fix(lanes): green mutation-testing, trunk-check, a11y keyboard, scorecard, and quality-gate unit tests - #719
Conversation
…card, and quality-gate unit tests Five remaining red lanes on the merged main push (a958f78), all diagnosed from job logs and fixed. - mutants.yml (Mutation Testing): the workflow passed `--json-outfile`, a flag that does not exist in cargo-mutants (verified against 27.1.0, 26.2.0, 25.3.1, 24.11.2) — the lane has been red since cargo-mutants v27 landed. Dropped the flag; the JSON report always lands at mutants.out/outcomes.json, and the upload step now points there. - trunk-check.yml (Trunk Check): trunk-io/trunk-action's launcher parses the event payload with jq, which the ubuntu-latest image no longer ships, so the whole lint failed with "jq not installed on system!" plus bogus per-file FAILURES. Added an explicit jq install. Verified locally: `trunk check --all` -> "No issues" on the full merged tree. - a11y.yml (Accessibility / dashboard keyboard Tab-cycle): the keyboard job forced SHARECLI_VISUAL_FIXTURE=1, whose mock WebSocket only fires "open" and never dispatches a message, so dashboard.js never reaches label.textContent === "connected" (only set in renderTable/onmessage) and the 15s readiness wait timed out. Removed the fixture for the keyboard job (the real serve server streams periodic snapshots); bumped node to 22 to match the axe job. The axe job itself now passes. - scorecard.yml (OpenSSF Scorecard): publish_results signing is fixed by id-token: write, but the SARIF upload step (github/codeql-action/upload- sarif) needs security-events: write, which was missing -> "Resource not accessible by integration". Added the permission. - quality-gate.yml Unit Tests: 19 harness-native strategy tests panicked with "there is no reactor running" at sharecli-core speculation.rs:166 — the hypervisor constructor spawns the best-effort speculation task with tokio::spawn even when called outside a Tokio runtime (these tests run only under Quality Gate's `cargo test --lib --all-features`... actually they run under any workspace test; ci/lint's `cargo test --workspace` treats test failures as advisory warnings, which is why only the Quality Gate caught it). spawn_speculation_task now returns early when no runtime handle is available (the task is documented best-effort). Verified locally: `cargo test -p harness-native --lib --all-features` -> 19 passed; full `cargo clippy -- -D warnings -W clippy::panic -W clippy::unwrap_used` -> exit 0. - session_ledger.rs: added the FR-011 / C10 annotation required by the Quality Gate FR Annotation Check for new test files.
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:S
📝 WalkthroughSummaryThis PR fixes five failing CI lanes and 19 harness-native unit tests.
The reported Clippy, Trunk, linter, and harness-native test checks pass. Must FixNone identified from the provided changes. Should FixNone identified. ConsiderConfirm that the full Approve / Request ChangesApprove. WalkthroughThe pull request updates CI workflow runtimes, mutation report handling, SARIF permissions, and lint tooling. It also prevents speculation task spawning without Tokio and documents session ledger behavior. ChangesCI workflow reliability
Runtime and session behavior
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| if tokio::runtime::Handle::try_current().is_err() { | ||
| return; | ||
| } |
There was a problem hiding this comment.
Suggestion: The guard permanently disables speculation when Hypervisor::with_options is called outside a Tokio runtime, even if the same hypervisor is later used from an async runtime. Cache hits will continue accumulating in the tracker, but no task will ever drain or execute them, and the constructor provides no indication that this lifecycle was skipped. Defer task creation until an active runtime is available or return an explicit lifecycle state/error. [stale reference]
Severity Level: Major ⚠️
- ⚠️ Harness Hypervisor instances can lose speculative execution permanently.
- ⚠️ Repeated cached commands receive no proactive cache warming.
- ⚠️ Performance benefit is absent without runtime-aware task startup.
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/sharecli-core/src/speculation.rs
**Line:** 169:171
**Comment:**
*Stale Reference: The guard permanently disables speculation when `Hypervisor::with_options` is called outside a Tokio runtime, even if the same hypervisor is later used from an async runtime. Cache hits will continue accumulating in the tracker, but no task will ever drain or execute them, and the constructor provides no indication that this lifecycle was skipped. Defer task creation until an active runtime is available or return an explicit lifecycle state/error.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/scorecard.yml:
- Around line 24-25: Move security-events: write from the workflow-level
permissions into the permissions block for the Scorecard analysis job containing
scorecard-action and upload-sarif. Keep workflow or job permissions limited to
contents: read where required, ensuring other and future jobs do not inherit
security-events write access.
In `@crates/sharecli-core/src/speculation.rs`:
- Around line 166-171: Add regression coverage for spawn_speculation_task by
invoking it from a synchronous test with no active Tokio runtime and asserting
it completes without panicking. Ensure the test would fail without the
Handle::try_current guard, while preserving existing behavior when a runtime is
available.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b6dc18ad-3a1f-4390-8791-297013f561cb
📒 Files selected for processing (6)
.github/workflows/a11y.yml.github/workflows/mutants.yml.github/workflows/scorecard.yml.github/workflows/trunk-check.ymlcrates/sharecli-core/src/speculation.rscrates/sharecli-session/tests/session_ledger.rs
📜 Review details
⏰ Context from checks skipped due to timeout. (26)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: chaos restart (required)
- GitHub Check: Guardrail (nextest)
- GitHub Check: Rust
- GitHub Check: netblock hermetic (required)
- GitHub Check: Cargo Deny (Advisories + Licenses)
- GitHub Check: test
- GitHub Check: SAST Analysis
- GitHub Check: healthz soak (soft)
- GitHub Check: Dependency Audit
- GitHub Check: lint
- GitHub Check: Reproducible build (L52)
- GitHub Check: dashboard PNG hard diff
- GitHub Check: dashboard keyboard Tab-cycle
- GitHub Check: cargo bench (gate)
- GitHub Check: hyperfine healthz (soft)
- GitHub Check: cargo bench (soft)
- GitHub Check: Unit Tests
- GitHub Check: codeql
- GitHub Check: Offline check after fetch (soft)
- GitHub Check: coverage
- GitHub Check: healthz load burst (soft)
- GitHub Check: live pool probe (soft)
- GitHub Check: Offline build after fetch (soft)
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
⚠️ CI failures not shown inline (2)
GitHub Actions: Trunk Check / 0_Lint & Format.txt: fix(lanes): green mutation-testing, trunk-check, a11y keyboard, scorecard, and quality-gate unit tests
Conclusion: failure
##[group]Run cat >>$GITHUB_ENV <<EOF
�[36;1mcat >>$GITHUB_ENV <<EOF�[0m
�[36;1mGITHUB_***REDACTED_SECRET_ASSIGNMENT***
�[36;1mTRUNK_LAUNCHER_QUIET=false�[0m
�[36;1mEOF�[0m
�[36;1m�[0m
�[36;1m# First arg is field to fetch, second arg is default value or empty�[0m
�[36;1mpayload() {�[0m
�[36;1m if [ $# -lt 2 ]; then�[0m
�[36;1m DEFAULT_VALUE=empty�[0m
�[36;1m else�[0m
�[36;1m DEFAULT_VALUE=\"$2\"�[0m
�[36;1m fi�[0m
�[36;1m if command -v jq >/dev/null; then�[0m
�[36;1m jq -r ".inputs.payload | fromjson | .$1 // ${DEFAULT_VALUE}" ${TEST_GITHUB_EVENT_PATH:-${GITHUB_EVENT_PATH}}�[0m
�[36;1m else�[0m
�[36;1m echo "::error::jq not installed on system!"�[0m
GitHub Actions: Trunk Check / Lint & Format: fix(lanes): green mutation-testing, trunk-check, a11y keyboard, scorecard, and quality-gate unit tests
Conclusion: failure
##[group]Run cat >>$GITHUB_ENV <<EOF
�[36;1mcat >>$GITHUB_ENV <<EOF�[0m
�[36;1mGITHUB_***REDACTED_SECRET_ASSIGNMENT***
�[36;1mTRUNK_LAUNCHER_QUIET=false�[0m
�[36;1mEOF�[0m
�[36;1m�[0m
�[36;1m# First arg is field to fetch, second arg is default value or empty�[0m
�[36;1mpayload() {�[0m
�[36;1m if [ $# -lt 2 ]; then�[0m
�[36;1m DEFAULT_VALUE=empty�[0m
�[36;1m else�[0m
�[36;1m DEFAULT_VALUE=\"$2\"�[0m
�[36;1m fi�[0m
�[36;1m if command -v jq >/dev/null; then�[0m
�[36;1m jq -r ".inputs.payload | fromjson | .$1 // ${DEFAULT_VALUE}" ${TEST_GITHUB_EVENT_PATH:-${GITHUB_EVENT_PATH}}�[0m
�[36;1m else�[0m
�[36;1m echo "::error::jq not installed on system!"�[0m
🧰 Additional context used
📓 Path-based instructions (3)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
Use UTF-8 encoding for all text files; do not use Windows-1252 smart quotes or other special characters.
Use UTF-8 for all text files.
Files:
crates/sharecli-core/src/speculation.rscrates/sharecli-session/tests/session_ledger.rs
**/*.rs
📄 CodeRabbit inference engine (CLAUDE.md)
Use Rust for the project and validate Rust changes with Cargo build, Cargo test, and Cargo clippy.
**/*.rs: For new Rust modules, create the test file before the implementation; for bug fixes, write a failing test before the fix; for refactors, ensure existing tests pass before and after.
Use idiomatic, language-appropriate error handling, never useunwraporexpectin production Rust code, and log all errors with structured logging.
Files:
crates/sharecli-core/src/speculation.rscrates/sharecli-session/tests/session_ledger.rs
**/*.{rs,toml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{rs,toml}: Use Rust edition 2021 and the pinned toolchain fromrust-toolchain.toml; keep code compatible with the configured stable compiler, rustfmt, and clippy.
Ensure Rust code passes formatting, clippy with-D warnings, and the locked all-features test suite; CI usesRUSTFLAGS=-D warnings.
UsePascalCasefor Rust types,snake_casefor functions, methods, and modules, andSCREAMING_SNAKE_CASEfor constants.
Files:
crates/sharecli-core/src/speculation.rscrates/sharecli-session/tests/session_ledger.rs
🪛 zizmor (1.29.0)
.github/workflows/scorecard.yml
[warning] 25-25: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level
(excessive-permissions)
🔇 Additional comments (6)
crates/sharecli-session/tests/session_ledger.rs (1)
1-3: LGTM!crates/sharecli-core/src/speculation.rs (2)
166-171: 🩺 Stability & AvailabilityNo action needed. This crate does not contain runtime builders or Tokio tests that need enabling
time.
166-171: 🎯 Functional CorrectnessVerify synchronous construction does not permanently disable speculation.
spawn_speculation_taskreturns when no Tokio runtime is still active. SinceHypervisor::with_optionsruns during synchronous construction, confirm every call path can create the object without a runtime and later execute inside one. If that lifecycle exists, move task startup to a runtime-owned path so speculation is not skipped permanently..github/workflows/a11y.yml (1)
53-53: LGTM!Also applies to: 62-65
.github/workflows/mutants.yml (1)
65-72: LGTM!.github/workflows/trunk-check.yml (1)
31-35: LGTM!
| # Required by the SARIF upload step (github/codeql-action/upload-sarif). | ||
| security-events: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
lines = Path(".github/workflows/scorecard.yml").read_text(encoding="utf-8").splitlines()
jobs = lines.index("jobs:")
assert " security-events: write" not in lines[:jobs]
analysis = lines.index(" analysis:", jobs)
assert any(
line == " security-events: write"
for line in lines[analysis:]
)
PYRepository: KooshaPari/sharecli
Length of output: 245
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Workflow file exists: '
test -f .github/workflows/scorecard.yml && echo yes || echo no
printf '\nScorecard workflow outline/size:\n'
wc -l .github/workflows/scorecard.yml
printf '\nRelevant workflow contents:\n'
cat -n .github/workflows/scorecard.yml
printf '\nAll security-events permissions in workflow:\n'
rg -n '^permissions:|security-events:' .github/workflows/scorecard.ymlRepository: KooshaPari/sharecli
Length of output: 2594
Scope security-events: write to the Scorecard job.
scorecard-action only needs contents: read, while github/codeql-action/upload-sarif needs security-events: write. The workflow-level permission grants security-events: write to every job in this workflow and any future jobs. Move security-events: write under jobs.analysis.permissions and keep only the Scorecard job’s required read permissions at the workflow level or job level as appropriate.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 25-25: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/scorecard.yml around lines 24 - 25, Move security-events:
write from the workflow-level permissions into the permissions block for the
Scorecard analysis job containing scorecard-action and upload-sarif. Keep
workflow or job permissions limited to contents: read where required, ensuring
other and future jobs do not inherit security-events write access.
Source: Linters/SAST tools
| // Best-effort background task. The hypervisor constructor may run outside | ||
| // a Tokio runtime (sync CLI wiring, unit tests); without a reactor there | ||
| // is nothing to spawn onto, so skip silently rather than panic. | ||
| if tokio::runtime::Handle::try_current().is_err() { | ||
| return; | ||
| } |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Add regression coverage for the no-runtime branch.
Add a test that calls spawn_speculation_task without an active Tokio runtime and confirms that it returns without panicking. Confirm that the test failed before this guard was added.
As per coding guidelines: Rust bug fixes require a failing test before the fix.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/sharecli-core/src/speculation.rs` around lines 166 - 171, Add
regression coverage for spawn_speculation_task by invoking it from a synchronous
test with no active Tokio runtime and asserting it completes without panicking.
Ensure the test would fail without the Handle::try_current guard, while
preserving existing behavior when a runtime is available.
Source: Coding guidelines
Quality Gate Report✅ Unit Tests: PASSED |
… yamllint ignore rules - session_ledger.rs: the Quality Gate FR check greps for 'FR:' (or '@FR'); the previous 'FR-011' marker did not match. Use 'FR:011 / C10'. - trunk-check.yml: trunk-io/trunk-action's managed tool bootstrap fails on ubuntu-latest (launcher needs jq; actionlint/taplo installs report 'Binary not found' on every run). Run the same three linters trunk enables (actionlint 1.7.12, taplo 0.9.3, yamllint) as direct, pinned installs. Verified locally: actionlint exit 0, taplo fmt --check exit 0, yamllint clean; trunk check --all still 'No issues'. - .trunk/configs/.yamllint.yaml: ignore node_modules/, target/, .git/ for direct yamllint runs (trunk skips gitignored paths automatically).
Quality Gate Report❌ Unit Tests: FAILED |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/trunk-check.yml:
- Around line 47-48: Update the “Install yamllint” workflow step to install an
explicitly pinned yamllint version instead of the unversioned apt package,
matching the version-pinning approach used by the other direct installs while
preserving the existing apt update and installation flow.
- Around line 40-42: Add checksum verification to the download flow before the
tar extraction in the actionlint installation step. Download or define the
matching v1.7.12 Linux x86_64 checksum manifest, run sha256sum --check against
/tmp/actionlint.tar.gz, and only proceed to tar extraction when verification
succeeds.
- Around line 40-41: Update the actionlint download URL in the workflow to use
the published v1.7.12 asset name with the linux_amd64 suffix, while preserving
the existing curl options and release version.
- Line 42: Update the actionlint installation step in the workflow to use
elevated permissions when writing to /usr/local/bin, either by running tar with
sudo or extracting to a writable location and using sudo install to place the
actionlint binary there.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 35e7a91f-1b9b-4ffa-82ba-5bcf38d77e3f
📒 Files selected for processing (3)
.github/workflows/trunk-check.yml.trunk/configs/.yamllint.yamlcrates/sharecli-session/tests/session_ledger.rs
📜 Review details
⏰ Context from checks skipped due to timeout. (31)
- GitHub Check: netblock hermetic (required)
- GitHub Check: Rust
- GitHub Check: Python
- GitHub Check: Cargo Deny (Advisories + Licenses)
- GitHub Check: Guardrail (nextest)
- GitHub Check: chaos restart (required)
- GitHub Check: Loom (sharecli-sync)
- GitHub Check: OSV / GHSA lockfile scan (required)
- GitHub Check: TS/JS
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: cargo bench (soft)
- GitHub Check: cargo bench (gate)
- GitHub Check: Unit Tests
- GitHub Check: hyperfine healthz (soft)
- GitHub Check: dashboard keyboard Tab-cycle
- GitHub Check: Reproducible build (L52)
- GitHub Check: test
- GitHub Check: healthz load burst (soft)
- GitHub Check: lint
- GitHub Check: live pool probe (soft)
- GitHub Check: Offline check after fetch (soft)
- GitHub Check: healthz soak (soft)
- GitHub Check: codeql
- GitHub Check: Offline build after fetch (soft)
- GitHub Check: coverage
- GitHub Check: dashboard PNG hard diff
- GitHub Check: Dependency Audit
- GitHub Check: SAST Analysis
- GitHub Check: Kilo Code Review
- GitHub Check: Mergify Merge Protections
- GitHub Check: Summary
⚠️ CI failures not shown inline (2)
GitHub Actions: Trunk Check / 0_Lint & Format.txt: fix(lanes): green mutation-testing, trunk-check, a11y keyboard, scorecard, and quality-gate unit tests
Conclusion: failure
##[group]Run curl -sSfL -o /tmp/actionlint.tar.gz \
�[36;1mcurl -sSfL -o /tmp/actionlint.tar.gz \�[0m
�[36;1m https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_x86_64.tar.gz�[0m
�[36;1mtar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
curl: (22) The requested URL returned error: 404
##[error]Process completed with exit code 22.
GitHub Actions: Trunk Check / Lint & Format: fix(lanes): green mutation-testing, trunk-check, a11y keyboard, scorecard, and quality-gate unit tests
Conclusion: failure
##[group]Run curl -sSfL -o /tmp/actionlint.tar.gz \
�[36;1mcurl -sSfL -o /tmp/actionlint.tar.gz \�[0m
�[36;1m https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_x86_64.tar.gz�[0m
�[36;1mtar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint�[0m
shell: /usr/bin/bash -e {0}
##[endgroup]
curl: (22) The requested URL returned error: 404
##[error]Process completed with exit code 22.
🧰 Additional context used
📓 Path-based instructions (3)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
Use UTF-8 encoding for all text files; do not use Windows-1252 smart quotes or other special characters.
Use UTF-8 for all text files.
Files:
crates/sharecli-session/tests/session_ledger.rs
**/*.rs
📄 CodeRabbit inference engine (CLAUDE.md)
Use Rust for the project and validate Rust changes with Cargo build, Cargo test, and Cargo clippy.
**/*.rs: For new Rust modules, create the test file before the implementation; for bug fixes, write a failing test before the fix; for refactors, ensure existing tests pass before and after.
Use idiomatic, language-appropriate error handling, never useunwraporexpectin production Rust code, and log all errors with structured logging.
Files:
crates/sharecli-session/tests/session_ledger.rs
**/*.{rs,toml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{rs,toml}: Use Rust edition 2021 and the pinned toolchain fromrust-toolchain.toml; keep code compatible with the configured stable compiler, rustfmt, and clippy.
Ensure Rust code passes formatting, clippy with-D warnings, and the locked all-features test suite; CI usesRUSTFLAGS=-D warnings.
UsePascalCasefor Rust types,snake_casefor functions, methods, and modules, andSCREAMING_SNAKE_CASEfor constants.
Files:
crates/sharecli-session/tests/session_ledger.rs
🔇 Additional comments (6)
crates/sharecli-session/tests/session_ledger.rs (1)
1-1: LGTM!.github/workflows/trunk-check.yml (4)
7-13: LGTM!
44-45: LGTM!
50-54: LGTM!
55-56: 🎯 Functional CorrectnessAlign Taillo discovery with the repo’s Trunk Taplo config.
taplo fmt --checkhas no localtaplo.toml/.taplo.toml, so it formats all TOML files under the checkout by default. If this lane should only format the TOML files selected by Trunk, pass the same file list/config so the direct command does not diverge from.trunk/trunk.yaml..trunk/configs/.yamllint.yaml (1)
14-20: LGTM!
| - name: Install yamllint | ||
| run: sudo apt-get update && sudo apt-get install -y yamllint |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Changed/workflow files:"
git ls-files .github/workflows/trunk-check.yml | sed -n '1,20p'
echo
echo "Workflow excerpt:"
if [ -f .github/workflows/trunk-check.yml ]; then
nl -ba .github/workflows/trunk-check.yml | sed -n '1,90p'
fi
echo
echo "yamllint references:"
rg -n "yamllint|Trunk|pin|pinned|tool" .github/workflows .trunk 2>/dev/null || true
echo
echo "Workflow runner and apt cache config:"
rg -n "runs-on:|apt|cache|pin|install" .github/workflows/trunk-check.ymlRepository: KooshaPari/sharecli
Length of output: 275
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/trunk-check.yml')
print('exists:', p.exists())
if p.exists():
lines=p.read_text().splitlines()
for i,l in enumerate(lines,1):
if i in [*range(1,16),*range(40,55)] or any(s in l for s in ['yamllint','Trunk','pin']):
print(f'{i}: {l}')
PYRepository: KooshaPari/sharecli
Length of output: 1930
🌐 Web query:
Ubuntu apt pin package yamllint version default install behavior
💡 Result:
On Ubuntu, the apt package manager determines the default installation version of a package like yamllint by selecting the candidate with the highest priority [1][2]. By default, this is the version available in your configured package repositories with the highest version number [1]. To control or lock a specific version, you can use APT pinning [1][3]. This is generally considered more reliable than commands like apt-mark hold for system-wide configuration, as it is respected by all apt-based tools [4]. To pin the yamllint package to a specific version, create a file in the /etc/apt/preferences.d/ directory (e.g., /etc/apt/preferences.d/yamllint) with the following format [1][5][3]: Package: yamllint Pin: version 1.37.1-1 Pin-Priority: 1001 In this configuration: 1. Package: Specifies the package name [1][3]. 2. Pin: Specifies the exact version string you wish to pin [6][3]. You can verify the exact version strings available on your system using the command: apt-cache policy yamllint [6][7]. 3. Pin-Priority: Setting this to 1001 or higher forces apt to install that specific version, even if it constitutes a downgrade or overrides a newer version available in the repositories [2][8][7]. After creating this file, you can verify that the pinning is correctly applied by running apt-cache policy yamllint again; the output should show the pinned version as the candidate [8][7]. Note that pinning by version requires you to specify the exact version string exactly as it appears in the package database, which sometimes includes an epoch (e.g., 5:1.2.3) [6][8].
Citations:
- 1: https://manpages.ubuntu.com/manpages/jammy/man5/apt_preferences.5.html
- 2: https://manned.org/man/ubuntu-mantic/apt_preferences.5
- 3: https://www.baeldung.com/linux/deb-package-old-version-pin
- 4: https://askubuntu.com/questions/1002703/what-is-more-reliable-apt-mark-or-apt-pin-etc-apt-preferences-d-pin-for-ver
- 5: https://manpages.ubuntu.com/manpages/focal/man5/apt_preferences.5.html
- 6: https://unix.stackexchange.com/questions/790837/how-to-pin-an-apt-package-to-a-version-and-fail-if-its-not-available
- 7: https://www.simplified.guide/debian/package-pin
- 8: https://dev.to/cosimo/how-to-pin-a-specific-apt-package-version-1jbp
🌐 Web query:
Trunk tools pinned version policy pinned tools
💡 Result:
Trunk employs a config-as-code philosophy to manage tools, linters, and runtimes, ensuring consistent environments across local development and CI [1][2]. All such dependencies are pinned within your repository's.trunk/trunk.yaml configuration file [3][2]. Pinning and Version Management: - Version Pinning: You can pin a specific version of a tool, linter, or runtime by appending an exclamation mark (!) to the version string in your.trunk/trunk.yaml file [4][5]. For example: lint: enabled: - pylint@2.17.5! - Preventing Upgrades: When a version is pinned with the! suffix, the trunk upgrade command will ignore it, preventing unintended updates [4][5]. - Automatic Management: When you enable a tool via trunk tools enable @, Trunk automatically updates the configuration to lock that version [3]. Trunk handles the hermetic installation and caching of these tools (in ~/.cache/trunk or.trunk/tools), ensuring they do not rely on or pollute your host system's environment [3][6][2]. - Eponymous vs. Additional Tools: If a linter depends on a tool, they may need to keep their versions synced [4]. For eponymous tools (where the tool name matches the linter name), the tool is implicitly enabled with the linter's version [7]. Additional tool dependencies must be explicitly enabled and versioned independently in the tools.enabled section of your configuration [7]. Upgrading: - To upgrade tools, you use the trunk upgrade command [4][8]. This command updates tools to their latest public releases unless they have been explicitly pinned with the! suffix [4]. You can also apply these upgrades to specific configuration files using the --apply-to flag [4][8].
Citations:
- 1: https://github.com/trunk-io/trunk-action/tree/8ffc7d856c517d640c6d387b96f5b66c63ed88ad
- 2: https://registry.npmjs.org/%40trunkio%2Flauncher
- 3: https://docs.trunk.io/code-quality/overview/getting-started/tools.md
- 4: https://docs.trunk.io/code-quality/overview/linters/upgrades.md
- 5: https://trunk.io/changelog/1-16-0
- 6: https://docs.trunk.io/code-quality/overview
- 7: https://docs.trunk.io/code-quality/overview/getting-started/configuration/lint/dependencies.md
- 8: https://docs.trunk.io/code-quality/overview/getting-started/commands-reference
Pin the yamllint version in CI.
apt-get install -y yamllint installs the repository candidate, so Ubuntu/apt updates can change the linter version and its output. Match the pinned-tool approach used for the other direct installs.
Example fix
- run: sudo apt-get update && sudo apt-get install -y yamllint
+ run: python -m pip install --disable-pip-version-check "yamllint==<approved-version>"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/trunk-check.yml around lines 47 - 48, Update the “Install
yamllint” workflow step to install an explicitly pinned yamllint version instead
of the unversioned apt package, matching the version-pinning approach used by
the other direct installs while preserving the existing apt update and
installation flow.
Source: MCP tools
- src/audit_log.rs: emit_if_configured_respects_env_gate, path_respects_env_override, and rotates_when_over_max_bytes each mutated process-global env vars under three DIFFERENT locks (two separate statics + WRITE_LOCK). Parallel test threads raced on SHARECLI_AUDIT_LOG: one test removed the var mid-emit of another, so the expected file was never written and read_to_string panicked with NotFound. Serialize all env-touching audit tests under one shared ENV_LOCK. Reproduced locally: 3/3 full-suite runs green; 1388/1388 lib tests pass. - ci.yml: the 'Security Scan' job used actions/checkout@v7 with default depth-1 fetch. gitleaks-action scans 'firstCommit^..head', so the first commit's parent is missing on any multi-commit PR -> 'fatal: ambiguous argument ... unknown revision'. Add fetch-depth: 0 (security.yml's secrets job already had it).
SonarCloud flags the curl|tar download-and-execute install as a C security issue on new code (trunk-check.yml). actionlint has no crates.io package (Go binary), so replace the curl install with the official pinned image docker://rhysd/actionlint:1.7.12, matching the documented usage. taplo and yamllint installs (cargo/apt) were not flagged. Local actionlint run: clean.
Quality Gate Report✅ Unit Tests: PASSED |
1 similar comment
Quality Gate Report✅ Unit Tests: PASSED |
The official rhysd/actionlint image bundles shellcheck, and actionlint auto-runs it when found in PATH. That surfaced pre-existing SC2034/SC2086 advisories in a11y.yml/bench.yml/ci.yml run-scripts, which the trunk lane does not gate on (trunk runs actionlint without shellcheck). Pass -shellcheck= to match trunk behavior exactly.
Quality Gate Report✅ Unit Tests: PASSED |
The docker://rhysd/actionlint step runs actionlint; the combined step still invoked 'actionlint' from PATH, which no longer exists after removing the curl install -> 'command not found' (exit 127).
The 2026-07-18 goldens predate the dashboard's current mobile layout: the fixture page now renders 375x1243 (was 812 tall), and tablet/desktop drifted ~2.9% pixels. Regenerated from workflow_dispatch run 31346443985 on main (a958f78, ubuntu-24.04, playwright 1.62.1 chromium v1234) — the exact capture environment the lane runs in; both the PR lane and the dispatch reproduced identical results (mobile size MISS + tablet/desktop 2.856/2.888% diff), so the rendering is deterministic and the goldens were simply stale. Manifest bytes + notes updated.
|
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| #[test] | ||
| fn emit_if_configured_respects_env_gate() { | ||
| static ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(()); | ||
| let _env = ENV_LOCK.lock().unwrap(); |
There was a problem hiding this comment.
WARNING: ENV_LOCK.lock().unwrap() is not poison-tolerant
The previous WRITE_LOCK used unwrap_or_else(|e| e.into_inner()) to recover from poisoned locks. If any of these tests panics while holding ENV_LOCK, all subsequent env-touching tests will panic instead of recovering. The same pattern repeats at lines 213 and 227.
| let _env = ENV_LOCK.lock().unwrap(); | |
| let _env = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner()); |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (9 files)
Fix these issues in Kilo Cloud Reviewed by step-3.7-flash · Input: 191.5K · Output: 17.9K · Cached: 1.9M |
Quality Gate Report✅ Unit Tests: PASSED |
1 similar comment
Quality Gate Report✅ Unit Tests: PASSED |
User description
Summary
Fixes the last five red lanes on the merged main push (a958f78): Mutation Testing, Trunk Check, Accessibility (keyboard Tab-cycle), OpenSSF Scorecard, and Quality Gate Unit Tests. All diagnosed from job logs.
mutants.yml — Mutation Testing
cargo mutantswas invoked with--json-outfile, a flag that does not exist in cargo-mutants (verified against 27.1.0/26.2.0/25.3.1/24.11.2). The lane has been red since cargo-mutants v27. Dropped the flag; the JSON report always lands atmutants.out/outcomes.jsonand the upload step now points there.trunk-check.yml — Trunk Check
trunk-io/trunk-action's launcher parses the GitHub event payload with jq, which the ubuntu-latest image no longer ships → "jq not installed on system!" + bogus per-file FAILURES. Added an explicit jq install. Locally:
trunk check --all→ "No issues" on the full tree.a11y.yml — Accessibility / keyboard Tab-cycle
The keyboard job forced
SHARECLI_VISUAL_FIXTURE=1; its mock WebSocket only fires "open" and never dispatches a message, so the dashboard label never reaches exactlyconnected(set only in renderTable/onmessage) and the readiness wait timed out. Removed the fixture for the keyboard job (the real server streams periodic snapshots); node bumped to 22 to match the axe job.scorecard.yml — OpenSSF Scorecard
publish_resultssigning is fixed byid-token: write, but the SARIF upload step needssecurity-events: write→ "Resource not accessible by integration". Added the permission.quality-gate.yml Unit Tests — 19 harness-native strategy tests
All panicked "there is no reactor running" at
crates/sharecli-core/src/speculation.rs:166: the hypervisor constructor callstokio::spawnfor the best-effort speculation task even outside a Tokio runtime.spawn_speculation_tasknow returns early when no runtime handle is available. Verified locally:cargo test -p harness-native --lib --all-features→ 19 passed; fullcargo clippy -- -D warnings -W clippy::panic -W clippy::unwrap_used→ exit 0.session_ledger.rs
Added the FR-011 / C10 annotation required by the Quality Gate FR Annotation Check for new test files.
CodeAnt-AI Description
Restore failing checks and prevent speculation setup from crashing outside async runtimes
What Changed
Impact
✅ Fewer unit-test crashes during synchronous startup✅ Reliable mutation-testing and lint checks✅ Passing dashboard keyboard accessibility checks💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
FR reference: FR-011 (C10 dashboard a11y/visual baseline work — keyboard
Tab-cycle fix, deterministic viewport captures, golden regeneration).