Repository navigation
fix: CodeRabbit auto-fixes for PR #804 - #1279
coderabbitai[bot] wants to merge 1 commit into
Conversation
Fixed 1 file(s) based on 1 failed pre-merge check. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 505545f8f5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| yq -r '.. | select(tag == "!!map") | select(has("uses")) | .uses | select(tag == "!!str")' "$f" \ | ||
| || printf '\001UNPARSED\001%s\n' "$f" | ||
| done | grep -E $'@[0-9a-fA-F]{40}$|^\001UNPARSED\001' | sort -u | ||
| grep -rhoE '^[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*[^[:space:]#]+@[0-9a-fA-F]{40}' \ |
There was a problem hiding this comment.
When a workflow or composite uses valid KYAML flow syntax such as steps: [{uses: "owner/action@<sha>"}], this anchored regex does not see the ref; quoted block scalars retain their opening quote and are falsely reported missing. I reproduced the flow-mapping case against this commit: a deliberately unkeyed action was ignored and the validator exited 0. This regresses the parser-based handling required by 3-practice/YAML-POLICY.adoc:55-70 and allows the required lock-coverage gate to pass without checking every action.
Useful? React with 👍 / 👎.
| "denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed" | ||
| # A2ML is dead. security-gate-pr-target.yml still calls its | ||
| # secrets-check-action; locking it in would connect new machinery to it. | ||
| "hyperpolymath/a2ml-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d" |
There was a problem hiding this comment.
In the reviewed commit tree, a repo-wide git grep finds no use of this action and security-gate-pr-target.yml does not exist, so this newly added entry immediately produces a stale-exception warning on every successful validator run. Because stale entries only warn rather than increment ERRORS, it also remains as an allowlist that would silently exempt this exact dependency if it were later reintroduced; omit it until there is an actual consumer.
Useful? React with 👍 / 👎.
1 participant
This follow-up PR contains CodeRabbit auto-fixes for #804.
Files modified:
.githooks/validate-actions-lock.sh