ci(repo-size): phase-1 prevention for AWS Security Agent 512 MB clone limit by emooreatx · Pull Request #758 · CIRISAI/CIRISAgent

emooreatx · 2026-05-15T03:34:24Z

AWS Security Agent's code review refuses to clone repos >512 MB. Working
tree is 397 MB and .git is 207 MB (~600 MB total), mostly historical binary
churn (Resources.zip × 12, libciris_verify_ffi.so × 33, etc).

Phase 1 (this commit) installs guardrails so the situation can't recur and
shrinks the pip-shipped tree slightly. The destructive history rewrite that
actually drops repo size below 512 MB is deferred to Phase 2 (separate
coordinated PR; needs CI updates so Resources.zip + jniLibs are rebuilt
from source instead of expected in-tree).

Changes:

.pre-commit-config.yaml: tighten check-added-large-files 500 → 250 KB,
document the intentionally-tracked allowlist (cities.db, android wheels)
.gitignore: add coverage.json (sibling of coverage.xml / .coverage)
coverage.json: git rm --cached (2.3 MB; generated artifact, working tree
copy preserved)
.github/workflows/repo-size-audit.yml: advisory CI job that reports pack
size + largest blobs and warns at 250 MiB, fails at 450 MiB
CLAUDE.md: add Repo Size entry under Quality Standards pointing at the
canonical fetch-from-release pattern (tools/update_ciris_verify.py)

Honest caveat: this PR does NOT bring the repo under 512 MB. GitHub still
reports it >512 MB because the historical churn is in the pack. AWS Security
Agent will continue to refuse to clone until Phase 2 lands.

https://claude.ai/code/session_01SVPXzanrJYFBdhpkg8HsfB

… limit AWS Security Agent's code review refuses to clone repos >512 MB. Working tree is 397 MB and .git is 207 MB (~600 MB total), mostly historical binary churn (Resources.zip × 12, libciris_verify_ffi.so × 33, etc). Phase 1 (this commit) installs guardrails so the situation can't recur and shrinks the pip-shipped tree slightly. The destructive history rewrite that actually drops repo size below 512 MB is deferred to Phase 2 (separate coordinated PR; needs CI updates so Resources.zip + jniLibs are rebuilt from source instead of expected in-tree). Changes: - .pre-commit-config.yaml: tighten check-added-large-files 500 → 250 KB, document the intentionally-tracked allowlist (cities.db, android wheels) - .gitignore: add coverage.json (sibling of coverage.xml / .coverage) - coverage.json: git rm --cached (2.3 MB; generated artifact, working tree copy preserved) - .github/workflows/repo-size-audit.yml: advisory CI job that reports pack size + largest blobs and warns at 250 MiB, fails at 450 MiB - CLAUDE.md: add Repo Size entry under Quality Standards pointing at the canonical fetch-from-release pattern (tools/update_ciris_verify.py) Honest caveat: this PR does NOT bring the repo under 512 MB. GitHub still reports it >512 MB because the historical churn is in the pack. AWS Security Agent will continue to refuse to clone until Phase 2 lands. https://claude.ai/code/session_01SVPXzanrJYFBdhpkg8HsfB

cla-assistant · 2026-05-15T03:34:38Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ emooreatx
❌ claude
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cla-assistant · 2026-05-15T03:34:41Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d332bcf404

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-15T03:38:36Z

      - id: check-added-large-files
-        args: ['--maxkb=500']
+        args: ['--maxkb=250']


Honor allowlisted binaries in large-file pre-commit hook

The new check-added-large-files setting enforces --maxkb=250 but does not configure any exclude for the files this same block describes as intentionally allowlisted (cities.db and Android wheel artifacts). Because this hook checks newly added files, routine wheel version bumps (new client/androidApp/wheels/pydantic_core-...whl filenames) will be rejected and force developers to bypass hooks, which directly contradicts the stated policy and can block normal Android packaging updates.

Useful? React with 👍 / 👎.

