You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(k9): satisfy the K9 validator in three contracts - #169
The Dogfood Gate's Validate K9 contracts job (k9-ecosystem/validate-action) fails on main with four errors:
File
Error
config/build.k9.ncl
Missing K9 format marker
config/rust-fmt.k9.ncl
Missing K9 format marker
config/rust-fmt.k9.ncl
Pedigree block missing 'name' field
setup-dev-env.k9.ncl
Hunt-level K9 file must include a 'signature' or 'signature_required' field
Changes
config/build.k9.ncl, config/rust-fmt.k9.ncl:
The K9! preamble was on line 2, under the SPDX comment. The validator needs it as the first non-empty line, as the contractiles/self-validating/template-*.k9.ncl files lay it out. It now comes first, with SPDX second.
Both pedigrees now carry a name.
setup-dev-env.k9.ncl is a Hunt component: it runs installers and shell commands. Its pedigree now declares signature_required = true, as template-hunt.k9.ncl does.
Testing
I ran the current k9-ecosystem validator (with the action's default ignore list) locally on this branch: 10 files scanned, 0 errors. On main it reports 4 errors.
The Dogfood Gate's "Validate K9 contracts" job (k9-ecosystem/validate-action)
fails on main with four errors:
- config/build.k9.ncl, config/rust-fmt.k9.ncl: "Missing K9 format marker".
The K9! preamble sat on line 2, under the SPDX comment; the validator
requires it as the first non-empty line, which is how the contractiles
templates lay it out. K9! now comes first, SPDX second.
- config/rust-fmt.k9.ncl: "Pedigree block missing 'name' field". Both config
contracts now carry a pedigree name.
- setup-dev-env.k9.ncl: "Hunt-level K9 file must include a 'signature' or
'signature_required' field". It is a Hunt component (it runs installers
and shell commands), so its pedigree now declares signature_required =
true, as contractiles/self-validating/template-hunt.k9.ncl does.
The validator now reports 10 files scanned, 0 errors.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Chores
Added and updated automated fuzz-testing setup, including runtime options for parser testing.
Updated build and development configuration metadata.
The changes add a ClusterFuzzLite Dockerfile, select inputs for the container build, and update fuzz target and runtime-option copying. They also update pedigree metadata in three K9 configuration files.
The Containerfile copies the manifest, lockfile, source, benches, crates, fuzz files and .clusterfuzzlite directory separately. The new Dockerfile sets a pinned Rust base-builder image, working directory and build script.
The build script copies fuzz target binaries from fuzz/target/x86_64-unknown-linux-gnu/release/ and copies an options file when one exists. The parser options disable leak detection for libFuzzer and AddressSanitizer.
The build and Rust format configurations gain pedigree names. The Rust format directive moves before the SPDX comment. The development environment configuration sets signature_required to true.
No concrete merge-blocking defect was verified; the PR is mergeable with normal ClusterFuzzLite execution checks.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title names the main change: it fixes the K9 validator errors in three contract files. The changeset edits those three K9 contracts (the K9! marker order, the pedigree name fields and signature_re…
Description check
The description states the four validator errors and explains each fix for the three K9 contracts. It describes the local validator run and the test result. It is related to the changeset.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: it fixes the K9 validator errors in three contract files. The changeset edits those three K9 contracts (the K9! marker order, the pedigree name fields and signature_required). The title does not mention the ClusterFuzzLite and SonarCloud commits, but the title does not need to cover every detail.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (6 skipped: 6 unsupported.)
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 6282f8b8-6a7e-46d6-9235-b04778a0f41b
Commits
Reviewing files that changed from the base of the PR and between e436fd4 and f73ee73.
Files selected for processing: 7
.clusterfuzzlite/Containerfile
.clusterfuzzlite/Dockerfile
.clusterfuzzlite/build.sh
.clusterfuzzlite/fuzz_parser.options
config/build.k9.ncl
config/rust-fmt.k9.ncl
setup-dev-env.k9.ncl
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Context from checks skipped due to timeout: 4
GitHub Check: CodeRabbit
GitHub Check: PR (address)
GitHub Check: semgrep-cloud-platform/scan
GitHub Check: Analyze (rust)
Additional context used
Checkov (3.3.30)
.clusterfuzzlite/Dockerfile
[low] 1-22: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[low] 1-22: Ensure that a user for the container has been created
(CKV_DOCKER_3)
GitHub Check: SonarCloud Code Analysis
.clusterfuzzlite/Dockerfile
[warning] 8-8: This image might run with "root" as the default user. Make sure it is safe here.
