Skip to content

Claude/gallant shannon 82193p#30

Closed
hyperpolymath wants to merge 5 commits into
mainfrom
claude/gallant-shannon-82193p
Closed

Claude/gallant shannon 82193p#30
hyperpolymath wants to merge 5 commits into
mainfrom
claude/gallant-shannon-82193p

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Closes #

Type of change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (would change existing behaviour)
  • 🕳️ Soundness fix (fixes a checker/proof false-negative)
  • 📖 Documentation
  • 🧹 Refactor / tech debt (behaviour-preserving)
  • ⚡ Performance
  • 🔧 Build / CI / tooling

How has this been verified?

Checklist

  • My commits are signed (git commit -S).
  • I ran the project's own checks/tests locally and they pass.
  • New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
    prose CC-BY-SA-4.0); I did not relicense existing files.
  • Docs are updated, and no public claim now overstates what the code does.
  • I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

hyperpolymath and others added 5 commits June 14, 2026 03:26
- Add tests/ covering ByteDetector (17), PathHandler (17),
  SafeWhitespace (13), TextTransform (19) — all 66 pass
- Fix byte_to_hex to handle multi-byte codepoints (>0xFF)
- Move normalize_line_endings to run after trim_lines_fn so JS
  .trim() cannot strip \r from CRLF-normalized lines
- Add scripts/build-all.sh; deno.json build-all delegates to it
  (deno task shell does not support POSIX for-in loops)
- Inject missing cross-module symbols into TextTransform.deno.js
  via post-compile Python patch (compiler issue #122 workaround):
  LF/CRLF/CR constants, is_invisible helper, concat alias

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… build-all.sh

Tests (4 SonarCloud issues):
- TextTransform_test.js: remove unused `assertNotEquals` import; replace
  `assertEquals(x.length > 0, true)` with `assert(x.length > 0)` for the
  three check_constraints tests (S1128 + boolean-literal smell)
- ByteDetector_test.js: remove tautological `|| report.length > 0` clause
  from the generate_report assertion (always true for non-empty output)

Build script:
- Replace `python3 - << PYEOF` heredoc with awk + POSIX shell; python3
  is banned in this repo (CLAUDE.md) and unavailable in the Deno deploy env

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath enabled auto-merge (rebase) June 23, 2026 16:42
@hyperpolymath
hyperpolymath disabled auto-merge June 24, 2026 08:23

Copy link
Copy Markdown
Owner Author

Closing as superseded — not mergeable as-is.

Tests + fixes (281e68c, d80aa61) are already on main (landed as e49bdfd / e036fb7) — git cherry marks both patch-equivalent, so that half adds nothing.

CI half (a982cce64459516940bf901, three identical re-pushes) can't land:

  • It relicenses governance.yml / scorecard.yml / hypatia-scan.yml to PMPL-1.0-or-later, reverting chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) #33 ("normalise to MPL-2.0", merged 2026-06-24).
  • It conflicts on those files — the branch base e155e6a is ~9 commits behind main.
  • It pins standards@5a93d9d, older than the estate-canonical 861b5e9 already used by governance.yml.

The genuinely useful part — wrapping scorecard.yml with the standards reusable — will be redone on top of current main (MPL-2.0 header, canonical 861b5e9 pin, correct security-events / id-token permissions) in a focused follow-up PR.


Generated by Claude Code

hyperpolymath added a commit that referenced this pull request Jun 24, 2026
Replace the standalone OSSF Scorecard job with a thin wrapper around
hyperpolymath/standards scorecard-reusable.yml, matching governance.yml.

- Pinned to the estate-canonical standards commit 861b5e9 (same as
  governance.yml) so the estate moves in lockstep.
- Grants security-events:write + id-token:write on the calling job: for a
  reusable call the caller is the ceiling for the called token, so without
  this the reusable's SARIF upload is silently downgraded and fails.
- Keeps the MPL-2.0 header, existing triggers, and the concurrency guardrail.
- Leaves scorecard-enforcer.yml standalone (it owns the score-threshold gate
  and the SECURITY.md / pinned-deps checks the reusable does not cover).

Supersedes the scorecard portion of the closed, stale PR #30 (which
relicensed these files to PMPL-1.0-or-later against #33 and pinned an
older standards SHA).


Claude-Session: https://claude.ai/code/session_01AHygjxRyU3WwmXEhA9KF5L

Co-authored-by: Claude <noreply@anthropic.com>
@hyperpolymath
hyperpolymath deleted the claude/gallant-shannon-82193p branch June 24, 2026 10:47
@hyperpolymath
hyperpolymath restored the claude/gallant-shannon-82193p branch July 7, 2026 18:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant