Skip to content

feat: prepare govctl 0.17.0 - #41

Merged
lucifer1004 merged 1 commit into
mainfrom
spike/zigbuild-release-ci
Jul 30, 2026
Merged

feat: prepare govctl 0.17.0#41
lucifer1004 merged 1 commit into
mainfrom
spike/zigbuild-release-ci

Conversation

@lucifer1004

@lucifer1004 lucifer1004 commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Summary

  • replace post-walk source exclusions with pruned, gitignore-compatible .gitignore and .govignore traversal, schema v5 migration, and precise deterministic reference diagnostics
  • build six canonical release targets in a pinned Zig environment, preserve four legacy aliases through 0.x, and gate publication on native Linux, Windows, and macOS smoke checks
  • make validation line-ending independent, authenticate self-update API requests, and prepare the curated 0.17.0 release metadata and upgrade notes

Upgrade notes

  • schema v5 removes source_scan.exclude; run govctl migrate to convert schema v4 exclusions into root .govignore rules
  • Linux assets now use musl and Windows assets use GNU/gnullvm canonical targets; legacy GNU/MSVC aliases remain available for all 0.x releases and end at 1.0.0

Validation

Summary by CodeRabbit

  • New Features
    • Schema version 5 support with Git-compatible source scanning via .gitignore and .govignore.
    • Deterministic source-reference diagnostics with stricter validation of configured capture groups and exact locations.
    • Authenticated GitHub self-update probing when GITHUB_TOKEN is available.
    • Pre-1.0 release compatibility alias artifacts for required target mappings.
  • Bug Fixes
    • Improved LF/CRLF robustness for bundled schema and signature checks.
    • More reliable ignore/include traversal with pruning, clearer error reporting, and safer migration rollback/recovery.
  • Documentation
    • Updated scanning, migration, validation, versioning, and upgrade guidance for 0.17.0.
  • Tests
    • Expanded cross-platform smoke and migration/scan coverage for the updated rules.

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@lucifer1004, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 4 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a20f96a-d3ae-44d0-a964-6b792b1190c5

📥 Commits

Reviewing files that changed from the base of the PR and between c6e3ac6 and 6c50978.

