Fix: Add Gerrit DNS validation, CI_TEST_MODE

Add fast-fail DNS validation of the Gerrit server
hostname after config display, before PR processing.
This catches bogus derived hostnames early instead of
letting the tool fail silently during cleanup.

Implement CI_TEST_MODE leveraging DRY_RUN: when
CI_TEST_MODE=true, force DRY_RUN=true and
G2G_DRYRUN_DISABLE_NETWORK=true so all tool logic
runs but Gerrit network operations are no-ops.
Cleanup tasks are also suppressed since there is no
server to query. Display a CI_TEST_MODE row with a
test-tube emoji in the config table when active.

Gate all cleanup operations on not ci_test_mode to
prevent network calls to non-existent Gerrit servers.

The early DNS validation is skipped when CI_TEST_MODE,
G2G_TEST_MODE, or G2G_DRYRUN_DISABLE_NETWORK are
active, consistent with existing dry-run preflight.

Add CI_TEST_MODE as an action input in action.yaml
and pass it to the CLI step. Update the reusable
workflow to read vars.CI_TEST_MODE. Switch the
testing.yaml happy-path test to CI_TEST_MODE=true.

Update test fixtures using placeholder hostnames to
set G2G_DRYRUN_DISABLE_NETWORK=true when popping
G2G_TEST_MODE since they target validation logic
not network reachability.

Remove console output blank line before:
- ✅ Operation completed!
- ❌ Operation failed!

Co-authored-by: Claude <claude@anthropic.com>
Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>

Author: ModeSevenIndustrialSolutions

.github/workflows/github2gerrit.yaml

@@ -190,6 +190,7 @@ jobs:
           DRY_RUN: ${{ inputs.DRY_RUN }}
           ISSUE_ID: ${{ inputs.ISSUE_ID }}
           ISSUE_ID_LOOKUP_JSON: ${{ vars.ISSUE_ID_LOOKUP_JSON }}
+          CI_TEST_MODE: ${{ vars.CI_TEST_MODE }}
           PR_NUMBER: ${{ inputs.PR_NUMBER }}
 
   github2gerrit:
@@ -220,6 +221,7 @@ jobs:
           ALLOW_DUPLICATES: ${{ inputs.ALLOW_DUPLICATES }}
           ISSUE_ID: ${{ inputs.ISSUE_ID }}
           ISSUE_ID_LOOKUP_JSON: ${{ inputs.ISSUE_ID_LOOKUP_JSON }}
+          CI_TEST_MODE: ${{ vars.CI_TEST_MODE }}
           GERRIT_SERVER: ${{ inputs.GERRIT_SERVER }}
           GERRIT_SERVER_PORT: ${{ inputs.GERRIT_SERVER_PORT }}
           GERRIT_PROJECT: ${{ inputs.GERRIT_PROJECT }}

.github/workflows/testing.yaml

@@ -34,12 +34,10 @@ jobs:
 
       - name: "Running local action: ${{ github.repository }}"
         uses: ./
-        env:
-          G2G_DRYRUN_DISABLE_NETWORK: 'true'
         with:
           GERRIT_KNOWN_HOSTS: 'dummy-host ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC...'
           GERRIT_SSH_PRIVKEY_G2G: 'dummy-key'
-          DRY_RUN: 'true'
+          CI_TEST_MODE: 'true'
           AUTOMATION_ONLY: 'false'
 
       # yamllint disable-line rule:line-length

action.yaml

@@ -69,6 +69,10 @@ inputs:
     description: "Enable CI testing mode; overrides .gitreview, creates orphan commits"
     required: false
     default: "false"
+  CI_TEST_MODE:
+    description: "Enable CI test mode; all tool logic runs but Gerrit network operations are skipped"
+    required: false
+    default: "false"
   FORCE:
     description: "Force PR closure regardless of Gerrit change status (abandoned, etc)"
     required: false
@@ -338,6 +342,7 @@ runs:
         SYNC_ALL_OPEN_PRS: ${{ env.SYNC_ALL_OPEN_PRS }}
         PR_NUMBER: ${{ env.PR_NUMBER }}
         G2G_TEST_MODE: "false"
+        CI_TEST_MODE: ${{ inputs.CI_TEST_MODE }}
       run: |
         # Run github2gerrit Python CLI
         set -euo pipefail

src/github2gerrit/cli.py

@@ -2126,8 +2126,76 @@ def _process() -> None:
         raise converted_error from exc
 
     gh = _read_github_context()
+
+    # --- CI_TEST_MODE: leverage DRY_RUN infrastructure ---
+    # CI_TEST_MODE reuses the existing DRY_RUN + G2G_DRYRUN_DISABLE_NETWORK
+    # code paths so that all tool logic runs but Gerrit network operations
+    # are no-ops.  Cleanup tasks (abandoned-PR / Gerrit-change sweeps) are
+    # also suppressed because they would hit a non-existent server.
+    ci_test_mode = env_bool("CI_TEST_MODE", False)
+
+    # G2G_TEST_MODE is an internal unit-test flag that short-circuits after
+    # config validation (no network at all).  It must also suppress the
+    # early DNS probe to avoid failures against placeholder hostnames.
+    g2g_test_mode = env_bool("G2G_TEST_MODE", False)
+
+    if ci_test_mode:
+        log.info(
+            "🧪 CI_TEST_MODE enabled: forcing DRY_RUN=true and "
+            "G2G_DRYRUN_DISABLE_NETWORK=true"
+        )
+        os.environ["DRY_RUN"] = "true"
+        os.environ["G2G_DRYRUN_DISABLE_NETWORK"] = "true"
+        # Rebuild inputs so the rest of the pipeline sees dry_run=True
+        data = _load_effective_inputs()
+
+    # Display config AFTER CI_TEST_MODE evaluation so the table
+    # reflects the actual runtime values (e.g. DRY_RUN forced true).
     _display_effective_config(data, gh)
 
+    # --- Early Gerrit server DNS validation (fast-fail) ---
+    # Validate the Gerrit server BEFORE any PR processing or workspace setup.
+    # This prevents wasted work when the server is unreachable or bogus.
+    # Runs for both normal and DRY_RUN modes — DRY_RUN still queries Gerrit
+    # for read-only checks (preflight probes, cleanup scans) so the server
+    # must actually resolve.
+    #
+    # Skipped when:
+    # - CI_TEST_MODE: no real Gerrit server exists for this repository
+    # - G2G_TEST_MODE: internal unit-test short-circuit; never reaches Gerrit
+    # - G2G_DRYRUN_DISABLE_NETWORK: explicitly opted out of all network probes
+    #   (consistent with its effect inside _dry_run_preflight)
+    dryrun_disable_network = env_bool("G2G_DRYRUN_DISABLE_NETWORK", False)
+
+    if not ci_test_mode and not g2g_test_mode and not dryrun_disable_network:
+        gerrit_host = data.gerrit_server or ""
+        if gerrit_host:
+            try:
+                _validator = Orchestrator(workspace=Path("."))
+                _validator.validate_gerrit_server(gerrit_host)
+                log.debug(
+                    "✅ Gerrit server '%s' DNS validation passed",
+                    gerrit_host.strip(),
+                )
+            except OrchestratorError as exc:
+                log.warning(
+                    "❌ Gerrit server validation failed for '%s'",
+                    gerrit_host,
+                )
+                safe_console_print(
+                    f"❌ Gerrit server '{gerrit_host}' could not be resolved. "
+                    f"Cannot proceed without a valid Gerrit server.",
+                    style="red",
+                )
+                exit_with_error(
+                    ExitCode.CONFIGURATION_ERROR,
+                    message=(
+                        f"Gerrit server DNS validation failed for "
+                        f"'{gerrit_host}'"
+                    ),
+                    exception=exc,
+                )
+
     # Detect PR operation mode for routing
     operation_mode = gh.get_operation_mode()
     if operation_mode != models.PROperationMode.UNKNOWN:
@@ -2164,8 +2232,10 @@ def _process() -> None:
             )
 
