feat(pages): community conformance homepage for all SDK conformance - #556
feat(pages): community conformance homepage for all SDK conformance#556arkavo-com wants to merge 4 commits into
Conversation
…#2) Community Stage-1: python, rust, and swift ↔ go@latest (Base TDF), floating release pins, native macOS platform for OpenTDFKit, and reporting/Pages. Verified green Community X-Test (python + rust@0.14.0 + swift@4.0.0).
With python, rust (0.14.0), and swift (4.0.0) all Stage-1 kas-ready, enable community×community encrypt/decrypt: - stage2-python-rust (ubuntu): python ↔ rust - stage2-swift-peers (macos): python ↔ rust ↔ swift - workflow_dispatch stage=all|1|2 filter - Capstone requires both stages (skipped allowed when filtered) - Docs: Stage-2 acceptance + local recipes
OpenTDFKit Package.swift requires swift-tools-version 6.2. macos-latest runners sometimes ship 6.1, which fails stage2 builds while stage1 can pass on a different host. Match OpenTDFKit CI (setup-xcode latest-stable).
The Pages site previously consumed only the python artifact and rendered a bare two-table page. Rebuild it as a proper conformance homepage: - generate_site.py: aggregate every community artifact into per-SDK scorecards, an encrypt×decrypt interop matrix parsed from junit test ids, and a capability matrix listing all SDKs (python/rust/swift/go), with provenance (source run, platform ref, go peer) and an enriched summary.json. Self-contained HTML, light/dark, defusedxml for parsing. - export_supports.py: capability snapshot extracted from the YAML heredoc and parameterized; now exported for python, rust, swift, and the go reference peer so every column has data. - community-pages.yml: download all community-*stage* artifacts from the source run, pass run provenance, pin Pages actions by SHA, add timeouts. - community-xtest.yml: set -o pipefail on the three piped pytest steps — `pytest | tee` was swallowing failures (latest run reported green with 3 failing python tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dvm7uKaNssz7ztu3nAmf7u
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (37)
📝 WalkthroughWalkthroughThis PR adds community SDK conformance workflows for Python, Rust, and Swift, native macOS platform startup, capability/reporting Pages, SDK CLI packaging, canonical ChangesCommunity conformance infrastructure
Harness and SDK integration
Documentation and repository configuration
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested reviewers: Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Opened against the wrong base repo (this is arkavo-org fork work) — apologies for the noise. Re-filed on arkavo-org/opentdf-tests. |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a community SDK conformance tier to the OpenTDF cross-client integration test suite (xtest), adding support for Python, Rust, and Swift community SDKs. It includes new documentation, a native macOS startup action, reporting scripts to generate a conformance dashboard, and updates to use canonical container profiles (tdf and tdf-ecwrap) instead of legacy aliases. The reviewer identified several critical issues: a Python 3 syntax error and unhandled exception risks in the site generation script, a potential JSON generation bug in the Python CLI wrapper, and a Cross-Site Scripting (XSS) vulnerability in the dashboard's HTML template.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| try: | ||
| snap = json.loads(supports.read_text()) | ||
| except json.JSONDecodeError, OSError: | ||
| continue | ||
| sdk = snap.get("sdk") | ||
| if isinstance(sdk, str) and sdk: | ||
| report.snapshots[sdk] = snap |
There was a problem hiding this comment.
In Python 3, catching multiple exceptions using a comma (except json.JSONDecodeError, OSError:) is a SyntaxError. It must be written as a tuple: except (json.JSONDecodeError, OSError):.
Additionally, json.loads can return non-dictionary types (like lists or strings). If snap is not a dictionary, calling snap.get("sdk") will raise an AttributeError and crash the script. This suggestion fixes both issues by using a tuple for the exceptions and defensively checking if snap is a dictionary.
| try: | |
| snap = json.loads(supports.read_text()) | |
| except json.JSONDecodeError, OSError: | |
| continue | |
| sdk = snap.get("sdk") | |
| if isinstance(sdk, str) and sdk: | |
| report.snapshots[sdk] = snap | |
| try: | |
| snap = json.loads(supports.read_text()) | |
| if isinstance(snap, dict): | |
| sdk = snap.get("sdk") | |
| if isinstance(sdk, str) and sdk: | |
| report.snapshots[sdk] = snap | |
| except (json.JSONDecodeError, OSError): | |
| continue |
| try: | ||
| tree = _safe_xml_parse(junit) | ||
| except ET.ParseError: | ||
| continue |
There was a problem hiding this comment.
_safe_xml_parse (from defusedxml) can raise security-related exceptions such as defusedxml.EntitiesForbidden or defusedxml.ExternalReferenceForbidden when encountering forbidden XML structures. These exceptions do not inherit from xml.etree.ElementTree.ParseError, so they will not be caught here, causing the script to crash. Catching Exception ensures the generator safely skips any malformed or malicious XML files.
try:
tree = _safe_xml_parse(junit)
except Exception:
continue| if [[ -n "${CLIENTID:-}" && -n "${CLIENTSECRET:-}" ]]; then | ||
| _creds_file=$(mktemp) | ||
| # shellcheck disable=SC2064 | ||
| trap 'rm -f "${_creds_file:-}"' EXIT | ||
| printf '{"clientId":"%s","clientSecret":"%s"}\n' "$CLIENTID" "$CLIENTSECRET" >"$_creds_file" | ||
| parent_args+=(--with-client-creds-file "$_creds_file") | ||
| fi |
There was a problem hiding this comment.
Constructing JSON using printf with direct string substitution can produce invalid JSON or corrupted values if CLIENTID or CLIENTSECRET contains special characters (such as " or \). Since jq is guaranteed to be available in the environment, use it to safely construct the JSON credentials file.
| if [[ -n "${CLIENTID:-}" && -n "${CLIENTSECRET:-}" ]]; then | |
| _creds_file=$(mktemp) | |
| # shellcheck disable=SC2064 | |
| trap 'rm -f "${_creds_file:-}"' EXIT | |
| printf '{"clientId":"%s","clientSecret":"%s"}\n' "$CLIENTID" "$CLIENTSECRET" >"$_creds_file" | |
| parent_args+=(--with-client-creds-file "$_creds_file") | |
| fi | |
| if [[ -n "${CLIENTID:-}" && -n "${CLIENTSECRET:-}" ]]; then | |
| _creds_file=$(mktemp) | |
| # shellcheck disable=SC2064 | |
| trap 'rm -f "${_creds_file:-}"' EXIT | |
| jq -n --arg id "$CLIENTID" --arg secret "$CLIENTSECRET" '{"clientId": $id, "clientSecret": $secret}' >"$_creds_file" | |
| parent_args+=(--with-client-creds-file "$_creds_file") | |
| fi |
| function cell(v) { | ||
| if (v === "supported") return '<span class="pill ok">supported</span>'; | ||
| if (v === "unsupported") return '<span class="pill fail">unsupported</span>'; | ||
| return '<span class="pill na">' + (v || "—") + '</span>'; | ||
| } |
There was a problem hiding this comment.
Directly concatenating v into the HTML string can lead to Cross-Site Scripting (XSS) or broken page layouts if summary.json contains unexpected characters or is manipulated. Escaping the HTML characters in v ensures the page remains secure and robust.
| function cell(v) { | |
| if (v === "supported") return '<span class="pill ok">supported</span>'; | |
| if (v === "unsupported") return '<span class="pill fail">unsupported</span>'; | |
| return '<span class="pill na">' + (v || "—") + '</span>'; | |
| } | |
| function cell(v) { | |
| if (v === "supported") return '<span class="pill ok">supported</span>'; | |
| if (v === "unsupported") return '<span class="pill fail">unsupported</span>'; | |
| const safe = String(v || "—").replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">"); | |
| return '<span class="pill na">' + safe + '</span>'; | |
| } |
1 participant
Summary
Rebuilds the GitHub Pages community conformance report as a homepage covering all community SDKs (python, rust, swift) plus the go reference peer — previously only the python artifact was consumed and rendered as a bare two-table page.
xtest/reporting/generate_site.py): per-SDK scorecards, an encrypt×decrypt interop matrix built from junit test ids (stage-2 community×community pairs appear automatically), a capability matrix listing every SDK, provenance strip (source run, platform ref, go peer, timestamp), and an enriched machine-readablesummary.json. Self-contained HTML, light/dark, status glyphs never rely on color alone.xtest/reporting/export_supports.py): extracted from the workflow heredoc, parameterized, and now exported for python, rust, swift, and go (taggedreference).community-pages.yml: downloads allcommunity-*stage*artifacts from the source run (viadownload-artifactwithrun-id), passes run provenance to the generator, pins the Pages actions by SHA, adds job timeouts, and still deploys on failed runs so the page shows red instead of going stale.community-xtest.yml: addsset -o pipefailto the three piped pytest steps.pytest | teewas swallowing pytest's exit code — run 29210974140 reported green while python stage-1 recorded 3 failed, 0 passed. Note: with the current python failures, the gate will legitimately go red until those are addressed.Verification
ruff check,ruff format --check,pyright: clean.actionlinton both workflows: clean.🤖 Generated with Claude Code
https://claude.ai/code/session_01Dvm7uKaNssz7ztu3nAmf7u
Summary by CodeRabbit