Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Safe Outputs Conformance] PTI-005: Retry-loop integrity-rejection check regex no longer matches error_recovery.cjs guard

Closed Beginner friendly
  • Is something wrong?
#70,805 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bash, github-actions
Domain
security, testing-qa

Research direction

Read the PTI-005 check near line 2673 in scripts/check-safe-outputs-conformance.sh and the retry-loop guard near line 352 in actions/setup/js/error_recovery.cjs. Confirm the guard still rejects integrity errors before calling shouldRetry, then adjust the checker to recognize both conditions when other OR clauses intervene. Run bash scripts/check-safe-outputs-conformance.sh; done when PTI-005 and the other checks pass.

Written by the indexing model from the issue text.

Description

automated conformance safe-outputs
Conformance Check Failure

Check ID: PTI-005
Severity: HIGH
Category: Security / Implementation

Problem Description

Section 7.3 PTI-005 requires that the retry loop reject ERR_TRANSPORT_INTEGRITY failures before invoking any custom shouldRetry classifier, so a corrupted patch/bundle transport can never be silently retried. The checker verifies this by matching the literal adjacent substring error?.code === "ERR_TRANSPORT_INTEGRITY" || !fullConfig.shouldRetry(error) in actions/setup/js/error_recovery.cjs.

The current guard (line 352) is:

if (error?.code === "ERR_TRANSPORT_INTEGRITY" || (fullConfig.deadline !== undefined && now() >= fullConfig.deadline) || !fullConfig.shouldRetry(error)) {

A deadline-expiry clause was inserted between the integrity check and the shouldRetry check, which breaks the checker's literal adjacency match.

Affected Components

  • Files:

    • actions/setup/js/error_recovery.cjs (retry-loop guard, line 352)
    • scripts/check-safe-outputs-conformance.sh (PTI-005 check, ~line 2673)
<b>🔍 Current vs Expected Behavior</b>
Current Behavior

|| is left-associative and short-circuits left-to-right, so error?.code === "ERR_TRANSPORT_INTEGRITY" is still evaluated before fullConfig.shouldRetry(error) regardless of the inserted deadline clause — the required ordering (integrity failures rejected before any custom classifier runs) is preserved at runtime. Only the checker's literal substring match fails, because it assumes no other clause can sit between the two conditions.

Expected Behavior

Either confirm the inserted deadline clause truly has no interaction with ERR_TRANSPORT_INTEGRITY classification (it appears not to, since it is its own independent OR-branch), and widen the PTI-005 checker pattern to tolerate additional clauses between the integrity check and the shouldRetry check, or restructure the guard so the integrity check is evaluated in isolation if the spec intends something stricter than left-to-right OR short-circuiting.

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

  1. Confirm that the deadline-expiry clause in error_recovery.cjs line 352 cannot mask or suppress ERR_TRANSPORT_INTEGRITY rejection (verify via the existing retry-loop tests, adding a regression test if integrity-failure-at-deadline is not already covered).
  2. Update the PTI-005 regex in scripts/check-safe-outputs-conformance.sh (~line 2673) to tolerate additional OR-clauses between the integrity check and the shouldRetry check, e.g. match error?.code === "ERR_TRANSPORT_INTEGRITY" and !fullConfig.shouldRetry(error) independently within the same if condition rather than as one adjacent literal string.
  3. Re-run the conformance script locally and confirm PTI-005 passes alongside the other PTI-00x checks.
Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check PTI-005 should pass without errors.

References
  • Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
  • Conformance Checker: scripts/check-safe-outputs-conformance.sh (line 2667)
  • Run: §39551296580
  • Date: 2026-10-21

Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 81.4 AIC · ⌖ 0.668 AIC · ⊞ 5.4K · ◷

  • expires on Oct 21, 2026, 9:53 PM UTC-08:00
Dominant language
Go
Stars
5.4k
Forks
596
Avg merge
3h 40m
Merged PRs (30d)
830

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw

All issues in github/gh-aw

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.