)]}' { "log": [ { "commit": "4de9d5abfbf6701a1a7255d4df8e5bf8ed7ab2a0", "tree": "52c6537561f072045a17c80ee3c8fcbebf36162c", "parents": [ "e72d1b79cba5c57aaba83efc8d4c658041367889" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 16:55:03 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 16:55:03 2026 -0700" }, "message": "Allow directories as positional args\n\nSupport passing directory paths as positional arguments to `shac check`,\n`shac fmt`, and `shac fix`. By default, only SCM-affected files within\nspecified directories are analyzed; `--all` can now be combined with\npositional arguments to analyze all non-ignored files within specified\ndirectories.\n\nWhen a directory argument is passed without `--all` and contains no\naffected files, print a message to stderr suggesting `--all` so that\nrunning `shac check \u003cdir\u003e` on a clean checkout is not a silent no-op.\n\nTAG\u003dagy\nCONV\u003ddf61e84d-3ea4-48d1-b951-5f4026f030fa\n\nFixed: 523334980\nChange-Id: I6858ae365ea7f657314c07a8af45aa5147196042\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1581813\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "e72d1b79cba5c57aaba83efc8d4c658041367889", "tree": "b994524976bffb05a4e4ed0278eb5c45a8c7df00", "parents": [ "63c0571f70f71c533d5ce623fb30a4d8813f24af" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 15:59:43 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 15:59:43 2026 -0700" }, "message": "Update to Go 1.27 and bump shadow and gosec\n\nUpdate shac\u0027s Go version from 1.26 to 1.27.1 across go.mod, scripts, and\nGitHub Actions workflows. Also update shadow (v0.31.0 -\u003e v0.48.0) and\ngosec (v2.22.3 -\u003e v2.29.0) so that they support Go 1.27\u0027s compiler\nexport data format, and exclude gosec\u0027s new G703 rule (path traversal\nvia taint analysis) alongside G304 since shac legitimately reads and\nwrites user-specified file paths.\n\nTAG\u003dagy\nCONV\u003ddf61e84d-3ea4-48d1-b951-5f4026f030fa\n\nChange-Id: Ib8becf24319f59020dfd0b378f0313f3905c001b\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1862780\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nPresubmit-Verified: fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cfuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "63c0571f70f71c533d5ce623fb30a4d8813f24af", "tree": "9e56d205019e94a3eb0c78549d17e61fe6dba1ab", "parents": [ "5be10c7d674cb82a5f88a090f9614750989791ad" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 10:54:45 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 10:54:45 2026 -0700" }, "message": "Let exec mocks omit executable extensions\n\ngo_install() in checks/common.star appends \".exe\" to tool paths on\nWindows, so mocks for those tools never matched there and `shac test`\nfell through to running nonexistent binaries. On Windows, let a mock\u0027s\nfirst element also match the same command with any %PATHEXT% extension\nappended, so the same mock works on every OS.\n\nAn alternative would be to make ctx.os.exec() itself resolve PATHEXT\nextensions for path-like commands, so checks wouldn\u0027t need to append\n\".exe\" at all. That changes real execution behavior for all checks,\nthough, whereas this keeps the change contained to tests.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ia99b3112dfab0a68d86258b323754aeac2f057be\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1862917\nPresubmit-Verified: fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cfuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "5be10c7d674cb82a5f88a090f9614750989791ad", "tree": "9fb7848792b1cb975991701191d7b4944ffa34fc", "parents": [ "81047bd9996f62b9873dbd9f9fc48da15e4b7771" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 09:15:57 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 09:15:57 2026 -0700" }, "message": "Allow test files to load() private symbols\n\nLet `*_test.star` files load `_`-prefixed symbols with load(), e.g.\n`load(\"//checks/foo.star\", \"_foo_check\")`, so tests can exercise a\ncheck\u0027s internal helpers without the check file having to export them.\n\nThe Starlark resolver unconditionally rejects loading private names, so\nshac renames the private names in a test file\u0027s load() statements to a\nmangled form before resolving the file, and adds matching aliases to\nthe globals of modules loaded by test files. Other files never see the\naliases, so they still can\u0027t load private symbols.\n\nAlso use this to validate the docs for the test-only `asserts` and\n`testing` modules in checks/check_doc_test.star via check_doc.star\u0027s\nprivate `_struct_signature` helper.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ibc2e03c6f549ddf5cebce5190cdeb7ec4995db20\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859303\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "81047bd9996f62b9873dbd9f9fc48da15e4b7771", "tree": "cc1d79d01050f8029223efdbad1ec315b02b7594", "parents": [ "0e939a57fd1b30e12b90d37defff99a885fe00f1" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 09:11:30 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 09:11:30 2026 -0700" }, "message": "Fall back from nsjail when /proc is read-only\n\nWhen `shac` runs inside an outer sandbox or container that mounts\n`/proc` read-only (such as Fuchsia\u0027s `testrunner` `nsjail` on Linux\nSwarming bots) or omits `/proc`, `nsjail` cannot write to\n`/proc/\u003cpid\u003e/setgroups` to initialize a nested user namespace. Detect\nthis in `sandbox.New` by checking `/proc/self/setgroups` for `EROFS` or\n`ErrNotExist` and fall back to `genericSandbox`.\n\n- Also guard `/usr/include` and `/usr/share` with `os.Stat` in\n `ctxOsExec` so `nsjail` does not fail when those directories are\n absent in minimal container environments.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ib5f4de1764646b054119b9de2f5ff7c2be9b1534\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1860159\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "0e939a57fd1b30e12b90d37defff99a885fe00f1", "tree": "0ed8152a3ef9e9aa6bda6f3c5294c6a44573c72e", "parents": [ "405e5e5da1478493ae4959e201f79703f005cf58" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 09:07:23 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 09:07:23 2026 -0700" }, "message": "Stop root resolution at shac.textproto\n\nWhen `resolveRoot` is given a directory that directly contains a\n`shac.textproto` file, treat that directory as the project root rather\nthan running `git rev-parse --show-toplevel`. This allows running `shac`\nagainst a staged or Bazel runfiles directory located inside a larger git\ncheckout without escaping to the outer git repository root, and avoids\nan unnecessary `git` subprocess when invoked at the root of a project.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Icde9e7320d997b53b3f96291bd2d4150c61d40b4\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1860158\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "405e5e5da1478493ae4959e201f79703f005cf58", "tree": "cb7a25e61783d0c58b5d440d87f7e428e7137678", "parents": [ "1c8b4577bff2efe3b142929e47596cbcf3b667e7" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 09:02:28 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 09:02:28 2026 -0700" }, "message": "Fix TestRunTests_Subdir on Windows\n\nThe test execs a `#!/bin/sh` script, which Windows can\u0027t run (\"%1 is\nnot a valid Win32 application\"). Write an equivalent batch file on\nWindows instead so the real-exec subdir coverage still runs there.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ic5b4b17f410e5a18456148e8a7828efe7033ad61\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1863155\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "1c8b4577bff2efe3b142929e47596cbcf3b667e7", "tree": "bacb335921fcba32253cc6361f9c13df3973ac9c", "parents": [ "2dfb3527ffd009d782df6cb0f6a91cecdad04aa3" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 08:18:08 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 08:18:08 2026 -0700" }, "message": "Add Starlark tests for built-in checks\n\nAdd `*_test.star` test suites for all of shac\u0027s own Starlark checks in\n`checks/` (`buildifier`, `check_doc`, `go`, `licenses`, and `shac`), and\nrun `shac test` as part of `./scripts/tests.sh`.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ie179bbbd2477e4cc86eace22092f3ce89df2860f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859307\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "2dfb3527ffd009d782df6cb0f6a91cecdad04aa3", "tree": "235b31897dc9d44a898e09d5a25464ffedb73b2b", "parents": [ "52a5aaf0a9755f14ab2f3440b764708027e29984" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 08:13:52 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 08:13:52 2026 -0700" }, "message": "Apply overlapping fixes in testing.run()\n\n`testing.run()` computed `res.files` with a single application of the\nemitted fixes, so when a check emitted several fixes on the same line\n(e.g. two URLs or a pair of smart quotes), only the first was applied.\n`shac fix` handles this by re-running the checks whose findings were\nskipped against the partially-fixed files until nothing is skipped, so\n`res.files` didn\u0027t match what `shac fix` would actually write.\n\nDo the same in `testing.run()`, with the same convergence detection and\npass limit as `shac fix`. Re-runs only affect `res.files`: findings and\nartifacts still come from the first pass, and re-runs\u0027 print() output\nis discarded so it doesn\u0027t show up as duplicates.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: I4a6f01eb744d0633ae37b216c03d770abc1f4f94\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859306\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "52a5aaf0a9755f14ab2f3440b764708027e29984", "tree": "1f5f6bd87222ca1c5bd68e0cd0eff926183889ae", "parents": [ "403d089af10f9e28db24db72a75ec322a247b2f3" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 08:08:27 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 08:08:27 2026 -0700" }, "message": "Give tests access to the real checkout\n\nUnmocked subprocesses run by `testing.run()` could previously only\nsee the test\u0027s virtual files, so checks that invoke repo-local scripts\nor prebuilt tools couldn\u0027t be tested without mocking them. Populate\nthe test root with symlinks to the real checkout, shadowed by the\ntest\u0027s virtual files, and mount the real checkout into the sandbox\nwith the same writability as under `shac check`.\n\nWhen the root isn\u0027t a git checkout (e.g. a Bazel runfiles tree whose\nfiles are symlinks to the source tree), also mount the symlinks\u0027\ntargets so that they resolve inside the sandbox.\n\n- Add a `subdir` parameter to `testing.run()` for testing checks\n registered by nested shac.star files, where `ctx.scm.root` is a\n subdirectory of the checkout.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: I3035441ae9e3ab5d06f95ab37f3a467f00a5fd01\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859305\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "403d089af10f9e28db24db72a75ec322a247b2f3", "tree": "b222d222f6dfe49522e3f77bf56810db4062e8d4", "parents": [ "9d7907fe001f7f1f3ae177154b0373bef14b55b5" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Oct 02 08:04:11 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Oct 02 08:04:11 2026 -0700" }, "message": "Add `testing.exec_mock()` to fake subprocesses\n\nAdd an `exec_mocks` parameter to `testing.run()` that intercepts\nmatching `ctx.os.exec()` calls, so tests can cover checks that wrap\ntools that are slow, nondeterministic, or unavailable in the test\nenvironment. Commands that no mock matches still run for real in the\nsandbox, and a mock that\u0027s never used fails the test.