PR-06: Checkpoint schema + cache invalidation + CI self-test (scanner) - #35
Merged
Merged
Conversation
- schemas/dsgai-scan.schema.json: formal schema for DSGAI-scan.json that
FORBIDS match_text/content/value/raw_grep_output on every finding
('field': false, not 'not/required' which would miss a lone field). The
redaction guarantee is now machine-checkable.
- CLI self-validates the checkpoint (stdlib, no jsonschema at runtime) before
writing and refuses to emit a finding carrying match content (exit 2).
- checkpoint_is_valid(): cache invalidation — a checkpoint may be reused only at
the current HEAD, on a clean tree, with the current ruleset. The skill's
resume logic uses this from PR-07 on; never serve stale findings with a fresh
date.
- .github/workflows/scanner-selftest.yml: installs ripgrep, runs pytest,
validates the ruleset + a fixture scan against their schemas, and asserts the
JSON stays in sync with the YAML. This is the gate that makes external rule
PRs safely mergeable.
- Fixed the PCRE compile check to key on rg's exit code (>=2) instead of the
string 'regex parse error' — PCRE2 emits a different message, so the old
check would have missed a broken PCRE2 pattern (and not failed CI). Added a
guard-the-guard test.
Acceptance: pytest green (16 checks); schema rejects a match_text finding
(negative test); a deliberately broken PCRE is detected by exit code.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| @requires_rg | ||
| def test_checkpoint_validates_against_schema(scan): | ||
| jsonschema = pytest.importorskip("jsonschema") | ||
| schema = json.loads(open(SCAN_SCHEMA, encoding="utf-8").read()) |
| """The redaction guarantee is machine-checkable: a finding carrying match | ||
| content must be rejected by the checkpoint schema.""" | ||
| jsonschema = pytest.importorskip("jsonschema") | ||
| schema = json.loads(open(SCAN_SCHEMA, encoding="utf-8").read()) |
|
|
||
| def test_rules_validate_against_schema(): | ||
| jsonschema = pytest.importorskip("jsonschema") | ||
| rules = yaml.safe_load(open(RULES_YAML, encoding="utf-8")) |
| def test_rules_validate_against_schema(): | ||
| jsonschema = pytest.importorskip("jsonschema") | ||
| rules = yaml.safe_load(open(RULES_YAML, encoding="utf-8")) | ||
| schema = json.loads(open(RULES_SCHEMA, encoding="utf-8").read()) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes Phase 1 (the trust foundation). Depends on PR-05.
What's here
schemas/dsgai-scan.schema.json— formal schema forDSGAI-scan.json. It forbidsmatch_text/content/value/raw_grep_outputon every finding via"field": false(not"not": {"required": [...]}, which would let a lone forbidden field slip through). The redaction guarantee is now machine-checkable.self_validate_checkpoint()runs before writing (stdlib only, no jsonschema at runtime) and refuses (exit 2) to emit a finding carrying match content.checkpoint_is_valid()reuses a checkpoint only at the current HEAD, on a clean working tree, with the current ruleset. The skill's resume logic calls this from PR-07 on. A compliance artifact must never serve stale findings with a fresh date..github/workflows/scanner-selftest.yml— installs ripgrep, runs pytest, validates the ruleset + a fixture scan against their schemas, and checks JSON⇄YAML sync. This is the gate that makes external rule PRs safely mergeable.Bug fixed while here
The PCRE compile check keyed on the string
"regex parse error"— but--pcre2emits"PCRE2: error compiling...". So a broken PCRE2 pattern would have passed the check and not failed CI, defeating the whole gate. Now it keys on rg's exit code (>=2), with a guard-the-guard test.Verification (all local)
pytest tests/ -q→ 14 passed (adds checkpoint-schema, ruleset-schema, match_text-rejection, self-guard, and compile-guard tests).match_text(the acceptance negative test).actionlintclean; both action SHAs verified real (checkoutv4.2.2,setup-pythonv5.3.0).After this merges, CONTRIBUTING's "rule PRs welcome once the self-test lands" is now true.