hardening: a `forbids` practice whose answer is UNKNOWN falls through to FAIL with empty evidence under --allow-unknown ("runtime safety checks are compiled away: ")

Aperta
  • Qualcosa non va?
#243 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python, swift
Ambito
cli, tooling

Direzione di ricerca

Start in policy/practices.py around lines 66-71, where an UNKNOWN answer under allow_unknown falls through to the forbids branch and fails with empty found() evidence. Then check questions/practices.py lines 85-90 and the Swift validator in ecosystems/swift.py lines 282-294. Done means a forbids practice with UNKNOWN and no matches passes under --allow-unknown, with a regression test for the repro.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Swift projects whose CI has an unrelated unread reusable workflow (swift-argument-parser, swift-nio, vapor, SwiftLint, dart-lang/http, bloc) get FAIL "Swift's runtime safety checks are compiled away: " with nothing after the colon; grep -rn Ounchecked over each checkout returns nothing. policy/practices.py:70-71: for a forbids practice, UNKNOWN with --allow-unknown should pass on the readable evidence (nothing forbidden found), as drift gets.

Evidence from the corpus audit

dart-lang/http, felangel/bloc / hardening (Swift)
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (nothing after the colon)
  • expected: PASS: "release builds keep Swift's runtime safety checks (no -Ounchecked)", as drift gets. No
    -Ounchecked or SWIFT_ENFORCE_EXCLUSIVE_ACCESS = off exists in either repo. The practice is a forbids one; its
    answer is "unknown" only because unrelated reusable workflows are unread, and --allow-unknown then turns
    "nothing forbidden found" into a failure with an empty list.
  • evidence: grep -rl Ounchecked over both checkouts: no file;
    pkgs/cupertino_http/ios_test/ios/Runner.xcodeproj/project.pbxproj:549: SWIFT_OPTIMIZATION_LEVEL = "-O";;
    --answers for http: {"language": "Swift", "unit": ".", "answer": "unknown", "compilers": [{"compiler": null, "found": {}, "missing": ["-Ounchecked", "unchecked exclusivity"]}], "unknowns": ["job tidy: ... reusable workflow ..."]};
    validator project_validator/ecosystems/swift.py:283-293: forbids=True, failed="Swift's runtime safety checks are compiled away".
  • repro: a Swift unit (any .xcodeproj) + a workflow job uses: owner/repo/.github/workflows/x.yml@sha; run with
    --allow-unknown --only hardening.
  • confidence: high
apple/swift-argument-parser, apple/swift-nio, vapor/vapor, realm/SwiftLint / hardening
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (empty evidence after the colon) in all
    four .allow.txt; the three projects with no unknowns (Alamofire, TCA, SwiftFormat) PASS the same check.
  • expected: PASS: no -Ounchecked or -enforce-exclusivity=unchecked exists in any of the four repositories
    (grep -rn "Ounchecked\|enforce-exclusivity" over each checkout returns nothing); with --allow-unknown the
    readable evidence shows nothing forbidden.
  • evidence: project_validator/questions/practices.py:85-90: in_doubt = met if practice.forbids else not met /
    if in_doubt and unknown: return Answer.UNKNOWN; project_validator/policy/practices.py:66-71: the UNKNOWN answer
    with allow_unknown falls through to if practice.forbids: return Result.failed(f"{words.failed}: {joined(answer.found())}", words.hint)
    with found() empty; project_validator/ecosystems/swift.py:282-294 (HARDENING = Practice(... forbids=True ...)).
    Strict run confirms the cause: apple__swift-argument-parser.txt [ERROR] hardening: ... Swift: whether Swift's runtime safety checks are kept is unknown.
  • repro: a Package.swift (// swift-tools-version:5.9, one target) plus a workflow whose only job is
    uses: other/repo/.github/workflows/x.yml@v1; run with --allow-unknown: hardening FAILs with an empty list.
    Fix is in judge_settings: for a forbids practice an UNKNOWN judged permissively must pass.
  • confidence: high

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

Lingua principale
Python
Stelle
4
Fork
1
Merge medio
10h 41m
PR unite (30g)
79

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di cpp-best-practices/project_validator

Tutte le issue di cpp-best-practices/project_validator

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.