\n\nMocked processes are returned through the same subprocess type as real\nones, so `wait()`, `raise_on_failure`, and `ok_retcodes` behave\nidentically.\n\n- Add `testing.exec_mock()`, which supports static outputs, a\n `testing.any_args` wildcard that matches zero or more arguments,\n and `handler` callbacks.\n- Add `testing.exec_result()` for handlers to return, and\n `testing.write_file()` for handlers that emulate tools that modify\n files.\n- Add `testing.root`, a placeholder that expands to the test\u0027s\n `ctx.scm.root` in mock commands, outputs, and written files.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: I1c14f698aa77c87245a906126900fc6530eaeeef\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859304\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "9d7907fe001f7f1f3ae177154b0373bef14b55b5", "tree": "3270bd130589052f0549a2e32c5c8f26e1f77981", "parents": [ "e7d5ec411ff74df6a492b752bcb52630d592edc2" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 01 14:48:24 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 01 14:48:24 2026 -0700" }, "message": "Add `testing.run()` for running checks in tests\n\nAdd a predeclared `testing` module whose `run()` function executes a\ncheck under test and returns the findings it emitted, the contents of\nthe input files after applying single-replacement fixes, and any\nartifacts it emitted.\n\nChecks run through the engine\u0027s real check-execution path\n(registeredCheck.call, ctx construction, finding validation, and fix\napplication) against a virtualized SCM and a temporary root directory\ncontaining the test\u0027s files, rather than through a test-only\nreimplementation of `ctx`. `testing.run()` accepts a `shac.check`\nobject, a raw check function, or a zero-argument function that\nregisters checks, so tests can exercise the same entry points that\nshac.star files use.\n\n- Add `testing.file()`, `testing.commit()`, and `testing.finding()`\n for constructing inputs and expected outputs.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Icacc0020df0f713757534b11a02c1c729e0e3f27\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859302\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "e7d5ec411ff74df6a492b752bcb52630d592edc2", "tree": "3e733a40e0dc8d167ea068c5b07888f9f22bf9cd", "parents": [ "53debe80789254728487ef5c60dd462225797ab6" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 01 14:43:48 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 01 14:43:48 2026 -0700" }, "message": "Add `asserts` module for `shac test`\n\nAdd a predeclared `asserts` module providing `asserts.eq()`,\n`asserts.ne()`, `asserts.true()`, `asserts.false()`,\n`asserts.contains()`, and `asserts.fails()`. `asserts.eq()` includes a\nunified diff in its failure message when comparing multi-line strings\nor nested values.\n\nThe module is only predeclared in `*_test.star` files run by\n`shac test`, so check code can\u0027t come to depend on it.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ie13f01940067e5681eafbc3314ea97b39598a1cd\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859301\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "53debe80789254728487ef5c60dd462225797ab6", "tree": "ca4321b7c89d81d0f84c710dd257ac144f6c23e6", "parents": [ "5a6411581fedce7eba1c9568f9df59b1ff55f07b" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 01 14:34:25 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 01 14:34:25 2026 -0700" }, "message": "Add `shac test` subcommand\n\nAdd a `shac test` subcommand that discovers `*_test.star` files,\nloads each one, and runs its zero-argument `test_*` functions in\nparallel, reporting a pass/fail result for each test case.\n`--json-output` writes the results as JSON so that wrapper tools can\nupload them to ResultDB.\n\nThis is the first in a series of changes that build out a framework\nfor testing shac checks. Later changes add the `asserts` and `testing`\nmodules that make tests useful.\n\n- Add `ignore_tests` to the shac.textproto schema to exclude files from\n test discovery.\n- Reject direct shac.register_check() calls in test files, since\n checks registered there would never run.\n- Split shacState\u0027s immutable configuration into an embedded\n shacConfig so that test runs can cheaply derive per-test states.\n- Factor shac.textproto loading out of runInner() into loadDocument().\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nBug: 324276429\nChange-Id: Ice444035018760612a33ac8cc19f88023c4b0869\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859296\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "5a6411581fedce7eba1c9568f9df59b1ff55f07b", "tree": "3ab14ee00c0c25092318b08495b556c15edd0301", "parents": [ "e7fcb039bd1ded76366a8e6358273bf260735533" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 01 13:39:24 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 01 13:39:24 2026 -0700" }, "message": "Validate finding spans when applying fixes\n\nExtract `applyReplacements` from `fixFindings` and validate that finding\nline and column spans do not exceed the file\u0027s line count or line\nlengths, returning a descriptive error instead of panicking with an\nout-of-range slice index.\n\nTAG\u003dagy\nCONV\u003d8e57f6e2-70d7-4a49-8868-f7bcd8944611\n\nChange-Id: I5e0b34668951ff8c3eb8ae8371e9d3fc24c6135c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1859300\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "e7fcb039bd1ded76366a8e6358273bf260735533", "tree": "acde427f49783f0c07db12f43e45020a35589ae3", "parents": [ "f1e8d250084c99a163eec9d9dba51db502d6782b" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Sep 21 11:15:20 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Sep 21 11:15:20 2026 -0700" }, "message": "doc: Fix ctx.emit.finding argument formatting\n\nFix the docstring for ctx.emit.finding in doc/stdlib.star by changing\n`properties (optional):` to `properties: (optional)` so that the doc\ngenerator recognizes the `Args:` block as structured arguments and\nrenders them as bullet points under `### Arguments` in doc/stdlib.md.\n\nAlso:\n- Prepend an HTML comment header in internal/engine/docregen_stdlib.go\n when writing doc/stdlib.md without altering `shac doc` CLI output.\n- Fail doc generation in internal/engine/docgen.go if a symbol\u0027s\n `Args:` section falls back to a free-form remark block.\n\nChange-Id: Ia3a70da0acbd34c53e9db265f4f19d1075269490\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1837984\nPresubmit-Verified: fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cfuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "f1e8d250084c99a163eec9d9dba51db502d6782b", "tree": "c37c234fa4071a0c406145f60b3d05d64e9ace9c", "parents": [ "fa47ce9efa3fdebf9ea526075bbc558e3b03d2e8" ], "author": { "name": "Eric Rahm", "email": "erahm@google.com", "time": "Fri Sep 18 16:24:47 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 18 16:24:47 2026 -0700" }, "message": "Add --quiet to `shac check` to hide passing checks\n\n`shac check` prints a `- \u003ccheck\u003e (success in \u003cduration\u003e)` line for every\ncheck that passes. In a project with dozens of checks, a single finding\ngets buried in a wall of success lines, which makes the output hard to\nread when it\u0027s captured by a wrapper (e.g. a git pre-commit hook) and\nrelayed to the user. There was no way to turn this off: `--quiet` was\nonly accepted by `shac fmt` and `shac fix`.\n\nMove the `--quiet` flag into commandBase, as the existing TODO\nsuggested, so all three subcommands accept it, and thread it through to\nreporting.Get(). In quiet mode the basic and interactive reporters omit\nthe completion line for checks that passed (with or without notice-level\nfindings). Findings of every level, the completion lines of checks that\nemitted warnings or errors or that failed to run, and the final\n\"a check failed\" error are still printed, so nothing actionable is\nhidden. The behavior of `shac fmt --quiet` and `shac fix --quiet` is\nunchanged, as is the default output of `shac check`.\n\nTest: go test ./..., with new TestBasic_Quiet and TestInteractive_Quiet\nreporter tests. Manually verified on Fuchsia that `shac check --quiet`\non a misformatted .gn file prints only the finding and the failing\ncheck\u0027s completion line (2 lines instead of 38), in both a TTY and\nwith redirected output.\n\nFixed: 563048921\nChange-Id: Id1e37c83ead921cfecf4c8fe744816db889b61a2\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1833450\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Eric Rahm \u003cerahm@google.com\u003e\nCommit-Queue: Eric Rahm \u003cerahm@google.com\u003e\nPresubmit-Verified: fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cfuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "fa47ce9efa3fdebf9ea526075bbc558e3b03d2e8", "tree": "eda08283a58fae8b45ba6fb2451e5cc46bb3c45f", "parents": [ "c533a7e8e65de475fafd4ca5880515c476629258" ], "author": { "name": "Eric Rahm", "email": "erahm@google.com", "time": "Fri Sep 18 16:23:36 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Sep 18 16:23:36 2026 -0700" }, "message": "Re-run checks to apply overlapping fixes\n\n`shac fmt` and `shac fix` apply at most one replacement per file line\nrange: findings are sorted by start line and any finding that overlaps\nwith an already-applied one is skipped. A whole-file replacement (as\nemitted by formatters like black, gofmt, rustfmt, or json formatters)\ntherefore caused every other finding in that file (e.g. a keep-sorted\nblock) to be silently dropped, and users had to run `shac fmt` twice for\nthe file to converge. There was no indication that anything was left\nunfixed, even without --quiet.\n\nImplement the TODO in fixFindings: count the skipped findings, and when\nthere are any, re-run the checks and apply the newly reported (now\nnon-overlapping) findings. This repeats until nothing is skipped.\n\nFixes that don\u0027t converge are an error rather than something to silently\ngive up on. The input of each re-run pass is fully determined by the\non-disk state and what the pass is narrowed to, so after each pass a\nhash of the digests of every file fixed so far, plus the checks and\nfiles the next pass is narrowed to, is recorded. If that fingerprint\nwas already seen, the next pass would repeat an earlier one and the\nfixes will never converge (a no-op replacement repeats the previous\ninput, oscillating replacements repeat an older one), so Fix() returns\nan error right away. maxFixPasses (5) remains as a safety net for checks\nthat keep changing the file without converging, and hitting it is also\nan error. Either way `shac fmt` exits non-zero and main prints the\nreason. With --emit a re-run would see the unmodified file, so no second\npass is attempted; a warning is printed to stderr even in quiet mode,\nsince silently dropping fixes was the original problem, but it is not an\nerror because it is a limitation of the mode rather than a misbehaving\ncheck.\n\nRe-run passes are narrowed to what still needs fixing. The allowlist is\nalways narrowed to the checks that had findings skipped, since the other\nchecks have nothing left to do; this has no effect on what the checks\nsee. Files are only narrowed to those with skipped findings when the\ncaller already specified files, so that every pass runs in the same\nmode. Switching from git mode to files mode would change what the checks\nsee: affected_files() reports action \u003d\u003d \"\" for specified files, and the\nignore list from shac.textproto is not applied to them. Both options are\nrestored when Fix() returns. On re-run passes, checks with nothing to\nfix are not logged again to avoid repeating the \"(all good!)\" lines for\nevery pass.\n\nAdd fix testdata cases: a whole-file formatter plus a line-range fixer\non the same file that converges in two passes; a check whose fixes\nnever converge, which verifies the pass bound and the resulting error;\na no-op replacement and an oscillating replacement, which verify that\nthe repeated input is detected after two and three passes respectively;\nthree checks whose skipped findings shrink from pass to pass, so that\na pass rewrites the same bytes as the previous one yet still converges,\nwhich verifies that only a repeated input counts as a cycle; a tracer\ncheck that verifies only the check with the skipped finding is re-run;\na check that records the affected files, which verifies files\nare narrowed when specified and left alone otherwise; and overlapping\nfindings in one file plus a non-overlapping finding in another, which\nverifies the latter is fixed in the first pass. The two pre-existing\ncases with overlapping findings are made content-aware so they converge\ninstead of hitting the pass bound. Also verify that Fix() restores\nOptions (including the allowlist) on return, including on error, and\nthat --emit output is unchanged and warns about the skipped finding.\n\nTick the \"Rerun formatting checks after a conflict is encountered\" item\nin the README road map. Add a TODO in fixFindings to break ties between\nfindings that start on the same line deterministically (e.g. by check\nname or registration order): two whole-file findings both sort first,\nso which one is applied in the first pass currently depends on the\norder in which the checks complete.\n\nTest: go test ./..., plus manual `shac fmt` on a Fuchsia python file\nwith both a black violation and an unsorted keep-sorted block, which now\nconverges in a single invocation, with only keep_sorted re-run in the\nsecond pass.\n\nFixed: 563048295\nChange-Id: I21963ab5db26252196c916992f3c28510b384cff\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1833449\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Eric Rahm \u003cerahm@google.com\u003e\nCommit-Queue: Eric Rahm \u003cerahm@google.com\u003e\n" }, { "commit": "c533a7e8e65de475fafd4ca5880515c476629258", "tree": "b003d22d448885d28b10215f8ff93b23112a8f2e", "parents": [ "f88a310bd579dda8e2aaae6062a862079632b446" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Sep 15 09:32:39 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Sep 15 09:32:39 2026 -0700" }, "message": "Suggest `shac fmt --all` when run with --all\n\nWhen a formatter check emits a finding without an explicit message,\nshac\u0027s default message told users to run `shac fmt`. That command only\nfixes the files it considers affected, so it silently did nothing for\nfindings that were only reported because shac was run with `--all`. The\nsuggested command now matches the file scope of the current run.\n\nFixed: 561978876\nChange-Id: Iee8899668d3117ec757a04cdb39ff4151001e644\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1827129\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nPresubmit-Verified: fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cfuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "f88a310bd579dda8e2aaae6062a862079632b446", "tree": "d99baed063b786d6a9125f87a29da16e8ac966f1", "parents": [ "ea13b156b02b502e135db0ee6e895d33c43af709" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Sep 14 10:45:55 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Sep 14 10:45:55 2026 -0700" }, "message": "Update luci-go\n\nFixed: 559053578\nChange-Id: I7cdfa14347a4ac4fb0da1cf7be8de286a19aa486\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1824389\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nPresubmit-Verified: fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cfuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n" }, { "commit": "ea13b156b02b502e135db0ee6e895d33c43af709", "tree": "42e36be2e55222fa845a4fb6fac7a11f81d01de4", "parents": [ "d819bafe9a850440cfc687f5fe7287de990ba21c" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Sep 02 13:40:41 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 13:40:41 2026 -0700" }, "message": "[shac] Address code review comments\n\nThese are changes to address comments on\nd819bafe9a850440cfc687f5fe7287de990ba21c. My AI agent forgot to amend\nand upload these changes before submitting the original CL.\n\nChange-Id: Iebb065f070abb8540124aa5363da0d388e86843e\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1802517\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "d819bafe9a850440cfc687f5fe7287de990ba21c", "tree": "3e4e149b19d011d88bef2e15826a75d745380893", "parents": [ "edc1943910515aa2c620d05881b9f0831ba4a643" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Sep 02 12:37:55 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 12:37:55 2026 -0700" }, "message": "Output check execution exceptions to ResultDB and SARIF\n\nThis will surface exact error messages to infra build summaries when\nchecks crash, rather than a generic \"Checks failed\" error message.\n\nChange-Id: Iff50a1afddc91a91d1142efdb9e5701b0e3900e3\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1799578\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "edc1943910515aa2c620d05881b9f0831ba4a643", "tree": "2eb20039c1bac7e49cf458a2f0ddf9aac37a88f2", "parents": [ "7762ee1e6ff35a3fd62d191c2d0f6731e9420a53" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Sep 02 11:35:46 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Sep 02 11:35:46 2026 -0700" }, "message": "[testing] Use t.Context() instead of context.Background()\n\nReplace context.Background() in all test and benchmark functions with\nt.Context() (or b.Context()) now that Go 1.24+ supports context\nretrieval directly from testing.TB. Also clean up unused context\npackage imports where applicable.\n\nTAG\u003dagy\nCONV\u003d3628b2d7-7807-4554-b805-0b14445ecf5d\n\nChange-Id: Ibf5513b9be3ee01d4ccc0e8bd43b42d7db2d8b4f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1802217\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "7762ee1e6ff35a3fd62d191c2d0f6731e9420a53", "tree": "9fd613d95c19a5a74621a253fa77eab9f016b6cc", "parents": [ "16191e0327960f44e138e93fbf7ecfce1d9f55f8" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Aug 04 06:46:30 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Aug 04 06:46:30 2026 -0700" }, "message": "reporting: avoid 0-length ranges for insertions\n\nGerrit does not predictably handle 0-length comment ranges. When an\ninsertion is mapped to `start_line\u003dX, end_line\u003dX, start_column\u003d0,\nend_column\u003d0` (common due to protobuf omitting 0s on the wire), Gerrit\u0027s\nbackend (`FixCalculator.java`) technically processes this as an intended\ninsertion.\n\nHowever, PolyGerrit (the web UI) handles this zero-length insertion\nunpredictably during its \"Apply Fix\" preview and frontend rendering. It\nmaps the zero-length replacement directly onto the `start_line` node,\nvisually replacing the entire original line X instead of pushing a new\ndiff node above it. In common edit cases like line swaps (insert line A\nbefore line B, delete old line A), this UI artifacting results in line B\nbeing permanently deleted when the fix is applied.\n\nTo avoid this, expand the diffed region to cover the adjacent line so\nthat pure insertions are emitted as explicit replacements spanning the\nentire adjacent line and containing the original content appended to the\ninserted content. This forces Gerrit to evaluate the modification as a\nclean, deterministic block replacement.\n\nThis should fix some diffs that were erroneously deleting lines, e.g.\nhttps://screenshot-v2.corp.google.com/8VecbDd5dNjuCKa\n\nTAG\u003dagy\n\nChange-Id: I7bb842807b2154be3d6a3e0dbd304c970f1741c5\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1740349\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "16191e0327960f44e138e93fbf7ecfce1d9f55f8", "tree": "b1245231e7ba18c82ef0589ae12884aa0f1f8bbc", "parents": [ "8105a752580d897ef6f38f61fcab08f3b4a00cc0" ], "author": { "name": "Aidan Wolter", "email": "awolter@google.com", "time": "Thu Jul 23 13:22:16 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 23 13:22:16 2026 -0700" }, "message": "[sandbox] Fix infinite loop when resolving outside mounts\n\nResolve symlinks for all mounts (including those outside the root) to\navoid nsjail remount errors (MS_RDONLY) when mounting paths containing\nsymlinks (such as prebuilt directories pointing to packages).\n\nThis builds on the previous symlink resolution fix by removing the\nearly exit for outside mounts, and adding a termination check (tracking\nthe previous path) to prevent an infinite loop when traversing parent\ndirectories of mounts outside the workspace root, even when \u0027continue\u0027\nis triggered in the loop body.\n\nAlso simplify the loop by using guard clauses to reduce nesting.\n\nAlso update the OutsideRoot test case to verify outside mounts are\nresolved correctly.\n\nBug: 535584437\nTAG: agy\nCONV: 51aeef66-6f58-49b6-9b14-e3c81576c8de\nChange-Id: Ie2c46524eed5b93bbf9bc6ae851ce82f29cd393f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1717233\nFuchsia-Auto-Submit: Aidan Wolter \u003cawolter@google.com\u003e\nReviewed-by: Charles Celerier \u003cchcl@google.com\u003e\nCommit-Queue: Aidan Wolter \u003cawolter@google.com\u003e\n" }, { "commit": "8105a752580d897ef6f38f61fcab08f3b4a00cc0", "tree": "bd96d0249d1464bd79b24d09928fd6624b9a92b0", "parents": [ "35e6afc786c72169c16575e5fd71cf95d82a1d60" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Jul 16 09:42:56 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 16 09:42:56 2026 -0700" }, "message": "[shac] Fix typo\n\nSuper minor, but this was causing the typo checker in GitHub actions to\nfail.\n\nChange-Id: I764603ee4857719bf69a5fd0f99318ac6706afb9\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1710030\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "35e6afc786c72169c16575e5fd71cf95d82a1d60", "tree": "dbbc8fa50291066a7a0718e7a5c09ed05e81b28f", "parents": [ "1480d546fe4c7af54f889ae5a4e7191fe6e90b05" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Jul 15 16:02:00 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 15 16:02:00 2026 -0700" }, "message": "Add dedicated API for commit message findings\n\nIntroduce `ctx.scm.commits()` to retrieve commit details for all commits\nsince the upstream HEAD, and `ctx.emit.commit_message_finding()` to\nattach findings to commit messages.\n\nI chose to introduce a separate method rather than reusing\n`ctx.emit.finding()` for emitting commit message findings, because the\nlatter option would have required either accepting magical `path`\nargument values to reference commit messages, or adding new parameters\nto the function to support commits.\n\nThis solution also adapts well to the two major potential edge cases of\nthis feature:\n1. There are multiple commits since the upstream HEAD and the user wants\n to validate them all (this is especially likely locally). Having\n `ctx.scm.commits()` return all the commits since the upstream HEAD\n supports this use case, and requiring the relevant commit object to\n be passed into `ctx.emit.commit_message_finding()` makes it unlikely\n that the finding would accidentally be attached to the wrong commit.\n2. We are on the upstream HEAD. In this case, the upstream HEAD commit\n message should not be validated because it has already become an\n immutable part of the repository\u0027s history and cannot be changed.\n\nBy using the repeated `ctx.scm.commits()` value (which will be empty if\nthere are no commits on top of the upstream HEAD) we adapt cleanly to\nboth of these cases.\n\n`ctx.emit.commit_message_finding()` supports all the same arguments as\n`ctx.emit.finding()` for specifying line and column numbers, but it does\nnot support `replacements` for the moment because we probably don\u0027t want\n`shac fix` to auto-amend commits.\n\nChange-Id: Ib987dc2eeac8c7222b42e9c77264336136f40141\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1708730\nReviewed-by: Eric Rahm \u003cerahm@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "1480d546fe4c7af54f889ae5a4e7191fe6e90b05", "tree": "04f3b9dc8f1b17bd0645523685b2f70d8110df91", "parents": [ "654f9187f15f6697fc1785a11e4ce77c2ff1e954" ], "author": { "name": "eakammer", "email": "eakammer@google.com", "time": "Fri Jul 10 11:05:01 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 10 11:05:01 2026 -0700" }, "message": "Ensure tags are unique and within size constraints\n\nWhen shac is run with all, a specific tag has the possibility of being\nrepeated for each pre-existing failure, leading to tags being too large.\nInstead, we will only add a tag if it has not been seen before.\n\nWe check that tags are below the required size and add a message that\ntags were truncated.\n\nBug: b/526044557\nChange-Id: I743ef52fe92d94412d60a6354d654e5c6a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1699554\nCommit-Queue: Liz Kammer \u003ceakammer@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "654f9187f15f6697fc1785a11e4ce77c2ff1e954", "tree": "02676707876835c1dbc0cc46a8da89e376735b74", "parents": [ "bcfcc3f352f40be73715c4308548488c6c588eeb" ], "author": { "name": "eakammer", "email": "eakammer@google.com", "time": "Wed Jul 08 07:34:29 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 08 07:34:29 2026 -0700" }, "message": "Add script to install protoc from cipd and run go generate\n\nChange-Id: I7da4c24ccde9ca127689e9eb83ea6a676a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1696714\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "bcfcc3f352f40be73715c4308548488c6c588eeb", "tree": "783bb4d7aecb1b1f351bbae74e8ba66a0213b7ce", "parents": [ "601ddf4bb3314b04900b7c06dcdfdd09e62d73f2" ], "author": { "name": "eakammer", "email": "eakammer@google.com", "time": "Wed Jul 08 06:22:25 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 08 06:22:25 2026 -0700" }, "message": "Add property bag \"properties\" to results\n\nThis enables emitting a finding that specifies Fuchsia specific static\nanalysis details rather than only generic SARIF details.\n\nInitially, we only support failIfMissingLabel which allows a user to\nspecify a Gerrit label that must have a positive vote to override any\nfindings.\n\nChange-Id: I768aa3a239666953a427ee1f269b4d566a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1685595\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "601ddf4bb3314b04900b7c06dcdfdd09e62d73f2", "tree": "fa8ccf27b87280706e3a8371c93d21be9c3a48bb", "parents": [ "234d74da4fc88c608c97609de31d887bc7f68e07" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Jul 06 14:15:57 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 06 14:15:57 2026 -0700" }, "message": "Update go-git and go-billy dependencies\n\nUpdate github.com/go-git/go-git/v5 to v5.19.1 and\ngithub.com/go-git/go-billy/v5 to v5.9.0 to resolve dependabot\nsecurity alerts. Also updated vendor directory to match.\n\nTAG\u003dagy\nCONV\u003dd58ae30e-3e76-42b2-a742-da13985f92a7\n\nChange-Id: I8f34435744638445f4563a786090eeed1d6de3d3\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1687374\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Liz Kammer \u003ceakammer@google.com\u003e\n" }, { "commit": "234d74da4fc88c608c97609de31d887bc7f68e07", "tree": "b3bd2c73e1f6dff04adf5ca76f17ac3ca754e97b", "parents": [ "97509c1f33dd3e64e8a420b4c8e94384da724b1d" ], "author": { "name": "eakammer", "email": "eakammer@google.com", "time": "Wed Jul 01 12:28:52 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 01 12:28:52 2026 -0700" }, "message": "Refactor some emit finding to use a string builder\n\nThis will enable changes to emit findings to have new parameters more\neasily.\n\nChange-Id: I4ddbbda88a3a85181e212992ab56d5de6a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1685594\nCommit-Queue: Liz Kammer \u003ceakammer@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "97509c1f33dd3e64e8a420b4c8e94384da724b1d", "tree": "8a64fdadcfc3cd88ef31119daba4e2be93d6fa55", "parents": [ "b031014f92949b030bb353847e98a3c77a2f2752" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Jun 30 14:07:28 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jun 30 14:07:28 2026 -0700" }, "message": "[docs] Document glob argument behavior\n\nI\u0027ve seen people doing things like `glob \u003d [\"foo.txt\", \"**/foo.txt\"]`\nwhich is redundant when just `glob \u003d \"foo.txt\"` would accomplish the\nsame thing. Update the documentation accordingly and add tests to\nverify.\n\nChange-Id: I941c57228b2b36cd9b1feadf06e5ea71f1eec69d\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1685794\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "b031014f92949b030bb353847e98a3c77a2f2752", "tree": "c665438f01c582db7b26942f4ac8520b470304c9", "parents": [ "82234204215cb9042386f6281182ce73ce4d9e4c" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Jun 22 15:01:25 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jun 22 15:01:25 2026 -0700" }, "message": "[engine] Support variadic lines arg in writeFile helper\n\nMakes test data slightly easier to declare.\n\nChange-Id: I16460e3ee71181cde1bdd5d79810cbec81dc7dc0\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1672814\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "82234204215cb9042386f6281182ce73ce4d9e4c", "tree": "7877866a1def84e53a4a922bc1bc47031235b86b", "parents": [ "e9114d8dab60946655f0fd7dbbb58acf6e9f00aa" ], "author": { "name": "Aidan Wolter", "email": "awolter@google.com", "time": "Thu Jun 04 09:23:23 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jun 04 09:23:23 2026 -0700" }, "message": "[sandbox] Resolve all symlinks in mounts to fix nsjail remount errors\n\nAlways resolve symlinks for all mounts, not just FUSE or outside mounts.\nThis fixes nsjail remount errors (MS_RDONLY) when mounting paths\ncontaining symlinks (such as prebuilt directories when prebuilt cache\nis enabled).\n\nBug: 516876349\nChange-Id: Icadf9e4edc35620dc60dadef2d4e85e64afb5404\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1629177\nCommit-Queue: Aidan Wolter \u003cawolter@google.com\u003e\nFuchsia-Auto-Submit: Aidan Wolter \u003cawolter@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "e9114d8dab60946655f0fd7dbbb58acf6e9f00aa", "tree": "93fbadbca50830d1bb94e35b68808dc3ec064dd6", "parents": [ "452157ac7c265a4481c4f269b73ea348447695b2" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue May 05 13:05:00 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 13:05:00 2026 -0700" }, "message": "Use errors.AsType instead of errors.As\n\nThe new generic `errors.AsType` is more ergonomic and concise to use.\n\nChange-Id: If430c83ae9ddd92db6c7b020fe0dfe871ad8fa3d\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1599809\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "452157ac7c265a4481c4f269b73ea348447695b2", "tree": "3d878a7089b5e9138f3c44296d70273fb7637178", "parents": [ "acc21917ebf554719f64a70e1d9cf5b3a4197393" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue May 05 13:00:55 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 05 13:00:55 2026 -0700" }, "message": "Suppress errors when shac is interrupted by Ctrl-C\n\nWhen shac is interrupted by Ctrl-C it sends SIGINT to any running\nsubprocesses, causing them to exit with `exec.ExitError`s which get\nprinted to stderr, since shac only supresses context errors when\nprinting errors.\n\nModify execsupport.Run to take a context and return ctx.Err() if the\ncontext was canceled and the command failed. This causes shac to return\ncontext.Canceled, which main.go suppresses when running in a terminal.\n\nChange-Id: I9875cbff4f3ed6317c1c86326b4e29d82560c755\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1599808\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "acc21917ebf554719f64a70e1d9cf5b3a4197393", "tree": "44bcdc025b365fa85d6fdc103bcec082b50e63c3", "parents": [ "1dcbbe9d460addba12da014a4ed364940d1bb82e" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Apr 17 14:27:35 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Apr 17 14:27:35 2026 -0700" }, "message": "[engine] Freeze file metadata to fix data race\n\nThe recent update to go.starlark.net in commit\n1dcbbe9d460addba12da014a4ed364940d1bb82e exposed a data race in shac.\nThe new version of Starlark added a `frozen` field to `Struct` and\nmutates it in `Freeze()`.\n\nshac shares `fileImpl` instances across concurrent checks. When a check\ncalls a builtin like `ctx.scm.affected_files()`, it returns a\ndictionary containing these shared file metadata structs. The\n`builtinWrapper` function that wraps all the shac built-in functions\nthen calls `Freeze()` on the dictionary, which recursively freezes all\nits elements. This resulted in concurrent calls to `Freeze()` on the\nsame shared metadata struct, causing a data race.\n\nFix this by freezing the metadata struct immediately after creation\nwhile holding the lock, making it immutable before it can be shared.\n`Freeze()` is idempotent so it\u0027s safe to call multiple times, just not\nconcurrently.\n\nAlso enable race detection in `scripts/tests.sh` on platforms that\nsupport CGO (which is required for race detection) so we can catch these\ntypes of issues before they land.\n\nChange-Id: I6676610a13f763c56709286ca7ff8c80d3fd03d3\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1579273\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "1dcbbe9d460addba12da014a4ed364940d1bb82e", "tree": "af9d23c0dd6704559f3da294a358eecbdfffd8be", "parents": [ "7166088451d840cf260f03ad4fd595c4b7620766" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Apr 16 14:31:18 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Apr 16 14:31:18 2026 -0700" }, "message": "[go] Update luci-go\n\nJust one small change required to accommodate a new argument to the\nstarlark `ast.ParseModule()` function.\n\nChange-Id: If5006a708f573bbd5c09b1419ce313d5e30a19ef\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1578293\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "7166088451d840cf260f03ad4fd595c4b7620766", "tree": "6b734665b7695fde80b210889decb862dc552aae", "parents": [ "8e1138076e8b1aa1bfddf47477e24c1109b3d56e" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Apr 14 10:30:07 2026 -0700" }, "committer": { "name": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 14 10:30:07 2026 -0700" }, "message": "[engine] Always cache scm calls\n\nPreviously `shac check \u003cfile\u003e` was very slow when running in a large\nrepository against a file with many findings. The SCM caching layer\ndidn\u0027t apply when running against a single file, so the `scm.allFiles()`\nmethod got called every time the user code called `ctx.emit.finding()`,\nresulting in very slow calls (~1 second per `ctx.emit.finding()` call in\nfuchsia.git).\n\nThis change improves the situation by unconditionally caching SCM\nresults. The very first `ctx.emit.finding()` call will still be slow\nsince it needs to populate the cache, but every subsequent call will be\nmuch faster.\n\nChange-Id: I632b1eebcd0a80212270659913c8cceb9732fea9\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1573856\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "8e1138076e8b1aa1bfddf47477e24c1109b3d56e", "tree": "ce6097dc4dcd4940054bb16fc59ff1b474074895", "parents": [ "d95f9d16b04e11f20ac278164d5aab620da85fec" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Apr 08 13:54:13 2026 -0700" }, "committer": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Apr 08 13:54:13 2026 -0700" }, "message": "[engine] Make symlink handling configurable in affected_files \u0026 all_files\n\nAdd an `include_symlinks` parameter to `ctx.scm.affected_files()` and\n`ctx.scm.all_files()`, defaulting to `False`. This gives users explicit\ncontrol over whether to include symlinks to files. The vast majority of\nthe time users probably don\u0027t want to analyze symlinks since the symlink\ntarget will already be analyzed, but there are possible exceptions.\n\nRegardless of this setting, symlinks pointing to directories are still\nstrictly excluded to prevent downstream crashes from tools expecting\nonly regular files.\n\nChange-Id: I775f630938fa83a96ed666db271a41325b39ca76\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1568873\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "d95f9d16b04e11f20ac278164d5aab620da85fec", "tree": "a8ead2301aa1b7ee83838a7eb26b45bdd64bf716", "parents": [ "2832cc0b82890f5fd5f066e9b8a06b9c4c41eaf5" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Apr 08 13:14:28 2026 -0700" }, "committer": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Apr 08 13:14:28 2026 -0700" }, "message": "[shac] Add GEMINI.md\n\nChange-Id: I0f916e2d594f00caf3c71f97fcce2841ef336ece\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1569173\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "2832cc0b82890f5fd5f066e9b8a06b9c4c41eaf5", "tree": "da2548af7fc4f7de9fd5467c80dc71805c5399ba", "parents": [ "828d606f114e63b9d1243368a3316cb22bd4d3c5" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Apr 07 12:37:07 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 07 12:37:07 2026 -0700" }, "message": "[engine] Optimize git submodule checks to avoid syscalls\n\nUpdate affectedFilesImpl to use git diff --raw instead of\n--name-status to retrieve file modes, allowing submodule detection\n(mode 160000) without os.Stat syscalls.\n\nUpdate allFiles to use git ls-files -s to retrieve file modes for\ntracked files, also avoiding os.Stat for them.\n\nChange-Id: Ifcf059710416ba3c87b18d5ae58f2243e2a019b6\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1567473\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "828d606f114e63b9d1243368a3316cb22bd4d3c5", "tree": "b541c04cb803f71a0b40ad132d84c1d963473f39", "parents": [ "bbca022a5cf75eb4d68f8789f7b57c077c556568" ], "author": { "name": "Jiaming Li", "email": "lijiaming@google.com", "time": "Tue Apr 07 12:14:55 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 07 12:14:55 2026 -0700" }, "message": "[cog] Resolve symbolic links before calculating relative paths.\n\nThis ensures that the relative path is calculated against the real file system path, preventing issues when the input file is a symbolic link.\n\nBug: 499411286\nChange-Id: Ib4a474d25d7692ab93577f72800e527079c40025\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1567013\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Jiaming Li \u003clijiaming@google.com\u003e\nCommit-Queue: Jiaming Li \u003clijiaming@google.com\u003e\n" }, { "commit": "bbca022a5cf75eb4d68f8789f7b57c077c556568", "tree": "31370ecef65cfe02cdc9c0f678db1e31e7025d6b", "parents": [ "f5a2c8ee3702a40ec88047233343a5255505ab7d" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Apr 06 16:06:42 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 06 16:06:42 2026 -0700" }, "message": "[engine] Add glob support to ctx.scm functions\n\nAdd a \u0027glob\u0027 argument to ctx.scm.all_files() and\nctx.scm.affected_files() using gitignore glob syntax for more convenient\nfiltering of files.\n\nI also considered using regexes (by comparison, pre-commit uses regexes\nfor selecting which files to check) but decided on globs because they\u0027re\nmore user-friendly, albeit less powerful. Since shac checks use\nimperative Starlark (whereas pre-commit uses declarative JSON) it\u0027s easy\nto fall back to using Starlark filtering for trickier use cases that\naren\u0027t satisfied by globs.\n\nChange-Id: I63ab1a3e56cfcdf10ad3d70f19dcd42f908ac5fd\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1566815\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "f5a2c8ee3702a40ec88047233343a5255505ab7d", "tree": "e0eb45aea6349836e293f564c5df08d727bfc2a7", "parents": [ "dfc5c35d5c129b008d4fda55344f8237117c83bc" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Apr 06 15:07:04 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 06 15:07:04 2026 -0700" }, "message": "[go] Update to go 1.26\n\n- Fixed a couple errors that came from passing non-constant format\n strings to `fmt.Errorf` and `fmt.Sprintf`\n- Ran `go fix ./...` to modernize code, in this case replacing\n `strings.Split` with `strings.SplitSeq` when the indices are not\n needed.\n- Updated an error message check in a test for an error whose wording\n changed on Windows.\n\nChange-Id: Ib3dd1ea8e901b0b062cbadf0302aed4e9c0ee363\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1566773\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\n" }, { "commit": "dfc5c35d5c129b008d4fda55344f8237117c83bc", "tree": "52df6d31dc768360b937d0e7c76279b46ac5798e", "parents": [ "440d19fb4fb47ca4c74b94069164acc6af21e08d" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Apr 06 14:01:08 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 06 14:01:08 2026 -0700" }, "message": "Update deps\n\nGitHub\u0027s Dependabot was reporting some vulnerabilities in our versions\nof gRPC and go-git. I don\u0027t think shac was actually affected by them but\ncan\u0027t hurt to update to newer versions.\n\nChange-Id: I7e54482df12b9982e5dd75082a77eb3be38eb77d\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1566814\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "440d19fb4fb47ca4c74b94069164acc6af21e08d", "tree": "7331391f8717092face47d15629a9ed8b455591b", "parents": [ "8e3416572f5e7cb762445f6dc3abc8993369fee6" ], "author": { "name": "Aidan Wolter", "email": "awolter@google.com", "time": "Mon Apr 06 13:54:21 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Apr 06 13:54:21 2026 -0700" }, "message": "[shac] Support git worktrees and external symlinks in sandbox\n\nTo support running shac in git worktrees, several adjustments were\nnecessary to handle symlinks pointing outside the worktree root and to\nensure SCM operations return correct results.\n\n1. Sandbox Symlink Resolution:\n In `fuse_unix.go`, we now detect if a symlink points outside the\n root directory. If it does, or if it\u0027s a FUSE filesystem, we mount\n the real path. This is crucial for worktrees where the `.git` file\n or other shared resources may point outside the worktree root.\n Without this, sandboxed tools would fail to access these files.\n\n2. SCM `allFiles` Delegation:\n In `runtime_ctx_scm.go`, `specifiedFilesOnly` now delegates\n `allFiles` to the base SCM instead of returning just the specified\n files. This ensures that even when running shac on specific files,\n checks that rely on `ctx.scm.all_files()` can still see the full\n repository context, which is often required for discovery or global\n checks.\n\n3. Sandbox Mounts:\n Added `/usr/share` to the default sandbox mounts in\n `runtime_ctx_os.go` to ensure tools can access shared system data.\n\nTest: Added `NotFuseSymlinkOutside` test in `fuse_unix_test.go`.\n Updated `TestRun_SpecificFiles` in `run_test.go`.\n Ran `go test ./...` and all tests passed.\nChange-Id: I2ee69b5be3bafd3429a70954786d382518dad270\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1566154\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Aidan Wolter \u003cawolter@google.com\u003e\nCommit-Queue: Aidan Wolter \u003cawolter@google.com\u003e\n" }, { "commit": "8e3416572f5e7cb762445f6dc3abc8993369fee6", "tree": "9de24980b68f68d80a7479931ccf334058e3e480", "parents": [ "0fdb11faebb6cf1cf2cf696c746d160dbe8a956b" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Mar 23 13:15:30 2026 -0700" }, "committer": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Mar 23 13:15:30 2026 -0700" }, "message": "[tests] Fix github pipelines\n\n- The macOS tests were failing due to `t.TempDir()` returning a path\n within a symlinked directory. The symlink was being resolved by the\n code under test but not by the test itself, causing failing\n assertions.\n- The Linux tests were failing with permissions errors from nsjail.\n Gemini suggested enabling unprivileged user namespaces in the github\n workflow, which seems to fix the issue.\n\nChange-Id: I7f631f4df8cc516d6061dcbfc882d54713eb055d\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1550880\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "0fdb11faebb6cf1cf2cf696c746d160dbe8a956b", "tree": "f9981511643c2bf4d49933da7ff15e774c05b166", "parents": [ "1bd41f71d977b37fa4cc05570bded8d589104a65" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Mar 19 06:43:22 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Mar 19 06:43:22 2026 -0700" }, "message": "[engine] Fix check existence validation across multiple shac.star files\n\nPreviously, the `--only` and `--exclude` check validation was performed\nindividually for each parsed `shac.star` file. This caused commands like\n`shac check --only buildifier` to fail with a \"check does not exist\"\nerror if the repository contained any nested `shac.star` file that\ndidn\u0027t also define that specific check.\n\nThis commit separates the Starlark parsing phase and the check execution\nphase. Check filtering validation is now deferred until all `shac.star`\nfiles have been loaded. The allowlist and denylist are validated against\nthe global pool of discovered checks across the entire codebase.\n\nI also added:\n- A test to verify the fix.\n- A benchmark that loads a shac.star file with 1,000 checks to ensure\n that separating the parsing and check execution phases doesn\u0027t\n materially impact shac\u0027s runtime (it doesn\u0027t).\n\nChange-Id: Ie2dce6f69a47bd33b11adeed68a48c08ee5ae17c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1545121\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Carver Forbes \u003ccarverforbes@google.com\u003e\n" }, { "commit": "1bd41f71d977b37fa4cc05570bded8d589104a65", "tree": "b555133cc31573dd426dcc2d317e031297171c88", "parents": [ "e70a7440b3c646308ca115406ae33c5ce922afe7" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Mar 19 06:41:28 2026 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Mar 19 06:41:28 2026 -0700" }, "message": "[engine] Ensure standard binary directories are mounted in sandbox\n\nShac\u0027s sandboxing tests had been broken in infra since the Debian 12\nrollout. This is because Debian 12 includes a merged `/usr` layout, with\n`/bin` and `/sbin` as symlinks pointing to `/usr/bin` and `/usr/sbin`.