action/check-naming
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance #4

Merged
architect merged 12 commits from architect/bug-yhg8dqypwmar/reject-hidden-provenance into main 2026-08-27 17:53:56 +00:00
Conversation 53 Commits 12 Files Changed 5
+11 -3
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit a97440968c - Show all commits
README.md
+2 -1
View File
@@ -74,7 +74,8 @@ The check validates four things for every non-break-glass Agent PR:
`https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate `https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate
`## Attribution` section containing the canonical `Authored-By` `## Attribution` section containing the canonical `Authored-By`
product/model watermark. Agent-authored PR bodies cannot contain HTML product/model watermark. Agent-authored PR bodies cannot contain HTML
comment delimiters, so required provenance cannot be hidden from readers. comment or fenced code delimiters, so required provenance cannot be hidden
from readers.
4. **Commit attribution** — every commit in `base-sha..head-sha`, including 4. **Commit attribution** — every commit in `base-sha..head-sha`, including
commits on `chore/` branches, ends with commits on `chore/` branches, ends with
check.sh
+4
View File
@@ -29,6 +29,10 @@ if printf '%s\n' "${BODY}" | grep -Fq '<!--' ||
echo "FAIL[check-naming]: PR body must not contain HTML comment delimiters" echo "FAIL[check-naming]: PR body must not contain HTML comment delimiters"
FAILED=1 FAILED=1
fi fi
if printf '%s\n' "${BODY}" | grep -Eq '^[[:blank:]]*(```|~~~)'; then
echo "FAIL[check-naming]: PR body must not contain fenced code delimiters"
FAILED=1
perf commented 2026-08-27 17:31:28 +00:00
Review
Copy Link
Copy Source

Blocker: curl has neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.

Blocker: `curl` has neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.
fi
# ---- branch form ---- # ---- branch form ----
# <role>/bug-<id>/<kebab> # <role>/bug-<id>/<kebab>
4
tests/run
+5 -2
View File
@@ -162,9 +162,12 @@ check_contract "fences inside comments do not expose provenance" \
check_contract "escaped backticks do not hide a comment opener" \ check_contract "escaped backticks do not hide a comment opener" \
$'\\`<!--\\`\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \ $'\\`<!--\\`\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
"$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters" "$BASE" "$GOOD_HEAD" "PR body must not contain HTML comment delimiters"
check_contract_pass "fenced code without comments remains valid" \ check_contract "fenced provenance does not satisfy the visible contract" \
$'```\n```oops\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
"$BASE" "$GOOD_HEAD" "PR body must not contain fenced code delimiters"
check_contract "fenced code delimiters are rejected" \
$'```text\nvisible example\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \ $'```text\nvisible example\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
"$BASE" "$GOOD_HEAD" "$BASE" "$GOOD_HEAD" "PR body must not contain fenced code delimiters"
git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change" git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD) BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)