chore(sync): rebuild wff-code/wff-chat from .claude@13d8aac #11
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1273,7 +1273,7 @@ platform: resolve against the platform's live docs and the CI-pinned tool versio | |
| | CI check | Static validation | | ||
| | --- | --- | | ||
| | ClusterFuzzLite | For each fuzz target declared in workflow: verify file exists at the declared path, has the correct extension (`.py` for Python), and compiles with `python3 -m py_compile {target}` | | ||
| | SARIF-producing scanners (Trivy, Snyk, Scorecard, SBOM) | If workflow references a SARIF file path, verify the generating step would produce it (check step ordering and output paths). Only `codeql.yml` and `dependency-review.yml` (deleted 2026-09) stopped producing SARIF; `sbom.yml`'s Grype and OSV-Scanner jobs still call `github/codeql-action/upload-sarif` to ingest into the Security tab (categories `grype-runtime-deps`, `osv-sbom-runtime-deps`), matching `.github/workflows/README.md:120-129`. Verify the `upload-sarif` step exists for those, and treat `actions/upload-artifact` as a backup copy of the raw SBOM/SARIF file, not a replacement for Security-tab ingestion. | | ||
|
|
||
| | SonarCloud | Verify `sonar-project.properties` has non-placeholder values for `sonar.organization` and `sonar.projectKey` | | ||
| | Codecov | If `codecov.yml` exists, verify it parses as valid YAML and references existing flag names | | ||
|
|
||
|
|
@@ -1620,25 +1620,27 @@ still serves dangling commits, so use `compare`, not existence. Validate the fix | |
| `if:`). When the failure appeared right after an edit, confirm causation by reverting the | ||
| suspected change on the current base before committing to a fix direction. | ||
|
|
||
| **SARIF / code-scanning orphan checks, CodeQL only (legacy, pre-2026-09):** `codeql.yml` and | ||
| `dependency-review.yml` were deleted fleet-wide (2026-09; `actions/dependency-review-action` now | ||
| requires paid GitHub Advanced Security). A "CodeQL" or "Code scanning results / CodeQL" check | ||
|
Comment on lines
+1623
to
+1625
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- changed hunk ---'
git diff -- plugins/wff-code/skills/pr-review/workflows/pr-fix.md | sed -n '1,220p'
printf '%s\n' '--- surrounding source ---'
sed -n '1590,1660p' plugins/wff-code/skills/pr-review/workflows/pr-fix.md
printf '%s\n' '--- related terms in repository ---'
rg -n -C 2 'Dependency Review|dependency-review|Code scanning results|mergeStateStatus|mergeable' plugins/wff-code/skills/pr-reviewRepository: ByronWilliamsCPA/plugin Length of output: 22294 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- orphan-check section continuation ---'
sed -n '1620,1688p' plugins/wff-code/skills/pr-review/workflows/pr-fix.md
printf '%s\n' '--- dependency-review references and workflow inventory ---'
rg -n -C 3 'Dependency Review|dependency-review-action|dependency-review\.yml|required.*context|required_status_checks|statusCheckRollup|check-runs' --glob '!plugins/wff-code/skills/pr-review/workflows/pr-fix.md' .
printf '%s\n' '--- repository workflow/docs files ---'
git ls-files | rg '(^|/)\.github/workflows/|dependency|README\.md$' | head -120Repository: ByronWilliamsCPA/plugin Length of output: 31761 🌐 Web query:
💡 Result: To configure the Dependency Review action as a required status check in GitHub, follow these steps: 1. Add the Dependency Review action to your repository's workflow configuration file (typically located in.github/workflows/) [1][2]. 2. Ensure the workflow is configured to run on pull requests [1][2]. 3. Go to your repository settings on GitHub, navigate to Branches, and select (or create) a branch protection rule for your target branch (e.g., main) [3][4]. 4. Under the "Protect matching branches" section, enable the "Require status checks to pass before merging" setting [3][4]. 5. In the list of available status checks, search for and select the name of the job defined in your Dependency Review workflow file (e.g., if your job is named 'dependency-review', that is the name you will see in the status check list) [3][4]. The Dependency Review action acts as a standard GitHub Actions check [3][5]. Once the job is added to your workflow, GitHub will register it as a status check, allowing you to select it in the branch protection settings [3][6]. The check will block pull requests from being merged only if it fails and you have configured it as a required status check in your branch protection rules [3][5]. Note that by default, the action will fail if it detects vulnerabilities or invalid licenses based on your configuration, which will subsequently cause the required status check to fail, preventing the merge [7][1][6]. You can manage this behavior using parameters like fail-on-severity [1][8]. Citations:
Classify stale The orphan rule names 🧰 Tools🪛 LanguageTool[style] ~1625-~1625: The double modal “requires paid” is nonstandard (only accepted in certain dialects). Consider “to be paid”. (NEEDS_FIXED) 🤖 Prompt for AI AgentsSource: MCP tools There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
sed -n '1608,1650p' plugins/wff-code/skills/pr-review/workflows/pr-fix.md
printf '\n--- nearby references ---\n'
rg -n -C 3 'CodeQL|Dependency Review|mergeable|mergeStateStatus|GHAS|Advanced Security|orphan' plugins/wff-code/skills/pr-review/workflows/pr-fix.mdRepository: ByronWilliamsCPA/plugin Length of output: 14631 🌐 Web query:
💡 Result: Summary (GitHub security feature availability for dependency review and code scanning) 1) Dependency review - Public repositories: available (GitHub documentation states dependency review is available for public repositories on GitHub.com). [1] - Private repositories: available only when GitHub Code Security or GitHub Advanced Security is enabled for that repository. [1] - If Code Security/Advanced Security is disabled, dependency review is not available and related security features are disabled. [2] 2) Code scanning (GitHub Code Security / Advanced Security) - Public repositories: code scanning is available by default. [3][4] - Private repositories: you must enable/purchase GitHub Code Security (part of GitHub Advanced Security) to use code scanning on private repositories. [5][6] - Plan constraint (GitHub Free/Pro): on those plans, code scanning is limited to publicly available repositories; to enable it for private/internal repos you must upgrade (e.g., GitHub Team or GitHub Enterprise with Code Security and enable it for the repo). [7][6] Practical implications - If your goal is to run both dependency review and code scanning on private repos, you need GitHub Advanced Security (Code Security) enabled for those repositories; otherwise, code scanning won’t run and dependency review won’t be available. [1][5][6] - For public repos, GitHub states code scanning and dependency review are available without requiring a paid Code Security license (Code Security features are enabled for public repositories by default). [3][4][1] Key sources: - Dependency review concept doc: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review [1] - GitHub security features / Advanced Security availability table and notes: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security [4] - Code scanning “private repository enablement” and licensing requirements: https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement [6] - Advanced Security billing/availability overview (free public vs paid private): https://docs.github.com/en/billing/concepts/product-billing/github-advanced-security [8] Citations:
Scope the GHAS entitlement rule by repository visibility.
🧰 Tools🪛 LanguageTool[style] ~1625-~1625: The double modal “requires paid” is nonstandard (only accepted in certain dialects). Consider “to be paid”. (NEEDS_FIXED) 🤖 Prompt for AI AgentsSource: MCP tools |
||
| visible on a new PR is therefore a leftover from before the deletion, not a live analysis: treat | ||
| it as permanently orphaned (not merely path-filtered) and, if it recurs, have the repo owner | ||
| disable "Code scanning: Default setup" in repo Settings > Code security so GitHub stops | ||
| registering the check context. This does NOT apply to other SARIF-producing workflows: `sbom.yml` | ||
| still runs `github/codeql-action/upload-sarif` for its Grype and OSV-Scanner jobs (categories | ||
| `grype-runtime-deps`, `osv-sbom-runtime-deps`), so those checks are live, not orphaned. The | ||
| pre-2026-09 mechanics below (queued indefinitely because the upstream analysis job was | ||
| path-filtered or skipped on config-only/docs-only PRs) still apply to those and to any other | ||
| SARIF-producing workflow, such as a Trivy or Snyk scan that guards a path filter. | ||
|
|
||
| ```bash | ||
| gh pr view "$PR_NUMBER" --repo "$OWNER/$REPO" --json mergeable,mergeStateStatus \ | ||
| --jq '{mergeable:.mergeable, state:.mergeStateStatus}' | ||
| ``` | ||
|
|
||
| If `mergeable: MERGEABLE` (button is active), a queued (not orphaned-CodeQL) SARIF check is a | ||
| non-blocking advisory check, not a CI failure. Classify it as "advisory pending (path-filtered | ||
| upstream job)" and do NOT trigger a re-fix cycle. The PR is safe to merge. | ||
|
Comment on lines
+1641
to
+1643
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
file="plugins/wff-code/skills/pr-review/workflows/pr-fix.md"
printf '%s\n' '--- relevant lines ---'
sed -n '1590,1660p' "$file"
printf '%s\n' '--- nearby references ---'
rg -n -C 3 'mergeable|mergeStateStatus|Dependency Review|SARIF|advisory pending|safe to merge|required context' "$file"Repository: ByronWilliamsCPA/plugin Length of output: 15247 🏁 Script executed: #!/bin/bash
set -eu
file="plugins/wff-code/skills/pr-review/workflows/pr-fix.md"
printf '%s\n' '--- changed hunks ---'
git diff --unified=25 -- "$file" | sed -n '1,260p'Repository: ByronWilliamsCPA/plugin Length of output: 183 🏁 Script executed: #!/bin/bash
set -eu
file="plugins/wff-code/skills/pr-review/workflows/pr-fix.md"
sed -n '1590,1660p' "$file"Repository: ByronWilliamsCPA/plugin Length of output: 4672 🌐 Web query:
💡 Result: In the GitHub GraphQL API, Citations:
Require merge-state and required-context checks before treating queued SARIF as advisory.
🤖 Prompt for AI AgentsSource: MCP tools |
||
|
|
||
| Classify the outcome: | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Qualify the tier-assignment statement for the free tier.
models_in_cost_tierrequires both costs to be zero forfree; paid bands useinput_costranges. Replace the current sentence with this distinction and update the README directly.🤖 Prompt for AI Agents