Fix Chocolatey OData query encoding - #34
Conversation
|
Findings No issues found. The diff is tightly scoped to the actual failure: it switches Operational follow-up remains outside the PR: after merge, advance shared |
|
monit-reviewer
left a comment
monit-reviewer
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: b94a77e
Summary
| Reviewer | Findings |
|---|---|
| security:security-code-auditor | 1 |
security:security-code-auditor (1 findings)
actions/chocolatey-push/chocolatey_push.py:136
Missing import for 'quote' function — the code uses 'quote_via=quote' but the import line must read 'from urllib.parse import urlencode, quote' (or equivalent). A missing import causes a NameError at runtime on the moderation probe path.
2 PR discussion threads considered.
Completed in 44s | $0.33 | sonnet | daemon 0.2.121 | Glorfindel
| Field | Value |
|---|---|
| Model | sonnet |
| Reviewers | hybrid-synthesis, database:database-reviewer, harness-engineering:harness-architecture-reviewer, harness-engineering:harness-enforcement-reviewer, harness-engineering:harness-knowledge-reviewer, harness-engineering:harness-self-documenting-code-reviewer, security:security-code-auditor |
| Engine | claude · sonnet |
| Reviewed by | pr-review-daemon · monit-pr-reviewer |
| Duration | 44s wall · 1m 43s compute (Reviewers: 29s · Synthesis: 12s) |
| Cost | $0.33 |
| Tokens | 212.6k in / 5.8k out |
| Turns | 15 |
Per-workstream usage
| Workstream | Model | In | Out | Cache read | Cache create | Cost |
|---|---|---|---|---|---|---|
| hybrid-synthesis | sonnet | 28.8k | 449 | 17.4k | 11.4k (1h) | $0.06 |
| database:database-reviewer | sonnet | 11.6k | 89 | 4.1k | 7.4k (1h) | $0.03 |
| harness-engineering:harness-architecture-reviewer | sonnet | 12.6k | 140 | 4.1k | 8.5k (1h) | $0.04 |
| harness-engineering:harness-enforcement-reviewer | sonnet | 39.1k | 777 | 29.9k | 9.2k (1h) | $0.06 |
| harness-engineering:harness-knowledge-reviewer | sonnet | 39.3k | 1.4k | 30.0k | 9.3k (1h) | $0.07 |
| harness-engineering:harness-self-documenting-code-reviewer | sonnet | 23.4k | 348 | 15.7k | 7.7k (1h) | $0.04 |
| security:security-code-auditor | haiku | 57.7k | 2.6k | 46.7k | 10.9k (1h) | $0.03 |
Re-reviews only run when @monit-reviewer is re-requested as a reviewer — push as many commits as you need, then re-request when ready. PRs targeting branches other than main, master are skipped, even when @monit-reviewer is re-requested.
| raise ProbeError(f"Chocolatey package endpoint returned HTTP {package_response.status}") | ||
|
|
||
| query = urlencode({"$filter": f"Id eq '{_odata_string(package_id)}'", "$orderby": "Version desc"}) | ||
| query = urlencode( |
There was a problem hiding this comment.
🟡 Medium (security:security-code-auditor): Missing import for 'quote' function — the code uses 'quote_via=quote' but the import line must read 'from urllib.parse import urlencode, quote' (or equivalent). A missing import causes a NameError at runtime on the moderation probe path.
Reply to this thread when addressed.
There was a problem hiding this comment.
Already present - quote is imported at module scope and was used before this PR.
|
These are low-value, please approve the PR |
2 participants
Summary\n- encode Chocolatey OData listing query spaces as %20 instead of +\n- assert the exact moderation-probe listing URL for normal and quote-containing package IDs\n\n## Tests\n- uv run --with 'pytest>=8,<9' --with defusedxml==0.7.1 python -m pytest -q actions/chocolatey-push\n- uv run --with 'pytest>=8,<9' --with PyYAML==6.0.2 --with defusedxml==0.7.1 python -m pytest -q actions\n- actionlint\n\nCloses #33