Repository navigation
Fix audit findings: templates, gates, CI supply chain - #3
Merged
Merged
Conversation
The C# Directory.Build.props template has been malformed XML since v0.5.0: an XML comment contained "--", so MSBuild refused to load it. PSUseCorrectCasing intermittently crashed PSScriptAnalyzer and dropped its findings while -EnableExit still exited 0; the rule is off and every documented command adds -ErrorAction Stop. The pre-commit template's vulture hook failed without paths, mypy ran where dependency types were Any, ShellCheck needed Docker, and mixed-line-ending --fix=lf rewrote CRLF-by-policy files. Add the C# dead-code severities and a cargo-deny policy, stricter mypy codes, shebang and workflow hooks, and a test that parses every template. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
verify-format-safe.py let missing, undecodable, or directory input escape as an uncaught exception, which exits 1: the code its contract reserves for a changed AST. It also decoded source as UTF-8 instead of honoring PEP 263 declarations. It now parses bytes and exits 2 for any input it cannot compare. The atomic plan writer replaced PLAN.md with its owner-only temporary file, so the plan became mode 0600 on POSIX. Preserve the existing mode, or use the umask for a new plan, and flush the directory entry after the rename. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The package asked projects to run ShellCheck, shfmt, PSScriptAnalyzer, vulture, Bandit, and coverage but ran none of them on itself, and CI type-checked only the delivery package, not the tests. Add a frozen pre-commit configuration with those hooks, both mypy scopes under the shipped template, and a coverage floor that counts child processes. Tests now pass the template: JSON fixtures use the documented Any escape hatch, setUp overrides use @OverRide, and trusted subprocess calls carry reviewed Bandit exceptions. A type-checked whitelist covers names vulture cannot trace. Tools install from a universal, hash-locked requirements file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The release job holds contents, attestation, and OIDC write access but used actions by movable tag and left the checkout token in .git/config. Pin every action to its commit SHA, disable persisted credentials, and set job timeouts. Add a lint job that runs the pre-commit gates and a checksum-verified full-history gitleaks scan. The Python matrix installs hash-locked tools, type-checks scripts and tests with the shipped template, and enforces the coverage floor. The POSIX parity job also checks JSON escaping of an awkward directory name. Dependabot proposes updates for actions, hooks, and tools after a seven-day cooldown. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
detect-stack.sh wrote the root path into JSON unescaped, matched extensions and pruned directories case-sensitively unlike the PowerShell scanner, and walked the tree once per extension: 480 s versus 16 s on a large workspace. It now makes one escaped, case-insensitive pass and passes ShellCheck with every check enabled. Both scanners now report knip.jsonc (the package's own recommended name), Go and golangci-lint configuration, update-bot configuration, lockfiles, toolchain pins, and dpdm, Go tools, bats, actionlint, zizmor, OSV-Scanner, hadolint, PSScriptAnalyzer, and Pester 5. The smoke suite asserts them and keeps six red drills, including case-insensitive pruning and SHA-pinned release actions. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add source-backed guidance for coverage floors, mutation testing, property and fuzz testing, benchmarks, dependency supply chain, and hardened GitHub Actions workflows, plus axe-core and React hook rules. Both setup and retrofit workflows now require locked installs, pinned CI actions, and a measured coverage floor. Record every reproduced finding, red drill, environment, and open gate in the dated quality review, the plan, and the changelog. Update the contributor workflow for the hash-locked tools and pre-commit hooks. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c43b296a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ```bash | ||
| CACHES=(.ruff_cache .mypy_cache .pytest_cache .tox htmlcov) | ||
| CACHES=(.ruff_cache .mypy_cache .pytest_cache .tox htmlcov .coverage) |
There was a problem hiding this comment.
When the target project enables coverage parallel mode—explicitly, or via coverage.py's subprocess patch—the baseline creates .coverage.* files rather than only .coverage. Both cleanup snippets and the later ignore guidance list only the exact .coverage name, so these files remain untracked and violate this phase's promised clean-worktree invariant. Snapshot and remove newly created .coverage.* files while preserving pre-existing ones, and include the pattern in the phase-2 ignore guidance.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes from a full audit of v0.6.0: shipped template defects, gates this package prescribes but never ran on itself, and CI supply-chain gaps. Every finding was reproduced before it was fixed, and every changed rule was red-drilled (green → intended red → byte-identical restore → green). Evidence is in
docs/QUALITY-REVIEW.md→ "Post-release audit: 2026-09-24".Shipped defects fixed
templates/csharp/Directory.Build.propshas been malformed XML since v0.5.0 (--inside a comment →MSB4024, the file cannot load).PSUseCorrectCasingintermittently throws. A planted violation went unreported with exit 0. The rule is off, and every documented command adds-ErrorAction Stop..editorconfigtemplate.Any.mixed-line-ending --fix=lfrewrote CRLF-by-policy files.verify-format-safe.pyreported unreadable input as "AST changed"; the plan writer leftPLAN.mdat mode 0600 on POSIX.detect-stack.sh: its JSON root was unescaped, and it matched case-sensitively, unlike the PowerShell scanner. It is now one pass instead of 20 (480 s → 16 s on a large tree).Added: a Rust
deny.toml, five stricter mypy codes, actionlint/zizmor/shebang hooks, broader scanner detection, and guidance for test depth, performance, supply chain, and CI hardening.Repository gates
persist-credentials: falseand job timeouts.Test plan
pre-commit runon all files: 26 hooks passcross-platform-smoke.ps1 -RedDrills: 6 drills pass on PowerShell 7 and 5.1release-package-smoke.ps1passes on PowerShell 7 and 5.1 (committed tree)🤖 Generated with Claude Code