[pr-review] Daily PR Code Quality Review — 34316107420

[github-actions]

Summary

PR	Title	Author	Top Issues	Quality
#59636	Fix threat detection config_error for workflows using custom engines	Copilot	0	🟢
#59629	build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2	dependabot[bot]	0	🟢
#59613	[compiler-threat-spec] Daily threat spec optimizer: audit cycle 2026-09-09	github-actions[bot]	0	🟢
#59612	[community] Update community contributions in README	github-actions[bot]	0	🟢
#59572	Add cached JSON reuse to the logs command	Copilot	0	🟢

Overall daily signal: 🟢 (all reviewed PRs averaged ≤1 issue/PR).

Full Findings

PR #59636 — Fix threat detection config_error for workflows using custom engines

• New/changed exported types and functions (EngineDefinition.DetectionEngine, emitCustomEngineThreatDetectionWarning, resolveCustomEngineDetectionEngineID, isThreatDetectionCapableEngineID, inheritedDetectionModel) all carry doc comments explaining intent.
• Error/fallback paths are handled explicitly (falls back to defaultThreatDetectionEngineID and logs via threatLog.Printf when an unsupported detection-engine is declared) — no missing if err != nil gaps observed in the diff.
• New test file threat_detection_custom_engine_test.go uses require/assert with concrete expectations (not just t.Log), covering fallback, custom detection-engine, ID normalization, and warning-message content.
• No function in the diff exceeds ~80 lines; existing buildDetectionEngineExecutionStep is pre-existing code with a (nolint/redacted):largefunc marker, not newly introduced complexity.
• Minor: the diff also updates a .lock.yml and unrelated (nolint/redacted) comments in engine_definition.go (auto-generated/lint housekeeping, not a functional risk).

PR #59629 — Bump js-yaml 4.3.1 → 4.3.2 (dependabot)

• Pure package-lock.json dependency bump; no application code, no Go changes.
• No error handling, doc comment, test, or function-size concerns apply.

PR #59613 — Daily threat spec optimizer audit cycle

• Documentation-only change to specs/compiler-threat-detection-spec.md (spec restructuring/condensation, version bump 1.0.30 → 1.0.31).
• No Go/test files touched; no code-quality checks applicable.

PR #59612 — Update community contributions in README

• Auto-generated README.md contributor-count updates only.
• No code, tests, or functions affected.

PR #59572 — Add cached JSON reuse to the logs command

• New file pkg/cli/logs_cached_json.go includes doc comments on exported/unexported helpers (loadCachedLogsJSON, lookup, normalizeCachedLogRun, cachedJSONCanSatisfy).
• Error handling is explicit: os.ReadFile and json.Unmarshal errors are wrapped with fmt.Errorf; missing runs array is surfaced as an error rather than silently ignored.
• lookup performs multiple compatibility guards (status, attempt, updated-at, repository, engine, artifact-dependent filters) before allowing cache reuse — conservative by design, reducing risk of stale-data bugs.
• New tests in logs_cached_json_test.go and logs_command_test.go use require/assert with real value checks (not log-only tests).
• No function observed in the excerpted diff exceeds ~30 lines; no oversized-function concern found in the reviewed sections.

Generated by 🖱️ Daily PR Code Quality Review · copilot · auto · 36.7 AIC · ⌖ 5.7 AIC · ⊞ 6.6K · ◷

• expires on Sep 9, 2026, 9:51 PM UTC-08:00