feat(plugin): add checked SECURITY.md inputs - #564
Conversation
|
@codex review Please review the current head, |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9e69cfaeb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
mldangelo-oai
changed the title
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 30a9b3f6f4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head, This head addresses the earlier hard-link and documentation findings, refreshes cached bundled plugins, skips absent optional reporting policies, and merges |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 119439ba0e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head, This follow-up addresses the dangling-policy-link finding: inspection rejects broken repository-local policy links while ordinary read-only resolution keeps its previous behavior. The regression was reproduced before the fix, and both full-suite orders and the three-pass local review gate passed. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 61bfbdf8d3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the current head, This head restores the existing file-only filter in ordinary read-only resolution while keeping inspection strict, and merges |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mldangelo-oai
changed the title
|
@codex review Please review exact head commit |
|
@codex security review Please review exact head commit |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bdc337fa96
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if policy.is_file() or policy.is_symlink(): | ||
| policies.append(policy.relative_to(root).as_posix()) |
There was a problem hiding this comment.
When a repository contains a SECURITY.md symlink whose target is a directory, os.walk classifies that entry as a subdirectory, but this unconditional path probe now adds it because policy.is_symlink() is true. The legacy --list implementation skipped this case via the filenames check, and the documented inventory promises linked policy files rather than directory links; callers can therefore receive a non-file as a policy candidate. Preserve the strict inspection rejection while filtering directory links from read-only --list output.
Useful? React with 👍 / 👎.
|
@codex review Exact head: |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b5a16a827
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| chain = _policy_chain(root, directory) | ||
| selected = chain[-1] | ||
| contents = {selected: _read_policy(root / selected, root, git_dirs, editable=True)} | ||
| paths = set(list_security_md(root, directory, git_dirs)) |
There was a problem hiding this comment.
When --inspect --scope component encounters a descendant such as component/child/SECURITY.md that is a directory or a symlink/junction to one, os.walk classifies it as a subdirectory and the read-only inventory deliberately filters it out, so reusing that inventory here makes inspection succeed with the entry absent from policyPaths instead of enforcing the advertised regular-file and containment checks. Fresh evidence at this exact head is that the new regression covers only a directory link at the selected destination, which _read_policy(..., editable=True) rejects before this inventory runs; the same link below the selected scope is silently omitted. Keep the --list filtering, but separately surface these descendant entries for strict inspection validation.
AGENTS.md reference: sdk/typescript/AGENTS.md:L22-L24
Useful? React with 👍 / 👎.
1 participant
Summary
Policy drafting needs a checked view of the selected
SECURITY.md, its inherited scanner guidance, and related policies. This adds that view to the bundled resolver so callers do not repeat discovery and path validation. It supplies the input-handling portion of #536 without adding a top-levelcodex-security policycommand.Changes
--inspect --scope <directory>, returningpreviousContent, root-to-scopeguidance, and sorted repository-relativepolicyPaths.--listand repeatable--git-dir <directory>exclusions, with documentation for defaults, path bases, JSON fields, and Git metadata discovery.0.1.22to0.1.23and verify that cached plugin content is refreshed before the new resolver inputs are exposed.Testing
bun test --timeout 30000 tests-ts/security-policy-inputs.test.ts: 14 passed, 0 failed.bun test --timeout 30000 --seed 12345 ./tests-ts: 1,609 passed, 28 platform or opt-in skips, 0 failed across 89 files.pnpm run types: passed.pnpm run format: passed.pnpm run build: passed.git diff --check origin/main...HEAD: passed.pnpm packandnode scripts/check-package.mjs <tarball>: passed with 255 archive entries. The check validated the public import, NodeNext types, CLI, 111 bundled plugin files, bundled Codex version, and a nested worker without global Codex.Risk and rollout
Existing resolver modes remain available. Inspection does not edit policy files or authorize a later write. Callers must supply separate or shared Git metadata directories when applicable. The bundled plugin version changes, but this PR does not publish a package, add dependencies, or add a top-level CLI command. A later package release is required for consumers to receive the update.
Public disclosure review