⛔ Files ignored due to path filters (6)
  • Cargo.lock is excluded by !**/*.lock
  • tests/snapshots/test_help__rfc_bump_help.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_deprecated_rfc_reference.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_mixed_valid_invalid_references.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_unknown_clause_reference.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_unknown_rfc_reference.snap is excluded by !**/*.snap
📒 Files selected for processing (63)
  • .claude-plugin/marketplace.json
  • .claude/.claude-plugin/plugin.json
  • .claude/skills/gov/SKILL.md
  • .github/workflows/release.yml
  • CHANGELOG.md
  • Cargo.toml
  • README.md
  • docs/guide/conformance-cases.md
  • docs/guide/rfcs.md
  • docs/guide/validation.md
  • docs/rfc/RFC-0002.md
  • docs/rfc/RFC-0009.md
  • gov/adr/ADR-0009-configurable-source-code-reference-scanning.toml
  • gov/adr/ADR-0041-self-update-and-cargo-binstall-binary-distribution.toml
  • gov/adr/ADR-0059-use-project-root-selection-with-layered-ignore-rules.toml
  • gov/adr/ADR-0060-build-releases-with-zig-and-preserve-target-aliases.toml
  • gov/config.toml
  • gov/releases.toml
  • gov/rfc/RFC-0002/clauses/C-COMPATIBILITY-BOUNDARY.toml
  • gov/rfc/RFC-0002/clauses/C-GLOBAL-COMMANDS.toml
  • gov/rfc/RFC-0002/clauses/C-PRE-1-RELEASE-TARGET-COMPATIBILITY.toml
  • gov/rfc/RFC-0002/rfc.toml
  • gov/rfc/RFC-0009/clauses/C-IGNORE-MIGRATION.toml
  • gov/rfc/RFC-0009/clauses/C-IGNORE-RULES.toml
  • gov/rfc/RFC-0009/clauses/C-REFERENCE-REPORTING.toml
  • gov/rfc/RFC-0009/clauses/C-SOURCE-SELECTION.toml
  • gov/rfc/RFC-0009/clauses/C-SUMMARY.toml
  • gov/rfc/RFC-0009/clauses/C-TRAVERSAL.toml
  • gov/rfc/RFC-0009/rfc.toml
  • gov/schema/SCHEMA.md
  • gov/work/2026-07-29-prune-excluded-source-scan-directories-during-traversal.toml
  • gov/work/2026-07-30-adopt-zig-release-builds-with-pre-1-0-aliases.toml
  • gov/work/2026-07-30-authenticate-self-update-api-requests.toml
  • gov/work/2026-07-30-close-0-17-release-review-findings.toml
  • gov/work/2026-07-30-close-final-0-17-source-scan-review-findings.toml
  • gov/work/2026-07-30-make-source-reference-diagnostics-precise-and-deterministic.toml
  • gov/work/2026-07-30-make-validation-line-ending-independent.toml
  • src/cli/resources/rfc.rs
  • src/cmd/check.rs
  • src/cmd/edit/delete_referrers.rs
  • src/cmd/migrate/mod.rs
  • src/cmd/migrate/ops.rs
  • src/cmd/migrate/ops_tests.rs
  • src/cmd/self_update.rs
  • src/cmd/self_update_tests.rs
  • src/config/mod.rs
  • src/config/runtime.rs
  • src/config/template.rs
  • src/main.rs
  • src/reference_pattern.rs
  • src/render/links.rs
  • src/scan.rs
  • src/schema.rs
  • src/signature/canonical_json.rs
  • src/signature/tests.rs
  • src/validate/bracket_refs.rs
  • src/verification/runner/process_group.rs
  • src/write/artifact.rs
  • src/write/artifact_io.rs
  • tests/edit_tests/clause.rs
  • tests/test_conformance.rs
  • tests/test_migrate.rs
  • tests/test_scan.rs
📝 Walkthrough

Walkthrough

Version 0.17.0 introduces schema version 5, layered source-scan ignore semantics, deterministic reference diagnostics, transactional migration rollback, CRLF-independent validation, Zig-based release packaging, pre-1.0 aliases, authenticated self-update requests, and related documentation, governance, and test updates.

Changes

Source scanning and schema migration

Layer / File(s) Summary
Source scan contract and diagnostics
src/scan.rs, src/reference_pattern.rs, src/cmd/check.rs, src/validate/bracket_refs.rs, tests/test_scan.rs, docs/rfc/RFC-0009.md, gov/rfc/RFC-0009/*
Source scanning uses include patterns with .gitignore/.govignore, shared capture-group validation, traversal pruning, normalized locations, deterministic ordering, and duplicate suppression.
Schema 4-to-5 migration
src/config/*, src/cmd/migrate/*, src/main.rs, tests/test_migrate.rs, gov/rfc/RFC-0002/*
Schema 4 repositories require migration; legacy source_scan.exclude entries are converted into .govignore, with dry-run, validation, rollback, and recovery-backup behavior covered by tests.
Documentation and governance alignment
README.md, docs/guide/validation.md, gov/adr/ADR-0059-*, gov/work/2026-07-29-*
User guidance and governance records describe schema 5 source-selection and layered-ignore behavior.

