[samirhvbr]

Concurrent agents can both store the same finding while the duplicate check awaits its model response. Each compares against a snapshot that does not yet contain the other filing.

Hold a per-run ReportState.dedupe_lock across reading stored findings, checking for duplicates and inserting the accepted report. Both create_vulnerability_report and create_dependency_report use the same lock.

Dependency checks normally resolve synchronously from CVE/package identity. However, an existing same-CVE report without package metadata can send the check through the model. That fallback has the same race and now receives the same protection. The structured package-identity fast path remains model-free. Distinct findings remain accepted, and an exceptional check releases the lock.

Fixes #627.

Validation on macOS/Apple Silicon, Python 3.12.14, with isolated HOME/configuration:

• Regression tests drive the real reporting helpers and real check_duplicate; only the model is replaced with a synthetic response that yields execution.
• The dependency fallback regression fails before the follow-up correction: both concurrent filings return success. Afterward exactly one is stored and the other identifies it as the duplicate.
• A control verifies that package-identity deduplication still needs no model call.
• 182 tests passed across reporting races/fields/tools, list reports, dedupe, report state and report writing.
• An experimental merge with current upstream 6b7ae2eb applied cleanly and passed the same 182 tests.
• Ruff lint/format, Mypy and Bandit passed on the changed code; git diff --check passed.

The trade-off is that filings in one run wait for an in-flight duplicate check. The lock is scoped to the report state, not shared across separate runs.

The complete repository suite, real model calls and live scans were not exercised. Remote CI still requires maintainer approval.

Prepared with AI assistance.

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Adds concurrency control to the duplicate-finding check.

The code appears safe to merge, but the race tests should cover a path where the real duplicate check pauses.

Findings

1.  Race tests miss real waits ▶

Fix with agent prompt

### Issue 1
tests/test_reporting_dedupe_race.py:45-49
Each test starts with no stored findings, but `_slow_check` always pauses. The real `check_duplicate` returns right away for an empty list and for matching dependency CVE/package pairs. These tests could pass even if the race returns on a path that waits for the model. Seed an unrelated finding in the vulnerability test and test a dependency case that reaches the model check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Both report creation paths now check saved findings and add new ones one at a time, so concurrent matching filings don’t both get stored.

• Concurrent matching findings get saved only once.

_{Reviews (1) · Last reviewed commit: "fix(reporting): serialize the duplicate ..."}

[greptile-apps]

Race tests miss real waits

Each test starts with no stored findings, but _slow_check always pauses. The real check_duplicate returns right away for an empty list and for matching dependency CVE/package pairs. These tests could pass even if the race returns on a path that waits for the model. Seed an unrelated finding in the vulnerability test and test a dependency case that reaches the model check.

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_reporting_dedupe_race.py
Line: 45-49

Comment:
**Race tests miss real waits**

Each test starts with no stored findings, but `_slow_check` always pauses. The real `check_duplicate` returns right away for an empty list and for matching dependency CVE/package pairs. These tests could pass even if the race returns on a path that waits for the model. Seed an unrelated finding in the vulnerability test and test a dependency case that reaches the model check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.