Fix/ci punchlist 2026 07 27 - #67
Merged
Merged
Conversation
The pinned SHA was commented '# v3.28.1' but actually resolves to tag v4.37.1 upstream (verified via git ls-remote). Keep the working SHA, label it honestly. Also fix guix.scm licence: pmpl-1.0-or-later is not a Guix licence symbol and contradicts the MPL-2.0 normalisation (#45). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The scorecard reusable requests contents:read at workflow level; the caller's explicit job-level permissions block zeroed it out, so Actions rejected the file at parse time (startup_failure, zero jobs — invisible to gh pr checks). Same class as the Secret Scanner fix in #51. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
….104 Clears Cargo Audit red: RUSTSEC-2026-0204 (crossbeam-epoch invalid pointer deref in fmt::Pointer) and warning RUSTSEC-2026-0190 (anyhow unsound downcast_mut). cargo check --workspace passes locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The repo's documentation had drifted from what the code is. Every defect here came from copy-in rather than decay. Machine-facing: - 0-AI-MANIFEST.a2ml pointed agents at README.adoc, which has not existed since PR #47 converted it to Markdown — the agent entry point was dead. Rewritten to v1.1 with a correct primary pointer, explicit read-order, and the Guix-only invariant. - .machine_readable/6a2/STATE.a2ml advanced 2026-06-13 -> 2026-07-29: July milestones, open issues #43/#35/#20, plus new [repo-facts] and [ci-status] blocks recording measured counts and per-workflow state. Human-facing: - ARCHITECTURE.md was a generic template stub describing src/ tests/ config/ and README.adoc — a layout this repo does not have. Replaced with the real pipeline, directory table, resource economy (including Echo/Landauer), metadata contract, and an honest known-gaps list. - QUICK_STATUS.md and TOOLCHAIN_STATUS.md: refreshed headers plus a currency note that the 2026-02 tables predate Echo and undercount the workspace (53 members, not 25 crates). - .claude/CLAUDE.md: read-this-first block with current CI state, the moved checkout path, and the gh-pr-checks trap; corrected packaging policy, which still listed Nix as a fallback despite the Guix-only ruling of 2026-05-18. - README.md: licence badge alt-text said PMPL-1.0 while the badge image said MPL-2.0; added an Architecture quick link. Verified: cargo check --workspace passes; counts measured by inspection. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ClusterFuzzLite reported a reproducible out-of-memory in fuzz_main (artifact oom-abc6a1849ffcc4d85f6f3524b146f4f1bc471edc). It is not really an OOM: the recursive-descent parser descends the native stack, so deeply nested input aborts the process with 'fatal runtime error: stack overflow', which libFuzzer reports as an OOM. About 1000 nested parens — roughly 2 KB — was enough, far inside the target's 100 KB cap, so the fuzzer found it easily. Adds MAX_RECURSION_DEPTH with a with_recursion_guard() helper that restores depth on every exit path, applied at the four recursive entry points: parse_expr_prec, parse_type, parse_block, and parse_block_inner. Exceeding it now yields a RecursionLimitExceeded parse error. The limit is 64, not a rounder larger number, because it must hold on the smallest stack the parser runs on. Rust spawns threads with 2 MiB by default and both the LSP and the test harness parse off the main thread; at roughly 8 KiB of debug-build stack per level, 256 still overflowed a 2 MiB thread while passing on the main thread's 8 MiB. 64 leaves about a 4x margin. Verified: - paren, type and brace nesting at depths 1k and 50k all survive on a 2 MiB thread; before the fix all three aborted at 1k. - all 108 .ecl files in the repo parse with zero depth-limit rejections, so the limit rejects no legitimate program. - cargo test -p eclexia-parser: 7/7 pass, including a new regression test covering expression nesting, type nesting, and the shallow case. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… & Test Build & Test has been red on main since 2026-07-25, which the first pass of this session's sitrep missed because it fell outside the top-10 runs inspected. The cause is not new code: clippy 1.97 tightened several lints, so the 'zero clippy warnings' claim in the February docs decayed without anyone editing the code. CI reported only the first failure because clippy stops at the first failing crate, hiding a chain of four across four crates: - eclexia-typeck unneeded_wildcard_pattern (amount: _ before ..) - eclexia-interp question_mark (if-let/else -> ?) - eclexia-lsp question_mark (if-let/else -> ?) - eclexia-graphql useless_borrows_in_formatting (redundant & in format!) All four are behaviour-preserving; the last three were applied by cargo clippy --fix and reviewed. Verified: cargo clippy --workspace --all-targets -- -D warnings exits 0, which is the exact command CI runs. cargo test --workspace is 44 passed / 1 failed, the single failure being integration_llvm_native_target, which needs llc from LLVM 17 and is unavailable in this environment — it passes in CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedClears clippy debt, bounds parser recursion depth to prevent stack overflows, and updates CI workflow configurations and dependency versions. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers
Summary by Gitar
This will update automatically on new commits.