feat(assail): exclude vendored-snapshot dirs from analysis (refile of #72 after force-push race)#77
Merged
Merged
Conversation
Three directory shapes hold vendored upstream snapshots that the
project does not own and must not be flagged against:
- .yarn/ (Yarn 4 cached release blobs, e.g. yarn-4.12.0.cjs)
- idaptik-rescript13-staging/ (the ReScript 13 staging tree
embedded in several estate repos)
- rescript-ecosystem/ (vendored upstream ReScript packages)
Add all three to both walk_directory's skip list and
count_languages_recursive's skip list (the latter only needs the
two snapshot trees — .yarn is already covered by its existing
dot-prefix skip).
Without these exclusions, panic-attack reports findings against
code the project cannot fix — developer-ecosystem#83 logged
166 findings, ~70% of which fall in these paths.
Regression tests verify each subtree is skipped while first-party
sibling files are still walked.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
May 27, 2026
…ansitive (#75) (#78) ## Summary Two layered refinements on top of #76 (phantom-declared / phantom-transitive split). Same three-way Mitigable/Unmitigable/Informational output, but the Informational tier now produces an accurate \`action\` field for two cohorts where the generic message was misleading. Closes #74 in part (build-script-only / vendored-pin name-list portion). Closes #75. ## Cohort E-3 — build-script-only / vendored-pin (#74, partial) A naive \`cargo machete --fix\` strip of certain phantom-declared crates breaks the build inscrutably (cross-compile TLS, native-lib resolution, build-time codegen). New \`is_build_script_only_or_vendored_pin(name)\` predicate covers crates that **have no \`use\` site by design**: - Build-script side-effect crates: \`pkg-config\`, \`cc\`, \`bindgen\`, \`cmake\`, \`autocfg\`, \`vcpkg\`, \`winres\`, \`embed-resource\` - Canonical vendored-pin: \`openssl-src\` When a phantom-declared crate matches, the action flips from \"Strip from Cargo.toml\" to \"DO NOT STRIP — load-bearing via build.rs side-effects or native-lib linkage\". **Future follow-up**: feature-based detection (e.g. \`openssl-sys = { features = [\"vendored\"] }\`) needs feature-set plumbing through \`ReachabilityEvidence\` — left out of scope. ## Cohort E-2 — Dioxus/GTK transitive (#75) Phantom-transitive advisories where the parent is in the Dioxus desktop family (\`wry\`, \`dioxus-desktop\`, \`dioxus\`) and the affected crate is in the GTK/webkit family now get a Cohort E-2 message naming the no-local-fix path (wait for parent release, or swap the desktop renderer). Sub-rule covers \`printpdf\`→\`kuchiki\`. GTK/webkit family matched: \`atk*\`, \`gdk*\`, \`gtk*\`, \`glib\`, \`glib-sys\`, \`gio\`, \`gio-sys\`, \`gobject-sys\`, \`gtk3-macros\`, \`proc-macro-error\`, \`paste\`, \`fxhash\`, \`webkit2gtk\`, \`webkit2gtk-sys\`. ## Bonus repair: src/assail/analyzer.rs test-module corruption The squash-merge sequence of PRs #71 (Julia) → #77 (refile of #72 vendored-snapshot) → #73 (flake.lock) left \`src/assail/analyzer.rs\` with an unclosed-delimiter at line 7962: - \`count_julia_dce\` had \`flake_findings\` body - \`julia_ext_jl_dce_is_exempt\` was missing closing braces - Two flake tests (\`flake_without_lock_is_low_severity\`, \`flake_with_narhash_has_no_finding\`) had landed inside the Julia section \`cargo test --lib\` was failing to compile on main as a result. This PR reassembles each section in its intended location; no test logic changed. ## Test plan - [x] \`cargo test --features http --lib bridge::classify::\` — 14/14 pass (5 new + 9 existing) - [x] \`cargo test --features http --lib\` — 343 lib tests pass (was previously failing to compile) - [x] \`cargo check --features http\` — green ## Changes - \`src/bridge/classify.rs\`: +268 / -29 lines (3 predicate fns + 2 cohort override branches + 5 regression tests) - \`src/assail/analyzer.rs\`: +/-109 lines, net wash (reassemble corrupted test sections) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refile of #72 after a botched rebase pushed the wrong HEAD and auto-closed the original PR. Same intent: exclude .yarn, idaptik-rescript13-staging, rescript-ecosystem from analysis. Resolved conflict in src/assail/analyzer.rs by merge-both (kept #71's Julia *Ext.jl tests + this PR's vendored-snapshot tests).
Closes #72 (refiled).
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com