feat(review): review_version 1.2 with answers, pre-existing, rounds and policy fields
This commit is contained in:
parent
ed67526987
commit
5709957e10
SSH key fingerprint:
SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
16 changed files with 1034 additions and 11 deletions
|
|
@ -12,6 +12,10 @@
|
|||
// warns, so a 1.0 review can still seed a plan (N-1 window, Handover 6). The
|
||||
// gate that decides on the verdict is lib/review/verdict-gate.mjs, which never
|
||||
// reads a missing verdict as ALLOW.
|
||||
//
|
||||
// review_version 1.2: optional round, policy, pre-existing, ran and `## Answers`
|
||||
// fields; each one present is checked for shape (`review12Issues`). A 1.1
|
||||
// review is read as before (N-1 window).
|
||||
|
||||
import { readFileSync, existsSync } from 'node:fs';
|
||||
import { parseDocument } from '../util/frontmatter.mjs';
|
||||
|
|
@ -67,6 +71,175 @@ function remediationStepSources(body) {
|
|||
return ids;
|
||||
}
|
||||
|
||||
// ---- review_version 1.2 shapes ------------------------------------------------
|
||||
// Codes: REVIEW_ANSWERS_MALFORMED (the `## Answers` table, and a MAJOR answered
|
||||
// `fixed` without its R-step), REVIEW_POLICY_MALFORMED (`review_policy`,
|
||||
// `review_policy_sha256`, a finding's `instruction_ref`), REVIEW_ROUND_MALFORMED
|
||||
// (`round`, `round_base`, `finalized`, `resolved`, `ran`, a finding's
|
||||
// `carried_from`) and REVIEW_PRE_EXISTING_MALFORMED (a finding's `pre_existing`,
|
||||
// `pre_existing_counts`).
|
||||
|
||||
const FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
|
||||
const SHA256_RE = /^[0-9a-f]{64}$/;
|
||||
const SEVERITIES = ['BLOCKER', 'MAJOR', 'MINOR', 'SUGGESTION'];
|
||||
const REVIEW_POLICY_VALUES = ['absent', 'applied', 'not-applied'];
|
||||
const RAN_ENGINES = ['code-review', 'security-review'];
|
||||
const ANSWERS_HEADER = '| Finding | Answer | Reason | Record | Carried from |';
|
||||
const ANSWER_FINDING_RE = /^([0-9a-f]{40})(?:#\d+)?$/;
|
||||
const CARRIED_FROM_RE = /^review-round-[0-9a-f]{12}-\d+\.md#[0-9a-f]{40}$/;
|
||||
|
||||
const isPlainObject = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
|
||||
|
||||
/** The lines of the `## Answers` section (heading excluded), up to the next `## ` heading or a fence; null when absent. */
|
||||
function answersSectionLines(body) {
|
||||
const lines = body.split('\n');
|
||||
const at = lines.findIndex((l) => /^##\s+Answers\s*$/.test(l));
|
||||
if (at === -1) return null;
|
||||
const out = [];
|
||||
for (const l of lines.slice(at + 1)) {
|
||||
if (/^##\s/.test(l) || /^\s{0,3}(`{3,}|~{3,})/.test(l)) break;
|
||||
out.push(l);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse the `## Answers` table. Returns `{rows, problems}`; rows hold
|
||||
* `{id, answer, reason, record, carriedFrom}`. An absent section, or one with
|
||||
* no table, has no rows.
|
||||
*/
|
||||
function parseAnswersTable(body) {
|
||||
const section = answersSectionLines(body);
|
||||
const rows = [];
|
||||
const problems = [];
|
||||
if (section === null) return { rows, problems };
|
||||
const table = section.map((l) => l.trim()).filter((l) => l.startsWith('|'));
|
||||
if (table.length === 0) return { rows, problems };
|
||||
if (table[0] !== ANSWERS_HEADER) {
|
||||
problems.push(`## Answers header must be exactly "${ANSWERS_HEADER}", got ${JSON.stringify(table[0])}`);
|
||||
return { rows, problems };
|
||||
}
|
||||
if (table.length < 2 || !/^\|(?:\s*:?-{3,}:?\s*\|){5}$/.test(table[1])) {
|
||||
problems.push('## Answers table has no separator line of five columns under its header');
|
||||
return { rows, problems };
|
||||
}
|
||||
const seen = new Set();
|
||||
table.slice(2).forEach((line, i) => {
|
||||
const where = `## Answers row ${i + 1}`;
|
||||
if (!line.endsWith('|')) { problems.push(`${where} does not end with "|"`); return; }
|
||||
const cells = line.slice(1, -1).split('|').map((c) => c.trim());
|
||||
if (cells.length !== 5) { problems.push(`${where} has ${cells.length} cells, not 5`); return; }
|
||||
const [finding, answer, reason, record, carriedFrom] = cells;
|
||||
const m = finding.match(ANSWER_FINDING_RE);
|
||||
if (!m) problems.push(`${where}: Finding ${JSON.stringify(finding)} is not a 40-char hex id (optionally #n)`);
|
||||
if (answer !== 'accepted' && answer !== 'fixed') {
|
||||
problems.push(`${where}: Answer must be accepted|fixed, got ${JSON.stringify(answer)}`);
|
||||
}
|
||||
if (answer === 'accepted' && reason === '') problems.push(`${where}: an accepted answer needs a non-empty Reason`);
|
||||
if (!SHA256_RE.test(record)) problems.push(`${where}: Record ${JSON.stringify(record)} is not a 64-char hex record hash`);
|
||||
if (carriedFrom !== '-' && !CARRIED_FROM_RE.test(carriedFrom)) {
|
||||
problems.push(`${where}: Carried from must be "-" or review-round-<run12>-<n>.md#<id>, got ${JSON.stringify(carriedFrom)}`);
|
||||
}
|
||||
if (m) {
|
||||
if (seen.has(m[1])) problems.push(`${where}: a second row for finding ${m[1]} (at most one row per finding)`);
|
||||
seen.add(m[1]);
|
||||
rows.push({ id: m[1], answer, reason, record, carriedFrom });
|
||||
}
|
||||
});
|
||||
return { rows, problems };
|
||||
}
|
||||
|
||||
/** The parsed trailing JSON block, or null when absent or unparseable (other checks report those). */
|
||||
function findingsPayload(body) {
|
||||
const last = extractFindingsBlock(body);
|
||||
if (last === null) return null;
|
||||
try { return JSON.parse(last); } catch { return null; }
|
||||
}
|
||||
|
||||
/** Issues for the review_version 1.2 fields that are present. Absent fields are never an issue. */
|
||||
function review12Issues(fm, body) {
|
||||
const out = [];
|
||||
const round = (msg) => out.push(issue('REVIEW_ROUND_MALFORMED', msg));
|
||||
const policy = (msg) => out.push(issue('REVIEW_POLICY_MALFORMED', msg));
|
||||
const pre = (msg) => out.push(issue('REVIEW_PRE_EXISTING_MALFORMED', msg));
|
||||
const answers = (msg) => out.push(issue('REVIEW_ANSWERS_MALFORMED', msg));
|
||||
|
||||
// Frontmatter.
|
||||
if ('round' in fm && !(Number.isInteger(fm.round) && fm.round >= 1 && fm.round <= 3)) {
|
||||
round(`frontmatter.round must be an integer 1-3, got ${JSON.stringify(fm.round)}`);
|
||||
}
|
||||
if ('round_base' in fm && fm.round_base !== null
|
||||
&& !(typeof fm.round_base === 'string' && FULL_SHA_RE.test(fm.round_base))) {
|
||||
round(`frontmatter.round_base must be a full 40- or 64-hex commit id or null, got ${JSON.stringify(fm.round_base)}`);
|
||||
}
|
||||
if ('finalized' in fm && typeof fm.finalized !== 'boolean') {
|
||||
round(`frontmatter.finalized must be a boolean, got ${JSON.stringify(fm.finalized)}`);
|
||||
}
|
||||
if ('review_policy' in fm && !REVIEW_POLICY_VALUES.includes(fm.review_policy)) {
|
||||
policy(`frontmatter.review_policy must be one of ${REVIEW_POLICY_VALUES.join('|')}, got ${JSON.stringify(fm.review_policy)}`);
|
||||
}
|
||||
if ('review_policy_sha256' in fm
|
||||
&& !(fm.review_policy_sha256 === 'none' || (typeof fm.review_policy_sha256 === 'string' && SHA256_RE.test(fm.review_policy_sha256)))) {
|
||||
policy(`frontmatter.review_policy_sha256 must be 64-char hex or none, got ${JSON.stringify(fm.review_policy_sha256)}`);
|
||||
}
|
||||
|
||||
// Trailing JSON block.
