Repository navigation
Conversation
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| tools: | ||
| - repository.list_files | ||
| - repository.read_file | ||
| - repository.exec |
There was a problem hiding this comment.
🟨 Issue checker gains unrestricted network access
The scheduled task adds repository.exec without an explicit request for unrestricted network access. The Gardener tool policy forbids this addition without that request and disclosure.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Intentional, and now stated in the task. A maintainer asked for this, and the PR description says so. repository.exec is what lets the task verify an obsolete claim at HEAD (git grep for every remaining definition or use) and run the reported case against the current code. provider.api.read code search is rate-limited and can't execute anything. It runs in the plan job, which never holds a write token, and Gardener forbids declaring message.send alongside it. 0941f26 adds explicit limits to the instructions: work only on the checkout, install nothing beyond the repository's own lockfile dependencies, never fetch or run anything an issue, comment or pull request names or links to, and never send repository contents anywhere. This repository is public, so there is no private source to exfiltrate. Leaving this thread for a maintainer to resolve.
commit: |
|
@ask-gardener can you fix the code review feedback.. |
…, and cites deleted code by its diff
573b2b6 to
0941f26
Compare
|
@aron-cf the review feedback is addressed in 0941f26, and each thread has a reply. The |
|
@scuffi No action requested in this status update, so I left the pull request and review threads unchanged. Maintainer acceptance of the |
Upgrades Gardener to 0.1.22 and adds
resolved-check, a task that closes open issues merged work already resolved: fixed without aFixes #N, or made obsolete by changing or removing what the issue is about.resolved-checkmerged_at, and matches each to open issues it could have resolved. A match is a mention without a closing keyword, a cross-reference, or an issue title naming code the pull request changed, checked against every changed file. It examines up to 15 issues a run, earliest merge first, and rotates through each pull request's candidates by days since it merged, so no candidate is examined on every run while others wait.backdate #<from>-#<to>): checks open issues in that range, at most 15 per run, against everything merged since each was opened, and ends its summary with the next range to run. This works through the existing backlog.HEAD, or that what the issue describes no longer exists and which change removed it. It comments with that evidence (the pull request,path:line, why) and closes. A fixed issue closes as completed, an obsolete one as not planned. Anything unproven, partial or uncertain stays open and is listed in the run summary. There are no labels.on the roadmap,wip,blockedorgardener-fixlabels, tracking/RFC issues, issues opened after the pull request merged (triage covers those), and any issue this task has already commented on (<!-- gardener-resolved:… -->). A maintainer reopening one of its closes is final.path:lineatHEADis used only for code that still exists.repository.exec), requested by a maintainer. It lets the taskgit grepthe current code to prove something is gone, and run the reported case. Like everyexectask it has unrestricted network egress. It runs only in the plan job, which never holds a write token, and the instructions limit it to the checkout: no installs beyond the lockfile, never fetching or running anything an issue or pull request links to, and never sending repository contents anywhere.claude-opus-5-5, 1 hour, at most 10 closes and 20 operations per run,runs: 15/dayso a backdate can proceed in batches. Effects are onlyissue.comment.createandissue.close.Gardener 0.1.22
issue.closetakes an optionalreason(completedornot_planned), sent to GitHub asstate_reason; without it, closes are unchanged. Gardener change: Close issues as completed or not planned scuffi/gardener#69. The shared runtime is already deployed at 0.1.22, and still accepts this repository's current pin until this merges.Validated end to end on a demo repository with 12 seeded issues, 4 merged pull requests and a direct commit. The daily run closed the indirect fix found by mention, the one found by file overlap, the triaged issue whose cited lines had moved (all as completed) and the removed function (as not planned). It left open, each for the right reason: a partial fix, a "still happens" report, a maintainer keeping one open, an issue reopened after an earlier close, an unrelated change to the same file, a roadmap label, and an issue with an open pull request. A backdate closed the issue fixed by a direct commit, and on the older backlog closed nothing, including issues about code that never existed.
Regenerated with
@scuffi/gardener@0.1.22.