GeezerVison

Copy link

Copy Markdown

Collaborator

Mikola Lysenko (mikolalysenko) marked this pull request as ready for review October 6, 2026 18:57

cursor Bot reviewed Oct 6, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

cursor Bot reviewed Oct 6, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Tanmay Singla (Tanmay182003) approved these changes Oct 6, 2026

View reviewed changes

cursor Bot reviewed Oct 6, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

465 checks passed

Mikola Lysenko (mikolalysenko) deleted the agent/fix-nested-apply-json-failures branch October 7, 2026 12:07

Merging main brought in #955's PENDING_INLINE_DIGESTS entries for
gradle_cache.rs, jvm_jar.rs and sidecars/maven.rs, but #690 had
already moved those files onto the utils::digest helpers. The guard
fails on stale entries, so coverage, test and test-release are red
on main and on this PR. This is the same change as #1016, ported so
this PR's CI can go green; it no-ops once #1016 lands.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012H7zqyRTeMzzAxit6xfV6r

The digest guard test is red on main: #955 added
crawlers/gradle_cache.rs, patch/jvm_jar.rs and
patch/sidecars/maven.rs to the pending list, and #690 had already
moved them onto the utils::digest helpers. This ports the same
three-line change as #1016, so it becomes a no-op once #1016 lands.

Assisted-by: Claude Code:claude-opus-5-5

Main's test jobs are red: production_digests_go_through_the_helpers
fails because PENDING_INLINE_DIGESTS still names gradle_cache.rs,
jvm_jar.rs and sidecars/maven.rs. #955 added them while those files
computed digests inline, and #690 (sbt/Mill/scala-cli) then moved them
onto utils::digest helpers; the two merged independently, so the
ratchet now fails on stale entries on every platform.

Remove the three entries so the list matches the production tree.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Qq8uwZ9NTCZXZRygn7woy7
(cherry picked from commit 6cb46c0)

Main's test jobs are red: production_digests_go_through_the_helpers
fails because PENDING_INLINE_DIGESTS still names gradle_cache.rs,
jvm_jar.rs and sidecars/maven.rs. #955 added them while those files
computed digests inline, and #690 (sbt/Mill/scala-cli) then moved them
onto utils::digest helpers; the two merged independently, so the
ratchet now fails on stale entries on every platform.

Remove the three entries so the list matches the production tree.


Claude-Session: https://claude.ai/code/session_01Qq8uwZ9NTCZXZRygn7woy7

Co-authored-by: Claude <[email protected]>

The digest guard test is red on main: #955 added
crawlers/gradle_cache.rs, patch/jvm_jar.rs and
patch/sidecars/maven.rs to the pending list, and #690 had already
moved them onto the utils::digest helpers. This ports the same
three-line change as #1016, so it becomes a no-op once #1016 lands.

(cherry picked from commit d65c5c4)

* Start fix for #964

Assisted-by: Claude Code:claude-opus-5-5

* Stop uv projects scanning the system Python

A fresh uv checkout (uv.lock with no .venv synced yet, or a
UV_PROJECT_ENVIRONMENT that doesn't exist yet) and a directory
holding only PEP 723 script locks fell back to the global
site-packages. Every OS-Python package then joined the candidate
set, so a vendored scan tried to vendor packages the project never
depends on and exited 1 with pypi_uv_lock_package_missing.

uv only ever installs such a project into its own env, and the
lock already supplies the lock-only packages, so the crawl now
returns no env for it. A uv.lock shared with Poetry, PDM or Pipenv
files keeps the old fallback.

Fixes #964

Assisted-by: Claude Code:claude-opus-5-5

* Route Gradle digests through utils::digest

main's coverage job is red: the digest guard test from #865
requires production hashing to go through the utils::digest
helpers, and the Gradle code from #646 still hashes inline. This
is the same change as #878, ported so this PR's CI can go green;
it no-ops once #878 lands.

Assisted-by: Claude Code:claude-opus-5-5

* Revert rustfmt-only churn in files this fix doesn't touch

661c117 ran `cargo fmt --all`, which reformatted 118 files the uv
fix never changes. main isn't rustfmt-clean and CI doesn't check
formatting, so the sweep adds nothing. It also hides the real
change and conflicts with every other open PR that touches those
files. Each reverted file is byte-identical to rustfmt's output on
the merge-base version, so this drops formatting only. The six
files that carry the fix and the ported #878 change keep their
formatting.

