Harden automation, release provenance, and project evidence - #4
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8976d4f43
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
|
|
||
| function splitLocator(locator: string): { name: string; version: string } { | ||
| const separator = locator.lastIndexOf('@') |
There was a problem hiding this comment.
For this repository's workspace:* entries, scoped locators such as @ant/computer-use-input@workspace:packages/@ant/computer-use-input contain another @ in the path, so lastIndexOf emits the corrupted name @ant/computer-use-input@workspace:packages/ and version ant/computer-use-input; the other local workspaces are emitted with workspace:packages/... versions and empty hashes. Every release will therefore publish and attest an SBOM containing 36 bogus npm components, so detect workspace locators or model them separately before splitting registry package coordinates.
AGENTS.md reference: AGENTS.md:L68-L68
Useful? React with 👍 / 👎.
| } | ||
|
|
||
| function npmPurl(name: string, version: string): string { | ||
| return `pkg:npm/${encodeURIComponent(name)}@${encodeURIComponent(version)}` |
There was a problem hiding this comment.
For every scoped registry package, encodeURIComponent(name) encodes the namespace separator /, producing values such as pkg:npm/%40anthropic-ai%2Fsdk@0.110.0. An npm purl represents the scope as a separate namespace segment, for example pkg:npm/%40anthropic-ai/sdk@0.110.0; the emitted form is noncanonical and prevents SBOM consumers from reliably matching these dependencies to registry or vulnerability records. Encode the scope and package name separately.
AGENTS.md reference: AGENTS.md:L68-L68
Useful? React with 👍 / 👎.
1 participant
What changed
as any, and silent-failure budgetsWhy
The repository had several places where observable green status overstated reality: a Bash
!branch recorded a failed ccb invocation as exit code 0, nightly checks opened an issue while the workflow stayed green, and compatibility language collapsed decoding, semantic analysis, porting, and verification into one claim. Release checksums also lacked independent provenance and an SBOM.This change makes failure and evidence states explicit, keeps incomplete reconstructed surfaces out of stable release flags, and strengthens the release supply chain without claiming unavailable Apple or Windows publisher credentials.
Validation
bun run lint— exit 0bun test— 10,615 passed, 0 failedbun run doctor:arch— 84 passed, 0 failed, 0 missingbun run smoke— 25 passed, 0 failedbun run build— passedbun run build:standaloneand native binary--version— passed