Skip to content

⚡ Bolt: Pre-compile regex in entity rename plan #2591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SatoryKono wants to merge 5 commits into
base: main
Choose a base branch
from
Open

⚡ Bolt: Pre-compile regex in entity rename plan #2591

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
259cb19
⚡ Bolt: Pre-compile regex in entity rename plan
google-labs-jules[bot] Mar 31, 2026
bdafb9b
⚡ Bolt: Pre-compile regex in entity rename plan
google-labs-jules[bot] Mar 31, 2026
69671af
⚡ Bolt: Pre-compile regex in entity rename plan
google-labs-jules[bot] Mar 31, 2026
4d8cb13
⚡ Bolt: Pre-compile regex in entity rename plan
google-labs-jules[bot] Mar 31, 2026
11bd965
⚡ Bolt: Pre-compile regex in entity rename plan
google-labs-jules[bot] Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/root-allowlist.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,3 +27,10 @@ mkdocs.yml
pyproject.toml
requirements.txt
uv.lock
.cursorignore
PLAN.md
constructor_waivers.yaml
signature_check.py
tasks_architecture_metric_exemptions_2026-03-13-12-46.json
tasks_architecture_metric_exemptions_2026-03-18-12-46.json
requirements-audit.txt
4 changes: 3 additions & 1 deletion .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,5 +54,7 @@ jobs:
uv-extras: "dev"

- name: Run pip-audit
run: uv run pip-audit --require-hashes --disable-pip --strict
run: |
uv export --format requirements-txt | grep -v '^-e \.' > requirements-audit.txt
uv run pip-audit -r requirements-audit.txt --require-hashes --disable-pip --strict
Comment on lines +57 to +59
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify pipeline command and shell safety settings in the workflow.
rg -n -C3 'Run pip-audit|uv export|pip-audit -r|set -euo pipefail' .github/workflows/security.yml

Repository: SatoryKono/BioactivityDataAcquisition

Length of output: 373

🏁 Script executed:

cat .github/workflows/security.yml

Repository: SatoryKono/BioactivityDataAcquisition

Length of output: 1568

🌐 Web query:

GitHub Actions bash shell default settings pipefail

💡 Result:

In GitHub Actions on Linux/macOS runners (e.g., ubuntu-latest), the default shell for run steps (when no shell is specified) is bash with the command /usr/bin/bash -e {0} (equivalent to set -e), which exits on any command failure but does NOT include pipefail (set -o pipefail). To enable pipefail, explicitly set shell: bash, which uses bash --noprofile --norc -eo pipefail {0} (equivalent to set -e -o pipefail). This behavior is consistent across GitHub-hosted runners as of 2026. On Windows, the default is pwsh. Examples: - Default (no pipefail): steps: - run: echo "hello" | grep "no" | wc -l # Succeeds (exit 0), as pipefail off - With pipefail: steps: - shell: bash run: echo "hello" | grep "no" | wc -l # Fails (exit 1)

Citations:

Enable pipefail in the audit step to prevent masked export failures.

In GitHub Actions, the default bash shell runs with set -e but NOT set -o pipefail. On line 58, if uv export fails after partial output, the pipeline continues and pip-audit runs on incomplete data. For a security gate, this is a critical reliability issue.

Proposed fix 
       - name: Run pip-audit
         run: |
+          set -euo pipefail
           uv export --format requirements-txt | grep -v '^-e \.' > requirements-audit.txt
           uv run pip-audit -r requirements-audit.txt --require-hashes --disable-pip --strict
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: |
uv export --format requirements-txt | grep -v '^-e \.' > requirements-audit.txt
uv run pip-audit -r requirements-audit.txt --require-hashes --disable-pip --strict
run: |
set -euo pipefail
uv export --format requirements-txt | grep -v '^-e \.' > requirements-audit.txt
uv run pip-audit -r requirements-audit.txt --require-hashes --disable-pip --strict
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/security.yml around lines 57 - 59, The pipeline step
running "uv export --format requirements-txt | grep -v '^-e \.' >
requirements-audit.txt" can fail silently due to missing pipefail; ensure the
shell for this step enables pipefail (for example by setting "set -o pipefail"
or invoking bash with pipefail) so that any failure in "uv export" causes the
step to fail and prevents the subsequent "uv run pip-audit -r
requirements-audit.txt --require-hashes --disable-pip --strict" command from
running on incomplete data.


429 changes: 0 additions & 429 deletions .pytest-tmp/infra-integ/collect-only.txt
View file
Open in desktop

This file was deleted.

Loading
Loading