[Safe Outputs Conformance] PTI-005: Retry-loop integrity-rejection check regex no longer matches error_recovery.cjs guard
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 75/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- bash, github-actions
- 领域
- security, testing-qa
调研方向
阅读 scripts/check-safe-outputs-conformance.sh 第2673行附近的 PTI-005 检查，以及 actions/setup/js/error_recovery.cjs 第352行附近的重试循环保护条件。确认该保护条件在调用 shouldRetry 之前仍会拒绝完整性错误，然后调整检查器，使其在中间出现其他 OR 子句时也能识别这两个条件。运行 bash scripts/check-safe-outputs-conformance.sh；PTI-005 和其他检查均通过后即完成。
由索引模型根据 Issue 内容生成。
描述
Conformance Check Failure
Check ID: PTI-005
Severity: HIGH
Category: Security / Implementation
Problem Description
Section 7.3 PTI-005 requires that the retry loop reject ERR_TRANSPORT_INTEGRITY failures before invoking any custom shouldRetry classifier, so a corrupted patch/bundle transport can never be silently retried. The checker verifies this by matching the literal adjacent substring error?.code === "ERR_TRANSPORT_INTEGRITY" || !fullConfig.shouldRetry(error) in actions/setup/js/error_recovery.cjs.
The current guard (line 352) is:
if (error?.code === "ERR_TRANSPORT_INTEGRITY" || (fullConfig.deadline !== undefined && now() >= fullConfig.deadline) || !fullConfig.shouldRetry(error)) {
A deadline-expiry clause was inserted between the integrity check and the shouldRetry check, which breaks the checker's literal adjacency match.
Affected Components
-
Files:
-
actions/setup/js/error_recovery.cjs(retry-loop guard, line 352) -
scripts/check-safe-outputs-conformance.sh(PTI-005 check, ~line 2673)
-
<b>🔍 Current vs Expected Behavior</b>
Current Behavior
|| is left-associative and short-circuits left-to-right, so error?.code === "ERR_TRANSPORT_INTEGRITY" is still evaluated before fullConfig.shouldRetry(error) regardless of the inserted deadline clause — the required ordering (integrity failures rejected before any custom classifier runs) is preserved at runtime. Only the checker's literal substring match fails, because it assumes no other clause can sit between the two conditions.
Expected Behavior
Either confirm the inserted deadline clause truly has no interaction with ERR_TRANSPORT_INTEGRITY classification (it appears not to, since it is its own independent OR-branch), and widen the PTI-005 checker pattern to tolerate additional clauses between the integrity check and the shouldRetry check, or restructure the guard so the integrity check is evaluated in isolation if the spec intends something stricter than left-to-right OR short-circuiting.
Remediation Steps
This task can be assigned to a Copilot coding agent with the following steps:
- Confirm that the deadline-expiry clause in
error_recovery.cjsline 352 cannot mask or suppressERR_TRANSPORT_INTEGRITYrejection (verify via the existing retry-loop tests, adding a regression test if integrity-failure-at-deadline is not already covered). - Update the PTI-005 regex in
scripts/check-safe-outputs-conformance.sh(~line 2673) to tolerate additional OR-clauses between the integrity check and theshouldRetrycheck, e.g. matcherror?.code === "ERR_TRANSPORT_INTEGRITY"and!fullConfig.shouldRetry(error)independently within the sameifcondition rather than as one adjacent literal string. - Re-run the conformance script locally and confirm PTI-005 passes alongside the other PTI-00x checks.
Verification
After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
The check PTI-005 should pass without errors.
References
- Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
- Conformance Checker:
scripts/check-safe-outputs-conformance.sh(line 2667) - Run: §39551296580
- Date: 2026-10-21
Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 81.4 AIC · ⌖ 0.668 AIC · ⊞ 5.4K · ◷
- expires on Oct 21, 2026, 9:53 PM UTC-08:00
- 主要语言
- Go
- 星标
- 5.5k
- 派生
- 606
- 平均合并
- 4 小时 8 分钟
- 30 天内合并 PR
- 813
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-aw 的其他 Issue
-
agent-research
难度 2/5 1-3 小时 新手友好度 64/100
维护者通常 1 天内回复
-
automation cli cookie documentation
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
automation documentation enhancement
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 1 天内回复
-
ai-inspected
难度 2/5 1-3 小时 新手友好度 83/100
维护者通常 1 天内回复
-
[doc-healer] DDUw improvement: retry integrity-filtered issue reads with direct single-item lookups未关闭automation documentation
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 2 天内回复
-
test-failure
难度 2/5 1-3 小时 新手友好度 72/100
teramoby/speedle-plus#129 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
containerd/containerd#14485 ·
维护者通常 1 天内回复
-
bug needs-triage
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复