Release distribution and self-update

Layer / File(s) Summary
Zig build and artifact packaging
.github/workflows/release.yml, Cargo.toml, gov/adr/ADR-0060-*
Release builds use a pinned Zig container, canonical target metadata, archive-specific packaging, and compatibility aliases for major-zero releases.
Cross-platform smoke gates
.github/workflows/release.yml, gov/work/2026-07-30-adopt-zig-release-builds-with-pre-1-0-aliases.toml
Linux, Windows, and macOS artifacts are extracted, executed, layout-checked, and probed for self-update behavior before release creation.
Authenticated self-update
src/cmd/self_update.rs, src/cmd/self_update_tests.rs, gov/work/2026-07-30-authenticate-self-update-api-requests.toml
GitHub release listing and update requests optionally use a non-empty GITHUB_TOKEN, with token filtering and archive metadata tests.

Validation and release metadata

Layer / File(s) Summary
Line-ending-independent validation
src/schema.rs, src/signature/*, gov/work/2026-07-30-make-validation-line-ending-independent.toml
Schema freshness and RFC signatures treat CRLF and LF content equivalently.
Artifact write validation
src/write/artifact.rs, src/write/artifact_io.rs, tests/edit_tests/clause.rs
TOML artifact writes use shared artifact metadata, normalize serialized values before validation, and preserve files when validation fails.
Version 0.17.0 records
Cargo.toml, CHANGELOG.md, gov/releases.toml, plugin manifests, RFC/ADR/work files
Package versions, release references, changelogs, manifests, and completed work records are updated for 0.17.0.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

  • govctl-org/govctl#9: Introduced the self-update command paths extended here with optional GitHub authentication.
  • govctl-org/govctl#26: Overlaps with the updated reference validation and diagnostic pipeline.
  • govctl-org/govctl#37: Overlaps with shared reference-pattern compilation and capture extraction in referrer handling.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 40.38% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the release-preparation changes for govctl 0.17.0.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch spike/zigbuild-release-ci

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jul 30, 2026

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
src/cmd/migrate/mod.rs (1)

302-347: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Preserve hand-edited gov/config.toml formatting when bumping the schema.

plan_config_version_bump parses the whole config into toml::Table and writes it with toml::to_string_pretty, so any user comments are discarded. The dependency is just toml = "1" with no preserve_order feature, so key ordering can also be normalized. Use a format-preserving writer such as toml_edit::DocumentMut for this migration mutation instead.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/cmd/migrate/mod.rs` around lines 302 - 347, Update
plan_config_version_bump to parse and serialize the configuration with
toml_edit::DocumentMut instead of toml::Table and toml::to_string_pretty,
preserving comments, formatting, and key order. Apply the existing
schema.version update and source_scan.exclude removal through the toml_edit
document API, while retaining the current diagnostics and FileOp::Write
behavior.
🧹 Nitpick comments (2)
src/scan.rs (2)

303-346: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Diagnostic path is hardcoded instead of derived from config.

Everywhere else in this function's callers the location comes from config.display_path(&config.gov_root.join("config.toml")). Here the literal "gov/config.toml" will be wrong whenever the gov root is not ./gov. Passing the display path into build_include_matcher keeps diagnostics accurate.

♻️ Proposed refactor
-fn build_include_matcher(root: &Path, patterns: &[String]) -> Result<Gitignore, Diagnostic> {
+fn build_include_matcher(
+    root: &Path,
+    patterns: &[String],
+    config_path: &str,
+) -> Result<Gitignore, Diagnostic> {
     let mut builder = GitignoreBuilder::new(root);
     for pattern in patterns {
         if pattern.is_empty() {
             return Err(Diagnostic::new(
                 DiagnosticCode::E0501ConfigInvalid,
                 "Invalid source_scan.include pattern: entries cannot be empty",
-                "gov/config.toml".to_string(),
+                config_path.to_string(),
             ));

Apply the same substitution to the remaining three diagnostics in this function and thread the already-computed config display path through from scan_source_refs.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/scan.rs` around lines 303 - 346, Update build_include_matcher to accept
the config display path as an argument and use it for all four Diagnostic
instances instead of the hardcoded "gov/config.toml". In scan_source_refs,
compute the path with config.display_path(&config.gov_root.join("config.toml"))
and pass it through to build_include_matcher.

