Repository navigation
Wave 8: second secrets scanner, sharded perpr, scanner egress opt-outs, JS date and GCM rules, fixture label, affected-run gates - #2151
Merged
Conversation
…s, JS date and GCM rules, fixture label, affected-run gates Review hub: - review_checks.sh runs trufflehog as a second offline secrets step right after gitleaks (SARIF output only, so no secret value is read, printed or stored). A failed 200-file call is retried file by file, the retry stops after 3 failures while no file has passed, and the gitleaks template's skip paths apply when the repo has no .gitleaks.toml. provision_tools.sh installs it. - trivy, grype and checkov reached a host from the hub even offline (trivy telemetry, grype's and checkov's own version checks). The hub now sets TRIVY_DISABLE_TELEMETRY=true, GRYPE_CHECK_FOR_APP_UPDATE=false and CKV_SKIP_PACKAGE_UPDATE_CHECK=true. They are environment variables, not flags, so older tool versions ignore them. - Two bundled semgrep rules for JavaScript and TypeScript: a date accepted only because an inline isNaN/isFinite check of Date.parse or new Date passed (V8 reads 2026-02-30 as 2 March), and createDecipheriv with a GCM cipher and no authTagLength. The date rule reports only inline checks: 23 true positives in 30 distinct hits on the measured sample, up from 23 in 34. - committed_personal_data.py rows end with fixture signals (placeholder-style local parts, reserved domains) and a "likely fixture" label for test paths. Counts only, no row dropped. On the audit rows it labels 4 of 30 fixture rows, 0 of 8 real-data rows and 0 of 33 rows of a known real export. - app_pentest.sh --openapi reads the spec URL under a 10 s deadline for the whole read, and errored schemathesis operations become a low lead. Delivery: - CI's perpr job runs as three parallel legs (scripts/ci-tests-shard.sh, the slicing the selftests job already uses). The legs are disjoint and cover every registration. The serial job took 19.1 minutes in the last measured run. - run-ci-tests.sh --affected always runs the cheap job's three whole-tree gates first, so a violation that no ci-test names fails in seconds locally instead of in CI. - parity_differ: the focus_gate loader registers the module before running it (dataclasses failed to build on Python 3.12 and 3.14), and the owner accept-file call passes the owner list instead of a tuple and an unknown keyword. - Guard-rail register (refs #1592): each of the 42 guard and hook scripts carries one `# rail: owner=<skill or role>, why=<one clause>, review=YYYY-MM-DD` line. `ci-gates.sh rails` fails on a rail with no line, an empty field or a bad date, so a new guard cannot land unowned, and `--audit` lists the rails past their review date for the owner to confirm or retire. It never removes one. No firing counts are printed, because no firing log is shared yet. scripts/test-rails.sh: 46 cases, all red without the subcommand. size-budget-raise: .claude/skills/deep-code-review/references/method-situational.md 44018→44231 the analyzer list names the trufflehog step and the committed-data fixture signals size-budget-raise: .claude/skills/deep-code-review/references/app-pentest.md 6344→6393 the spec read deadline and the errored-operations lead size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 8731→10152 the trufflehog step, its retry and noise rules, and the three scanner egress opt-outs Tests: 114/115 affected suites pass (run-ci-tests.sh --affected, 115 of 280 tests selected, on 6ff901b47). scripts/test-ci-gates.sh failed its awk-v-ok lint on the new shard script; one comment fixes it. Re-run on this head: 303 pass, 8 fail, 2 skipped; the 8 are the checks that need process inspection or timing this sandbox blocks, the same set as on earlier waves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 8: twelve lanes in one squashed commit. The commit message has the detail for each item.
What changes
isNaN(Date.parse(…)), and GCMcreateDecipherivwithoutauthTagLength.app_pentest.sh --openapireads the spec under a 10 s deadline.run-ci-tests.sh --affectedruns the cheap job's whole-tree gates first.ci-gates.sh railsenforces it.Verification
--affected: 114 of 115 suites pass.test-ci-gates.shcaught an un-annotatedawk -vin the new shard script, fixed here; the re-run passes 303 checks, and its 8 failures are the sandbox-only set that failed before this change too.🤖 Generated with Claude Code