Repository navigation
Add Codex and Claude Code push and PR hooks - #620
Conversation
hashicorp-vault-sonar-prod
Bot
changed the title
romainbrenguier
changed the title
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
979c280 to
a423d0c
Compare
CI failed: CI jobs failed with a GitHub API 403 rate-limit error for installation 134737833; this is infrastructure throttling, and it is unclear whether the new PR hooks caused it.OverviewOne unique error template was found across 2 analyzed logs (jobs 131337867864 and 131337868007). The failure is a GitHub API rate-limit response (HTTP 403) rather than a test or build assertion, so the overall assessment is an infrastructure/API throttling issue. FailuresGitHub API rate limit exceeded (HTTP 403) (confidence: high)
Summary
Code Review
|
| Auto-apply | Compact | Unblock |
|
|
|
Was this helpful? React with 👍 / 👎 | Gitar
|
| if Path(words[0]).name in ("sh", "bash", "zsh"): | ||
| for index, word in enumerate(words[1:], 1): | ||
| if word.startswith("-") and "c" in word[1:] and index + 1 < len(words): | ||
| attempted, _ = is_push(words[index + 1]) | ||
| if attempted: | ||
| return True, False | ||
| break | ||
| standalone = push_words(command) is not None | ||
| for segment in re.split(r"[;&|\n]+", command): | ||
| try: | ||
| tokens = shlex.split(segment) | ||
| except ValueError: | ||
| continue | ||
| if git_push_tokens(tokens): | ||
| return True, standalone |
There was a problem hiding this comment.
⚠️ Edge Case: Shell-wrapper push check is bypassed by --norc/--rcfile or a prefix
The new wrapper check in is_push only fires when words[0] is sh/bash/zsh. It also breaks on the first option that contains a c. Traced bypasses:
bash --norc -c "git push"andbash --rcfile x -c "git push":--norc/--rcfilematch"c" in word[1:], so the code recurses on the wrong word (-corx), gets False, and breaks.cd . && bash -c "git push",env bash -c ...andtimeout 60 sh -c ...:words[0]is not a shell, so the wrapper branch is skipped.
In every case the per-segment fallback sees the single token "git push", whose Path(...).name is not git, so is_push returns (False, False). The push then runs without verify_head. This contradicts the new HOOKS.md claim that "Shell wrapped pushes are blocked".
Fix: inside each segment, look for the shell token at any position, skipping env/timeout/exec/command prefixes. Treat only short-option clusters (-[a-zA-Z]*c[a-zA-Z]*, not --…) as -c. Keep scanning instead of breaking.
Detect a shell -c wrapper in every segment and only match short-option clusters:
SHELLS = ("sh", "bash", "zsh", "dash", "ksh")
def wrapped_push(tokens):
for i, token in enumerate(tokens):
if Path(token).name not in SHELLS:
continue
for j in range(i + 1, len(tokens) - 1):
if re.fullmatch(r"-[a-zA-Z]*c[a-zA-Z]*", tokens[j]) and is_push(tokens[j + 1])[0]:
return True
return False
Was this helpful? React with 👍 / 👎
| for match in re.finditer(r'CI-OVERRIDE:\s*["\u201c](.+?)["\u201d]', reply): | ||
| quote = " ".join(match.group(1).split()).casefold() | ||
| if len(quote) >= 8 and quote == latest: |
There was a problem hiding this comment.
💡 Edge Case: Override quote regex rejects messages containing quotes or newlines
authorized_override now requires the quoted text to equal the user's entire latest message. The extraction regex is ["\u201c](.+?)["\u201d], which is lazy and has no DOTALL. If the message contains a ", for example CI-OVERRIDE: ignore the "NEXT analysis" failure, the capture stops at the first inner quote. If the message spans more than one line, . cannot match the newline. In both cases the capture never equals latest, so a real user authorization is always rejected, and the documented CI-OVERRIDE: "<their entire latest message>" procedure cannot work.
Fix: capture greedily up to the last closing quote on the reply's final override line, using DOTALL. Alternatively, compare the normalized text after CI-OVERRIDE: without requiring delimiters.
Greedy, DOTALL match anchored at the end of the reply:
match = re.search(r'CI-OVERRIDE:\s*["\u201c](.+)["\u201d]\s*$', reply, flags=re.DOTALL)
if match:
quote = " ".join(match.group(1).split()).casefold()
if len(quote) >= 8 and quote == latest:
return match.group(1)
return None
Was this helpful? React with 👍 / 👎
bc10516
into
chore/ai-experiment-agent-readiness
Adds repository-owned Codex and Claude Code hooks for
git pushand turn finalization.Both clients use the same committed-HEAD checks, saved results, exact-commit Build PR job validation, and review status. Claude's adapter validates CI override quotes against user messages in its session transcript.
Validated with 4 Codex hook tests, 4 Claude hook tests, and
mvn clean verify -Pcoverage -DskipTests=false -Bagainst the final committed HEAD.Summary by Gitar
CleartextProtocolFilterExporterandCleartextProtocolCorpusExporterto generate shared JSON exclusions and corpus for npm/nupkg packagesneverssl.com,osmand.net, and many XML namespace identifier prefixes toCleartextProtocolFilter(bool)Trueand(bool)FalseCODESYS boolean value exclusions toSecretClassifierThis will update automatically on new commits.
Agent workflow
Tool link: https://github.com/SonarSource/languages-experimental-tooling/tree/romain/my-tickets/personal/romain-brenguier
PR updated using
uv run update_with_claude.py --prompt "Rebase on origin/master, fixing conflicts" -a "None" -g "codex"PR updated using
uv run update_with_claude.py --prompt "Rebase on origin/master, fixing conflicts" -a "None" -g "codex"PR updated using `uv run update_with_claude.py --prompt "Implement the action plan described in the document Rebase on chore/ai-experiment-agent-readiness
SonarSource/sonar-analyzer-commons:chore/ai-experiment-agent-readiness
Drop commits from master that shouldn't be part of the PR, after master diverged from the base branch.." -a "Rebase on chore/ai-experiment-agent-readiness
SonarSource/sonar-analyzer-commons:chore/ai-experiment-agent-readiness
Drop commits from master that shouldn't be part ...
PR updated using
uv run update_with_claude.py --prompt "Implement the action plan described in the document Code Review: Adds repository-owned Codex and Claude Code hooks that gategit push` and turn finalization on committed-HEAD checks and exact-commit Build PR validation. Changes are requested: the CI-OVERRIDE check accepts any 8+ character substring of a user message, so it can be bypassed by quoting ordinary text, and the Claude PreToolUse hook has no timeout, so a long Maven run could le...