fix: round 8 of the release review of 6.3.0, for 6.3.1
Round 8 (0f400d3..29b4ac9, BLOCK: 1 BLOCKER, 12 MAJOR, 1 MINOR). Each fix
began with a test that failed on 29b4ac9 (13 tests, all red there); suite
2221 (2219/0/2).
- BLOCKER: a backticked check whose trailing comment holds a quote, $,
backtick or backslash is refused, not dropped. The comment was never
screened, while the executor hands the Verify span as written to red
proof, the test lock and the done line inside --cmd "...", where a $(...)
runs and a quote ends the argument. trekplan's text and the reviewer's
NOT RUN table say so.
- A span that is only a comment is not-a-command, not a placeholder. The
dropComment text says the allowlist still refuses a word with a # in it.
- The criteria runner, comparison-gate and end-state-gate use isMain: they
did nothing and exited 0 under a symlinked path. The test now refuses any
process.argv[1] comparison outside lib/util/is-main.mjs.
- Files: in a field with backticked paths, a plain word counts only before
the entry's description (a dash, or a colon after the path); a name with
no slash only first in its entry or after and/or/+/&. "mocks
fs.readFileSync", "runs on Node.js 22.x" or "no change to package.json"
no longer make a tests-only step look like it builds something.
Lowercase makefile, rakefile and justfile are build files. Measured on the
520 Files: fields in 48 plans of the marketplace and the test repo:
3 fields read differently (two notes no longer read as files, one
duplicate name dropped), tests-only changed in 0.
- The test lock compares --cmd without its trailing comment, and the test
lock and the done line read a stop with stoppedBy, the one reading.
red-proof drops its second reading, spawnError.
- release-check reads a relative --review in --repo or, when only that one
exists, from the current directory as 6.3.0 did; two different files are
exit 2, never guessed. The runbook says so.
- One trailing-json reader: a closing fence may be longer than three
backticks, in the block reader and the verdict gate alike, and the review
validator and the synthesis digest use it, so three backticks inside a
JSON string no longer hide a BLOCKER from the remediation-step check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
parent
29b4ac91b3
commit
a10018f9d3
SSH key fingerprint:
SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
18 changed files with 310 additions and 56 deletions
|
|
@ -296,10 +296,15 @@ export function onFailureAction(text) {
|
|||
* wherever they sit (`a.mjs`/`b.mjs`, inside a note), a backticked build
|
||||
* file (`Makefile`, `Dockerfile`), and a backticked capitalised name with no
|
||||
* extension that stands alone in its entry. Beside them a plain word counts
|
||||
* only when it is clearly a file or a directory: a name with an extension, a
|
||||
* dotfile, a path with a slash that ends in a file or a `/`, or a build file
|
||||
* (", Dockerfile", "the CLI entry src/cli.mjs", "and Makefile"; round 7: they
|
||||
* were dropped, and a step that builds something read as tests-only).
|
||||
* only when it is clearly a file or a directory, and only before the entry's
|
||||
* description starts (a dash, or a colon after the backticked path): a path
|
||||
* with a slash that ends in a file or a `/` anywhere there ("the CLI entry
|
||||
* src/cli.mjs"), and a name with an extension, a dotfile or a build file only
|
||||
* where an entry or a list starts: first in its entry, or after "and", "or",
|
||||
* "+" or "&" (", Dockerfile", "and Makefile", ", package.json"). Round 7: they
|
||||
* were dropped, and a step that builds something read as tests-only. Round 8:
|
||||
* "— mocks fs.readFileSync", "runs on Node.js 22.x" or "no change to
|
||||
* package.json" read as files, and a step that holds only its test did not.
|
||||
* "covers pass/fail", "JSON, YAML" or "v6.3.0 format" is no path.
|
||||
* - A field with no backticked path names every path-like word: a name with an
|
||||
* extension, a dotfile, a path with a slash, a directory (`docs/`), a glob
|
||||
|
|
@ -318,8 +323,12 @@ const BARE_NAME = /^[A-Z][\w.-]*$/;
|
|||
// The last segment is a dotfile or a name with an extension, or the path is a directory.
|
||||
const FILE_OR_DIR = /(?:^|\/)(?:\.[\w-][\w.-]*|[^/]*\.[A-Za-z*][A-Za-z0-9*]*)$|\/$/;
|
||||
// A build file named without an extension: a capitalised name that ends in
|
||||
// `file` (Makefile, Dockerfile, Gemfile, Jenkinsfile, ...), not the word Profile.
|
||||
const BUILD_FILE = /^(?!Profile$)(?:[A-Z][a-z]+|GNUmake)file$/;
|
||||
// `file` (Makefile, Dockerfile, Gemfile, Jenkinsfile, ...), not the word Profile,
|
||||
// and the lowercase names make, rake and just also read (round 8).
|
||||
const BUILD_FILE = /^(?!Profile$)(?:[A-Z][a-z]+|GNUmake)file$|^(?:make|rake|just)file$/;
|
||||
// Where an entry's description starts, and the words that start a list item.
|
||||
const DESCRIPTION_DASH = /^(?:\u2014|\u2013|-|--)$/;
|
||||
const LIST_JOINER = /^(?:and|or|\+|&)$/i;
|
||||
const lastSegment = (p) => p.replace(/\/$/, '').split('/').pop();
|
||||
const norm = (p) => p.replace(/\\/g, '/').replace(/^\.\//, '');
|
||||
// A backticked span that is a path, not a URL, an option or a call (`parse()`, `p.parse()`).
|
||||
|
|
@ -346,11 +355,21 @@ export function fieldPaths(text) {
|
|||
const alone = /^\u0000(\d+)\u0000$/.exec(entry);
|
||||
if (alone && BARE_NAME.test(spans[Number(alone[1])])) { out.push(spans[Number(alone[1])]); continue; }
|
||||
if (tickedField) {
|
||||
// In the order they stand: the backticked paths, and a plain word only
|
||||
// when it is clearly a file or a directory (round 7).
|
||||
for (const t of tokens) {
|
||||
if (t.includes('\u0000')) out.push(...[...t.matchAll(/\u0000(\d+)\u0000/g)].map((m) => Number(m[1])).filter((i) => isTicked[i]).map((i) => spans[i]));
|
||||
else if (isFileWord(plainWord(t))) out.push(plainWord(t));
|
||||
// In the order they stand: the backticked paths, and before the
|
||||
// description a plain word that is clearly a file where it may stand
|
||||
// (rounds 7-8).
|
||||
let described = false;
|
||||
for (let i = 0; i < tokens.length; i++) {
|
||||
const t = tokens[i];
|
||||
if (t.includes('\u0000')) {
|
||||
out.push(...[...t.matchAll(/\u0000(\d+)\u0000/g)].map((m) => Number(m[1])).filter((n) => isTicked[n]).map((n) => spans[n]));
|
||||
if (t.endsWith(':')) described = true;
|
||||
continue;
|
||||
}
|
||||
if (DESCRIPTION_DASH.test(t)) described = true;
|
||||
const w = plainWord(t);
|
||||
if (described || !isFileWord(w)) continue;
|
||||
if (w.includes('/') || i === 0 || LIST_JOINER.test(tokens[i - 1])) out.push(w);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -30,6 +30,7 @@
|
|||
import { readFileSync, existsSync } from 'node:fs';
|
||||
import { issue, fail } from '../util/result.mjs';
|
||||
import { isMain } from '../util/is-main.mjs';
|
||||
import { extractFindingsBlock } from '../review/findings-schema.mjs';
|
||||
|
||||
// Origin tag for every synthesised finding (Phase 7 rule 7: codebase vs research).
|
||||
export const ORIGIN_VALUES = Object.freeze(['codebase', 'research']);
|
||||
|
|
@ -55,23 +56,15 @@ const ARRAY_FIELDS = Object.freeze([
|
|||
['sources', 'DIGEST_SOURCES_NOT_ARRAY'],
|
||||
]);
|
||||
|
||||
// Last fenced ```json … ``` block, so prose above it never confuses the parser.
|
||||
const JSON_FENCE_GLOBAL = /```json[ \t]*\r?\n([\s\S]*?)```/gi;
|
||||
|
||||
/**
|
||||
* Extract the inner body of the LAST fenced `json` block in `text`.
|
||||
* Extract the inner body of the LAST fenced `json` block in `text`, with the
|
||||
* one block reader (lib/review/findings-schema.mjs): three backticks inside a
|
||||
* JSON string do not end the block (release review of 6.3.0, round 8).
|
||||
* @param {string} text
|
||||
* @returns {string|null} the JSON source, or null if no json fence is present.
|
||||
*/
|
||||
export function extractDigestBlock(text) {
|
||||
if (typeof text !== 'string') return null;
|
||||
JSON_FENCE_GLOBAL.lastIndex = 0;
|
||||
let last = null;
|
||||
let m;
|
||||
while ((m = JSON_FENCE_GLOBAL.exec(text)) !== null) {
|
||||
last = m[1];
|
||||
}
|
||||
return last;
|
||||
return extractFindingsBlock(text);
|
||||
}
|
||||
|
||||
function isNonEmptyString(v) {
|
||||
|
|
|
|||
|
|
@ -42,8 +42,12 @@ export const FINDING_REQUIRED_FIELDS = Object.freeze([
|
|||
// gate's reader: a JSON string cannot hold a line break, so three backticks
|
||||
// inside one ("a fenced ```bash block") never end the block. Ending it at the
|
||||
// first triple backtick anywhere made fill-finding-ids exit 2 (release review
|
||||
// of 6.3.0, found while writing round 7's review.md; present in 6.2.0).
|
||||
const JSON_FENCE_GLOBAL = /^[ \t]*```json[ \t]*\r?\n([\s\S]*?)^[ \t]*```[ \t]*\r?$/gim;
|
||||
// of 6.3.0, found while writing round 7's review.md; present in 6.2.0). As in
|
||||
// Markdown, the closing fence may be longer than three backticks (round 8);
|
||||
// three backticks after text on the same line are no fence, here or in the gate.
|
||||
// One reader for every trailing json block: the review validator and the
|
||||
// synthesis digest import it.
|
||||
const JSON_FENCE_GLOBAL = /^[ \t]*```json[ \t]*\r?\n([\s\S]*?)^[ \t]*`{3,}[ \t]*\r?$/gim;
|
||||
|
||||
/**
|
||||
* Extract the inner body of the LAST fenced `json` block in `text`.
|
||||
|
|
|
|||
|
|
@ -118,7 +118,9 @@ function atLeastVersion(v, major, minor) {
|
|||
return Boolean(m) && (Number(m[1]) > major || (Number(m[1]) === major && Number(m[2]) >= minor));
|
||||
}
|
||||
|
||||
const FENCE_RE = /^```[ \t]*([A-Za-z0-9_+-]*)[^\n]*\n[\s\S]*?^```[ \t]*$/gm;
|
||||
// A fence as lib/review/findings-schema.mjs reads one: on a line of its own,
|
||||
// indented or not, and a closing fence of three backticks or more (round 8).
|
||||
const FENCE_RE = /^[ \t]*```[ \t]*([A-Za-z0-9_+-]*)[^\n]*\n[\s\S]*?^[ \t]*`{3,}[ \t]*$/gm;
|
||||
|
||||
/** Language tag of the LAST fenced block in `body` (lower-cased), '' for none, null when no fence. */
|
||||
function lastFenceLanguage(body) {
|
||||
|
|
|
|||
|
|
@ -42,7 +42,7 @@ import { join, resolve, dirname } from 'node:path';
|
|||
import { createHash } from 'node:crypto';
|
||||
import { tmpdir } from 'node:os';
|
||||
import { resolveRepo, canonicalPath } from '../verification/repo-tools.mjs';
|
||||
import { DEFAULT_TIMEOUT_MS, allowedCommand, runCommand, screenCommand } from '../verification/criteria-runner.mjs';
|
||||
import { DEFAULT_TIMEOUT_MS, allowedCommand, dropComment, runCommand, screenCommand, stoppedBy } from '../verification/criteria-runner.mjs';
|
||||
import { isMain } from './is-main.mjs';
|
||||
|
||||
export const LOCK_VERSION = 1;
|
||||
|
|
@ -172,7 +172,8 @@ function main(argv) {
|
|||
} else {
|
||||
const testCmd = typeof lock.cmd === 'string' && lock.cmd.trim() !== '' ? lock.cmd : null;
|
||||
if (!testCmd) fail(2, 'the lock names no test command (lock with --cmd "<Verify>"); never marked green');
|
||||
if (args.cmd !== undefined && args.cmd !== testCmd) fail(2, `--cmd is not the step's test command stored in the lock (${testCmd})`);
|
||||
// One reading of a command passed as written: a trailing comment is no part of it (round 8).
|
||||
if (args.cmd !== undefined && dropComment(args.cmd) !== dropComment(testCmd)) fail(2, `--cmd is not the step's test command stored in the lock (${testCmd})`);
|
||||
const allowed = allowedCommand(testCmd, { cwd: cur.repo.root });
|
||||
if (!allowed.allowed) fail(2, `command not run: ${allowed.reason}`);
|
||||
const screen = screenCommand(testCmd);
|
||||
|
|
@ -180,9 +181,9 @@ function main(argv) {
|
|||
// No shell: the words the screen checked are the words that run.
|
||||
const r = runCommand(testCmd, { cwd: cur.repo.root, timeoutMs: DEFAULT_TIMEOUT_MS });
|
||||
// With no shell, 126/127 is the test program's own exit: a red, not "could not run".
|
||||
if (r.error || r.status === null) {
|
||||
fail(2, `the test command did not run to an exit code (${r.error?.message ?? r.signal ?? `exit ${r.status}`})`);
|
||||
}
|
||||
// A stop is read once, by stoppedBy (round 8).
|
||||
const stopped = stoppedBy(r, { timeoutMs: DEFAULT_TIMEOUT_MS });
|
||||
if (stopped) fail(2, `the test command ${stopped.why}`);
|
||||
if (r.status !== 0) fail(1, `the test command exited ${r.status}; the lock stays unmarked`);
|
||||
lock.green_at = new Date().toISOString();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@ import { readFileSync, existsSync } from 'node:fs';
|
|||
import { parseDocument } from '../util/frontmatter.mjs';
|
||||
import { issue, ok, fail } from '../util/result.mjs';
|
||||
import { isMain } from '../util/is-main.mjs';
|
||||
import { extractFindingsBlock } from '../review/findings-schema.mjs';
|
||||
|
||||
export const REVIEW_REQUIRED_FRONTMATTER = [
|
||||
'type',
|
||||
|
|
@ -33,14 +34,13 @@ export const REVIEW_BODY_SECTIONS = ['Executive Summary', 'Coverage', 'Remediati
|
|||
export const VERDICT_VALUES = Object.freeze(['ALLOW', 'WARN', 'BLOCK']);
|
||||
|
||||
const HEX_ID_RE = /^[0-9a-f]{40}$/;
|
||||
const JSON_FENCE_GLOBAL = /```json[ \t]*\r?\n([\s\S]*?)```/gi;
|
||||
|
||||
/** IDs of BLOCKER findings in the trailing JSON block ([] when absent/unparseable). */
|
||||
/**
|
||||
* IDs of BLOCKER findings in the trailing JSON block ([] when absent/unparseable).
|
||||
* Read with the one block reader, so three backticks inside a JSON string do
|
||||
* not end the block early and hide a BLOCKER (release review of 6.3.0, round 8).
|
||||
*/
|
||||
function blockerIdsFromBody(body) {
|
||||
let last = null;
|
||||
let m;
|
||||
JSON_FENCE_GLOBAL.lastIndex = 0;
|
||||
while ((m = JSON_FENCE_GLOBAL.exec(body)) !== null) last = m[1];
|
||||
const last = extractFindingsBlock(body);
|
||||
if (last === null) return [];
|
||||
try {
|
||||
const payload = JSON.parse(last);
|
||||
|
|
|
|||
|
|
@ -50,6 +50,7 @@ import { fileURLToPath } from 'node:url';
|
|||
import { spawnSync } from 'node:child_process';
|
||||
import { sliceSteps, parseStepFields } from '../parsers/plan-schema.mjs';
|
||||
import { commandEnv } from '../util/command-env.mjs';
|
||||
import { isMain } from '../util/is-main.mjs';
|
||||
|
||||
const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
|
||||
|
||||
|
|
@ -149,16 +150,26 @@ export function looksLikeCommand(span) {
|
|||
return true;
|
||||
}
|
||||
|
||||
const COMMENT_NOT_PLAIN = 'a trailing comment with a quote, $, backtick or backslash (the span reaches a shell inside double quotes)';
|
||||
|
||||
// The first backtick-delimited span on the line is the command by convention —
|
||||
// both templates put it first and a second span holds the expected output.
|
||||
// A plan step's `Verify:` and `End-to-end:` fields follow the same convention.
|
||||
export function firstCommand(text) {
|
||||
const m = text.match(/`([^`]+)`/);
|
||||
if (!m) return { command: null, reason: 'no-command' };
|
||||
const raw = dropComment(m[1]);
|
||||
const span = m[1].trim();
|
||||
const raw = dropComment(span);
|
||||
// Template placeholders (`{exact command}`) are not commands.
|
||||
if (raw === '' || /^\{.*\}$/.test(raw)) return { command: null, reason: 'placeholder' };
|
||||
if (!looksLikeCommand(raw)) return { command: null, reason: 'not-a-command' };
|
||||
if (span === '' || /^\{.*\}$/.test(raw)) return { command: null, reason: 'placeholder' };
|
||||
// A span that is only a comment names nothing to run (round 8).
|
||||
if (raw === '' || !looksLikeCommand(raw)) return { command: null, reason: 'not-a-command' };
|
||||
// The comment is never screened, but the executor hands the span as written
|
||||
// to red proof, the test lock and the done line inside double quotes
|
||||
// (`--cmd "{Verify command}"`): there a `"` ends the argument and a `$`, a
|
||||
// backtick or a backslash still means something (release review of 6.3.0,
|
||||
// round 8). A comment with one of them is refused, never dropped.
|
||||
if (/["$`\\]/.test(span.slice(raw.length))) return { command: null, reason: COMMENT_NOT_PLAIN };
|
||||
return { command: raw, reason: '' };
|
||||
}
|
||||
|
||||
|
|
@ -170,7 +181,9 @@ export function firstCommand(text) {
|
|||
* span (`Verify:`, `Regression:`, `End-to-end:`, a `## Verification` bullet)
|
||||
* and a command passed as written (red proof, the done line, the test lock),
|
||||
* so the words screened are the words run (round 7). Only a `#` that opens a
|
||||
* word on the same line is a comment (`tests/a#b.test.mjs` is a path).
|
||||
* word on the same line is a comment: `tests/a#b.test.mjs` is kept whole here,
|
||||
* and the allowlist then refuses the word, since a `#` is not a plain word
|
||||
* (round 8).
|
||||
*/
|
||||
export function dropComment(command) {
|
||||
return String(command ?? '').replace(/[ \t]+#[^\n]*$/, '').trim();
|
||||
|
|
@ -887,6 +900,6 @@ export function main(argv) {
|
|||
return rep.summary.ok ? 0 : 1;
|
||||
}
|
||||
|
||||
if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
|
||||
if (isMain(import.meta.url)) {
|
||||
process.exitCode = main(process.argv.slice(2));
|
||||
}
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@
|
|||
import { appendFileSync, existsSync, readFileSync } from 'node:fs';
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { resolve } from 'node:path';
|
||||
import { DEFAULT_TIMEOUT_MS, allowedCommand, runCommand, screenCommand } from './criteria-runner.mjs';
|
||||
import { DEFAULT_TIMEOUT_MS, allowedCommand, runCommand, screenCommand, stoppedBy } from './criteria-runner.mjs';
|
||||
import { repoRoot } from './red-proof.mjs';
|
||||
import { isMain } from '../util/is-main.mjs';
|
||||
|
||||
|
|
@ -58,9 +58,9 @@ export function writeDoneLine({ cwd, step, cmd, report, timeoutMs = DEFAULT_TIME
|
|||
if (head.status !== 0) return { status: 'not-run', reason: `no git HEAD in ${dir}` };
|
||||
// No shell: the words the screen checked are the words that run.
|
||||
const r = runCommand(cmd, { cwd: dir, timeoutMs });
|
||||
if (r.error || r.status === null) {
|
||||
return { status: 'not-run', reason: `the command did not run to an exit code (${r.error?.message ?? r.signal ?? `exit ${r.status}`})`, exit: r.status };
|
||||
}
|
||||
// A stop is read once, by stoppedBy (round 8).
|
||||
const stopped = stoppedBy(r, { timeoutMs });
|
||||
if (stopped) return { status: 'not-run', reason: `the command ${stopped.why}`, exit: r.status };
|
||||
if (r.status !== 0) return { status: 'failed', reason: `the test command exited ${r.status}`, exit: r.status };
|
||||
const line = `DONE step ${step}: \`${cmd}\` exit 0 at ${head.stdout.trim()} ${new Date().toISOString()}`;
|
||||
appendFileSync(report, `${line}\n`);
|
||||
|
|
|
|||
|
|
@ -98,7 +98,7 @@ function run(cmd, cwd, timeoutMs) {
|
|||
const r = runCommand(cmd, { cwd, timeoutMs });
|
||||
const output = `${r.stdout ?? ''}${r.stderr ?? ''}`;
|
||||
const stopped = stoppedBy(r, { timeoutMs });
|
||||
return { exit: r.status, signal: r.signal ?? null, tap: tap(output), tail: output.slice(-TAIL), spawnError: r.error ? r.error.message : null, stopped: stopped?.why ?? null, loadError: LOAD_ERROR.test(output) };
|
||||
return { exit: r.status, signal: r.signal ?? null, tap: tap(output), tail: output.slice(-TAIL), stopped: stopped?.why ?? null, loadError: LOAD_ERROR.test(output) };
|
||||
}
|
||||
|
||||
/** What the red at the start point was: the test file failing to load, or a test failing. */
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue