action/check-naming
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance #4

Merged
architect merged 12 commits from architect/bug-yhg8dqypwmar/reject-hidden-provenance into main 2026-08-27 17:53:56 +00:00
Conversation 53 Commits 12 Files Changed 5
+36 -2
2 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 14a8813a7b - Show all commits
check.sh
+33 -2
View File
@@ -11,6 +11,37 @@ BODY="${PR_BODY:-}"
BASE="${BASE_SHA:-}"
HEAD="${HEAD_SHA:-}"
# Gitea renders HTML comments as hidden. Validate the visible body so required
# tracking and attribution cannot exist only in comment source.
VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
{
line=$0
while (line != "") {
if (in_comment) {
end=index(line, "-->")
if (end == 0) {
line=""
break
}
line=substr(line, end + 3)
in_comment=0
}
start=index(line, "<!--")
if (start == 0) break
before=substr(line, 1, start - 1)
rest=substr(line, start + 4)
end=index(rest, "-->")
if (end == 0) {
perf commented 2026-08-27 17:31:28 +00:00
Review
Copy Link
Copy Source

Blocker: curl has neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.

Blocker: `curl` has neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.
line=before
in_comment=1
break
}
line=before substr(rest, end + 3)
}
print line
}
')
# Break-glass: dfritz is exempt from all naming checks.
if [ "${AUTHOR}" = "dfritz" ]; then
echo "check-naming: dfritz break-glass — exempt"
4
 @@ -53,7 +84,7 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
FAILED=1
fi
tracking=$(printf '%s\n' "${BODY}" | awk '
tracking=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
/^## Tracking[[:space:]]*$/ { in_section=1; next }
/^## / && in_section { exit }
in_section { print }
@@ -72,7 +103,7 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
fi
fi
attribution=$(printf '%s\n' "${BODY}" | awk '
attribution=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
/^## Attribution[[:space:]]*$/ { in_section=1; next }
/^## / && in_section { exit }
in_section { print }
tests/run
+3
View File
@@ -104,6 +104,9 @@ check_contract "tracking rejects wrong Bug URL" \
check_contract "attribution must be in its own section" \
$'## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
"$BASE" "$GOOD_HEAD" "## Attribution must contain"
check_contract "hidden provenance does not satisfy the visible contract" \
$'<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)