Audit: fail strict on wasm reads via the github.com/*/raw/ URL form - #48
Merged
Conversation
Makes repoint rule 5 machine-checked: lecture-wasm executes code cells
in the reader's browser, where the github.com/*/raw/ redirect fails
CORS, so any wasm code-cell read via a github.com form is now a
migration inconsistency — it fails --strict and renders in the
dashboard's problems box. Only code-cell reads are scanned, so
{download} and prose links (navigations, CORS-exempt) cannot trip it.
This is a post-merge net, not a gate: the scan reads each lecture
repo's main, so a violation turns the weekly/push audit red rather
than blocking the offending PR. PLAN rule 5 updated to match.
Negative-tested against a doctored lecture-wasm clone whose
origin/main reverts mpd2020.xlsx to the github.com form: strict exits
1 with "mpd2020.xlsx: lecture-wasm reads via
github.com/{org}/{repo}/raw/{ref}/… — fails CORS in the browser
(repoint rule 5)". Current real repos pass clean.
Follows up #46/#47; the empirical basis is recorded there.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Extends the audit scanner to enforce PLAN “repoint rule 5” in --strict mode by flagging lecture-wasm code-cell reads that use any github.com/... raw/blob URL form (which fails CORS in-browser), and updates the PLAN text to reflect that the rule is now machine-checked post-merge.
Changes:
- Add a new
migration_inconsistenciescheck: anylecture-wasmref whoseurl_formis agithub.com/...form is reported as a strict-failing inconsistency. - Update PLAN rule-5 documentation to describe the new post-merge strict audit enforcement behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| scripts/build_audit.py | Adds a rule-5 audit check that reports lecture-wasm github.com/... URL forms as migration_inconsistencies (strict-failing and dashboard-visible). |
| PLAN.md | Updates rule-5 wording to reflect that strict audit now checks the URL form for lecture-wasm code-cell reads. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Addresses Copilot review: with only the file named, two wasm lectures
reading the same file via a bad form would produce identical messages.
Negative test now reports "mpd2020.xlsx: lecture-wasm long_run_growth
reads via github.com/{org}/{repo}/raw/{ref}/…".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mmcky
added a commit
that referenced
this pull request
Aug 7, 2026
…ges host (#50) * PLAN: add repoint rule 6 — the media host is LFS-only, so a fold changes host `media.githubusercontent.com` serves only LFS objects and returns 404 for a plain-git file, while `raw.githubusercontent.com` serves it. Both send access-control-allow-origin: *, so this is host routing rather than CORS — a different failure from rule 5, and it affects CPython consumers too. This is latent in exactly one remaining piece of work, and it would break all of it. high_dim_data tracks *.csv and *.dta under a blanket LFS rule, so all 14 consuming reads go through the media host today. The storage decision lands those six datasets here as plain git, after which the media host 404s for them — so the fold must change host as well as org and repo. A mechanical org/repo swap breaks every read. Rule 6 records the measurement, enumerates the 14 reads with file and line, and gives the acceptance grep. Phase 3 gets a matching checkbox, since that is where the work happens. Nothing in CI covers this: the strict audit's URL-form check catches only the github.com/*/raw/ form, and only in lecture-wasm (#48). Two of the 14 reads are builder notebooks the audit does not scan as data reads at all. Found while preparing the french_rev set. Context in QuantEcon/workspace-lectures#23. * PLAN: tighten rule 6's intro line and de-duplicate the Phase 3 checkbox Addresses Copilot review on #50. The "Repoint rules" intro said rules 5 and 6 are "not fully enforced either" — a doubled construction, and vague where the rest of that paragraph is specific about what CI does and does not catch. Now says what CI actually covers: the github.com/*/raw/ form in lecture-wasm, and nothing else. The Phase 3 checkbox repeated the acceptance grep and both caveats already in rule 6. A grep string copied into two places drifts, and this one is load-bearing — if the copies disagree later, the checklist is what someone will act on. The box keeps the what and the why so it still means something on its own, and defers the enumerated reads, the acceptance check and the CI caveat to rule 6, which is now the single canonical place. The grep string appears once in the file. Docs only; no change to the rule's substance.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes repoint rule 5 machine-checked, closing the gap PLAN admitted when the rule landed in #47 ("the strict check cannot enforce this rule"). Any
lecture-wasmcode-cell read whose URL uses agithub.com/…form — all three spellings the scanner knows (/raw/,/raw/refs/heads/,/blob/…?raw=true) — is now reported as a migration inconsistency, so it fails--strictand renders in the dashboard's problems box with the file and form named.Scope falls out of the existing scan for free: only
{code-cell}reads are recorded, so{download}targets and prose links — navigations, where CORS does not apply and thegithub.comform is fine — can never trip the check. Non-wasm repos are untouched (their readers run real CPython).What this is and isn't: a post-merge net, not a gate. The audit scans each lecture repo's
main, so a violation turns the next audit run red (any push to this repo's main, or the Monday cron) rather than blocking the offending wasm PR — pre-merge, the rule still rests on repoint-PR discipline. PLAN rule 5's wording is updated to match. A true pre-merge gate would be a grep step in lecture-wasm's own CI, deliberately not part of this change.Testing: current real repos pass strict clean (exit 0). Negative-tested against a doctored
lecture-wasmclone whoseorigin/mainreverts thempd2020.xlsxread to thegithub.comform — strict exits 1 with:The violations join
migration_inconsistenciesrather than a new problems key so the dashboard renders them with zero changes torender_audit.py— the message text carries the rule-5 attribution.The empirical basis (browser-verified CORS behaviour of each host) is recorded on #46. Follows #47.
🤖 Generated with Claude Code