codeant-ai-for-open-source[bot] commented on code in PR #44439: URL: https://github.com/apache/superset/pull/44439#discussion_r4052312915
########## automation/Dockerfile: ########## @@ -0,0 +1,69 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# Toolbox image for reproducing and validating the Devin automations that run +# against this fork (see automation/README.md). It is NOT the Superset app image +# (that is the top-level Dockerfile); it only bundles the scanners the nightly +# scan uses plus the GitHub CLI, so anyone can run the same checks locally. +# +# docker build -t superset-automation -f automation/Dockerfile . +# docker run --rm -it --user "$(id -u):$(id -g)" -v "$PWD":/workspace -e GH_TOKEN superset-automation +# +# Run with --user so the reports written to automation/out/ are owned by you, +# not root. HOME is pre-created world-writable so gh/npm/pip-audit caches work +# for any uid. +# +ARG PY_VER=3.11-slim-bookworm +FROM python:${PY_VER} + +ARG NODE_MAJOR=24 +ARG RUFF_VERSION=0.9.7 + +ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \ + PIP_NO_CACHE_DIR=1 \ + PYTHONUNBUFFERED=1 \ + HOME=/home/toolbox \ + WORKSPACE=/workspace + +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + bsdextrautils ca-certificates curl git gnupg jq \ + && mkdir -p /etc/apt/keyrings \ + && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \ + | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \ + && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \ + > /etc/apt/sources.list.d/nodesource.list \ + && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \ + -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \ + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \ + > /etc/apt/sources.list.d/github-cli.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends nodejs gh \ + && rm -rf /var/lib/apt/lists/* + +# Same scanners the nightly-scan automation installs. ruff is pinned to the +# version in requirements/development.txt so results match CI. +COPY automation/requirements.txt /tmp/automation-requirements.txt +RUN pip install pip-audit bandit radon "ruff==${RUFF_VERSION}" \ + -r /tmp/automation-requirements.txt Review Comment: **Suggestion:** Installing unpinned `pip-audit`, `bandit`, and `radon` makes future image builds use changing CLI behavior, so the toolbox cannot reliably reproduce the documented scan. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Code quality` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=4883f3bc96c846c497c8a286513b7d0c&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=4883f3bc96c846c497c8a286513b7d0c&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** automation/Dockerfile **Line:** 61:62 **Comment:** *Code Quality: Installing unpinned `pip-audit`, `bandit`, and `radon` makes future image builds use changing CLI behavior, so the toolbox cannot reliably reproduce the documented scan. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=6fc94370dec86f3d1b8cac84cc7f8097c4bd9254ac9a3ebbf31c4a9027c35a83&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=6fc94370dec86f3d1b8cac84cc7f8097c4bd9254ac9a3ebbf31c4a9027c35a83&reaction=dislike'>๐</a> ########## automation/scripts/scan.sh: ########## @@ -0,0 +1,109 @@ +#!/usr/bin/env bash +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Runs the same read-only checks the nightly-scan automation runs, so a +# finding in a `nightly-scan` issue can be reproduced locally. Nothing here +# writes to GitHub or changes the repo. +# +# scan.sh [python-advisories|npm-advisories|outdated-deps|ci-supply-chain|frontend-lint|code-hardening|all] +# +set -uo pipefail + +ROOT="${WORKSPACE:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}" +OUT="${SCAN_OUT:-$ROOT/automation/out}" +mkdir -p "$OUT" +cd "$ROOT" + +section() { printf '\n==== %s ====\n' "$1"; } + +python_advisories() { + section "python-advisories: pip-audit against pinned requirements" + for f in requirements/base.txt requirements/development.txt; do + echo "--- $f" + # --disable-pip audits the exact pins without building any wheel locally + pip-audit --disable-pip --no-deps -r "$f" -f json -o "$OUT/pip-audit-$(basename "$f" .txt).json" \ + || case $? in + 1) ;; # exit 1 means vulnerabilities were found; the summary line above says how many + *) echo "pip-audit could not audit $f (the automation falls back to the OSV batch API)" ;; + esac + done +} + +npm_advisories() { + section "npm-advisories: npm audit per lockfile workspace" + for ws in superset-frontend superset-websocket superset-embedded-sdk; do + [ -f "$ws/package-lock.json" ] || continue + echo "--- $ws" + (cd "$ws" && npm audit --audit-level=moderate --package-lock-only --json \ + > "$OUT/npm-audit-$ws.json"; true) Review Comment: **Suggestion:** If `npm audit` fails because npm or the network is unavailable, `true` hides the failure and the script silently reports no findings from that workspace. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Error handling` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=5eb0dde24efc49879e3accb7974fb23f&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=5eb0dde24efc49879e3accb7974fb23f&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** automation/scripts/scan.sh **Line:** 51:52 **Comment:** *Error Handling: If `npm audit` fails because npm or the network is unavailable, `true` hides the failure and the script silently reports no findings from that workspace. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=afebf2b14473c5e38cac4aea1b42118a8285a63edc2462c0a171831cf4193816&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=afebf2b14473c5e38cac4aea1b42118a8285a63edc2462c0a171831cf4193816&reaction=dislike'>๐</a> ########## automation/scripts/scan.sh: ########## @@ -0,0 +1,109 @@ +#!/usr/bin/env bash +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Runs the same read-only checks the nightly-scan automation runs, so a +# finding in a `nightly-scan` issue can be reproduced locally. Nothing here +# writes to GitHub or changes the repo. +# +# scan.sh [python-advisories|npm-advisories|outdated-deps|ci-supply-chain|frontend-lint|code-hardening|all] +# +set -uo pipefail + +ROOT="${WORKSPACE:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}" +OUT="${SCAN_OUT:-$ROOT/automation/out}" +mkdir -p "$OUT" +cd "$ROOT" + +section() { printf '\n==== %s ====\n' "$1"; } + +python_advisories() { + section "python-advisories: pip-audit against pinned requirements" + for f in requirements/base.txt requirements/development.txt; do + echo "--- $f" + # --disable-pip audits the exact pins without building any wheel locally + pip-audit --disable-pip --no-deps -r "$f" -f json -o "$OUT/pip-audit-$(basename "$f" .txt).json" \ + || case $? in + 1) ;; # exit 1 means vulnerabilities were found; the summary line above says how many + *) echo "pip-audit could not audit $f (the automation falls back to the OSV batch API)" ;; + esac Review Comment: **Suggestion:** When `pip-audit` fails for infrastructure reasons, this only prints a nonexistent fallback message and produces no advisory report, so Python vulnerabilities can be silently missed. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Incomplete implementation` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=56a6991c7fc74c61bcee13a64e08404d&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=56a6991c7fc74c61bcee13a64e08404d&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** automation/scripts/scan.sh **Line:** 38:42 **Comment:** *Incomplete Implementation: When `pip-audit` fails for infrastructure reasons, this only prints a nonexistent fallback message and produces no advisory report, so Python vulnerabilities can be silently missed. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=539d5916a66013119c2651203bcdfa3edd940539fcd7216aadc8d9eea362f050&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=539d5916a66013119c2651203bcdfa3edd940539fcd7216aadc8d9eea362f050&reaction=dislike'>๐</a> ########## automation/scripts/scan.sh: ########## @@ -0,0 +1,109 @@ +#!/usr/bin/env bash +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Runs the same read-only checks the nightly-scan automation runs, so a +# finding in a `nightly-scan` issue can be reproduced locally. Nothing here +# writes to GitHub or changes the repo. +# +# scan.sh [python-advisories|npm-advisories|outdated-deps|ci-supply-chain|frontend-lint|code-hardening|all] +# +set -uo pipefail + +ROOT="${WORKSPACE:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}" +OUT="${SCAN_OUT:-$ROOT/automation/out}" +mkdir -p "$OUT" +cd "$ROOT" + +section() { printf '\n==== %s ====\n' "$1"; } + +python_advisories() { + section "python-advisories: pip-audit against pinned requirements" + for f in requirements/base.txt requirements/development.txt; do + echo "--- $f" + # --disable-pip audits the exact pins without building any wheel locally + pip-audit --disable-pip --no-deps -r "$f" -f json -o "$OUT/pip-audit-$(basename "$f" .txt).json" \ + || case $? in + 1) ;; # exit 1 means vulnerabilities were found; the summary line above says how many + *) echo "pip-audit could not audit $f (the automation falls back to the OSV batch API)" ;; + esac + done +} + +npm_advisories() { + section "npm-advisories: npm audit per lockfile workspace" + for ws in superset-frontend superset-websocket superset-embedded-sdk; do + [ -f "$ws/package-lock.json" ] || continue + echo "--- $ws" + (cd "$ws" && npm audit --audit-level=moderate --package-lock-only --json \ + > "$OUT/npm-audit-$ws.json"; true) + jq -r '.metadata.vulnerabilities // {} | to_entries[] | "\(.key): \(.value)"' \ + "$OUT/npm-audit-$ws.json" 2>/dev/null || true + done +} + +outdated_deps() { + section "outdated-deps: npm outdated in superset-frontend" + (cd superset-frontend && npm outdated --json > "$OUT/npm-outdated.json"; true) + jq -r 'to_entries[] | "\(.key): \(.value.current) -> \(.value.latest)"' \ + "$OUT/npm-outdated.json" 2>/dev/null | head -50 + echo "(Python pins are compared against PyPI by the automation; see requirements/base.in for deliberate caps.)" +} + +ci_supply_chain() { + section "ci-supply-chain: risky patterns in .github/workflows" + grep -rn "pull_request_target" .github/workflows || echo "no pull_request_target" + echo "--- third-party actions not pinned to a commit SHA" + grep -rhoE "uses: [^@]+@[^ ]+" .github/workflows \ + | grep -vE "@[0-9a-f]{40}$" | grep -v "uses: ./" | sort | uniq -c | sort -rn | head -30 + echo "--- unpinned installs" + grep -rnE "(pip|npm) install " .github/workflows | grep -vE "==|@[0-9]" | head -20 +} + +frontend_lint() { + section "frontend-lint: oxlint warnings in production code (needs node_modules)" + if [ ! -d superset-frontend/node_modules ]; then + echo "superset-frontend/node_modules missing; run 'npm ci' there first (slow, ~5 min)" + return + fi + (cd superset-frontend && npx oxlint --config oxlint.json --format json > "$OUT/oxlint.json"; true) Review Comment: **Suggestion:** If `npx oxlint` cannot run or fails to load its configuration, `true` hides the error and the scan continues as though production linting found nothing. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Error handling` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=14b9a1da8bfb438589bee009524d3237&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=14b9a1da8bfb438589bee009524d3237&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** automation/scripts/scan.sh **Line:** 82:82 **Comment:** *Error Handling: If `npx oxlint` cannot run or fails to load its configuration, `true` hides the error and the scan continues as though production linting found nothing. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=1252fbf3717b728129800871b0d7508ffdbd6f08d4920882551a10b9c34bfd2c&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44439&comment_hash=1252fbf3717b728129800871b0d7508ffdbd6f08d4920882551a10b9c34bfd2c&reaction=dislike'>๐</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
