hardening: a `forbids` practice whose answer is UNKNOWN falls through to FAIL with empty evidence under --allow-unknown ("runtime safety checks are compiled away: ")

Ouverte
  • Quelque chose ne va pas ?
#243 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
Une demi-journée
Accessibilité débutants
42/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
python, swift
Domaine
cli, tooling

Piste de recherche

Start in policy/practices.py around lines 66-71, where an UNKNOWN answer under allow_unknown falls through to the forbids branch and fails with empty found() evidence. Then check questions/practices.py lines 85-90 and the Swift validator in ecosystems/swift.py lines 282-294. Done means a forbids practice with UNKNOWN and no matches passes under --allow-unknown, with a regression test for the repro.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Swift projects whose CI has an unrelated unread reusable workflow (swift-argument-parser, swift-nio, vapor, SwiftLint, dart-lang/http, bloc) get FAIL "Swift's runtime safety checks are compiled away: " with nothing after the colon; grep -rn Ounchecked over each checkout returns nothing. policy/practices.py:70-71: for a forbids practice, UNKNOWN with --allow-unknown should pass on the readable evidence (nothing forbidden found), as drift gets.

Evidence from the corpus audit

dart-lang/http, felangel/bloc / hardening (Swift)
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (nothing after the colon)
  • expected: PASS: "release builds keep Swift's runtime safety checks (no -Ounchecked)", as drift gets. No
    -Ounchecked or SWIFT_ENFORCE_EXCLUSIVE_ACCESS = off exists in either repo. The practice is a forbids one; its
    answer is "unknown" only because unrelated reusable workflows are unread, and --allow-unknown then turns
    "nothing forbidden found" into a failure with an empty list.
  • evidence: grep -rl Ounchecked over both checkouts: no file;
    pkgs/cupertino_http/ios_test/ios/Runner.xcodeproj/project.pbxproj:549: SWIFT_OPTIMIZATION_LEVEL = "-O";;
    --answers for http: {"language": "Swift", "unit": ".", "answer": "unknown", "compilers": [{"compiler": null, "found": {}, "missing": ["-Ounchecked", "unchecked exclusivity"]}], "unknowns": ["job tidy: ... reusable workflow ..."]};
    validator project_validator/ecosystems/swift.py:283-293: forbids=True, failed="Swift's runtime safety checks are compiled away".
  • repro: a Swift unit (any .xcodeproj) + a workflow job uses: owner/repo/.github/workflows/x.yml@sha; run with
    --allow-unknown --only hardening.
  • confidence: high
apple/swift-argument-parser, apple/swift-nio, vapor/vapor, realm/SwiftLint / hardening
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (empty evidence after the colon) in all
    four .allow.txt; the three projects with no unknowns (Alamofire, TCA, SwiftFormat) PASS the same check.
  • expected: PASS: no -Ounchecked or -enforce-exclusivity=unchecked exists in any of the four repositories
    (grep -rn "Ounchecked\|enforce-exclusivity" over each checkout returns nothing); with --allow-unknown the
    readable evidence shows nothing forbidden.
  • evidence: project_validator/questions/practices.py:85-90: in_doubt = met if practice.forbids else not met /
    if in_doubt and unknown: return Answer.UNKNOWN; project_validator/policy/practices.py:66-71: the UNKNOWN answer
    with allow_unknown falls through to if practice.forbids: return Result.failed(f"{words.failed}: {joined(answer.found())}", words.hint)
    with found() empty; project_validator/ecosystems/swift.py:282-294 (HARDENING = Practice(... forbids=True ...)).
    Strict run confirms the cause: apple__swift-argument-parser.txt [ERROR] hardening: ... Swift: whether Swift's runtime safety checks are kept is unknown.
  • repro: a Package.swift (// swift-tools-version:5.9, one target) plus a workflow whose only job is
    uses: other/repo/.github/workflows/x.yml@v1; run with --allow-unknown: hardening FAILs with an empty list.
    Fix is in judge_settings: for a forbids practice an UNKNOWN judged permissively must pass.
  • confidence: high

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

Langage dominant
Python
Étoiles
4
Forks
1
Merge moyen
10 h 41 min
PR mergées (30 j)
79

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de cpp-best-practices/project_validator

Toutes les issues de cpp-best-practices/project_validator

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.