legal: synchronize standalone artifact inspection - #55
Conversation
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Summary by CodeRabbit
WalkthroughThe pull request adds standalone artifact inspection for pinned third-party assets. It verifies downloads and checksums, inspects legal files across AMD64 and ARM64 assets, generates JSON and Markdown evidence, and integrates synchronization into CI workflows. ChangesStandalone artifact inspection
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant UpstreamWorkflow
participant InspectionScript
participant GitHubAssets
participant EvidenceFiles
UpstreamWorkflow->>InspectionScript: refresh standalone inspection
InspectionScript->>GitHubAssets: download pinned AMD64 and ARM64 assets
GitHubAssets-->>InspectionScript: asset contents
InspectionScript->>InspectionScript: verify checksums and compare legal files
InspectionScript->>EvidenceFiles: write changed JSON and Markdown reports
EvidenceFiles-->>UpstreamWorkflow: tracked inspection changes
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb7ea07b07
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex address that feedback Apply only the concrete P1 review fix: public standalone asset downloads must never read or send |
|
To use Codex here, create an environment for this repo. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/sync-standalone-artifact-inspection.py`:
- Around line 276-301: Update download_verified to remove the GH_TOKEN lookup
and Authorization header from the release-asset download request, leaving only
the non-sensitive headers needed for urllib.request.Request. Preserve the
existing GitHub URL validation, retry behavior, checksum verification, and
destination cleanup.
- Around line 76-109: Validate TOML parser support for the quoted dotted
platform keys used by mise.lock during dependency/version setup, before calling
load_uv_assets(). Fail with a clear dependency/version error when the runtime
cannot parse those keys, rather than allowing load_uv_assets() to proceed or
fail later during platform lookup.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1b7158b7-0afe-459a-b3a6-9032c46e0990
📒 Files selected for processing (7)
.github/workflows/build-amd64.yml.github/workflows/check-upstream.ymlscripts/sync-standalone-artifact-inspection.pyscripts/test_sync_standalone_artifact_inspection.pythird_party/README.mdthird_party/standalone-artifact-inspection.jsonthird_party/standalone-artifact-inspection.md
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
third_party/standalone-artifact-inspection.mdthird_party/README.md
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/check-upstream.yml.github/workflows/build-amd64.yml
🪛 ast-grep (0.45.0)
scripts/sync-standalone-artifact-inspection.py
[warning] 287-287: Request-controlled URL passed to urlopen; validate against an allowlist to prevent SSRF.
Context: urllib.request.urlopen(request, timeout=300)
Note: [CWE-918] Server-Side Request Forgery (SSRF).
(urlopen-unsanitized-data)
[info] 494-494: use jsonify instead of json.dumps for JSON output
Context: json.dumps(new_report, indent=2, ensure_ascii=False)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
🪛 Ruff (0.16.0)
scripts/test_sync_standalone_artifact_inspection.py
[warning] 16-16: Assertion should be broken down into multiple parts
Break down assertion into multiple parts
(PT018)
scripts/sync-standalone-artifact-inspection.py
[warning] 45-45: Avoid specifying long messages outside the exception class
(TRY003)
[warning] 240-240: Too many return statements (13 > 6)
(PLR0911)
[warning] 240-240: Too many branches (13 > 12)
(PLR0912)
[error] 287-287: Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
(S310)
[error] 288-288: Audit URL open for permitted schemes. Allowing use of file: or custom schemes is often unexpected.
(S310)
[warning] 295-295: Consider moving this statement to an else block
(TRY300)
[warning] 359-366: Use a list comprehension to create a transformed list
(PERF401)
🔇 Additional comments (9)
scripts/sync-standalone-artifact-inspection.py (3)
1-45: LGTM!
112-274: LGTM!
304-528: LGTM!scripts/test_sync_standalone_artifact_inspection.py (1)
1-139: LGTM!.github/workflows/build-amd64.yml (1)
38-46: LGTM!.github/workflows/check-upstream.yml (1)
267-268: LGTM!Also applies to: 278-285, 309-309
third_party/README.md (1)
24-47: LGTM!third_party/standalone-artifact-inspection.json (1)
142-169: LGTM!third_party/standalone-artifact-inspection.md (1)
11-11: LGTM!
|
Review follow-up:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d81525ec9b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if actual != expected_sha256: | ||
| fail(f"SHA-256 mismatch for {url}: {actual} != {expected_sha256}") | ||
| return | ||
| except (OSError, urllib.error.URLError) as exc: |
There was a problem hiding this comment.
When GitHub or its release-asset host closes one of these large downloads before the advertised Content-Length, response.read() raises http.client.IncompleteRead, which is neither an OSError nor a URLError. That exception therefore bypasses the intended three-attempt loop and fails the daily upstream workflow immediately; include the relevant http.client transport exceptions in the retry handling (and similarly retry a premature clean EOF before treating its digest mismatch as final).
Useful? React with 👍 / 👎.
1 participant
What changed
tar.gzand raw-binary packaging forms and never extracts archives;Repaired evidence
For uv 0.12.1, the verified pinned assets contain three archive members and no separate license-like file:
The preserved Apache-2.0 and MIT license texts remain the authoritative notices shipped with the image.
Race prevention inside the repository
Check upstream versionsnow refreshes the standalone report after updating pins andmise.lock, tracks both generated report files and validates them before committing. Future GitHub CLI, Codex CLI, ttyd, mise or uv update PRs therefore carry their exact packaging evidence instead of starting with a stale report.Repository branch protection remains a separate GitHub setting; this PR does not weaken or bypass required checks.
Validation
This remains intentionally narrow: it does not parse Dockerfiles or arbitrary shell/package-manager syntax and is not a general dependency-license scanner.