… build
ClusterFuzzLite fails in build_fuzzers on every PR, for three reasons:
- It runs `docker build -f .clusterfuzzlite/Dockerfile`, but the directory
only had a Containerfile. Add a Dockerfile that mirrors it (same pinned
base-builder-rust digest). The Containerfile stays for podman-first
local builds.
- build.sh copied targets from ./target/..., but cargo-fuzz writes them
to ./fuzz/target/x86_64-unknown-linux-gnu/release/. The copy failed with
"cannot stat".
- Once built, fuzz_parser reported a leak on its first input (a single
newline). The leak comes from nickel-lang-parser, which allocates AST
nodes in a bumpalo arena that never runs destructors, so strings in
those nodes always leak. Add fuzz_parser.options turning off leak
detection for libFuzzer and ASan, and have build.sh copy each target's
.options file to $OUT. ASan still reports memory-safety errors.
Verified locally with the same base image:
- The compile finishes and $OUT contains fuzz_parser.
- A 90-second fuzz run (615 executions) produced no crashes.
- With both leak switches off, the run exits 0 with no artifacts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
(cherry picked from commit 3f5120d)
SonarCloud failed this PR on a D security rating for new code:
- Dockerfile:10 "Copying recursively might inadvertently add sensitive
data to the container." `COPY . $SRC/bunsenite` sent the whole
checkout, .git included, into the build image.
- build.sh:13 "Use '[[' instead of '['".
The image now copies only what the fuzz build reads:
- Cargo.toml and Cargo.lock
- src/
- benches/ (declared as [[bench]] targets)
- crates/ (the patched nickel-lang-vector)
- fuzz/
- .clusterfuzzlite/ (build.sh reads the per-target .options from there)
The Containerfile gets the same change, to stay in sync. Nothing in
these paths uses include_str!/include_bytes! on files outside them, and
`cargo metadata` resolves both manifests from that subset.
The "runs as root" warning stays as it is: the OSS-Fuzz base-builder
image needs root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
(cherry picked from commit bb33a7e)
ClusterFuzzLite PR (address) fails here for reasons unrelated to this PR. It also fails on main: the directory had no Dockerfile, the fuzz binary copy path was wrong, and an upstream nickel-lang-parser arena leak made every run report a crash.
#170 fixes all three, and its fuzz job is green. I've cherry-picked its two commits here (d402894 and f73ee73). Git will drop the duplicate changes whichever PR merges first.
SonarCloud (B security rating). The cause is a single hotspot that arrived with the ported ClusterFuzzLite commits: .clusterfuzzlite/Dockerfile:8, "might run with root". It is the same item already explained on #170. The OSS-Fuzz base-builder-rust image compiles into $OUT as root, so adding a USER line would break the fuzz build. The hotspot needs a maintainer to mark it "Safe" in SonarCloud.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
What was wrong
The Dogfood Gate's Validate K9 contracts job (
k9-ecosystem/validate-action) fails onmainwith four errors:config/build.k9.nclconfig/rust-fmt.k9.nclconfig/rust-fmt.k9.nclsetup-dev-env.k9.nclChanges
config/build.k9.ncl,config/rust-fmt.k9.ncl:K9!preamble was on line 2, under the SPDX comment. The validator needs it as the first non-empty line, as thecontractiles/self-validating/template-*.k9.nclfiles lay it out. It now comes first, with SPDX second.name.setup-dev-env.k9.nclis a Hunt component: it runs installers and shell commands. Its pedigree now declaressignature_required = true, astemplate-hunt.k9.ncldoes.Testing
I ran the current
k9-ecosystemvalidator (with the action's default ignore list) locally on this branch: 10 files scanned, 0 errors. Onmainit reports 4 errors.Generated by Claude Code