Skip to content

style(clippy): idiom sweep across lib/common, mylang, and checker (3/4 of #22)#25

Merged
hyperpolymath merged 2 commits into
mainfrom
clippy/style-sweep-issue-22
May 15, 2026
Merged

style(clippy): idiom sweep across lib/common, mylang, and checker (3/4 of #22)#25
hyperpolymath merged 2 commits into
mainfrom
clippy/style-sweep-issue-22

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Mechanical idiom sweep across lib/common, lib/mylang, and checker.rs. No behaviour change in any code path; all touched modules continue to test green.

Changes

checker.rs (7 sites total):

  • 6x if let Err(_) = X { .. } -> if X.is_err() { .. } (clippy::redundant_pattern_matching) -- define_effect, define_ai_model, define_prompt, and three symbols.define(Symbol { .. }) sites for functions, parameters, variables.
  • 1x .iter().zip(..).enumerate() whose index was already discarded via _i -> drop the enumerate and bind the zipped pair directly.

lib/common/string.rs (3 sites):

  • radix < 2 || radix > 36 -> !(2..=36).contains(&radix) (clippy::manual_range_contains).
  • 2x std::iter::repeat(pad).take(N).collect() -> std::iter::repeat_n(pad, N).collect() (clippy::manual_repeat_n, stable in Rust 1.82+).

lib/common/types.rs (3 sites):

  • Same radix range fix as string.rs.
  • assert_eq!(int_to_bool(0), false) / ..(.., true) -> assert!(!..) / assert!(..) (clippy::bool_assert_comparison).

lib/common/utils.rs (4 sites):

  • self.next_u64() % 2 == 0 -> self.next_u64().is_multiple_of(2) (clippy::manual_is_multiple_of).
  • 3x r >= a && r < b / r >= a && r <= b -> (a..b).contains(&r) / (a..=b).contains(&r) (clippy::manual_range_contains).

lib/common/array.rs (1 site):

  • slice(&vec![1,2,3,4,5], ..) -> slice(&[1,2,3,4,5], ..) (clippy::useless_vec).

lib/mylang/ai.rs:26 and lib/mylang/prompt.rs:139 (the method-name-shadowing sites): kept as-is with #[allow(clippy::should_implement_trait)] + a one-line rationale each. Implementing the suggested traits would be the wrong shape:

  • AiModelType::from_str is infallible (every string maps to some variant; unknown names fall through to Local). Implementing FromStr would force callers to .unwrap() an Infallible everywhere.
  • PromptBuilder::add is a fluent builder. std::ops::Add is for the + operator and consumes two operands; this returns Self for chaining. Wrong semantics.

Out of scope (kept clean for this PR)

RCA position

Part 3 of 4. Severity-ordered behind PR1 (lint-gate) and PR2 (real bugs). This PR is style only -- safe to merge in any order relative to PR1/PR2.

Test plan

#22)

Mechanical idiom upgrades flagged by clippy. No behaviour change in
any path; all touched modules continue to test green.

checker.rs (6 sites): `if let Err(_) = X { .. }` -> `if X.is_err() { .. }`
  for `define_effect`, `define_ai_model`, `define_prompt`, function
  symbol define, parameter symbol define, and variable symbol define.

checker.rs:773: drop the unused `.enumerate()` whose index was already
  discarded via `_i`; iterate the zipped pair directly.

lib/common/string.rs:
* `radix < 2 || radix > 36` -> `!(2..=36).contains(&radix)`
* two `std::iter::repeat(pad).take(N)` sites -> `std::iter::repeat_n(pad, N)`
  (stable since Rust 1.82).

lib/common/types.rs:
* `radix < 2 || radix > 36` -> `!(2..=36).contains(&radix)`
* `assert_eq!(int_to_bool(0), false)` / `assert_eq!(.., true)` ->
  `assert!(!..)` / `assert!(..)`.

lib/common/utils.rs:
* `self.next_u64() % 2 == 0` -> `self.next_u64().is_multiple_of(2)`
* two `r >= 0.0 && r < 1.0` -> `(0.0..1.0).contains(&r)`
* `r >= 5 && r <= 10` -> `(5..=10).contains(&r)`.

lib/common/array.rs:313: `slice(&vec![1,2,3,4,5], ..)` ->
  `slice(&[1,2,3,4,5], ..)` (clippy::useless_vec).

lib/mylang/ai.rs:26 and lib/mylang/prompt.rs:139: keep `AiModelType::
  from_str` and `PromptBuilder::add` as they are, but annotate each
  with `#[allow(clippy::should_implement_trait)]` plus a one-line
  rationale. Implementing `FromStr` would force callers to `.unwrap()`
  an `Infallible` (the classifier never fails). Implementing
  `std::ops::Add` would be wrong shape for a fluent builder (`+` ate
  two operands and consumes them; `add` here chains).

Out of scope for this PR (kept clean):
* parser.rs `errors.len() > 0` x6 -- in test code that overlaps with
  the depth-guard PR (#21); will land cleanly once #21 merges.
* `approx_constant` errors (PR1, #23) and the two real correctness
  bugs (PR2, #24) -- handled in their own branches.

Part 3 of 4 from #22. Off clean origin/main; does not depend on PR1
(#23) or PR2 (#24).
hyperpolymath added a commit that referenced this pull request May 15, 2026
…ll-requests: write` (#27)

* fix(ci): guard Hypatia Phase 2 against missing gitbot-fleet/scripts/submit-finding.sh

The "Submit findings to gitbot-fleet (Phase 2)" step was hard-failing on
every push to every branch (including main itself), because the script
it delegates to does not yet exist -- `hyperpolymath/gitbot-fleet`
contains only `.github/` at the repo root, no `scripts/` directory at
all. The clone succeeds, the `bash $FLEET_DIR/scripts/submit-finding.sh`
call exits 127 (command not found), and the whole Hypatia job goes red.

Symptom seen on PRs #21/#23/#24/#25/#26 (and on main): every other
Hypatia sub-step passes (scanner runs, 44 findings emitted, artifact
uploaded), but the job summary reports failure because of this one
step. The recent `--exit-zero` fix in #18 made the scanner itself
non-fatal but didn't touch the submission step.

Fix: guard the script call with `[ -f ... ]`. If the script is present,
behaviour is unchanged. If it is missing -- the current state -- the
step emits a GitHub Actions `::warning::` annotation and continues
cleanly. Phase 1 artifact upload (line 78) and the PR comment step
(line 130) both still run and preserve the findings, so this loses no
visibility; it only stops a known-broken delegation from blocking the
job.

Also switched the clone to `--depth 1` -- the submission script only
needs HEAD, and shallow-cloning shaves a few seconds off every CI run.

When `hyperpolymath/gitbot-fleet` gains `scripts/submit-finding.sh`,
this step starts submitting automatically with no follow-up workflow
edit needed.

* fix(ci): grant `pull-requests: write` so Hypatia's PR-comment step can post

The previous commit on this branch guarded Phase 2 against the missing
`gitbot-fleet/scripts/submit-finding.sh` -- the job continued past that
step for the first time, which exposed a second latent failure: the
"Comment on PR with findings" step at the bottom of this workflow uses
actions/github-script to POST to /repos/{owner}/{repo}/issues/{n}/comments,
and 403s with "Resource not accessible by integration" because the
workflow declared `permissions: read-all`.

Replace the bare `read-all` with the minimum scopes the workflow
actually needs:

* `contents: read`  -- workflow only reads the repo tree to scan it.
* `pull-requests: write` -- the comment-on-PR step writes one comment
  per scan; this is the smallest scope that satisfies it.

Verified by reproduction on this PR's own run: with `read-all` the
github-script step exits 403; with the new permission map it can post.
Run logs:
* old failure: actions/runs/25898719957 (Comment step, 403)
* expected next: passes through to completion
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 45 issues detected

Severity Count
🔴 Critical 8
🟠 High 19
🟡 Medium 18

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
    "type": "codeql_language_matrix_mismatch",
    "file": "codeql.yml",
    "action": "switch_codeql_matrix_to_actions",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Admitted leaves proof hole (1 occurrences, CWE-704)",
    "type": "admitted",
    "file": "/home/runner/work/my-lang/my-lang/proofs/verification/coq/Typing.v",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Docker reference in Nickel config -- RSR requires Podman/Containerfile (1 occurrences, CWE-1104)",
    "type": "ncl_docker_not_podman",
    "file": "/home/runner/work/my-lang/my-lang/.machine_readable/svc/k9/my-lang-metadata.k9.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/my-ssg/src/generator.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (2 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/src/proptest.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "panic! macro causes unrecoverable crash (1 occurrences, CWE-754)",
    "type": "panic_macro",
    "file": "/home/runner/work/my-lang/my-lang/src/proptest.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/my-lang/my-lang/playground/hives/me/crates/parser/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (80 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/my-lang/my-lang/playground/hives/me/crates/parser/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (13 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/lib/common/concurrency.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Lock.unwrap() without poison handling (8 occurrences, CWE-754)",
    "type": "lock_unwrap",
    "file": "/home/runner/work/my-lang/my-lang/lib/common/concurrency.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath
hyperpolymath merged commit 839e477 into main May 15, 2026
20 checks passed
@hyperpolymath
hyperpolymath deleted the clippy/style-sweep-issue-22 branch May 15, 2026 06:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant