chore(compliance): standards alignment 2026-05-30#56
Conversation
|
Warning Review limit reached
More reviews will be available in 50 minutes and 58 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (39)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ FIPS Compatibility Check
Status: ✅ PASSED What is FIPS?FIPS 140-2/140-3 is a US government standard for cryptographic modules. Common issues:
|
Dependency ReviewThe following issues were found:
License Issuesuv.lock
OpenSSF Scorecard
Scanned Files
|
There was a problem hiding this comment.
Pull request overview
Compliance-focused remediation sweep to align the repository with the current standards manifest (packaging metadata, licensing/REUSE hygiene, CI hardening, documentation/tooling conventions), with a small amount of runtime version plumbing updated to derive versions from package metadata.
Changes:
- Updated packaging metadata and dependency constraints (keywords/URLs, Python target version alignment, MkDocs upper-bounds, lockfile updates).
- Hardened/clarified CI and supply-chain guidance (SonarCloud failing on test failures, Scorecard slug fixes, pinning guidance for images/deps, Qlty plugin enablement).
- Added/updated compliance and documentation artifacts (missing license text, OSSF checklist/template docs, CLAUDE folder guidelines, changelog/slug cleanups, draft doc wording normalization).
Reviewed changes
Copilot reviewed 38 out of 39 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Updates locked dependency graph to reflect new MkDocs upper-bound constraints and refreshed transitive versions. |
tests/CLAUDE.md |
Adds folder-level testing guidelines and stated coverage gates (needs alignment with actual enforced thresholds). |
src/audio_processor/services/deepgram_client.py |
Replaces SDK call-site comment with RAD/#CRITICAL external resource verification notes. |
src/audio_processor/services/CLAUDE.md |
Adds services-layer folder guidance including RAD tagging and error-handling expectations. |
src/audio_processor/cli.py |
Switches Click --version reporting to derive from installed distribution metadata. |
src/audio_processor/api/routes.py |
Adds RAD/#CRITICAL notes about shared in-memory job store concurrency and upload-input security concerns. |
src/audio_processor/api/CLAUDE.md |
Adds API-layer folder guidance (decorator metadata, exception mapping, async conventions). |
src/audio_processor/api/__init__.py |
Derives APP_VERSION from importlib.metadata rather than a hardcoded string. |
src/audio_processor/__init__.py |
Derives __version__ from importlib.metadata with a safe fallback when not installed. |
scripts/setup-supply-chain.sh |
Adds Scorecard guidance comments for pinning a pip-installed dependency with hash. |
REUSE.toml |
Removes non-existent/phantom paths to keep REUSE config accurate. |
README.md |
Fixes OpenSSF Scorecard badge slug to match the hyphenated repo name. |
pyproject.toml |
Adds keywords and [project.urls]; constrains MkDocs deps; aligns Ruff target-version to py311. |
mkdocs.yml |
Fixes repo_name slug, adds new nav entry, and enables strict: true. |
LICENSES/ODbL-1.0.txt |
Adds missing ODbL license text referenced by REUSE configuration. |
docs/planning/tech-spec.md |
Rewords TL;DR to remove banned/flagged phrasing (“comprehensive”). |
docs/planning/project-vision.md |
Rewords TL;DR/core value statements to remove banned/flagged phrasing. |
docs/planning/phases/phase-2-integration.md |
Refines milestone description to be more specific than “comprehensive output”. |
docs/planning/adr/adr-001-initial-architecture.md |
Rewords TL;DR to remove banned/flagged phrasing. |
docs/ossf-badge-checklist.md |
Adds a pre-filled OpenSSF badge questionnaire checklist (one evidence line needs correction re: SHA pinning). |
docs/OPENSSF_COMPLIANCE.md |
Rewords “comprehensive” statements and clarifies security scanning/tooling descriptions. |
docs/known-vulnerabilities-template.md |
Adds a template for documenting deferred vulnerabilities with required fields and audit trail. |
docs/draft_vision.md |
Normalizes punctuation/formatting and removes em-dash patterns in draft vision doc. |
docs/draft_tech_spec.md |
Normalizes formatting (revision history table) and removes em-dash patterns in draft tech spec. |
docs/draft_audio_preprocessing.md |
Normalizes punctuation/formatting and removes em-dash patterns in draft preprocessing doc. |
docs/draft_ADR.md |
Normalizes list/table formatting and removes em-dash patterns in draft ADR doc. |
docs/development/architecture.md |
Rewords a sentence to remove banned/flagged phrasing. |
docker-compose.yml |
Adds instructions/comments to pin Redis image by SHA digest for reproducibility (still unpinned). |
CHANGELOG.md |
Merges/normalizes formatting in an entry (em-dash to colon style). |
.secrets.baseline |
Updates baseline metadata (line number + generation timestamp) to match current repo state. |
.qlty/qlty.toml |
Enables Qlty plugins (ruff, basedpyright, bandit) via new [plugins] section. |
.github/workflows/sonarcloud.yml |
Removes continue-on-error for pytest; adjusts coverage verification behavior accordingly. |
.github/workflows/scorecard.yml |
Fixes Scorecard dashboard URL slug to hyphenated repo name. |
.github/workflows/README.md |
Rewords “comprehensive” statements and clarifies workflow descriptions. |
.github/workflows/dependency-review.yml |
Adds CI-013 note about potential duplication with org-level reusable security workflow. |
.github/workflows/codeql.yml |
Adds CI-013 note about potential duplication with org-level reusable security workflow. |
.github/CODEOWNERS |
Adds deferral note about missing org team for dual-ownership. |
.clusterfuzzlite/Dockerfile |
Adds Scorecard pinning instructions for base image and atheris installation. |
.clusterfuzzlite/build.sh |
Adds Scorecard pinning instruction comment for atheris install. |
PR ReviewStatus: do not merge yet — PR is 🔴 Critical (must fix before merge)
🟠 Important (should fix)
The compliance work itself is sound; blockers are stale-branch integration vs. #53 plus one self-inflicted REUSE regression. 🤖 Generated with Claude Code |
|
Tip For best results, initiate chat on the files or code changes.
