fix(scripts): re-apply audit-gap hardening onto sanitized main - #1
Open
opencdlee-dotcom wants to merge 4 commits into
Open
fix(scripts): re-apply audit-gap hardening onto sanitized main#1opencdlee-dotcom wants to merge 4 commits into
opencdlee-dotcom wants to merge 4 commits into
Conversation
…ntake + narration - gh_handoff: per-call 120s subprocess timeout + top-level TimeoutExpired routed through _friendly; merge auth/repo-create/repo-view stdout into stderr before friendly translation so token redaction covers either stream. - registry_verify: warn on non-404 HTTP errors (401/403/5xx) instead of silently returning "exists"; still fail-open so transient registry issues do not block installs. - intake_handler: 100KB upfront cap in _extract_subtools to bound regex/slice work on pathological inputs. - narration: capture_subprocess timeout path bounds proc.wait(5s), explicitly closes stdout/stderr pipes to unblock _drain_stream readline(), and joins with 10s timeout so a stuck reader can never hang the build. All 224 tests pass, 2 skipped. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The `test` job has failed on main since 2026-05-06: CI runs `uv sync --frozen`, which requires a committed lockfile, but uv.lock was never tracked. Every run died at "Unable to find lockfile at `uv.lock`, but `--frozen` was provided" before a single test executed. Generated with `uv lock` (uv 0.11.6, CPython 3.13) and verified against the exact CI sequence: `uv sync --frozen` then `uv run pytest` -> 224 passed, 2 skipped, 4 deselected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`uv sync --frozen` installs only the main dependency set; pytest and ruff live in `[project.optional-dependencies].dev`, so the runner reached `uv run pytest` with no pytest on PATH and died with "Failed to spawn: `pytest`". Combined with the missing lockfile, the test job has never executed a single test. Adds `--extra dev` to the sync step. Verified against a clean environment (UV_PROJECT_ENVIRONMENT set to an empty path, pytest 9.1.1 installed fresh): `uv sync --frozen --extra dev` then `uv run --frozen pytest` -> 224 passed, 2 skipped, 4 deselected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ion is hermetic `_detect_version_managers` probes the real home directory (`(Path.home() / ".nvm").exists()`, same for .pyenv/.asdf/...), but nine tests in test_preflight.py called `plan()`/`detect()` without isolating HOME. On any machine that has a version manager installed the node/python install actions are suppressed as "blocked by VM", so `test_macos_uses_brew` asserted on an empty action list. This never surfaced because CI could not run tests at all until the previous two commits; GitHub's Linux runners ship nvm at ~/.nvm, so the very first real run failed there while passing on a dev Mac without ~/.nvm. Fix adds the existing `tmp_install_log` fixture — which already does the HOME isolation via monkeypatch.setenv + Path.home — to the nine tests that lacked it. The fixture was already used this way by the tests that passed; no new abstraction, no assertion changed, no test skipped. Verified `uv run pytest` -> 224 passed, 2 skipped, 4 deselected under three homes: a normal home, a home with ~/.nvm (reproduces the CI failure), and a home with ~/.nvm + ~/.pyenv + ~/.asdf. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-applies hardening that existed only in the local checkout (pre-history-scrub) onto
the current sanitized
main, then repairs the CI pipeline it revealed.1.
fix(scripts)— audit-gap hardeninggh_handoff.py— per-subprocesstimeout=120son everygh/gitcall so a flakyuplink can't hang the build; merges
stderr+stdoutforgh auth status/gh repo create/gh repo viewso the friendly translator sees the whole messageregardless of which stream the CLI version uses;
TimeoutExpiredhandled atmain().intake_handler.py— upfront 100 KB truncation guard against pathological payloads.narration.py,registry_verify.py— matching timeout + error-path fixes.Cherry-picked rather than pushed:
mainwas history-scrubbed remotely (personal email→ noreply,
/Users/charlie→/Users/user), and the local branch still carried thepre-scrub history, so pushing it would have re-introduced the scrubbed identifiers into
public history. Re-authored under the noreply address; tree scanned clean.
2.
fix(ci)— the test job had never run a single testTwo independent breaks, both pre-existing since 2026-05-06:
uv.lockwas never committed, souv sync --frozendied with "Unable to findlockfile" before any test.
uv run pytestdied with "Failed to spawn:pytest" — pytest livesin
[project.optional-dependencies].dev, which plainuv syncdoesn't install. Added--extra dev.3.
fix(tests)— the first real run exposed a non-hermetic test_detect_version_managersprobes the real home ((Path.home() / ".nvm").exists()), butnine tests called
plan()/detect()without isolatingHOME. GitHub's Linux runnersship nvm at
~/.nvm, so node installs were suppressed as "blocked by VM" andtest_macos_uses_brewasserted on an empty list — while passing on a dev Mac without~/.nvm. Fixed by adding the repo's existingtmp_install_logfixture (which alreadydoes HOME isolation) to those nine tests. No assertion changed, no test skipped or
weakened, no new abstraction.
Verification
uv sync --frozen --extra dev+uv run pytest→ 224 passed, 2 skipped, 4 deselected,reproduced locally under three homes: normal,
~/.nvmpresent (reproduces the CIfailure), and
~/.nvm+~/.pyenv+~/.asdf. CI on this branch: both jobs green.🤖 Generated with Claude Code