feat(enrichment): end-of-life runtime regression analyzer (endoflife.date) - #1532
Merged
Conversation
…date) Sixth REES analyzer. Parses runtime/base-image/engine pins a PR changes (Dockerfile FROM, .nvmrc, go.mod) and checks endoflife.date (free, no key) — flagging a pin onto a release that is already past end-of-support or goes EOL within 90 days. Injectable now for deterministic tests. 4 new node:test units (27 total) + a live endoflife.date check. Closes #1504.
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
andriypolanski
pushed a commit
to andriypolanski/gittensory
that referenced
this pull request
Jun 27, 2026
…rdening (JSONbored#1099) * fix(guardrail): fail-closed on KV outage + broaden crucial-path coverage Flood-readiness (emission weights rose on metagraphed + gittensory; a contributor wave is imminent). Two guardrail hardenings: 1. Fail-CLOSED on a KV read fault. loadHardGuardrailGlobs previously fell back to the narrow default (.github/workflows + scripts) on a THROWN read, so a KV outage correlated with a flood would silently shrink the guarded surface and let crown-jewel edits (scoring/auth/rules/the gate) auto-merge. A thrown read now returns FAIL_CLOSED_GUARDRAIL_GLOBS = ['**'] → every PR is held for human review until the read recovers. A legitimately-absent key still uses the narrow default so a freshly-installed repo can operate. 2. Broadened the LIVE per-repo KV globs (done out-of-band, effective immediately): - gittensory: added src/upstream/**, src/settings/**, src/review/**, src/services/**, src/github/**, src/config/** — the gate/decision/reviewer/ scoring/auth engine that lived OUTSIDE the old dir-prefix guards (e.g. score-breakdown.ts, command-authorization.ts, agent-actions.ts, ai-review.ts, ruleset.ts). This is the awesome-claude JSONbored#4196 incident class. - metagraphed: added src/** (the old config guarded specific .mjs files but NOT src/mcp-server.mjs — the file PR JSONbored#1528 touched). Tests: change-guardrail asserts the crucial out-of-dir files now hit the guardrail while infra/data/registry/docs/tests still auto-merge; guardrail-config asserts the outage path fails closed. Full suite green (3489). * fix(review): break the Gittensory Gate self-deadlock that froze reviews under load ROOT CAUSE of the stall (diagnosed from the LIVE audit_events ledger, not the frozen review_targets/review_audit): the Gittensory Gate is a REQUIRED check, and fetchLiveCiAggregate counted it like any other CI. A review posts the gate as in_progress, then prReadyForReview waits for ALL required CI to finish — but the gate never finishes (it's only concluded by the very review being deferred). So every green-CI PR deferred forever as 'CI still running' (38 review_deferred_ci_pending in 30 min; metagraphed JSONbored#1532 deferred 4x with all checks green). Fix: fetchLiveCiAggregate now SKIPS the bot's own GITTENSORY_GATE_CHECK_NAME in both the check-runs and commit-status loops, so the bot waits on real CI only and never on its own gate. Test: a green 'test' check + an in_progress 'Gittensory Gate' (gate in the required set) now reports ciState 'passed', not 'pending'.
andriypolanski
pushed a commit
to andriypolanski/gittensory
that referenced
this pull request
Jun 27, 2026
…it — completes the self-deadlock fix (JSONbored#1105) JSONbored#1099 excluded only Gittensory Gate, but the bot posts TWO checks as in_progress while reviewing — Gittensory Gate AND Gittensory Context (app.ts:23-24). Counting Context re-created the exact same self-deadlock: green-CI PRs (e.g. metagraphed JSONbored#1532, all real checks success/neutral) deferred forever as 'CI still running' because the bot waited on its own in_progress Context check. Generalize the exclusion to a BOT_OWNED_CHECK_NAMES set so the bot never waits on ANY check it posts itself. Test now asserts both in_progress bot checks are ignored -> ciState 'passed'.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixth REES analyzer. Parses runtime/base-image/engine pins a PR changes (
Dockerfile FROM,.nvmrc,go.mod) and checks endoflife.date (free, no key) — flags a pin onto a release past end-of-support or EOL within 90 days. Injectablenowfor deterministic tests. 4 newnode:testunits (27 total) + a live check. Closes #1504.