Repository navigation
fix(scripts): the SPDX recipe writes the template rule that stops at an indented body - #659
Merged
Merged
Conversation
…an indented body The recipe `fix-workflow-linter-spdx-rule.sh` writes the SPDX rule of the estate template. That rule stopped the scan only at a body line in column 1, so it accepted a licence comment after the body of a workflow with an indented root mapping. A review of pull request 658 found this, and the thread stayed open because the rule text belongs to the template. The template gets the repair in rsr-template-repo pull request 323 (owner decision, 2026-11-10: the template first, then the recipe). The recipe now writes the same text: the stop condition is `/^[[:space:]]*[^#[:space:]]/`. - The test expects the new text, and runs the new rule on 2 more sample files: an indented body with a late licence line (must fail), and an indented body with the licence first (must pass). - The campaign note names the template pull request, and has 1 new limit: a linter that has the first form of the template rule is not a target. The target of the recipe does not change: the `head -1` rule only. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK
Contributor
|
Caution Review failedThe pull request is closed.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
hyperpolymath
marked this pull request as ready for review
November 10, 2026 18:23
hyperpolymath
enabled auto-merge (squash)
November 10, 2026 18:23
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
hyperpolymath
disabled auto-merge
November 10, 2026 18:24
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
…t test value (#660) ## Summary 4 checks are red on `main` and on each pull request (for example #658 and #659): `scan / gitleaks`, `scan / rust-secrets`, and the 2 UUID conformance checks. This pull request repairs their 2 causes. | Cause | Lines | Where the source is | |---|---|---| | The Rust rule of the secret scan | 2 names of environment variables in `bots/echidnabot/src/api/auth.rs`, 2 test values in `bots/echidnabot/tests/smoke.rs` | echidnabot | | The same rule | 1 test value in `tests/echidnabot/api_gate_regressions.rs` | this repository | | The strict UUID rule | 3 nil UUID literals in the echidnabot tests | echidnabot | The echidnabot lines are repaired at their source: hyperpolymath/echidnabot#197 (merged, `998d306`). No line here is a secret. The values are names of environment variables and test credentials. ## Changes - **`bots/echidnabot/`**: `scripts/sync-vendored-bot.sh echidnabot --sync --rev a045184...` moves the pin from `1443adf` to `a045184`, the head of upstream `main`. 4 files change in the copy: - `src/api/auth.rs`, `tests/protocol_contract.rs`, `tests/smoke.rs`: the changes of echidnabot#197 (the pragma on 4 lines; the nil UUID comes from `uuid::Uuid::nil()` and is not a literal). - `Cargo.lock`: the changes of echidnabot#198 (`event-listener` 5.4.2, `chacha20` 0.10.2, `spin` 0.9.9). - **`tests/echidnabot/api_gate_regressions.rs`**: the pragma `// scanner-allow: rust-secrets` on the 1 test value that this repository owns, with a comment of 2 lines. The 2 dated notes in `docs/migrations/secret-scanner-cicd-suite/` name the old pin. They are records of 2026-11-09 and do not change. ## Not in this change The sqlx repair for RUSTSEC-2026-0459 (hyperpolymath/echidnabot#199) is not merged upstream at this time. A later pin move carries it. ## Testing - `bash scripts/sync-vendored-bot.sh echidnabot --check`: `bots/echidnabot matches ...@a045184... (90 entries)`, exit 0. - A local copy of the 2 rules (the Rust rule of the scanner at `proven-cicd` `03e858b`, and the strict UUID rule), run on the whole tree: 0 hits in 270 Rust files. Before this change the same copy gave 5 lines and 3 literals. - Not run locally: gitleaks, and the Rust tests of the copy. CI runs them. The 3 changed Rust files passed the echidnabot CI at `998d306`. ## What to expect in CI `scan / gitleaks`, `scan / rust-secrets` and the 2 UUID conformance checks pass. If 1 of them does not, the result is added here. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
