hardening: a `forbids` practice whose answer is UNKNOWN falls through to FAIL with empty evidence under --allow-unknown ("runtime safety checks are compiled away: ")

Aberta
  • Algo errado?
#243 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
Meio dia
Facilidade para iniciantes
42/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
python, swift
Domínio
cli, tooling

Direção de pesquisa

Start in policy/practices.py around lines 66-71, where an UNKNOWN answer under allow_unknown falls through to the forbids branch and fails with empty found() evidence. Then check questions/practices.py lines 85-90 and the Swift validator in ecosystems/swift.py lines 282-294. Done means a forbids practice with UNKNOWN and no matches passes under --allow-unknown, with a regression test for the repro.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Swift projects whose CI has an unrelated unread reusable workflow (swift-argument-parser, swift-nio, vapor, SwiftLint, dart-lang/http, bloc) get FAIL "Swift's runtime safety checks are compiled away: " with nothing after the colon; grep -rn Ounchecked over each checkout returns nothing. policy/practices.py:70-71: for a forbids practice, UNKNOWN with --allow-unknown should pass on the readable evidence (nothing forbidden found), as drift gets.

Evidence from the corpus audit

dart-lang/http, felangel/bloc / hardening (Swift)
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (nothing after the colon)
  • expected: PASS: "release builds keep Swift's runtime safety checks (no -Ounchecked)", as drift gets. No
    -Ounchecked or SWIFT_ENFORCE_EXCLUSIVE_ACCESS = off exists in either repo. The practice is a forbids one; its
    answer is "unknown" only because unrelated reusable workflows are unread, and --allow-unknown then turns
    "nothing forbidden found" into a failure with an empty list.
  • evidence: grep -rl Ounchecked over both checkouts: no file;
    pkgs/cupertino_http/ios_test/ios/Runner.xcodeproj/project.pbxproj:549: SWIFT_OPTIMIZATION_LEVEL = "-O";;
    --answers for http: {"language": "Swift", "unit": ".", "answer": "unknown", "compilers": [{"compiler": null, "found": {}, "missing": ["-Ounchecked", "unchecked exclusivity"]}], "unknowns": ["job tidy: ... reusable workflow ..."]};
    validator project_validator/ecosystems/swift.py:283-293: forbids=True, failed="Swift's runtime safety checks are compiled away".
  • repro: a Swift unit (any .xcodeproj) + a workflow job uses: owner/repo/.github/workflows/x.yml@sha; run with
    --allow-unknown --only hardening.
  • confidence: high
apple/swift-argument-parser, apple/swift-nio, vapor/vapor, realm/SwiftLint / hardening
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (empty evidence after the colon) in all
    four .allow.txt; the three projects with no unknowns (Alamofire, TCA, SwiftFormat) PASS the same check.
  • expected: PASS: no -Ounchecked or -enforce-exclusivity=unchecked exists in any of the four repositories
    (grep -rn "Ounchecked\|enforce-exclusivity" over each checkout returns nothing); with --allow-unknown the
    readable evidence shows nothing forbidden.
  • evidence: project_validator/questions/practices.py:85-90: in_doubt = met if practice.forbids else not met /
    if in_doubt and unknown: return Answer.UNKNOWN; project_validator/policy/practices.py:66-71: the UNKNOWN answer
    with allow_unknown falls through to if practice.forbids: return Result.failed(f"{words.failed}: {joined(answer.found())}", words.hint)
    with found() empty; project_validator/ecosystems/swift.py:282-294 (HARDENING = Practice(... forbids=True ...)).
    Strict run confirms the cause: apple__swift-argument-parser.txt [ERROR] hardening: ... Swift: whether Swift's runtime safety checks are kept is unknown.
  • repro: a Package.swift (// swift-tools-version:5.9, one target) plus a workflow whose only job is
    uses: other/repo/.github/workflows/x.yml@v1; run with --allow-unknown: hardening FAILs with an empty list.
    Fix is in judge_settings: for a forbids practice an UNKNOWN judged permissively must pass.
  • confidence: high

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

Linguagem predominante
Python
Estrelas
4
Forks
1
Merge médio
10h 41min
PRs com merge (30d)
79

Preparar o ambiente

Este projeto não oferece contêiner de desenvolvimento, Dockerfile nem guia de contribuição, então a configuração fica por sua conta: comece pelo README e veja nosso guia da primeira contribuição para os passos gerais.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de cpp-best-practices/project_validator

Todas as issues de cpp-best-practices/project_validator

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.