A concluded `has_releases` (or other detectable key) is never offered for confirmation
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
调研方向
First read section 7.11 of framework-design.md, then inspect get_pending_data, ResolvedContext.pending(), and accept_candidates on the 042-candidate-integrity branch after feature 042 lands. Check how proposals are represented and how loaded controls identify relevant keys. Done means concluded detector values for those keys are offered with the candidate payload, detector origin, and digest, and can be accepted by digest.
由索引模型根据 Issue 内容生成。
描述
Applies once feature 042 lands (branch 042-candidate-integrity, not yet merged); until then the behaviour described may differ on main.
Pending-data questions run detection. For an auto_detect = true key such as has_releases, a detection that completes (for example gh release list answering with no releases) makes the key concluded for the run. ResolvedContext.pending() lists only candidate and unknown keys, so a concluded key is not asked. The audit, however, uses only confirmed values for applicability (it does not run the detection pipelines), so the concluded value never affects the audit either. Result: a project with no releases is never asked about releases, and its release-gated controls stay applicable indefinitely unless someone passes has_releases=false by hand.
framework-design.md 7.11 says "Pending-data questions do run the pipelines, and a person can confirm the proposed value", and accept_candidates already accepts "a value concluded in this run", but no question offers it.
Proposed fix: list concluded values of keys that affect a loaded control in get_pending_data as proposals (same candidate payload, origin detector, digest), so a person can accept them by digest. The conservative default (control stays applicable) is unchanged until a person confirms.
- 主要语言
- Python
- 星标
- 22
- 派生
- 27
- 平均合并
- 2 天 19 小时
- 30 天内合并 PR
- 51
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
darnitdevorg/darnit 的其他 Issue
-
module-core needs triage ux
难度 2/5 1-3 小时 新手友好度 72/100
darnitdevorg/darnit#648 ·
维护者通常 2 天内回复
-
ci needs triage
难度 2/5 1-3 小时 新手友好度 62/100
darnitdevorg/darnit#607 ·
维护者通常 2 天内回复
-
dependencies module-baseline needs triage
难度 2/5 1-3 小时 新手友好度 68/100
darnitdevorg/darnit#606 ·
维护者通常 2 天内回复
-
`darnit validate` crashes on openssf-baseline.toml summarising levels可能已有人在做 @i-am-paradox 于 12 天前认领。 未关闭interface-cli module-core
难度 2/5 1-3 小时 新手友好度 78/100
darnitdevorg/darnit#589 · 1 条评论 ·
维护者通常 2 天内回复
-
good first issue maintenance
难度 2/5 1-3 小时 新手友好度 83/100
darnitdevorg/darnit#587 · 2 条评论 ·
维护者通常 2 天内回复
查看 darnitdevorg/darnit 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
Arekkazu/sgpmp-backend#744 ·
维护者通常 1 天内回复
-
agent/reviewer
难度 2/5 1-3 小时 新手友好度 78/100
projectbluefin/utah-packages#634 ·
维护者通常 1 天内回复
-
enhancement good first issue help wanted
难度 2/5 1-2 天 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
home-assistant/core#188613 ·
维护者通常 1 天内回复
-
Website未关闭good first issue
难度 2/5 1-3 小时 新手友好度 91/100
TanbirRamim/open-source-radar#314 ·
维护者通常 1 天内回复