Repository navigation
Fix the seven review findings left open on #3590 - #3600
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Warning Review limit reachedYour organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Next included review available in 48 minutes. View limit details
✨ Finishing Touches: 💡 1
Comment |
🤖 CodeAnt AI — Review Status
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
codeant-ai
Bot
added
the
size:L
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
PR Summary by QodoResolve seven outstanding review findings from #3590
AI Description
Diagram
High-Level Assessment
Files changed (12)
|
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Code Review by Qodo
No findings for this group No findings for this group No findings for this group Resolved findings 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Qodo Fixer✅ Committed (2) · ☑ Fixed (2) Commits pushed directly to this PR — no separate fix PR opened. Process — 2 fixed
|
Auto-approval revoked — new findings require attention.
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
CodeAnt Nitpicks2 code suggestions1. The check uses a pre-lock snapshot. If another link is created before these RPCs run, a non-organiser revokes only the old rows and succeeds while that link remains active.Race condition · 2. When no push is sent and none fails, such as when no subscriptions exist, this marks the offer delivered, so replay cannot retry after a device is linked.Logic error · |
|
Auto-fix isn't included in your plan ↗ |
- worker contract test now proves the chosen deadline is attached to the RPC builder - incident runbook uses the variable names the app actually reads - release manifest picks the commit in the runtime resolver's order, skipping invalid values - ops digest accepts the shorter gaps a manual run leaves between scheduled runs - Trivy refreshes a cached vulnerability database once its NextUpdate has passed - a partially delivered open-shift offer is recorded as delivered, so a replay does not resend it to everyone - a non-organiser revoking display links by occurrence is refused when someone else created one, instead of a silent partial revoke Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
345a5ea to
f6ae178
Compare
|
Rebased onto main after #3590 merged (now one commit, f6ae178). I dropped two commits that qodo-code-review[bot] pushed to this branch:
|
|
Code review by qodo was updated up to the latest commit f6ae178 |
…s own A cached metadata.json with no database file now triggers a download, and the Java database is refreshed whenever it is missing or stale rather than only alongside the main database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review follow-up (fe4bd40):
🤖 Addressed by Claude Code |
CodeAnt PR Risk: Low Risk
Assessed commit: |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Code review by qodo was updated up to the latest commit fe4bd40 |
Code Review ✅ Approved 2 closed / 2 findings🔴 High risk · Making occurrence-based teaching-link revocation require organiser status when any link has another or unknown creator could block legitimate non-organiser revocations. Fixes the seven open #3590 review threads, including the ops-digest adjacency check and per-recipient delivery tracking for open-shift alerts. Hourly-adjacency check means scheduled ops-digest runs can never page, and failed per-recipient persistence no longer causes a replay to resend to everyone. No issues remain open. ✅ 2 closed✅ Bug: Hourly-adjacency check means scheduled ops-digest runs can never page
✅ Edge Case: Failed per-recipient persistence makes a replay resend to everyone
VerificationRules No rules evaluated Functional validation Not enabledAuto-approval Approved For more verification details, comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Important Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
|
Code review by qodo was updated up to the latest commit a429bfc |
User description
Follow-up to #3590: fixes the seven review threads that were left open so the #3590 merge was not held up. Rebased onto
mainafter #3590 merged.tests/worker-lease-transition-contract.test.ts.abortSignal(...)on the.rpc(...)builder. Before, it only checked that the strings appeared somewhere in the adapter.docs/governance-incident-runbooks.mdRAG_PERSIST_RAW_QUERY_TEXT,RAG_PERSIST_ANSWER_TEXTandOPENAI_STORE_RESPONSES.scripts/deploy/write-release-manifest.mjsresolveDeploymentCommitSha, and takes the first candidate that is a valid SHA.scripts/ops-digest.mjsscripts/trivy-image-scan.mjsNextUpdatetime, or when the cached copy is missing or unreadable. If that download fails, the scan fails.src/lib/roster/alerts/dispatch.tssrc/lib/teaching/repository.tsteaching_role_deniedand nothing is revoked. Before, some links were revoked and the call still returned{}. A non-organiser can still revoke their own link by its token.No migrations and no RAG ranking files are touched.
RAG impact: no retrieval behaviour change. No retrieval or ranking files are touched.
Tests: I added regression tests for each fix except the runbook.
npx vitest runpassed 110 of 110 across the 8 affected test files.verify:cheapcould not run in the session worktree, because its installed dependencies do not match the lockfile. I am re-running it in a fresh checkout.🤖 Generated with Claude Code
Summary by cubic
Implements the seven review-follow-up fixes left open on #3590, rebased onto
mainafter that PR merged. No RAG retrieval behaviour changes.Fixes
RAG_PERSIST_RAW_QUERY_TEXT,RAG_PERSIST_ANSWER_TEXT,OPENAI_STORE_RESPONSES).resolveDeploymentCommitSha, skipping invalid values.trivy-image-scan.mjsrefreshes its cached vulnerability database onceNextUpdatehas passed or the cache is partial (missing or unreadable metadata included); a failed refresh fails the scan, and the Java database is refreshed on its own when missing or stale.roster_open_post_alert_deliveriestable, so a replay retries only the recipients who were not reached instead of resending to everyone.Regression tests were added for every fix except the runbook;
npx vitest runpasses all affected tests.Written for commit a429bfc. Summary will update on new commits.
CodeAnt-AI Description
Fix duplicate shift alerts, partial teaching-link revocations, and stale vulnerability scans
What Changed
Impact
✅ No duplicate open-shift offers after partial delivery✅ No partial unauthorised teaching-link revocations✅ Scans avoid using expired vulnerability data✅ More reliable release and incident evidence💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.