Repository navigation
fix(OMN-10732): remove silent env fallbacks in omnibase_infra src/ and wire validator gate - #1543
Merged
Merged
Conversation
…d wire validator gate Fix 6 src/ violations: replace os.environ.get(KEY, "localhost/url") with fail-fast os.environ[KEY]; annotate 7 approved 127.0.0.1 bind-address defaults with # fallback-ok. - model_postgres_pool_config.py: POSTGRES_HOST default_factory → os.environ["POSTGRES_HOST"]; from_dsn() raises ValueError on missing hostname instead of silently using localhost - backend_probe.py: PGHOST fallback → os.environ["PGHOST"] - agent_learning_extraction/config.py: hardcoded LLM URL → os.environ["LLM_CODER_FAST_URL"] - model_infisical_config.py + model_infisical_handler_config.py: Infisical URL → os.environ["INFISICAL_ADDR"] - 7 health/metrics bind-address 127.0.0.1 defaults annotated # fallback-ok (security rationale) - validate_no_env_fallbacks.py: skip lines annotated # fallback-ok - Wire validator into pre-commit (no-env-localhost-fallback) and CI as required check - Update tests: replace fallback-expectation with fail-fast assertions
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (17)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
enabled auto-merge (squash)
May 9, 2026 15:36
jonahgabriel
added a commit
that referenced
this pull request
May 9, 2026
…rseded by no-env-fallbacks) The no-env-localhost-fallback hook was added by OMN-10732 (#1543 merge into main). The canonical no-env-fallbacks hook from this PR is a superset — remove the duplicate.
jonahgabriel
added a commit
that referenced
this pull request
May 9, 2026
… types (#1544) * feat(OMN-10741): unified validate_no_env_fallbacks.py covering all 6 pattern types Replaces the 4 divergent per-repo scripts with a single canonical implementation that covers all patterns from the OMN-10658 enforcement sweep: - os.environ.get("X", "localhost...") - os.getenv("X", "localhost...") - default="localhost..." (Pydantic Field / function param) - ${VAR:-localhost} (shell scripts) - Hardcoded 192.168.* IPs as default values - 127.0.0.1 bind addresses as default values Supports # fallback-ok: <reason> annotation to exempt justified lines. Wired as pre-commit hook (no-env-fallbacks) in pass_filenames mode so it only scans staged files, allowing phased cleanup of pre-existing violations. Includes 30 unit tests covering all patterns, exemption markers, docstring skipping, and the run() / run_on_files() entry points. * chore(OMN-10741): trigger CI re-run after Evidence-Source added to PR body * chore(OMN-10741): fix Evidence-Source format to OCC#870 * chore(OMN-10741): add Evidence-Ticket line to satisfy gate * fix(OMN-10741): remove duplicate no-env-localhost-fallback hook (superseded by no-env-fallbacks) The no-env-localhost-fallback hook was added by OMN-10732 (#1543 merge into main). The canonical no-env-fallbacks hook from this PR is a superset — remove the duplicate. * fix(OMN-10741): address fallback validator review * fix(OMN-10741): annotate justified fallback exceptions * test(OMN-10741): cover fallback validator integration * fix(OMN-10741): add deploy gate contract --------- Co-authored-by: jonahgabriel <jonahgabriel@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-10732
Fixes all 6 src/ silent fallback violations and annotates the 7 approved 127.0.0.1 bind-address defaults. Wires the existing validator into pre-commit and CI as a required gate.
Changes
src/ violations fixed (fail-fast):
runtime/models/model_postgres_pool_config.py:30— POSTGRES_HOST default_factory → os.environ["POSTGRES_HOST"]runtime/models/model_postgres_pool_config.py:222— from_dsn() raises ValueError on missing hostname instead of silently falling back to localhostbackends/backend_probe.py:194— PGHOST fallback → os.environ["PGHOST"]services/agent_learning_extraction/config.py:34— hardcoded http://localhost:8001 → os.environ["LLM_CODER_FAST_URL"]adapters/models/model_infisical_config.py:35— https://app.infisical.com → os.environ["INFISICAL_ADDR"]handlers/models/infisical/model_infisical_handler_config.py:39— same127.0.0.1 bind-address defaults annotated fallback-ok (7 fields across health/metrics servers): bind 127.0.0.1 by default to prevent unauthenticated network exposure; override via env var for cluster deployments.
Validator + hook wiring:
Tests updated:
OCC Evidence
Contract and DoD receipts in onex_change_control PR #873 (jonah/omn-10732-occ-contract):
dod_evidence