webapp: OIDC-authorized task status endpoint for the triage reconciler

The transformers-ci nightly triage opens a tracking issue then dispatches
one serge task per failure group, and refreshes the issue by polling open
PRs. Groups that end `no_fix` open no PR, so their row never updates — the
script has no way to learn a task's terminal status (it holds only a GitHub
Actions OIDC bearer, and /info requires a web session).

Add GET /tasks/{owner}/{repo}/{job_id}/status, authorized the same way as
POST /tasks (OIDC bearer, repo claim must match the path). Returns status /
result / error so the reconciler can mark no_fix (and error) groups in the
tracking issue instead of waiting on a PR that never comes.

Serge-side prerequisite only; the transformers-ci reconciler change to
consume it is a follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tarekziade

reviewbot/webapp.py

@@ -3545,6 +3545,57 @@ def task_info(request: Request, owner: str, repo: str, job_id: str) -> JSONRespo
     )
 
 
+@app.get("/tasks/{owner}/{repo}/{job_id}/status")
+def task_status(request: Request, owner: str, repo: str, job_id: str) -> JSONResponse:
+    """Machine-facing task status, authorized by GitHub Actions OIDC (same as
+    ``POST /tasks``) rather than a web session — so the caller that dispatched a
+    task can poll its terminal outcome. The ``/info`` sibling requires a browser
+    session; this one accepts the OIDC bearer the dispatcher already holds.
+
+    Authorized on the token's ``repository`` claim: a run can only read tasks it
+    could have dispatched for its own repo. Returns the job ``status``
+    (``running``/``published``/``no_fix``/``error``/…), the ``result`` (patch/PR
+    details on ``published``), and ``error`` — enough for the triage reconciler
+    to mark a group ``no_fix`` in the tracking issue instead of waiting on a PR
+    that never comes."""
+    if not cfg.task_api_enabled:
+        raise HTTPException(status_code=404, detail="tasks_api_disabled")
+
+    token = _bearer_token(request)
+    try:
+        claims = verify_token(
+            token,
+            issuer=cfg.task_oidc_issuer,
+            audience=cfg.task_oidc_audience,
+        )
+    except OIDCError as exc:
+        raise HTTPException(status_code=401, detail=f"oidc_verification_failed: {exc}")
+
+    # The OIDC repository claim is authoritative — the caller may only read tasks
+    # for the repo its token was minted for, and it must match the path.
+    if claims.repository.lower() != f"{owner}/{repo}".lower():
+        raise HTTPException(status_code=403, detail="repo_claim_mismatch")
+
+    with _jobs_lock:
+        job = _jobs.get(job_id)
+    if job is None:
+        job = _load_job_from_store(job_id)
+    if job is None or job.kind != "task":
+        raise HTTPException(status_code=404, detail="task_not_found")
+    if job.target_owner != owner or job.target_repo != repo:
+        raise HTTPException(status_code=404, detail="task_target_mismatch")
+
+    return JSONResponse(
+        {
+            "id": job.id,
+            "status": job.status,
+            "target": f"{job.target_owner}/{job.target_repo}",
+            "result": job.task_result,
+            "error": job.error,
+        }
+    )
+
+
 @app.get("/tasks/{owner}/{repo}/{job_id}/stream")
 async def task_stream(
     request: Request, owner: str, repo: str, job_id: str

tests/test_webapp_tasks.py

@@ -206,6 +206,70 @@ def fake_submit(fn, job, worker_cfg, req):
         self.assertNotIn("skipped", results[1].json())
         self.assertTrue(results[2].json().get("skipped"))
 
+    def _seed_task_job(self, webapp, *, status="no_fix", repo="acme/widgets"):
+        owner, name = repo.split("/", 1)
+        webapp._store.insert_job(
+            id="task-status-1",
+            user="octocat",
+            target_owner=owner,
+            target_repo=name,
+            target_number=0,
+            trigger_comment="fix it",
+            llm_provider="hf",
+            llm_api_base=None,
+            llm_model="m",
+            created_at=1.0,
+            status=status,
+            source="task",
+            kind="task",
+            task_spec_json="{}",
+        )
+
+    def test_status_endpoint_oidc_returns_no_fix(self):
+        if TestClient is None:
+            self.skipTest("fastapi not installed")
+        webapp = self._import_webapp()
+        self._seed_task_job(webapp, status="no_fix")
+        with patch.object(webapp, "verify_token", return_value=_Claims()):
+            client = TestClient(webapp.app)
+            r = client.get(
+                "/tasks/acme/widgets/task-status-1/status",
+                headers={"Authorization": "Bearer tok"},
+            )
+        self.assertEqual(r.status_code, 200)
+        body = r.json()
+        self.assertEqual(body["id"], "task-status-1")
+        self.assertEqual(body["status"], "no_fix")
+        self.assertEqual(body["target"], "acme/widgets")
+
+    def test_status_endpoint_rejects_foreign_repo_claim(self):
+        if TestClient is None:
+            self.skipTest("fastapi not installed")
+        webapp = self._import_webapp()
+        self._seed_task_job(webapp, status="no_fix")
+        # A token minted for a different repo must not read acme/widgets tasks.
+        with patch.object(
+            webapp, "verify_token", return_value=_Claims(repository="evil/repo")
+        ):
+            client = TestClient(webapp.app)
+            r = client.get(
+                "/tasks/acme/widgets/task-status-1/status",
+                headers={"Authorization": "Bearer tok"},
+            )
+        self.assertEqual(r.status_code, 403)
+
+    def test_status_endpoint_404_when_api_disabled(self):
+        if TestClient is None:
+            self.skipTest("fastapi not installed")
+        webapp = self._import_webapp(task_api_enabled=False)
+        with patch.object(webapp, "verify_token", return_value=_Claims()):
+            client = TestClient(webapp.app)
+            r = client.get(
+                "/tasks/acme/widgets/task-status-1/status",
+                headers={"Authorization": "Bearer tok"},
+            )
+        self.assertEqual(r.status_code, 404)
+
     def test_inprocess_execution_dispatches_to_worker(self):
         if TestClient is None:
             self.skipTest("fastapi not installed")