Skip to content

Track local advisory patches and fail incomplete Node audits - #29

Merged
omry merged 1 commit into
mainfrom
pr29
Oct 19, 2026
Merged

Track local advisory patches and fail incomplete Node audits#29
omry merged 1 commit into
mainfrom
pr29

Conversation

@omry

@omry omry commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Projects can now record advisories covered by local patches as an advisory ID or [advisory, comment] in localPatches. The audit infers affected packages and versions, preserves raw findings and patch files, and maintains one issue when a newer stable upstream fix is available. Unknown evidence leaves an existing notification open; the issue shows a bounded table with the complete evidence in its artifact.

Incomplete initial or final security audits now fail visibly and skip publication even when project checks pass. pnpm audits collect ignored advisories without changing the project’s ignore rules, and failed runs retain their summary and report.

Validation: 1,140 tests pass; Ruff lint/format and runtime type checks pass. Read-only cli.dev evidence correctly identifies image-size@2.0.2 and upstream 2.0.4 without changing project files. Regression coverage includes incomplete audits, compact configuration, inferred versions, issue lifecycle, large Unicode reports through the CLI, unknown registry evidence, and the data-only credential boundary.

Consumers must update both workflow pins before using localPatches. No installed repositories are changed by this PR.

@omry
omry marked this pull request as ready for review October 19, 2026 13:18
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-19T13:59:42.178411Z 58ba430 Manual request
🔒 Security Review ✅ Completed 2026-10-19T13:27:58.738563Z 96ae9f5 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:a7882cbfe017b07744105c7400b958a6c5d391706043d4dcc51006de43c7dd3a",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:a7882cbfe017b07744105c7400b958a6c5d391706043d4dcc51006de43c7dd3a",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 118098187188
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 118098187846
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 118098187946
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 118098187340
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 118098187449
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 118098187851
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 118098187524
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:470bd4d107a447482c2629ffaea894e85f00c14f07d373dd64404d88d4dbad7d",
      "operation_identity": "sha256:1e62fd30f13d79201242b986bc2897371b1d4d8a6047de43b65a418f48a0400c",
      "review_request": {
        "body_digest": "sha256:bd2831ca59a477d35c0c4b820546fd3f9c6b14c0e6337206bc48697afd36c4fb",
        "id": 6268935167
      },
      "review_result": {
        "body_digest": "sha256:86b7bc0afea2e43b3b6eb1301da8e773d74798c10a2b9328c6c31e32606708eb",
        "id": 6269014300
      }
    },
    "evidence_fingerprint": "sha256:d13a9fef574177e0b069072f5e038281c589674644a3d1da51746af004585b91",
    "head_sha": "58ba4306085af41025eab8d2f63e729c01b537d0",
    "operation_identity": "sha256:1e62fd30f13d79201242b986bc2897371b1d4d8a6047de43b65a418f48a0400c",
    "review_request_id": 6268935167,
    "review_result_id": 6269014300,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:a7882cbfe017b07744105c7400b958a6c5d391706043d4dcc51006de43c7dd3a",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "test",
      "run_id": 118098187188
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, npm, 11.9.0)",
      "run_id": 118098187846
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.20.0)",
      "run_id": 118098187946
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.21.0)",
      "run_id": 118098187340
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, npm, 11.9.0)",
      "run_id": 118098187449
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.20.0)",
      "run_id": 118098187851
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.21.0)",
      "run_id": 118098187524
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 118081483404,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081483404"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 118081484061,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081484061"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 118081483804,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081483804"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 118081483655,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081483655"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 118081483760,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081483760"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 118081483508,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081483508"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 118081483579,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39259009309/job/118081483579"
        }
      ],
      "head_sha": "96ae9f5b51c83b47f96c3e87058f464460f98084",
      "id": "sha256:52cf26ed59be7f12f13a730e6c101c3a23955da5811503fb43f10f566a329d8d",
      "required_checks": [
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 118090796297,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090796297"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 118090796663,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090796663"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 118090796755,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090796755"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 118090797142,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090797142"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 118090796747,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090796747"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 118090796617,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090796617"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 118090796558,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39261721725/job/118090796558"
        }
      ],
      "head_sha": "1f587de8b2b8922df5093a11984d61dd458d14cf",
      "id": "sha256:ac770755d394f9984f45262e6f7dc1fb01796bba54e16421674a58eb24d51e6c",
      "required_checks": [
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 118098187188,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187188"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 118098187846,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187846"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 118098187946,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187946"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 118098187340,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187340"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 118098187449,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187449"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 118098187851,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187851"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 118098187524,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39263842492/job/118098187524"
        }
      ],
      "head_sha": "58ba4306085af41025eab8d2f63e729c01b537d0",
      "id": "sha256:bc7e6fc1f2256153a0dc6718720d76b0e7435c3087584c201089e0fc90b45288",
      "required_checks": [
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [
    {
      "classification": "current-slice-defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314392367",
        "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314484551"
      ],
      "id": "codex-inline-4314392367",
      "invariant": "Accepted comment strings must render and encode as UTF-8 without aborting audit/report retention.",
      "proposed_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "rationale": "Unpaired surrogate reproduces accepted input followed by UnicodeEncodeError; reject it at declaration validation, which also governs report validation.",
