Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Round 12 follow-ups: IaC/model duplicate, check-run count, invalid Mermaid, confidence labels

Open
  • Is something wrong?
#952 7 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
30/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, java
Domain
devtools

Research direction

The four defects sit in the review pipeline: the IaC/model finding dedup, the check-run title counts, the summary Mermaid rendering, and the confidence capping. Start with the scan-versus-model dedup code and the secret-scan dedup it should mirror, then the check-run title builder. Done means the acceptance criteria pass, with tests covering same-line IaC duplicates, open-total titles, and a dropped invalid Mermaid block.

Written by the indexing model from the issue text.

Description

bug java

Round 12 (v0.7.0 RC4, 2e6dccf), smaller defects:

  1. Deterministic IaC finding duplicated by a model finding on the same line: ThrillhouseBot-test#158 threads 4149725874 (scan) and 4149716341 (model), both on node/Dockerfile:16 (runs as root).
  2. Check-run title counts only the new round's findings: #158 check run 110121261126 says "1 findings" while 20 are open; #149 says "6 findings: 0 critical, 0 high…" while 21 are open.
  3. Invalid Mermaid in the summary diagram: #154 round 1 uses -> edges, round 2 has a stray comma in PE["pending"],; #152 round 2 uses ->> in a flowchart. A diagram that does not parse should be dropped, not posted.
  4. Confidence contradicts the evidence: a finding backed by the failing CI test is tagged low confidence (#154 4149695274, #155 4149712189); a deterministic build failure (missing nginx.conf COPY source, #155) went to double-check at low confidence; #156 demoted the two HIGH defects confirmed by the failing test to MEDIUM/low double-check items.

Acceptance criteria

  • The IaC scan drops a model finding on the same line and the same rule, as the secret scan already does.
  • The check-run title reports the open total (new + still open), with the new count separate.
  • The summary's Mermaid block is checked for the flowchart edge syntax and omitted when it does not validate.
  • A finding whose description cites a failing CI test on the same code is not capped below medium confidence.
Dominant language
Java
Stars
35
Forks
7
Avg merge
9h 23m
Merged PRs (30d)
154

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from devops-thiago/ThrillhouseBot

All issues in devops-thiago/ThrillhouseBot

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.