harden review readiness skill gates#600
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3046994629
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Pull the diff (cap size so we never blow the context window). | ||
| gh pr diff "$PR" --repo "$REPO" | head -c 200000 > /tmp/pr.diff | ||
| gh pr diff "$PR" --repo "$REPO" \ | ||
| | python -c 'import sys; sys.stdout.buffer.write(sys.stdin.buffer.read()[:200000])' \ |
There was a problem hiding this comment.
For very large PRs, this read()[:200000] still consumes the complete gh pr diff stream before applying the 200 KB cap, so the workflow can spend runner time/memory downloading and buffering a huge diff even though only the first chunk is sent to Claude. This regresses the previous streaming behavior of head -c; use a bounded read/streaming truncation that stops after the limit while still handling SIGPIPE cleanly.
Useful? React with 👍 / 👎.
1 participant
Summary
make checkviamake review-readiness.proof/skill-progression-2026-06-12/LOG.md.Review Readiness
proof/skill-progression-2026-06-12/LOG.md.Proof
python scripts/review_readiness_guard.py-> passedpython -m pytest sdk/tests/test_review_readiness_guard.py sdk/tests/test_sdk_preflight.py sdk/tests/test_ci_guardrails.py -q-> 16 passedpython scripts/sdk_preflight.py-> passedpython -m ruff check sdk/agentguard/ scripts/generate_pypi_readme.py scripts/sdk_preflight.py scripts/sdk_release_guard.py scripts/ci_tools_requirements_guard.py scripts/review_readiness_guard.py-> passedpython scripts/ci_tools_requirements_guard.py-> passedpython scripts/generate_pypi_readme.py --check-> passedpython scripts/sdk_release_guard.py-> passedpython -m pytest sdk/tests/ -q-> 812 passedpython -m pytest sdk/tests/test_architecture.py -v-> 9 passedpython -m bandit -r sdk/agentguard/ -s B101,B110,B112,B311 -q-> passed with no findingspython -m pytest sdk/tests/ -v --cov=agentguard --cov-report=term-missing --cov-fail-under=80-> 812 passed, 92.36% coveragenpm --prefix mcp-server ci && npm --prefix mcp-server test-> 10 passed, using a temporary npm cache because the default npm cache hit ENOSPC earlierpython -m pip install -e ./agentguard-mcp && cd agentguard-mcp && python -m ruff check agentguard_mcp tests && python -m pytest-> 15 passedRisk And Rollback
Low. This is repo-process/workflow hardening plus tests and a proof log. Rollback is a straight revert of this PR.
Scope
Notes
makeis not installed in this PowerShell environment, so the equivalent underlying commands were run directly.actionlintis not installed, so workflow syntax relies on the existing GitHub Action check after PR open.npm --prefix mcp-server cireported the known moderatehonoadvisory; existing issue security: mcp-server npm audit — fast-uri (high), hono + qs (moderate) #596 and Dependabot PR chore(deps): bump hono from 4.12.18 to 4.12.23 in /mcp-server #570 already track it, so no duplicate issue was opened.