Reject stale issue reproductions

* Verify reread bytes against the checked source hash before embedding a failed block.
* Refuse source-bearing drafts when the file changes or cannot be reread.

Author: claell

bibtexparser/cli.py

@@ -4,6 +4,7 @@
 import json
 import sys
 from collections.abc import Sequence
+from hashlib import sha256
 from pathlib import Path
 
 from . import __version__
@@ -124,18 +125,26 @@ def _run_check(args: argparse.Namespace) -> int:
         issue_url = build_issue_url(report)
         if args.include_source_in_issue_link:
             try:
-                source = args.file.read_bytes().decode(args.encoding)
-                reproduction = extract_reproduction_snippet(source)
-                if reproduction is None:
+                source_bytes = args.file.read_bytes()
+                if sha256(source_bytes).hexdigest() != report.source_sha256:
                     reproduction_notice = (
-                        "no exact bounded failed-block reproduction could be extracted; "
-                        "add a reviewed minimal example manually"
+                        "the file changed after the compatibility check; rerun the command"
                     )
                 else:
-                    reproduction_issue_url = build_issue_url(
-                        report,
-                        reproduction=reproduction,
-                    )
+                    source = source_bytes.decode(args.encoding)
+                    reproduction = extract_reproduction_snippet(source)
+                    if reproduction is None:
+                        reproduction_notice = (
+                            "no exact bounded failed-block reproduction could be "
+                            "extracted; add a reviewed minimal example manually"
+                        )
+                    else:
+                        reproduction_issue_url = build_issue_url(
+                            report,
+                            reproduction=reproduction,
+                        )
+            except OSError:
+                reproduction_notice = "the file could not be reread for a source-bearing draft"
             except (LookupError, UnicodeDecodeError):
                 reproduction_notice = "the selected encoding could not decode the source"
             except ValueError as error:

tests/test_cli.py

@@ -98,6 +98,34 @@ def test_explicit_source_link_contains_exact_failed_block(self, capsys):
         assert "WARNING" in output
         assert "terminal logs and browser history" in output
 
+    def test_changed_file_cannot_be_attached_to_an_outdated_report(self, capsys, monkeypatch):
+        """The reproduction and privacy-safe report must describe identical bytes."""
+        original_source = b"@article{private-record, title={Original}"
+        changed_source = b"@article{private-record, title={Changed}"
+        path = self._source_file(original_source.decode())
+        original_read_bytes = Path.read_bytes
+        reads = 0
+
+        def changing_read_bytes(candidate):
+            nonlocal reads
+            if candidate == path:
+                reads += 1
+                return original_source if reads == 1 else changed_source
+            return original_read_bytes(candidate)
+
+        monkeypatch.setattr(Path, "read_bytes", changing_read_bytes)
+        try:
+            status = main(["check", str(path), "--include-source-in-issue-link"])
+            output = capsys.readouterr().out
+        finally:
+            os.unlink(path)
+
+        assert status == 1
+        assert "file changed after the compatibility check" in output
+        assert "Issue draft with reproduction:" not in output
+        assert original_source.decode() not in output
+        assert changed_source.decode() not in output
+
     def test_json_report_can_omit_issue_link(self, capsys):
         """Applications receive stable structured output and can suppress the URL."""
         path = self._source_file("@article{private-record, title={Secret title}")