str | None:
+    # Nur auf der Box (wo creds liegen) sinnvoll
+    creds = _gitea_creds()
+    if not creds: return None
+    user, token = creds
+    cache_key = (repo, branch, head_sha)
+    cached = _CI_CACHE.get(cache_key)
+    if cached and (time.time() - cached["ts"] < 30 or cached["status"] in ("success", "failure", "skipped")):
+        return cached["status"]
+    
+    full_repo = "Hitonabi/mission-control-v2" if repo == "mc2" else "Hitonabi/lucy"
+    url = f"http://192.168.178.153:3000/api/v1/repos/{full_repo}/actions/runs?branch={urllib.parse.quote(branch)}&limit=1"
+    try:
+        req = urllib.request.Request(url, headers={"Authorization": "token " + token})
+        with urllib.request.urlopen(req, timeout=5) as r:
+            data = json.load(r)
+            runs = data if isinstance(data, list) else data.get("runs", data.get("workflow_runs", []))
+            if runs:
+                run = runs[0]
+                if run.get("head_sha", "").startswith(head_sha[:7]):
+                    st = run.get("status")
+                    if st:
+                        _CI_CACHE[cache_key] = {"status": st, "ts": time.time()}
+                        return st
+    except Exception as e:
+        log.warning("auftragsbuch: CI-Status fetch fehler: %s", e)
+    return None
+
 
 
 def _available() -> bool:
@@ -176,6 +217,10 @@ def _repo_items(repo: str, statuses: dict, gutachten: dict) -> list[dict]:
             stempel = gutachten.get(f"{repo}:{branch}")
             if not (isinstance(stempel, dict) and stempel.get("commit_ts") == ts_val):
                 stempel = None
+            
+            head_sha = (_git(repo, ["rev-parse", ref]).stdout or "").strip()
+            ci_status = _fetch_ci_status(repo, branch, head_sha) if head_sha else None
+
             stat = (_git(repo, ["diff", "--shortstat", f"origin/main...{ref}"]).stdout or "").strip()
             files_raw = (_git(repo, ["diff", "--name-status", f"origin/main...{ref}"]).stdout or "").splitlines()
             files = []
@@ -209,6 +254,7 @@ def _repo_items(repo: str, statuses: dict, gutachten: dict) -> list[dict]:
                 # es im Repo liegt. Lucy wird dagegen IMMER am PC gebaut (kein dist im Repo).
                 "frontend_ohne_build": repo == "mc2" and frontend_src and not frontend_dist,
                 "status": None if (status or {}).get("state") == "eingespielt" and ahead > 0 else status,
+                "ci_status": ci_status,
             })
         except Exception:
             log.warning("auftragsbuch: Branch %s (%s) nicht lesbar", branch, repo, exc_info=True)