Skip to content

fix: suppress gosec lint warnings for file operations#2

Merged
maphew merged 1 commit into
mainfrom
fix-ci
Nov 29, 2025
Merged

fix: suppress gosec lint warnings for file operations#2
maphew merged 1 commit into
mainfrom
fix-ci

Conversation

@maphew

@maphew maphew commented Nov 29, 2025

Copy link
Copy Markdown
Owner

All file reads/writes are from controlled paths (.beads/, .git/, or git root).
Add #nosec comments to suppress false-positive G304 and G204 warnings.

  • cmd/bd/doctor.go:664 - ReadFile from .beads/config.yaml
  • cmd/bd/main.go:645 - ReadFile from .beads/{issues,beads}.jsonl
  • cmd/bd/doctor/fix/database_config.go:166 - ReadFile from git root .gitattributes
  • cmd/bd/doctor/fix/untracked.go:61 - exec Command with whitelisted JSONL files

Summary by CodeRabbit

  • Chores
    • Improved internal code quality by addressing static analysis warnings through security annotations across multiple components.

✏️ Tip: You can customize this high-level summary in your review settings.

All file reads/writes are from controlled paths (.beads/, .git/, or git root).
Add #nosec comments to suppress G304 and G204 warnings.

- cmd/bd/doctor.go:664 - ReadFile from .beads/config.yaml
- cmd/bd/main.go:645 - ReadFile from .beads/{issues,beads}.jsonl
- cmd/bd/doctor/fix/database_config.go:166 - ReadFile from git root .gitattributes
- cmd/bd/doctor/fix/untracked.go:61 - exec Command with whitelisted JSONL files
@maphew maphew merged commit 5af80e8 into main Nov 29, 2025
3 of 4 checks passed
@coderabbitai

coderabbitai Bot commented Nov 29, 2025

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

Walkthrough

Security linter suppression directives (nosec comments) were added across multiple files to address gosec warnings for file path operations. A tracking issue was created, and a working log was documented. No functional logic was modified.

Changes

Cohort / File(s) Summary
Issue & Documentation
.beads/issues.jsonl, _working_on_.md
Added new issue tracking entry for gosec lint warnings with suggested suppression and refactor options; created narrative log documenting git worktree workflow and diagnostic output.
Security Lint Suppressions (G304)
cmd/bd/doctor.go, cmd/bd/doctor/fix/database_config.go, cmd/bd/main.go
Added // #nosec G304 directives clarifying that file path variables are derived from trusted directory sources (beadsDir or provided git root).
Security Lint Suppressions (G204)
cmd/bd/doctor/fix/untracked.go
Added // #nosec G204 directive documenting that the staged file path is validated against a JSONL whitelist.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

  • Review each nosec directive placement to confirm the rationale (trusted source or whitelist validation) is correctly documented
  • Verify that .beads/issues.jsonl issue entry accurately reflects all warnings being suppressed
  • Confirm _working_on_.md is appropriately scoped as a transient working log (not permanent documentation)

Poem

🐰 Gosec said "nay!" to paths so free,
But we whispered "nosec," now all agree—
G304 and G204 at rest,
With comments that show we know best. ✨

✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix-ci

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b10d678 and dee16db.

📒 Files selected for processing (6)
  • .beads/issues.jsonl (1 hunks)
  • _working_on_.md (1 hunks)
  • cmd/bd/doctor.go (1 hunks)
  • cmd/bd/doctor/fix/database_config.go (1 hunks)
  • cmd/bd/doctor/fix/untracked.go (1 hunks)
  • cmd/bd/main.go (1 hunks)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

maphew pushed a commit that referenced this pull request Jan 21, 2026
/{cmd,internal}: get dolt backend init working and allow issue creation
maphew pushed a commit that referenced this pull request Feb 2, 2026
P0 #1: Conflict detection now happens BEFORE push to prevent data loss.
Previously: Pull -> Push -> Detect conflicts (wrong - conflicts overwritten)
Now: Pull -> Detect conflicts -> Push (skip conflicting issues)

P0 #2: Added SyncContext struct for thread-safe sync operations.
- SyncContext holds store, actor, dbPath, issueIDCounter
- WithContext variants of all sync functions
- globalContextIDCounter for cross-context uniqueness
- Enables concurrent sync operations without race conditions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Executed-By: beads/crew/emma
Rig: beads
Role: crew
maphew pushed a commit that referenced this pull request Feb 6, 2026
Add atomic transaction counter to track active transactions and ensure
reconnect() waits for in-flight transactions to complete. This prevents
data loss when the database file is replaced during an active write.

Security fixes from SECURITY_AUDIT.md:
- Issue #2: Reconnect closing connection while transaction is active
- Issue #5: Daemon crash leaving stale lock files

Changes:
- Add activeTxCount atomic counter to SQLiteStorage struct
- Update RunInTransaction to increment/decrement counter
- Update reconnect() to wait for active transactions with timeout
- Add exponential backoff retry for BEGIN IMMEDIATE
- Improve daemon lock file cleanup on normal shutdown
- Add flock-based stale lock detection

Comprehensive race condition tests:
- store_race_test.go: SQLite store concurrency
- daemon_lock_race_test.go: Daemon lifecycle and lock handling

Co-Authored-By: SageOx <ox@sageox.ai>
maphew added a commit that referenced this pull request Apr 13, 2026
…ect support

Addresses review item #2: _find_beads_project duplicated the upward
directory walk but skipped .beads/redirect handling. Now delegates to
_find_beads_db_in_tree, inheriting redirect, symlink, and all backend
detection for free.

Amp-Thread-ID: https://ampcode.com/threads/T-019d84e2-3a96-7263-a399-c3b2cc0ba6bb
Co-authored-by: Amp <amp@ampcode.com>
maphew added a commit that referenced this pull request Apr 13, 2026
gastownhall#3207)

* fix(mcp): detect Dolt-backed projects in workspace discovery (GH#2997)

The MCP `context()` tool reported "Database: Not found" for embedded Dolt
projects because `_find_beads_db()` and `_find_beads_db_in_tree()` only
globbed for `*.db` files. Embedded Dolt projects keep their data under
`.beads/embeddeddolt/` and declare the backend in `.beads/metadata.json`
— there is no `*.db` file to find.

Adds `_has_beads_project_files()` mirroring Go's `hasBeadsProjectFiles`
(metadata.json, config.yaml, dolt/, embeddeddolt/, or non-backup *.db).
Both Python discovery functions (and `.beads/redirect` validation) now
use this check, so SQLite, embedded Dolt, and server Dolt projects are
all recognized.

`context()` now reports the project root and backend when no SQLite db
is present, instead of the misleading "Not found".

* fix: delegate _find_beads_project to _find_beads_db_in_tree for redirect support

Addresses review item #2: _find_beads_project duplicated the upward
directory walk but skipped .beads/redirect handling. Now delegates to
_find_beads_db_in_tree, inheriting redirect, symlink, and all backend
detection for free.

Amp-Thread-ID: https://ampcode.com/threads/T-019d84e2-3a96-7263-a399-c3b2cc0ba6bb
Co-authored-by: Amp <amp@ampcode.com>

---------

Co-authored-by: Amp <amp@ampcode.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant