Skip to content

test(review): document the last unreachable review-evasion coverage branch - #3476

Merged
JSONbored merged 3 commits into
mainfrom
claude/review-evasion-coverage-followup
Jul 5, 2026
Merged

test(review): document the last unreachable review-evasion coverage branch#3476
JSONbored merged 3 commits into
mainfrom
claude/review-evasion-coverage-followup

Conversation

@JSONbored

@JSONbored JSONbored commented Jul 5, 2026

Copy link
Copy Markdown
Owner

Summary

  • Small follow-up to feat(review): add review-evasion protection #3414 (review-evasion protection). Adds a /* v8 ignore next */ annotation with an explanatory comment on the one remaining defensive fallback branch in closeReviewEvasionSelfCloseIfActive: closeError instanceof Error ? closeError : new Error(errorMessage(closeError)).
  • closePullRequest's only failure path is Octokit's request() call, which always rejects with a RequestError (an Error subclass) -- the new Error(...) normalization arm is a type-safety fallback for the unknown-typed catch, not a reachable runtime path. Documents that explicitly rather than leaving it silently uncovered.
  • No functional change.
  • Follow-up within this same PR: the ignore was initially placed on the whole ternary throw, which could have suppressed coverage for the REACHABLE closeError instanceof Error rethrow path too. Rewrote it as an if block (if (closeError instanceof Error) throw closeError;) with /* v8 ignore else */ scoping the ignore to only the unreachable non-Error fallback, so the reachable rethrow stays fully subject to coverage.

No issue because this is a maintenance-only coverage annotation (chore): a one-line v8 ignore comment tightening patch coverage on an already-merged PR (#3414), with no functional or behavioral change to review against.

Scope

  • The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
  • This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
  • This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
  • I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

  • git diff --check
  • npm run actionlint (n/a -- no workflow changes)
  • npm run typecheck
  • npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
  • npm run test:workers (n/a -- no workers-pool test changes)
  • npm run build:mcp (n/a -- no MCP package changes)
  • npm run test:mcp-pack (n/a -- no MCP package changes)
  • npm run ui:openapi:check (n/a -- no OpenAPI/schema changes)
  • npm run ui:lint (n/a -- no UI changes)
  • npm run ui:typecheck (n/a -- no UI changes)
  • npm run ui:build (n/a -- no UI changes)
  • npm audit --audit-level=moderate
  • New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries (n/a -- a comment-only coverage annotation, no new behavior; existing review-evasion tests in test/unit/queue.test.ts re-run clean)

If any required check was skipped, explain why:

  • This is a single-line comment addition inside one already-tested file (src/queue/processors.ts); the workers/mcp/ui suites are unaffected by a comment change, so only typecheck and the affected test file (test/unit/queue.test.ts, review-evasion suite) were re-run directly, per this repo's usual scoped-validation practice for small follow-ups.

Safety

  • No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
  • Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
  • Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (n/a)
  • API/OpenAPI/MCP behavior is updated and tested where needed. (n/a)
  • UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (n/a -- no UI changes)
  • Visible UI changes include a UI Evidence section below with screenshots. (n/a -- no visible UI)
  • Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (n/a -- comment-only)

…ranch

closePullRequest's only failure path is Octokit's request() call, which
always rejects with a RequestError (an Error subclass) -- the
`: new Error(...)` normalization branch is a type-safety fallback for
the unknown-typed catch, not a reachable runtime path.

Closes out patch coverage on the review-evasion protection PR: 100%
line/branch across all 10 changed files.
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@JSONbored JSONbored self-assigned this Jul 5, 2026
@loopover-orb loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 5, 2026
@loopover-orb

loopover-orb Bot commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

Review updated: 2026-07-05 09:53:28 UTC

1 file · 1 AI reviewer · 2 blockers · readiness 100/100 · CI pending · blocked

⏸️ Suggested Action - Manual Review

  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
  • Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This change is non-functional at runtime, but it changes coverage accounting in a hot queue path and the annotation is broader than the PR claims. The explanatory comment is useful, but the PR also explicitly lacks the issue link this repo requires for external contributor changes.

Blockers

  • src/queue/processors.ts:10656 suppresses coverage on the whole `throw closeError instanceof Error ? closeError : new Error(...)` statement, so the reachable `Error` propagation path is hidden along with the unreachable fallback; move the ignore to only the fallback expression or restructure the branch so the real path remains measured.
  • PR test(review): document the last unreachable review-evasion coverage branch #3476 does not close or clearly link an eligible open issue, which violates this repo's contributor PR policy; link the maintainer-authorized issue or have a maintainer explicitly confirm this exception.
Nits — 3 non-blocking
  • src/queue/processors.ts:10656: prefer an explicit branch so the coverage ignore can attach only to the unreachable normalization arm, for example `if (closeError instanceof Error) throw closeError; /* v8 ignore next */ throw new Error(errorMessage(closeError));`.
  • PR description: add the eligible issue reference or maintainer exception directly in the summary so the scope decision is auditable.
  • Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Concerns raised — review before merging

  • No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
  • Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.
Signal Result Evidence
Code review ❌ 2 blockers 1 reviewer
Linked issue ✅ No-issue rationale PR body explains why no issue is linked.
Related work ✅ No active overlap found No same-issue or scoped active PR overlap found.
Change scope ✅ 20/20 Low review scope from cached public metadata (no linked issue context).
Validation posture ✅ 25/25 PR body includes validation/test evidence.
Contributor workload ✅ 10/10 Author activity: 56 registered-repo PR(s), 46 merged, 586 issue(s).
Contributor context ✅ Confirmed Gittensor contributor JSONbored; Gittensor profile; 56 PR(s), 586 issue(s).
Gate result ❌ Blocking Repo-configured hard blocker found.
Review context
  • Author: JSONbored
  • Role context: owner (maintainer lane)
  • Public audience mode: oss maintainer
  • Lane context: Repository registration is not available in the local Gittensory cache.
  • Public profile languages: not available
  • Official Gittensor activity: 56 PR(s), 586 issue(s).
  • PR-specific overlap: none found.
Contributor next steps
  • Treat this as maintainer-lane context rather than normal contributor-lane activity.
  • No action.
  • Link the issue being solved, or explicitly explain why this is a no-issue PR.
Signal definitions
  • Related work = same linked issue, overlapping active PRs, or title/path similarity.
  • Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
  • Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
  • Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
  • Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed


💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

  • Re-run Gittensory review

@codecov

codecov Bot commented Jul 5, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.03%. Comparing base (a979552) to head (bc0168e).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3476   +/-   ##
=======================================
  Coverage   93.03%   93.03%           
=======================================
  Files         298      298           
  Lines       31203    31203           
  Branches    11386    11386           
=======================================
+ Hits        29029    29030    +1     
  Misses       1518     1518           
+ Partials      656      655    -1     
Files with missing lines Coverage Δ
src/queue/processors.ts 93.42% <100.00%> (+0.03%) ⬆️
🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

JSONbored added 2 commits July 5, 2026 02:26
…ranch

Adds a v8-ignore annotation for the defensive non-Error normalization
arm in closeReviewEvasionSelfCloseIfActive's re-close-failure path.
closePullRequest's only failure mode is Octokit's request() call,
which always rejects with a RequestError (an Error subclass), never a
raw thrown value -- the normalization exists only to satisfy the
unknown-typed catch's type signature.

Split the ternary into an if block with the ignore scoped to only the
unreachable else/fallback, so the reachable Error rethrow path stays
fully subject to coverage. No functional change.
…hrow

Names the specific existing regression test that exercises the
`closeError instanceof Error` rethrow in closeReviewEvasionSelfCloseIfActive,
so the branch-coverage annotation's claim is directly verifiable rather
than asserted. No functional change.
@JSONbored
JSONbored merged commit 29319d4 into main Jul 5, 2026
7 checks passed
@JSONbored
JSONbored deleted the claude/review-evasion-coverage-followup branch July 5, 2026 09:58
JSONbored added a commit that referenced this pull request Jul 5, 2026
…view freeze (#3490)

The maintainer-gated freeze (#3461) reused the last published AI
review for any PR carrying the manual-review label, with no author
exemption. Confirmed live on PR #3476: pushing genuine follow-up
commits to the owner's own held PR kept replaying the ORIGINAL,
now-stale AI verdict instead of evaluating the new commits, because
github_app.ai_review_frozen_reuse fired on every push. The anti-gaming
concern the freeze exists for is specific to a contributor iterating
pushes against the bot; it never applies to the repo owner, an
ADMIN_GITHUB_LOGINS fleet operator, or a protected automation bot,
matching the exemption this codebase already grants those authors
everywhere else (auto-close, review-nag, contributor caps).

Root-caused via the live audit_events trail on the self-host VPS,
which showed ai_review_frozen_reuse firing on every one of #3476's
own follow-up commits despite the PR being owner-authored.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. manual-review Gittensor contributor context

Development

Successfully merging this pull request may close these issues.

1 participant