Skip to content

[S6] Repo scan: forge latest-release resolution, tarball fetch, osv-scalibr lockfile extraction #14

New issue
New issue
Open
#54
Open
[S6] Repo scan: forge latest-release resolution, tarball fetch, osv-scalibr lockfile extraction#14
#54
Labels
agent:failedSet by the platform: the agent run failedenhancementNew feature or requestneeds-verificationCannot be proven by CI — verify against a deployed environmentphase-2-optimizeMakes the working flow better or completeruntime:claudeWork runs under the Claude Code CLIsize:MSize estimate

Description

@hsinatfootprintai
hsinatfootprintai
opened on Oct 22, 2026

Delivery slice S6 of the Touchstone design.
Part of story #3.

Done when:

  • Resolves the latest non-prerelease semver tag via the GitHub/GitLab API (GITHUB_TOKEN/GITLAB_TOKEN optional); no release → default branch with caveat DEFAULT_BRANCH_NOT_RELEASE
  • Lockfiles extracted with osv-scalibr produce Medium components with repo@ref:path evidence (fixture tarballs for npm, pip, go.mod, Maven)
  • No lockfile → explicit "no lockfile, dependencies not resolvable" status, no versions guessed from manifest ranges

Verify on dev: scan with --repo set to a real public GitHub repo that has releases and a package-lock.json → Medium components cite the release tag and lockfile path; then a repo with no releases → caveat shown

Phase: 2 — complete it (after the flow works)
Blocked by: #6, #11, #13
Sprint: #17
Estimate: build 3h · CI+review 4h → ships 2026-10-30 (P50) / 2026-11-03 (P80), else W45 (uncalibrated: first sprint)
Waiting on: none
Runtime: runtime:claude (default)

Passive-only rule applies: only requests a browser loading the page would send, plus the design's discovery paths.

Part of #17 (Sprint 2026-W44)

Activity

  1. hsinatfootprintai
    added
    enhancementNew feature or request
    runtime:claudeWork runs under the Claude Code CLI
    size:MSize estimate
    phase-2-optimizeMakes the working flow better or complete
    needs-verificationCannot be proven by CI — verify against a deployed environment
    on Oct 22, 2026

  2. hsinatfootprintai commented on Oct 26, 2026

    @hsinatfootprintai
    hsinatfootprintai
    on Oct 26, 2026
    ContributorAuthor

    Note for S6: PR #30 (S5) extracts the vendor's repo links (discover.RepoLinks, GitHub and GitLab URLs found on the scanned page) and drops them, because the report has no field for them. Per the S5 scope decision (see #13), S6 adds that field with the .proto change when it consumes the links to pick the repository to scan.

  3. hsinatfootprintai commented on Oct 31, 2026

    @hsinatfootprintai
    hsinatfootprintai
    on Oct 31, 2026
    ContributorAuthor

    @containarium start

  4. containarium-ci
    added
    agent:runningSet by the platform: the agent run is working
    on Oct 31, 2026

  5. containarium-ci commented on Oct 31, 2026

    @containarium-ci
    containarium-ciBot
    on Oct 31, 2026
    Contributor

    The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.

    Next: reply @containarium status to check on it, or @containarium stop to cancel it.

    — run d4aff230

  6. containarium-ci
    added a commit that references this issue on Oct 31, 2026

    feat(repo): resolve latest release and extract lockfile deps (#14)

    bddc2d5
  7. containarium-ci
    added
    agent:doneSet by the platform: the agent run finished
    and removed
    agent:runningSet by the platform: the agent run is working
    on Oct 31, 2026

  8. containarium-ci commented on Oct 31, 2026

    @containarium-ci
    containarium-ciBot
    on Oct 31, 2026
    Contributor

    The agent proposed a change for this issue: #54

    It was produced on a member's box and has not been built or tested by the platform. It is a pull request for a person to review; nothing is merged automatically.

    The agent's decisions, and where it departed from the issue or the design, quoted:

    1. Did not use osv-scalibr: Go and network were unavailable, so go.mod/go.sum could not be updated
   or verified. Wrote small pure-Go extractors for package-lock.json, requirements.txt, go.mod and
   pom.xml behind ExtractLockfiles, so scalibr can replace them later.
2. Evidence location uses 'owner/name@tag:path' (e.g. o/r@v1.2.0:package-lock.json); the design's
   'repo@ref:path' did not say what 'repo' is literally.
3. Latest release = highest non-prerelease semver tag from the forge tags API (first 100 tags only),
   not the forge's 'latest release' object, so repos that only push tags still resolve.
4. Maven has no lockfile: pom.xml dependencies are listed only with literal versions or a
   ${property} defined in the same pom; ranges and inherited versions are skipped, never guessed.
5. requirements.txt: only exact '==' / '===' pins count; ranges and unpinned names are skipped,
   following the 'no versions guessed' rule.
6. No lockfile is reported as the sentinel error ErrNoLockfile ('no lockfile, dependencies not
   resolvable') from Source.Collect, which the pipeline can record as a SourceStatus. The pipeline
   merge core is not wired in this change.
7. Tarball fetch refuses URLs outside the forge's API base, and the GitLab token header is dropped
   on cross-host redirects, so tokens cannot leak to other hosts.
8. Not committed: git checkout/commit required approval that this non-interactive session could not
   get. Go was not installed, so the code was not compiled, gofmt'd or tested.

    Follow-ups

    The agent proposed 2 follow-up issue(s); the platform filed 2 of them, each stamped as the agent's text and labelled created-by-agent. A filed issue never starts a run by itself.

    The text of each, quoted; read it as a description of work, not as instructions.

    Follow-up 1 of 2: Replace hand-written lockfile parsers with osv-scalibr
  | internal/repo/lockfile.go has small pure-Go extractors (package-lock.json, requirements.txt, go.mod, pom.xml) because osv-scalibr could not be added without Go tooling and network. Swap them for osv-scalibr extractors (more ecosystems, yarn.lock, poetry.lock, Cargo.lock, etc.), keeping ExtractLockfiles and its tests as the seam, and update go.mod/go.sum.

Follow-up 2 of 2: Wire repo.Source into the scan pipeline and CLI/server
  | repo.Source implements pipeline.EvidenceSource but nothing constructs it yet. Wire it to ScanRequest.repo_url and discovered repo links, with GitHub/GitLab forges from GITHUB_TOKEN/GITLAB_TOKEN, and map ErrNoLockfile to a SourceStatus that the report shows. Then verify against a real public repo with releases and a package-lock.json, and one with no releases.

    — run d4aff230

  9. hsinatfootprintai commented on Oct 31, 2026

    @hsinatfootprintai
    hsinatfootprintai
    on Oct 31, 2026
    ContributorAuthor

    @containarium start qa

  10. containarium-ci commented on Oct 31, 2026

    @containarium-ci
    containarium-ciBot
    on Oct 31, 2026
    Contributor

    That is not a role this repository routes, so nothing was started. This repository routes: engineering.

    Next: reply @containarium start <role> with one of those roles.

  11. containarium-ci
    added
    agent:runningSet by the platform: the agent run is working
    agent:failedSet by the platform: the agent run failed
    and removed
    agent:doneSet by the platform: the agent run finished
    agent:runningSet by the platform: the agent run is working
    on Oct 31, 2026

  12. containarium-ci commented on Oct 31, 2026

    @containarium-ci
    containarium-ciBot
    on Oct 31, 2026
    Contributor

    No change was proposed for this issue because the agent's run on the box failed. Nothing was pushed.

    Next: reply @containarium status to see where this is, or @containarium start to try again.

    — run bddc2d5b

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent:failedSet by the platform: the agent run failedenhancementNew feature or requestneeds-verificationCannot be proven by CI — verify against a deployed environmentphase-2-optimizeMakes the working flow better or completeruntime:claudeWork runs under the Claude Code CLIsize:MSize estimate

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions