Repository navigation
CI-SEC-CODEQL: close CodeQL alerts #57 and #59 - #1581
Merged
Merged
Conversation
…eQL #59) The proof step checks out github.event.pull_request.head.sha; CodeQL (actions/cache-poisoning/poisonable-step) could not see statically that it never runs on schedule/workflow_dispatch. Add the explicit event check and pin it in ci-shape for both red-first steps. Test-First: scripts/test-ci-shape.sh::ci-shape fails when the proof step 'if' drops the pull_request event check
A single replace pass can re-assemble a comment opener, e.g. `<!<!---->-->`. Move the strip into stripComments(), which repeats until stable and also drops an unterminated opener. Test-First: docs/diagrams/export-svg.test.mjs::stripComments leaves no comment opener behind
Cuarroc
marked this pull request as ready for review
October 15, 2026 17:58
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Cuarroc
added
the
review-ok
Owner
Author
|
Root: review-ok bound to head 6260cea. Tier A: Codex (OpenAI) APPROVE and Kimi (Moonshot) APPROVE; the author is Claude (Anthropic). All checks green incl. CodeQL and GitGuardian at 2026-10-15T18:11:19Z. No open high finding. |
Owner
Author
|
Root auto-queue: head 6260cea unchanged since review-ok, all checks green. @Mergifyio queue |
30 of 46 tasks
Contributor
Merge Queue Status
This pull request spent 13 minutes 46 seconds in the queue, including 13 minutes 3 seconds running CI. Required conditions to merge
|
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Diese Änderung schließt die beiden offenen CodeQL-Meldungen #57 und #59 durch Codekorrekturen, nicht durch Verwerfen. Der SVG-Export entfernt Kommentare jetzt so lange, bis kein Kommentar-Anfang mehr übrig ist, und der red-first-Beweisschritt in der CI nennt das Pull-Request-Ereignis ausdrücklich in seiner Bedingung. Die Prüfung durch zwei fremde Modellfamilien steht noch aus (Stufe A).
Report
Plan-ID: CI-SEC-CODEQL.
Was geändert wurde
04d8dca2→ Alert merge queue: checking #51 + #50 + #35 together on main (8ca95da) #59 (actions/cache-poisoning/poisonable-step, ci.yml, Joblinux_1): Der Schrittred-first - proof against merge base(checktpull_request.head.shaaus) hat in seinemif:jetztgithub.event_name == 'pull_request' &&. Der Schrittred-first - planhatte das schon; es gibt in ci.yml keinen weiteren Schritt mitpull_request.head.sha.scripts/ci/ci-shape.shprüft die Bedingung nun für beide Schritte,scripts/test-ci-shape.shhat dazu einen Mutationsfall.6260cea5→ Alert chore(deps): bump the npm group across 1 directory with 5 updates #57 (js/incomplete-multi-character-sanitization,docs/diagrams/export-svg.mjs:124): Neuesdocs/diagrams/strip-comments.mjsmitstripComments(): wiederholt das Entfernen bis der String stabil ist und entfernt auch ein unterminiertes<!--(Regex<!--(?:[\s\S]*?-->)?).export-svg.mjsnutzt es. Eigene Datei, damit der Test ohne Chromium und ohne argv läuft.Belege
Test-First: scripts/test-ci-shape.sh::ci-shape fails when the proof step 'if' drops the pull_request event checkundTest-First: docs/diagrams/export-svg.test.mjs::stripComments leaves no comment opener behind;bash scripts/ci/red-first.sh→ Exit 0 (beide an der Merge-Base rot/fehlend, am Kopf grün).node --test docs/diagrams/export-svg.test.mjs→ Exit 0 (6 Tests, mit Chromium).bash scripts/ci/ci-shape.sh→ Exit 0;bash scripts/test-ci-shape.sh→ Exit 0.bash scripts/ci/gates.sh lane prepush→ Exit 0 (ungepiped, 279 s).NICHT ABGEDECKT
mainnach dem Merge; ob CodeQL die Schleife instripCommentsund die explizite Ereignisbedingung als Behebung wertet, ist nicht lokal belegt.#[cfg(windows)]-Tests und die Windows-Arme von clippy laufen unter Linux nicht; die Windows-Bahn läuft in der Merge-Queue.export-svg.mjs(Browserpfad) ist unverändert; der Kommentar-Fall<!<!---->-->lässt sich über den Browser-Export nicht erzeugen (XMLSerializer maskiert<), daher testet der TeststripCommentsdirekt.Architecture drift: keine Befunde.
Review: ausstehend (Stufe A: Sicherheit + .github-Workflow, zwei Modellfamilien außer Claude). ci.yml gehört laut CODEOWNERS dem Nutzer (Review-Anfrage, blockiert nicht).
🤖 Generated with Claude Code
Review disposition (Root, head 6260cea)
Tier A (security + workflow). Author family: Anthropic (Claude Sonnet 5.5; the job was rerouted by the Codex brake). Two reviewers from other vendors, both APPROVE on 6260cea:
review-pr1581-codex.md): no findings. It confirmed red-first against the base for both alerts: the old regex fails on<!<!---->-->, and the old ci-shape check accepts the guard mutation.pr1581-kimi-6260cea5.md): five low findings, listed below.strip-comments.mjs:6also strips comment-like text in contentci.yml:352: the proof step is now skipped on pushrf_plansuccess, andrf_planonly runs onpull_request, so push behaviour is unchanged. No required check depends on this step outside PRs.export-svg.test.mjs:107: no exact output assertiontest-ci-shape.sh:188: the mutation test covers only the proof stepci-shape.sh:178: assumes 8-space indentThe alerts close only after the next CodeQL scan of main. Both were still open at review time, which the Codex review confirms.