fix(operations): harden maintainer readiness evidence output - #477
Conversation
|
Warning Review limit reached
Next review available in: 11 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| assertAcquisitionPrivatePathParents(absolutePath); | ||
| mkdirSync(dirname(absolutePath), { recursive: true }); | ||
| writeFileSync(absolutePath, `${JSON.stringify(report, null, 2)}\n`, "utf8"); | ||
| writeAcquisitionPrivateFile(absolutePath, `${JSON.stringify(report, null, 2)}\n`); |
There was a problem hiding this comment.
📝 Info: Parent validation rejects symlinked ancestors up to root
writeReport validates every existing parent up to the filesystem root before writing (assertAcquisitionPrivatePathParents at scripts/lib/acquisition-private-output.mjs:78-87). Missing dirs are tolerated, so recursive mkdir still works. On macOS tmpdir() resolves under /var, a symlink to /private/var, which this walk would reject. CI is Linux so no regression here, only relevant to local runs.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Scope
Harden the buyer/operator-facing Maintainer App readiness evidence writer against symbolic-link leaf and parent traversal without changing GitHub App authority, governance evaluation, or readiness semantics.
TDD state
RED commit
e6c7e97c2d0789650c1c496401a580dea6642d2badds realistic public-entrypoint regressions: a collection-failure report must not overwrite a pre-existing symlink target, and must not create evidence through a symlinked report parent. Current productionwriteReport()uses recursive mkdir plus pathnamewriteFileSync, so these tests are expected to fail until the production writer is repaired.Intended minimal repair
Reuse Noema's existing no-follow, single-link, identity-checked, atomic private evidence writer. Validate existing parent components before recursive directory creation, then write through the hardened writer which revalidates parents and the leaf immediately before mutation.
Draft until the RED is observed, the smallest production fix is applied, and exact-head Application/reviewer/Security evidence is terminal-success.