CI: Commit-Policy und allowed_signers für Qt6-Migration

- commit-policy.prompt.md: Policy für Multi-Repo Commits
- allowed_signers: SSH-Signing Konfiguration für Gitea
- check_pr_policies.py: Policy-Check Skript
- MIGRATION_STATUS.md: Dokumentierter Migrationsfortschritt

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Entire-Checkpoint: 01M0G01614JAYPA7N20RAGZJND

ci/check_pr_policies.py

@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(".").resolve()
+TEST_DIRS = [
+    ROOT / "tests",
+    ROOT / "test",
+    ROOT / "qt6-after" / "qt6-migrated-benchmark" / "tests",
+]
+CPP_EXTENSIONS = {".c", ".cc", ".cpp", ".cxx", ".h", ".hh", ".hpp", ".hxx"}
+ALLOWED_SIGNERS_FILE = ROOT / "ci" / "allowed_signers"
+
+TEST_PATTERNS = [
+    "test_{name}.cpp",
+    "test_{name}.h",
+    "{name}_test.cpp",
+    "{name}_test.h",
+    "{name}test.cpp",
+    "{name}test.h",
+    "{name}gtest.cpp",
+    "{name}gtest.h",
+]
+
+
+def run(cmd: str) -> str:
+    return subprocess.check_output(cmd, shell=True, text=True).strip()
+
+
+def git_ref_exists(ref: str) -> bool:
+    try:
+        subprocess.check_call(
+            f"git rev-parse --verify --quiet '{ref}'",
+            shell=True,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        return True
+    except subprocess.CalledProcessError:
+        return False
+
+
+def is_pull_request_build() -> bool:
+    return bool(os.environ.get("CHANGE_ID"))
+
+
+def resolve_target_ref() -> str | None:
+    raw = os.environ.get("CHANGE_TARGET", "").strip()
+
+    candidates = []
+    if raw:
+        candidates.append(raw)
+        if not raw.startswith("origin/"):
+            candidates.append(f"origin/{raw}")
+
+    candidates.extend(["origin/main", "main"])
+
+    seen = set()
+    for ref in candidates:
+        if ref and ref not in seen:
+            seen.add(ref)
+            if git_ref_exists(ref):
+                return ref
+
+    return None
+
+
+def changed_files_and_base() -> tuple[list[str], str]:
+    target = resolve_target_ref()
+
+    if target:
+        print(f"Vergleiche gegen Ziel-Ref: {target}")
+        out = run(f"git diff --name-only {target}...HEAD")
+        files = [line.strip() for line in out.splitlines() if line.strip()]
+        return files, target
+
+    if is_pull_request_build():
+        print("ERROR: Kein gültiger Ziel-Branch-Ref für PR-Build gefunden.")
+        sys.exit(1)
+
+    if git_ref_exists("HEAD~1"):
+        print("Kein Ziel-Branch-Ref gefunden, verwende HEAD~1 für Branch-Build.")
+        out = run("git diff --name-only HEAD~1..HEAD")
+        files = [line.strip() for line in out.splitlines() if line.strip()]
+        return files, "HEAD~1"
+
+    print("Keine Vergleichsbasis gefunden, behandle alle versionierten Dateien als geändert.")
+    out = run("git ls-files")
+    files = [line.strip() for line in out.splitlines() if line.strip()]
+    return files, ""
+
+
+def commits_in_range(base: str) -> list[str]:
+    if base:
+        if base == "HEAD~1":
+            out = run("git rev-list HEAD~1..HEAD")
+        else:
+            out = run(f"git rev-list {base}..HEAD")
+    else:
+        out = run("git rev-list HEAD")
+    return [line.strip() for line in out.splitlines() if line.strip()]
+
+
+def is_cpp_file(path: Path) -> bool:
+    return path.suffix.lower() in CPP_EXTENSIONS
+
+
+def require_clang_format():
+    if not (ROOT / ".clang-format").exists():
+        print("ERROR: .clang-format fehlt im Repository-Root.")
+        sys.exit(1)
+
+
+def require_allowed_signers():
+    if not ALLOWED_SIGNERS_FILE.exists():
+        print(f"ERROR: {ALLOWED_SIGNERS_FILE} fehlt.")
+        sys.exit(1)
+
+
+def check_format(path: Path):
+    subprocess.check_call(f"clang-format --dry-run --Werror '{path}'", shell=True)
+
+
+def candidate_names(path: Path):
+    stem = path.stem.lower()
+    names = {stem}
+    for suffix in ["_p", "_impl", "_private", "_priv", "_ui"]:
+        if stem.endswith(suffix):
+            names.add(stem[:-len(suffix)])
+    return sorted(n for n in names if n)
+
+
+def iter_test_files():
+    for test_dir in TEST_DIRS:
+        if test_dir.exists():
+            yield from (p for p in test_dir.rglob("*") if p.is_file())
+
+
+def has_related_test(path: Path) -> bool:
+    test_files = list(iter_test_files())
+    if not test_files:
+        return False
+
+    test_names = [p.name.lower() for p in test_files]
+
+    for name in candidate_names(path):
+        for pattern in TEST_PATTERNS:
+            if pattern.format(name=name).lower() in test_names:
+                return True
+        for test_name in test_names:
+            if name in test_name and ("test" in test_name or "gtest" in test_name):
+                return True
+    return False
+
+
+def verify_commit_signature(commit: str):
+    env = os.environ.copy()
+    env["GIT_CONFIG_COUNT"] = "1"
+    env["GIT_CONFIG_KEY_0"] = "gpg.ssh.allowedSignersFile"
+    env["GIT_CONFIG_VALUE_0"] = str(ALLOWED_SIGNERS_FILE)
+
+    subprocess.check_call(
+        f"git verify-commit {commit}",
+        shell=True,
+        env=env,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+
+
+def main():
+    require_clang_format()
+    require_allowed_signers()
+
+    files, base = changed_files_and_base()
+    if not files:
+        print("Keine geänderten Dateien erkannt.")
+        return
+
+    commits = commits_in_range(base)
+    if not commits:
+        print("Keine neuen Commits im Vergleichsbereich erkannt.")
+    else:
+        for commit in commits:
+            print(f"Prüfe SSH-Signatur: {commit}")
+            try:
+                verify_commit_signature(commit)
+            except subprocess.CalledProcessError:
+                print(
+                    "ERROR: Commit ist nicht gültig mit erlaubtem SSH-Signierer signiert: "
+                    f"{commit}"
+                )
+                sys.exit(1)
+
+    for rel in files:
+        path = ROOT / rel
+        if not path.exists():
+            continue
+        if is_cpp_file(path):
+            print(f"Prüfe: {rel}")
+            try:
+                check_format(path)
+            except subprocess.CalledProcessError:
+                print(f"ERROR: Formatfehler in {rel}")
+                sys.exit(1)
+
+            if not has_related_test(path):
+                print(
+                    "ERROR: Kein passender Test unter tests/, test/ oder "
+                    "qt6-after/qt6-migrated-benchmark/tests/ gefunden für: "
+                    f"{rel}"
+                )
+                sys.exit(1)
+
+    print("PR-Policy-Prüfungen erfolgreich.")
+
+
+if __name__ == "__main__":
+    main()