chore: clear the 9 pre-existing CodeQL baseline alerts - #157
Merged
Conversation
None are introduced by any feature PR — they surface repo-wide on main and got re-attributed onto large-regen PRs (#153/#156) by CodeQL's "changes too large" re-scan. Fixing the root debt so the aggregate CodeQL check goes green. Code (js/file-system-race + js/identity-replacement): - test/lib/diff.mjs: readdirSync({withFileTypes}) instead of readdir + separate statSync (the stat is a check-then-read TOCTOU). - src/cli.mjs: unlink directly + catch ENOENT instead of existsSync-then-unlink. - benchmark/run.mjs: read the prior lock-stamp via try/catch instead of existsSync-then-readFileSync; drop the identity `.replace(/^_/, '_')` no-op in slugOf. Workflows (actions/missing-workflow-permissions + actions/unpinned-tag): - ci.yml: add `permissions: contents: read` to the test / compile / fixture-guard jobs (least privilege; preview already had its own). - benchmark.yml + yama-review.yml: pin marocchino/sticky-pull-request-comment and juspay/yama to their release SHAs (v3 / v2.7.1 kept as trailing comments). All behaviour-preserving: 104 goldens match + compile, benchmark byte-identical (slug + stamp changes verified), workflows parse. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Benchmark: ✅ PASS
|
commit: |
Tara-ag
approved these changes
Jul 22, 2026
Tara-ag
left a comment
Tara-ag
left a comment
There was a problem hiding this comment.
Review Summary
Files reviewed: 6
New issues raised: 0 (CRITICAL: 0, MAJOR: 0, MINOR: 0, SUGGESTION: 0)
This is a behavior-preserving chore PR that clears pre-existing CodeQL baseline alerts:
- Workflow hardening:
permissions: contents: readadded to CI jobs; action tags pinned to full commit SHAs with version comments. - TOCTOU fixes:
existsSync-then-read/write patterns replaced with direct operations insidetry/catchinsrc/cli.mjs,benchmark/run.mjs, andtest/lib/diff.mjs. - Dead-code removal: the
slugOfidentity no-op removed; comment correctly notes that a leading@already becomes_.
No generated ReScript or mapping logic is touched, so the binding-safety and determinism guarantees are unaffected. No hardcoded secrets, unsafe casts, type-variable regressions, or nondeterminism introduced. Approved.
Merged
jagguji
added a commit
that referenced
this pull request
Jul 22, 2026
First stable (`latest`) release since **v1.2.4**. Bumps `package.json` 1.2.6-beta.10 → **1.3.0** and closes the `[Unreleased]` CHANGELOG section as `[1.3.0]`. ## What's in it (since 1.2.4) - **Resolution:** exports-map + `typesVersions` entry resolution (#104); **subpath binding** `--subpaths` (#147). - **Chart fidelity (#120):** bare `Function` → `JsFn` opaque module + `boolean|Config` unions (Part A); `object|Config` → opaque module + `string|object` → `@unboxed` (Part B). - **Props modelling:** discriminated-union props keep per-branch requiredness via `@tag` (`--variant-props`, #65); **record-props is now the output form for every component** (#155). - **Fixes:** array-hybrid `...JsxDOM.domProps` (#144), React class components (#101), the #109 coverage-papercut batches, structural-name stability across compiler versions (#90), and more. - **Infra:** CodeQL baseline hardening (#157), `setup-node@v7` (#152). ##⚠️ Upgrading (the one thing to note) **JSX call sites are unchanged.** The only output-form change: every component now binds `type props = {…}` + `external make: React.component<props>` (#155). A *direct* `Button.make(~label="x")` labeled-args call becomes `React.createElement(Button.make, {label: "x"})`. JSX-only consumers just regenerate. Chosen as a **minor** (1.3.0), not major — the tool's CLI is backward-compatible and the record-props flip is a one-time regen for consumers (validated end-to-end against `blend-rescript`: 215/222 usable, all 299 modules compile). ## Release mechanism After merge, tagging `v1.3.0` on main triggers `publish-npm.yml` → `npm publish` to the **`latest`** dist-tag (plain version → `latest`). Verified: 105 goldens match + compile, benchmark equal-metrics. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repo has 9 open CodeQL alerts on
main(visible in the default-branch scan). None come from any feature PR — they get re-attributed onto large-regeneration PRs (#153, #156) by CodeQL's "changes too large" re-scan, showing up as a red aggregate CodeQL check even though theAnalyzejobs pass. This clears the root debt so that check goes green.Fixes
Code —
js/file-system-race(high ×3) +js/identity-replacement(medium)test/lib/diff.mjs—readdirSync(dir, { withFileTypes: true })instead ofreaddir+ a separatestatSync(the stat is a check-then-read TOCTOU: the file could vanish between the two syscalls).src/cli.mjs—unlinkdirectly inside the existing try/catch instead ofexistsSync-then-unlink(the check-then-unlink is the race; the catch already handles "already gone").benchmark/run.mjs— read the prior lock-stamp via try/catch instead ofexistsSync-then-readFileSync; and drop the.replace(/^_/, '_')inslugOf, which was an identity no-op ("@s/p"→"_s_p"already starts with_).Workflows —
actions/missing-workflow-permissions(medium ×3) +actions/unpinned-tag(medium ×2)ci.yml— addpermissions: contents: readto thetest/compile/fixture-guardjobs (least-privilege; thepreviewjob already declared its own).benchmark.yml+yama-review.yml— pinmarocchino/sticky-pull-request-commentandjuspay/yamato their release commit SHAs, with the# v3/# v2.7.1version as trailing comments (the CodeQL-recommended form). Note:yama-review.ymlis generated by juspay/yama's setup script, so a future regen may need the pin re-applied.Safety
All behaviour-preserving — verified: 104 goldens match + compile, benchmark byte-identical (the
slugOfand lock-stamp changes are proven by the baselines still resolving), and the workflows parse. Nosrc/runtime logic changed (thecli.mjsedit is the--cleanstale-file removal, same effect).After this merges, the pre-existing alerts clear repo-wide and the red CodeQL check on #156 (and future large-regen PRs) goes green.
🤖 Generated with Claude Code