Maintenance: quality workflowz — scheduled audits, canaries, dep automation, 3 bug fixes - #8
Merged
Merged
Conversation
hono <4.12.34 has 3 moderate + 1 low advisories against our surface (SSR memo cross-request disclosure, CORS ReDoS, proxy header leak, language-middleware DoS). 4.13.3 is a caret-range bump; full suite re-greened. bun audit now clean.
- maintenance.yml (Mon 09:30 UTC): scheduled bun audit -> security issue; canary suites against bun@latest and redis-stack@latest -> maintenance issue; docker build + upsert/query smoke - dependabot: bun deps (all), github-actions, docker, docker-compose ecosystems; @upstash/vector stays ungrouped for individual review; typescript majors ignored (7.x hold) - pin redis-stack-server 7.4.0-v8 in CI + compose (bit-identical to current latest; canary now watches latest explicitly) - Dockerfile oven/bun 1 -> 1.3-alpine (minor-pinned) actionlint + shellcheck clean.
…-safe metrics token - timeout middleware: attach an observer to the losing next() chain so a late rejection logs instead of becoming an unhandledRejection - ensureIndex: parse DISTANCE_METRIC from FT.INFO (RESP3 + RESP2) and fail loudly when an existing index was built under a different UPVECTOR_METRIC; previously only dimension was validated, so a metric change silently mis-normalized scores - /metrics token: timingSafeEqual with length pre-check, matching the main auth middleware 381 tests (247 unit / 60 integration / 74 compat) green via scripts/test-all.sh against redis-stack 7.4.0-v8.
RUNBOOK.md documents the recurring system: automation inventory, triage playbook per failure signal, release gate, and the deep-audit workflowz (parallel adversarial finders + refute-voting). First run recorded in docs/audits/2026-08-22-deep-audit.md: 15 raw findings, 6 confirmed, 3 fixed, 3 open for triage.
- ensureIndex: compare FT.INFO metric against the Redis-native name (toRedisDistanceMetric) — raw config values (EUCLIDEAN/DOT_PRODUCT) would have spuriously failed every already-exists check for 2 of 3 metrics - syncIndexes/loadDimension: validate metric compatibility at boot and cold-cache paths too; previously only the already-exists branch checked, so a restart with a changed UPVECTOR_METRIC stayed silent; ValidationError rethrown instead of swallowed by generic catches - timeout middleware: attach the late-rejection observer inside the timeout branch only — unconditional attachment mislabeled every fast handler error as "late failure after request timeout" - maintenance.yml canary-bun: drop UPVECTOR_TOKEN=test step export that conflicted with the test-token-123 server env (guaranteed 401s) - docs: README counts 372/238 -> 381/249-unit table rows, pin redis-stack-server in README side-by-side example, CLAUDE.md container line matches Dockerfile pin Full gate green: 383 tests (249 unit / 60 integration / 74 compat).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets up the recurring quality system discussed in #discussion, plus the first deep-audit pass.
Always-on automation
bun audit→ labeled security issue; full-suite canaries againstbun@latestandredis-stack-server:latest; docker build + upsert/query smoke through the deployed artifact. Failures open amaintenanceissue with dedup.github-actions+docker+docker-composeecosystems.@upstash/vectorstays ungrouped (compat contract, individual review). TypeScript 7 majors ignored deliberately.7.4.0-v8in CI + compose (digest-identical to currentlatest, so zero behavior change); Dockerfileoven/bun:1.3-alpine. Floating versions now exist only as explicit canaries that fail loudly.test.yml/ weekly SDK-compat workflow unchanged apart from the Redis pin.First deep-audit pass (procedure documented in docs/RUNBOOK.md)
5 blind finder agents → 15 raw findings → adversarial refutation → 6 confirmed → personally verified:
Fixed:
unhandledRejection— now observed + logged (regression test)UPVECTOR_METRICagainst existing data silently mis-normalized scores — now fails loudly via FT.INFO metric parse (RESP3+RESP2) + unit tests/metricstoken: timing-safe compareOpen for triage (docs/audits/2026-08-22-deep-audit.md): Float32 overflow silent (
1e300→ ±Infinity stored),/fetchids-cap stricter than docs, non-atomic namespace reset race.Also
Verification
scripts/test-all.shon redis-stack7.4.0-v8bun audit: clean on hono 4.13.3