             # First, abandon the specific Gerrit change for this closed PR
+            # Skip in CI_TEST_MODE: no Gerrit server to query
             if (
-                gh.pr_number
+                not ci_test_mode
+                and gh.pr_number
                 and data.gerrit_server
                 and data.gerrit_project
                 and gh.repository
@@ -2209,7 +2279,8 @@ def _process() -> None:
                     )
 
             # Run abandoned PR cleanup if enabled
-            if FORCE_ABANDONED_CLEANUP:
+            # Skip in CI_TEST_MODE: no Gerrit server to query
+            if FORCE_ABANDONED_CLEANUP and not ci_test_mode:
                 try:
                     log.debug("Running abandoned PR cleanup...")
                     if gh.repository and "/" in gh.repository:
@@ -2225,7 +2296,8 @@ def _process() -> None:
                     log.warning("Abandoned PR cleanup failed: %s", exc)
 
             # Run Gerrit cleanup if enabled
-            if FORCE_GERRIT_CLEANUP:
+            # Skip in CI_TEST_MODE: no Gerrit server to query
+            if FORCE_GERRIT_CLEANUP and not ci_test_mode:
                 try:
                     log.debug("Running Gerrit cleanup for closed GitHub PRs...")
                     if data.gerrit_server and data.gerrit_project:
@@ -2285,7 +2357,8 @@ def _process() -> None:
     # Run cleanup tasks for Gerrit events and legacy G2G_GERRIT_CHANGE_URL
     if gerrit_event_change_url or gerrit_change_url:
         # Run abandoned PR cleanup if enabled
-        if FORCE_ABANDONED_CLEANUP:
+        # Skip in CI_TEST_MODE: no Gerrit server to query
+        if FORCE_ABANDONED_CLEANUP and not ci_test_mode:
             try:
                 log.debug("Running abandoned PR cleanup...")
                 if gh.repository and "/" in gh.repository:
@@ -2301,7 +2374,8 @@ def _process() -> None:
                 log.warning("Abandoned PR cleanup failed: %s", exc)
 
         # Run Gerrit cleanup if enabled
-        if FORCE_GERRIT_CLEANUP:
+        # Skip in CI_TEST_MODE: no Gerrit server to query
+        if FORCE_GERRIT_CLEANUP and not ci_test_mode:
             try:
                 log.debug("Running Gerrit cleanup for closed GitHub PRs...")
                 if data.gerrit_server and data.gerrit_project:
@@ -2322,7 +2396,8 @@ def _process() -> None:
         _process_close_merged_prs(data, gh)
 
         # Run abandoned PR cleanup if enabled
-        if FORCE_ABANDONED_CLEANUP:
+        # Skip in CI_TEST_MODE: no Gerrit server to query
+        if FORCE_ABANDONED_CLEANUP and not ci_test_mode:
             try:
                 log.debug("Running abandoned PR cleanup...")
                 if gh.repository and "/" in gh.repository:
@@ -2338,7 +2413,8 @@ def _process() -> None:
                 log.warning("Abandoned PR cleanup failed: %s", exc)
 
         # Run Gerrit cleanup if enabled
-        if FORCE_GERRIT_CLEANUP:
+        # Skip in CI_TEST_MODE: no Gerrit server to query
+        if FORCE_GERRIT_CLEANUP and not ci_test_mode:
             try:
                 log.info("Running Gerrit cleanup for closed GitHub PRs...")
                 if data.gerrit_server and data.gerrit_project:
@@ -2383,7 +2459,8 @@ def _process() -> None:
             log.debug("Processing completed ✅")
 
             # Run abandoned PR cleanup if enabled
-            if FORCE_ABANDONED_CLEANUP:
+            # Skip in CI_TEST_MODE: no Gerrit server to query
+            if FORCE_ABANDONED_CLEANUP and not ci_test_mode:
                 try:
                     log.debug("Running abandoned PR cleanup...")
                     if gh.repository and "/" in gh.repository:
@@ -2399,7 +2476,8 @@ def _process() -> None:
                     log.warning("Abandoned PR cleanup failed: %s", exc)
 
