[ci] Audit live CI inputs against policy - #3578
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## Gt4itljw3xh6tci2mjqj4z245i6pwle2i #3578 +/- ##
==================================================================
Coverage 91.85% 91.85%
==================================================================
Files 20 20
Lines 6093 6093
==================================================================
Hits 5597 5597
Misses 496 496 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5070ce31b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
5070ce3 to
fac6e43
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
4864e15 to
b49d72d
Compare
fac6e43 to
77f85fe
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 77f85fe605
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
77f85fe to
fded6e0
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head. Treat earlier reviews of older commits as stale. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
fded6e0 to
97b518e
Compare
55a8694 to
8da94d7
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
8da94d7 to
e19d827
Compare
97b518e to
12e15aa
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12e15aa10e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
e19d827 to
5488531
Compare
12e15aa to
1efd245
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1efd245312
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
5488531 to
da7ad19
Compare
1efd245 to
205aa5e
Compare
|
Authored by an agent, posting via joshlf's account @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 205aa5e0fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Collect repository packages, resolved dependencies, features, and Cargo targets with locked, offline Cargo metadata, then validate every policy reference against the live checkout before planning work. Disable rustup's automatic toolchain installation separately because Cargo cannot apply `--offline` until after the rustup proxy has selected a toolchain. Retain Cargo's complete PackageId dependency graph instead of collapsing packages by name. Validate semantic toolchains against every reachable resolved package, including external transitive dependencies, while retaining conservative declared workspace edges. Name external packages as name@version in diagnostics so duplicate package names stay distinct. Derive the stable feature closure and its nightly-only complement from Cargo's complete feature graph. Follow plain and strong optional- dependency edges according to Cargo semantics while leaving `dep:` and weak edges non-activating. Reject an all-features profile on a non-nightly toolchain whenever the selected package has a nonempty nightly complement. Future feature changes therefore fail the audit instead of silently moving nightly-only coverage onto stable. Require an explicit no-default profile if a future manifest introduces default features. Accept Rust's two-component and dotted target names without assuming every target is a three-part triple. Validate each Cargo target's exact kind and crate-type pairing so representation drift cannot silently change which artifact CI exercises. Preflight the supported .cargo/config.toml shape before invoking Cargo. Reject unreviewed top-level mechanisms and the legacy .cargo/config name, which Cargo gives precedence even when config.toml is present. Follow every declared source-replacement chain. Reject missing, ambiguous, or cyclic endpoints. Require each terminal directory source to use a local relative spelling and resolve to a directory inside the checkout. Canonicalize trusted manifests, Cargo targets, configured directory sources, and baseline paths before using them. Reject symbolic links which leave the checkout, require every resolved manifest and target to remain inside it, and distinguish missing baseline inputs from other file-system errors. For semantic non-nightly toolchains, compare the compiler version with the declared MSRV of every reachable package. Cargo metadata normalizes a two-component package MSRV before this exact semantic comparison; raw toolchain metadata remains canonical and exact. A dated nightly remains deliberately incomparable with stable release numbers. Fail when packages, target kinds, crate types, examples, required features, baseline paths, or toolchain sources escape classification. Also validate the narrower line-oriented Cargo.toml grammar consumed by build.rs. This keeps valid TOML formatting changes from silently breaking the build script's separate parser. Keep all collected data deterministic and report independent inventory errors together. Cargo metadata remains authoritative; this layer checks coordination without copying its package or feature lists into policy. Tests: focused feature, target, graph, version, configuration, path-containment, live-audit, and mutation tests. *Authored by an agent, posting via joshlf's account* gherrit-pr-id: Gocqawbn3p3zj7xyfo7etk6vo4633r3tn
da7ad19 to
d6bc5ea
Compare
205aa5e to
467e8ab
Compare
|
Authored by an agent, posting via joshlf's account @codex review Please review the current head, |
2 participants
Collect repository packages, resolved dependencies, features, and Cargo
targets with locked, offline Cargo metadata, then validate every policy
reference against the live checkout before planning work. Disable
rustup's automatic toolchain installation separately because Cargo
cannot apply
--offlineuntil after the rustup proxy has selected atoolchain.
Retain Cargo's complete PackageId dependency graph instead of collapsing
packages by name. Validate semantic toolchains against every reachable
resolved package, including external transitive dependencies, while
retaining conservative declared workspace edges. Name external packages
as name@version in diagnostics so duplicate package names stay distinct.
Derive the stable feature closure and its nightly-only complement from
Cargo's complete feature graph. Follow plain and strong optional-
dependency edges according to Cargo semantics while leaving
dep:andweak edges non-activating. Reject an all-features profile on a
non-nightly toolchain whenever the selected package has a nonempty
nightly complement. Future feature changes therefore fail the audit
instead of silently moving nightly-only coverage onto stable.
Require an explicit no-default profile if a future manifest introduces
default features. Accept Rust's two-component and dotted target names
without assuming every target is a three-part triple. Validate each
Cargo target's exact kind and crate-type pairing so representation drift
cannot silently change which artifact CI exercises.
Preflight the supported .cargo/config.toml shape before invoking Cargo.
Reject unreviewed top-level mechanisms and the legacy .cargo/config
name, which Cargo gives precedence even when config.toml is present.
Follow every declared source-replacement chain. Reject missing,
ambiguous, or cyclic endpoints. Require each terminal directory source
to use a local relative spelling and resolve to a directory inside the
checkout.
Canonicalize trusted manifests, Cargo targets, configured directory
sources, and baseline paths before using them. Reject symbolic links
which leave the checkout, require every resolved manifest and target to
remain inside it, and distinguish missing baseline inputs from other
file-system errors.
For semantic non-nightly toolchains, compare the compiler version with
the declared MSRV of every reachable package. Cargo metadata normalizes
a two-component package MSRV before this exact semantic comparison; raw
toolchain metadata remains canonical and exact. A dated nightly remains
deliberately incomparable with stable release numbers.
Fail when packages, target kinds, crate types, examples, required
features, baseline paths, or toolchain sources escape classification.
Also validate the narrower line-oriented Cargo.toml grammar consumed by
build.rs. This keeps valid TOML formatting changes from silently
breaking the build script's separate parser.
Keep all collected data deterministic and report independent inventory
errors together. Cargo metadata remains authoritative; this layer checks
coordination without copying its package or feature lists into policy.
Tests: focused feature, target, graph, version, configuration,
path-containment, live-audit, and mutation tests.
Authored by an agent, posting via joshlf's account
Latest Update: v16 — Compare vs v15
📚 Full Patch History
Links show the diff between the row version and the column version.
⬇️ Download this PR
Branch
git fetch origin refs/heads/Gocqawbn3p3zj7xyfo7etk6vo4633r3tn && git checkout -b pr-Gocqawbn3p3zj7xyfo7etk6vo4633r3tn FETCH_HEADCheckout
git fetch origin refs/heads/Gocqawbn3p3zj7xyfo7etk6vo4633r3tn && git checkout FETCH_HEADCherry Pick
git fetch origin refs/heads/Gocqawbn3p3zj7xyfo7etk6vo4633r3tn && git cherry-pick FETCH_HEADPull
Stacked PRs enabled by GHerrit.