Repository navigation
Bound analyzer provenance tree lookup for broad squash commits - #1139
Conversation
Read immutable tree metadata through the Git Database commit endpoint so broad squash payloads cannot overflow the analyzer provenance subprocess. Keep unavailable and malformed metadata fail-closed, and add a regression that models the previous response-size failure. Record the production recurrence, TDD evidence, full coverage, and isolated package dogfood under pm-gactwj.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Warning Review limit reachedNext included review available in 46 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughSummary by CodeRabbit
WalkthroughThe hosted-analysis gate now reads commit trees from GitHub’s bounded Git Database endpoint. Tests update mocked response shapes, verify endpoint usage, and preserve fail-closed behavior. PM records document the defect, fix, regression coverage, and validation results. ChangesHosted-analysis provenance
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The change bounds squash-commit tree lookups while preserving fail-closed handling for invalid metadata, and adds regression coverage for oversized responses; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai full review @greptileai please review this exact head. |
Reviewer's GuideBounds squash-commit tree lookups by using GitHub’s narrow Git Database commit endpoint, retains fail-closed metadata validation, and adds regression coverage for oversized responses alongside production/PM evidence. Sequence diagram for bounded squash commit tree lookupsequenceDiagram
participant Gate as HostedAnalysisGate
participant GitHub as GitHubGitDatabaseAPI
Gate->>GitHub: gh api repos/{repository}/git/commits/{sha}
GitHub-->>Gate: tree metadata response
Gate->>Gate: parseObject(stdout, GitHub commit API)
alt valid tree SHA
Gate->>Gate: readCommitTree returns normalized tree SHA
else unavailable, malformed, or mismatched metadata
Gate->>Gate: readCommitTree returns null
end
Flow diagram for fail-closed squash provenance validationflowchart TD
A[Read squash commit tree metadata] --> B{Request succeeded?}
B -- No --> F[Reject provenance]
B -- Yes --> C[Parse GitHub response]
C --> D{Valid tree SHA?}
D -- No --> F
D -- Yes --> E{Tree matches PR head?}
E -- No --> F
E -- Yes --> G[Accept reviewed PR provenance]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
✅ Action performedFull review finished. |
Greptile SummaryThe PR replaces heavyweight commit-with-files reads with bounded Git Database commit metadata while preserving strict squash-provenance validation. It also strengthens regression coverage and records the completed production-defect closure.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| scripts/release/hosted-analysis-gate.mjs | Switches tree lookup to the bounded Git Database commit endpoint and correctly validates its top-level tree SHA. |
| tests/unit/scripts/release/hosted-analysis-gate.spec.ts | Updates endpoint fixtures, models the former one-MiB overflow, requires two bounded reads, and retains negative provenance cases. |
| .agents/pm/issues/pm-gactwj.toon | Records a consistent closed production-defect item with required structured gate evidence and verification details. |
| .agents/pm/history/pm-gactwj.jsonl | Provides a consistent mutation history through implementation, verification, closure, and claim release. |
| CHANGELOG.md | Adds the closed defect to the generated Unreleased Fixed section with the corresponding PM link. |
Sequence Diagram
sequenceDiagram
participant Gate as Hosted analysis gate
participant GH as GitHub API
Gate->>GH: Read reviewed PR association
GH-->>Gate: Merge SHA and reviewed head SHA
Gate->>GH: "GET git/commits/{mergeSha}"
GH-->>Gate: tree.sha
Gate->>GH: "GET git/commits/{headSha}"
GH-->>Gate: tree.sha
alt Trees match and analyzers pass
Gate-->>Gate: Accept identical_tree_squash_pr_head
else Metadata unavailable, malformed, or mismatched
Gate-->>Gate: Fail closed
end
Reviews (2): Last reviewed commit: "docs(pm): close broad squash provenance ..." | Re-trigger Greptile
|
CodeRabbit review acknowledged: the exact head produced no actionable findings. The bounded Git Database endpoint, top-level tree validation, overflow negative control, and fail-closed cases are all covered by the green 120-test focused suite and exact hosted matrix. |
|
Sourcery guide acknowledged: its sequence and failure-path summary matches the implemented contract. The production SHA also passes live through identical_tree_squash_pr_head, so no remediation is required from this guide. |
|
CodeRabbit full-review completion acknowledged. The reviewed head is 9f72d42 and no actionable findings were emitted. |
|
CodSpeed result acknowledged: all 11 benchmarks are unchanged, consistent with this release-gate-only endpoint correction. |
|
Greptile 5/5 review acknowledged: the exact head retains strict provenance semantics, uses validated full SHAs, and has positive plus malformed, unavailable, missing, mismatched, and oversized-response controls. No actionable finding remains. |
|
Sourcery budget-limit review acknowledged as provider unavailability rather than approval. Its separate generated review guide was still inspected and contained no actionable finding; CodeRabbit, Greptile, hosted analyzers, and repository gates provide the terminal review evidence for this head. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Record exact-head hosted evidence and structured defect-gate proof, close and release the tracked regression, and regenerate the changelog with pm-changelog 2026.8.22.
|
@greptileai please review the new exact head 434fde3, including the PM closure and generated changelog. |
|
@coderabbitai full review of the new exact head 434fde3, including the PM closure and generated changelog. |
|
|
|
Codecov exact-head result acknowledged: every modified and coverable line is covered and all tests passed. |
|
CodeRabbit exact-head request response acknowledged. The provider rate limit is recorded as unavailability, not approval; the same product change was fully reviewed at the prior head, while the closeout-only head passed the complete hosted matrix and Greptile 5/5. |
|
Edited CodeRabbit summary re-inspected at 2026-08-28T15:42:16Z: the exact-head request was rate-limited and emitted no new actionable comment. This is a provider limitation, not approval. |
|
CodSpeed exact-head update acknowledged: all 11 benchmarks remain unchanged for head 434fde3. |
|
Greptile exact-head review acknowledged: head 434fde3 received 5/5, explicitly validated the PM closure and changelog, and reported no blocking failure. |
Summary
PM item
Production control
Merged-main CI run 33182695715 failed only Release analyzer readiness for merge 0480ab6. With this change, the real gate resolves PR #1133 head 9f56a49 as identical_tree_squash_pr_head, confirms the shared tree, and accepts DeepScan and CodeFactor at zero findings.
Verification
The PM item is closed and released in this reviewed PR. The final closeout commit intentionally triggers a fresh exact-head hosted matrix and bot review before merge.