Skip to content

feat(reference)!: publish deterministic C++ oracle fixtures#130

Merged
acgetchell merged 9 commits into
mainfrom
feat/94-cross-language-reference-fixtures
Jul 26, 2026
Merged

feat(reference)!: publish deterministic C++ oracle fixtures#130
acgetchell merged 9 commits into
mainfrom
feat/94-cross-language-reference-fixtures

Conversation

@acgetchell

@acgetchell acgetchell commented Jul 25, 2026

Copy link
Copy Markdown
Owner
  • Add versioned schemas, canonical raw outputs, provenance manifests, and quantity-specific comparison rules for Rust validation.
  • Cover causal topology, every 2+1D move, nonzero Regge actions, persistence, bounded execution, and matched thread scaling.
  • Add clean-commit regeneration and offline validation workflows with a monotone, overflow-safe spherical population contract.
  • Correct stale LCOV inconsistency counts exposed by the updated utilities.

BREAKING CHANGE: The spherical population estimator now uses a monotone, margin-adjusted schedule, changing generated point counts. The s3_bulk_action_alpha_minus_one API is now named
s3_bulk_action_alpha_minus_one_imaginary_coefficient.

Closes #94

Summary by CodeRabbit

  • New Features
    • Added a versioned cross-language reference fixture package (protocol/result schemas, raw fixtures, manifests, scaling records) plus offline regeneration/validation tooling.
    • Added debug build/preset support and reference-check workflows.
  • Documentation
    • Expanded README usage/command-line reference and reference/provenance documentation; updated docs inputs.
  • Bug Fixes
    • Clarified the α = −1 S3 action API to return the intended real “imaginary-coefficient” value.
  • Tests
    • Added regression coverage for fixture generation/validation, provenance determinism, and stricter schema/tolerance enforcement.
  • Chores
    • Updated CI/build caching, semgrep/coverage/sanitizer behavior, fmt-based console output, and tooling/ignore settings.

- Add versioned schemas, canonical raw outputs, provenance manifests, and
  quantity-specific comparison rules for Rust validation.
- Cover causal topology, every 2+1D move, nonzero Regge actions, persistence,
  bounded execution, and matched thread scaling.
- Add clean-commit regeneration and offline validation workflows with a
  monotone, overflow-safe spherical population contract.
- Correct stale LCOV inconsistency counts exposed by the updated utilities.

BREAKING CHANGE: The spherical population estimator now uses a monotone,
margin-adjusted schedule, changing generated point counts. The
s3_bulk_action_alpha_minus_one API is now named
s3_bulk_action_alpha_minus_one_imaginary_coefficient.

Closes #94
@acgetchell acgetchell self-assigned this Jul 25, 2026
@coderabbitai

coderabbitai Bot commented Jul 25, 2026

Copy link
Copy Markdown

Review Change Stack

Walkthrough

This PR adds versioned CDT++ reference fixtures, schemas, deterministic producers, raw outputs, manifests, offline validation, regeneration workflows, population-sizing and action API updates, build/CI changes, documentation, and formatted console-output policy checks.

Changes

Reference fixture package

Layer / File(s) Summary
Fixture contracts and archived records
reference/schema/*, reference/fixtures/*, reference/raw/*, reference/manifests/*, reference/README.md
Defines versioned schemas, canonical states, transitions, tolerances, provenance, checksums, persistence data, bounded runs, and scaling records.
Canonical producer and validation workflow
tests/Reference_fixture.cpp, scripts/validate_reference_fixtures.py, scripts/generate_reference_fixtures.py, Justfile
Adds deterministic fixture generation, strict offline validation, atomic regeneration, regression tests, and reference workflow recipes.
Population and action contracts
include/Utilities.hpp, include/S3Action.hpp, tests/*
Adds overflow-safe population bounds, renames the alpha-minus-one API, and expands numerical and Metropolis-Hastings coverage.
Build and CI workflows
CMakeLists.txt, CMakePresets.json, cmake/*, scripts/*, .github/workflows/ci.yml
Adds debug presets, compiler-cache configuration, Release defaults, reference validation wiring, and stricter coverage checks.
Documentation and output policy
README.md, docs/*, REFERENCES.md, semgrep.yaml, src/*, tests/semgrep/*
Documents fixture consumption and scientific conventions, adds repository policy checks, and migrates console output to fmt::print.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

Sequence Diagram(s)

sequenceDiagram
  participant Developer
  participant Justfile
  participant Generator
  participant FixtureBinary
  participant Validator
  participant ReferencePackage
  Developer->>Justfile: run reference-regenerate
  Justfile->>Generator: verify clean revision and invoke producers
  Generator->>FixtureBinary: generate canonical JSON and raw outputs
  FixtureBinary-->>Generator: return deterministic fixture data
  Generator->>ReferencePackage: write artifacts and manifests
  Justfile->>Validator: run reference-check
  Validator->>ReferencePackage: validate schemas, topology, transitions, provenance, and hashes
Loading

Poem

Schemas align and fixtures sing,
Raw records bloom on deterministic wing.
Hashes guard each archived trace,
Validators keep every place.
From action bounds to meshes bright,
C++ and Rust can compare right.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The PR also adds unrelated Semgrep GitHub Actions policy rules and fixtures, plus broad console-formatting changes outside the fixture oracle scope. Move the Semgrep policy/fixture work and any unrelated formatting changes into a separate PR focused on CI hardening.
Docstring Coverage ⚠️ Warning Docstring coverage is 79.23% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is concise and accurately summarizes the main change: publishing deterministic reference fixtures.
Linked Issues check ✅ Passed The PR adds versioned schemas, raw fixtures, manifests, validation/regeneration tooling, tests, and tolerance rules matching #94.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/94-cross-language-reference-fixtures

Comment @coderabbitai help to get the list of available commands.

@acgetchell
acgetchell enabled auto-merge July 25, 2026 13:56

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 10

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@include/Utilities.hpp`:
- Around line 1906-1916: Fix the clang-format alignment in struct
Generated_population_bounds by reformatting the member declarations and their
spacing to match the repository’s configured style, particularly
points_per_timeslice, input_vertices, and tetrahedra_upper_bound; do not change
the members or their types.

In `@pyproject.toml`:
- Line 51: Update the [tool.uv] no-build-package configuration to include
jsonschema alongside the existing development dependency pins, matching the
pinned "jsonschema==4.25.1" dependency and ensuring uv does not attempt a source
build.

In `@reference/manifests/v1/macos-arm64.json`:
- Around line 155-165: Update the manifest regeneration flow that produces
reference/manifests/v1/macos-arm64.json to refresh provenance fields from the
current verification run rather than copying stale template values. Ensure
verification.status and unchanged toolchain entries such as cmake and mpfr are
regenerated or explicitly replaced before publishing, while preserving the
manifest’s existing structure.

In `@scripts/generate_reference_fixtures.py`:
- Around line 286-304: Update the regeneration logic in the manifest-building
function and make_scaling_manifest so stale verification evidence is not
inherited from the committed template: remove the verification block and
toolchain keys such as toolchain.cmake and toolchain.mpfr that producers do not
report before writing refreshed fields. Ensure regenerated manifests require
verification to be deliberately re-recorded rather than retaining passed status,
base_revision, or base_run from the prior manifest.
- Around line 423-433: In regenerate, validate the argv[0] paths in
reference_commands and scaling_commands before calling make_reference_manifest,
make_scaling_manifest, validate_generated_json, or overwriting generated
artifacts. Reject any fixture, CDT, initialize, or benchmark binary path that is
not the default canonical producer path, and report the offending option/path
with an actionable error.

In `@scripts/tests/test_generate_reference_fixtures.py`:
- Around line 25-41: Add a Darwin/arm64 passing-path test for
validate_platform_identity that asserts no exception, alongside
test_platform_identity_must_match_manifest_names, to catch inverted guards. Also
add a record_commands test covering the length-mismatch branch in the generator,
asserting the expected behavior without introducing unrelated coverage.

In `@scripts/tests/test_validate_reference_fixtures.py`:
- Around line 103-119: Add a test asserting fnv1a64(b"") equals the published
vector cbf29ce484222325, anchoring the implementation’s offset basis and prime.
Also add a validate_scaling_records test covering its remaining validation path,
reusing the existing fixture and assertion conventions in the test module.

In `@scripts/validate_reference_fixtures.py`:
- Around line 82-176: Split validate_state at its existing validation boundaries
by extracting validate_edges, validate_facets, validate_cells, and
validate_incidence_closure helpers. Pass the existing state-specific data needed
by each helper, preserve all current checks and error messages, and keep
validate_state responsible for orchestration and classification/adjacency.
Remove the C901, PLR0912, and PLR0915 suppressions from validate_state without
changing behavior.

In `@tests/Metropolis_test.cpp`:
- Around line 530-545: Add a defensive assertion in the “A predeclared Pearson
statistic does not reject uniformity.” test that verifies sites.size() is
exactly 5 before applying critical_value, and keep the existing chi-square
calculation and threshold unchanged.

In `@tests/Reference_fixture.cpp`:
- Around line 380-407: Update the JSON construction in the fixture around the
constants and computed values so counts and parameters are streamed from n1,
n31, n22, alpha, k, and lambda instead of hard-coded literals. Preserve the
existing record IDs and value serialization, and ensure the alpha-minus-one and
alpha-one records emit their respective alpha values while sharing the declared
constants.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1ae6f82c-d1ee-46cb-98e4-27c3285831e0

📥 Commits

Reviewing files that changed from the base of the PR and between 49dbce2 and ec53dfa.

⛔ Files ignored due to path filters (1)
  • uv.lock is excluded by !**/*.lock
📒 Files selected for processing (37)
  • .gitignore
  • Justfile
  • README.md
  • REFERENCES.md
  • docs/Doxyfile
  • docs/cgal-integration.md
  • docs/metropolis-hastings.md
  • docs/reproducibility.md
  • include/S3Action.hpp
  • include/Utilities.hpp
  • pyproject.toml
  • reference/README.md
  • reference/fixtures/v1/protocol.json
  • reference/manifests/v1/macos-arm64.json
  • reference/manifests/v1/scaling-macos-arm64.json
  • reference/raw/v1/cpp-reference.json
  • reference/raw/v1/end-to-end.txt
  • reference/raw/v1/persistence-v1.off
  • reference/raw/v1/persistence-v1.off.meta
  • reference/raw/v1/scaling-threads-1.txt
  • reference/raw/v1/scaling-threads-2.txt
  • reference/raw/v1/scaling-threads-4.txt
  • reference/schema/fixture-v1.schema.json
  • reference/schema/result-v1.schema.json
  • reference/schema/run-manifest-v1.schema.json
  • scripts/coverage.sh
  • scripts/generate_reference_fixtures.py
  • scripts/tests/test_generate_reference_fixtures.py
  • scripts/tests/test_validate_reference_fixtures.py
  • scripts/validate_reference_fixtures.py
  • src/CMakeLists.txt
  • tests/CMakeLists.txt
  • tests/Metropolis_test.cpp
  • tests/Reference_fixture.cpp
  • tests/Runtime_config_test.cpp
  • tests/S3Action_test.cpp
  • tests/Utilities_test.cpp

Comment thread include/Utilities.hpp
Comment thread pyproject.toml
Comment thread reference/manifests/v1/macos-arm64.json
Comment thread scripts/generate_reference_fixtures.py Outdated
Comment thread scripts/generate_reference_fixtures.py Outdated
Comment thread scripts/tests/test_generate_reference_fixtures.py
Comment thread scripts/tests/test_validate_reference_fixtures.py
Comment thread scripts/validate_reference_fixtures.py Outdated
Comment thread tests/Metropolis_test.cpp
Comment thread tests/Reference_fixture.cpp Outdated
- Rebuild manifests from canonical producers and current toolchain evidence.
- Reject noncanonical binaries, malformed records, and stale verification state.
- Standardize console and fixture output on fmt::print and enforce it with Semgrep.

Closes #94

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
scripts/generate_reference_fixtures.py (1)

496-513: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Validate producer paths before spending the producer runs.

validate_producer_paths only needs display_path of the four binaries, but it runs after produce_raw_artifacts has already executed the fixture, bounded, persistence, and three benchmark producers (up to a 900 s timeout each). A noncanonical --benchmark-binary therefore costs a full regeneration cycle before the error surfaces. Nothing is published yet, so this is purely about feedback latency.

♻️ Proposed reordering in `regenerate`
     fixture_command, bounded_command, persistence_command, benchmark_commands = producer_commands(*paths)
+    reference_commands = [
+        [display_path(fixture_binary)],
+        [display_path(cdt_binary), *bounded_command[1:]],
+        [display_path(initialize_binary), *persistence_command[1:]],
+    ]
+    scaling_commands = [[display_path(benchmark_binary), *command[1:]] for command in benchmark_commands]
+    validate_producer_paths(reference_commands, scaling_commands)
     generated, fixture_json, scaling_records = produce_raw_artifacts(

with the later duplicate construction at lines 506-512 removed.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/generate_reference_fixtures.py` around lines 496 - 513, Move
construction of reference_commands and scaling_commands, followed by
validate_producer_paths, before the produce_raw_artifacts call in regenerate,
using the existing binary and command variables. Remove the later duplicate
command construction and validation while preserving the subsequent artifact
generation and metadata flow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/tests/test_generate_reference_fixtures.py`:
- Around line 80-103: Add a test for the divergent-version branch in
configured_cmake_version, using the existing cache_paths setup and mocking
run_command with a side_effect that returns two different CMake version strings.
Assert the function’s guard behavior for mismatched cache versions and verify
both cache commands are invoked with the expected timeout.

In `@tests/Reference_fixture.cpp`:
- Around line 41-42: Split output_precision into separate coordinate_precision
and value precision constants, keeping long double::max_digits10 for action
values and defining coordinate_precision for double coordinates. Update the
position formatting in the relevant output path to use coordinate_precision
while preserving output_precision for action values.

In `@tests/semgrep/formatted_output.cpp`:
- Around line 4-8: The formatted_output.cpp Semgrep fixture emits unintended
diagnostic-output policy findings alongside its intended assertions. Mark the
relevant std::cerr and std::clog diagnostic-output findings as expected in the
fixture, or exclude this non-doctest fixture from those runtime policy rules
while preserving the use-fmt-print-for-console-output assertions.

---

Outside diff comments:
In `@scripts/generate_reference_fixtures.py`:
- Around line 496-513: Move construction of reference_commands and
scaling_commands, followed by validate_producer_paths, before the
produce_raw_artifacts call in regenerate, using the existing binary and command
variables. Remove the later duplicate command construction and validation while
preserving the subsequent artifact generation and metadata flow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 76f18132-5c1c-4d02-b036-4b9a6f809133

📥 Commits

Reviewing files that changed from the base of the PR and between ec53dfa and 6972970.

📒 Files selected for processing (16)
  • include/Periodic_3_triangulations.hpp
  • include/Utilities.hpp
  • pyproject.toml
  • scripts/generate_reference_fixtures.py
  • scripts/tests/test_generate_reference_fixtures.py
  • scripts/tests/test_validate_reference_fixtures.py
  • scripts/validate_reference_fixtures.py
  • semgrep.yaml
  • src/cdt-viewer.cpp
  • src/cdt.cpp
  • src/initialize.cpp
  • tests/CGAL_benchmark.cpp
  • tests/Metropolis_test.cpp
  • tests/Random_benchmark.cpp
  • tests/Reference_fixture.cpp
  • tests/semgrep/formatted_output.cpp

Comment thread scripts/tests/test_generate_reference_fixtures.py
Comment thread tests/Reference_fixture.cpp
Comment thread tests/semgrep/formatted_output.cpp
- Load Linux tests with the configured compiler's libstdc++.
- Reduce sanitizer smoke work to avoid CI timeouts.
- Validate canonical reference producers before execution.
- Serialize fixture coordinates at double precision.
- Match producer-path assertions to repr-formatted Windows errors.
- Discover Semgrep targets from one repository root to avoid RPC stalls.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
scripts/tests/test_generate_reference_fixtures.py (1)

89-100: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use pytest.raises for this exception assertion.

Ruff PT027 flags unittest.TestCase.assertRaises; this can fail python-check even though the assertions are behaviorally correct. Retain the message checks while switching to pytest.raises (or verify that PT027 is intentionally disabled).

Suggested change
-            self.assertRaises(ValueError) as raised,
+            pytest.raises(ValueError) as raised,
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/tests/test_generate_reference_fixtures.py` around lines 89 - 100,
Replace the unittest-style assertRaises context around generator.regenerate with
pytest.raises(ValueError), preserving the existing exception message checks
against raised.value or the captured exception. Update the test imports as
needed, and do not disable PT027.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Justfile`:
- Around line 195-198: Bound the repository-root Semgrep invocation in the
Justfile recipe by adding explicit exclusions for ignored build, virtualenv,
coverage, and generated directories alongside tests/semgrep. Keep scanning the
repository root with --no-git-ignore while ensuring these paths cannot
contribute slow scans or false positives.

---

Outside diff comments:
In `@scripts/tests/test_generate_reference_fixtures.py`:
- Around line 89-100: Replace the unittest-style assertRaises context around
generator.regenerate with pytest.raises(ValueError), preserving the existing
exception message checks against raised.value or the captured exception. Update
the test imports as needed, and do not disable PT027.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: df30cf60-376f-44c3-8308-21eee188b6c4

📥 Commits

Reviewing files that changed from the base of the PR and between b0c3169 and b282c0b.

📒 Files selected for processing (3)
  • Justfile
  • scripts/tests/test_generate_reference_fixtures.py
  • semgrep.yaml

Comment thread Justfile Outdated
- Make Release the canonical optimized configuration and add a focused Debug CLI workflow.
- Add pinned ccache support for local pkgx builds and Ubuntu CI jobs.
- Enforce pinned, approved GitHub Actions with readable version annotations.
- Bound repository Semgrep scans to relevant source directories.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
Justfile (1)

45-50: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Restore the full CTest gate to just ci.

Replacing build with reference-generated-check removes the full build/CTest execution; that recipe only rebuilds the fixture producer and validates generated output. This contradicts the documented canonical CI contract.

  • Justfile#L45-L50: run the existing full build/CTest workflow in addition to reference-generated-check.
  • .github/CONTRIBUTING.md#L51-L65: retain this claim only after restoring the test gate; otherwise document the narrower command behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Justfile` around lines 45 - 50, The just ci recipe must restore the existing
full build/CTest workflow while also running reference-generated-check; update
Justfile lines 45-50 to invoke that build/test recipe in addition to the
generated-reference validation. In .github/CONTRIBUTING.md lines 51-65, retain
the documented canonical CI claim because it becomes accurate after the Justfile
change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 175-176: Update the README description of the just build recipe to
refer to the platform-specific build script, covering scripts/build.sh on Unix
and scripts/build.bat on Windows instead of implying that only scripts/build.sh
is used.

In `@scripts/build.bat`:
- Line 11: Normalize PRESET to its canonical lowercase name before the cmake
--preset invocation, ensuring Debug, Reference, and Parallel inputs become
debug, reference, and parallel respectively. Update the validation and
preset-selection flow around the PRESET checks, including the debug branch shown
by the PRESET_READY jump, while preserving rejection of unsupported values.

In `@semgrep.yaml`:
- Line 102: Update the pattern-regex rule to recognize SHA-pinned uses entries
lacking a valid release/version comment, including trailing whitespace or
non-version comments such as “pinned”; preserve exclusions for the repository’s
accepted version-comment format. Add fixtures covering invalid comments and a
valid comment, and verify the rule matches only the former.
- Line 62: Update the pattern-regex rule to match docker:// action references
instead of excluding them, and enforce the same immutable-reference validation
by rejecting mutable tags or requiring a digest. Preserve the existing handling
for local actions and non-docker external references.

---

Outside diff comments:
In `@Justfile`:
- Around line 45-50: The just ci recipe must restore the existing full
build/CTest workflow while also running reference-generated-check; update
Justfile lines 45-50 to invoke that build/test recipe in addition to the
generated-reference validation. In .github/CONTRIBUTING.md lines 51-65, retain
the documented canonical CI claim because it becomes accurate after the Justfile
change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2bcd853a-41f1-4b9a-9dba-339a88b8e48e

📥 Commits

Reviewing files that changed from the base of the PR and between b282c0b and e29f69a.

📒 Files selected for processing (20)
  • .github/CONTRIBUTING.md
  • .github/workflows/ci.yml
  • CMakeLists.txt
  • CMakePresets.json
  • Justfile
  • README.md
  • cmake/Cache.cmake
  • cmake/StandardProjectSettings.cmake
  • scripts/build.bat
  • scripts/build.sh
  • scripts/codeql-build.sh
  • scripts/coverage.sh
  • scripts/iwyu.sh
  • scripts/pkgx-build.sh
  • scripts/pkgx-env.sh
  • scripts/slurm.sh
  • semgrep.yaml
  • src/CMakeLists.txt
  • tests/semgrep/.github/actions/action_policy.yml
  • tests/semgrep/.github/workflows/action_policy.yml

Comment thread README.md Outdated
Comment thread scripts/build.bat Outdated
Comment thread semgrep.yaml Outdated
Comment thread semgrep.yaml Outdated
- Isolate ccache from compiler-toolchain dependency resolution.
- Normalize Windows preset names before invoking CMake.
- Require immutable container digests and readable action version comments.
- Document the platform-specific build launchers.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@semgrep.yaml`:
- Around line 64-65: Update the external-action regex rules in semgrep.yaml at
the affected pinning, allowlist, and version-comment patterns to allow zero or
more additional path segments by changing the optional single-segment group to a
repeating group. Add a fixture covering a nested action path and verify all
three rules handle it correctly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ea85c256-e61c-4449-a8d8-431ce331f147

📥 Commits

Reviewing files that changed from the base of the PR and between b282c0b and 930238a.

📒 Files selected for processing (20)
  • .github/CONTRIBUTING.md
  • .github/workflows/ci.yml
  • CMakeLists.txt
  • CMakePresets.json
  • Justfile
  • README.md
  • cmake/Cache.cmake
  • cmake/StandardProjectSettings.cmake
  • scripts/build.bat
  • scripts/build.sh
  • scripts/codeql-build.sh
  • scripts/coverage.sh
  • scripts/iwyu.sh
  • scripts/pkgx-build.sh
  • scripts/pkgx-env.sh
  • scripts/slurm.sh
  • semgrep.yaml
  • src/CMakeLists.txt
  • tests/semgrep/.github/actions/action_policy.yml
  • tests/semgrep/.github/workflows/action_policy.yml

Comment thread semgrep.yaml Outdated
Apply SHA pinning, allowlist, and version-comment checks to GitHub Action references with arbitrarily nested path segments.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@semgrep.yaml`:
- Around line 64-65: Update the `pattern-regex` rules on lines 64–65, 85, and
105 to match both standalone `uses:` keys and shorthand list entries prefixed
with `- uses:` while preserving their existing validation behavior. Add a
fixture covering a shorthand step such as `- uses: actions/checkout@v7` and
verify pinning, allowlisting, and version-comment enforcement apply to it.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b1035e04-b872-47b0-8c7d-59bdc58f3c48

📥 Commits

Reviewing files that changed from the base of the PR and between 930238a and 745d402.

📒 Files selected for processing (2)
  • semgrep.yaml
  • tests/semgrep/.github/workflows/action_policy.yml

Comment thread semgrep.yaml Outdated
Apply SHA pinning, allowlist, and version-comment checks to GitHub Action shorthand list entries, including container actions.
@acgetchell

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
semgrep.yaml (1)

428-430: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Match chained stream insertions. std::cout << $VALUE; only catches a single insertion, so chained output like std::cout << "value: " << value << '\n'; is missed. Use a chain-aware matcher, e.g. std::cout <<... << $VALUE;, and keep tests/semgrep/formatted_output.cpp as regression coverage.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@semgrep.yaml` around lines 428 - 430, Update the stream patterns in the
semgrep rules to match chained insertions for std::cout, std::cerr, and
std::clog, rather than only a single << operation. Preserve coverage for
standalone insertions and add or update regression cases in formatted_output.cpp
for chained output.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@semgrep.yaml`:
- Around line 428-430: Update the stream patterns in the semgrep rules to match
chained insertions for std::cout, std::cerr, and std::clog, rather than only a
single << operation. Preserve coverage for standalone insertions and add or
update regression cases in formatted_output.cpp for chained output.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 120f821d-ac38-499b-8d24-72f40db0e912

📥 Commits

Reviewing files that changed from the base of the PR and between 745d402 and 406a482.

📒 Files selected for processing (2)
  • semgrep.yaml
  • tests/semgrep/.github/workflows/action_policy.yml

@acgetchell
acgetchell merged commit 5708747 into main Jul 26, 2026
13 checks passed
@acgetchell
acgetchell deleted the feat/94-cross-language-reference-fixtures branch July 26, 2026 03:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Publish deterministic C++ reference fixtures for Rust comparison

1 participant