Repository navigation
fix(k9): preserve conformance evidence and publish compact status reports - #1273
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 38 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
5048949 to
0db2822
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
|
Autofix was enabled. Check current status in the Coding task. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0db2822073
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| fetch-depth: 0 | ||
| ref: ${{ github.event.pull_request.head.sha || github.sha }} |
There was a problem hiding this comment.
When the target branch has advanced since the PR branch was created, checking out pull_request.head.sha makes every structural and conformance check run against the contributor's standalone head rather than GitHub's synthetic merge commit. A PR can therefore receive the required green check even though the tree that would be merged with the current base violates these checks; retain the merge checkout for validation and pass the head SHA separately for report identity and changed-file calculations.
Useful? React with 👍 / 👎.
| const dirty = execute(root, 'git', ['diff', '--quiet', 'HEAD']).code !== 0; | ||
| return { schema: VERSION, profile, tools, dirty, generated: new Date().toISOString(), sha: env.K9_HEAD_SHA || execute(root, 'git', ['rev-parse', 'HEAD']).output.trim(), run: env.GITHUB_RUN_ID || 'local', pr: env.PR_NUMBER || 'local', url: env.GITHUB_RUN_ID ? `https://github.com/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : '', categories, state: state(all), counts: counts(all) }; | ||
| } | ||
| const escape = s => String(s).replace(/[&<>|`]/g, c => ({ '&': '&', '<': '<', '>': '>', '|': '|', '`': '`' }[c])).replace(/\r?\n/g, ' '); |
There was a problem hiding this comment.
For a PR containing a K9 filename or diagnostic-controlled value with Markdown such as x** [label](https://example.invalid), this function escapes HTML delimiters but leaves Markdown control characters such as []()*_! and mentions untouched. Because render() interpolates the result directly into the bot's PR comment rather than a code block, a contributor can inject rendered links, images, mentions, or text that visually spoofs the conformance report; escape GitHub-flavored Markdown as well or render these values as code.
Useful? React with 👍 / 👎.
| gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \ | ||
| | jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .body // ""' \ | ||
| > "$RUNNER_TEMP/k9-previous.md" |
There was a problem hiding this comment.
If the comments API is temporarily unavailable, rate-limited, or denied, set -euo pipefail makes this newly added lookup step fail the required job even though the previous report is optional and the renderer already supports a missing baseline as no comparable baseline. The evidence collector still runs because of always(), so its report can be green while the required check remains red solely because comparison history could not be fetched; handle this lookup failure by writing an empty baseline and continuing.
Useful? React with 👍 / 👎.
| - name: Install reporting runtime | ||
| if: ${{ always() }} | ||
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 |
There was a problem hiding this comment.
When setup-bun changes its default release, this required workflow silently begins running both the reporting regression tests and the DEED validator under a different runtime, so an upstream Bun release can break or alter conformance results without any repository change; it also changes the recorded profile and discards otherwise comparable baselines. The repository's other runtime lanes explicitly pin Bun 1.4.2, so this setup step should likewise specify a reviewed bun-version rather than following the action's moving default.
Useful? React with 👍 / 👎.
1 participant
The current K9 report posts entire logs on every run and can hide validator failures. This change preserves subprocess exit status and per-file evidence, then publishes one compact, updatable DEED–K9 report.
The table covers DEED syntax, the K9 contract typecheck, validator self-tests, positive/negative controls and the live L0–L2 corpus. It shows pass/fail/indeterminate/N/A counts, comparable-revision arrows and expandable findings. Colours distinguish blocking failures, incomplete evidence, advisory debt, success and explicit scope exclusions. The badge names its syntax/L0–L2 scope; it does not certify signatures or metadata truth.
Full JSON, tool versions and logs are written under tests/conformance/YYYY-MM-DD/pr-N/run-ID-ATTEMPT and uploaded as a 90-day artifact. Existing report comments are updated rather than appended. A generated lock-membership update reuses already-resolved action pins; no dependency digest changed.
Validation:
Stacked on #1272 to use its repo deed. This PR does not change normative K9 rules or loosen branch protections. Reporting documentation and implementation live in 1-formats/k9/tools/.