356-369: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Probing ignore-file readability by reading full contents on every reached directory.

read_to_string is used purely to detect unreadable paths, so every directory in the tree pays two extra opens plus a full file read whose result is discarded — and the .gitignore/.govignore bytes are then read a second time by the walker. File::open gives the same NotFound/IsADirectory/permission signal without the read.

♻️ Proposed refactor
     for name in [".gitignore", ".govignore"] {
         let path = directory.join(name);
-        match fs::read_to_string(&path) {
+        match fs::File::open(&path) {
             Ok(_) => {}
             Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
             Err(error) => result.diagnostics.push(Diagnostic::io_error(

Note that File::open on a directory succeeds on Linux, so keep a metadata().is_dir() check if the test_scan_reports_reached_unreadable_ignore_path case must keep failing.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/scan.rs` around lines 356 - 369, Update validate_reached_ignore_files to
probe each ignore path with File::open instead of fs::read_to_string, preserving
the existing NotFound handling and diagnostic reporting for other errors. After
opening, check metadata().is_dir() so directory paths still produce the expected
unreadable-path diagnostic, while avoiding reading and discarding file contents.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 183-276: In both smoke jobs, `smoke-cross` and the sibling job
spanning `.github/workflows/release.yml` lines 278-334, set job permissions to
`contents: read`, configure the `actions/checkout` step with
`persist-credentials: false`, and keep `GITHUB_TOKEN` defined only on the
self-update probe step rather than the whole job.

In `@gov/releases.toml`:
- Around line 5-6: Remove duplicated TOML array-table headers in
gov/releases.toml at lines 5-6, retaining one [[releases]] header before the
0.17.0 fields. In gov/rfc/RFC-0002/rfc.toml at lines 44-79, retain exactly one
[[sections]] header and one [[changelog]] header for each record.

---

Outside diff comments:
In `@src/cmd/migrate/mod.rs`:
- Around line 302-347: Update plan_config_version_bump to parse and serialize
the configuration with toml_edit::DocumentMut instead of toml::Table and
toml::to_string_pretty, preserving comments, formatting, and key order. Apply
the existing schema.version update and source_scan.exclude removal through the
toml_edit document API, while retaining the current diagnostics and
FileOp::Write behavior.

---

Nitpick comments:
In `@src/scan.rs`:
- Around line 303-346: Update build_include_matcher to accept the config display
path as an argument and use it for all four Diagnostic instances instead of the
hardcoded "gov/config.toml". In scan_source_refs, compute the path with
config.display_path(&config.gov_root.join("config.toml")) and pass it through to
build_include_matcher.
- Around line 356-369: Update validate_reached_ignore_files to probe each ignore
path with File::open instead of fs::read_to_string, preserving the existing
NotFound handling and diagnostic reporting for other errors. After opening,
check metadata().is_dir() so directory paths still produce the expected
unreadable-path diagnostic, while avoiding reading and discarding file contents.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 093fbf0d-dcf0-4a66-84a1-0eb07fd61934

📥 Commits

Reviewing files that changed from the base of the PR and between deb71d0 and 8b923fb.

⛔ Files ignored due to path filters (6)
  • Cargo.lock is excluded by !**/*.lock
  • tests/snapshots/test_help__rfc_bump_help.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_deprecated_rfc_reference.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_mixed_valid_invalid_references.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_unknown_clause_reference.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_unknown_rfc_reference.snap is excluded by !**/*.snap
📒 Files selected for processing (61)
  • .claude-plugin/marketplace.json
  • .claude/.claude-plugin/plugin.json
  • .claude/skills/gov/SKILL.md
  • .github/workflows/release.yml
  • CHANGELOG.md
  • Cargo.toml
  • README.md
  • docs/guide/conformance-cases.md
  • docs/guide/rfcs.md
  • docs/guide/validation.md
  • docs/rfc/RFC-0002.md
  • docs/rfc/RFC-0009.md
  • gov/adr/ADR-0009-configurable-source-code-reference-scanning.toml
  • gov/adr/ADR-0041-self-update-and-cargo-binstall-binary-distribution.toml
  • gov/adr/ADR-0059-use-project-root-selection-with-layered-ignore-rules.toml
  • gov/adr/ADR-0060-build-releases-with-zig-and-preserve-target-aliases.toml
  • gov/config.toml
  • gov/releases.toml
  • gov/rfc/RFC-0002/clauses/C-COMPATIBILITY-BOUNDARY.toml
  • gov/rfc/RFC-0002/clauses/C-GLOBAL-COMMANDS.toml
  • gov/rfc/RFC-0002/clauses/C-PRE-1-RELEASE-TARGET-COMPATIBILITY.toml
  • gov/rfc/RFC-0002/rfc.toml
  • gov/rfc/RFC-0009/clauses/C-IGNORE-MIGRATION.toml
  • gov/rfc/RFC-0009/clauses/C-IGNORE-RULES.toml
  • gov/rfc/RFC-0009/clauses/C-REFERENCE-REPORTING.toml
  • gov/rfc/RFC-0009/clauses/C-SOURCE-SELECTION.toml
  • gov/rfc/RFC-0009/clauses/C-SUMMARY.toml
  • gov/rfc/RFC-0009/clauses/C-TRAVERSAL.toml
  • gov/rfc/RFC-0009/rfc.toml
  • gov/schema/SCHEMA.md
  • gov/work/2026-07-29-prune-excluded-source-scan-directories-during-traversal.toml
  • gov/work/2026-07-30-adopt-zig-release-builds-with-pre-1-0-aliases.toml
  • gov/work/2026-07-30-authenticate-self-update-api-requests.toml
  • gov/work/2026-07-30-make-source-reference-diagnostics-precise-and-deterministic.toml
  • gov/work/2026-07-30-make-validation-line-ending-independent.toml
  • src/cli/resources/rfc.rs
  • src/cmd/check.rs
  • src/cmd/edit/delete_referrers.rs
  • src/cmd/migrate/mod.rs
  • src/cmd/migrate/ops.rs
  • src/cmd/migrate/ops_tests.rs
  • src/cmd/self_update.rs
  • src/cmd/self_update_tests.rs
  • src/config/mod.rs
  • src/config/runtime.rs
  • src/config/template.rs
  • src/main.rs
  • src/reference_pattern.rs
  • src/render/links.rs
  • src/scan.rs
  • src/schema.rs
  • src/signature/canonical_json.rs
  • src/signature/tests.rs
  • src/validate/bracket_refs.rs
  • src/verification/runner/process_group.rs
  • src/write/artifact.rs
  • src/write/artifact_io.rs
  • tests/edit_tests/clause.rs
  • tests/test_conformance.rs
  • tests/test_migrate.rs
  • tests/test_scan.rs

Comment thread .github/workflows/release.yml
Comment thread gov/releases.toml
Comment on lines +5 to +6
[[releases]]
version = "0.17.0"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Remove duplicated TOML array-table headers across the release metadata.

Both files create unintended empty records before the populated entries.

  • gov/releases.toml#L5-L6: retain only one [[releases]] header before the 0.17.0 fields.
  • gov/rfc/RFC-0002/rfc.toml#L44-L79: retain one [[sections]] header and one [[changelog]] header per record.
📍 Affects 2 files
  • gov/releases.toml#L5-L6 (this comment)
  • gov/rfc/RFC-0002/rfc.toml#L44-L79
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@gov/releases.toml` around lines 5 - 6, Remove duplicated TOML array-table
headers in gov/releases.toml at lines 5-6, retaining one [[releases]] header
before the 0.17.0 fields. In gov/rfc/RFC-0002/rfc.toml at lines 44-79, retain
exactly one [[sections]] header and one [[changelog]] header for each record.

