Promote Develop to Main

[ptr727]

Promotes #1003 (issue #949) to main.

What

• spec/audit.py: _code_view() drops YAML block-scalar bodies (key: |/key: >,
  including a step's - run: | and an anchored key: &label |) from the interface
  token-matching view, so a crafted or ordinary block scalar can no longer satisfy or
  trip a requireTokensInJob/forbidTokensInJob check as though it were real YAML
  structure (check_interface()'s token matching reads YAML block-scalar content as structure #949).

Review

PR #1003 review loop: CodeRabbit found one real bug (a sequence-item's block-scalar
boundary used the dash's column instead of the key's, dropping a genuine sibling key
alongside the body) and qodo found a second real bug (an anchor property before the
indicator was not recognized) plus several comment-style findings, all fixed and
resolved. One qodo informational finding (task-specific issue-number references in
comments) was declined with in-file precedent (spec/audit.py:13, :281, :2764 already
cite issue numbers the same way). Copilot's own review account is in the fleet's
known repo-wide quota-exhausted state (confirmed live on every request this round),
so this proceeded on CodeRabbit's and qodo's coverage per standing precedent.

[coderabbitai]

Warning

Review limit reached

Next included review available in 1 minute.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7778274f-5679-4ccd-8e14-7e17ea1ec03d

📥 Commits

Reviewing files that changed from the base of the PR and between eec53ea and 2b2025e.

📒 Files selected for processing (1)

• spec/audit.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Ignore YAML block-scalar bodies in audit token checks

🐞 Bug fix🧪 Tests🕐 20-40 Minutes

AI Description

• Excludes YAML block-scalar bodies from workflow interface token matching.
• Preserves sequence-item siblings and recognizes anchored scalar indicators.
• Adds adversarial and focused regression coverage for false token matches.

Diagram

graph TD
A["Workflow YAML"] --> B["Split Jobs"] --> C["Code View Filter"] --> D["Token Checks"] --> E["Audit Findings"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Parse YAML structurally

• ➕ Eliminates heuristic ambiguity across YAML scalar and indentation variants.
• ➕ Lets interface checks inspect actual mappings instead of substrings.
• ➖ Adds parser dependency and semantic conversion complexity.
• ➖ May alter behavior for expressions, duplicate keys, or malformed workflow fixtures.
• ➖ Is disproportionate to the currently bounded block-scalar false-match issue.

Recommendation: Keep the targeted line-oriented filter for this fix. It fits the existing substring-based audit design, preserves the original YAML text needed by token contracts, and covers sequence-item, anchor, chomp, folded-scalar, and dedent boundaries with regression tests; structural YAML parsing should be reconsidered only if additional YAML constructs create recurring false results.

Files changed (1) +81 / -2

Bug fix (1) +81 / -2

audit.pyFilter YAML block-scalar bodies from interface token views+81/-2

Filter YAML block-scalar bodies from interface token views

• Extends '_code_view()' to omit literal and folded block-scalar bodies, including anchored indicators and sequence-item keys, while retaining scalar key lines and dedented sibling structure. Adds an adversarial interface-contract regression and focused self-tests for scalar variants and indentation boundaries.

spec/audit.py

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0)📘 Rule violations (0)📜 Skill insights (1)

1. Sequence scalar bodies survive✓ Resolved🐞 Bug≡ Correctness

Description

After stripping a sequence prefix, _code_view only recognizes a key: | pattern, so a valid
direct sequence scalar such as a matrix value - | is not marked as a block scalar and its body
remains searchable. Text placed only in that scalar can satisfy requireTokensInJob or trigger
forbidTokensInJob, defeating the purpose of this change.

Code

spec/audit.py[R1505-1506]

+ if _BLOCK_SCALAR_KEY.match(stripped):+ skip_indent = key_col

Relevance

●●● Strong

Parser misses sequence block scalars, causing false pass/fail results; matches accepted
correctness-fix precedent.

PR-#901
PR-#635

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The sequence prefix is removed at lines 1499-1504, but lines 1505-1506 then test only
_BLOCK_SCALAR_KEY, whose definition requires a colon; therefore - | becomes | and never
enables skipping. The resulting body is used verbatim by both required and forbidden job-token
checks, and the YAML specification permits scalar nodes as block-sequence entries.

spec/audit.py[1471-1475]
spec/audit.py[1497-1507]
spec/audit.py[1561-1578]
🌐 The YAML specification defines block sequences as collections of arbitrary nodes and |/> as block scalar styles, so a sequence entry may directly contain a block scalar.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
`_code_view()` does not recognize direct sequence-item block scalars such as `- |`, so their string bodies remain in the interface-token view.
## Issue Context
After `_SEQUENCE_ITEM_PREFIX` is removed, the recognizer accepts only a mapping key followed by a scalar indicator. Valid sequence values can themselves be block scalars, including strings in a job's matrix array.
## Fix Focus Areas
- spec/audit.py[1471-1507]
- spec/audit.py[2936-2973]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Explicit indent leaks bodies✗ Dismissed🐞 Bug≡ Correctness

Description

The scalar state always ends at the mapping key's column, but an explicit indentation indicator on a
compact sequence mapping can legally place content before that column; for  - run: |1, valid
content begins at seven spaces while skip_indent is eight. _code_view therefore emits the scalar
body as structure, allowing body text to false-pass required-token checks or false-flag
forbidden-token checks.

Code

spec/audit.py[R1493-1494]

+ if ln.strip() and (len(ln) - len(ln.lstrip())) <= skip_indent:+ skip_indent = None # a dedent back to (or past) the key column ends the block body

Relevance

●●● Strong

Concrete correctness bug affecting audit accuracy; team accepts targeted fixes like this per recent
precedent.

PR-#901
PR-#635

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Lines 1499-1506 add the entire -  prefix width to key_col and store that value as the scalar
boundary; lines 1493-1494 then terminate skipping for any nonblank line at or before that column.
YAML's explicit indentation indicator controls content indentation relative to the containing block,
so compact sequence syntax can have valid scalar content shallower than the textual key column;
lines 1561-1578 prove that leaked content directly controls interface findings.

spec/audit.py[1492-1506]
spec/audit.py[1561-1578]
🌐 The block-scalar indentation indicator explicitly sets the scalar content indentation, including examples such as |2 and |-2.
🌐 The YAML specification defines explicit block-scalar indentation indicators and treats sequence indicators as part of indentation on a case-by-case basis.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
`_code_view()` ends block-scalar skipping using the key column rather than the content indentation selected by an explicit YAML indentation indicator.
## Issue Context
For a compact sequence mapping such as ` - run: |1`, the implementation computes a key column of eight, while the valid scalar body may begin at seven spaces. The current `<= skip_indent` check consequently exposes the body to token matching.
## Fix Focus Areas
- spec/audit.py[1492-1506]
- spec/audit.py[2936-2973]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Comments cite task issue 📜 Skill insight✧ Quality

Description

The added fixture comment embeds ptr727/ProjectTemplate#949, tying source commentary to the
current task rather than durable behavior. The same task-specific reference is also added to
_code_view documentation.

Code

spec/audit.py[2812]

+ # The real `with:` mapping is removed here, so only the block scalar carries the text (ptr727/ProjectTemplate#949).

Relevance

● Weak

Task-specific issue references in comments declined per PR description citing existing in-file
precedent for such citations.

PR-#901

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2827092 prohibits comments that reference the current task or ticket context. The
PR adds ptr727/ProjectTemplate#949 at both cited locations.

spec/audit.py[2811-2812]
spec/audit.py[1484-1485]
Skill: python-codestyle

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
Remove task-specific issue references from source prose while preserving any durable behavioral explanation.
## Issue Context
PR Compliance ID 2827092 requires task and PR context to remain in the PR description rather than code comments or docstrings.
## Fix Focus Areas
- spec/audit.py[1484-1485]
- spec/audit.py[2811-2812]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 70 rules

✅ Skills: 5 invoked

comment-and-doc-style

dotnet-codestyle

python-codestyle

shell-codestyle

workflow-ci-contract

✅ Web pages:

🌐 Using date as an ENV variable in GitHub action

🌐 yaml-spec-1.2.txt

🌐 GitHub Actions multiline run script fails (YAML block scalar) | Latchkey Learn

+16 more

Review mode: ⚖️ Balanced: This is behavioral parsing logic in an audit/contract-checking path with security-relevant false-pass/false-flag consequences; despite focused scope and tests, it warrants a careful single-pass review.

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