fix(deps): complete Gate_SDK @v1 pin — lock, validator, and hook - #282
Conversation
|
✅ PR reviewable size is within recommended limits |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
|
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The new validator logic is currently too permissive for manifests and can produce misleading errors for invalid lock resolved_reference values due to an overly strict regex match.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
What changed in this PR
Updates the repository’s Gate_SDK dependency policy enforcement to align constellation-node-sdk with the moving major tag @v1, and synchronizes the Poetry lock plus unit tests to that policy.
Changes:
- Update
scripts/validate_sdk_pin.pyfrom immutable-SHA enforcement to a moving-major@v1policy (including lockfile validation). - Regenerate
poetry.locktoconstellation-node-sdk1.1.0 withreference = "v1"and a newresolved_reference. - Add/adjust unit tests to cover the updated validator behavior and update an SDK pin docstring reference.
| File | Description |
|---|---|
poetry.lock |
Updates constellation-node-sdk version and git source reference/resolution to the v1 moving-major policy. |
scripts/validate_sdk_pin.py |
Reworks SDK pin validation from SHA-based pinning to @v1 moving-major checks (plus lock validation). |
tests/unit/test_node_app.py |
Updates docstring to reflect the new @v1 / 1.1.0 pin description. |
tests/unit/test_validate_sdk_pin.py |
Adds unit tests covering the new moving-major validator behavior (manifests + lock + repo tree). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| LOCK_REFERENCE_RE = re.compile( | ||
| r'name = "constellation-node-sdk".*?\[package\.source\].*?' | ||
| r'reference = "([^"]+)".*?resolved_reference = "([0-9a-f]{40})"', | ||
| re.DOTALL, | ||
| ) | ||
|
|
||
|
|
||
| def check_text(rel: str, text: str) -> list[str]: | ||
| errors: list[str] = [] | ||
| if CANONICAL_REPO not in text: | ||
| errors.append(f"{rel}: missing {CANONICAL_REPO}") | ||
| if FORBIDDEN_FORK in text: | ||
| errors.append(f"{rel}: {FORBIDDEN_FORK} remains") | ||
| if rel == "poetry.lock": | ||
| match = LOCK_REFERENCE_RE.search(text) | ||
| if match is None: | ||
| errors.append(f"{rel}: constellation-node-sdk source block missing") | ||
| else: | ||
| reference, resolved = match.group(1), match.group(2) | ||
| if reference != MAJOR_TAG: | ||
| errors.append(f"{rel}: reference={reference!r} (want {MAJOR_TAG!r})") | ||
| if not SHA_RE.fullmatch(resolved): | ||
| errors.append(f"{rel}: resolved_reference is not a SHA") |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0eb838db5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if not SHA_RE.fullmatch(resolved): | ||
| errors.append(f"{rel}: resolved_reference is not a SHA") | ||
| else: | ||
| if MAJOR_TAG not in text: |
There was a problem hiding this comment.
When either manifest uses a revision such as v10 or v1-malicious, this substring check still finds v1 and returns no error, so the repository-tree test approves a dependency that violates the required @v1 policy. Parse the constellation-node-sdk declaration and compare its revision exactly instead of searching the whole file.
Useful? React with 👍 / 👎.
Problem
fix(deps): complete Gate_SDK @v1 pin — lock, validator, and hook (+2 more commits below)
PR #263 adopted the moving major tag in the manifests. Sync poetry.lock to that tag and replace the SHA fail-closed check so main is coherent.
Closes #266
Fix
Risk
Blast radius: measured paths in Changes by intent
Rollback: revert this PR
Evidence
Gates
semgrepclean, or findings triaged below — n/a — not this changeReviewer focus
See Changes by intent and Protected-root (if any additive_only path).
Changes by intent
Added
tests/unit/test_validate_sdk_pin.py— fix(deps): keep @v1 pin off Makefile/pre-commit overlap with fix(c-009): add make cypher-lint and close live interpolation holes #280Modified
poetry.lock— fix(deps): complete Gate_SDK @v1 pin — lock, validator, and hookscripts/validate_sdk_pin.py— fix(deps): complete Gate_SDK @v1 pin — lock, validator, and hooktests/unit/test_node_app.py— fix(deps): complete Gate_SDK @v1 pin — lock, validator, and hookDeleted
Files touched
Commits
Test plan
make prlocal gate receipt presentrelease_authorized)Changed files