Repository navigation
fix(ci): close remaining review findings from #1285 - #1291
Conversation
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 38 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
…1305) ## Summary Follow-up to #1239. SonarCloud's quality gate passed on #1239 but reported **1 new issue**. The session that wrote #1239 could not open the finding, because its proxy blocks sonarcloud.io. The only conditional #1239 added is `if [ "$got" = "0" ]` in `scripts/tests/apply-baseline-test.sh`, the guard that keeps an `invalid_actions_lock` ack out of the shipped baseline. #1291 answered the same Sonar rule elsewhere in this repo with Bash `[[ ... ]]`, so this PR does the same to this one line: ```diff - if [ "$got" = "0" ]; then + if [[ "$got" == "0" ]]; then ``` The rest of the file is unchanged. ## Testing | Check | Result | |---|---| | `bash scripts/tests/apply-baseline-test.sh` | 52 passed, 0 failed | | Mutation: an `invalid_actions_lock` ack restored to a copy of `.hypatia-baseline.json` | 2 FAIL, exit 1. The guard still fails on its target. | | `.githooks/pre-commit` and `commit-msg` | passed, including gitleaks, SPDX and validate-actions-lock | **Unconfirmed:** I could not read the Sonar finding itself, so this PR's Sonar run is the confirmation. If Sonar still reports a new issue here, it was something else and I'll follow up. --- _Generated by [Claude Code](https://claude.ai/code/session_01TbbnKqskQA5mj5gfMniPzi)_ Co-authored-by: Claude <noreply@anthropic.com>
1 participant
Follow-up to #1285, which was merged as
cf8f912while these final review findings were still outstanding.Changes
@(for example,release@2026) and add an offline regression fixture. The existing build-metadata (+) case remains covered.[[ ... ]]in the conditions flagged by Sonar, and retain the explicit fail-closed identity refusal when either identity grep has no matches. Add regression cases for missing local and source identity fields.persist-credentials: falseon all seven mirror reusable checkout steps, addressing the Zizmorartipackedwarning; mirror pushes use their explicit external credentials.The paginated fail-closed tag lookup and the scanner lock-section boundary fix were already included in #1285.
Validation
scripts/tests/close-lock-test.sh: 26 passedscripts/tests/relock-standards-pin-test.sh: passed, including both missing-identity casestests/test_secret_scanner_no_inherit.sh: passed (77 workflows, 60 lock sections)scripts/tests/relock-sha-keys-test.sh: 12 passedscripts/tests/complete-job-refs-test.sh: 16 passedscripts/tests/regen-dependabot-locks-test.sh: 59 passedbash -nandgit diff --check: passedThe two local suites requiring
yq(lock-selfcheck-test.shandvalidate-actions-lock-test.sh) could not run in this environment becauseyqis not installed; the corresponding lock/self-consistency checks passed on #1285.