Repository navigation
fix(server): drop the unwraps in apply_tactic; mark the test fixture module - #490
Merged
Merged
Conversation
…module The Hypatia baseline gate fails with three unfiltered findings: * code_safety/unwrap_without_check in src/rust/server/session.rs. The handler checked state.is_none() and then unwrapped four times. Bind the state with let-else instead, take the goal counts from the values in hand, and clear goals through if-let on QED. Behaviour is the same. * code_safety/expect_in_hot_path and code_safety/panic_macro in src/rust/provers/test_fixture.rs. The module is compiled only under #[cfg(all(test, unix))] (provers/mod.rs); a failed fixture setup must fail the test. Hypatia strips only a trailing #[cfg(test)] block in the same file, so it cannot see this. Record that with file-level hypatia: allow directives rather than baseline entries. Checked with Hypatia main's code_safety scan: the three findings are present without this change and absent with it. cargo fmt --check and cargo clippy --lib -D warnings pass; cargo test --lib server passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 24 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Owner
Author
|
No fix exists yet, and it is outside this PR's scope. Generated by Claude Code |
hyperpolymath
marked this pull request as ready for review
November 10, 2026 17:55
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
3 tasks done
hyperpolymath
enabled auto-merge (squash)
November 10, 2026 18:09
|
1 task done
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
…0.2.0 (#495) ## Summary `governance / Actions lockfile verify` fails on main (d98b0e2). Every open PR fails it too, including #490 and #492. The governance gate installs `gh-actions-lock` v0.2.0. That version reports unused lockfile entries as errors (upstream github/gh-actions-lock#159). echidna's lockfile has 8 such entries: - job-level reusable-workflow calls in `governance`, `hypatia-scan`, `mirror`, `scorecard`, `secret-scanner`, `security-scan`, `spark-theatre-gate` and the SLSA publish workflow (standards, proven-cicd, panic-attack, slsa-github-generator); - the deleted `boj-build.yml`. The lockfile does not track reusable workflows. Each one stays SHA-pinned inline in its workflow file, which `workflow-linter` checks. ## Changes - `.github/workflows/actions.lock` only. I regenerated it with `gh-actions-lock` v0.2.0, built from `github/gh-actions-lock` at tag `v0.2.0`, with `--no-onboard --no-narrow`. - No workflow file and no step pin changes. A plain `gh actions-lock` run would also have rewritten 2 bare-SHA pins to refs, one of them to `@main`. I did not apply those rewrites. ## RSR Quality Checklist ### Required - [x] No secrets, credentials, or `.env` files included ## Testing - Before the change: `gh-actions-lock --verify-local` gives "8 of 34 workflows failed: 8 stale", the same entries as the CI failure. - After the change: "All 34 workflows have complete lockfile coverage." - The run printed "could not verify" warnings for some pins, because the tool's GraphQL calls are blocked in this session. Those pins are unchanged, and the runner re-checks them at job start. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Hypatia baseline gate fails with 3 unfiltered findings. This PR removes them at the source and adds no baseline entries.
Changes
src/rust/server/session.rs(code_safety/unwrap_without_check, high, a real finding):apply_tacticcheckedstate.is_none()and then called.unwrap()4 times. It now binds the state withlet ... else, takes the goal counts from the values it already holds, and clears the goals withif leton QED. The behaviour does not change.src/rust/provers/test_fixture.rs(code_safety/expect_in_hot_pathandcode_safety/panic_macro, false positives): the module compiles only under#[cfg(all(test, unix))], declared inprovers/mod.rs, and a failed fixture setup must fail the test. Hypatia removes only a trailing#[cfg(test)]block in the same file, so it cannot see that this whole module is test-only. I added 2 file-levelhypatia: allowdirectives with reasons. Hypatia's guidance prefers these to baseline entries.RSR Quality Checklist
Required
cargo test --lib server(2 passed)cargo fmt --checkon both filescargo clippy --lib -D warningsTesting
I ran Hypatia main's
code_safetycollector on echidna:unwrap_without_checkinsession.rs;expect_in_hot_pathandpanic_macrointest_fixture.rs).🤖 Generated with Claude Code
https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4