Pseudo-version audit: per-dependency integrity signal#100
Open
unidoc-alip wants to merge 1 commit into
developmentunidoc/unisupply:developmentfrom
feat/pseudo-version-auditunidoc/unisupply:feat/pseudo-version-auditCopy head branch name to clipboard
Open
Pseudo-version audit: per-dependency integrity signal#100unidoc-alip wants to merge 1 commit intodevelopmentunidoc/unisupply:developmentfrom feat/pseudo-version-auditunidoc/unisupply:feat/pseudo-version-auditCopy head branch name to clipboard
unidoc-alip wants to merge 1 commit into
developmentunidoc/unisupply:developmentfrom
feat/pseudo-version-auditunidoc/unisupply:feat/pseudo-version-auditCopy head branch name to clipboard
Conversation
…y signal Flags every resolved dependency pinned to a pseudo-version go.mod version, distinct from the AI-generated-code scanner's zero-tagged-releases-ever heuristic. Fully offline via golang.org/x/mod/module.IsPseudoVersion. * Direct, non-test-only pins score MEDIUM (+4); indirect LOW (+2); confirmed test-only pins render INFO with no score impact * Never drives the project headline into HIGH on its own — per-dependency risk factor only, kept out of the integrity_floor candidate * Surfaced in text/JSON/PDF reports and as a new forbid_pseudo_versions policy rule (enabled in the strict preset), exempting confirmed test-only dependencies
Code CoverageTotal: 75.4% Per-package breakdown (low → high)
Generated for commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA: https://unidoc.atlassian.net/browse/US-1649
Summary
golang.org/x/mod/module.IsPseudoVersion), distinct from the AI-generated-code scanner's zero-tagged-releases-ever heuristicforbid_pseudo_versionspolicy rule (enabled in the strict preset), exempting confirmed test-only dependenciesTest plan
just fmt && go vet ./... && just lint && go test ./...cleanunidoc/garabic,google/go-cmdtest,golang.org/x/telemetryas pseudo-version findings; headline stays sub-HIGH--policy-preset strict)