mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-21 00:21:30 +00:00
96dc368d96
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Publish / Classify release event (push) Waiting to run
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Publish / ci (push) Blocked by required conditions
Publish / Publish to npm (push) Blocked by required conditions
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
* chore(ci): add shared vendored-grammars manifest; monitor reads it .github/vendored-grammars.json is the single source of truth for the vendored tree-sitter grammars (c/swift/kotlin/dart/proto): name, upstream coords, and policy holds. update-vendored-grammars.mjs now builds its GRAMMARS map from the manifest (behavior-preserving — same exported shape). Adds manifest-agreement tests so the loader can't silently skew from the file. * fix(ci): classify vendored grammars from manifest, drop bare "?" (#858) The readiness report decided "is this vendored?" via is_vendored_pin (a file: package.json spec) — but the 5 vendored grammars aren't in package.json, so they were misrouted through the npm path and rendered bare "?" for ABI (read from an empty node_modules), plus a spurious "? (fetch failed)" for github-only proto. Now vendored grammars are classified by membership in the shared manifest and their ABI is read from gitnexus/vendor/<name>/src/parser.c (always in a checkout). github-only vendored grammars skip the npm peer-dep fetch; the tree-sitter-c hold is surfaced from the manifest (held, not plain "Ready"); and every remaining unintrospectable value renders a labeled token, never a bare "?". --assert-current now covers the vendored grammars too instead of skipping them. Adds a stdlib unittest suite incl. a manifest⇄vendor-dir consistency guard. * docs(ci): document the shared vendored-grammars manifest Both tree-sitter workflow headers now point at .github/vendored-grammars.json as the shared source of truth; the readiness workflow gains a PR-path trigger on the manifest + test, and runs the readiness unit tests on validation events. CONTRIBUTING.md documents the manifest contract under CI automation contracts. * fix(review): apply autofix feedback - Guard manifest reads in both scripts with a clear error (was an opaque module-import traceback that crashed the script and test collection). - Never render a bare "?": relabel the npm-path ABI/version/peer sentinels and the vendored upstream-ABI miss to labeled tokens; the report is now ?-free regardless of node_modules/network, and the test is hermetic. - Add a VENDORED_NAMES ⊆ GRAMMARS guard + manifest-missing error test. - Drop now-dead is_vendored_pin/is_vendored/_(vendored)_. - Compose held + out-of-range vendored blocker reasons instead of overwriting. - Reword the shared-manifest docs to not over-claim shared upstream coords. * fix(ci): apply root prettier formatting to mjs + ts test The quality/format gate runs root `prettier --check .` (printWidth 100, the gitnexus-local config differs and falsely passed locally). * test(ci): make both tree-sitter scripts testable offline The scripts hit live npm/GitHub, which makes the report run flaky and the monitor's detect/apply logic untestable. Add hermetic seams: - readiness: --offline flag (+ GITNEXUS_TS_READINESS_OFFLINE env) no-ops the npm registry + upstream fetches; the report renders deterministically (vendored ABIs from the repo, npm columns marked 'offline', no bare '?'). 3 tests assert an offline run touches ZERO network (urlopen patched to raise). - monitor: detect() and apply() accept injected deps (vendoredVersion/ resolveUpstream/fetchSource/readAbi) so the newer/ABI/hold gating runs offline with fixtures; apply gains --dry-run (validates but writes nothing). 6 tests cover newer/same-version/held-c/ABI-15/applicable + a no-mutation dry-run. * fix(review): keep --assert-current hermetic + harden the no-bare-? invariant Tri-review findings (PR #2187): - P2 REGRESSION: --assert-current (documented 'hermetic and offline', run in CI without --offline) routed the 5 vendored grammars through vendored_drift_summary, which fetches upstream parser.c + commit sha — 10 discarded network calls per run. Fix: read the vendored ABI locally via a new vendored_abi_from_repo() helper (also used by vendored_drift_summary). Now verifiably network-free. - Unify the upstream-ABI miss sentinel: prose said 'n/a (generated at build)' while the matrix said 'n/a' — and 'generated at build' is a wrong cause (swift HAS a committed parser.c). Both now render neutral 'n/a'. - Fix the stale assert_current docstring claiming swift is prebuilt-only/no parser.c. - Guard the last latent bare-? path (vendor package.json missing 'version'). Tests: AssertCurrent (network-free guard + out-of-range via the new injection point), malformed-JSON manifest, detect() error-path, explicit npm/github undefined assertions. 17 Python + 15 vitest, all hermetic. * fix(review): use a single unittest import style (CodeQL 753) CodeQL py/import-and-import-from flagged `import unittest` + `from unittest import mock`. Collapse to `from unittest import TestCase, main, mock`. * fix(review): explicit raise in _matrix_row (CodeQL 754) CodeQL py/mixed-returns flagged the implicit fall-through after self.fail() (which it doesn't model as NoReturn). End with an explicit raise AssertionError. * test(review): replace non-null assertions with a must() guard @typescript-eslint/no-non-null-assertion flagged 4 `!` operators. Add a narrowing must<T>(value, message) helper (throws on undefined) and a named baseResolveUpstream, removing every non-null assertion. * fix(review): unguessable heredoc delimiter for the report output The report embeds the manifest `hold` field (fork-PR-editable); a fixed DRIFT_EOF delimiter in a hold value could close the $GITHUB_OUTPUT heredoc early and inject output keys. Use DRIFT_EOF_$(openssl rand -hex 16) — a value the report cannot contain. (Randomized delimiter over base64: keeps REPORT raw markdown, no consumer-side decode.) * fix(review): scope issues:write to scheduled runs (two-job split) GitHub Actions has no step-level permissions, so the only way to keep PR runs (incl. forks) from receiving `issues: write` is to split the job. A `report` job (contents:read, all events) renders the report + the PR `:⚠️:` and exposes report/exit_code as job outputs; a schedule-only `upsert-issue` job (needs: report, issues:write, no checkout) consumes them for the issue upsert + close. The 'Check upgrade readiness' check name is preserved. * fix(review): launder npm-version '?' in disposition prose The disposition bucket prose interpolated r['npm_version'] raw, so a successful 200 npm /latest response lacking a 'version' key would render a bare '?' (the matrix cell already laundered it). Add npm_version_label ('unknown' for '?') and use it in all five bucket renderers. Test a version-less npm response. * refactor(review): load_vendored_manifest returns only the consumed 'hold' The readiness script reads only the grammar names + 'hold'; the 'key' and 'upstream' fields were phantom data (upstream-drift coords live in the script's own GRAMMARS map). Narrow the return to {hold}. * fix(review): unify detect()/apply() 'newer' check for github grammars detect() compared the bare sha7 while apply() compared up.version (the full <base>-g<sha7> provenance string apply() also writes). After the bot re-vendored a github grammar once, detect() reported a perpetual false 'update available' while apply() correctly saw 'already current' — a noisy job summary + wasted --apply subprocess (the PR-exists guard absorbed it before any duplicate PR). Extract a shared isNewer(up, have) helper used by both. Tests cover equal- provenance (false), first-vendoring plain-version (true, not suppressed), and sha-advanced (true). Coupled with U12 (the detect⇄apply agreement assertion lives there once apply()'s not-newer path returns instead of process.exit). * test(review): cover main()'s out-of-range + prebuilt-only vendored ABI branches main()'s vendored-ABI classification reads through vendored_abi_from_repo (the local-read seam --assert-current uses), so patching it drives the 'Vendored (ABI out of range)' blocker branch and the prebuilt-only (vendored_abi None → 'prebuilt' cell, not '?') branch — neither reachable today since all 5 vendor dirs ship parser.c at ABI 14. * test(review): monitor-side manifest⇄vendor-dir consistency guard Mirror the Python consistency guard on the monitor side — the monitor consumes the same manifest and is the side that WRITES files from manifest `name`, so manifest/vendor-dir drift must fail CI here too. * fix(review): validate grammar names at manifest load (path-traversal guard) The manifest `name` is joined into gitnexus/vendor/<name> paths in both scripts (and apply() WRITES there), so reject any name not matching tree-sitter-[a-z0-9-]+ at the single load chokepoint — defense-in-depth even though the live trust boundary already prevents exploitation. loadManifestGrammars gains an injectable `raw` arg + export for testing; tests reject a '../etc' name in both scripts. * refactor(review): apply() throws ApplyExit; CLI maps to exit codes apply()'s 4 process.exit calls killed the vitest worker, blocking in-process tests of its error branches. Replace them with a thrown ApplyExit{code}; the not-newer (already-current) path returns `have` instead of exit(0). The isMain CLI block try/catches and maps ApplyExit.code → process.exit, so the monitor's subprocess contract (exit 0/2/3) is byte-identical (verified via subprocess smoke). Tests cover unknown-key=2, held=3, ABI-reject=3, and not-newer (returns current, no throw, no write). * refactor(review): extract vendored render helper; trim docstrings (<1000 lines) Extract the 'Vendored parsers' prose render into _render_vendored_section() so main() coordinates named phases rather than inlining a ~450-line monolith, and condense the most verbose docstrings/comments. The script drops from 1092 to 999 lines (under the 1000 bar the maintainability review flagged). Behavior-preserving: the deterministic --offline render is byte-identical before/after (verified in-place), --assert-current still passes, and the full unit suite is green. * fix(review): row-diff regex captures only the Status cell The change-detection regex captured the whole row tail as group 2, so any non-status cell drift (e.g. an upstream-ABI bump) emitted a false-positive 'change' line. Capture only the Status cell ([^|]+? before the final |$). The workflow parseRows regex and the Python _ROW_DIFF_RE stay byte-identical; the stability test now asserts group 2 is the status string (e.g. c → 'Vendored — held') and contains no pipe. * fix(ci): hoist intro string out of the list literal (CodeQL 755) The U13 extraction moved the 'Vendored parsers' intro paragraph (implicitly concatenated string literals) INTO a list literal, tripping CodeQL py/implicit-string-concatenation-in-list (reads as a possibly-missing comma between elements). Hoist it into a parenthesized `intro` variable. Render is byte-identical. |
||
|---|---|---|
| .. | ||
| call-routing | ||
| cfg | ||
| group | ||
| ingestion | ||
| integrations | ||
| mcp | ||
| model | ||
| scope-resolution | ||
| taint | ||
| workers | ||
| ai-context.test.ts | ||
| analyze-api.test.ts | ||
| analyze-community-skills-gate.test.ts | ||
| analyze-config.test.ts | ||
| analyze-embedding-endpoint-flags.test.ts | ||
| analyze-embeddings-limit.test.ts | ||
| analyze-gitnexusrc.test.ts | ||
| analyze-heap-respawn.test.ts | ||
| analyze-job.test.ts | ||
| analyze-lbug-checkpoint-threshold.test.ts | ||
| analyze-local-embedding-error.test.ts | ||
| analyze-no-stats-bridge.test.ts | ||
| analyze-respawn-progress-terminal.test.ts | ||
| analyze-wal-error.test.ts | ||
| analyze-worker-ipc.test.ts | ||
| analyze-worker-pool-size.test.ts | ||
| analyze-worker-timeout.test.ts | ||
| api-analyze-upload.test.ts | ||
| api-file-route.test.ts | ||
| api-graph-streaming.test.ts | ||
| api-query-readonly-wiring.test.ts | ||
| api-readonly-wiring.test.ts | ||
| assert-publish-grammar-coverage.test.ts | ||
| ast-utils.test.ts | ||
| binding-accumulator.test.ts | ||
| blade-template-routes.test.ts | ||
| bm25-search.test.ts | ||
| build-tree-sitter-grammars-probe.test.ts | ||
| c-static-linkage-side-channel.test.ts | ||
| call-attribution-issue-1166.test.ts | ||
| call-extraction.test.ts | ||
| call-form.test.ts | ||
| call-processor-routes.test.ts | ||
| calltool-dispatch.test.ts | ||
| chunker.test.ts | ||
| cli-commands.test.ts | ||
| cli-i18n.test.ts | ||
| cli-impact-disambiguation.test.ts | ||
| cli-index-help.test.ts | ||
| cli-message.test.ts | ||
| clone-safety-cloneable.test.ts | ||
| clone-safety-payloads.test.ts | ||
| clone-safety.test.ts | ||
| cobol-copy-expander.test.ts | ||
| cobol-preprocessor.test.ts | ||
| cohesion-consistency.test.ts | ||
| community-processor.test.ts | ||
| compatible-stdio-transport.test.ts | ||
| cors.test.ts | ||
| cpp-ue-preprocessor.test.ts | ||
| csharp-namespace-extraction.test.ts | ||
| csv-escaping.test.ts | ||
| cursor-hook.test.ts | ||
| dart-import-resolver.test.ts | ||
| dart-type-extractor.test.ts | ||
| deferred-resolution-profile.test.ts | ||
| detect-changes-worktree.test.ts | ||
| dockerfile-runtime-asset-parity.test.ts | ||
| doctor-format.test.ts | ||
| embedder.test.ts | ||
| embedding-chunking.test.ts | ||
| embedding-config.test.ts | ||
| embedding-dims.test.ts | ||
| embedding-pipeline.test.ts | ||
| embedding-runtime-support.test.ts | ||
| entry-point-scoring.test.ts | ||
| env.test.ts | ||
| esm-extension-resolution.test.ts | ||
| eval-formatters.test.ts | ||
| eval-server-bind-restriction.test.ts | ||
| exact-search.test.ts | ||
| expo-routes.test.ts | ||
| extract-element-type-from-string.test.ts | ||
| extract-generic-type-args.test.ts | ||
| fastapi-router-bindings.test.ts | ||
| fetch-reason-parsing.test.ts | ||
| field-extraction.test.ts | ||
| format-elapsed.test.ts | ||
| framework-detection.test.ts | ||
| fts-rss-verdict.test.ts | ||
| git-clone.test.ts | ||
| git-utils.test.ts | ||
| git.test.ts | ||
| grammar-update-monitor.test.ts | ||
| graph.test.ts | ||
| group-service-not-found.test.ts | ||
| has-method.test.ts | ||
| hf-env.test.ts | ||
| hook-db-lock-probe.test.ts | ||
| hooks.test.ts | ||
| http-client-safe-url.test.ts | ||
| http-embedder.test.ts | ||
| hybrid-search.test.ts | ||
| ignore-service.test.ts | ||
| impact-batching-grouping.test.ts | ||
| impact-confidence.test.ts | ||
| impact-pagination.test.ts | ||
| import-cycles.test.ts | ||
| import-resolver-factory.test.ts | ||
| incremental-file-hash.test.ts | ||
| incremental-orchestration.test.ts | ||
| incremental-parse-cache.test.ts | ||
| incremental-shadow-candidates.test.ts | ||
| incremental-subgraph-extract.test.ts | ||
| index-repo-command.test.ts | ||
| ingestion-utils.test.ts | ||
| java-call-arity.test.ts | ||
| java-spring-route-ingestion.test.ts | ||
| jcl-parser.test.ts | ||
| kotlin-scope-captures.test.ts | ||
| kotlin-static-marker.test.ts | ||
| language-availability-skip.test.ts | ||
| language-skip.test.ts | ||
| laravel-route-extraction.test.ts | ||
| lazy-action.test.ts | ||
| lbug-adapter-wal-schema.test.ts | ||
| lbug-checkpoint-lifecycle.test.ts | ||
| lbug-checkpoint.test.ts | ||
| lbug-config-wal.test.ts | ||
| lbug-embedding-hashes.test.ts | ||
| lbug-extension-loader.test.ts | ||
| lbug-native-check.test.ts | ||
| lbug-native-safe-path.test.ts | ||
| lbug-pool-fts-load.test.ts | ||
| lbug-query-result-utils.test.ts | ||
| lbug-readonly-error.test.ts | ||
| list-status-branch.test.ts | ||
| local-backend-maxbuffer.test.ts | ||
| local-cli-subprocess.test.ts | ||
| local-symbol-pruner.test.ts | ||
| logger.test.ts | ||
| max-file-size.test.ts | ||
| mcp-http-transport.test.ts | ||
| mcp-stdout-sentinel.test.ts | ||
| mcp-wal-feedback.test.ts | ||
| method-extraction.test.ts | ||
| method-props.test.ts | ||
| mro-processor.test.ts | ||
| noise-filter.test.ts | ||
| onnxruntime-common-resolver.test.ts | ||
| parse-diff-hunks.test.ts | ||
| parse-impl-warm-cache-parsedfile-coverage.test.ts | ||
| parse-impl-worker-lazy-cache.test.ts | ||
| parse-impl-worker-startup-gating.test.ts | ||
| parsedfile-store.test.ts | ||
| parser-loader-abi.test.ts | ||
| parser-loader-skip-optional.test.ts | ||
| parser-loader.test.ts | ||
| parsing-worker-fallback.test.ts | ||
| pdg-mode-flip.test.ts | ||
| phase-timer.test.ts | ||
| php-namespace-extraction.test.ts | ||
| php-template-scope.test.ts | ||
| pipeline-exports.test.ts | ||
| pipeline-runner.test.ts | ||
| platform-capabilities.test.ts | ||
| pool-wal-recovery.test.ts | ||
| prebuild-coverage.test.ts | ||
| private-ip.test.ts | ||
| process-processor.test.ts | ||
| publish.test.ts | ||
| query-degraded-signal.test.ts | ||
| query-fts-parameterization.test.ts | ||
| query-params.test.ts | ||
| range-binding-parse-timeout.test.ts | ||
| rate-limit.test.ts | ||
| receiver-extraction.test.ts | ||
| rel-csv-split.test.ts | ||
| repo-manager-ensure-ignore-readonly.test.ts | ||
| repo-manager-finalize-invariant.test.ts | ||
| repo-manager-transient-error.test.ts | ||
| repo-manager.test.ts | ||
| resolve-enclosing-owner.test.ts | ||
| resolve-invocation.test.ts | ||
| resources.test.ts | ||
| result-merge.test.ts | ||
| route-tool-detection.test.ts | ||
| run-analyze-fts-repair.test.ts | ||
| run-analyze.test.ts | ||
| runner-exec-tail.test.ts | ||
| safe-parse.test.ts | ||
| schema.test.ts | ||
| scope-index-store.test.ts | ||
| security.test.ts | ||
| semantic-chunk-search.test.ts | ||
| server-cors-stack.test.ts | ||
| server-validation.test.ts | ||
| server.test.ts | ||
| setup-antigravity.test.ts | ||
| setup-codex.test.ts | ||
| setup-jsonc.test.ts | ||
| setup-selection.test.ts | ||
| setup.test.ts | ||
| shape-check.test.ts | ||
| shared-type-extractors.test.ts | ||
| sibling-clone-drift.test.ts | ||
| sidecar-recovery.test.ts | ||
| skill-gen.test.ts | ||
| skills-steering.test.ts | ||
| skip-git-cli.test.ts | ||
| spring-route-extractor-parity.test.ts | ||
| staleness.test.ts | ||
| stdout-silence.test.ts | ||
| structure-processor.test.ts | ||
| suffix-index-ambiguity.test.ts | ||
| symbol-table.test.ts | ||
| text-generator.test.ts | ||
| tool-direct-cli.test.ts | ||
| tool-process-linking.test.ts | ||
| tools.test.ts | ||
| topological-sort.test.ts | ||
| tree-sitter-queries.test.ts | ||
| type-env.test.ts | ||
| uninstall.test.ts | ||
| upload-ingest.test.ts | ||
| upload-sweep.test.ts | ||
| utils.test.ts | ||
| variable-extraction.test.ts | ||
| vendored-grammars.test.ts | ||
| vue-sfc-extractor.test.ts | ||
| wal-checkpoint-driver.test.ts | ||
| web-ui-serving.test.ts | ||
| wiki-flags.test.ts | ||
| wiki-grouping-batch.test.ts | ||
| wiki-llm-client.test.ts | ||
| wiki-mermaid-sanitizer.test.ts | ||
| worker-pool-cumulative-timeout.test.ts | ||
| worker-pool-error-stack.test.ts | ||
| worker-pool-options.test.ts | ||
| worker-pool-resilience.test.ts | ||
| worker-pool-slot-generation.test.ts | ||
| worker-pool-startup-stderr.test.ts | ||
| worker-pool-timeout-retire.test.ts | ||
| worker-pool-transferlist.test.ts | ||
| worker-pool-windows-quarantine.test.ts | ||