feat(tcfeed): stop offering the workflow to repositories the rules cannot read - #157
Merged
Conversation
…nnot read
A maintainer declined the offer on SibtainOcn/Quiesce with the reason
written out in full: a local Windows CLI in Go, no server, no network,
nothing deserialised, so "the workflow would be reporting on categories
this codebase can't produce." Nothing here was deciding that first, so a
human read the pitch and did it for us.
The rule set is not language-neutral and never claimed to be. Counted out
of packages/scan/src: javascript 49, typescript 49, python 18, java 10,
php 9, shell 7, go 6, ruby 5, and nothing at all for C, C++, Rust, C#,
Swift or Kotlin. prTarget now scores a candidate by how much of it those
rules can read — bytes, weighted, from the languages field on the
`gh repo view` call it was already making, so it costs no extra request —
and skips below twelve.
Twelve is where the three measured results sit either side of it.
inspektor-gadget scores 2.3 and returned 45 findings with 0 true
positives; spinifex scores 10.1 and returned 280 with 0; Quiesce scores 6
and returns exactly one, `exec.Command("cmd", "/c", "ver")`, which is a
false positive. Nothing above the floor has been measured that badly.
TCFEED_MIN_RULES moves it, and 0 turns it off.
The scan path is left alone and only gains the number as a column: it
exists to produce a shortlist to read by hand, and a Go repository with a
real key in it is still worth reading. It is the unsolicited pull request
that needs a floor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan63 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 52 | LOW: 7
…and 13 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A maintainer declined the offer on SibtainOcn/Quiesce#5 with the reason written out in full:
He was right, and nothing in
tcfeedwas deciding that before he had to.What changed
prTargetnow scores a candidate by how much of it the rule set can actually read, and skips below a floor.The rules are not language-neutral and never claimed to be. Counted out of
packages/scan/src/:The score is those counts weighted by each language's share of the repository in bytes, from the
languagesfield on thegh repo viewcallprTargetwas already making — so it costs no extra request. Entirely TypeScript scores 49, entirely Python 18, entirely Go 6, entirely Rust 0.Why twelve
Because of what the measured results sit either side of it:
Nothing above the floor has been measured that badly.
TCFEED_MIN_RULESmoves it;0turns it off.Dry run over the calibration set:
What did not change
The scan path still scans everything and only gains the number as a
RULEScolumn. It exists to produce a shortlist to read by hand, and a Go repository with a real key in it is still worth reading. It is the unsolicited pull request that needs a floor, not the reading.Verification
tsc --noEmit --strictclean.🤖 Generated with Claude Code