|
||||
const payload = findingsPayload(body);
|
||||
const findings = Array.isArray(payload?.findings) ? payload.findings : [];
|
||||
findings.forEach((f, i) => {
|
||||
if (!isPlainObject(f)) return;
|
||||
if ('pre_existing' in f && typeof f.pre_existing !== 'boolean') {
|
||||
pre(`findings[${i}].pre_existing must be a boolean, got ${JSON.stringify(f.pre_existing)}`);
|
||||
}
|
||||
if ('carried_from' in f && !(typeof f.carried_from === 'string' && HEX_ID_RE.test(f.carried_from))) {
|
||||
round(`findings[${i}].carried_from must be a 40-char hex finding id, got ${JSON.stringify(f.carried_from)}`);
|
||||
}
|
||||
if ('instruction_ref' in f && typeof f.instruction_ref !== 'string') {
|
||||
policy(`findings[${i}].instruction_ref must be a string, got ${JSON.stringify(f.instruction_ref)}`);
|
||||
}
|
||||
});
|
||||
if (isPlainObject(payload)) {
|
||||
if ('pre_existing_counts' in payload) {
|
||||
const c = payload.pre_existing_counts;
|
||||
const okCounts = isPlainObject(c) && Object.entries(c)
|
||||
.every(([k, n]) => SEVERITIES.includes(k) && Number.isInteger(n) && n >= 0);
|
||||
if (!okCounts) pre(`pre_existing_counts must map ${SEVERITIES.join('|')} to counts ≥ 0, got ${JSON.stringify(c)}`);
|
||||
}
|
||||
if ('resolved' in payload) {
|
||||
const r = payload.resolved;
|
||||
if (!(Array.isArray(r) && r.every((id) => typeof id === 'string' && HEX_ID_RE.test(id)))) {
|
||||
round(`resolved must be an array of 40-char hex finding ids, got ${JSON.stringify(r)}`);
|
||||
}
|
||||
}
|
||||
if ('ran' in payload) {
|
||||
const r = payload.ran;
|
||||
const okRan = isPlainObject(r)
|
||||
&& Array.isArray(r.engines) && r.engines.every((e) => RAN_ENGINES.includes(e))
|
||||
&& Array.isArray(r.reviewers) && r.reviewers.every((s) => typeof s === 'string');
|
||||
if (!okRan) {
|
||||
round(`ran must be {engines: subset of ${RAN_ENGINES.join('|')}, reviewers: [string]}, got ${JSON.stringify(r)}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ## Answers.
|
||||
const { rows, problems } = parseAnswersTable(body);
|
||||
for (const p of problems) answers(p);
|
||||
const majors = new Set(findings
|
||||
.filter((f) => isPlainObject(f) && typeof f.id === 'string' && String(f.severity).toUpperCase() === 'MAJOR')
|
||||
.map((f) => f.id));
|
||||
const fixedMajors = rows.filter((r) => r.answer === 'fixed' && majors.has(r.id));
|
||||
if (fixedMajors.length > 0) {
|
||||
const steps = remediationStepSources(body);
|
||||
for (const r of fixedMajors) {
|
||||
if (!steps.has(r.id)) {
|
||||
answers(`MAJOR ${r.id} is answered fixed but no "### Step R<n>" under ## Remediation Steps has "Source finding: ${r.id}"`);
|
||||
}
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
export function validateReviewContent(text, opts = {}) {
|
||||
const strict = opts.strict !== false;
|
||||
const doc = parseDocument(text);
|
||||
|
|
@ -152,6 +325,16 @@ export function validateReviewContent(text, opts = {}) {
|
|||
else warnings.push(issueObj);
|
||||
}
|
||||
|
||||
// 1.2+: every new field is optional; a malformed one present is an error
|
||||
// (strict) or a warning (soft). A 1.1 file is read as before (N-1 window).
|
||||
const atLeast12 = v && (Number(v[1]) > 1 || (Number(v[1]) === 1 && Number(v[2]) >= 2));
|
||||
if (atLeast12) {
|
||||
for (const issueObj of review12Issues(fm, body)) {
|
||||
if (strict) errors.push(issueObj);
|
||||
else warnings.push(issueObj);
|
||||
}
|
||||
}
|
||||
|
||||
for (const section of REVIEW_BODY_SECTIONS) {
|
||||
const re = new RegExp(`^##\\s+${section}\\b`, 'm');
|
||||
if (!re.test(body)) {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue