Repository navigation
fix(ci): exclude vendored source comments with the shared scanner - #7469
Conversation
✅
|
@coderabbitai full review |
|
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (4)
Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (10)
🔇 Additional comments (4)
📝 WalkthroughWalkthroughThe TODO scanner job now uses the pinned shared workflow with Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to No actionable issue was identified. The change is mergeable after normal CI checks. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The scanner remains pinned to an exact revision, with unchanged caller permissions, secret forwarding, and production triggers. No introduced security vulnerability was established. However, the replacement workflow’s credential use and issue-update recovery behavior could not be verified, so the migration retains some uncertainty. Retained concerns Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (2 skipped: 2 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
devantler
left a comment
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: fab517e
- CodeRabbit: current-PR native refusal, event 2026-10-03T19:39:46Z, included reviews unavailable for 13 minutes. PR/account allowance; recovery at the stated reset. No paid review requested.
- Codex: native account refusal, event 2026-10-03T15:31:41Z, freshly read this round. Account included review allowance exhausted; recovery requires restored included allowance. No reset time stated.
- Cursor Bugbot: native user/team refusal, event 2026-10-03T15:35:36Z, freshly read this round. User/team usage or spend limit; recovery requires restored included allowance. No reset time stated.
Reviewed all four changed files for correctness, source and authentication boundaries. The caller binds the immutable canonical release and enables only its root vendor filter; the old consumer ignore is removed. Comparison with the former callee confirms unchanged contents-read/issues-write permissions, App-key forwarding, optional authentication default and configured project default. This change does not claim configured-project integration proof.
The helper derives inputs from the parsed candidate caller and released defaults, requires a clean catalogue at that exact full SHA, validates bare reusable delegation and the production input forwarding, and preserves the released scenario's literal file, request and output expectations. The hosted workflow has only contents-read authority, no scanner/project secrets, credential-free checkouts and a bounded timeout. Its actual pinned scanner runs with no network and synthetic authentication against the strict loopback replay.
Scoped contract RED to GREEN, fixture-schema binding, shellcheck, actionlint and diff hygiene pass locally. The wider local harness hits the existing macOS Bash 3 empty-array limitation in unrelated Talos upgrade tests; that result is not reported as a local pass. Native consumer CI 37148160956 completed successfully at this head: https://github.com/devantler-tech/ksail/actions/runs/37148160956/job/111276260098. The actual scanner completed all 13 requests; disabled filtering, overbroad ignore and corrupted expected payload each fail at their intended replay diagnostic, ruling out acquisition/build failures as controls. Required full CI must settle before promotion. Complete review thread pagination, direct review objects, inline comments and provider check-runs were checked with no remaining findings.
Verdict: no P0/P1 findings
@coderabbitai full review |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
Ready at The exact-head native consumer job passed the actual pinned scanner’s 13-request scenario and the disabled-filter, overbroad-ignore and corrupted-payload controls at their intended diagnostics. Auth/project defaults, App forwarding and caller permissions are preserved. This adoption does not claim configured-project integration or the separate scanner error-boundary repair. |
Why
Vendored source comments should not create maintenance work for KSail, while comments in owned source must remain visible.
What
Use the released shared vendor filter and canonical catalogue. Verify the actual scanner excludes only root vendor directories and keeps owned, nested, and nearby paths, with controls that detect broken filtering and changed issue contents. Existing project integration remains unchanged.
Fixes #7468