Repository navigation
Provision the Composite-Actions Check's YAML Parser Through uvx - #2359
Merged
Merged
Conversation
…able The composite-actions check fell back to yq, which no workflow provisions, so a host with neither PyYAML nor yq reported every action as unreadable. The fallback now runs PyYAML under uvx, a declared host tool that already runs the schema half, so the parser is PyYAML on every host. A host with neither still gets the named finding. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The uvx reader now stringifies mapping keys, turns any read failure into one stderr line under its own exit code, and runs with UTF-8 stdio that the parent decodes leniently. A failure of uvx itself, a timeout, an exit, or a missing tool, is one finding rather than one per action file, and never carries the reader script. The README states each half's tools. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lds Used One uvx probe per run resolves an interpreter that imports PyYAML, and a failure of that probe is the single host finding. The reader then runs under that interpreter as a direct child, so its timeout kills it, and it emits only each step's run, shell, and name, so aliases elsewhere in the file are never expanded. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An interpreter uvx resolved but removed on exit, as under UV_NO_CACHE, now fails to launch as one host finding rather than one per action file. The reader keeps any truthy scalar step name as a string, so its labels match the in-process read. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #2359 +/- ##
===========================================
+ Coverage 57.70% 57.86% +0.15%
===========================================
Files 16 16
Lines 7919 7944 +25
===========================================
+ Hits 4570 4597 +27
+ Misses 3349 3347 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Isolate the uvx Python invocations before approval.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Updates composite-action parsing to provision PyYAML through uvx when unavailable locally.
Changes:
- Adds cached interpreter probing and bounded YAML reading.
- Expands fallback, timeout, alias, encoding, and failure tests.
- Documents parser requirements.
A critical issue remains: child Python invocations are not isolated from repository-controlled modules.
| File | Description |
|---|---|
tests/test_repo_gate.py |
Tests fallback reader behavior and failures. |
scripts/README.md |
Documents composite-action tool requirements. |
.github/actions/repo-gate/repo_gate.py |
Implements uvx-based YAML reading. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
`python -c` puts the working directory on sys.path, so a `yaml.py` or `json.py` in the checked-out repository could shadow the probe's or the reader's imports. Both now run from the gate's directory, and the reader gets the action's absolute path. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Running the children from the gate's own directory put them in a shared temp directory when the gate itself is fetched to one. Both `-c` programs instead drop the empty `sys.path` entry before importing anything, so no module in the working directory shadows theirs, wherever it is. The cwd and absolute-path changes are reverted. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On Python 3.13 and later, `-c` imports linecache from the working directory before the program's first statement, so stripping sys.path inside the program comes too late, and an inherited PYTHONPATH can add the working directory back. Both children now run with `-I -X utf8`, which keeps the working directory, PYTHONPATH, and user site off sys.path and makes stdio UTF-8 without an environment variable. The sys.path strip and the PYTHONIOENCODING injection are removed. Addresses #2348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ptr727
added a commit
that referenced
this pull request
Oct 4, 2026
…nd Review Digest Tolerance (#2360) ## Summary Promotes `develop` to `main` with four pull requests, each already reviewed and merged into `develop`: - [#2352](#2352) asserts that `hub-fetch-run.py`'s fallback fetch uses the `main` path. - [#2355](#2355) tolerates a per-field `workflowRun` error in `pr_review.py`, keying unreadable Actions runs per suite so no failure is hidden. - [#2356](#2356) reads the `comments` label live in the validate task's lint job rather than off the event payload, on public repositories, with private repositories following in #2354. - [#2359](#2359) reads composite-action files through PyYAML under `uvx`, in isolated mode, where PyYAML is not importable, replacing the unprovisioned `yq` fallback. Closes #2339 Closes #2338 Closes #1703 Closes #2348 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The repo gate's
composite-actionscheck read action files with PyYAML and fell back toyq, which nothing provisions, so a host with neither reported every action as unreadable.uvx --with pyyamlprobe per run.uvis already a declared host tool and runs the schema half. The parser is therefore PyYAML on every host.run,shell, andname), so aliases elsewhere in a file are never expanded.scripts/README.mdstates the tools each half needs.Tests cover the probe-once path, each host-level failure, the direct-child timeout, alias and non-UTF-8 inputs, and label parity. Each fix was reverted once to confirm its test fails.
Follow-ups: #2357 (the in-process path can hang on an alias-expanded step name or shell, pre-existing) and #2358 (under
UV_NO_CACHEthe host finding names the vanished temp path rather than the cause).Addresses #2348
🤖 Generated with Claude Code