fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path - #201
Conversation
…ion pin comment, re-key a stale audit path
Four independent hygiene fixes, each measured rather than assumed.
**ClusterFuzzLite batch fuzzing has failed every week since at least
2026-06-07** (06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26).
It is `schedule:`-triggered, so it never appeared on the main-branch
push board and the 2026-07-21 sweep — which measured push-on-main only
— did not see it. The `address` leg passes; the `undefined` leg dies at
"Build Fuzzers (undefined)" with:
cargo fuzz build --release --sanitizer=undefined fuzz_octad_id
error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
[possible values: address, leak, memory, thread, none]
cargo-fuzz has no UBSan option, so this combination can never work for a
Rust project. `cflite_pr.yml` was already corrected to `[address]`; the
batch variant was missed. Dropping `undefined` is the honest fix —
`thread`/`leak` are valid for Rust and can be added deliberately later.
**The CodeQL pin comment was wrong by two major versions.** The pinned
SHA e4fba868 is real and is upstream tag **v4.37.3**, but both `uses:`
lines annotated it `# v3.28.1`. A pin comment that misstates the version
defeats the audit purpose of SHA pinning, since reviewers read the
comment, not the hash.
Note for the record: an unpushed local commit proposed re-pinning these
to 29b1f65c1f735799893313399435a59f54045865. That SHA **does not exist**
in github/codeql-action (the API returns 422), so it was dropped rather
than salvaged.
**A stale audit key was re-firing the only High-severity finding in the
scan.** `audits/assail-classifications.a2ml` keyed
`connectors/clients/rescript/src/VeriSimVql.res`; the VCL rename moved
that file to `VeriSimVcl.res` and the classification never followed, so
its `UnsafeDeserialization` finding was unsuppressed. Every classification
key in the file now resolves to an existing path.
**push-email-notify.yml removed** per the estate ruling that retains
push-email only in 007, robodog-defensive-systems-lab and
defensive-multiplicity. It was already `disabled_manually` and no
variable or secret references it.
Also adds local-noise entries to `.gitignore` (db files, caches, agent
worktrees, export/build outputs). Deliberately does **not** ignore
`.editorconfig`: it is tracked, annotated in `REUSE.toml`, and checked
by the governance `quality` job's editorconfig-checker.
Verified: `reuse lint` 775/775 compliant, zero unused licences;
`tests/doc-consonance-gate.sh` passes; both edited workflows parse as
YAML. The one `validate-a2ml.sh` error on this file is **pre-existing on
origin/main** — byte-identical output with and without this change.
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedFixes the ClusterFuzzLite UBSan failure, corrects CodeQL pin version comments, re-keys the stale audit path, and removes the deprecated push-email workflow. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
Measured impact of the classification re-keyScanned a pristine Before this PR —
The single live High is: It is live only because the classification key still says After this PR's one-word change: So the repo goes to zero live High and zero live Critical. Nothing is being Worth noting for sequencing: this is what makes a real severity gate adoptable |
fix(ci): green the 8-week ClusterFuzzLite red, correct a 2-major-version pin comment, re-key a stale audit path
Four independent hygiene fixes, each measured rather than assumed.
ClusterFuzzLite batch fuzzing has failed every week since at least
2026-06-07 (06-07, 06-14, 06-21, 06-28, 07-05, 07-12, 07-19, 07-26).
It is
schedule:-triggered, so it never appeared on the main-branchpush board and the 2026-07-21 sweep — which measured push-on-main only
— did not see it. The
addressleg passes; theundefinedleg dies at"Build Fuzzers (undefined)" with:
cargo-fuzz has no UBSan option, so this combination can never work for a
Rust project.
cflite_pr.ymlwas already corrected to[address]; thebatch variant was missed. Dropping
undefinedis the honest fix —thread/leakare valid for Rust and can be added deliberately later.The CodeQL pin comment was wrong by two major versions. The pinned
SHA e4fba868 is real and is upstream tag v4.37.3, but both
uses:lines annotated it
# v3.28.1. A pin comment that misstates the versiondefeats the audit purpose of SHA pinning, since reviewers read the
comment, not the hash.
Note for the record: an unpushed local commit proposed re-pinning these
to 29b1f65c1f735799893313399435a59f54045865. That SHA does not exist
in github/codeql-action (the API returns 422), so it was dropped rather
than salvaged.
A stale audit key was re-firing the only High-severity finding in the
scan.
audits/assail-classifications.a2mlkeyedconnectors/clients/rescript/src/VeriSimVql.res; the VCL rename movedthat file to
VeriSimVcl.resand the classification never followed, soits
UnsafeDeserializationfinding was unsuppressed. Every classificationkey in the file now resolves to an existing path.
push-email-notify.yml removed per the estate ruling that retains
push-email only in 007, robodog-defensive-systems-lab and
defensive-multiplicity. It was already
disabled_manuallyand novariable or secret references it.
Also adds local-noise entries to
.gitignore(db files, caches, agentworktrees, export/build outputs). Deliberately does not ignore
.editorconfig: it is tracked, annotated inREUSE.toml, and checkedby the governance
qualityjob's editorconfig-checker.Verified:
reuse lint775/775 compliant, zero unused licences;tests/doc-consonance-gate.shpasses; both edited workflows parse asYAML. The one
validate-a2ml.sherror on this file is pre-existing onorigin/main — byte-identical output with and without this change.