cowork-bot: automated improvements (cowork/improve-configdrift)#44
Merged
Conversation
…startswith
Critical keys with embedded sensitive terms (db_password, jwt_token,
app_secret_key, mysql_auth_url, oauth_token, connection_endpoint,
main_api_key_id) were incorrectly classified as WARNING or INFO instead
of BREAKING.
Root cause: _infer_severity_{added,removed,changed}() used
key.lower().startswith(p) which only catches keys that *begin* with
a critical prefix. Real-world config keys overwhelmingly embed the
sensitive term (e.g. 'db_password', not 'password_db'), so the heuristic
almost always missed them.
Fix: change to substring check -- p in key.lower() -- so the severity
gate fires correctly for any key containing a critical term.
Non-sensitive keys (cache_ttl, log_level, port, retry_count) are
unaffected since none of the critical terms appear as substrings.
Regression tests: 11 new cases in TestSeveritySubstringMatch, including
an end-to-end diff_configs assertion that has_breaking fires.
114/114 tests pass; ruff clean.
…itical terms Supersedes substring match (p in key.lower()) which: - Fixed nested keys like services.database.password (TRUE positive) - But over-flagged false positives: author->auth, secretary->secret, tokenizer->token New algorithm splits flattened keys into words (dot/snake/kebab/camel) and matches critical terms as contiguous word sequences. Also handles concatenated forms for multi-word terms (apikey -> api_key). +30 tests for word-boundary behavior: nested TRUE-positives, concatenated TRUE-positives, and 10 false-positive regressions. All 141 tests pass; ruff clean.
…ot on public PyPI); remove false PyPI badge
… names Closes #37. Path.stem strips the final dotted segment of directory names, causing silent collisions for dirs like "prod.v2" and "prod". Path.name preserves the full basename.
🤖 Automated Code Review✅ Ruff Lint — No issues
|
💡 Codex Reviewconfigdrift/src/configdrift/diff.py Line 79 in f51ae53  Treat numeric-suffixed critical keys as breaking
Keys such as ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated improvement PR from the Cowork repo-improver rotation (one coherent senior-dev improvement per run; see individual commit messages). Subsequent runs push additional commits to this PR rather than opening new ones.