Skip to content

fix(validator): detect name= in single-line pedigree assignment#20

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/k9-pedigree-inline-name-parse
May 28, 2026
Merged

fix(validator): detect name= in single-line pedigree assignment#20
hyperpolymath merged 1 commit into
mainfrom
fix/k9-pedigree-inline-name-parse

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

  • pedigree = component_pedigree & { name = "..." } on a single line was silently ignored — the opening and closing braces appear on the same line so pedigree_depth returned to 0 immediately, and the name = check (anchored ^[[:space:]]+name) never matched an inline token
  • Adds an unanchored fallback [[:space:]]name[[:space:]]*= check (option b — parse the full logical unit) alongside the existing anchored check
  • Same fallback applied to version|schema_version for consistency
  • Root cause: developer-ecosystem@baab1534 K9 validation failure

Test plan

  • Create a .k9.ncl with pedigree = component_pedigree & { name = "foo" } (single-line form) — validator must pass the name check
  • Multi-line pedigree blocks still detected (existing behaviour unchanged)
  • No tests required for workflow YAML changes (CI itself is the test)

🤖 Generated with Claude Code

Why: developer-ecosystem@baab1534 revealed that `pedigree = component_pedigree
& { name = "..." }` written on a single line was not detected by the validator.
The `name =` check used `^[[:space:]]+name[[:space:]]*=` which requires name to
start a line with leading whitespace. On a single-line pedigree the opening and
closing braces appear on the same line as `pedigree =`, so pedigree_depth
returns to 0 immediately and subsequent line-iteration never has a chance to see
`name =` on a freshly-indented line.

Change (option b — parse the whole logical unit): the `name =` and
`version|schema_version =` checks now carry a second condition using the
unanchored pattern `[[:space:]]name[[:space:]]*=` which matches the inline
form. The existing anchored check is kept for the normal multi-line case.
Both checks are guarded by `in_pedigree == true` so they only fire within
the recognised pedigree block.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@hyperpolymath
hyperpolymath enabled auto-merge (squash) May 28, 2026 14:36
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 74 issues detected

Severity Count
🔴 Critical 1
🟠 High 4
🟡 Medium 69

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Action actions/upload-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/download-artifact@v4 needs attention",
    "type": "unpinned_action",
    "file": "release.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "unknown",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependabot-automerge.yml",
    "type": "unknown",
    "file": "dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath
hyperpolymath disabled auto-merge May 28, 2026 20:19
@hyperpolymath
hyperpolymath merged commit 5dc1ee6 into main May 28, 2026
22 checks passed
@hyperpolymath
hyperpolymath deleted the fix/k9-pedigree-inline-name-parse branch May 28, 2026 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant