You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(ci): initialize the shared scanner response fixture - #642
The shared Idris dependent scanner test fixture no longer initializes Mock.responses. Rust rejects the integration test with E0063 at tests/scan_tests.rs:352, so all-target compilation and the following tests cannot run. The same defect is present on current main and blocks dependency PRs #633–#637.
Actual failure: job 124701176251, with the same current-main failure in job 124813337915.
Change
Initialize the existing response override map with BTreeMap::new() in ready_mock. This is one source line; the real transport, assertions, dependency locks and vendored bot sources are unchanged.
Verification
The source and exact Git blob were inspected, and the one-line diff was read back. No local Rust execution is claimed. The existing idris-dependents hosted matrix must qualify this revision using its locked all-target build, tests, Clippy and formatting gates.
The older E2E closure defect has a separate fix already on main (#639). Echidnabot's vendored source pin, existing governance/security findings and dependency updates need their own verified dispositions; this PR does not suppress them.
Summary by CodeRabbit
Tests
Updated automated test setup to allow tests to provide custom mock responses while retaining the existing default mock behavior. This change affects test coverage and does not alter functionality available in the application.
Hosted follow-up
The da53 hosted locked build passed the original missing-field failure, then the existing edge-case suite exposed two stale assertions in job126927683205/run41931039453. Current412bcad784dd16193475a09ecfa614147dc6fa51 keeps hard-error rejection by using HTTP500 for that fixture (404 is intentionally recorded as a skipped URL), and includes the already public skippedUrls field in the exact JSON assertion. Existing scan_tests already exercises both raw paths for skipped404/410/451 and hard401/403/422/429/500/503; production behavior is unchanged.
Current412 requires its own full hosted result. Separate governance failures—canonical action allowlist, retained Python audit/test implementations and the older scanner/native-lock contract—remain open and are not waived by this test repair. The vendored Echidnabot dependency PR also needs its upstream source closure resolved independently.
The common test fixture omitted Mock.responses, preventing the existing all-target build from compiling scan_tests. Initialize the override map empty while retaining the ready rate-limit state and every existing assertion.
The existing Rust matrix supplies build, test, Clippy and formatting qualification; no new runtime pass is claimed.
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title "fix(ci): initialize the shared scanner response fixture" matches the change. The diff adds one line that initializes the mock's responses map as an empty BTreeMap in ready_mock, which…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title "fix(ci): initialize the shared scanner response fixture" matches the change. The diff adds one line that initializes the mock's responses map as an empty BTreeMap in ready_mock, which fixes the missing field error (E0063) that blocked the all-target build of tests/scan_tests.rs. The title names the main change and the affected fixture. It is specific and concise, and it does not list files or use vague wording.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Error committing Unit Tests locally.
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Reviewing files that changed from the base of the PR and between 64ebfbe and da53d54.
Files selected for processing: 1
idris-dependents/tests/scan_tests.rs
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Use HTTP 500 for the existing fatal raw-response control; documented
404/410/451 behavior is already covered by both-fetch-path controls.
Include the existing skippedUrls field in the exact serialized report.
Repairs the two assertions exposed after E0063 was fixed in hosted job
126927683205. No production behavior changes or local test pass claimed.
…644)
> **Update (2026-11-05):** `main`'s red CI was fixed independently by
#649, which merged the same three test repairs as this PR's first
commit. `main` has been merged in (`50a5b5f`, conflicts resolved to
`main`'s `ready_mock` plus this branch's superset `scan_edge_tests`).
Against `main`, this PR now **only adds** the review fixes below and
their tests:
> - Codex/CodeRabbit on #628: unterminated strings, GitHub-as-host,
case-insensitive `.gitmodules` keys, relative submodule URLs, HTTP error
bodies
> - Codex/CodeRabbit on this PR: relative URLs that climb into the host
(git-verified), owner pages with `?`/`#`, authority ending at `?`/`#`
(host spoofing)
>
> 87 tests pass. #642 is now fully superseded by #649.
## Why
Follow-up to #628. That PR merged while CodeRabbit's bot-generated tests
were failing, so **`build · test · clippy (idris-dependents)` has been
red on `main` since 2026-10-27**. This PR turns it green and closes the
review findings that were still open when #628 merged.
## Commit 1: repair the tests that broke `main`
All three are the defects CodeRabbit itself flagged in its last review
of #628:
- `scan_tests::ready_mock` was missing the new `responses` field (E0063,
so the target did not compile). It now takes the remaining fields from
`..Mock::default()`.
- The report JSON contract test lacked `skippedUrls`.
- The "hard failure" test used 404, which #628's own change now skips by
design. The hard failure uses 500, and the 404 skip is asserted
separately: empty rows, with the URL listed in `skipped_urls`.
This commit is green on its own: 79 tests, fmt and clippy, checked in an
isolated worktree.
## Commit 2: review findings from #628
| Finding | Source | Fix |
|---|---|---|
| `brief = "depends = proven` reported `proven` | Codex | An
unterminated string runs to EOF, so its contents are never read as
package syntax |
| `https://example.com/mirrors/github.com/<owner>/x` counted as HIGH |
Codex | GitHub must be the URL's **host**. Handles ports, userinfo,
`git+https` and scp form |
| `URL = …` in `.gitmodules` was ignored | Codex | Keys matched
case-insensitively, as git config does |
| `url = ../../<owner>/repo.git` was ignored | Codex | Relative URLs
resolved against the dependent repository, as git does. Climbing past
the host returns nothing |
| HTTP errors said only `HTTP 401` | CodeRabbit | A bounded body excerpt
(≤300 chars) is appended, e.g. "Bad credentials" |
Each fix has a regression test, and **all 5 fail on the previous
source** (checked by running them against `main`'s `src/`).
## Verification
- `cargo build --locked --all-targets` ✅ · `cargo test --locked`: **84
passed** ✅ · `cargo clippy -D warnings` ✅ · `cargo fmt --check` ✅
- Idris2 oracle, re-run because the lexer changed: `idris2 agrees on all
1003 cases` (Idris2 `0.8.0-d87ae51c3`, 3 fixtures and 1,000 generated
files)
## Not in this PR
- A live scan against GitHub still needs a token with code-search
access. This session's token is repo-scoped.
---
_Generated by [Claude
Code](https://claude.ai/code/session_01J4QvDfb1gn2SD218jMg9jk)_
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **Bug Fixes**
* GitHub references are now matched by host and repository owner,
avoiding false matches from unrelated URLs. Owner matching is
case-insensitive, and query strings and fragments are excluded from
repository paths.
* Relative submodule URLs are resolved against their GitHub superproject
when checking references.
* Unterminated quoted strings are consumed through the end of input.
* Failed content requests now include a trimmed portion of the response
body in error details. HTTP 404 responses are skipped without failing
the scan.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
_Generated by [Claude Code](https://claude.ai/code)_
---------
Co-authored-by: Claude <noreply@anthropic.com>
Failed to create Coding Agent finishing-touch task.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The shared Idris dependent scanner test fixture no longer initializes
Mock.responses. Rust rejects the integration test with E0063 attests/scan_tests.rs:352, so all-target compilation and the following tests cannot run. The same defect is present on current main and blocks dependency PRs #633–#637.Actual failure: job 124701176251, with the same current-main failure in job 124813337915.
Change
Initialize the existing response override map with
BTreeMap::new()inready_mock. This is one source line; the real transport, assertions, dependency locks and vendored bot sources are unchanged.Verification
The source and exact Git blob were inspected, and the one-line diff was read back. No local Rust execution is claimed. The existing
idris-dependentshosted matrix must qualify this revision using its locked all-target build, tests, Clippy and formatting gates.The older E2E closure defect has a separate fix already on main (#639). Echidnabot's vendored source pin, existing governance/security findings and dependency updates need their own verified dispositions; this PR does not suppress them.
Summary by CodeRabbit
Hosted follow-up
The da53 hosted locked build passed the original missing-field failure, then the existing edge-case suite exposed two stale assertions in job126927683205/run41931039453. Current412bcad784dd16193475a09ecfa614147dc6fa51 keeps hard-error rejection by using HTTP500 for that fixture (404 is intentionally recorded as a skipped URL), and includes the already public skippedUrls field in the exact JSON assertion. Existing scan_tests already exercises both raw paths for skipped404/410/451 and hard401/403/422/429/500/503; production behavior is unchanged.
Current412 requires its own full hosted result. Separate governance failures—canonical action allowlist, retained Python audit/test implementations and the older scanner/native-lock contract—remain open and are not waived by this test repair. The vendored Echidnabot dependency PR also needs its upstream source closure resolved independently.