      "source_url": "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314392367",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86t8FYO"
    },
    {
      "classification": "current-slice-defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314561026",
        "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314636657"
      ],
      "id": "codex-inline-4314561026",
      "invariant": "Published official release availability must be independent from automatic remediation and compatibility.",
      "proposed_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "rationale": "Reproduced by calling actual fixed_versions with complete audit evidence and controlled registry sets; direct correction preserves the agreed contract.",
      "source_url": "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314561026",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86t8fUg"
    },
    {
      "classification": "current-slice-defect",
      "evidence": [
        "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314561036",
        "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314636810"
      ],
      "id": "codex-inline-4314561036",
      "invariant": "Registry absence must not override an audit-reported affected version or close notifications under uncertainty.",
      "proposed_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "rationale": "Reproduced by calling actual fixed_versions with complete audit evidence and controlled registry sets; direct correction preserves the agreed contract.",
      "source_url": "https://github.com/hydra-ecosystem/github-actions/pull/29#discussion_r4314561036",
      "status": "fixed",
      "thread_id": "PRRT_kwDOVJzQB86t8fUp"
    }
  ],
  "pr": {
    "base_ref": "main",
    "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
    "body_digest": "sha256:bfce7fd8e28e478c1c8e301eec582ca9c76d1cf8a34ce000c93335b5a34458d7",
    "diff_digest": "sha256:04aa3fb17bb9bc1e1833bc30385b3aa5a4ce9763d2aa4565c65c9cc94700fc09",
    "head_ref": "pr29",
    "head_sha": "58ba4306085af41025eab8d2f63e729c01b537d0",
    "pr": 29,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:4fff93a7124d99e212ddf103178dd6f51a7d325df946ccf96ef50c8ff6bc62bc"
  },
  "record_version": 8,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-19T13:18:16Z",
      "base_ref": "main",
      "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
      "body_digest": "sha256:84ade4c3a093f89cbbb36366742449c0da1d3ee220ee427f7cbcd7819d661e78",
      "created_at": "2026-10-19T13:23:14Z",
      "head_sha": "96ae9f5b51c83b47f96c3e87058f464460f98084",
      "id": 6268270328,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-19T13:18:16Z",
      "base_ref": "main",
      "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
      "body_digest": "sha256:5bee0b04f785315be9108997a457da76d8e9999ba78d428f72f56b391ff24582",
      "created_at": "2026-10-19T13:40:37Z",
      "head_sha": "1f587de8b2b8922df5093a11984d61dd458d14cf",
      "id": 6268622989,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-19T13:18:16Z",
      "base_ref": "main",
      "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
      "body_digest": "sha256:bd2831ca59a477d35c0c4b820546fd3f9c6b14c0e6337206bc48697afd36c4fb",
      "created_at": "2026-10-19T13:55:48Z",
      "head_sha": "58ba4306085af41025eab8d2f63e729c01b537d0",
      "id": 6268935167,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "main",
      "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
      "body_digest": "sha256:8c4ca8f549c8c8a909277fb074edec483bf27936487943d6f3c53c6aa553ec3e",
      "commit_id": "96ae9f5b51c83b47f96c3e87058f464460f98084",
      "id": 5572272521,
      "inline_message_ids": [
        4314392367
      ],
      "request_comment_id": 6268270328,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-19T13:29:49Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86t8FYO"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
      "body_digest": "sha256:f729e0733a5fa31e2b70dc0e856c61eda97a59c34a99b659af92b7db7d25f985",
      "commit_id": "1f587de8b2b8922df5093a11984d61dd458d14cf",
      "id": 5572483699,
      "inline_message_ids": [
        4314561026,
        4314561036
      ],
      "request_comment_id": 6268622989,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-19T13:46:11Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOVJzQB86t8fUg",
        "PRRT_kwDOVJzQB86t8fUp"
      ]
    },
    {
      "base_ref": "main",
      "base_sha": "fc4a8057bdbf2c62a089c953fb6ea7fde2d35ca7",
      "body_digest": "sha256:86b7bc0afea2e43b3b6eb1301da8e773d74798c10a2b9328c6c31e32606708eb",
      "commit_id": "58ba4306085af41025eab8d2f63e729c01b537d0",
      "id": 6269014300,
      "inline_message_ids": [],
      "request_comment_id": 6268935167,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-19T13:59:40Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:a7882cbfe017b07744105c7400b958a6c5d391706043d4dcc51006de43c7dd3a",
  "rounds": [
    {
      "applied_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "disposition_changes": [
        "codex-inline-4314392367"
      ],
      "effective_diff_digest": "sha256:61b9ce85e89ecc675b95f5917afb5e0bee6d8a421b57ef99911815b39dbbf289",
      "finding_ids": [
        "codex-inline-4314392367"
      ],
      "invariants": [
        "Accepted local-patch comments must encode as UTF-8 without losing audit diagnostics or issue notifications."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "resulting_head": "1f587de8b2b8922df5093a11984d61dd458d14cf",
      "review_observation_id": null,
      "review_request_id": 6268270328,
      "review_result_id": 5572272521,
      "reviewed_head": "96ae9f5b51c83b47f96c3e87058f464460f98084",
      "root_cause": "Declaration validation allowed unpaired Unicode surrogate code points. Shared validation now rejects them before configuration acceptance or issue mutation.",
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "disposition_changes": [
        "codex-inline-4314561026",
        "codex-inline-4314561036"
      ],
      "effective_diff_digest": "sha256:04aa3fb17bb9bc1e1833bc30385b3aa5a4ce9763d2aa4565c65c9cc94700fc09",
      "finding_ids": [
        "codex-inline-4314561026",
        "codex-inline-4314561036"
      ],
      "invariants": [
        "Release availability is independent of automatic repair compatibility.",
        "Registry absence cannot override audit evidence or close an uncertain notification."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "node/runtime/local_patches.py",
        "node/tests/test_local_patches.py"
      ],
      "resulting_head": "58ba4306085af41025eab8d2f63e729c01b537d0",
      "review_observation_id": null,
      "review_request_id": 6268622989,
      "review_result_id": 5572483699,
      "reviewed_head": "1f587de8b2b8922df5093a11984d61dd458d14cf",
      "root_cause": "An automatic-remediation hint and currently published range membership were incorrectly treated as conclusive release/applicability evidence. Direct branches now query releases independently and retain uncertainty.",
      "round": 2,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        "codex-inline-4314561026",
        "codex-inline-4314561036"
      ],
      "effective_diff_digest": "sha256:04aa3fb17bb9bc1e1833bc30385b3aa5a4ce9763d2aa4565c65c9cc94700fc09",
      "finding_ids": [],
      "invariants": [
        "Compact assertions preserve raw security evidence and patch files.",
        "Official release availability is independent of compatibility; unknown evidence never closes notifications."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "58ba4306085af41025eab8d2f63e729c01b537d0",
      "review_observation_id": null,
      "review_request_id": 6268935167,
      "review_result_id": 6269014300,
      "reviewed_head": "58ba4306085af41025eab8d2f63e729c01b537d0",
      "root_cause": null,
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry

omry commented Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

@codex, regular review 96ae9f5

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 19, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 96ae9f5b51

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/local_patches.py
@omry

omry commented Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

@codex, regular review 1f587de

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 19, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f587de8b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread node/runtime/local_patches.py Outdated
Comment thread node/runtime/local_patches.py Outdated
@omry
Track local advisory patches and fail incomplete Node audits
58ba430 
Projects can now record advisories covered by local patches as an advisory ID or `[advisory, comment]` in `localPatches`. The audit infers affected packages and versions, preserves raw findings and patch files, and maintains one issue when a newer stable upstream fix is available. Unknown evidence leaves an existing notification open; the issue shows a bounded table with the complete evidence in its artifact.

Incomplete initial or final security audits now fail visibly and skip publication even when project checks pass. pnpm audits collect ignored advisories without changing the project’s ignore rules, and failed runs retain their summary and report.

Validation: 1,140 tests pass; Ruff lint/format and runtime type checks pass. Read-only cli.dev evidence correctly identifies image-size@2.0.2 and upstream 2.0.4 without changing project files. Regression coverage includes incomplete audits, compact configuration, inferred versions, issue lifecycle, large Unicode reports through the CLI, unknown registry evidence, and the data-only credential boundary.

Consumers must update both workflow pins before using localPatches. No installed repositories are changed by this PR.
@omry

omry commented Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

@codex, regular review 58ba430

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 58ba430608

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved label Oct 19, 2026
@omry
omry merged commit f48a435 into main Oct 19, 2026
14 checks passed
@omry
omry deleted the pr29 branch October 19, 2026 14:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry