Repository navigation
feat: tarsier check policy (TAR-47) + otel/semconv-drift (TAR-63) - #6
Merged
Merged
Conversation
Add `tarsier check --policy` with opt-in blocking classes only; reject layer-3/4 and unknown block entries at parse time. Honour baseline. Document exit codes. Add Go/TS otel/semconv-drift rules for deprecated HTTP attribute names (advisory), with ruletests and badshop fixtures. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Bugbot/security: validate trimmed block entries but blockedRules used raw strings, so padded class names silently disabled the gate. Ponytail: hoist normalizeEngine/ensurePatternRules/runEngines for scan and check; drop unused gocyclo nolint. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Lock the property behind the whitespace bypass: after validate succeeds, Block is trimmed and blockedRules expands every mapped rule. Prefer stdlib fuzz over a property-testing dependency. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Property tests for fingerprint/suppressions/partition, version+JSON decode, multi-lang Analyze, and CI gate counters. Prefer testing.F over rapid (no new dep). Corpus keeps the blockingCount threshold=0 edge. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
go run tool@version was switching to the tool module's older go line (x/tools v0.50 → 1.26) while this module requires go 1.27.1, so deadcode failed with "package requires newer Go version". Pin each go-run tool to $(go env GOVERSION) so analysis uses the same toolchain as the module. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Propagate deadcode non-zero exit (package load failures) instead of only checking stdout. Update otel-semconv-drift-go snapshot to match the blank semconv import fixture so `make rules` passes. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Remove live-API-dead File helpers kept alive only by tests/fuzz.
Delete unreachable ValueSpec ok-check and parseVersion i>2 break.
Add focused tests for policy load errors, render write failures,
normalizeEngine(""), extras sort, and a few resolve edge cases.
Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Unchecked assert fails golangci; branch stays defensive and uncovered. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
WalkDir reports ModeSymlink without ModeDir, so IsDir is always false here; one skip covers file and directory symlink entries. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
Cold-cache `go: downloading` lines were merged into stdout via 2>&1 and falsely failed the non-empty deadcode check in CI. Pin GOTOOLCHAIN from go.mod so GOTOOLCHAIN=local on an older host go still selects the module line. Co-authored-by: Bartłomiej Piekarz <Pieczasz@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements two Linear targets:
TAR-47 —
tarsier check+ policy filetarsier check --policy observability-policy.yaml [path]unbounded-metric-labels,secrets-in-logs,missing-propagation,removed-required-eventslogs/unstructured-logging--baseline/--baseline-write)1only when opted-in blocking findings match; documented in--helpand READMETAR-63 —
otel/semconv-drifthttp.method,http.target, …)attribute/semconv(Go) or@opentelemetry/api|semantic-conventions(TS) is importedinfoseverity; migration guide innoteMake / toolchain
make dead/modern/vuln: pinGOTOOLCHAIN=$(go env GOVERSION)sogo run tool@versiondoes not downgrade to the tool module’s older go line (x/tools v0.50 → 1.26 vs module go 1.27.1)make deadalso fails on deadcode non-zero exit (package load errors), not only non-empty stdoutotel-semconv-drift-goast-grep snapshot to blank-import fixtureVerification
make dead/make modern/make vulnmake lintmake testmake rules(ast-grep test)make tidy