fix(security): reject malformed artifact-token structures - #274
Conversation
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthrough
ChangesArtifact 토큰 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java (1)
353-370: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win수동 파서의 경계값 회귀 테스트를 추가하세요.
ArtifactLinkServiceTest에서 올바른 HMAC을 가진 9개 및 11개 payload 필드와 빈 필드를 테스트하세요. 잘못된 Base64URL, 비수치 또는 범위를 벗어난 epoch-second, 잘못된 UUID의 기대 결과도 명시하세요.ArtifactTokenParserFuzzTest는 항상 10개 필드를 유효한 Base64URL로 인코딩하므로 이 경로를 모두 대체하지 않습니다. JaCoCo line/branch 100% 결과와 Jazzer 대상을 CI에서 계속 확인하세요.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java` around lines 353 - 370, Add boundary-regression tests in ArtifactLinkServiceTest covering valid-HMAC payloads with 9 and 11 fields, including empty fields, plus invalid Base64URL, non-numeric or out-of-range epoch seconds, and malformed UUID expectations. Exercise the manual parser loop around TOKEN_FIELD_COUNT and lastDotIndex; retain ArtifactTokenParserFuzzTest and ensure CI still verifies JaCoCo line/branch coverage and the Jazzer target.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java`:
- Around line 353-370: Add boundary-regression tests in ArtifactLinkServiceTest
covering valid-HMAC payloads with 9 and 11 fields, including empty fields, plus
invalid Base64URL, non-numeric or out-of-range epoch seconds, and malformed UUID
expectations. Exercise the manual parser loop around TOKEN_FIELD_COUNT and
lastDotIndex; retain ArtifactTokenParserFuzzTest and ensure CI still verifies
JaCoCo line/branch coverage and the Jazzer target.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 1ae73271-481c-4649-befa-164af1657def
📒 Files selected for processing (1)
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java (1)
63-114: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win변경된 파서의 나머지 분기에도 테스트를 추가하십시오.
현재 테스트는 필드 수, Base64URL, epoch, UUID 경계를 다룹니다.
parseAndVerify의 다음 세 분기는 아직 다루지 않습니다.
- 점(
.)이 전혀 없는 토큰:lastDotIndex == -1- 서명 불일치:
MessageDigest.isEqual가 false를 반환하는 경로- 지원하지 않는 버전:
parts[0]가VERSION과 다른 경우코딩 가이드라인은 프로덕션 Java 코드에 100% JaCoCo 라인 및 분기 커버리지를 요구합니다. 이 테스트들을 추가하면 이번 변경의 커버리지가 완결됩니다.
♻️ 추가 테스트 예시
+ `@Test` + void rejectsTokenWithoutDelimiter() { + assertMalformedToken("no-delimiter-token"); + } + + `@Test` + void rejectsTokenWithTamperedSignature() { + String payload = String.join(".", validPayloadFields); + assertMalformedToken(payload + "." + encode("wrong-signature")); + } + + `@Test` + void rejectsSignedPayloadWithUnsupportedVersion() { + String[] fields = validPayloadFields.clone(); + fields[0] = encode("v0"); + + assertMalformedToken(signedToken(fields)); + }As per coding guidelines: "Production Java code must maintain 100% JaCoCo line and branch coverage".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java` around lines 63 - 114, Extend the tests for parseAndVerify to cover the remaining branches: assert a token with no dot is rejected, create a structurally valid token with a deliberately mismatched signature and assert rejection, and create a signed token whose first field differs from VERSION and assert rejection. Keep the existing malformed-token assertion style and helpers such as signedToken and assertMalformedToken.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java`:
- Around line 76-82: Update the parser exercised by
ArtifactTokenManualParserBoundaryTest so an empty tokenId field is rejected
during parsing and never stored in ArtifactTokenClaims. Preserve the existing
malformed-token assertion path, ensuring the request fails as 401 Unauthorized
rather than reaching findByTokenId("") and returning 403.
---
Nitpick comments:
In
`@src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java`:
- Around line 63-114: Extend the tests for parseAndVerify to cover the remaining
branches: assert a token with no dot is rejected, create a structurally valid
token with a deliberately mismatched signature and assert rejection, and create
a signed token whose first field differs from VERSION and assert rejection. Keep
the existing malformed-token assertion style and helpers such as signedToken and
assertMalformedToken.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4c5f6a1d-ef20-4d0f-a473-c1058af9d2a1
📒 Files selected for processing (1)
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java
|
CodeRabbit's boundary-regression finding was valid. It exposed a fail-closed distinction: an HMAC-valid token with an empty required token-id segment reached the ledger and returned |
seonghobae
changed the title
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
The additional CodeRabbit nitpick is duplicate rather than an untested production branch. Existing |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== checked-out commit =='
git rev-parse HEAD
git status --short
git show -s --format='%H%n%P%n%s' HEAD
echo '== requested commit availability and diff summary =='
git cat-file -e ce93485cf9ce859e594303774b6e87278ef9bcca^{commit}
git diff --stat ce93485cf9ce859e594303774b6e87278ef9bcca^ ce93485cf9ce859e594303774b6e87278ef9bcca
git diff --find-renames --unified=80 ce93485cf9ce859e594303774b6e87278ef9bcca^ ce93485cf9ce859e594303774b6e87278ef9bcca -- src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo '== source and boundary-test outlines =='
ast-grep outline src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java --items all
ast-grep outline src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java --items all
echo '== parser and related security references =='
rg -n -C 6 --glob '*.java' \
'parseAndVerify|MessageDigest\.isEqual|Base64|getDecoder|UUID\.fromString|parseLong|ledger|FORBIDDEN|UNAUTHORIZED|Jazzer|Fuzz' \
src/main src/test .github 2>/dev/null || true
echo '== fuzz files =='
fd -HI -t f . | rg -i '(jazzer|fuzz|fuzzer)'
echo '== GitHub PR and requested workflow runs =='
gh pr view 274 --repo ContextualWisdomLab/clearfolio --json number,state,isDraft,headRefOid,reviewDecision,statusCheckRollup,reviews
for run in 31051666714 31051900018 31051901808 31051899990; do
echo "-- run $run --"
gh run view "$run" --repo ContextualWisdomLab/clearfolio --json databaseId,headSha,status,conclusion,name,event,workflowName,url,jobs
doneLength of output: 206790 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== boundary test, complete =='
cat -n src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java
echo '== artifact parser fuzz target =='
cat -n src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
echo '== relevant workflows =='
for file in .github/workflows/fuzz.yml .github/workflows/ci.yml; do
if [ -f "$file" ]; then
echo "-- $file --"
cat -n "$file"
fi
done
fd -HI -t f -e yml -e yaml .github/workflows -x sh -c '
if grep -qiE "benchmark|allocation|changelog|fuzz|jazzer" "$1"; then
echo "-- $1 --"
grep -inE "benchmark|allocation|changelog|fuzz|jazzer" "$1"
fi
' sh {}
echo '== changelog and benchmark references =='
fd -HI -t f -i 'changelog*' -i '*benchmark*' . || true
rg -n -i -C 2 'artifact token|artifactlink|manual parser|split\("\\\\\."\)|benchmark|allocation' \
CHANGELOG.md docs README.md pom.xml .github 2>/dev/null || true
echo '== direct Actions run records =='
for run in 31051666714 31051900018 31051901808 31051899990 31051899956 31051898608; do
echo "-- run $run --"
gh api "repos/ContextualWisdomLab/clearfolio/actions/runs/$run" \
--jq '{id,head_sha,status,conclusion,name,event,html_url,created_at,updated_at}'
done
echo '== RED Maven test failure evidence =='
gh run view 31051666714 --repo ContextualWisdomLab/clearfolio --job 92460004269 --log-failed 2>&1 \
| rg -n -i -C 3 'expected|actual|empty|token|failure|ArtifactTokenManualParserBoundaryTest' || true
echo '== current PR checks and review state =='
gh pr view 274 --repo ContextualWisdomLab/clearfolio \
--json isDraft,headRefOid,reviewDecision,statusCheckRollup \
--jq '{isDraft,headRefOid,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,detailsUrl}]}'Length of output: 20133 🏁 Script executed: #!/bin/bash
set -u
echo '== changelog and benchmark files =='
fd -HI -t f . | rg -i '(^|/)(changelog[^/]*|[^/]*benchmark[^/]*)$' || true
echo '== workflow references =='
fd -HI -t f . .github/workflows | while IFS= read -r file; do
if grep -qiE 'benchmark|allocation|changelog|fuzz|jazzer' "$file"; then
echo "-- $file --"
grep -inE 'benchmark|allocation|changelog|fuzz|jazzer' "$file" || true
fi
done
echo '== project references =='
rg -n -i -C 2 'artifact token|artifactlink|manual parser|benchmark|allocation|changelog' \
README.md docs pom.xml .github 2>/dev/null || true
echo '== direct Actions records =='
for run in 31051666714 31051900018 31051901808 31051899990 31051899956 31051898608; do
echo "-- run $run --"
gh api "repos/ContextualWisdomLab/clearfolio/actions/runs/$run" \
--jq '{id,head_sha,status,conclusion,name,event,html_url,created_at,updated_at}' \
|| echo "UNAVAILABLE: $run"
done
echo '== RED test failure lines =='
gh run view 31051666714 --repo ContextualWisdomLab/clearfolio --job 92460004269 --log-failed 2>&1 \
| rg -n -i -C 4 'expected|actual|empty|required field|ArtifactTokenManualParserBoundaryTest|FAILURE' \
|| true
echo '== current exact-head checks =='
gh pr view 274 --repo ContextualWisdomLab/clearfolio \
--json isDraft,headRefOid,reviewDecision,statusCheckRollup \
--jq '{isDraft,headRefOid,reviewDecision,checks:[.statusCheckRollup[]|select(.name|test("Maven test|fuzz \\(ArtifactTokenParserFuzzTest\\)|Semgrep|osv-scan|trivy-fs|scorecard|strix"))|{name,status,conclusion,workflowName,detailsUrl}]}' \
|| trueLength of output: 74984
The empty-segment regression is fixed. The RED evidence is valid. CI run Actionable finding: The PR is still Draft. The Strix workflow
|
Thank you for the valid finding. I have addressed the fail-closed distinction by enforcing strict bounds checking in the manual |
seonghobae
changed the title
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested='e15754503470c03ad11cbe8e718dfae41d25b259'
repo='ContextualWisdomLab/clearfolio'
echo '== Repository state and requested commit =='
echo "checked_out=$(git rev-parse HEAD)"
git status --short
git cat-file -e "${requested}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$requested"
echo '== PR current head and review/check state =='
gh pr view 274 --repo "$repo" \
--json number,state,isDraft,headRefOid,reviewDecision,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,detailsUrl}]}'
echo '== Current-head changes from first parent =='
git diff --stat "${requested}^" "$requested"
git diff --find-renames --unified=100 "${requested}^" "$requested" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java
echo '== Relevant file discovery =='
fd -HI -t f . | rg '(ArtifactLinkService|ArtifactToken.*(Test|Fuzz)|fuzz\.ya?ml|ci\.ya?ml)$' || true
echo '== Source and test outlines =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
do
if [ -f "$file" ]; then
echo "-- outline: $file --"
ast-grep outline "$file" --items all
fi
done
echo '== Parser, status mapping, and boundary-test references =='
rg -n -C 8 --glob '*.java' \
'parseAndVerify|verifyReadToken|MessageDigest\.isEqual|lastIndexOf|indexOf|split\(|Base64|UUID\.fromString|parseLong|UNAUTHORIZED|FORBIDDEN|unsupported|empty|required|malformed|ArtifactTokenParserFuzzTest' \
src/main src/test
echo '== Complete current files under review =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
do
if [ -f "$file" ]; then
echo "-- $file --"
cat -n "$file"
fi
done
echo '== Workflow and fuzz configuration =='
for file in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$file" ] || continue
if grep -qiE 'fuzz|jazzer|ArtifactTokenParserFuzzTest' "$file"; then
echo "-- $file --"
cat -n "$file"
fi
doneLength of output: 175304 🏁 Script executed: #!/bin/bash
set -euo pipefail
requested='e15754503470c03ad11cbe8e718dfae41d25b259'
repo='ContextualWisdomLab/clearfolio'
echo '== Exact-head identity =='
printf 'checked_out='
git rev-parse HEAD
git show -s --format='requested=%H%nparent=%P%nsubject=%s' "$requested"
gh pr view 274 --repo "$repo" --json headRefOid,isDraft,reviewDecision \
--jq '{headRefOid,isDraft,reviewDecision}'
echo '== Exact-head changed files and patch =='
git diff-tree --no-commit-id --name-status -r "$requested"
git diff --unified=25 "${requested}^" "$requested" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java
echo '== Requested deterministic test definitions =='
rg -n --glob '*.java' \
'void (rejectsSignedPayloadWithOnlyNineFields|rejectsSignedPayloadWithElevenFields|rejectsSignedPayloadWithAnEmptyRequiredField|rejectsSignedPayloadWithMalformedBase64Url|rejectsSignedPayloadWithNonNumericEpochSecond|rejectsSignedPayloadWithOutOfRangeEpochSecond|rejectsSignedPayloadWithMalformedDocumentIdentifier|rejectsSignedPayloadWithUnsupportedVersion|verifyReadTokenRejectsUnsupportedVersion)\s*\(' \
src/test/java/com/clearfolio/viewer/artifact
echo '== Current-head status checks =='
gh pr checks 274 --repo "$repo" --json name,state,workflow,link \
--jq '.[] | {name,state,workflow,link}' || true
echo '== All actions runs on the requested head =='
gh run list --repo "$repo" --commit "$requested" --limit 50 \
--json databaseId,name,workflowName,status,conclusion,url,createdAt,updatedAt \
--jq '.[] | {databaseId,name,workflowName,status,conclusion,url,createdAt,updatedAt}' || trueLength of output: 19331
I found no actionable issue in the requested scope.
Current-head CI, Security Scan, SAST Semgrep, CodeQL, and all fuzz targets, including The PR remains Draft and requires review. Strix Security Scan run ✅ Action performedReview finished.
|
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
Acknowledged. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='96c624297174b5cb0e39f6dadbad05ca6091d81a'
echo '== exact commit and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 274 --repo "$repo" \
--json number,state,isDraft,headRefOid,reviewDecision,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,detailsUrl}]}'
echo '== changes in requested commit =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --unified=40 "${head}^" "$head" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java
echo '== relevant files =='
fd -HI -t f . | rg '(ArtifactLinkService|ArtifactToken.*(Test|Fuzz)|fuzz\.ya?ml|ci\.ya?ml|CHANGELOG|README|benchmark)' || true
echo '== source and test outlines =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
do
if [ -f "$file" ]; then
echo "-- $file --"
ast-grep outline "$file" --items all
fi
done
echo '== implementation and deterministic-test references =='
rg -n -C 7 --glob '*.java' \
'parseAndVerify|verifyReadToken|MessageDigest\.isEqual|lastIndexOf|indexOf|Base64|UUID\.fromString|parseLong|UNAUTHORIZED|FORBIDDEN|rejectsSignedPayload|verifyReadTokenRejectsUnsupportedVersion|ArtifactTokenParserFuzzTest' \
src/main src/test
echo '== exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,url,createdAt,updatedAt \
--jq '.[] | {databaseId,name,workflowName,status,conclusion,url,createdAt,updatedAt}'Length of output: 181700 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='96c624297174b5cb0e39f6dadbad05ca6091d81a'
echo '== confirm current PR head =='
gh pr view 274 --repo "$repo" --json headRefOid,isDraft,reviewDecision \
--jq '{headRefOid,isDraft,reviewDecision}'
echo '== required exact-head workflow status =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,url,updatedAt \
--jq '.[] | select(
(.name == "CI") or
(.name == "Security Scan") or
(.name == "SAST Semgrep") or
(.name == "fuzz") or
(.name | startswith("Strix Security Scan"))
) | {databaseId,name,workflowName,status,conclusion,url,updatedAt}'
echo '== performance claims and benchmark evidence =='
rg -n -i -C 3 \
'성능 최적화|allocation|allocat|throughput|benchmark|regex.*overhead|overhead.*regex|unnecessary.*array' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
CHANGELOG.md README.md docs .github pom.xml 2>/dev/null || true
echo '== benchmark-related tracked files =='
fd -HI -t f . | rg -i '(^|/)[^/]*(benchmark|jmh|perf|performance)[^/]*($|/)' || trueLength of output: 4230 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='96c624297174b5cb0e39f6dadbad05ca6091d81a'
echo '== current head =='
gh pr view 274 --repo "$repo" --json headRefOid,isDraft,reviewDecision \
--jq '{headRefOid,isDraft,reviewDecision}'
echo '== required exact-head runs =='
for run in 31058784201 31058784263 31058784481 31058784233; do
gh run view "$run" --repo "$repo" \
--json databaseId,headSha,name,status,conclusion,url,updatedAt \
--jq '{databaseId,headSha,name,status,conclusion,url,updatedAt}'
done
echo '== exact-head check rollup for CI, security, SAST, and fuzz =='
gh pr view 274 --repo "$repo" --json statusCheckRollup \
--jq '[.statusCheckRollup[] |
select(
.name == "Maven test" or
.name == "Semgrep (multi-language SAST)" or
.name == "osv-scan" or
.name == "trivy-fs" or
.name == "dependency-review" or
.name == "scorecard" or
(.name | startswith("fuzz ("))
) |
{name,status,conclusion,workflowName,detailsUrl}
]'Length of output: 1875 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='96c624297174b5cb0e39f6dadbad05ca6091d81a'
echo '== current head =='
gh pr view 274 --repo "$repo" --json headRefOid,isDraft,reviewDecision \
--jq '{headRefOid,isDraft,reviewDecision}'
echo '== direct exact-head workflow records =='
for run in 31058784201 31058784263 31058784481 31058784233; do
echo "-- $run --"
gh api "repos/${repo}/actions/runs/${run}" \
--jq '{id,head_sha,name,status,conclusion,html_url,updated_at}'
done
echo '== fuzz job status =='
gh api "repos/${repo}/actions/runs/31058784233/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,html_url,started_at,completed_at}'
echo '== exact-head pull request check rollup =='
gh pr view 274 --repo "$repo" --json statusCheckRollup \
--jq '[.statusCheckRollup[] |
select(
.name == "Maven test" or
.name == "Semgrep (multi-language SAST)" or
.name == "osv-scan" or
.name == "trivy-fs" or
.name == "dependency-review" or
.name == "scorecard" or
(.name | startswith("fuzz ("))
) |
{name,status,conclusion,workflowName,detailsUrl}
]'Length of output: 3642
CI I found one actionable issue. Unsupported performance claim: I found no other actionable issue in the requested scope.
The PR remains Draft and requires review. You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='2fedfa829c31931b91b2f75cd6e99eacdb8a9f6c'
echo '== exact-head identity and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 274 --repo "$repo" --json number,isDraft,headRefOid,reviewDecision \
--jq '{number,isDraft,headRefOid,reviewDecision}'
echo '== changed files from parent =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --stat "${head}^" "$head"
echo '== candidate files =='
fd -HI -t f . | rg '(^|/)(ArtifactLinkService|ArtifactToken.*(Test|Fuzz)|CHANGELOG|README|.*[Bb]enchmark.*|.*[Gg]uard.*)\.(java|md|ya?ml)$' || true
echo '== outlines =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java \
CHANGELOG.md
do
if [ -f "$file" ]; then
echo "-- $file --"
if [[ "$file" == *.java ]]; then ast-grep outline "$file" --items all; fi
cat -n "$file"
fi
done
echo '== security, test, and guard references =='
rg -n -C 5 --glob '*.java' --glob '*.md' \
'parseAndVerify|MessageDigest\.isEqual|lastIndexOf|Base64|UUID\.fromString|parseLong|UNAUTHORIZED|FORBIDDEN|rejectsSignedPayload|onlyNine|Eleven|Empty|required|unsupported.*version|allocation|throughput|benchmark|CHANGELOG' \
src/main src/test CHANGELOG.md README.md 2>/dev/null || true
echo '== exact-head named runs =='
for run in 31061913403 31062219464 31062219437 31062219547 31062219521; do
echo "-- run $run --"
gh run view "$run" --repo "$repo" \
