Skip to content

fix(gate): refresh PR files before policy evaluation - #866

Merged
JSONbored merged 3 commits into
mainfrom
codex/fix-vulnerability-in-manifest-policy-gate
Jun 19, 2026
Merged

fix(gate): refresh PR files before policy evaluation#866
JSONbored merged 3 commits into
mainfrom
codex/fix-vulnerability-in-manifest-policy-gate

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • The manifest-policy gate could be evaluated against stale or missing cached PR file rows, allowing policy-violating changes to pass when the DB cache did not reflect the current PR head.
  • Ensure gate decisions that depend on changed files use a fresh GitHub fetch for the specific PR so enforceable manifest-policy findings are accurate.

Description

  • Add deletePullRequestFiles in src/db/repositories.ts and clear cached file rows for a PR before inserting fresh file metadata.
  • Add refreshPullRequestDetails(env, repoFullName, pullNumber) to src/github/backfill.ts which fetches the current PR files/reviews/checks, replaces cached rows via deletePullRequestFiles, and updates the pull_request_detail_sync_state row.
  • Call refreshPullRequestDetails from the PR webhook path in src/queue/processors.ts before maybePublishPrPublicSurface when slopGateMode or manifestPolicyGateMode is enabled so gates evaluate up-to-date files.
  • Add a regression test in test/unit/backfill.test.ts that seeds a stale cached file row, stubs GitHub responses for the current head, calls refreshPullRequestDetails, and asserts the stale row is replaced by the fetched file list.

Testing

  • Ran type checking with npx tsc --noEmit and it succeeded.
  • Ran the backfill unit tests with npx vitest run test/unit/backfill.test.ts and the new regression test passed.
  • Ran the gate policy unit tests with npx vitest run test/unit/gate-check-policy.test.ts and all tests passed.

Codex Task

@ghost

ghost commented Jun 18, 2026

Copy link
Copy Markdown

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal Result Evidence Action
Gate result ⚠️ Skipped #866 is no longer open. No action.

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

@ghost ghost added the gittensory:reviewed label Jun 18, 2026
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@ghost

ghost commented Jun 18, 2026

Copy link
Copy Markdown

gittensory · advisory review

Reviewed 4 changed file(s) — two independent AI reviewers.

Changed files: src/db/repositories.ts, src/github/backfill.ts, src/queue/processors.ts, test/unit/backfill.test.ts

Suggested action:Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds a refreshPullRequestDetails flow that re-fetches PR files, reviews, and checks, deletes stale file records, and updates sync state before gate evaluation. It introduces a DB helper to delete PR files and updates the queue processor and tests accordingly.

Suggestions

  • Add a brief comment near the deletePullRequestFiles call explaining the need to drop stale cached paths.
  • Consider adding a test for the error path where deletePullRequestFiles throws, to ensure the system remains consistent.
  • Verify that the warning prefix "File sync failed for #" matches exactly the string emitted by fetchPullRequestFiles to avoid false positives.

Worth double-checking

  • If fetchPullRequestFiles changes its warning format, the file‑deletion guard may mis‑detect failures.
  • refreshPullRequestDetails is now invoked for every gated PR; ensure this extra DB write does not cause performance regressions under high load.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds a new function to refresh pull request files before policy evaluation, ensuring that the latest file state is considered. The changes are well-structured and include necessary tests. The overall quality is high.

Suggestions

  • Consider adding a comment explaining the purpose of the new refreshPullRequestDetails function and its parameters.
  • Ensure that the deletePullRequestFiles function is thoroughly tested, especially edge cases where files might not be deleted as expected.

Worth double-checking

  • Verify that the new function handles all possible edge cases, such as network failures or invalid pull request numbers.
  • Ensure that the deletion of pull request files does not affect other parts of the system that might rely on cached file data.

@codecov

codecov Bot commented Jun 18, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.71%. Comparing base (25b77f1) to head (bd31b88).

Files with missing lines Patch % Lines
src/github/backfill.ts 90.00% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #866      +/-   ##
==========================================
- Coverage   96.72%   96.71%   -0.01%     
==========================================
  Files         109      109              
  Lines       14750    14769      +19     
  Branches     5340     5344       +4     
==========================================
+ Hits        14267    14284      +17     
- Misses         95       96       +1     
- Partials      388      389       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@JSONbored JSONbored self-assigned this Jun 18, 2026
@JSONbored
JSONbored force-pushed the codex/fix-vulnerability-in-manifest-policy-gate branch from 9f26870 to 4b971d4 Compare June 18, 2026 22:21
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 19, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
gittensory-ui bd31b88 Commit Preview URL

Branch Preview URL
Jun 19 2026, 05:55 AM

@JSONbored
JSONbored merged commit 8d134a5 into main Jun 19, 2026
19 of 21 checks passed
@JSONbored
JSONbored deleted the codex/fix-vulnerability-in-manifest-policy-gate branch June 19, 2026 06:05
JSONbored added a commit that referenced this pull request Jun 20, 2026
The webhook gate path refreshes the PR's files before evaluating the slop and
manifest-policy gates (#866/#925), but the manual 'Re-run Gittensory review'
retrigger called the same publish path without refreshing. A user re-running
after pushing commits got the slop/manifest gate evaluated against stale (or
empty) cached files, so the re-published Gate check reflected the wrong diff.

Mirror the webhook guard: refresh the PR files before publishing on the
retrigger path too. refreshPullRequestDetails is fail-safe (preserves the
cache on a fetch error).

Closes #927

Co-authored-by: ghost <49853598+JSONbored@users.noreply.github.com>
Co-authored-by: reviewwed[bot] <292611012+reviewwed[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant