Repository navigation
fix: CodeRabbit auto-fixes for PR #764 - #1281
coderabbitai[bot] wants to merge 4 commits into
Conversation
Fixed 3 file(s) based on 2 failed pre-merge checks. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
|
Important Review skippedThis PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again. ⚙️ Run configuration
You can disable this status message by setting the
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6388705d00
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # `informational`. Without these, research findings can never be | ||
| # acknowledged and the baseline gate can never go green on them. | ||
| def sevs: ["critical","high","medium","warn","low","info","informational"]; | ||
| def sevs: ["critical","high","medium","low","info"]; |
There was a problem hiding this comment.
The inspected Hypatia workflow accepts warn and informational, and the authoritative baseline schema permits both, but this validator now rejects them. The repository's own .hypatia-baseline.json contains numerous warn entries, so whenever a nonempty scan invokes this script, it exits 2 before filtering any findings and breaks the baseline-backed gate.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@hyperpolymath I’ll route this fix to the coding workflow.
- Restore
warnandinformationalin thesevslist inscripts/apply-baseline.sh. - Check that the validator matches the authoritative baseline schema and scanner vocabulary.
- Add regression tests for both aliases, including suppression, severity overrides, and blocking ranks.
The fix is not yet implemented or verified.
Failed to start Coding Agent task. Please try again.
You are interacting with an AI system.
There was a problem hiding this comment.
@hyperpolymath I’ll retry the coding workflow for this fix. The previous attempt did not start.
- Restore
warnandinformationalin the baseline validator. - Check consistency with the baseline schema and scanner.
- Add regression tests and run them in the coding workflow.
The fix is not yet implemented or verified.
Failed to start Coding Agent task. Please try again.
You are interacting with an AI system.
| (["severity","rule_module","type"][] | ||
| | select(($e[.]|type) != "string") | ||
| | "entry[\($i)]: required key \(.) missing or not a string"), |
There was a problem hiding this comment.
The authoritative schema and format documentation allow rule_module to be a nonempty string array so one acknowledgement can cover the same defect emitted by multiple modules. Requiring this field to be a string rejects those valid baselines with exit 2; validation must retain the array form, and matching must test membership rather than exact array-to-string equality.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
📌 Tracking this review finding. CodeRabbit will verify future changes against the original feedback and will only mark it fixed when the code satisfies it.
| (.rule_module | if type == "array" then . else [.] end) | ||
| | any(. == $finding.rule_module) | ||
| ) | ||
| .severity == $finding.severity |
There was a problem hiding this comment.
For legacy acknowledgements written with warn, Hypatia now emits the same findings as medium; exact equality therefore marks an acknowledged finding as new and can fail a blocking gate. The existing baseline regression suite explicitly covers matching these two representations in both directions, so the severity-tier normalization should remain.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@hyperpolymath I’ll start the code-change workflow to restore warn ↔ medium compatibility.
- Restore severity-tier normalisation in
scripts/apply-baseline.sh. - Ensure baseline validation accepts legacy
warnentries and stays aligned with.machine_readable/hypatia-baseline.schema.json. - Check regression coverage for both matching directions and blocking-gate behaviour.
Failed to start Coding Agent task. Please try again.
You are interacting with an AI system.
There was a problem hiding this comment.
@hyperpolymath I’ll retry the code-change workflow with the following scope.
- Restore
warn↔mediumbaseline matching. - Accept legacy
warnbaseline entries in both validation layers. - Verify regression coverage and blocking-gate behaviour.
Failed to start Coding Agent task. Please try again.
You are interacting with an AI system.
| # invalid element shape, unknown severity, and multiple JSON documents | ||
| ['', " \n", '[', '{}', 'null', '[{}]', '[{"severity":"unknown"}]', '[] []', "[]\n[{\"severity\":\"high\"}]"].each do |invalid| | ||
| # Test invalid inputs - flat array format | ||
| ['', '[', '[]', '[{}]', '[{"severity":"unknown"}]'].each do |invalid| |
There was a problem hiding this comment.
A clean scan legitimately produces [], and the workflow under test explicitly accepts it and emits zero counts. Adding [] to this invalid-input loop therefore makes science-ci-security-test.rb fail every time; the inspected self-test.yml discovers and runs its shell wrapper, so this change leaves the required self-test job red.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
📌 Tracking this review finding. CodeRabbit will verify future changes against the original feedback and will only mark it fixed when the code satisfies it.
|
|
||
| if (( MAX_KEPT_RANK >= THRESHOLD_RANK )); then | ||
| echo "::error::Gate failed: $BLOCKING_COUNT unfiltered finding(s) at or above '$BLOCKING_THRESHOLD' ($KEPT_COUNT kept in total)." >&2 | ||
| echo "::error::Gate failed: $KEPT_COUNT unfiltered finding(s) at or above '$BLOCKING_THRESHOLD'." >&2 |
There was a problem hiding this comment.
When kept findings contain mixed severities, this message reports every kept finding as being at or above the threshold. For example, one high plus one info at a high threshold reports two blocking findings even though only one qualifies, producing misleading gate diagnostics; retain a separate at-or-above-threshold count.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
📌 Tracking this review finding. CodeRabbit will verify future changes against the original feedback and will only mark it fixed when the code satisfies it.
|
Add Carrot credits or activate Agent usage billing to use Autofix |
|
This branch has not been deployed
1 participant
This follow-up PR contains CodeRabbit auto-fixes for #764.
Files modified:
scripts/apply-baseline.shscripts/plan-ruleset-constraint-repair.rbscripts/tests/science-ci-security-test.rb