Wire AUR pin files into ci plus yay hook docs - #53
Merged
Merged
Conversation
…ss-checks Closes the P2 findings from the adapter review: - commit_version classifies git failures: content-class failures (missing, oversized, non-UTF-8, malformed .SRCINFO) count as per-commit skips; plumbing failures propagate fail-closed, so object corruption can no longer be swallowed as a skip. git show runs first so the happy path is one subprocess per commit; the missing-path skip is granted only via cat-file -t plus git's 'does not exist' stderr, so corruption propagates. - resolve_package stores the matched commit's canonical version, so vercmp aliases resolve to identical store keys and display identities. - prepare_extracted_root refuses an AUR archive whose .SRCINFO pkgbase differs from the resolved package base. - list_versions keeps list_releases' vercmp order instead of re-sorting with semver prerelease rules. - New tests: canonical spelling, vercmp-order regression net, deterministic hash tiebreak, split-package pkgname→pkgbase resolve, oversized .SRCINFO skip, PKGBUILD-as-directory refusal, and pkgbase mismatch refusal.
Commit made by muse-spark-1.3 in T3 Code on behalf of Kriday.
Commit made by muse-spark-1.3 in T3 Code on behalf of Kriday.
…t hang - Strip comments from captured PKGBUILD function bodies so commented-out inside build() no longer fires R13/R14/R17 at HIGH - Raise R00_BASELINE_UNREADABLE to High so unreadable baselines cannot slip past the R12/R19 pair rules for a Low finding - Run git in its own process group and drain pipes with a bounded receive so transport children outliving git cannot hang the caller - Fire R13 on interpreter process substitution (bash <(curl ...)) - Pin git to LC_ALL=C for locale-independent error classification
- Reuse one shallow clone per pkgbase across resolve, releases walk, and author lookup (cache keyed by full clone url, capped at 8 entries); fetch_verified keeps its fresh re-clone as an independent sample - Add removed_count to CiReport so deleted pins surface in the report and both summaries - Decode PKGBUILD $'...' \xHH and octal escapes as raw bytes like bash (non-UTF-8 becomes U+FFFD, octal over one byte fails closed)
Commit made by muse-spark-1.3-contributor-free in opencode on behalf of Kriday.
Commit made by muse-spark-1.3-contributor-free in opencode on behalf of Kriday.
kridaydave
force-pushed
the
fix-aur-review-findings
branch
from
September 12, 2026 07:04
b824481 to
999ccac
Compare
# Conflicts: # CHANGELOG.md # src/registry/aur.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacks on the AUR adapter, PKGBUILD heuristics, and review-fix commits in this branch (those layers are not in main yet, so this PR carries the whole stack).
PR4 integration:
Pins are pkgbase@pkgver-pkgrel, not raw commit hashes. Commit binding holds through newest-commit-wins plus the commit-bound archive digest in the audit log. Raw @commit pins need a resolve-by-commit path; left as follow-up. No store.rs changes per the ask-first guardrail.
Gate: cargo fmt --check, cargo clippy --locked -D warnings, cargo test --locked (453 pass) all green. No new dependencies.