--json databaseId,headSha,name,status,conclusion,url,workflowName,updatedAt \
--jq '{databaseId,headSha,name,status,conclusion,url,workflowName,updatedAt}'
done
echo '== all workflow runs on exact head =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,url,updatedAt \
--jq '.[] | {databaseId,name,workflowName,status,conclusion,url,updatedAt}'
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=274 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 4047 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='2fedfa829c31931b91b2f75cd6e99eacdb8a9f6c'
echo '== commits from parser predecessor to requested head =='
git log --oneline --decorate --no-merges 96c624297174b5cb0e39f6dadbad05ca6091d81a.."$head"
echo '== patches after predecessor =='
git diff --find-renames --unified=30 96c624297174b5cb0e39f6dadbad05ca6091d81a "$head" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
CHANGELOG.md
echo '== parser implementation =='
rg -n -A140 -B15 'parseAndVerify\s*\(' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo '== boundary and guard test methods =='
rg -n -A35 -B5 --glob '*.java' \
'void\s+(rejectsSignedPayload|verifyReadTokenRejects|.*Guard.*|.*Regression.*|.*Performance.*)\w*\s*\(' \
src/test/java/com/clearfolio/viewer/artifact
echo '== all explicit boundary method declarations =='
rg -n --glob '*.java' \
'void\s+\w*(Nine|Eleven|Empty|Base64|Epoch|DocumentIdentifier|Version|Signature|Shape)\w*\s*\(' \
src/test/java/com/clearfolio/viewer/artifact src/test/java/com/clearfolio/viewer/fuzz
echo '== performance terms in tracked text and Java sources =='
rg -n -i -C3 --glob '*.java' --glob '*.md' \
'allocation|throughput|benchmark|performance|regex.*overhead|overhead.*regex' \
src/main src/test CHANGELOG.md README.md docs 2>/dev/null || true
echo '== CHANGELOG current section =='
cat -n CHANGELOG.md | sed -n '1,100p'
echo '== cited Actions runs =='
for run in 31061913403 31062219464 31062219437 31062219547 31062219521; do
gh run view "$run" --repo "$repo" \
--json databaseId,headSha,name,status,conclusion,url,workflowName,updatedAt \
--jq '{databaseId,headSha,name,status,conclusion,url,workflowName,updatedAt}'
done
echo '== all exact-head workflow runs =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,url,updatedAt \
--jq '.[] | {databaseId,name,workflowName,status,conclusion,url,updatedAt}'
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=274 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 83645 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='2fedfa829c31931b91b2f75cd6e99eacdb8a9f6c'
echo '== evidence-guard commit files and patch =='
git show --format='commit=%H%nsubject=%s' --name-status 93792b7
git show --format= --unified=80 93792b7
echo '== files changed in all post-96c624 commits =='
for commit in a5886a0 c8fe295 93792b7 396c563 77175a4 2fedfa8; do
echo "-- $commit --"
git show --format='%H %s' --name-status "$commit"
done
echo '== guard-like source files and references =='
fd -HI -t f . | rg -i '(guard|evidence|artifact.*token|token.*artifact|changelog)' | while IFS= read -r file; do
echo "-- $file --"
rg -n -i -C3 'ArtifactTokenManualParserBoundaryTest|rejectsSignedPayload|parseAndVerify|allocation|throughput|benchmark|CHANGELOG' "$file" || true
done
echo '== exact-head Actions run records through REST =='
for run in 31062219464 31062219437 31062219547 31062219521; do
echo "-- $run --"
gh api "repos/${repo}/actions/runs/${run}" \
--jq '{id,head_sha,name,status,conclusion,html_url,workflow_id,event,updated_at}'
done
echo '== exact-head Actions runs through REST =='
gh api "repos/${repo}/actions/runs?head_sha=${head}&per_page=100" \
--jq '.workflow_runs[] | {id,head_sha,name,status,conclusion,html_url,workflow_id,updated_at}'
echo '== review thread resolution =='
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=274 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 18037 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
run='31062219464'
echo '== workflow references to evidence guard =='
fd -HI -t f -e yml -e yaml .github/workflows -x sh -c '
echo "-- $1 --"
rg -n -i -C3 "test_artifact_token_parser_evidence|pytest|python.*scripts|scripts/" "$1" || true
' sh {}
echo '== CI jobs and steps =='
gh api "repos/${repo}/actions/runs/${run}/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,steps:[.steps[]|{name,status,conclusion}]}'
echo '== CI log references to evidence guard =='
gh run view "$run" --repo "$repo" --log 2>&1 \
| rg -n -i -C3 'test_artifact_token_parser_evidence|manual_parser_has_no_unbenchmarked|manual_parser_keeps_signed' || trueLength of output: 1447 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
run='31062219464'
echo '== workflow references to evidence guard =='
fd -HI -t f . .github/workflows -e yml -e yaml -x sh -c '
echo "-- $1 --"
rg -n -i -C3 "test_artifact_token_parser_evidence|pytest|python.*scripts|scripts/" "$1" || true
' sh {}
echo '== CI jobs and steps =='
gh api "repos/${repo}/actions/runs/${run}/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,steps:[.steps[]|{name,status,conclusion}]}'
echo '== CI log references to evidence guard =='
gh run view "$run" --repo "$repo" --log 2>&1 \
| rg -n -i -C3 'test_artifact_token_parser_evidence|manual_parser_has_no_unbenchmarked|manual_parser_keeps_signed' || trueLength of output: 3077
I found no actionable issue in the requested scope.
Strix Security Scan The PR remains Draft and requires review. I did not infer independent approval. You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head Test-first evidence is RED |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='0b64be1f761d4dc6377eae1363cbe400ca973555'
echo '== Exact commit and pull request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
gh pr view 274 --repo "$repo" --json number,isDraft,headRefOid,reviewDecision,statusCheckRollup \
--jq '{number,isDraft,headRefOid,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,detailsUrl}]}'
echo '== Files changed at exact commit =='
git diff-tree --no-commit-id --name-status -r "$head"
git diff --stat "${head}^" "$head"
echo '== Candidate files =='
fd -HI -t f . | rg '(^|/)(ArtifactLinkService|ArtifactToken.*(Test|Fuzz)|test_artifact_token_parser_evidence|CHANGELOG|ci)\.(java|py|md|ya?ml)$' || true
echo '== Java outlines =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
do
if [ -f "$file" ]; then
echo "-- $file --"
ast-grep outline "$file" --items all
fi
done
echo '== Parser and status boundary =='
rg -n -A150 -B15 --glob '*.java' \
'parseAndVerify\s*\(|verifyReadToken\s*\(' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo '== Deterministic boundary and existing branch test methods =='
rg -n -A30 -B5 --glob '*.java' \
'void\s+(rejectsSignedPayload|verifyReadTokenRejectsInvalidShape|verifyReadTokenRejectsInvalidSignature|verifyReadTokenRejectsUnsupportedVersion)\w*\s*\(' \
src/test/java/com/clearfolio/viewer/artifact
echo '== Evidence guard and changelog =='
for file in scripts/test_artifact_token_parser_evidence.py CHANGELOG.md .github/workflows/ci.yml; do
if [ -f "$file" ]; then
echo "-- $file --"
cat -n "$file"
fi
done
echo '== Unsupported performance terms in production and changelog =='
rg -n -i -C3 'allocation|throughput|benchmark|performance|regex.*overhead|overhead.*regex' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java CHANGELOG.md \
scripts/test_artifact_token_parser_evidence.py 2>/dev/null || true
echo '== Cited workflow runs =='
for run in 31064424433 31064527256 31064527227 31064527237 31064527206; do
echo "-- $run --"
gh api "repos/${repo}/actions/runs/${run}" \
--jq '{id,head_sha,name,status,conclusion,html_url,workflow_id,event,updated_at}'
done
echo '== All workflow runs on exact head =='
gh api "repos/${repo}/actions/runs?head_sha=${head}&per_page=100" \
--jq '.workflow_runs[] | {id,head_sha,name,status,conclusion,html_url,workflow_id,updated_at}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=274 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 69582
I found no actionable issue in the requested implementation scope.
Strix Security Scan You are interacting with an AI system. |
f8a85f7 to
2656321
Compare
|
@opencode-agent Fix the exact-current-head CI regression on Root cause is confirmed from CI run Required bounded repair:
|
seonghobae
changed the title
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head This draft is a clean descendant of parent #270 exact
Test-first RED evidence: Exact-head GREEN evidence: CI Submit a formal exact-head review only after your own inspection. Automated review remains advisory unless GitHub counts the reviewer identity and repository permission; parent #270, independent write-authorized approval, and every branch-protection gate remain mandatory. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='03afab3884107e8149729b82426f22051e8fba14'
parent='26563218ae42eaa876c784fcf56b27f8cb810080'
echo '== exact head and PR state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${parent}^{commit}"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$parent" "$head" && echo 'parent_is_ancestor=true'
git rev-list --left-right --count "${parent}...${head}"
gh pr view 274 --repo "$repo" --json number,isDraft,headRefOid,reviewDecision,statusCheckRollup \
--jq '{number,isDraft,headRefOid,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,detailsUrl}]}'
echo '== parent-relative diff =='
git diff --stat "$parent" "$head"
git diff --name-status "$parent" "$head"
git diff --unified=50 "$parent" "$head" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java \
scripts/test_artifact_token_parser_evidence.py \
.github/workflows/ci.yml CHANGELOG.md
echo '== candidate files =='
fd -HI -t f . | rg '(^|/)(ArtifactLinkService|ArtifactToken.*(Test|Fuzz)|test_artifact_token_parser_evidence|CHANGELOG|ci)\.(java|py|md|ya?ml)$' || true
echo '== Java structure =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenManualParserBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
do
if [ -f "$file" ]; then
echo "-- outline: $file --"
ast-grep outline "$file" --items all
fi
done
echo '== parser and authorization boundary =='
rg -n -A180 -B20 --glob '*.java' \
'parseAndVerify\s*\(|verifyReadToken\s*\(' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java
echo '== deterministic and retained tests =='
rg -n -A35 -B5 --glob '*.java' \
'void\s+\w*(Nine|Eleven|Trailing|Empty|Blank|Base64|Epoch|DocumentIdentifier|Version|InvalidShape|InvalidSignature)\w*\s*\(' \
src/test/java/com/clearfolio/viewer/artifact src/test/java/com/clearfolio/viewer/fuzz
echo '== evidence guard, workflow, and documentation =='
for file in scripts/test_artifact_token_parser_evidence.py .github/workflows/ci.yml CHANGELOG.md; do
if [ -f "$file" ]; then
echo "-- $file --"
cat -n "$file"
fi
done
echo '== performance claims in relevant tracked content =='
rg -n -i -C3 \
'allocation|latency|throughput|benchmark|performance|regex.*overhead|overhead.*regex' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/test/java/com/clearfolio/viewer/artifact \
scripts/test_artifact_token_parser_evidence.py CHANGELOG.md README.md docs .github 2>/dev/null || true
echo '== cited workflow runs =='
for run in 31065484032 31065976766 31066185632 31066185647 31066185728 31066185676; do
echo "-- $run --"
gh api "repos/${repo}/actions/runs/${run}" \
--jq '{id,head_sha,name,status,conclusion,html_url,event,updated_at}'
done
echo '== jobs for current CI evidence =='
gh api "repos/${repo}/actions/runs/31066185632/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,steps:[.steps[]|{name,status,conclusion}]}'
echo '== all workflow runs on exact head =='
gh api "repos/${repo}/actions/runs?head_sha=${head}&per_page=100" \
--jq '.workflow_runs[] | {id,head_sha,name,status,conclusion,html_url,updated_at}'
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=274 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 174993 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='03afab3884107e8149729b82426f22051e8fba14'
echo '== ArtifactTokenClaims change and complete source =='
git diff --unified=80 "${head}^" "$head" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java
cat -n src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java
echo '== claim validation tests and token boundary tests =='
rg -n -A45 -B8 --glob '*.java' \
'ArtifactTokenClaims|rejectsSignedPayloadWithAnEmptyRequiredField|rejectsValidTokenWithTrailingDelimiter|verifyReadTokenRejectsInvalidShape|verifyReadTokenRejectsInvalidSignature' \
src/test/java
echo '== fuzz target and workflow binding =='
cat -n src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
fd -HI -t f -e yml -e yaml .github/workflows -x sh -c '
if rg -q "ArtifactTokenParserFuzzTest|jazzer|fuzz" "$1"; then
echo "-- $1 --"
cat -n "$1"
fi
' sh {}
echo '== evidence guard test discovery and test runner scope =='
rg -n -C4 --glob '*.py' \
'test_artifact_token_parser_evidence|ArtifactTokenBoundaryTest|UNSUPPORTED_PERFORMANCE_CLAIMS|pytest' \
scripts requirements-test.txt 2>/dev/null || true
echo '== exact-head Maven job summary from CI log =='
gh run view 31066185632 --repo "$repo" --job 92504283097 --log 2>&1 \
| rg -n -i -C3 \
'Tests run:|tests run:|Failures:|Errors:|Skipped:|missed|jacoco|javadoc|warning|verify_maven_test_reports|ArtifactTokenBoundaryTest' \
|| true
echo '== parent contracts changed by current head =='
git diff --name-status "${head}^" "$head"
git diff --name-status 26563218ae42eaa876c784fcf56b27f8cb810080 "$head" -- \
pom.xml .github/workflows src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/test/java/com/clearfolio/viewer/artifact scripts CHANGELOG.mdLength of output: 30513 🏁 Script executed: #!/bin/bash
set -u
repo='ContextualWisdomLab/clearfolio'
echo '== fuzz workflow references =='
fd -HI -t f . .github/workflows -e yml -e yaml -x sh -c '
if rg -q "ArtifactTokenParserFuzzTest|jazzer|fuzz" "$1"; then
echo "-- $1 --"
rg -n -C4 "ArtifactTokenParserFuzzTest|jazzer|fuzz|head.sha|git rev-parse" "$1"
fi
' sh {} || true
echo '== Maven job report evidence =='
gh run view 31066185632 --repo "$repo" --job 92504283097 --log 2>&1 \
| rg -n -i -C2 \
'ArtifactTokenBoundaryTest|Tests run:|Tests run|Failures:|Errors:|Skipped:|verify_maven_test_reports|JaCoCo|missed.*(line|branch)|javadoc|warning' \
|| true
echo '== exact head status and pending checks =='
gh pr view 274 --repo "$repo" --json headRefOid,isDraft,reviewDecision,statusCheckRollup \
--jq '{headRefOid,isDraft,reviewDecision,pending:[.statusCheckRollup[]|select(.status != "COMPLETED" or (.conclusion != "SUCCESS" and .conclusion != "SKIPPED"))|{name,status,conclusion,workflowName,detailsUrl}]}'
echo '== direct exact-head test and production files changed from parent =='
git diff --name-status 26563218ae42eaa876c784fcf56b27f8cb810080 03afab3884107e8149729b82426f22051e8fba14Length of output: 43556
I found no actionable issue in the requested scope.
Strix Security Scan You are interacting with an AI system. |
|
@coderabbitai review @opencode-agent @cwl-noema-review Independently review exact current head Exact-head CI |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/clearfolio'
head='03afab3884107e8149729b82426f22051e8fba14'
parent='26563218ae42eaa876c784fcf56b27f8cb810080'
echo '== exact identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${parent}^{commit}"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$parent" "$head" && echo 'parent_is_ancestor=true'
printf 'parent...head='; git rev-list --left-right --count "${parent}...${head}"
echo '== exact parent-relative file set and diff =='
git diff --name-status "$parent" "$head"
git diff --stat "$parent" "$head"
git diff --unified=60 "$parent" "$head" -- \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
scripts/test_artifact_token_parser_evidence.py \
CHANGELOG.md
echo '== relevant Java outlines =='
for file in \
src/main/java/com/clearfolio/viewer/artifact/ArtifactLinkService.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactTokenBoundaryTest.java \
src/test/java/com/clearfolio/viewer/artifact/ArtifactLinkServiceTest.java \
src/test/java/com/clearfolio/viewer/fuzz/ArtifactTokenParserFuzzTest.java
do
[ -f "$file" ] || continue
echo "-- $file --"
ast-grep outline "$file" --items all
done
echo '== parser, ledger boundary, and claims validation =='
rg -n -A180 -B15 --glob '*.java' \
'parseAndVerify\s*\(|verifyReadToken\s*\(|ArtifactTokenClaims\s*\(' \
src/main/java/com/clearfolio/viewer/artifact
rg -n -A70 -B12 --glob '*.java' \
'requireNonNull|isBlank|trim|strip|normalize' \
src/main/java/com/clearfolio/viewer/artifact/ArtifactTokenClaims.java
echo '== relevant deterministic and retained test declarations =='
rg -n -A35 -B5 --glob '*.java' \
'void\s+\w*(Nine|Eleven|Trailing|Empty|Blank|Base64|Epoch|DocumentIdentifier|Version|InvalidShape|InvalidSignature)\w*\s*\(' \
src/test/java/com/clearfolio/viewer/artifact src/test/java/com/clearfolio/viewer/fuzz
echo '== evidence guard and performance-claim search =='
cat -n scripts/test_artifact_token_parser_evidence.py
rg -n -i -C2 \
'allocation|latency|throughput|benchmark|performance|regex.*overhead|overhead.*regex' \
src/main/java/com/clearfolio/viewer/artifact \
src/test/java/com/clearfolio/viewer/artifact \
scripts/test_artifact_token_parser_evidence.py CHANGELOG.md README.md docs 2>/dev/null || true
echo '== exact-head workflow records =='
for run in 31066185632 31066185647 31066185728 31066185676; do
gh api "repos/${repo}/actions/runs/${run}" \
--jq '{id,head_sha,name,status,conclusion,html_url,updated_at}'
done
echo '== all current-head runs =='
gh api "repos/${repo}/actions/runs?head_sha=${head}&per_page=100" \
--jq '.workflow_runs[] | {id,head_sha,name,status,conclusion,html_url,updated_at}'
echo '== PR state and unresolved review threads =='
gh pr view 274 --repo "$repo" --json isDraft,headRefOid,reviewDecision \
--jq '{isDraft,headRefOid,reviewDecision}'
gh api graphql -F owner='ContextualWisdomLab' -F name='clearfolio' -F number=274 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 178180
I found no actionable issue in the requested scope.
Strix Security Scan I do not infer the required counted independent approval. Parent You are interacting with an AI system. |
|
Review-scope correction: this exact head is 10 commits ahead and 0 behind #270, with a five-file parent-relative slice, but the PR still targets |
|
Exact stack refresh: authoritative parent #270 is now |
|
Superseded by clean draft #276 at exact head |
1 participant
Security objective
Reject malformed signed artifact-token structures before authorization or token-ledger access while preserving the exact HMAC-bound payload semantics. This draft is a clean descendant of authoritative parent #270 exact head
26563218ae42eaa876c784fcf56b27f8cb810080.The bounded parent-relative diff contains exactly five files:
CHANGELOG.md.No allocation, latency, throughput, or regex-performance claim is made without reproducible benchmark evidence.
Test-first evidence
Empty required claim
RED exact head
bf88a253bdb7308a0e5231676829b2880a3cf8fc, CI31065484032, Maven merge-compatibility job92502195972, ran 480 tests and failed exactly because a valid-HMAC payload with an emptytokenIdreached ledger lookup and returned403 Forbiddeninstead of being rejected as malformed with401 Unauthorized.ArtifactTokenClaimsnow validates all signed text claims centrally during construction. It does not trim or normalize values, so verified signature meaning is unchanged. The rule applies to the service and to standalone/MSA callers that construct claims directly.Trailing delimiter
RED exact head
e7524b8fb514f1e47bbd120e4a2ce1665bddcbed, CI31065976766, Maven job92503663447, ran 481 tests and failed exactly because Java's defaultString.splitdiscarded a trailing empty segment, allowing an otherwise valid token followed by.to pass verification.The parser now uses
split("\\.", -1)so trailing empty fields are preserved. The exact field-count gate rejects the extra delimiter before HMAC verification, claim decoding, authorization, or ledger access.Boundary contract
ArtifactTokenBoundaryTestand the existing artifact-link service tests deterministically verify rejection of:ArtifactTokenParserFuzzTestremains enabled; no fuzz or coverage gate was replaced.Exact-head acceptance evidence
Exact current head is
03afab3884107e8149729b82426f22051e8fba14.31066185632: success.92504283097: Java 21mvn -B --no-transfer-progress verify; 481 tests, zero failures, errors, or skips; 59 production classes; all zero-missed-line and zero-missed-branch JaCoCo checks met; warning-free public Javadocs completed.92504283065: success.92504283089: success.31066185647: success.31066185728: success.31066185676: all required targets succeeded.Queued, pending, cancelled, skipped-required, stale-head, predecessor-head, local-only, synthetic-only, advisory-only, and commit-status-only evidence is not passing.
Stack and merge gate
Keep this PR draft. While #270 remains open, the correct review base is parent branch
fix/pii-logging-16240128950440010639; a direct API retarget attempt returned an upstream 502, so no base transition is inferred. After #270 integrates, retarget to protectedmain, confirm the same bounded five-file effective diff, and rerun every base-sensitive or head-sensitive gate.Before merge, require formal exact-current-head CodeRabbit and Noema/Strix evidence, zero unresolved actionable threads, a counted approval from an independent reviewer with repository write permission, expected-head-safe satisfaction of every branch-protection and repository-policy rule, and successful CI, security, coverage, documentation, merge-compatibility, and fuzz evidence. Do not bypass protections, weaken tests, infer approval from bot status or advisory comments, or publish a release from this draft.