Repository navigation
fix(source-control): close the cost hold's billed and security probe gaps - #10583
Conversation
Lane-Activity: work-resolve-issue/resolve-issue
|
claude-security-review reviewed No security findings in the incremental change since e924f7d ( What changed. Does it weaken a merge hold? No.
Alternation order. At a Unclosed expressions. A Spend. None. The change touches the risk-scoring script and its test only. Not reported: on a very long line holding an unclosed |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
claude-review reviewed Incremental review of What changed. Checks made.
Tests. Spend. None of this change spends anything. |
|
pr-unblock / address-feedback finished round 1 of max 4 on fbe89c5. |
melodic-automation-lanes
Bot
added
the
needs-human
|
The pr-unblock lane stopped on this pull request and needs a person: a review finding is uncertain or deferred, so a person decides it.
To resume, deal with the reason above, remove the gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=10583 -f activity=address-feedback |
kyle-sexton
left a comment
kyle-sexton
left a comment
There was a problem hiding this comment.
Owner approval of head fbe89c5 (hold path babysit_risk.py; cost rule loop-lane README:335-341).
kyle-sexton
removed
the
needs-human
|
Unattended merge: native auto-merge leaves this pull request unarmed at head |
Lane-Activity: pr-unblock/address-feedback
d826d5b
|
pr-unblock / address-feedback finished round 2 of max 4 on d826d5b. |
Lane-Activity: pr-unblock/address-feedback
|
pr-unblock / address-feedback finished round 3 of max 4 on 4017f44. |
|
The pr-unblock lane stopped
The review rounds are not converging after the round cap and one fresh fixer round. Open review threads:
When a retry on this head can change the outcome, the lane runs one on its own, up to its per-head cap, and edits this comment if it stops again; a run that does not stop clears the status. When no retry can (a review thread the lane does not take or settle, or a failing check after the retries are spent), a person resolves the threads or gets the checks green, then dispatches the workflow below: that run finds the cause gone and clears the status. On a pull request the lanes App opened, the dispatchers start that run once per stop; on any other, a person does. A new commit to the branch starts clean. A reply on a thread, from an account with write access, starting To run it again on this head now, dispatch the gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=10583 -f activity=address-feedback |
|
Unattended merge: native auto-merge leaves this pull request unarmed at head |
melodic-automation-lanes
Bot
added
the
needs-human
A quote a YAML comment leaves open in a `${{` could still move where
_logical_lines joins a split expression, so a bare `secrets` on the
next line escaped the secret-exposure hold. Every `${{` now starts a
fresh body with no literal open, keeping the body it cuts short, and a
body whose literal is still open where its read ends holds under its
own text, so only the same body removed elsewhere offsets it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…olve-issue/issue-9241-40621393295-1
…imeout raises
The cost hold now reads a bare `secrets` in an `if:` value written without
`${{ }}` (job or step level, quoted, flow style or a block scalar) as a
secret-exposure-review reference.
At a timeout key path where the base has numbers and none is lost, a gained
number counts as raised only above the highest one there, and a
`leg-timeout-minutes` set where the base had none is a cap, not a raise. Job
`timeout-minutes` keeps its 360-minute baseline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t their key path On a workflow that names a model action, the line pass reported every added timeout number when the patch removed none, so a cap added to a model leg held the merge for cost. With base text to compare, the path pass already judges each number at its key path, so the line pass now keeps only added expressions. With no base text it still judges numbers. Two fixtures whose base and head text omitted the timeout the patch changed now carry it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lane-Activity: pr-unblock/resolve-conflicts
e924f7d
|
Unattended merge: native auto-merge leaves this pull request unarmed at head |
melodic-automation-lanes
Bot
added
the
needs-human
kyle-sexton
removed
the
needs-human
…reference The base merge at e924f7d resolved babysit_risk.py's conflict without #10743's `${{ }}` alternative of _SECRET_REF, so `${{ secrets }}`, `contains(secrets, 'A')` and `secrets || 'x'` inside an expression no longer matched it. Restore the alternative and pin those shapes in a test that fails without it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kyle-sexton
removed
the
do-not-merge
Refs: #9241
Summary
The unattended merge gate's cost hold (
babysit_risk.py) now catches the shapes from #9241 that can bill or that widen what a credential or an agent can reach. The model-setting shapes and the public-repository timeout shapes from the first version are dropped: under the owner's direction, cost means only what can bill, and model usage under the Claude subscriptions or prepaid API credits does not, nor do Actions minutes on a public repository. This PR no longer settles the #9241 rows forANTHROPIC_MODEL,model:/max-turns:inputs and model flags in actions or scripts, so it refers to the issue and does not close it.Kept:
secretscontext inside a${{ }}expression outside a string (${{ secrets }},contains(secrets, 'X')),secrets.*, and a reference split across a folded scalar rate HIGHsecret-exposure-review.claude-code*action or@anthropic-ai/claude-coderun) in a composite.github/actions/**/action.ymlrates HIGHagent-surface-review.runs-onexpression's matrix values and inputdefault:/options:count as runner values, since larger runners bill even on public repositories.Dropped:
_MODEL_FLAG/_MODEL_SETTINGand the widened_COST_WORKFLOW_LINE(ANTHROPIC_*MODEL,model:/max-turns:inputs) across workflows, composite actions and.github/scripts/;_COST_WORKFLOW_LINEis main's again.new local callcost-finding, and theno patch to readcost-findingfor a.github/scripts/file._raised_timeouts, unchanged.Fix
plugins/source-control/skills/babysit-prs/scripts/babysit_risk.py:_billed_timeouts(the per-key-path comparison,_yaml_entries,_item_drops,_path_timeouts,_raises) runs only whenpublicis not True; main's_raised_timeoutsand_TIMEOUTstay for the public report._composite_model_legsreplaces_model_surfaceand returns new model legs only. The secret helpers (_expressions,_logical_lines,_secret_refs,_BARE_SECRETS) and runner helpers (_referenced_runners,_join_flow) are unchanged from the earlier head.tests/test_babysit_risk_cost.py: removedtest_model_settings_on_a_model_step_are_reported,test_a_new_local_workflow_or_action_call_is_reported,test_model_settings_in_actions_and_scripts_are_reportedandtest_other_action_and_script_lines_are_not_reported;assertChargeno longer asserts a public-repository report.docs/conventions/pr-pipeline/README.md: the raised-timeout paragraph is scoped off a public repository; thecost-findingbullets are main's again..changes/source-control/and.changes/pr-pipeline/fragments reworded to the trimmed scope.A composite
action.ymloraction.yamlwith no patch to read rates HIGHagent-surface-review, since it may hide a new model leg (review thread onbabysit_risk.py).Verification
python3 -m unittest discoverinplugins/source-control/skills/babysit-prs/scripts: 3433 tests, OK (5 skipped), on head a39253e.test_a_composite_action_with_no_patch_holds_for_securityfails without the no-patch fix and passes with it.python3 -I scripts/sync-hold-floor.py --check: exit 0.scripts/check-changelog-fragments.sh --check: all fragments valid.scripts/run-ruff.sh checkon the changed Python: all checks passed.check-affectedrun passed after merging origin/main.Related
babysit_risk.pytoo.🤖 Generated with Claude Code