Ordered action plan🔴 Must fix before merge
🟠 Should fix
Once conflicts are resolved and the REUSE/coverage fixes are pushed, drop a comment and I'll run a full review. |
Remediations applied: FOUND-014: add [project.urls] to pyproject.toml FOUND-015: populate keywords in pyproject.toml FOUND-016: add org-team deferral comment to CODEOWNERS TOOL-QLTY-001: add [plugins] section to .qlty/qlty.toml TOOL-PYVER-001: align ruff target-version to py311 (min supported) MKDOCS-VER-001/002: add upper-bound pins to mkdocs and plugin deps MKDOCS-NAV-001: add development/setup.md to nav MKDOCS-REPO-001: fix repo_name slug (underscore to hyphen) MKDOCS-STRICT-001: enable strict: true in mkdocs.yml MKDOCS-COPYRIGHT-001: update copyright year to 2025-2026 CI-007-SC: remove continue-on-error from sonarcloud.yml pytest step SCORECARD-URI: fix audio_processor -> audio-processor in README and scorecard.yml CI-013: add deduplication notice to codeql.yml and dependency-review.yml CAND-001: add LICENSES/ODbL-1.0.txt (referenced by REUSE.toml) CAND-003: use importlib.metadata for version in all three version strings CAND-004: merge duplicate ### Fixed sections in CHANGELOG CAND-005: fix CHANGELOG comparison URL slugs (underscore to hyphen) CAND-006: create docs/known-vulnerabilities-template.md CAND-007: add Redis SHA-pin comment to docker-compose.yml CAND-008: add #CRITICAL RAD tags to routes.py and deepgram_client.py CAND-009: remove phantom paths from REUSE.toml CAND-010: add DRAFT comments to docs/draft_*.md files CLAUDE-007: fix 49+ em-dash violations across 5 docs files CLAUDE-008: replace AI-pattern blacklist words in docs CLAUDE-010: create folder-level CLAUDE.md for api/, services/, tests/ OSSF-001: create docs/ossf-badge-checklist.md for badge application SCORECARD:Pinned-Dependencies: add pinning instructions to clusterfuzzlite and setup script Manual steps remaining: - File OpenSSF badge at https://bestpractices.coreinfrastructure.org/en/projects/new - Pin Redis, atheris, and keyrings.google-artifactregistry-auth with SHA hashes Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The compliance audit (CAND-001) added LICENSES/ODbL-1.0.txt on the premise that REUSE.toml referenced ODbL-1.0 without the license text present. The ODbL annotation block (data/**, models/**) matches no files in the repo, so the license is unused; adding the text triggered a 'Unused licenses: ODbL-1.0' REUSE failure that does not occur on main. Remove the file to restore compliance; it should be re-added together with the first ODbL-licensed data file. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The importlib.metadata version derivation in audio_processor/__init__.py and api/__init__.py has an 'except PackageNotFoundError: ... = "unknown"' branch that is unreachable while the package is installed, leaving it uncovered and dropping SonarCloud new-code coverage to 71.4% (below the 80% gate). Add tests that patch importlib.metadata.version to raise for audio-processor only, reload each module, and assert the 'unknown' fallback, restoring clean state in a finally block. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Address Copilot review findings on PR #56: - ossf-badge-checklist.md: the quality_build_reproducible evidence claimed the Docker image is SHA-pinned, but only pinning instructions exist (redis:7-alpine and the ClusterFuzzLite base image are still unpinned per the Manual Steps checklist). Reword to state instructions are documented and pinning is pending. - tests/CLAUDE.md: the coverage table listed a blanket 90% patch gate. Actual enforcement is 80% overall (--cov-fail-under=80, CI coverage-threshold) and Codecov patch target 80%, with 90% patch only on the unit flag. Replace with an accurate, sourced table. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
williaby
force-pushed
the
chore/openssf-compliance-docs
branch
from
27468a0 to
09a2d41
Compare
PR Fix SummaryResolved the blockers from the review. Branch rebased onto Conflict resolution (rebase onto
CI fixes
Review comments (
Deferred (post-push verification)
Local gates green: ruff, basedpyright (0/0), pytest + 91% coverage, 🤖 Generated with Claude Code |
|
CI re-run result (SHA 09a2d41)Cleared (4 of the 6 originally-failing checks):
Still failing (pre-existing, not introduced by this PR):
My earlier note expected these to clear after the rebase; they did not. Root cause is Trivy CVE-database drift, not this PR. The base image is SHA-pinned ( Recommended: handle in a dedicated 🤖 Generated with Claude Code |
The Container Security Trivy gate fails on exactly 2 HIGH findings (the gate ranks by highest vendor severity; GitHub SARIF buckets them lower by NVD CVSS, which is why they did not surface as HIGH code-scanning alerts): - CVE-2025-59375 (libexpat1): DoS via large dynamic memory allocation on crafted XML. No XML parser in src/; only reachable via ffmpeg XML demuxers, DoS-only, bounded by upload size cap, ffmpeg timeout, and container limits. - CVE-2026-48962 (perl-base): IO::Compress < 2.220 RCE via attacker-controlled output glob. App is Python and never invokes perl/IO::Compress. Both have no Debian fix available. Added to .trivyignore with documented risk assessments and matching entries in docs/known-vulnerabilities.md per the unfixed-CVE policy. Reassess-by 2026-07-30. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Compliance Remediations
Applied by the repo-compliance system against standards manifest (built-in inventories, first audit run).
Changes Made
Foundations
[project.urls]table topyproject.toml(FOUND-014)keywordsfield inpyproject.toml(FOUND-015)CODEOWNERS(FOUND-016)LICENSES/ODbL-1.0.txt— referenced byREUSE.tomlbut absent (CAND-001)REUSE.toml(poetry.lock,.zenodo.json,validate_workflows.sh,codemeta.json) (CAND-009)importlib.metadata(CAND-003)### Fixedsections inCHANGELOG.md(CAND-004)audio_processor→audio-processor(CAND-005)docs/known-vulnerabilities-template.md(CAND-006)<!-- DRAFT: ... -->comments todocs/draft_*.mdfiles (CAND-010)Toolchain
[plugins]section to.qlty/qlty.tomlwith ruff, basedpyright, bandit (TOOL-QLTY-001)rufftarget-versiontopy311to matchrequires-python = ">=3.11"minimum (TOOL-PYVER-001)#CRITICALRAD tags toroutes.py(_jobs concurrency, file upload security) anddeepgram_client.py(ExternalResources) (CAND-008)CI/CD
continue-on-error: truefrom pytest step insonarcloud.yml(CI-007-SC)README.mdandscorecard.yml:audio_processor→audio-processorcodeql.ymlanddependency-review.ymldocker-compose.yml(CAND-007).clusterfuzzlite/Dockerfile,build.sh,scripts/setup-supply-chain.shClaude Docs
comprehensive,seamless,robust,crucial) in docs (CLAUDE-008)CLAUDE.mdforsrc/audio_processor/api/,src/audio_processor/services/, andtests/(CLAUDE-010)MkDocs
mkdocsand plugin dependencies (MKDOCS-VER-001/002)development/setup.mdto nav (MKDOCS-NAV-001)repo_nameslug from underscore to hyphen (MKDOCS-REPO-001)strict: true(MKDOCS-STRICT-001)--strictverification comment todocs.yml(MKDOCS-CI-001)OSSF
docs/ossf-badge-checklist.md— pre-filled questionnaire for badge application (OSSF-001)Checks Resolved
FOUND-014, FOUND-015, FOUND-016, TOOL-QLTY-001, TOOL-PYVER-001, CI-007-SC, CI-013, CLAUDE-007, CLAUDE-008, CLAUDE-010, MKDOCS-VER-001, MKDOCS-VER-002, MKDOCS-NAV-001, MKDOCS-REPO-001, MKDOCS-STRICT-001, MKDOCS-COPYRIGHT-001, MKDOCS-CI-001, CAND-001 through CAND-010
Manual Steps Required
docs/ossf-badge-checklist.mdas guidedocker-compose.yml: rundocker inspect redis:7-alpine --format '{{index .RepoDigests 0}}'and substitute SHAatherisin.clusterfuzzlite/Dockerfileandbuild.shwith version + hashkeyrings.google-artifactregistry-authinscripts/setup-supply-chain.shwith version + hash@ByronWilliamsCPA/maintainersteam to enable dual-ownership onCODEOWNERSpathsPre-commit
All hooks pass on the full changeset. Pre-commit domain was entirely clean — no findings.
Generated with Claude Code