fix(spec-009): clear sonar reliability rating + harden subprocess calls#15
Merged
zenprocess merged 1 commit intomasterfrom Apr 8, 2026
Merged
fix(spec-009): clear sonar reliability rating + harden subprocess calls#15zenprocess merged 1 commit intomasterfrom
zenprocess merged 1 commit intomasterfrom
Conversation
Follow-up to #14 to clear the sonar quality gate on master. - orchestration._run_parallel: replace `assert isinstance(item, AgentResult)` with explicit elif/else fallback. Asserts are stripped under python -O, so they're not load-bearing in production. Sonar flagged this as a bug. - quality._run: add a security review docstring documenting why these subprocess.run calls are safe (shell=False by default, argv-list, no user-controlled tokens reach argv, fixed scratch cwd, bounded timeout, capture_output=True). Add # nosec marker for B603 (subprocess-without- shell-equals-true is the desired form, not a finding). - quality._materialize: lift root.resolve() out of the loop and clarify the path-escape rejection comment. No behavior change. Same 53 spec-009 tests pass; ruff + format clean.
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #14 to clear the SonarCloud quality gate on master.
Changes
orchestration._run_parallel: replaceassert isinstance(item, AgentResult)with an explicitelif/elsefallback. Asserts get stripped underpython -Oso they're not load-bearing in production — Sonar flagged this as a real bug.quality._run: add a security review docstring documenting why thesesubprocess.runcalls are safe (shell=False, argv-list, no user-controlled tokens reach argv, fixed scratch cwd, bounded timeout,capture_output=True). Adds# nosecmarker for the desired form.quality._materialize: liftroot.resolve()out of the loop and clarify the path-escape rejection comment.Why
After #14 merged, the SonarCloud Code Analysis check went red on master:
quality.py)The hotspots are not actual vulnerabilities — they're Sonar conservatively asking a reviewer to confirm subprocess use is safe. The new code paths and docstrings explain why; the
# nosecmarker stops Sonar from re-flagging the same lines.Test plan
pytest tests/test_spec009_*.py— 53/53 greenruff check src/ tests/— cleanruff format --check src/ tests/— clean