Co-Authored-By: Claude <[email protected]>

* Drop stale digest pending-list entries

Merging main brought in #955's PENDING_INLINE_DIGESTS entries for
gradle_cache.rs, jvm_jar.rs and sidecars/maven.rs, but #690 had
already moved those files onto the utils::digest helpers. The guard
fails on stale entries, so coverage, test and test-release are red
on main and on this PR. This is the same change as #1016, ported so
this PR's CI can go green; it no-ops once #1016 lands.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012H7zqyRTeMzzAxit6xfV6r

---------

Co-authored-by: socket-patch agent <[email protected]>

* Start fix for #907

Assisted-by: Claude Code:claude-opus-5-5

* Warn on hosted yarn classic pins berry drops

A yarn 2+ install migrates a classic (v1) yarn.lock and re-resolves
every entry from the registry, so a hosted pin is silently dropped and
the package installs unpatched. Vendored mode already warned about
this; hosted mode said nothing.

The hosted engine now reads package.json beside a classic yarn.lock,
and the classic rewriter warns redirect_yarn_classic_berry_migration_risk
once per run when the lock carries a hosted pin, unless package.json
pins yarn 1 through packageManager. The yarn 1 check is shared with
the vendored probe so both modes agree.

Fixes #907

Assisted-by: Claude Code:claude-opus-5-5

* Skip berry warning when no root package.json

A yarn.lock with no root package.json is not a project yarn installs
from, so there is nothing to warn about. This also keeps the advisory
off rewriter fixtures that carry only a lock.

Assisted-by: Claude Code:claude-opus-5-5

* Route Gradle digests through utils::digest

main has failed socket-patch-core's lib tests since Gradle support
(#646) and the digest helpers (#865) both landed. The guard test
production_digests_go_through_the_helpers flags three files #646 added
that still hash inline: crawlers/gradle_cache.rs, patch/jvm_jar.rs and
patch/sidecars/maven.rs. That breaks test, test-release and coverage on
every open PR.

Each inline sha1/sha256 call now goes through sha1_hex_of or
sha256_hex_of, which compute the same lowercase hex. Behaviour is
unchanged.

Assisted-by: Claude Code:claude-opus-5-5
(cherry picked from commit 659ac2c)

* Pin yarn 1 in the yarn classic bench fixture

The scan benchmark treats any warning as a failed scenario. Its yarn
classic project declared no package manager, so a hosted scan now
correctly warns that a yarn 2+ install would drop the pins. Declare
packageManager [email protected], as the berry fixture declares yarn 4 and
as a real classic project would. The measured scan is unchanged.

Assisted-by: Claude Code:claude-opus-5-5

* Drop stale entries from the digest pending list

Main's test jobs are red: production_digests_go_through_the_helpers
fails because PENDING_INLINE_DIGESTS still names gradle_cache.rs,
jvm_jar.rs and sidecars/maven.rs. #955 added them while those files
computed digests inline, and #690 (sbt/Mill/scala-cli) then moved them
onto utils::digest helpers; the two merged independently, so the
ratchet now fails on stale entries on every platform.

Remove the three entries so the list matches the production tree.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Qq8uwZ9NTCZXZRygn7woy7
(cherry picked from commit 6cb46c0)

---------

Co-authored-by: Claude <[email protected]>

* Run CI on the merge queue and stop cancelling main push runs

Add a merge_group trigger and a single aggregate `ci-ok` job that needs
every CI job, so a repository ruleset can require one check and turn on
GitHub's merge queue. The queue tests each PR merged onto the current tip
of main before it lands, which closes the semantic merge race that left
main red (two PRs that each passed on their own, #955 and #690, broke the
two-sided PENDING_INLINE_DIGESTS ratchet once both merged).

Group push runs per commit. A concurrency group keeps only one pending
run, so the shared refs/heads/main group cancelled every queued push but
the newest during a merge burst; most main commits never got a verdict.
The old comment claimed push runs "always finish", which was false.

Also correct the hosted-e2e comment: no branch protection or ruleset
registers it as a required check today; ci-ok needs it instead.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Keep merge-queue runs on the PR tier and main hosted-e2e uncancelled

merge_group fell through the 'not pull_request' gate on e2e-full,
yarn-berry-full and cargo-vex-matrix-full, so every queue entry ran the
nightly matrices and could fail or overrun the queue wait. hosted-e2e
still grouped main pushes on github.ref; a group keeps one pending job,
so burst pushes cancelled each other and ci-ok counted that as failure.
Group main pushes per commit, matching the workflow-level group.

Co-Authored-By: Claude <[email protected]>

* Expect the full CI tier to skip merge-queue runs too

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>

Resolve conflicts against main's rustfmt pass and the containment-helper
refactor (#1042): keep main's formatting, drop the removed `canon` /
composer-identity helpers in favour of PurlKey, and route main's new
apply-failure purl matching in get.rs (#955) through PurlKey::qualified /
PurlKey::same so it agrees with the rest of the purl identity.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>