You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(ci): move the static analysis scanner pin to panic-attack 55ffcc9 - #497
static-analysis-gate.yml pins panic-attack f2a6a70. This PR moves PANIC_ATTACK_REF to 55ffcc9a240e937edd968487af15ab45c6f0522f (panic-attack main, the same commit as Security Scan since PR 491).
55ffcc9 includes hyperpolymath/panic-attack#278. It anchors Lean and Isabelle sorry findings to their line, so the inline panic-attack: accepted markers on the 2 detector fixtures under tests/corpus_fixtures/ now apply.
Changes
.github/workflows/static-analysis-gate.yml: the pin and its comment. bridge-gate.yml reads the same pin. src/bridge/ and the Patch Bridge schema (0.3.0) did not change between the 2 commits.
Both fixture sorry findings (isabelle/Smoke.thy:21, minif2f/algebra.lean:11) are suppressed: true.
Not in this PR: the 2 entries that PR 489 added to audits/assail-classifications.a2ml for the same fixtures. With this pin the inline markers already cover them, so they can be removed in a follow-up if you want.
55ffcc9 is panic-attack main. It includes panic-attack#278, which
anchors Lean and Isabelle `sorry` findings to their line, so the inline
`panic-attack: accepted` markers on the 2 detector fixtures apply.
bridge-gate.yml reads the same pin. src/bridge/ and the Patch Bridge
schema (0.3.0) did not change between f2a6a70 and 55ffcc9.
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6
Signed-off-by: Claude <noreply@anthropic.com>
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 5518ce01-0216-4921-8e48-ff5e57f0513d
Commits
Reviewing files that changed from the base of the PR and between 453fe3b and 33ff4ee.
Files selected for processing: 1
.github/workflows/static-analysis-gate.yml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Context from checks skipped due to timeout: 6
GitHub Check: rust-ci / Cargo test
GitHub Check: semgrep-cloud-platform/scan
GitHub Check: CodeRabbit
GitHub Check: rust-ci / llvm-cov line coverage
GitHub Check: panic-attack assail
GitHub Check: PR (address)
Additional context used
Code guidelines: 1
CLAUDE.md — auto-discovered
Path-based instructions: 1
Source excerpt: **Version + release history**: [`CHANGELOG.adoc`](CHANGELOG.adoc) (single source of truth; do not duplicate version strings elsewhere)
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
static-analysis-gate.ymlpins panic-attackf2a6a70. This PR movesPANIC_ATTACK_REFto55ffcc9a240e937edd968487af15ab45c6f0522f(panic-attackmain, the same commit as Security Scan since PR 491).55ffcc9includes hyperpolymath/panic-attack#278. It anchors Lean and Isabellesorryfindings to their line, so the inlinepanic-attack: acceptedmarkers on the 2 detector fixtures undertests/corpus_fixtures/now apply.Changes
.github/workflows/static-analysis-gate.yml: the pin and its comment.bridge-gate.ymlreads the same pin.src/bridge/and the Patch Bridge schema (0.3.0) did not change between the 2 commits.RSR Quality Checklist
Required
bash scripts/ci/test-static-analysis-evidence.shgives 59 receipt controls passed.unsafeblocks without// SAFETY:comments.envfiles includedAs Applicable
Testing
On a clean checkout of this commit, with the scanner built by
cargo install --git … --rev 55ffcc9… --locked --features http(the gate's own command):static-analysis-evidence.sh scan panic-attack:status: ran, exit 0, counts 0 critical, 43 high, 64 medium, 1 low.static-analysis-evidence.sh gate: exit 0.sorryfindings (isabelle/Smoke.thy:21,minif2f/algebra.lean:11) aresuppressed: true.Not in this PR: the 2 entries that PR 489 added to
audits/assail-classifications.a2mlfor the same fixtures. With this pin the inline markers already cover them, so they can be removed in a follow-up if you want.Screenshots
Not applicable.
Generated by Claude Code