Skip to content

Validate community preset submissions before opening catalog PRs - #4787

Open
mnriem wants to merge 4 commits into
github:mainfrom
mnriem:mnriem-fix-4746-preset-submission-validation
Open

mnriem wants to merge 4 commits into
github:mainfrom
mnriem:mnriem-fix-4746-preset-submission-validation

Conversation

@mnriem

@mnriem mnriem commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator

Description

Closes #4746.

  • Add a deterministic verifier for the downloaded preset manifest, release tag, README install references, issue metadata, and resulting catalog and documentation files. It reads archive contents without executing them and supports preset-scoped manifests in monorepos.
  • Defer validation-passed and the draft catalog PR request until the generated files pass consistency and ordering checks. Distinguish confirmed submission mismatches from blocked checks and agent-generated files that need repair.
  • Regenerate the compiled workflow lock file and add positive and negative regression cases, including a stale --from URL alongside a valid --dev command, archive unavailability, and preserved created_at on updates.

Testing

  • .venv/bin/python -m pytest -q tests/test_community_preset_validation.py tests/test_github_workflows.py --tb=short (137 passed)
  • gh aw compile add-community-preset --no-check-update
  • Live submission workflow run (requires an issue labeled for maintainer automation)

AI Disclosure

  • I did not use AI assistance for this contribution
  • I did use AI assistance

AI disclosure: GitHub Copilot App, GPT-6 Sol (runtime-default reasoning effort), autonomously generated and tested the verifier, workflow updates, and regression tests at the contributors request. The contributor requested the commit and PR; no human line-by-line review or live workflow validation is claimed.

Compare published manifests and README release references with issue fields, then verify generated catalog and documentation before success labeling. Regenerate the workflow lock file and cover submission, blocked, and repair outcomes.

Refs github#4746

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings September 29, 2026 12:36

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

馃煛 Changes recommended

The verifier permits stale timestamps and misses stale URLs for some accepted scoped tags.

Review effort: Balanced
Findings: 1 High severity 路 1 Medium severity

Open (2)
What changed in this PR

Adds deterministic validation to prevent inconsistent community preset catalog PRs.

Changes:

  • Validates archives, manifests, README install URLs, metadata, and generated files.
  • Delays success labeling and PR creation until validation passes.
  • Adds regression coverage and regenerates the compiled workflow.
File Description
.github/鈥媠cripts/鈥媣alidate_community_preset.py Implements preset validation.
.github/鈥媤orkflows/鈥媋dd-community-preset.md Integrates validation and gating.
.github/鈥媤orkflows/鈥媋dd-community-preset.lock.yml Regenerates the compiled workflow.
tests/鈥媡est_community_preset_validation.py Adds validator regression tests.
tests/鈥媡est_github_workflows.py Verifies workflow gating behavior.

馃挕 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/scripts/validate_community_preset.py Outdated
Comment thread .github/scripts/validate_community_preset.py
@mnriem mnriem added the triage-can-wait Verdict: valid and in-scope but deprioritized; held behind the evidence gate label Sep 29, 2026
Record the submission UTC date and require generated catalog timestamps to match it; keep update creation dates intact. Detect stale README release links whose scoped tag prefix matches the submitted release, including ZIP archive URLs.

Refs github#4746

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings September 29, 2026 13:05
@mnriem

mnriem commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator Author

Review-round update (commit 6acc33db): the preset verifier now records the submission UTC date and checks generated catalog timestamps against it while preserving existing creation dates on updates. README release checks also recognize the submitted scoped tag prefix, so stale URLs cannot be masked by another accepted install command. Added regressions for both archive URL forms, stale new/update timestamps, and unrelated monorepo releases; the focused suite passed (143 tests), and the workflow lock was regenerated. The two review threads are left open for reviewer verification.

On behalf of @mnriem: GitHub Copilot App (GPT-6 Sol, runtime-default reasoning effort, autonomous) authored these code, workflow, and test changes and this review-round summary. No human line-by-line review or live workflow run is claimed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

馃煛 Changes recommended

The verifier can accept incomplete catalog metadata and incorrectly reject unrelated monorepo release URLs.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
Resolved since last review (2)
Previously missed (1)

In code that hasn't changed since last review

Medium severity Validate the homepage field in generated catalog entries

.github/鈥媠cripts/鈥媣alidate_community_preset.py:256

Include homepage in the validated snapshot. Step 4 requires this field for new catalog entries, and every current community preset has it, but generated() only compares keys present in expected; consequently a generated entry with a missing or stale homepage still passes. Since the issue form has no separate homepage field, the deterministic value here is the submitted repository URL.

Comment thread .github/scripts/validate_community_preset.py
Avoid treating unrelated unscoped monorepo release URLs as stale while retaining checks for matching preset scopes and release assets. Require generated catalog homepage to equal the submitted repository URL for new and updated presets.

Refs github#4746

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings September 29, 2026 13:26
@mnriem

mnriem commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator Author

Review-round update (commit 0007401e): unscoped monorepo README releases are now compared only when the submitted preset is identifiable by the same release asset (or by an unscoped archive tag from an unscoped submission); unrelated releases no longer fail validation. Generated catalog entries must also include homepage equal to the submitted repository URL, including updates. Added success and failure regressions for both cases, reran the focused suite (150 passed), and regenerated the workflow lock file. The review thread remains open for reviewer verification.

On behalf of @mnriem: GitHub Copilot App (GPT-6 Sol, runtime-default reasoning effort, autonomous) authored the verifier, workflow, and test changes in this round and this summary. No human line-by-line review or live workflow run is claimed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

馃煛 Changes recommended

README monorepo detection and documentation-table validation contain unresolved false-positive and consistency bugs.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
Resolved since last review (1)

Comment thread .github/scripts/validate_community_preset.py
Use the downloaded archive manifest count to apply bare-tag stale URL checks only when the archive contains one preset. Keep scoped tags and matching release assets checked, and document the monorepo exception with regression coverage.

Refs github#4746

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings September 30, 2026 21:24
@mnriem

mnriem commented Sep 30, 2026

Copy link
Copy Markdown
Collaborator Author

Review-round update (commit 33815e53): bare archive tags are now treated as belonging to the submitted preset only when the downloaded archive contains a single preset.yml. A multi-preset archive can therefore have another preset鈥檚 unscoped archive URL in its README without being marked stale; scoped tags and matching release assets remain checked. Added before/after regression coverage for the monorepo case and matching/stale single-preset archives, regenerated the workflow lock file, and ran the focused suite (153 passed). The review thread is left open for reviewer verification.

On behalf of @mnriem: GitHub Copilot App (GPT-6 Sol, runtime-default reasoning effort, autonomous) authored this verifier, workflow, and test update and this review-round summary. No human line-by-line review or live workflow run is claimed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

馃煛 Changes recommended

The verifier permits archive resource exhaustion and mishandles valid preset names containing pipes.

Review effort: Balanced
Findings: 1 High severity

Open (1)
Resolved since last review (1)
Previously missed (1)

In code that hasn't changed since last review

Medium severity Handle escaped pipes in preset names when parsing table rows

.github/鈥媠cripts/鈥媣alidate_community_preset.py:382

Escaped pipes in a valid human-readable preset name are still treated as table delimiters here. documentation_row() deliberately renders Data | Governance as Data \| Governance, but this split parses the name as Data \, so the generated phase can never pass for that submission. Split on unescaped delimiters and unescape the cell value; please add a regression case with a pipe in the preset name.

Comment on lines +109 to +114
manifest_count += 1
try:
if member.file_size > 1024 * 1024:
raise ValueError("preset.yml exceeds 1 MiB")
with archive.open(member) as stream:
data = yaml.safe_load(stream.read().decode("utf-8"))

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

triage-can-wait Verdict: valid and in-scope but deprioritized; held behind the evidence gate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add pre-PR consistency checks to the preset submission workflow

2 participants