Per PR feedback (P2 Badge Honor): the new check-added-large-files hook at --maxkb=250 doesn't actually exclude the files this same block describes as intentionally allowlisted. Wheel version-bumps (e.g., pydantic_core-2.23.4-...whl → 2.24.0-...whl) are "new files" to the hook and would be rejected — forcing developers to bypass with --no-verify, contradicting the policy stated in the comment. Fix: add an `exclude:` regex covering cities.db + the wheels/ glob. Same `(?x)^(...)$` shape as the global exclude at the bottom of the file. Documented requirement for additions: must meet the same justification standard as bypassing the hook would. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

sonarqubecloud · 2026-05-15T13:49:22Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…1 gate Two bugs in the size-audit workflow (cherry-picked from PR #758): 1. **Broken pipe**: `sort | head -20` with `set -euo pipefail` failed step 2 (and would fail step 3) with exit 141 from SIGPIPE — the top-20 listing prints correctly but the step fails on cleanup, masking the real signal. Fixed by switching to `awk 'NR<=20'` which reads its full input and never closes the pipe early. 2. **Thresholds dead-letter for Phase 1 state**: workflow had WARN=250 / FAIL=450 MiB but actual repo pack is ~1,121 MiB from historical binary churn (libciris_verify_ffi × N platforms × N versions, Resources.zip × N, llama-server-arm64, etc.). The FAIL was a permanent red ❌ on every CI run with no actionable fix in this PR (the BFG history rewrite is Phase 2). That trains alert fatigue — exactly the failure mode the workflow exists to prevent. Fix: Phase 1 is advisory-only. New env knob `FAIL_HARD=false` downgrades >=FAIL to a warning instead of a hard error. Bumped WARN=1300 / FAIL=1500 so we surface regressions worse than today's baseline without spamming the current state. Phase 2 plan documented inline: when BFG history rewrite drops pack to ~205 MiB, flip the env block to WARN=250 / FAIL=450 / FAIL_HARD=true and the gate becomes blocking again. Net effect: workflow now does its actual job — lists the largest tracked files + largest historical blobs without erroring, surfaces size growth as warnings, doesn't block CI on a pre-existing condition that has its own remediation plan. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

emooreatx · 2026-05-15T15:41:09Z

Subsumed by #759. All Phase 1 repo-size work has been brought into the 2.8.12 patch release for consolidated shipping:

2d237b3c9 — cherry-pick of the original prevention commit (.pre-commit-config.yaml 500→250 KB, .gitignore coverage.json, coverage.json git-rm, CLAUDE.md policy doc, the repo-size-audit.yml workflow)
432011d1c — cherry-pick of my earlier exclude-regex fix (cities.db + Android wheels allowlist)
d069ad93d — new: fix two bugs in the size-audit workflow
- Broken pipe: sort | head -20 with set -euo pipefail exited 141 from SIGPIPE; switched to awk 'NR<=20' which reads its full input
- Threshold realism: WARN=250/FAIL=450 was a permanent red ❌ vs actual ~1,121 MiB pack. Made Phase 1 advisory-only with FAIL_HARD=false, bumped WARN=1300/FAIL=1500 to surface regressions worse than today without spamming. Phase 2 plan documented inline (drop to 250/450 + FAIL_HARD=true once BFG history rewrite lands).

This PR can be closed after #759 merges. Closing will be tracked in #759's description.

🤖 Generated with Claude Code

chatgpt-codex-connector Bot reviewed May 15, 2026

View reviewed changes

This was referenced May 15, 2026

v2.8.12: wire-contract guards (UNKNOWN_PARENT + lat/lng region-fuzz) + FFI loader + lang reinforcement #759

Closed

v2.8.12: wire-contract guards + FFI loader + lang reinforcement + Phase 1 repo-size #762

Merged

Navigation Menu

Uh oh!

ci(repo-size): phase-1 prevention for AWS Security Agent 512 MB clone limit - #758

ci(repo-size): phase-1 prevention for AWS Security Agent 512 MB clone limit#758
emooreatx wants to merge 2 commits into
mainfrom
claude/fix-repo-size-limit-kGeIc

emooreatx commented May 15, 2026

Uh oh!

cla-assistant Bot commented May 15, 2026 •

edited

Loading

Uh oh!

cla-assistant Bot commented May 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 15, 2026

Uh oh!

sonarqubecloud Bot commented May 15, 2026

Uh oh!

emooreatx commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

emooreatx commented May 15, 2026

Uh oh!

cla-assistant Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cla-assistant Bot commented May 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 15, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented May 15, 2026

Quality Gate passed

Uh oh!

emooreatx commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cla-assistant Bot commented May 15, 2026 •

edited

Loading