[ci] Audit live CI inputs against policy - #3578
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Gt4itljw3xh6tci2mjqj4z245i6pwle2i #3578 +/- ##
==================================================================
Coverage 91.85% 91.85%
==================================================================
Files 20 20
Lines 6093 6093
==================================================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5070ce31b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
5070ce3 to
fac6e43
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
4864e15 to
b49d72d
Compare
fac6e43 to
77f85fe
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 77f85fe605
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Collect repository packages, features, and Cargo targets with locked, offline Cargo metadata, then validate every policy reference against the live checkout before planning work. Disable rustup's automatic toolchain installation separately because Cargo cannot apply `--offline` until after the rustup proxy has selected a toolchain. Derive the stable feature closure and its nightly-only complement from Cargo's complete feature graph. Follow plain and strong optional- dependency edges according to Cargo semantics while leaving `dep:` and weak edges non-activating. Require an explicit no-default profile if a future manifest introduces default features. Accept Rust's two-component and dotted target names without assuming every target is a three-part triple. Canonicalize trusted manifest, Cargo-target, and configured baseline paths before using them. Reject symbolic links which leave the checkout, distinguish missing baseline inputs from other file-system errors, and require pinned stable and semantic build-rs compilers not to predate the package MSRV. Fail when packages, target kinds, examples, required features, baseline paths, or toolchain sources escape classification. Also validate the narrower line-oriented Cargo.toml grammar consumed by build.rs. This keeps valid TOML formatting changes from silently breaking the build script's separate parser. Keep all collected data deterministic and report independent inventory errors together. Cargo metadata remains authoritative; this layer checks coordination without copying its package or feature lists into policy. Tests: focused feature, target, version, build.rs, path-containment, live-audit, and mutation tests. *Authored by an agent, posting via joshlf's account* gherrit-pr-id: Gocqawbn3p3zj7xyfo7etk6vo4633r3tn
77f85fe to
fded6e0
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head. Treat earlier reviews of older commits as stale. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Collect repository packages, features, and Cargo targets with locked,
offline Cargo metadata, then validate every policy reference against the
live checkout before planning work. Disable rustup's automatic toolchain
installation separately because Cargo cannot apply
--offlineuntilafter the rustup proxy has selected a toolchain.
Derive the stable feature closure and its nightly-only complement from
Cargo's complete feature graph. Follow plain and strong optional-
dependency edges according to Cargo semantics while leaving
dep:andweak edges non-activating. Require an explicit no-default profile if a
future manifest introduces default features. Accept Rust's two-component
and dotted target names without assuming every target is a three-part
triple.
Canonicalize trusted manifest, Cargo-target, and configured baseline
paths before using them. Reject symbolic links which leave the checkout,
distinguish missing baseline inputs from other file-system errors, and
require pinned stable and semantic build-rs compilers not to predate the
package MSRV.
Fail when packages, target kinds, examples, required features, baseline
paths, or toolchain sources escape classification. Also validate the
narrower line-oriented Cargo.toml grammar consumed by build.rs. This
keeps valid TOML formatting changes from silently breaking the build
script's separate parser.
Keep all collected data deterministic and report independent inventory
errors together. Cargo metadata remains authoritative; this layer checks
coordination without copying its package or feature lists into policy.
Tests: focused feature, target, version, build.rs, path-containment,
live-audit, and mutation tests.
Authored by an agent, posting via joshlf's account
Latest Update: v9 — Compare vs v8
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/Gocqawbn3p3zj7xyfo7etk6vo4633r3tn && git checkout -b pr-Gocqawbn3p3zj7xyfo7etk6vo4633r3tn FETCH_HEADCheckout
git fetch origin refs/heads/Gocqawbn3p3zj7xyfo7etk6vo4633r3tn && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/Gocqawbn3p3zj7xyfo7etk6vo4633r3tn && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.