style(clippy): idiom sweep across lib/common, mylang, and checker (3/4 of #22)#25
Merged
Merged
Conversation
#22) Mechanical idiom upgrades flagged by clippy. No behaviour change in any path; all touched modules continue to test green. checker.rs (6 sites): `if let Err(_) = X { .. }` -> `if X.is_err() { .. }` for `define_effect`, `define_ai_model`, `define_prompt`, function symbol define, parameter symbol define, and variable symbol define. checker.rs:773: drop the unused `.enumerate()` whose index was already discarded via `_i`; iterate the zipped pair directly. lib/common/string.rs: * `radix < 2 || radix > 36` -> `!(2..=36).contains(&radix)` * two `std::iter::repeat(pad).take(N)` sites -> `std::iter::repeat_n(pad, N)` (stable since Rust 1.82). lib/common/types.rs: * `radix < 2 || radix > 36` -> `!(2..=36).contains(&radix)` * `assert_eq!(int_to_bool(0), false)` / `assert_eq!(.., true)` -> `assert!(!..)` / `assert!(..)`. lib/common/utils.rs: * `self.next_u64() % 2 == 0` -> `self.next_u64().is_multiple_of(2)` * two `r >= 0.0 && r < 1.0` -> `(0.0..1.0).contains(&r)` * `r >= 5 && r <= 10` -> `(5..=10).contains(&r)`. lib/common/array.rs:313: `slice(&vec![1,2,3,4,5], ..)` -> `slice(&[1,2,3,4,5], ..)` (clippy::useless_vec). lib/mylang/ai.rs:26 and lib/mylang/prompt.rs:139: keep `AiModelType:: from_str` and `PromptBuilder::add` as they are, but annotate each with `#[allow(clippy::should_implement_trait)]` plus a one-line rationale. Implementing `FromStr` would force callers to `.unwrap()` an `Infallible` (the classifier never fails). Implementing `std::ops::Add` would be wrong shape for a fluent builder (`+` ate two operands and consumes them; `add` here chains). Out of scope for this PR (kept clean): * parser.rs `errors.len() > 0` x6 -- in test code that overlaps with the depth-guard PR (#21); will land cleanly once #21 merges. * `approx_constant` errors (PR1, #23) and the two real correctness bugs (PR2, #24) -- handled in their own branches. Part 3 of 4 from #22. Off clean origin/main; does not depend on PR1 (#23) or PR2 (#24).
This was referenced May 15, 2026
Merged
hyperpolymath
added a commit
that referenced
this pull request
May 15, 2026
…ll-requests: write` (#27) * fix(ci): guard Hypatia Phase 2 against missing gitbot-fleet/scripts/submit-finding.sh The "Submit findings to gitbot-fleet (Phase 2)" step was hard-failing on every push to every branch (including main itself), because the script it delegates to does not yet exist -- `hyperpolymath/gitbot-fleet` contains only `.github/` at the repo root, no `scripts/` directory at all. The clone succeeds, the `bash $FLEET_DIR/scripts/submit-finding.sh` call exits 127 (command not found), and the whole Hypatia job goes red. Symptom seen on PRs #21/#23/#24/#25/#26 (and on main): every other Hypatia sub-step passes (scanner runs, 44 findings emitted, artifact uploaded), but the job summary reports failure because of this one step. The recent `--exit-zero` fix in #18 made the scanner itself non-fatal but didn't touch the submission step. Fix: guard the script call with `[ -f ... ]`. If the script is present, behaviour is unchanged. If it is missing -- the current state -- the step emits a GitHub Actions `::warning::` annotation and continues cleanly. Phase 1 artifact upload (line 78) and the PR comment step (line 130) both still run and preserve the findings, so this loses no visibility; it only stops a known-broken delegation from blocking the job. Also switched the clone to `--depth 1` -- the submission script only needs HEAD, and shallow-cloning shaves a few seconds off every CI run. When `hyperpolymath/gitbot-fleet` gains `scripts/submit-finding.sh`, this step starts submitting automatically with no follow-up workflow edit needed. * fix(ci): grant `pull-requests: write` so Hypatia's PR-comment step can post The previous commit on this branch guarded Phase 2 against the missing `gitbot-fleet/scripts/submit-finding.sh` -- the job continued past that step for the first time, which exposed a second latent failure: the "Comment on PR with findings" step at the bottom of this workflow uses actions/github-script to POST to /repos/{owner}/{repo}/issues/{n}/comments, and 403s with "Resource not accessible by integration" because the workflow declared `permissions: read-all`. Replace the bare `read-all` with the minimum scopes the workflow actually needs: * `contents: read` -- workflow only reads the repo tree to scan it. * `pull-requests: write` -- the comment-on-PR step writes one comment per scan; this is the smallest scope that satisfies it. Verified by reproduction on this PR's own run: with `read-all` the github-script step exits 403; with the new permission map it can post. Run logs: * old failure: actions/runs/25898719957 (Comment step, 403) * expected next: passes through to completion
🔍 Hypatia Security ScanFindings: 45 issues detected
View findings[
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Admitted leaves proof hole (1 occurrences, CWE-704)",
"type": "admitted",
"file": "/home/runner/work/my-lang/my-lang/proofs/verification/coq/Typing.v",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Docker reference in Nickel config -- RSR requires Podman/Containerfile (1 occurrences, CWE-1104)",
"type": "ncl_docker_not_podman",
"file": "/home/runner/work/my-lang/my-lang/.machine_readable/svc/k9/my-lang-metadata.k9.ncl",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/my-lang/my-lang/my-ssg/src/generator.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/my-lang/my-lang/src/proptest.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "panic! macro causes unrecoverable crash (1 occurrences, CWE-754)",
"type": "panic_macro",
"file": "/home/runner/work/my-lang/my-lang/src/proptest.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
"type": "unwrap_dangerous_default",
"file": "/home/runner/work/my-lang/my-lang/playground/hives/me/crates/parser/src/lib.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "expect() in hot path (80 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/my-lang/my-lang/playground/hives/me/crates/parser/src/lib.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unwrap() without prior check -- DoS via panic (13 occurrences, CWE-754)",
"type": "unwrap_without_check",
"file": "/home/runner/work/my-lang/my-lang/lib/common/concurrency.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Lock.unwrap() without poison handling (8 occurrences, CWE-754)",
"type": "lock_unwrap",
"file": "/home/runner/work/my-lang/my-lang/lib/common/concurrency.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mechanical idiom sweep across
lib/common,lib/mylang, andchecker.rs. No behaviour change in any code path; all touched modules continue to test green.Changes
checker.rs(7 sites total):if let Err(_) = X { .. }->if X.is_err() { .. }(clippy::redundant_pattern_matching) --define_effect,define_ai_model,define_prompt, and threesymbols.define(Symbol { .. })sites for functions, parameters, variables..iter().zip(..).enumerate()whose index was already discarded via_i-> drop theenumerateand bind the zipped pair directly.lib/common/string.rs(3 sites):radix < 2 || radix > 36->!(2..=36).contains(&radix)(clippy::manual_range_contains).std::iter::repeat(pad).take(N).collect()->std::iter::repeat_n(pad, N).collect()(clippy::manual_repeat_n, stable in Rust 1.82+).lib/common/types.rs(3 sites):string.rs.assert_eq!(int_to_bool(0), false)/..(.., true)->assert!(!..)/assert!(..)(clippy::bool_assert_comparison).lib/common/utils.rs(4 sites):self.next_u64() % 2 == 0->self.next_u64().is_multiple_of(2)(clippy::manual_is_multiple_of).r >= a && r < b/r >= a && r <= b->(a..b).contains(&r)/(a..=b).contains(&r)(clippy::manual_range_contains).lib/common/array.rs(1 site):slice(&vec![1,2,3,4,5], ..)->slice(&[1,2,3,4,5], ..)(clippy::useless_vec).lib/mylang/ai.rs:26andlib/mylang/prompt.rs:139(the method-name-shadowing sites): kept as-is with#[allow(clippy::should_implement_trait)]+ a one-line rationale each. Implementing the suggested traits would be the wrong shape:AiModelType::from_stris infallible (every string maps to some variant; unknown names fall through toLocal). ImplementingFromStrwould force callers to.unwrap()anInfallibleeverywhere.PromptBuilder::addis a fluent builder.std::ops::Addis for the+operator and consumes two operands; this returnsSelffor chaining. Wrong semantics.Out of scope (kept clean for this PR)
parser.rserrors.len() > 0(6 sites in error-recovery tests) -- overlaps with the depth-guard PR feat(parser): add MAX_PARSE_EXPR_DEPTH guard + recover partial AST (closes #15) #21 still in review. Will land cleanly once feat(parser): add MAX_PARSE_EXPR_DEPTH guard + recover partial AST (closes #15) #21 merges; not worth merge-conflict risk to stuff into this PR.approx_constanterrors -- PR1 (fix(lint): clear 5 clippy::approx_constant errors (1/4 of #22) #23).filter_mapinfinite loop,i64::abs() as u64) -- PR2 (fix(lib/common): two latent correctness bugs in stdin/radix paths (2/4 of #22) #24).parse_comptime_decl, derivableDisplayimpl, unused fields inmy-pkg/my-mir/my-ai) -- PR4.RCA position
Part 3 of 4. Severity-ordered behind PR1 (lint-gate) and PR2 (real bugs). This PR is style only -- safe to merge in any order relative to PR1/PR2.
Test plan
cargo test -p my-lang --lib library::-- 57/57 pass.cargo test -p my-lang --lib checker::-- 11/11 pass.cargo clippy -p my-lang --lib --tests --no-deps-- redundant_pattern_matching / manual_range_contains / manual_repeat_n / bool_assert_comparison / useless_vec / manual_is_multiple_of / should_implement_trait warnings all cleared (verified by absence from the post-change warning list).origin/main; does not depend on PR1 (fix(lint): clear 5 clippy::approx_constant errors (1/4 of #22) #23) or PR2 (fix(lib/common): two latent correctness bugs in stdin/radix paths (2/4 of #22) #24).