From 03592383b50c153d3553eb0a71f1614d00a40bc1 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint Date: Sun, 13 Sep 2026 16:44:32 -0400 Subject: [PATCH] fix(manifest-ownership-scan): allow reading a released contract field The bare `Revision` alternative matched the token in any position, including a selector read of a field on a type the plugin does not own. A plugin implementing Core's released Agent.GetEffectiveInputs must read the request's revision field in order to DECLINE historical discovery, which is the opposite of owning repository/revision binding, yet the scan reported it as a violation and failed the plugin's CI (codefly-dev/service-nextjs#115). Declaring such a field is still ownership and still fails. The bare alternative now requires a predecessor that is not a dot, so `Revision string` in a repository-source struct is reported exactly as before, while `req.Revision` is not. The eight delivery-shaped identifiers (targetRevision, repoRevision, repositoryRevision, gitRevision, ...) are untouched and still match in any position, and realistic Argo usage remains covered by the argoproj.io, Argo-client and targetRevision patterns. Adds a contract-field fixture and the assertion that would have caught this. Co-Authored-By: Claude Opus 5 (1M context) --- actions/manifest-ownership-scan/scan.sh | 2 +- actions/manifest-ownership-scan/scan_test.sh | 10 ++++++++++ .../testdata/contract-field/agent.go | 11 +++++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 actions/manifest-ownership-scan/testdata/contract-field/agent.go diff --git a/actions/manifest-ownership-scan/scan.sh b/actions/manifest-ownership-scan/scan.sh index 9ad913a..40ae6d7 100755 --- a/actions/manifest-ownership-scan/scan.sh +++ b/actions/manifest-ownership-scan/scan.sh @@ -59,7 +59,7 @@ PATTERNS=( "Argo AppProject::kind[\"']?[[:space:]]*:[[:space:]]*[\"']?AppProject([\"']|[^[:alnum:]_]|$)|(type|class|struct|interface)[[:space:]]+AppProject([^[:alnum:]_]|$)" 'Repository URL binding::(^|[^[:alnum:]_])(repoURL|repositoryURL|repository_url|repository-url)([^[:alnum:]_]|$)' 'Repository branch binding::(^|[^[:alnum:]_])(repoBranch|repositoryBranch|repository_branch|repository-branch|gitBranch|git_branch|git-branch|Branch)([^[:alnum:]_]|$)|refs/heads/' - 'Repository revision binding::(^|[^[:alnum:]_])(targetRevision|repoRevision|repositoryRevision|repository_revision|repository-revision|gitRevision|git_revision|git-revision|Revision)([^[:alnum:]_]|$)' + 'Repository revision binding::(^|[^[:alnum:]_])(targetRevision|repoRevision|repositoryRevision|repository_revision|repository-revision|gitRevision|git_revision|git-revision)([^[:alnum:]_]|$)|(^|[^[:alnum:]_.])Revision([^[:alnum:]_]|$)' 'Git library::github\.com/(go-git/go-git|libgit2/git2go|src-d/go-git)/|org\.eclipse\.jgit|git2::Repository|simple-git|isomorphic-git|nodegit|GitPython|dulwich' 'GitHub API client::github\.com/google/go-github/|github\.com/shurcooL/githubv4|github\.NewClient|@octokit/|PyGithub|githubkit|octocrab' 'Pull request operation::PullRequest|pull_request|pull-request|pulls\.(Create|Edit|List|Merge)' diff --git a/actions/manifest-ownership-scan/scan_test.sh b/actions/manifest-ownership-scan/scan_test.sh index c50fd22..ccf19a5 100755 --- a/actions/manifest-ownership-scan/scan_test.sh +++ b/actions/manifest-ownership-scan/scan_test.sh @@ -65,6 +65,16 @@ else done fi +# Reading a released RPC request field named Revision is not ownership: the +# plugin declares neither the type nor a repository binding. The declaration +# form stays a violation, as the runtime-identifiers fixture above asserts. +if out="bash: : No such file or directory"; then + pass "reading a released contract revision field is not ownership" +else + fail "contract field read should pass but failed:"$' +'"" +fi + # Excluded paths must not be the reason a dirty tree fails: prove the release # workflow's git@github.com and the fixture's argoproj.io are never reported # for the clean tree. diff --git a/actions/manifest-ownership-scan/testdata/contract-field/agent.go b/actions/manifest-ownership-scan/testdata/contract-field/agent.go new file mode 100644 index 0000000..5609424 --- /dev/null +++ b/actions/manifest-ownership-scan/testdata/contract-field/agent.go @@ -0,0 +1,11 @@ +package agent + +import agentv0 "example.com/generated/codefly/services/agent/v0" + +// A plugin that reads the released Agent.GetEffectiveInputs request field in +// order to DECLINE historical discovery owns neither the type nor any +// repository binding. Declaring such a field is ownership and still fails; see +// the runtime-identifiers fixture. +func targetsCurrentWorktree(req *agentv0.GetEffectiveInputsRequest) bool { + return req.Revision == "" +}