…late rule (#662) ## Summary `scripts/fix-workflow-linter-spdx-rule.sh` had 1 target: the `head -1` rule. #659 recorded the gap as a limit: a linter with the first form of the template rule is not a target, and keeps that form. The first form stops only at a line in column 1 (`/^[^#[:space:]]/`). A workflow with an indented body then passes the lint with a licence line after the body. The template repaired this in `rsr-template-repo` pull request 323. The linter of `system-et` still has the first form. This pull request makes the first form a second target. ## Changes - **`scripts/fix-workflow-linter-spdx-rule.sh`**: the second target is a line that is exactly `if ! awk '<first form>' "$name"; then`. Only the rule text changes on that line: the 2 comment lines and the `echo` line are already correct in such a file. - One awk function finds the target. `--check` and the repair both use it, so the count and the repair cannot disagree. - The rule text is compared as a literal string, not as a pattern. - A line with the rule text in a different shape is not a target. - **`tests/template-drift-recipes-test.sh`**: 2 cases. - The first form is repaired to the same file that the `head -1` repair gives. Before the repair, the test shows the defect: the first form accepts a licence line after an indented body. - The rule text in a line of another shape is not changed. - **`campaigns/TEMPLATE-DRIFT-CAMPAIGN.adoc`**: the target in the recipe table, the evidence, and the limit (2 targets, not 1). The recipes are still not dispatched. This change does not touch the automation quarantine. ## Testing - `bash tests/template-drift-recipes-test.sh`: `PASS: registry routes, predicates, exact repairs, idempotence, refusals and symlink rejection for 3 recipes`. - Negative control: with the old script and the new test, the test fails with `fix-workflow-linter-spdx-rule.sh --check spdx-form2: expected 1, got 0`. - Real file: a copy of the linter of `system-et` at `main` (`bbe1d13`). `--check` gives 1 before and 0 after. 1 line changes. The `Check SPDX Headers` step is then identical to the step of the template at `main` (`0208563`), 19 lines. - `bash -n` on the script: no error. `shellcheck` is not installed in the session, so it was not run. The awk of the session is mawk 1.3.4. Not verified: the number of repositories that have the first form. No estate scan was made. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The recipe
fix-workflow-linter-spdx-rule.shwrites the SPDX rule of the estate template intoworkflow-linter.yml. That rule stopped its scan only at a body line in column 1. For a workflow with an indented root mapping, it accepted a licence comment after the body.A review of #658 found this. The thread stayed open there, because the rule text belongs to the template. The owner asked for the repair in the template first, then here (2026-11-10).
Order of merge. The template gets the repair in hyperpolymath/rsr-template-repo#323. Merge that pull request before this one, so that the recipe writes text that the template has.
Changes
scripts/fix-workflow-linter-spdx-rule.sh: the rule that the recipe writes has the new stop condition,/^[[:space:]]*[^#[:space:]]/. The target of the recipe does not change: thehead -1rule only.tests/template-drift-recipes-test.sh: the expected text is the new rule. The test runs the new rule on 2 more sample files: an indented body with a late licence line (must fail), and an indented body with the licence first (must pass).campaigns/TEMPLATE-DRIFT-CAMPAIGN.adoc: the evidence line names the template pull request. 1 new limit: a linter that has the first form of the template rule is not a target of the recipe.Testing
bash tests/template-drift-recipes-test.sh: PASS.mainand the new test: FAIL (spdx-old: wrong repair). So the test sees the difference.workflow-linter.ymlofsystem-etat04a8b6eand ofanytype: 1 target before, 0 after. In each file, the stepCheck SPDX Headersis then identical to the step of the template branch (rsr-template-repo#323,915acb2), 19 lines.shellcheck.Limit
A repository that has the first form of the template rule already (for example
system-et, since its pull requests 92 and 94) keeps that form. The recipe does not move it to the new form. That needs a second target in the recipe, which is not in this change.Generated by Claude Code