[hyperpolymath]

The B1 gate compares uppercase classification/reachability strings with panic-attack's lowercase wire values. A native reachable/unmitigable CVE is counted as zero blockers. Missing CVE arrays and unavailable assessment data can also pass the permissive filter.

Validate schema 0.3.0, dependency counts, vulnerability-data availability and finding enums before interpreting a report. Exit 1 for B1 blockers and 2 for unavailable or invalid assessment; only qualified reports without blockers pass. Reject empty files and multiple JSON documents. Avoid emitting untrusted finding prose as workflow annotations.

Add an independent contract job on every PR, with 29 executable cases, and require it before the existing bot dependency gate. Action references and permissions are unchanged.

Validation: 29 local cases pass; changed YAML and all embedded shell parse. Reproduced the original false-negative with a native blocking report. Full remote workflows and live OSV triage remain pending; upstream compilation prerequisite is tracked in hyperpolymath/panic-attack#265. Related to #1009; does not close its broader fleet work.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Summary

Summary by CodeRabbit

• Improvements
  • Bridge report checks now verify the report format, vulnerability-data status and supported classifications before allowing the CI gate to pass.
  • The gate now waits for the bridge report checks to succeed and blocks reports containing reachable, unmitigable vulnerabilities.
• Tests
  • Added checks covering valid, blocking, malformed, invalid and missing reports.

The bridge gate now runs report contract tests and uses a dedicated checker for B1 reports. The checker validates schema and vulnerability data, then returns distinct outcomes for invalid data, blocking CVEs, and passing reports.

Changes: Bridge report validation

Layer / File(s)	Summary
Report contract and validation .machine_readable/descriptiles/STATE.a2ml, scripts/ci/check-bridge-report.sh, scripts/ci/test-bridge-report.sh	The contract checkpoint records the candidate report requirements. The checker validates report structure and vulnerability data, then rejects reports with reachable, unmitigable CVEs. Tests cover passing, blocking, unavailable, and malformed reports.
CI gate integration .github/workflows/bridge-gate.yml	The workflow runs the contract tests and requires their success before the bridge gate proceeds. The B1 step calls the checker for bridge-report.json.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant BridgeContract as bridge-contract job
  participant TestScript as test-bridge-report.sh
  participant Checker as check-bridge-report.sh
  participant BridgeGate as bridge-gate job
  BridgeContract->>TestScript: Run report contract tests
  TestScript->>Checker: Check test reports
  Checker-->>TestScript: Return expected status
  TestScript-->>BridgeContract: Report test result
  BridgeContract-->>BridgeGate: Allow gate after success
  BridgeGate->>Checker: Check bridge-report.json in B1
  Checker-->>BridgeGate: Return validation or blocker status

Loading

Possibly related issues

• hyperpolymath/hypatia#1009 — The PR adds an executable report contract test and a CI gate, which supports the issue’s goal of catching defects before external review.

Merge Risk: Minimal · up to 067ab

The checker correctly combines classification and reachability when identifying blockers. Additional regression cases would strengthen coverage but do not block merging after normal checks.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T10:04:26.263650Z	067abb3	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.