@lucifer1004
lucifer1004 force-pushed the spike/zigbuild-release-ci branch from 8b923fb to c6e3ac6 Compare July 30, 2026 04:20

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (2)
tests/test_scan.rs (2)

613-627: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Symlink test passes vacuously.

The project contains no .rs file other than the symlinked one, so 0 source files scanned would also hold if the include matcher or the walker were broken entirely. Add a real in-tree file so the count distinguishes "didn't follow the link" from "scanned nothing at all".

💚 Proposed strengthening
     let external = tempfile::tempdir()?;
     fs::write(external.path().join("linked.rs"), "fn linked() {}\n")?;
     symlink(external.path(), temp_dir.path().join("linked"))?;
+    write_main_rs(temp_dir.path(), "fn main() {}\n")?;
 
     let output = run_commands(temp_dir.path(), &[&["check"]])?;
-    assert!(output.contains("  0 source files scanned"), "{output}");
+    assert!(output.contains("  1 source files scanned"), "{output}");
     Ok(())
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_scan.rs` around lines 613 - 627, Strengthen
test_scan_does_not_follow_symbolic_links by creating a real in-tree .rs file
under the initialized project before running the check. Update the assertion to
expect one source file scanned, preserving the symlink setup so the test
distinguishes scanning the real file from following the external link.

29-62: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Two adjacent helpers navigate the same TOML two different ways.

set_source_scan_include uses panicking index assignment (config["source_scan"]["include"] = ...), which aborts with an unhelpful panic if [source_scan] is ever absent, while set_source_scan_pattern right below does the same navigation defensively. Current callers always go through init_source_scan_project, so this works today, but it's an easy trap for the next test. Consider a shared set_source_scan_field(dir, key, value) helper.

♻️ Sketch of a shared helper
-fn set_source_scan_include(
-    dir: &Path,
-    patterns: &[&str],
-) -> Result<(), Box<dyn std::error::Error>> {
-    let config_path = dir.join("gov/config.toml");
-    let mut config: toml::Value = toml::from_str(&fs::read_to_string(&config_path)?)?;
-    config["source_scan"]["include"] = toml::Value::Array(
-        patterns
-            .iter()
-            .map(|pattern| toml::Value::String((*pattern).to_string()))
-            .collect(),
-    );
-    fs::write(config_path, toml::to_string_pretty(&config)?)?;
-    Ok(())
-}
-
-fn set_source_scan_pattern(dir: &Path, pattern: &str) -> Result<(), Box<dyn std::error::Error>> {
+fn set_source_scan_field(
+    dir: &Path,
+    key: &str,
+    value: toml::Value,
+) -> Result<(), Box<dyn std::error::Error>> {
     let config_path = dir.join("gov/config.toml");
     let mut config: toml::Value = toml::from_str(&fs::read_to_string(&config_path)?)?;
     let config_table = config
         .as_table_mut()
         .ok_or("config root must be a TOML table")?;
     let source_scan = config_table
         .entry("source_scan")
         .or_insert_with(|| toml::Value::Table(toml::Table::new()))
         .as_table_mut()
         .ok_or("source_scan must be a TOML table")?;
-    source_scan.insert(
-        "pattern".to_string(),
-        toml::Value::String(pattern.to_string()),
-    );
+    source_scan.insert(key.to_string(), value);
     fs::write(config_path, toml::to_string_pretty(&config)?)?;
     Ok(())
 }
+
+fn set_source_scan_include(
+    dir: &Path,
+    patterns: &[&str],
+) -> Result<(), Box<dyn std::error::Error>> {
+    let array = patterns
+        .iter()
+        .map(|pattern| toml::Value::String((*pattern).to_string()))
+        .collect();
+    set_source_scan_field(dir, "include", toml::Value::Array(array))
+}
+
+fn set_source_scan_pattern(dir: &Path, pattern: &str) -> Result<(), Box<dyn std::error::Error>> {
+    set_source_scan_field(dir, "pattern", toml::Value::String(pattern.to_string()))
+}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_scan.rs` around lines 29 - 62, Refactor set_source_scan_include
and set_source_scan_pattern to share a defensive set_source_scan_field helper
that validates or creates the root source_scan table before inserting the
requested field. Preserve each helper’s existing value conversion and
file-writing behavior, and remove the panicking indexed assignment from
set_source_scan_include.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@gov/rfc/RFC-0009/clauses/C-IGNORE-RULES.toml`:
- Line 14: The RFC clause’s stated ignore-rule precedence is not validated by
the implementation and tests. Add scan tests covering cross-file exclusion
conflicts in both directions—root .govignore versus deeper .gitignore and root
.gitignore versus deeper .govignore—then ensure src/scan.rs preserves the
clause’s file-type-before-depth precedence; alternatively revise the clause to
match the library’s depth-before-file-type behavior.

In `@src/scan.rs`:
- Around line 117-129: Update the WalkBuilder configuration in the
source-scanning setup to add an entry filter that prunes any .git directory
before traversal descends into it. Preserve the existing git_ignore(true)
behavior and all other walker options, using the builder’s entry-filter
mechanism rather than a post-scan exclusion.

In `@src/validate/bracket_refs.rs`:
- Around line 291-301: The invalid-match diagnostic in the target_capture error
branch lacks occurrence-specific location data, allowing distinct matches to be
removed by extend_with_pattern_dedup. Update the Diagnostic::new location
argument in the reference-pattern validation flow to include the match byte
offset within text, or preferably the line/column from SourceLocator, while
preserving the existing error code and message.

---

Nitpick comments:
In `@tests/test_scan.rs`:
- Around line 613-627: Strengthen test_scan_does_not_follow_symbolic_links by
creating a real in-tree .rs file under the initialized project before running
the check. Update the assertion to expect one source file scanned, preserving
the symlink setup so the test distinguishes scanning the real file from
following the external link.
- Around line 29-62: Refactor set_source_scan_include and
set_source_scan_pattern to share a defensive set_source_scan_field helper that
validates or creates the root source_scan table before inserting the requested
field. Preserve each helper’s existing value conversion and file-writing
behavior, and remove the panicking indexed assignment from
set_source_scan_include.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2bbd1564-4d02-4476-ab74-b1c0daf261a6

📥 Commits

Reviewing files that changed from the base of the PR and between 8b923fb and c6e3ac6.

⛔ Files ignored due to path filters (6)
  • Cargo.lock is excluded by !**/*.lock
  • tests/snapshots/test_help__rfc_bump_help.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_deprecated_rfc_reference.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_mixed_valid_invalid_references.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_unknown_clause_reference.snap is excluded by !**/*.snap
  • tests/snapshots/test_scan__scan_unknown_rfc_reference.snap is excluded by !**/*.snap
📒 Files selected for processing (62)
  • .claude-plugin/marketplace.json
  • .claude/.claude-plugin/plugin.json
  • .claude/skills/gov/SKILL.md
  • .github/workflows/release.yml
  • CHANGELOG.md
  • Cargo.toml
  • README.md
  • docs/guide/conformance-cases.md
  • docs/guide/rfcs.md
  • docs/guide/validation.md
  • docs/rfc/RFC-0002.md
  • docs/rfc/RFC-0009.md
  • gov/adr/ADR-0009-configurable-source-code-reference-scanning.toml
  • gov/adr/ADR-0041-self-update-and-cargo-binstall-binary-distribution.toml
  • gov/adr/ADR-0059-use-project-root-selection-with-layered-ignore-rules.toml
  • gov/adr/ADR-0060-build-releases-with-zig-and-preserve-target-aliases.toml
  • gov/config.toml
  • gov/releases.toml
  • gov/rfc/RFC-0002/clauses/C-COMPATIBILITY-BOUNDARY.toml
  • gov/rfc/RFC-0002/clauses/C-GLOBAL-COMMANDS.toml
  • gov/rfc/RFC-0002/clauses/C-PRE-1-RELEASE-TARGET-COMPATIBILITY.toml
  • gov/rfc/RFC-0002/rfc.toml
  • gov/rfc/RFC-0009/clauses/C-IGNORE-MIGRATION.toml
  • gov/rfc/RFC-0009/clauses/C-IGNORE-RULES.toml
  • gov/rfc/RFC-0009/clauses/C-REFERENCE-REPORTING.toml
  • gov/rfc/RFC-0009/clauses/C-SOURCE-SELECTION.toml
  • gov/rfc/RFC-0009/clauses/C-SUMMARY.toml
  • gov/rfc/RFC-0009/clauses/C-TRAVERSAL.toml
  • gov/rfc/RFC-0009/rfc.toml
  • gov/schema/SCHEMA.md
  • gov/work/2026-07-29-prune-excluded-source-scan-directories-during-traversal.toml
  • gov/work/2026-07-30-adopt-zig-release-builds-with-pre-1-0-aliases.toml
  • gov/work/2026-07-30-authenticate-self-update-api-requests.toml
  • gov/work/2026-07-30-close-0-17-release-review-findings.toml
  • gov/work/2026-07-30-make-source-reference-diagnostics-precise-and-deterministic.toml
  • gov/work/2026-07-30-make-validation-line-ending-independent.toml
  • src/cli/resources/rfc.rs
  • src/cmd/check.rs
  • src/cmd/edit/delete_referrers.rs
  • src/cmd/migrate/mod.rs
  • src/cmd/migrate/ops.rs
  • src/cmd/migrate/ops_tests.rs
  • src/cmd/self_update.rs
  • src/cmd/self_update_tests.rs
  • src/config/mod.rs
  • src/config/runtime.rs
  • src/config/template.rs
  • src/main.rs
  • src/reference_pattern.rs
  • src/render/links.rs
  • src/scan.rs
  • src/schema.rs
  • src/signature/canonical_json.rs
  • src/signature/tests.rs
  • src/validate/bracket_refs.rs
  • src/verification/runner/process_group.rs
  • src/write/artifact.rs
  • src/write/artifact_io.rs
  • tests/edit_tests/clause.rs
  • tests/test_conformance.rs
  • tests/test_migrate.rs
  • tests/test_scan.rs
🚧 Files skipped from review as they are similar to previous changes (17)
  • .claude-plugin/marketplace.json
  • docs/guide/rfcs.md
  • docs/guide/conformance-cases.md
  • src/config/template.rs
  • gov/adr/ADR-0009-configurable-source-code-reference-scanning.toml
  • docs/guide/validation.md
  • src/verification/runner/process_group.rs
  • gov/adr/ADR-0041-self-update-and-cargo-binstall-binary-distribution.toml
  • gov/rfc/RFC-0009/clauses/C-SUMMARY.toml
  • gov/adr/ADR-0060-build-releases-with-zig-and-preserve-target-aliases.toml
  • README.md
  • .claude/.claude-plugin/plugin.json
  • gov/releases.toml
  • src/cli/resources/rfc.rs
  • CHANGELOG.md
  • gov/schema/SCHEMA.md
  • docs/rfc/RFC-0002.md

Comment thread gov/rfc/RFC-0009/clauses/C-IGNORE-RULES.toml
Comment thread src/scan.rs
Comment thread src/validate/bracket_refs.rs
@lucifer1004
lucifer1004 force-pushed the spike/zigbuild-release-ci branch from c6e3ac6 to 6c50978 Compare July 30, 2026 04:48
@lucifer1004
lucifer1004 merged commit 5cc6812 into main Jul 30, 2026
8 checks passed
@lucifer1004
lucifer1004 deleted the spike/zigbuild-release-ci branch July 30, 2026 04:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant