Skip to content

chore(pre-commit): add check-merge-conflict hook - #182

Merged
lusoris merged 1 commit into
masterfrom
chore/pre-commit-conflict-marker-audit
May 31, 2026
Merged

lusoris merged 1 commit into
masterfrom
chore/pre-commit-conflict-marker-audit

Conversation

@lusoris

@lusoris lusoris commented May 29, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Adds no-conflict-markers local hook (scripts/ci/check-conflict-markers.sh) as a belt-and-suspenders companion to the existing check-merge-conflict entry (pre-commit-hooks v6.0.0).
  • The new hook uses git grep (git's C binary, < 5ms) and fires on every commit regardless of file type; check-merge-conflict is Python-based and covers the standard three-way conflict syntax.
  • PR fix(ci): remove committed merge-conflict markers from CI YAML files #174 (commit a4e9e707) fixed 70 files contaminated by conflict markers from commit 24bb5daf; this hook would have blocked that commit at the pre-commit gate.
  • Cleaned up: PR was previously contaminated with 5,435 LOC of unrelated changes. Reconstructed as a clean 3-file, 55-line diff on top of master.

Type

  • build / ci — tooling / infra

Checklist

  • Commits follow Conventional Commits.
  • make format && make lint is green locally (pre-commit hooks all passed on commit).
  • Unit tests pass: meson test -C build.
  • If I touched any SIMD/GPU code path, I ran /cross-backend-diff and the worst ULP is ≤ 2.
  • If I touched a feature extractor with SIMD/GPU twins, I either updated every twin or listed the gap under "Known follow-ups" below.
  • If I added a new .c / .cpp / .cu / .h / .hpp, it has the appropriate license header.
  • If this is a breaking change, the commit message uses ! or BREAKING CHANGE:.
  • If this PR adds an ADR, the ADR row lives in docs/adr/_index_fragments/<NNNN-slug>.md.

Bug-status hygiene (ADR-0165)

no state delta: tooling-only change; no bug opened or closed.

Netflix golden-data gate (ADR-0024)

  • I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Cross-backend numerical results

no rebase impact: pre-commit-only.

Deep-dive deliverables (ADR-0108)

  • Research digest — no digest needed: trivial pre-commit hook addition
  • Decision matrix — no alternatives: only-one-way fix
  • AGENTS.md invariant note — no rebase-sensitive invariants
  • Reproducer / smoke-test command — see Reproducer below
  • CHANGELOG fragment — changelog.d/changed/pre-commit-conflict-marker.md
  • Rebase note — no rebase impact: pre-commit-only change

Reproducer

# Verify the new hook catches a real conflict marker
echo "<<<<<<< HEAD" >> /tmp/test-conflict.txt
git add /tmp/test-conflict.txt 2>/dev/null || true
pre-commit run no-conflict-markers --files /tmp/test-conflict.txt
# Expected: hook fires and exits 1

# Verify clean commit passes
pre-commit run --files .pre-commit-config.yaml scripts/ci/check-conflict-markers.sh

Known follow-ups

None.

🤖 Generated with Claude Code

@lusoris
lusoris enabled auto-merge (squash) May 29, 2026 10:26
@lusoris
lusoris force-pushed the chore/pre-commit-conflict-marker-audit branch from 83a4dc4 to 6cf96ef Compare May 29, 2026 11:33
@lusoris
lusoris disabled auto-merge May 29, 2026 11:43
@lusoris
lusoris marked this pull request as draft May 29, 2026 11:43
@lusoris
lusoris force-pushed the chore/pre-commit-conflict-marker-audit branch 3 times, most recently from 305a16a to fcab22a Compare May 29, 2026 15:30
@lusoris
lusoris marked this pull request as ready for review May 31, 2026 13:37
@lusoris
lusoris force-pushed the chore/pre-commit-conflict-marker-audit branch from fcab22a to 2a6eedb Compare May 31, 2026 13:37
@lusoris
lusoris merged commit d3d7df5 into master May 31, 2026
29 of 30 checks passed
@lusoris
lusoris deleted the chore/pre-commit-conflict-marker-audit branch May 31, 2026 13:37
lusoris added a commit that referenced this pull request Jun 12, 2026
…CI) (#868)

* fix(codeql): resolve HIGH-severity security-cpp-high alerts (23 sites)

- cpp/integer-multiplication-cast-to-long (11): pre-cast one operand to
  size_t / double / ptrdiff_t before int*int multiplications in
  cambi.c, float_vif.c (log message), iqa/convolve.c (img_offset),
  moment.c, psnr.c, and vif_tools.c (four memcpy size expressions).
  Add stddef.h to convolve.c for ptrdiff_t.

- cpp/incomplete-parity-check (3): change `% 2 == 1` to `% 2 != 0`
  in vif_tools.c (assert), svm.cpp (powi loop), pdjson.c (JSON
  object key/value alternation). The == 1 form is wrong for negative
  operands; != 0 is always correct.

- cpp/wrong-type-format-argument (2): fix float_vif.c error log that
  printed size_t fields scaled_w/scaled_h with %d; change to %zu.

- cpp/world-writable-file-creation (1): in vmaf.cpp replace bare
  fopen("wb") with open(O_WRONLY|O_CREAT|O_TRUNC, 0644)+fdopen() on
  POSIX so the created file is never world-writable independent of the
  caller's umask. Add <fcntl.h>.

- cpp/path-injection (4): in test_output.c resolve the mkstemp-created
  path through realpath() immediately after creation, breaking the taint
  chain from getenv("TMPDIR") to the vmaf_write_output call site.

- cpp/toctou-race-condition (2): skipped — both sites are in test
  cleanup (RMDIR after stat assertion). The stat result drives a test
  assertion, not a security-sensitive access decision; no atomic
  replacement of open() is applicable to rmdir. Reported as skipped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(codeql): resolve security-python-and-ci CodeQL alerts

Fixes 18 open CodeQL alerts across the Python and CI categories:

- yaml.github-actions.security.run-shell-injection (#661): move
  github.event_name, github.base_ref, and github.event.before from
  inline ${{...}} interpolation to env: vars in the SYCL clang-tidy
  detect step of lint-and-format.yml.

- python.lang.security.use-defused-xml-parse (#216, #217): replace
  xml.etree.ElementTree with defusedxml.ElementTree in
  feature_extractor.py and quality_runner.py; add defusedxml>=0.7.1
  to python/pyproject.toml and python/requirements.txt.

- py/undefined-export (#352, #353, #354, #616): restructure
  aiutils/__init__.py to do a conditional eager import of the parquet
  helpers so the names are defined when pyarrow is present, and only
  include them in __all__ when the import succeeded.

- py/stack-trace-exposure (#178, #179, #585): log exception detail
  server-side and return a generic message to the HTTP client in
  http_transport.py _handle_score (invalid JSON, bad params, scorer
  error branches).

- python.lang.security.audit.dangerous-subprocess-use-tainted-env-args
  (#227, #372): add shlex.quote() around user-supplied path arguments
  passed into shell strings in extract_ugc_features.py and
  test_bbb_e2e_v5_bug_cluster.py.

- py/file-not-closed (#677, #678): replace bare open() calls with
  context managers in test_coverage_round3.py.

- py/redundant-comparison (#427, #431): remove redundant
  assert not (x != y) lines that duplicate the preceding assert x == y.

- py/equals-hash-mismatch (#182): convert RdPoint to frozen=True
  dataclass so __eq__ and __hash__ are generated consistently.

- py/inheritance/signature-mismatch (#197): add result_dict=None
  default to EnsembleVmafQualityRunner._populate_result_dict so the
  signature is compatible with the base class.

- py/multiple-definition (#201): drop redundant assignment to
  feature_found in feature_extractor.py wildcard discovery path.

- py/str-format/surplus-named-argument (#204): remove unused
  dataset= kwarg from the format() call in routine.py.

Skipped: python.lang.security.audit.insecure-file-permissions (#373) —
  the Unix socket at 0o660 is intentional (Go sidecar node must write
  to it and runs as the same UNIX group); tightening to 0o644 would
  break the IPC channel.

Skipped: py/path-injection (#180, #181) — _validate_path() already
  resolves the path and checks it against an allowlist before any file
  operation; the data flow is secure and the CodeQL dataflow trace is a
  false positive on this allowlisted pattern.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Lusoris <lusoris@pm.me>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@lusoris lusoris added this to the 1.0.0 — First release milestone Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant