fix(storage): reject unknown artifact-store modes on current main - #413
fix(storage): reject unknown artifact-store modes on current main#413seonghobae wants to merge 4 commits into
Conversation
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Please review the unchanged exact current head |
|
Exact-current-head read-only review request for @opencode-agent review |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="961f44a19c4ced87f8062b3ab9842a9a08d05235"
head="e9b97b9212d5dbfafb8af47a17c6ef26f4002800"
repo="ContextualWisdomLab/clearfolio"
pr="413"
echo "== checked-out commit =="
git rev-parse HEAD
echo "== requested commits present =="
git cat-file -t "$base"
git cat-file -t "$head"
echo "== exact two-dot diff summary =="
git diff --stat "$base" "$head"
echo "== changed paths =="
git diff --name-status "$base" "$head"
echo "== exact diff =="
git diff --no-ext-diff --unified=80 "$base" "$head"
echo "== AST outline for changed source/test files =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
echo "--- $file ---"
ast-grep outline "$file" --items all --view expanded 2>&1 || true
done
echo "== artifact-store related definitions and tests =="
rg -n -i -C 4 \
'(artifact[-_ ]?store|filesystem|set[A-Za-z0-9_]*mode|store[A-Za-z0-9_]*mode|NUL|\\0)' \
-g '!node_modules/**' -g '!dist/**' -g '!build/**' .
echo "== GitHub PR live metadata =="
gh pr view "$pr" --repo "$repo" --json number,state,isDraft,mergeable,baseRefOid,headRefOid,reviewDecision,statusCheckRollup,reviews
echo "== GitHub PR review threads =="
gh api "repos/$repo/pulls/$pr/comments?per_page=100" \
--jq '.[] | {id, user: .user.login, path, line, side, body, created_at}' || trueLength of output: 201847 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="961f44a19c4ced87f8062b3ab9842a9a08d05235"
head="e9b97b9212d5dbfafb8af47a17c6ef26f4002800"
repo="ContextualWisdomLab/clearfolio"
pr="413"
echo "== repository identity and ancestry =="
printf 'checked_out='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=true"
echo "== changed paths =="
git diff --name-status "$base" "$head"
echo "== exact diff =="
git diff --no-ext-diff --unified=40 "$base" "$head"
echo "== changed-file content at requested head =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
echo "--- $file ---"
git show "$head:$file" | cat -n
done
echo "== configuration declarations and artifact store wiring =="
rg -n -C 12 \
'(class .*Properties|artifact.*store|ArtifactStore|set[A-Za-z]*Mode|get[A-Za-z]*Mode|filesystem|artifact-store)' \
src/main/java src/test/java \
-g '*.java'
echo "== GitHub comparison and branch protection =="
gh api "repos/$repo/compare/$base...$head" \
--jq '{status, merge_base_commit: .merge_base_commit.sha, ahead_by, behind_by, total_commits, files: [.files[] | {filename, status, additions, deletions}]}'
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks, required_pull_request_reviews}' || true
echo "== GitHub review comments and reviews =="
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq '.[] | {user: .user.login, state, commit_id, submitted_at, body}' || true
gh api "repos/$repo/pulls/$pr/comments?per_page=100" \
--jq '.[] | {user: .user.login, path, line, side, body, commit_id}' || trueLength of output: 202192 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="961f44a19c4ced87f8062b3ab9842a9a08d05235"
head="e9b97b9212d5dbfafb8af47a17c6ef26f4002800"
source_file="src/main/java/com/clearfolio/viewer/config/ArtifactStoreProperties.java"
test_file="src/test/java/com/clearfolio/viewer/config/ArtifactStorePropertiesTest.java"
echo "== exact targeted diff =="
git diff --no-ext-diff --unified=100 "$base" "$head" -- "$source_file" "$test_file"
echo "== ArtifactStoreProperties at requested head =="
git show "$head:$source_file" | cat -n
echo "== ArtifactStorePropertiesTest at requested head =="
git show "$head:$test_file" | cat -n
echo "== all mode accessor call sites =="
rg -n -C 5 '\b(getMode|setMode)\s*\(' \
src/main/java src/test/java -g '*.java'
echo "== explicit test method names at requested head =="
git show "$head:$test_file" | \
rg -n '^\s*(void|public void|private void)\s+[A-Za-z0-9_]+\s*\('Length of output: 29069
No findings.
