From bdc7065c6cdc90d97aff3443c1979c2fe9641d5a Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 14:22:13 +0100 Subject: [PATCH 1/4] fix(ci): the invisible-character gate never matched anything MEASURED 2026-08-27: this gate's pattern caught 0 OF 6 invisible-character test cases. It has never detected an NBSP, zero-width space, BOM, soft hyphen, bidi override or word joiner. ROOT CAUSE: the pattern used UTF-8 BYTE sequences (\xc2\xa0) while grep -P matches CHARACTERS. Bytes c2 a0 are ONE character U+00A0; \xc2\xa0 asks for TWO characters, U+00C2 then U+00A0, which is never present. grep -P '\xc2\xa0' -> miss grep -P '\x{a0}' -> MATCH Only \x00 worked, being single-byte in both readings. FIXED: codepoint escapes; C0 control characters \x01-\x08,\x0B,\x0C,\x0E-\x1F added (TAB/LF/CR excluded); and grep -a, without which grep skips any NUL-bearing file as binary. The C0 range matters: a stray BACKSPACE byte made a workflow unparseable in developer-ecosystem, so it never ran, and this linter called it clean. Canonical fix: hyperpolymath/empty-linter#70. 1 file(s) here. VERIFIED: YAML re-parsed, and the corrected pattern was confirmed to catch a real NBSP before the change was kept. --- .github/workflows/dogfood-gate.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index f69883d1..1b15f656 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -150,7 +150,7 @@ jobs: # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens, # non-breaking spaces, null bytes, and other invisible Unicode in source files. set +e - PATTERNS='\xc2\xa0|\xe2\x80\x8b|\xe2\x80\x8c|\xe2\x80\x8d|\xef\xbb\xbf|\xc2\xad|\xe2\x80\x8e|\xe2\x80\x8f|\xe2\x80\xaa|\xe2\x80\xab|\xe2\x80\xac|\xe2\x80\xad|\xe2\x80\xae|\x00' + PATTERNS='\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]|\x{a0}|\x{ad}|\x{200b}|\x{200c}|\x{200d}|\x{200e}|\x{200f}|\x{202a}|\x{202b}|\x{202c}|\x{202d}|\x{202e}|\x{2060}|\x{feff}' find "$GITHUB_WORKSPACE" \ -not -path '*/.git/*' -not -path '*/node_modules/*' \ -not -path '*/.deno/*' -not -path '*/target/*' \ @@ -161,7 +161,7 @@ jobs: -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \ -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \ -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \ - -exec grep -Prl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null + -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null EL_EXIT=$? set -e From 4e5a45d3db44815dafaef9a9b3e673e299fb5309 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 28 Aug 2026 16:35:47 +0100 Subject: [PATCH 2/4] fix(ci): make invisible-character PCRE locale-independent --- .github/workflows/dogfood-gate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 1b15f656..60d8e224 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -150,7 +150,7 @@ jobs: # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens, # non-breaking spaces, null bytes, and other invisible Unicode in source files. set +e - PATTERNS='\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]|\x{a0}|\x{ad}|\x{200b}|\x{200c}|\x{200d}|\x{200e}|\x{200f}|\x{202a}|\x{202b}|\x{202c}|\x{202d}|\x{202e}|\x{2060}|\x{feff}' + PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]' find "$GITHUB_WORKSPACE" \ -not -path '*/.git/*' -not -path '*/node_modules/*' \ -not -path '*/.deno/*' -not -path '*/target/*' \ From 86fbcab11d1fd1040ce1743b05bf4a6b30111f64 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 4 Sep 2026 18:40:39 +0100 Subject: [PATCH 3/4] Update .github/workflows/dogfood-gate.yml Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/dogfood-gate.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 60d8e224..345bc8e0 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -161,7 +161,7 @@ jobs: -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \ -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \ -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \ - -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null + -exec grep -aPl "$PATTERNS" {} + > /tmp/empty-lint-results.txt 2>/dev/null EL_EXIT=$? set -e From 6af0f1b65dd03d5e34cf32461df4055c63331024 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 00:28:47 +0100 Subject: [PATCH 4/4] =?UTF-8?q?=F0=9F=94=A7=20CodeRabbit=20CI=20Fix:=20Fix?= =?UTF-8?q?=20failing=20CI=20checks=20across=20security,=20Rust,=20and=20g?= =?UTF-8?q?overnance=20workflows=20(#513)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI failure fixes was requested by @hyperpolymath. * https://github.com/hyperpolymath/gitbot-fleet/pull/497#issuecomment-5439764257 The following files were modified: * `bots/seambot/tests/github_integration.rs` * `dashboard/src/main.rs` * `robot-repo-automaton/src/fixer.rs` Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- bots/seambot/tests/github_integration.rs | 2 +- dashboard/src/main.rs | 11 +- robot-repo-automaton/src/fixer.rs | 406 ++++++++++++++++++++++- 3 files changed, 401 insertions(+), 18 deletions(-) diff --git a/bots/seambot/tests/github_integration.rs b/bots/seambot/tests/github_integration.rs index 3f5173b2..8cdb39c6 100644 --- a/bots/seambot/tests/github_integration.rs +++ b/bots/seambot/tests/github_integration.rs @@ -153,7 +153,7 @@ mod tests { let response = r#"{ "token": "ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "expires_at": "2024-01-15T12:00:00Z" - }"#; + }"#; // gitleaks:allow -- placeholder token (all 'x's), not a real credential let parsed: serde_json::Value = serde_json::from_str(response).unwrap(); assert!(parsed["token"].as_str().unwrap().starts_with("ghs_")); diff --git a/dashboard/src/main.rs b/dashboard/src/main.rs index b8f8f501..dede6a8c 100644 --- a/dashboard/src/main.rs +++ b/dashboard/src/main.rs @@ -175,7 +175,11 @@ async fn report_handler( match format.to_lowercase().as_str() { "html" => (StatusCode::OK, [("content-type", "text/html")], report), - "json" => (StatusCode::OK, [("content-type", "application/json")], report), + "json" => ( + StatusCode::OK, + [("content-type", "application/json")], + report, + ), _ => (StatusCode::OK, [("content-type", "text/plain")], report), } } @@ -211,10 +215,7 @@ async fn websocket_handler( } /// Handle WebSocket connection -async fn websocket_connection( - mut socket: axum::extract::ws::WebSocket, - state: AppState, -) { +async fn websocket_connection(mut socket: axum::extract::ws::WebSocket, state: AppState) { use axum::extract::ws::Message; use tokio::time::{interval, Duration}; diff --git a/robot-repo-automaton/src/fixer.rs b/robot-repo-automaton/src/fixer.rs index c288a44d..91a788ad 100644 --- a/robot-repo-automaton/src/fixer.rs +++ b/robot-repo-automaton/src/fixer.rs @@ -1,12 +1,394 @@ - content - .replace("gitbot-fleet", repo_name) - .replace("{{LICENSE}}", "MPL-2.0") - .replace("{{YEAR}}", &year) - .replace("{{AUTHOR}}", "Jonathan D.A. Jewell") - .replace("{{EMAIL}}", "j.d.a.jewell@open.ac.uk"); - content - .replace("gitbot-fleet", repo_name) - .replace("{{LICENSE}}", "MPL-2.0") - .replace("{{YEAR}}", &year) - .replace("{{AUTHOR}}", "Jonathan D.A. Jewell") - .replace("{{EMAIL}}", "j.d.a.jewell@open.ac.uk") +// SPDX-License-Identifier: MPL-2.0 +//! Fix application - delete, modify, create, disable. + +use regex::Regex; +use std::fs; +use std::path::{Component, Path, PathBuf}; + +use crate::catalog::{Fix, FixAction}; +use crate::detector::DetectedIssue; +use crate::error::{Error, Result}; + +/// Result of applying a single fix. +#[derive(Debug, Clone)] +pub struct FixResult { + pub success: bool, + pub files_modified: Vec, + pub action_taken: String, + pub error: Option, +} + +/// Applies fixes to a repository on disk. +pub struct Fixer { + repo_path: PathBuf, + dry_run: bool, +} + +impl Fixer { + /// Create a new fixer for the given repository. + pub fn new(repo_path: PathBuf, dry_run: bool) -> Self { + Self { repo_path, dry_run } + } + + /// Resolve a fix target relative to the repository root, rejecting any + /// path that would escape the repository. The target need not exist + /// (e.g. for `Create`), so this is pure path arithmetic. + fn resolve_target(&self, target: &str) -> Result { + let joined = self.repo_path.join(target); + + let mut normalized = PathBuf::new(); + for component in joined.components() { + match component { + Component::ParentDir => { + if !normalized.pop() { + return Err(Error::Fix(format!( + "Fix target '{target}' resolves outside the repository" + ))); + } + } + Component::CurDir => {} + other => normalized.push(other), + } + } + + if !normalized.starts_with(&self.repo_path) { + return Err(Error::Fix(format!( + "Fix target '{target}' resolves outside the repository" + ))); + } + + Ok(normalized) + } + + /// Apply a single fix, returning the outcome. A rejected or failed fix + /// is reported via `FixResult`, not `Err` (the operation itself did not + /// error; the requested change simply could not be made safely). + pub fn apply(&self, _issue: &DetectedIssue, fix: &Fix) -> Result { + let target = match self.resolve_target(&fix.target) { + Ok(path) => path, + Err(e) => { + return Ok(FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "rejected".to_string(), + error: Some(e.to_string()), + }); + } + }; + + let result = match fix.action { + FixAction::Delete => self.apply_delete(&target), + FixAction::Modify => self.apply_modify(&target, fix), + FixAction::Create => self.apply_create(&target, fix), + FixAction::Disable => FixResult { + success: true, + files_modified: Vec::new(), + action_taken: "Disable: no-op, manual review required".to_string(), + error: None, + }, + }; + + Ok(result) + } + + fn apply_delete(&self, target: &Path) -> FixResult { + if !target.exists() { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("Delete: {} already absent", target.display()), + error: None, + }; + } + + if self.dry_run { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("DRY RUN: would delete {}", target.display()), + error: None, + }; + } + + match fs::remove_file(target) { + Ok(()) => FixResult { + success: true, + files_modified: vec![target.to_path_buf()], + action_taken: format!("Deleted {}", target.display()), + error: None, + }, + Err(e) => FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Delete: failed".to_string(), + error: Some(e.to_string()), + }, + } + } + + fn apply_create(&self, target: &Path, fix: &Fix) -> FixResult { + if target.exists() { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("Create: {} already exists", target.display()), + error: None, + }; + } + + if self.dry_run { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("DRY RUN: would create {}", target.display()), + error: None, + }; + } + + if let Some(parent) = target.parent() { + if let Err(e) = fs::create_dir_all(parent) { + return FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Create: failed".to_string(), + error: Some(e.to_string()), + }; + } + } + + let content = fix.fallback.clone().unwrap_or_default(); + match fs::write(target, content) { + Ok(()) => FixResult { + success: true, + files_modified: vec![target.to_path_buf()], + action_taken: format!("Created {}", target.display()), + error: None, + }, + Err(e) => FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Create: failed".to_string(), + error: Some(e.to_string()), + }, + } + } + + fn apply_modify(&self, target: &Path, fix: &Fix) -> FixResult { + let Some(modification) = fix.modification.as_deref() else { + return FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Modify: failed".to_string(), + error: Some("Modify fix has no modification instruction".to_string()), + }; + }; + + let original = match fs::read(target) { + Ok(bytes) => bytes, + Err(e) => { + return FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Modify: failed".to_string(), + error: Some(e.to_string()), + }; + } + }; + + let original_text = match String::from_utf8(original) { + Ok(text) => text, + Err(_) => { + return FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Modify: failed".to_string(), + error: Some(format!( + "Refusing to modify binary file {}", + target.display() + )), + }; + } + }; + + let new_text = match Self::apply_modification(&original_text, modification) { + Ok(text) => text, + Err(e) => { + return FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Modify: failed".to_string(), + error: Some(e), + }; + } + }; + + if self.dry_run { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("DRY RUN: would modify {}", target.display()), + error: None, + }; + } + + if new_text == original_text { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("Modify: {} already up to date", target.display()), + error: None, + }; + } + + match fs::write(target, new_text) { + Ok(()) => FixResult { + success: true, + files_modified: vec![target.to_path_buf()], + action_taken: format!("Modified {}", target.display()), + error: None, + }, + Err(e) => FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Modify: failed".to_string(), + error: Some(e.to_string()), + }, + } + } + + /// Apply a `replace-line:`, `replace-pattern:`, `insert-before:` or + /// `insert-after:` modification instruction to `content`. + fn apply_modification( + content: &str, + modification: &str, + ) -> std::result::Result { + if let Some(rest) = modification.strip_prefix("replace-pattern:") { + let (pattern, replacement) = rest + .split_once(':') + .ok_or_else(|| "Invalid replace-pattern instruction".to_string())?; + let re = Regex::new(pattern).map_err(|e| format!("Invalid regex: {e}"))?; + return Ok(re.replace_all(content, replacement).into_owned()); + } + + let mut lines: Vec = content.lines().map(str::to_string).collect(); + let trailing_newline = content.ends_with('\n'); + + if let Some(rest) = modification.strip_prefix("replace-line:") { + let (line_no, replacement) = rest + .split_once(':') + .ok_or_else(|| "Invalid replace-line instruction".to_string())?; + let line_no: usize = line_no + .parse() + .map_err(|_| "Invalid line number in replace-line instruction".to_string())?; + if line_no == 0 || line_no > lines.len() { + return Err(format!( + "replace-line: line {line_no} does not exist (file has {} lines)", + lines.len() + )); + } + lines[line_no - 1] = replacement.to_string(); + } else if let Some(rest) = modification.strip_prefix("insert-before:") { + let (line_no, text) = rest + .split_once(':') + .ok_or_else(|| "Invalid insert-before instruction".to_string())?; + let line_no: usize = line_no + .parse() + .map_err(|_| "Invalid line number in insert-before instruction".to_string())?; + if line_no == 0 || line_no > lines.len() + 1 { + return Err(format!( + "insert-before: line {line_no} does not exist (file has {} lines)", + lines.len() + )); + } + lines.insert(line_no - 1, text.to_string()); + } else if let Some(rest) = modification.strip_prefix("insert-after:") { + let (line_no, text) = rest + .split_once(':') + .ok_or_else(|| "Invalid insert-after instruction".to_string())?; + let line_no: usize = line_no + .parse() + .map_err(|_| "Invalid line number in insert-after instruction".to_string())?; + if line_no == 0 || line_no > lines.len() { + return Err(format!( + "insert-after: line {line_no} does not exist (file has {} lines)", + lines.len() + )); + } + lines.insert(line_no, text.to_string()); + } else { + return Err(format!("Unknown modification instruction: {modification}")); + } + + let mut result = lines.join("\n"); + if trailing_newline { + result.push('\n'); + } + Ok(result) + } + + /// Apply a batch of auto-approved fixes and commit the results locally. + pub fn apply_and_commit( + &self, + _issues: &[DetectedIssue], + auto_fixes: &[(DetectedIssue, Fix)], + ) -> Result> { + let mut results = Vec::with_capacity(auto_fixes.len()); + let mut modified: Vec = Vec::new(); + let mut messages: Vec = Vec::new(); + + for (issue, fix) in auto_fixes { + let result = self.apply(issue, fix)?; + if result.success && !result.files_modified.is_empty() { + modified.extend(result.files_modified.clone()); + messages.push(issue.commit_message.clone()); + } + results.push(result); + } + + if !self.dry_run && !modified.is_empty() { + self.commit_changes(&modified, &messages)?; + } + + Ok(results) + } + + /// Stage and commit the given files in the local repository. + fn commit_changes(&self, files: &[PathBuf], messages: &[String]) -> Result<()> { + let repo = git2::Repository::open(&self.repo_path)?; + let mut index = repo.index()?; + + for file in files { + let relative = file.strip_prefix(&self.repo_path).unwrap_or(file); + if file.exists() { + index.add_path(relative)?; + } else { + let _ = index.remove_path(relative); + } + } + index.write()?; + + let tree_id = index.write_tree()?; + let tree = repo.find_tree(tree_id)?; + let signature = git2::Signature::now("robot-repo-automaton", "noreply@hyperpolymath.dev")?; + + let message = if messages.is_empty() { + "fix: automated compliance fixes".to_string() + } else { + messages.join("\n") + }; + + let parent_commit = repo.head().ok().and_then(|h| h.peel_to_commit().ok()); + let parents: Vec<&git2::Commit> = parent_commit.iter().collect(); + + repo.commit( + Some("HEAD"), + &signature, + &signature, + &message, + &tree, + &parents, + )?; + + Ok(()) + } +}