security: require zero CodeQL findings#64
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e44d2ae681
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| with: | ||
| output: codeql-results | ||
| - name: Require clean CodeQL results | ||
| run: python scripts/check_codeql_sarif.py "${{ steps.analyze.outputs.sarif-output }}" |
There was a problem hiding this comment.
analyze exposes sarif-output as the generated SARIF file path, but check_codeql_sarif.py treats its argument as a directory and calls rglob("*.sarif"). Since Path.rglob on that file returns no results, both matrix jobs fail with “no SARIF files found” even when CodeQL is clean, blocking every PR and main push. Pass the configured codeql-results directory instead, or make the checker accept an individual SARIF file.
Useful? React with 👍 / 👎.
| domain = text[domain_start:end] | ||
| dot = domain.rfind(".") | ||
| suffix = domain[dot + 1:] if dot > 0 else "" | ||
| if len(suffix) >= 2 and all(char in _EMAIL_SUFFIX_CHARS for char in suffix): | ||
| yield start, end, text[start:end] |
There was a problem hiding this comment.
When an email is followed by a period, such as bob@acme.com., the domain scan consumes the terminal period because . is allowed in _EMAIL_DOMAIN_CHARS; rfind then sees that final period and produces an empty suffix, so no email is emitted. This common prose case regresses the former regex behavior and can additionally produce the spurious @acme mention from the independent mention matcher. Trim trailing dots (and preserve the last non-empty label) before validating and yielding; the same copied logic in engines/ingest.py needs the equivalent fix.
Useful? React with 👍 / 👎.
2 participants
Summary
mainVerification
The public release tag remains held fail-closed on the separate live backup, restore, alert-delivery, and paid-canary launch gates.