             # Run Gerrit cleanup if enabled
-            if FORCE_GERRIT_CLEANUP:
+            # Skip in CI_TEST_MODE: no Gerrit server to query
+            if FORCE_GERRIT_CLEANUP and not ci_test_mode:
                 try:
                     log.info("Running Gerrit cleanup for closed GitHub PRs...")
                     if data.gerrit_server and data.gerrit_project:
@@ -2567,7 +2645,8 @@ def _process() -> None:
     pipeline_success, result = _process_single(data, gh, progress_tracker)
 
     # Run abandoned PR cleanup if enabled and pipeline was successful
-    if pipeline_success and FORCE_ABANDONED_CLEANUP:
+    # Skip in CI_TEST_MODE: no Gerrit server to query
+    if pipeline_success and FORCE_ABANDONED_CLEANUP and not ci_test_mode:
         try:
             log.debug("Running abandoned PR cleanup...")
             # Extract owner and repo from gh.repository (format: "owner/repo")
@@ -2585,7 +2664,8 @@ def _process() -> None:
             log.warning("Abandoned PR cleanup failed: %s", exc)
 
     # Run Gerrit cleanup if enabled and pipeline was successful
-    if pipeline_success and FORCE_GERRIT_CLEANUP:
+    # Skip in CI_TEST_MODE: no Gerrit server to query
+    if pipeline_success and FORCE_GERRIT_CLEANUP and not ci_test_mode:
         try:
             log.debug("Running Gerrit cleanup for closed GitHub PRs...")
             if data.gerrit_server and data.gerrit_project:
@@ -2612,10 +2692,11 @@ def _process() -> None:
     # Show summary after progress tracker is stopped
     if show_progress and RICH_AVAILABLE:
         summary = progress_tracker.get_summary() if progress_tracker else {}
+        print()
         safe_console_print(
-            "\n✅ Operation completed!"
+            "✅ Operation completed!"
             if pipeline_success
-            else "\n❌ Operation failed!",
+            else "❌ Operation failed!",
             style="green" if pipeline_success else "red",
         )
         safe_console_print(
@@ -2864,6 +2945,9 @@ def _get_ssh_agent_status() -> str:
 
 def _display_effective_config(data: Inputs, gh: GitHubContext) -> None:
     """Display effective configuration in a formatted table."""
+    # Use env_bool for consistent boolean parsing across the codebase
+    ci_test_mode_enabled = env_bool("CI_TEST_MODE", False)
+
     # Detect mode and display prominently
     github_mode = _is_github_mode()
     mode_label = "GITHUB_MODE" if github_mode else "CLI_MODE"
@@ -2924,6 +3008,11 @@ def _display_effective_config(data: Inputs, gh: GitHubContext) -> None:
     # Mode first - always show
     config_info[mode_label] = mode_description
 
+    # Show CI_TEST_MODE regardless of operation mode so logs always
+    # indicate when the run is using test infrastructure.
+    if ci_test_mode_enabled:
+        config_info["CI_TEST_MODE"] = "🧪"
+
     if is_closing_pr_mode:
         # In PR closing mode, only show minimal relevant config
         if data.dry_run:

src/github2gerrit/core.py

@@ -1658,6 +1658,38 @@ def __init__(
     # Public API
     # ---------------
 
+    def validate_gerrit_server(self, gerrit_host: str | None) -> None:
+        """Validate that the Gerrit server hostname can be resolved via DNS.
+
+        This provides a fast-fail mechanism to catch invalid or unreachable
+        Gerrit servers early, before any work is done.
+
+        Args:
+            gerrit_host: The Gerrit server hostname to validate.
+                May be ``None`` or empty, in which case an error is raised.
+
+        Raises:
+            OrchestratorError: If the hostname is empty/None or cannot
+                be resolved.
+        """
+        if not gerrit_host or not gerrit_host.strip():
+            raise OrchestratorError(_MSG_MISSING_GERRIT_SERVER)
+
+        host = gerrit_host.strip()
+        try:
+            socket.getaddrinfo(host, None)
+            log.debug("DNS resolution for Gerrit host '%s' succeeded", host)
+        except socket.gaierror as exc:
+            log.warning(
+                "Gerrit server '%s' could not be resolved via DNS. "
+                "This typically means either the server hostname is "
+                "incorrect or there is no Gerrit server associated "
+                "with this repository.",
+                host,
+            )
+            msg = f"DNS resolution failed for '{host}'"
+            raise OrchestratorError(msg) from exc
+
     def execute(
         self,
         inputs: Inputs,

tests/test_cli.py

@@ -180,6 +180,9 @@ def test_no_pr_context_exits_2(tmp_path: Path) -> None:
     env["GITHUB_EVENT_NAME"] = "workflow_dispatch"
     # Disable test mode to ensure non-zero exit on missing PR context
     env.pop("G2G_TEST_MODE", None)
+    # Skip early DNS validation — this test targets PR context validation,
+    # not network reachability of the derived placeholder hostname
+    env["G2G_DRYRUN_DISABLE_NETWORK"] = "true"
     # Force non-bulk path to avoid GitHub API token requirement
     env["SYNC_ALL_OPEN_PRS"] = "false"
     # Set PR_NUMBER to empty to trigger validation error
@@ -238,6 +241,9 @@ def test_validation_fails_when_no_organization_and_missing_gerrit_params(
     env.pop("GITHUB_EVENT_NAME", None)
     # Disable test mode to ensure validation errors are properly caught
     env.pop("G2G_TEST_MODE", None)
+    # Skip early DNS validation — this test targets input validation,
+    # not network reachability of placeholder hostnames
+    env["G2G_DRYRUN_DISABLE_NETWORK"] = "true"
     # Use empty config file to avoid interference from real config
     empty_config = tmp_path / "config.txt"
     empty_config.write_text("", encoding="utf-8")
@@ -294,6 +300,9 @@ def test_validation_local_cli_requires_derivation_disabled(
     env["G2G_ENABLE_DERIVATION"] = "false"  # Explicitly disable derivation
     # Disable test mode to see validation behavior
     env.pop("G2G_TEST_MODE", None)
+    # Skip early DNS validation — this test targets derivation validation,
+    # not network reachability of placeholder hostnames
+    env["G2G_DRYRUN_DISABLE_NETWORK"] = "true"
     # Use empty config file to avoid interference from real config
     empty_config = tmp_path / "config.txt"
     empty_config.write_text("", encoding="utf-8")

tests/test_cli_outputs_file.py

@@ -111,6 +111,9 @@ def _base_env_with_event(tmp_path: Path) -> dict[str, str]:
         "GITHUB_HEAD_REF": "feature",
         # Ensure real execution path (not short-circuited)
         "G2G_TEST_MODE": "false",
+        # Skip early DNS validation — tests mock the Gerrit layer,
+        # the derived placeholder hostname is not resolvable
+        "G2G_DRYRUN_DISABLE_NETWORK": "true",
         # Disable automation-only mode for tests
         "AUTOMATION_ONLY": "false",
     }
@@ -216,6 +219,8 @@ def test_multi_pr_url_mode_writes_aggregated_outputs(
         "GITHUB_TOKEN": "dummy",
         "DRY_RUN": "true",
         "G2G_TEST_MODE": "false",
+        # Skip early DNS validation — tests mock the Gerrit layer
+        "G2G_DRYRUN_DISABLE_NETWORK": "true",
         "GITHUB_OUTPUT": str(outputs_file),
     }
 

tests/test_cli_url_and_dryrun.py

@@ -31,6 +31,9 @@ def _base_env() -> dict[str, str]:
         # Token not needed since we mock build_client for bulk mode
         "GITHUB_TOKEN": "dummy",
         "DRY_RUN": "true",
+        # Skip early DNS validation — tests mock the Gerrit layer,
+        # the derived placeholder hostname is not resolvable
+        "G2G_DRYRUN_DISABLE_NETWORK": "true",
         # Disable automation-only mode for tests
         "AUTOMATION_ONLY": "false",
     }