GitHub reports
|
|
@opencode-agent review Review exact head Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="413"
base="961f44a19c4ced87f8062b3ab9842a9a08d05235"
head="e9b97b9212d5dbfafb8af47a17c6ef26f4002800"
echo "== Commit identity and ancestry =="
printf 'checked_out='; git rev-parse HEAD
printf 'base_type='; git cat-file -t "$base"
printf 'head_type='; git cat-file -t "$head"
printf 'merge_base='; git merge-base "$base" "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=true'
echo "== Exact changed paths =="
git diff --name-status "$base" "$head"
echo "== Exact diff =="
git diff --no-ext-diff --unified=80 "$base" "$head"
echo "== Changed-file outlines =="
git diff --name-only "$base" "$head" | while IFS= read -r file; do
echo "--- $file ---"
ast-grep outline "$file" --items all --view expanded 2>&1 || true
done
echo "== Artifact-store mode declarations, use sites, and tests =="
rg -n -C 8 --glob '*.java' \
'\b(class\s+ArtifactStoreProperties|setMode\s*\(|getMode\s*\(|artifact[-_ ]?store|filesystem|IllegalArgumentException|\\0|NUL)\b' \
src/main/java src/test/java
echo "== Requested-head content for changed Java files =="
git diff --name-only "$base" "$head" -- '*.java' | while IFS= read -r file; do
echo "--- $file @ $head ---"
git show "$head:$file" | cat -n
done
echo "== Live pull request state =="
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,baseRefOid,headRefOid,reviewDecision,statusCheckRollup,reviews
echo "== Live review comments =="
gh api "repos/$repo/pulls/$pr/comments?per_page=100" \
--jq '.[] | {user: .user.login, path, line, side, commit_id, created_at, body}' || true
echo "== Live review-thread resolution summary =="
gh api graphql -F owner="ContextualWisdomLab" -F name="clearfolio" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body path } } }
}
}
}
}' --jq '
.data.repository.pullRequest.reviewThreads.nodes
| {
total: length,
unresolved: map(select(.isResolved == false)) | length,
unresolved_current: map(select(.isResolved == false and .isOutdated == false)) | length
}' || trueLength of output: 206732
No findings.
GitHub still reports
|
|
Exact-current-head independent review request for The two-file artifact-store configuration boundary is mergeable; CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. Blank authority preserves the secure filesystem default, explicit filesystem/in-memory modes normalize deterministically, and unknown or NUL-corrupted modes fail without replacing the prior value. Protected @opencode-agent review Review this exact head read-only. Do not mutate the branch, synthesize author approval, weaken protection, or merge. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
pr="413"
head="e9b97b9212d5dbfafb8af47a17c6ef26f4002800"
source_file="src/main/java/com/clearfolio/viewer/config/ArtifactStoreProperties.java"
test_file="src/test/java/com/clearfolio/viewer/config/ArtifactStorePropertiesTest.java"
echo "== Requested commit and checkout =="
printf 'checked_out='; git rev-parse HEAD
printf 'requested_head_type='; git cat-file -t "$head"
printf 'requested_head_parent='; git rev-parse "${head}^"
echo "== Live PR and protected main refs =="
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,baseRefName,baseRefOid,headRefName,headRefOid,reviewDecision,statusCheckRollup,reviews
printf 'live_main='; git ls-remote origin refs/heads/main | awk '{print $1}'
echo "== Requested head ancestry and merge bases =="
requested_base=$(git rev-parse "${head}^")
live_main=$(git ls-remote origin refs/heads/main | awk '{print $1}')
printf 'requested_base='; echo "$requested_base"
printf 'merge_base_requested_base_head='; git merge-base "$requested_base" "$head"
printf 'merge_base_live_main_head='; git merge-base "$live_main" "$head"
if git merge-base --is-ancestor "$live_main" "$head"; then
echo 'live_main_is_ancestor_of_head=true'
else
echo 'live_main_is_ancestor_of_head=false'
fi
echo "== Exact PR diff from parent =="
git diff --no-ext-diff --stat "$requested_base" "$head"
git diff --no-ext-diff --name-status "$requested_base" "$head"
git diff --no-ext-diff --unified=80 "$requested_base" "$head"
echo "== Current merge-base diff paths =="
live_merge_base=$(git merge-base "$live_main" "$head")
git diff --no-ext-diff --name-status "$live_merge_base" "$head"
echo "== Changed-file outlines =="
for file in "$source_file" "$test_file"; do
echo "--- $file ---"
ast-grep outline "$file" --items all --view expanded
done
echo "== Requested-head source and tests =="
for file in "$source_file" "$test_file"; do
echo "--- $file @ $head ---"
git show "$head:$file" | cat -n
done
echo "== Mode accessor and artifact-store call sites =="
rg -n -C 5 --glob '*.java' \
'\b(getMode|setMode)\s*\(|\bArtifactStoreProperties\b|artifact[-_ ]?store|filesystem|in-memory|IllegalArgumentException|\\0|NUL' \
src/main/java src/test/java
echo "== Live review thread state =="
gh api graphql -F owner="ContextualWisdomLab" -F name="clearfolio" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } path line body } }
}
}
}
}
}' --jq '
.data.repository.pullRequest.reviewThreads.nodes |
{total: length,
unresolved: map(select(.isResolved == false)) | length,
unresolved_current: map(select(.isResolved == false and .isOutdated == false)) | length}'
echo "== Required status check conclusion summary =="
gh pr checks "$pr" --repo "$repo" --requiredLength of output: 199359
No findings.
Live The PR remains
|
1 participant
Objective
Fail closed on unsupported or corrupted artifact-store modes while preserving the secure
filesystemdefault.Exact current-head evidence
961f44a19c4ced87f8062b3ab9842a9a08d05235;1709b150faef6009f449ccc2f1c3f6ba2b96e391;e9b97b9212d5dbfafb8af47a17c6ef26f4002800;Contract
Explicit
filesystemvalues normalize deterministically; unknown modes such as URI-like secret-bearing text and NUL-corrupted known-mode input are rejected with a controlled failure; a rejected setter call cannot replace the secure default.Scope boundary
Configuration integrity only. Artifact bytes, atomic writes, signed links, tenant authority, deletion lifecycle, and credential adapters are unchanged.
Merge gate
Keep this exact head unchanged. Auto-merge may act only after live checks remain successful, zero valid unresolved findings remain, and a qualifying independent non-author approval is attached to this exact head. Automated evidence and predecessor reviews do not transfer.