Repository navigation
Parse consecutive added files sharing /dev/null source (#143) - #144
Merged
Merged
Conversation
matiasb
marked this pull request as ready for review
August 7, 2026 02:11
This was referenced Nov 3, 2026
Open
pastikacik-collab
pushed a commit
to pastikacik-collab/RimSort
that referenced
this pull request
Nov 3, 2026
## What Temporarily disables the `checkov` git-hooks hook and removes the `python3.14-ecdsa-0.19.2` `permittedInsecurePackages` waiver that existed only for it. Closes RimSort#2609. ## Why `nix flake check` fails on any nixpkgs pin carrying `python3Packages.unidiff` 1.0.1 — which is every current `nixos-unstable` revision. The chain is entirely upstream of us: - `nix/parts/hooks.nix` enables the `checkov` hook, so the flake check builds `pkgs.checkov`; - `checkov` depends on `python3Packages.bc-detect-secrets`, which runs its own test suite during its build; - under unidiff 1.0.1 two tests fail (`TestScanDiff::test_filename_filters_are_invoked_first`, `TestScanDiff::test_success`) with `UnidiffParseError: Target without source: +++ b/.secrets.baseline`, so `bc-detect-secrets` does not build, so `checkov` does not build, so the hook set — and the required `Nix Flake Check` gate — fails. Root cause and full evidence are in RimSort#2609. Short version: the trigger is [python-unidiff#144](matiasb/python-unidiff#144) (`bddf7bac`), which stopped starting a new file at a `---` header while a `diff --git` block is open; detect-secrets' `test_data/sample.diff` ends with a second `diff --git a/setup.py b/setup.py` whose `---`/`+++` pair names `.secrets.baseline`, so the parser is still on `setup.py` at `+++ b/.secrets.baseline` and the pre-existing target-mismatch check (`unidiff/patch.py:566`) raises. Upstream fix under review: [NixOS/nixpkgs#582549](NixOS/nixpkgs#582549). `bc-detect-secrets` has exactly one consumer in nixpkgs (`checkov`), so this is the whole blast radius. ## Why disabling the hook is enough (and the waiver can go too) `checkov.enable = false` does not merely skip the hook at run time — `git-hooks.nix` never forces the hook's `entry`, so `pkgs.checkov` is not evaluated at all: - `nix eval .#checks.x86_64-linux.pre-commit.drvPath` succeeds with the waiver removed; - that derivation contains **zero** references to `checkov` or `ecdsa`; - a full `nix flake check` passes (`package`, `pre-commit`, `pytest` all green, x86_64-linux). The waiver's own comment asked for exactly this: *"Drop this if checkov ever leaves the hook set."* ## Undoing this Re-enabling means flipping `enable` back to `true` **and** restoring the ecdsa waiver in the same change (they move together). Track it on RimSort#2609; once NixOS/nixpkgs#582549 reaches `nixos-unstable`, expect a cold Cachix for `checkov` since its output path changes. ## Side effect worth knowing This also unblocks the nixpkgs bump (RimSort#2588), which is pinned to a revision carrying unidiff 1.0.1 and therefore cannot pass `Nix Flake Check` while the hook is enabled. With the hook off, that PR should go green once this lands and dependabot refreshes its branch — no need to wait on the nixpkgs merge. ## Tests No Python changed; the gate is the flake check, which was run in full on this branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
---handler now starts a new file whenever we're not inside a git header block (patch_info is None), instead of keying on source-filename equality. This stops consecutive/dev/null-sourced added files from being merged, while keeping git renames/new-files intact.