hardening: a `forbids` practice whose answer is UNKNOWN falls through to FAIL with empty evidence under --allow-unknown ("runtime safety checks are compiled away: ")

未关闭
  • 哪里不对？
#243 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
半天
新手友好度
42/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
python, swift
领域
cli, tooling

调研方向

Start in policy/practices.py around lines 66-71, where an UNKNOWN answer under allow_unknown falls through to the forbids branch and fails with empty found() evidence. Then check questions/practices.py lines 85-90 and the Swift validator in ecosystems/swift.py lines 282-294. Done means a forbids practice with UNKNOWN and no matches passes under --allow-unknown, with a regression test for the repro.

由索引模型根据 Issue 内容生成。

描述

Swift projects whose CI has an unrelated unread reusable workflow (swift-argument-parser, swift-nio, vapor, SwiftLint, dart-lang/http, bloc) get FAIL "Swift's runtime safety checks are compiled away: " with nothing after the colon; grep -rn Ounchecked over each checkout returns nothing. policy/practices.py:70-71: for a forbids practice, UNKNOWN with --allow-unknown should pass on the readable evidence (nothing forbidden found), as drift gets.

Evidence from the corpus audit

dart-lang/http, felangel/bloc / hardening (Swift)
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (nothing after the colon)
  • expected: PASS: "release builds keep Swift's runtime safety checks (no -Ounchecked)", as drift gets. No
    -Ounchecked or SWIFT_ENFORCE_EXCLUSIVE_ACCESS = off exists in either repo. The practice is a forbids one; its
    answer is "unknown" only because unrelated reusable workflows are unread, and --allow-unknown then turns
    "nothing forbidden found" into a failure with an empty list.
  • evidence: grep -rl Ounchecked over both checkouts: no file;
    pkgs/cupertino_http/ios_test/ios/Runner.xcodeproj/project.pbxproj:549: SWIFT_OPTIMIZATION_LEVEL = "-O";;
    --answers for http: {"language": "Swift", "unit": ".", "answer": "unknown", "compilers": [{"compiler": null, "found": {}, "missing": ["-Ounchecked", "unchecked exclusivity"]}], "unknowns": ["job tidy: ... reusable workflow ..."]};
    validator project_validator/ecosystems/swift.py:283-293: forbids=True, failed="Swift's runtime safety checks are compiled away".
  • repro: a Swift unit (any .xcodeproj) + a workflow job uses: owner/repo/.github/workflows/x.yml@sha; run with
    --allow-unknown --only hardening.
  • confidence: high
apple/swift-argument-parser, apple/swift-nio, vapor/vapor, realm/SwiftLint / hardening
  • kind: FALSE_POSITIVE
  • actual: FAIL: Swift: Swift's runtime safety checks are compiled away: (empty evidence after the colon) in all
    four .allow.txt; the three projects with no unknowns (Alamofire, TCA, SwiftFormat) PASS the same check.
  • expected: PASS: no -Ounchecked or -enforce-exclusivity=unchecked exists in any of the four repositories
    (grep -rn "Ounchecked\|enforce-exclusivity" over each checkout returns nothing); with --allow-unknown the
    readable evidence shows nothing forbidden.
  • evidence: project_validator/questions/practices.py:85-90: in_doubt = met if practice.forbids else not met /
    if in_doubt and unknown: return Answer.UNKNOWN; project_validator/policy/practices.py:66-71: the UNKNOWN answer
    with allow_unknown falls through to if practice.forbids: return Result.failed(f"{words.failed}: {joined(answer.found())}", words.hint)
    with found() empty; project_validator/ecosystems/swift.py:282-294 (HARDENING = Practice(... forbids=True ...)).
    Strict run confirms the cause: apple__swift-argument-parser.txt [ERROR] hardening: ... Swift: whether Swift's runtime safety checks are kept is unknown.
  • repro: a Package.swift (// swift-tools-version:5.9, one target) plus a workflow whose only job is
    uses: other/repo/.github/workflows/x.yml@v1; run with --allow-unknown: hardening FAILs with an empty list.
    Fix is in judge_settings: for a forbids practice an UNKNOWN judged permissively must pass.
  • confidence: high

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

主要语言
Python
星标
4
派生
1
平均合并
10 小时 41 分钟
30 天内合并 PR
79

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

cpp-best-practices/project_validator 的其他 Issue

查看 cpp-best-practices/project_validator 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。