\nAnd `$PATH` on infra machines only includes `/usr/bin` while omitting\n`/bin` entirely.\n\nPreviously, Shac\u0027s nsjail sandbox configuration only bind-mounted the\ndirectories that were explicitly listed in the host\u0027s `$PATH`. Because\nof this, if `/bin` was missing from `$PATH`, the sandbox wouldn\u0027t create\na `/bin` directory or the symlink. This caused any shell scripts using a\nstandard `#!/bin/sh` shebang to fail with an `execve` \"No such file or\ndirectory\" error.\n\nThis commit updates the sandbox configuration to explicitly mount\n`/bin`, `/usr/bin`, `/sbin`, and `/usr/sbin` if they exist on the host\nsystem. This ensures that standard shebangs and basic utilities are\nalways resolvable, regardless of how the CI environment configures\n`$PATH`.\n\nChange-Id: Id79edbc70e801dbd547c0d735c9a1feb2ca9e53e\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1545660\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Carver Forbes \u003ccarverforbes@google.com\u003e\n" }, { "commit": "e70a7440b3c646308ca115406ae33c5ce922afe7", "tree": "4c65ecc4403ed31b7f536a979a2be5c635d39525", "parents": [ "ef3b0318ff010952fc7ec0b8fe310de6eb0369f3" ], "author": { "name": "Colin Nelson", "email": "colnnelson@google.com", "time": "Thu Feb 05 14:44:01 2026 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Feb 05 14:44:01 2026 -0800" }, "message": "fix: emit file if no changes\n\nWhen running `Fix`, if there is a single file, and we are instructed to emit,\nAND there are no findings (aka the file is \"just fine\"), write the file out to\nstdout.\n\nFixes a case in some tools where when the file is \"correct\", they clear\nthe contents of the file as `shac` writes nothing to stdout.\n\nChange-Id: Ifaf7a90c525a69a79b1eba8eab8f690e6a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1495327\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Colin Nelson \u003ccolnnelson@google.com\u003e\nCommit-Queue: Colin Nelson \u003ccolnnelson@google.com\u003e\n" }, { "commit": "ef3b0318ff010952fc7ec0b8fe310de6eb0369f3", "tree": "ce10584104f49eb4a05b2de83f54ac8d9c6a9d0b", "parents": [ "14b338085fb79f8c8cbfb397cb0c71932a3f285a" ], "author": { "name": "Colin Nelson", "email": "colnnelson@google.com", "time": "Wed Jan 28 14:46:44 2026 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jan 28 14:46:44 2026 -0800" }, "message": "[fix] support file input on stdin\n\nFor tools like `jj` to work with their internal formatters (e.g. `jj fix`),\nthe contract is that the formatter takes input of the file on stdin and\noutputs it on stdout.\n\nChange-Id: Iab8d7ccd140ca51e1c26413ae8057e6e6a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1486739\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Colin Nelson \u003ccolnnelson@google.com\u003e\n" }, { "commit": "14b338085fb79f8c8cbfb397cb0c71932a3f285a", "tree": "e5ce970eaf18d7e614b90442d226954f1be4b6b6", "parents": [ "dbb1f8727cc13ef01c2607d7bcbc4d52c142f61b" ], "author": { "name": "Colin Nelson", "email": "colnnelson@google.com", "time": "Mon Jan 26 15:31:20 2026 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jan 26 15:31:20 2026 -0800" }, "message": "[fix]: add option to output to stdout\n\nAdds new CLI flag `--emit` to `fix` which emits the file diffs to stdout\nas opposed to writing the files.\n\nBug: b/478922736\nFixed: b/478922736\nChange-Id: Ifd3fa361a790e46c9b1dd6b0c9d6ac836a6a6964\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1485280\nFuchsia-Auto-Submit: Colin Nelson \u003ccolnnelson@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Colin Nelson \u003ccolnnelson@google.com\u003e\n" }, { "commit": "dbb1f8727cc13ef01c2607d7bcbc4d52c142f61b", "tree": "66d8d08611a78241622655efc7129229ff983179", "parents": [ "0661e13549326be026a124ede89f3437791ece26" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Jan 06 16:16:14 2026 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jan 06 16:16:14 2026 -0800" }, "message": "Remove `x :\u003d x` instances\n\n... and apply some other modernizations, by running:\n\n go run golang.org/x/tools/go/analysis/passes/modernize/cmd/modernize@latest -fix ./...\n\nChange-Id: I7a303239301cd758f2412c09cb44285f21a7a02c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1468348\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "0661e13549326be026a124ede89f3437791ece26", "tree": "8a0e512c64a3a67b66891a9633b9c3b9eabb04b0", "parents": [ "12f4bbe1d428fdf7a36dabd88a0b8131dafef490" ], "author": { "name": "Chase Latta", "email": "chaselatta@google.com", "time": "Tue Jan 06 13:28:36 2026 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jan 06 13:28:36 2026 -0800" }, "message": "Update Mounts to work correctly in FUSE\n\nWhen running shac from within a FUSE filesystem, symlinks pointing\noutside the FUSE root (like tool prebuilts) are often broken inside the\nsandbox because the target real paths are not mounted by default. Additionally, binding\nFUSE paths directly can fail with \"Invalid argument\" if the filesystem\ndoesn\u0027t support certain mount flags (e.g. MS_RDONLY).\n\nThis change implements `resolveFuseMounts` to handle these FUSE scenarios by:\n\n1. **Resolving Recursive Symlinks**: Walking up the directory tree of\n each mount (and the command executable) to find and resolve parent\n symlinks. This ensures that tools relying on sibling directories (e.g.,\n Python needing `../lib` relative to `.../bin/python`) work correctly\n by reconstructing the necessary directory structure inside the sandbox.\n\n2. **Mounting Real Paths**: Instead of binding the FUSE path\n directly, it resolves paths to their underlying physical locations and mounts both:\n * `Real -\u003e Real`: To ensure internal validity of symlinks (target exists).\n * `Real -\u003e Virtual`: To overlay the FUSE path with real content, satisfying\n the user\u0027s request while bypassing FUSE bind-mount limitations.\n\n3. **Including Command Executable**: Explicitly scanning the command executable\n path for external symlinks, ensuring required binaries and their\n dependencies are mounted even if they weren\u0027t explicitly requested in\n the config.\n\n4. **Enforcing Sorting by Destination**: Updating the mount sorting logic to\n sort by *Destination* path. This is critical for the overlay strategy,\n ensuring that parent directories (e.g., the workspace root) are mounted\n before their specific subdirectory overlays.\n\nThis resolves errors like:\n- `remountPt(): ... Invalid argument` (FUSE bind failure)\n- `statvfs(...): No such file or directory` (Mounting over broken symlinks)\n- `ModuleNotFoundError` (Python missing libraries due to missing sibling mounts)\n\nBug: 460750712\nChange-Id: I2f44461b8b3e7d4d3b0f7404024d21d31d60d8f7\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1460776\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Chase Latta \u003cchaselatta@google.com\u003e\n" }, { "commit": "12f4bbe1d428fdf7a36dabd88a0b8131dafef490", "tree": "c06a71ee9ea0b1b0a42fbae486305bcbf2a8c9e1", "parents": [ "ad84ec8dd63868e1d210eca3f527f282404c4b6d" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Aug 28 15:31:40 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 28 15:31:40 2025 -0700" }, "message": "[shac] Log full command before running\n\n... when the verbose `-v` flag is set. This will help debug nsjail\nissues since it will print the full nsjail command line.\n\nChange-Id: I8bc557c28c833821c2a985334cc9551c2a3c9c5f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1356847\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "ad84ec8dd63868e1d210eca3f527f282404c4b6d", "tree": "348b9fd864a4e789b83970c451ffbcffe188aa2e", "parents": [ "253a8655f7705723355be629dd058c0ab51bf3fe" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Jul 07 12:33:42 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 07 12:33:42 2025 -0700" }, "message": "[shac] Allow col\u003d\u003dend_col for findings\n\nIf a finding happens due to some missing text that needs to be inserted\nto fix it (but doesn\u0027t require deleting any existing characters) then\nthe finding will have col\u003d\u003dend_col. This is perfectly valid and should\nbe allowed.\n\nChange-Id: I79fec4e589f30cbf4fcec1640a2c6b114de61c75\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1316185\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "253a8655f7705723355be629dd058c0ab51bf3fe", "tree": "48efa93537a4d7ac5cb7f5a025654c2171f6d97d", "parents": [ "28c0266d9df7334844a162e48cb6f96a97b35f6e" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Jul 07 11:59:24 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 07 11:59:24 2025 -0700" }, "message": "[shac] Update golang.org/x/net\n\nFixes a couple moderate security issues reported by GitHub\u0027s dependabot.\n\nSteps:\n1. `go get -u golang.org/x/net`\n2. `go mod vendor`\n3. `go mod tidy`\n\nChange-Id: I594e643fdf3055c214b5b79dc1d717d72b30ce89\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1316184\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "28c0266d9df7334844a162e48cb6f96a97b35f6e", "tree": "3f4594558bcf29bcd5aeef82b10df384d160b4cc", "parents": [ "06d3fb33656f89bdf30c8447b1b02865b7c50981" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon May 12 11:28:15 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon May 12 11:28:15 2025 -0700" }, "message": "[shac] Add --skip flag to check\n\nThis will be useful for things like skipping especially slow checks when\nrunning pre-commit git hooks.\n\nBug: 416713101\nChange-Id: I647341de0a2adf1d6703156ec56c401e2263600c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1272844\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "06d3fb33656f89bdf30c8447b1b02865b7c50981", "tree": "a3ffa8a2767dd4b4774e6806068529208d848a8d", "parents": [ "295efabaf6bcf922f02a42d00d51c5d0dfb64607" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Apr 15 12:40:00 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 15 12:40:00 2025 -0700" }, "message": "[engine] Use result of slices.Compact\n\nslices.Compact returns a value instead of mutating the input, so the old\ncode was not actually removing duplicates.\n\nThis only mattered when files were based as positional arguments to\n`shac check`, which is not super common, and even less common that\nsomeone would list the same file twice, hence why we didn\u0027t notice it\nuntil it started being raised by the \"lint\" GitHub workflow.\n\nI also updated the `govet` shac check to include the analyzer that was\ncatching this in the GitHub workflow.\n\nChange-Id: I4a0eb6014d9d9dc1edc225ea60bf76d1fcc3f950\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1252105\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "295efabaf6bcf922f02a42d00d51c5d0dfb64607", "tree": "ef8cc5afe4ad3680189f82de8c51aadcaece6716", "parents": [ "73b01ea24fcb006f1b0a9911c4fc445418b29eeb" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Apr 15 12:35:03 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 15 12:35:03 2025 -0700" }, "message": "[go] Update go version in github workflows\n\n... to correspond to what\u0027s declared in go.mod. Also add Gerrit\nif-this-then-that blocks to reduce the likelihood of these versions\ngetting out of sync again.\n\nChange-Id: Ied3f995b4f4d2640ea1d5fe513082162481ae501\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1252104\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "73b01ea24fcb006f1b0a9911c4fc445418b29eeb", "tree": "01beb550f88282e961a455f8723a8da003e2871c", "parents": [ "4e34b9f9fb6cd2f108d94046add0afb0a6c4a812" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Apr 09 11:39:11 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Apr 09 11:39:11 2025 -0700" }, "message": "[reporting] Use lower-level difflib output\n\nUse the lower-level `GetGroupedOpCodes()` difflib function, which\nreturns a list of structs representing the diff output, instead of\nusing `GetUnifiedDiffString()` which returns a human-readable output\nthat then needs to be parsed into the Sarif format.\n\nThis greatly simplifies the conversion code and also fixes a bug caused\nby the string parsing logic: if the old code didn\u0027t have a trailing\nnewline on the last line, and the new code added one, the diff would\nsquash the + and - lines into one because of the lack of a newline\n(basically conflating newlines in source versus newlines to separate the\ndiff lines).\n\nBug: 408229390\nChange-Id: Id6277274ccb089bb32cce620cc65c43f8997c599\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1248984\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "4e34b9f9fb6cd2f108d94046add0afb0a6c4a812", "tree": "bfc7a4a8765dbdf156d70acb4f7890cd7d1d39cd", "parents": [ "a192667c60311c8c2a4e4de8542bdc0c264cb250" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Apr 08 19:31:28 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Apr 08 19:31:28 2025 -0700" }, "message": "[reporting] Split full-file diffs for readability\n\nIt\u0027s common for findings from code formatters to have suggested\nreplacements that cover the entire file. However, the resulting diff as\nshown in Gerrit is not very readable because it shows the entire file\ncontents twice even when only a small number of lines would change.\n\nNow we use a diffing library to split full-file diffs into small chunks,\nso we don\u0027t show large unchanged parts of the file in Gerrit.\n\nThis is especially important now that we\u0027re migrating from Gerrit robot\ncomments to Gerrit findings for showing these results. Gerrit findings\npresent the suggested diff much more prominently than did robot\ncomments, so it\u0027s more important that the diff not be huge and\nunhelpful.\n\nBug: 408229390\nChange-Id: I39eb10348c8b9d466e1eebe8e1d688a26b2cae24\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1245364\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "a192667c60311c8c2a4e4de8542bdc0c264cb250", "tree": "e458e01c28f9895f2647e8b647c082478c58a0b2", "parents": [ "bf297ac0d953130343d4be68ddec06ac3b1897c2" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri Apr 04 11:41:51 2025 -0700" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Apr 04 11:41:51 2025 -0700" }, "message": "[checks] Fix gosec and shadow\n\nChange-Id: Id4215c6470f820df9533ee7efd570959230a102c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1245384\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "bf297ac0d953130343d4be68ddec06ac3b1897c2", "tree": "fa727259c1b60f254a26e95f1405c49edaf7adfd", "parents": [ "f304272c4bfcac068054fec859415f7bc1d158ae" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Jan 07 11:11:53 2025 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jan 07 11:11:53 2025 -0800" }, "message": "Update go to 1.23.4\n\nChange-Id: I4a660623799dc3bb172f05a0bd5d60e4ff1c8154\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1183852\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "f304272c4bfcac068054fec859415f7bc1d158ae", "tree": "6a39e3f0617611798ea896283a9cbeede35423d5", "parents": [ "1952693c35413e08784683e50557ba0654476ecc" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Jan 07 11:09:33 2025 -0800" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jan 07 11:09:33 2025 -0800" }, "message": "[go.mod] Update go-git\n\nBy running:\n\n1. go get -u github.com/go-git/go-git/v5\n2. go mod tidy\n3. go mod vendor\n\nFixed: 388112436\nChange-Id: I7d2f4da6a4d76644244b0b8c926d0cfb27ffcdc6\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1183374\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "1952693c35413e08784683e50557ba0654476ecc", "tree": "6dcc0576ac6bff293701ded0464f85b123c26909", "parents": [ "3b5f780911445d7371d8df77176d2a0e72affb79" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Aug 01 22:15:32 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Aug 01 22:15:32 2024 +0000" }, "message": "[scm] Use correct action when returning all files\n\nPreviously, every file returned by `ctx.scm.all_files()` or (when the\n`--all` flag was set) `ctx.scm.affected_files()` would have a \"A\" in its\naction field, falsely implying that all files were newly added, and thus\nmaking it impossible for checks to accurately determine whether a file\nwas new or not.\n\nNow files will have the correct action value even when all files are\nreturned.\n\nTo test, I ran a locally compiled version of shac with this change\nthrough the static-checks builder in led and confirmed that a check that\nonly checks files with action\u003d\"A\" no longer reports any findings:\nhttps://ci.chromium.org/ui/p/fuchsia/builders/try.shadow/static-checks/b8740770129818037905/test-results?q\u003dExactID%3Ashac%2Funderscore_vs_dash+VHash%3Ae3b0c44298fc1c14\n\nChange-Id: I4dfd50386d6de9659eb9f8d91647fb22ce7a6c84\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1092836\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "3b5f780911445d7371d8df77176d2a0e72affb79", "tree": "8ce501c4c1ead9d4d72d41adf4ebb12315a57bb5", "parents": [ "a9d602b39816adfb217fcbf36a3424e73ca297af" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri May 31 20:19:29 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 31 20:19:29 2024 +0000" }, "message": "Update go-git to v5\n\nGenerated by adding \"/v5\" to the import paths and then running:\n\n $ go get -t ./...\n $ go mod tidy\n $ go mod vendor\n\nChange-Id: I41ce6e7fac0a104c5a1bea1c3965019c5b74f134\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1057575\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Danielle Kay \u003cdanikay@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "a9d602b39816adfb217fcbf36a3424e73ca297af", "tree": "83598bab7ea33ae23d203304c4a8380116101f90", "parents": [ "3c781e6f8d723ad2856e407b98d53f2deaa0d4bc" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri May 31 20:18:50 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 31 20:18:50 2024 +0000" }, "message": "Update Go dependencies\n\nGenerated by running:\n\n $ go get -u -t ./...\n $ go mod tidy\n $ go mod vendor\n\nThis should fix some Dependabot alerts in GitHub.\n\nThe only code change required was a fix for a test\u0027s expected error\nmessage, likely resulting from a minor change to starlark-go\u0027s parsing\nlogic.\n\nRunning `go get` with Go 1.22 caused Go to add a `toolchain` directive\nto go.mod, which in turn caused Go commands to try to download the\nspecified toolchain version on-the-fly if it differed from the currently\ninstalled version. This is overly pedantic in most cases, so I set the\n`GOTOOLCHAIN` env var on Go checks to point to the currently installed\nversion to prevent internet accesses.\n\nChange-Id: If9581d7dc5aab23a1acaebe0304d7b9bf417a89d\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1052073\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Rob Mohr \u003cmohrr@google.com\u003e\n" }, { "commit": "3c781e6f8d723ad2856e407b98d53f2deaa0d4bc", "tree": "628474ac3dea8a72367d8ac121f8e4443cb44e47", "parents": [ "d2ee6f43f9ef0be1d59771b4cddc771fad981744" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Fri May 31 20:18:19 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri May 31 20:18:19 2024 +0000" }, "message": "[checks] Set GOWORK\u003doff\n\nThis ensures that Go commands always use the versions of libraries\nspecified in go.mod, and thus that are vendored in the /vendor\ndirectory. Otherwise, when working in a Go workspace, Go commands would\ntry to use the version of each library from the workspace, which\nwouldn\u0027t necessary be in the /vendor directory, and would fall back to\ntrying to download from the internet.\n\nAlso set `GOPROXY\u003doff` for better error messages in the future - it\nshould now indicate better *why* it\u0027s trying to connect to the internet,\nrather than trying to connect and failing.\n\nFinally, update the `gosec` and `shadow` versions since the old versions\nseem to be crashing on newer code.\n\nChange-Id: I14b22ef9565a1181fc54d3c5cacf0573844358a5\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1058532\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Danielle Kay \u003cdanikay@google.com\u003e\n" }, { "commit": "d2ee6f43f9ef0be1d59771b4cddc771fad981744", "tree": "792a4f32e89384787512b8035a889d25d21cdb8b", "parents": [ "7148098779af3c64634e2c34a15458137bee25f5" ], "author": { "name": "Rob Mohr", "email": "mohrr@google.com", "time": "Wed May 22 14:17:03 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 22 14:17:03 2024 +0000" }, "message": "[doc] Fix argument name in example\n\nChange-Id: If06c7131933720a457416bd98f19438ecf8737ba\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1052124\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Rob Mohr \u003cmohrr@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "7148098779af3c64634e2c34a15458137bee25f5", "tree": "379548e67f0bf63250c61e00c71ec3a156b63c67", "parents": [ "7e0cb4c2338fcd5005876da9ef0ddf4df29e1be1" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed May 22 14:13:35 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed May 22 14:13:35 2024 +0000" }, "message": "Fix link in CONTRIBUTING.md\n\nIt previously referenced a file in the main fuchsia repository that\ndoesn\u0027t exist here. The referenced file in the fuchsia repo also\ncontains fuchsia-specific instructions that aren\u0027t relevant for shac, so\ninstead I chose to link to the generic Gerrit docs.\n\nChange-Id: Id2cfc157d5ce8a031ca48728b7a26462d334f766\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1050514\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Rob Mohr \u003cmohrr@google.com\u003e\n" }, { "commit": "7e0cb4c2338fcd5005876da9ef0ddf4df29e1be1", "tree": "4a7cb39d725fe5fe3db2adef02b872f6411ff8e3", "parents": [ "f2f79afd3b329a6ce556f97f73931138e1235808" ], "author": { "name": "Rob Mohr", "email": "mohrr@google.com", "time": "Tue May 21 22:34:38 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue May 21 22:34:38 2024 +0000" }, "message": "[README] Expand no_trailing_whitespace example\n\nExpand the no_trailing_whitespace example to work with \u0027shac fmt\u0027.\n\nChange-Id: Ib029169cf5e01519e7bc7877d64e17d94f11c26f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/1051018\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Rob Mohr \u003cmohrr@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "f2f79afd3b329a6ce556f97f73931138e1235808", "tree": "9f31747a9a93bea49100bb9ec5f6a430b7838895", "parents": [ "adb70a5f398a89191aa1d425b4dd8b24bf2f0b84" ], "author": { "name": "Marc-Antoine Ruel", "email": "maruel@gmail.com", "time": "Tue Feb 20 16:11:51 2024 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Feb 20 16:11:51 2024 +0000" }, "message": "Update pinned dependencies\n\nThis permits to use the stock google.golang.org/protobuf\nThis add BugComponent to ResultDB.\n\nChange-Id: I9c17184a966943bc6fd919b44637effb7b7d5c1c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/992852\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: David Fang \u003cfangism@google.com\u003e\n" }, { "commit": "adb70a5f398a89191aa1d425b4dd8b24bf2f0b84", "tree": "8e273f7bfbec4e99dfed16981a31eb9cb5a6a444", "parents": [ "4a57f93c781074d2857b851ed6ef31e03292676e" ], "author": { "name": "Marc-Antoine Ruel", "email": "maruel@gmail.com", "time": "Mon Oct 16 21:20:54 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Oct 16 21:20:54 2023 +0000" }, "message": "Fix shac check on Windows\n\nShare the Go modules across installation, while using separate sumdb\n(via separate GOPATH) to work around race conditions.\n\nChange-Id: Iae8ae78a2cbd2cc8aa7c4d76ba35a8d8e5812c50\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/931379\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\n" }, { "commit": "4a57f93c781074d2857b851ed6ef31e03292676e", "tree": "8637c4dc2f15869cfb5e42cd0c888003119eea90", "parents": [ "308e5025c1d28d3834643bc76a2cd7094a268a79" ], "author": { "name": "Marc-Antoine Ruel", "email": "maruel@gmail.com", "time": "Mon Oct 16 21:18:51 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Oct 16 21:18:51 2023 +0000" }, "message": "Fix tests on Windows\n\n- Use echo hello world consistently.\n- Use cmd.exe /c echo hello world on Windows.\n- Stop using os.Clearenv() and instead selectively clear environment\n variables.\n\nDoes not fix \"shac check\" on Windows yet. It will be done in a follow\nup.\n\nChange-Id: I366f42dabf6bc5899ba98c7a38c0afea519a28b2\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/931712\nReviewed-by: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "308e5025c1d28d3834643bc76a2cd7094a268a79", "tree": "c108685eb4cfd4b14dbefcc2bb0409881767627d", "parents": [ "d9d4a62eebe77b1fdd6143e9c633625b87e1cdf1" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Oct 16 15:47:51 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Oct 16 15:47:51 2023 +0000" }, "message": "[engine] Include arguments in `emit` errors\n\nThis will make debugging slightly easier when encountering these errors.\n\nChange-Id: Ie9c671889c715dd64fb045aed057d451c437cd13\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/931036\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "d9d4a62eebe77b1fdd6143e9c633625b87e1cdf1", "tree": "df94b73dba612863dece735302ec555f4b94cf49", "parents": [ "523a1d3723ebc7e7068bc0c0d76a79ba7e2551a7" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 12 15:08:14 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 12 15:08:14 2023 +0000" }, "message": "[engine] Update starlark-go\n\nThe latest version of starlark-go deprecates the global `resolve.Allow*`\nfields in favor of a `syntax.FileOptions` object that gets passed into\nthe parsing function.\n\nI added a test to make sure the optional features are still enabled. I\ndidn\u0027t include a test for `while` because it\u0027s not supported by\nbuildifier.\n\nChange-Id: I5495674963624c2d303a95615ea7942a625aa645\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/930355\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "523a1d3723ebc7e7068bc0c0d76a79ba7e2551a7", "tree": "439bd566110969fa378f157b17433cd866c456d5", "parents": [ "505bdf3fc42854ce1e89795f1f9a06c65dbc80c2" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 12 14:32:18 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 12 14:32:18 2023 +0000" }, "message": "Update Go deps\n\nThis resolves 2 GitHub security dependabot alerts for golang.org/x/net\nthat aren\u0027t actually relevant to shac but cause noise.\n\nThe only dep I didn\u0027t update to the latest version is go.starlark.net\nsince the latest version deprecates several fields, which breaks\nstaticcheck, so I\u0027ll update it in a follow-up.\n\nGenerated by running:\n\n1. `go get -u ./...`\n2. `go get go.starlark.net@v0.0.0-20230807144010-2aa75752d1da`\n3. `go mod vendor`\n4. `go mod tidy`\n\nChange-Id: I31a188133c578bb230282e8d8ddc454b0f3ab4dd\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929897\nReviewed-by: Yuping Zhai \u003cyupingz@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "505bdf3fc42854ce1e89795f1f9a06c65dbc80c2", "tree": "db53da01974b96f94688fe152f3f81e366cad6bf", "parents": [ "1f0699b92d3cf42902ae326cd24807ccf0cfd2c7" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 12 13:46:52 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 12 13:46:52 2023 +0000" }, "message": "[tests] Fix breakage on Windows\n\nThe Windows equivalent of $HOME is $LocalAppData, we need to give checks\naccess to that var as well or else `go` commands fail because they can\u0027t\nevaluate a cache directory, which has broken the tests in the Windows\nGitHub workflow.\n\nAlso be more consistent about not using trailing commas after textproto\nfields, since they\u0027re unnecessary.\n\nChange-Id: Ia3c396bd78f2d72eff18ebb2b1e1394eb878fefe\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/930374\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "1f0699b92d3cf42902ae326cd24807ccf0cfd2c7", "tree": "9ca35157ba6dafe3d4867f5093fea13ab88a1973", "parents": [ "8c21becb480d4c1536001dfc8590b6ea7cc4f621" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 12 06:46:58 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 12 06:46:58 2023 +0000" }, "message": "[engine] Simplify subprocess running code\n\nSeparate calls to Start() and Wait() can be collapsed into Run().\n\nChange-Id: I89cb2324d2210617914aeb3f88ff6978d9f8eb49\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/930375\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "8c21becb480d4c1536001dfc8590b6ea7cc4f621", "tree": "ed343f7b6876a327d738bdd07f4d9a08a6280fbd", "parents": [ "9a096d6659b0a2853f2132843de80402335b2771" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Oct 11 18:01:47 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Oct 11 18:01:47 2023 +0000" }, "message": "Reland \"[engine] Limit number of active subprocesses\"\n\nThis reverts commit 0dae038b1f9471122d08633e0e246f8436c24275.\n\nReason for revert: There was a potential for deadlocks in the first\nversion of this change. Previously, the semaphore used to limit the\nnumber of running subprocesses wouldn\u0027t get released, allowing another\nsubproces to start, until the subprocess completed *and* the `wait()`\nStarlark function was called on the subprocess object.\n\nThis meant that it was not safe to launch a large number of subprocesses\nand then call `wait()` on them in any order other than the same order in\nwhich they were started. Otherwise the code would run the risk of\ncalling `wait()` on a subprocess that couldn\u0027t start until another\nsubprocess had `wait()` called on it, leading to a deadlock.\n\nNow the semaphore gets released by a separate goroutine immediately\nafter the subprocess completes, even if the Starlark code hasn\u0027t called\n`wait()` yet, making this class of deadlock impossible.\n\nOriginal change\u0027s description:\n\u003e Revert \"[engine] Limit number of active subprocesses\"\n\u003e\n\u003e This reverts commit 612779b564d2ba08167db3f63f4166fa012729bd.\n\u003e\n\u003e Reason for revert: `shac check --all` is hanging in large repos:\n\u003e https://ci.chromium.org/b/8767597391211255425\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [engine] Limit number of active subprocesses\n\u003e \u003e\n\u003e \u003e Previously the number of concurrent subprocess invocations launched by\n\u003e \u003e `ctx.os.exec()` was unbounded, which could place a strain on the system.\n\u003e \u003e Now there\u0027s effectively a pool of NumCPU+2 workers for running\n\u003e \u003e subprocesses.\n\u003e \u003e\n\u003e \u003e `ctx.os.exec()` returns immediately, but the underlying subprocess is\n\u003e \u003e started asynchronously.\n\u003e \u003e\n\u003e \u003e `ba -against main` showed no significant difference in the results of\n\u003e \u003e the `ctx.os.exec()` benchmarks.\n\u003e \u003e\n\u003e \u003e Change-Id: I76e4542249783c9a503f0f927e327e9f90f8bb04\n\u003e \u003e Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/867979\n\u003e \u003e Reviewed-by: Ina Huh \u003cihuh@google.com\u003e\n\u003e \u003e Commit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n\u003e\n\u003e Change-Id: Icfd3611825b1995948c856170ddc353b7ebfb1eb\n\u003e No-Presubmit: true\n\u003e No-Tree-Checks: true\n\u003e No-Try: true\n\u003e Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929633\n\u003e Fuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n\u003e Commit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n\u003e Reviewed-by: RubberStamper 🤖 \u003candroid-build-ayeaye@system.gserviceaccount.com\u003e\n\nChange-Id: Iefdd7aebc04d03e60f925f136a08eebc28e5bb63\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929654\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "9a096d6659b0a2853f2132843de80402335b2771", "tree": "70bb696081fb906583cd06abca2028687576b9fc", "parents": [ "0dae038b1f9471122d08633e0e246f8436c24275" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Oct 11 17:49:56 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Oct 11 17:49:56 2023 +0000" }, "message": "[cli] Print goroutine stacktrace on SIGTERM\n\nThis will help debug current and future timeouts in infrastructure, e.g.\ncommit 612779b564d2ba08167db3f63f4166fa012729bd had to be reverted\nbecause it was causing shac to apparently hang.\n\nChange-Id: I9c95b0e5088a967abfc384a82f1b2acf56278b8b\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929634\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "0dae038b1f9471122d08633e0e246f8436c24275", "tree": "8265a628481d33bb7cbce0a94ed09488be8e8fba", "parents": [ "612779b564d2ba08167db3f63f4166fa012729bd" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Oct 10 20:05:10 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Oct 10 20:05:10 2023 +0000" }, "message": "Revert \"[engine] Limit number of active subprocesses\"\n\nThis reverts commit 612779b564d2ba08167db3f63f4166fa012729bd.\n\nReason for revert: `shac check --all` is hanging in large repos: \nhttps://ci.chromium.org/b/8767597391211255425\n\nOriginal change\u0027s description:\n\u003e [engine] Limit number of active subprocesses\n\u003e\n\u003e Previously the number of concurrent subprocess invocations launched by\n\u003e `ctx.os.exec()` was unbounded, which could place a strain on the system.\n\u003e Now there\u0027s effectively a pool of NumCPU+2 workers for running\n\u003e subprocesses.\n\u003e\n\u003e `ctx.os.exec()` returns immediately, but the underlying subprocess is\n\u003e started asynchronously.\n\u003e\n\u003e `ba -against main` showed no significant difference in the results of\n\u003e the `ctx.os.exec()` benchmarks.\n\u003e\n\u003e Change-Id: I76e4542249783c9a503f0f927e327e9f90f8bb04\n\u003e Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/867979\n\u003e Reviewed-by: Ina Huh \u003cihuh@google.com\u003e\n\u003e Commit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n\nChange-Id: Icfd3611825b1995948c856170ddc353b7ebfb1eb\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929633\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: RubberStamper 🤖 \u003candroid-build-ayeaye@system.gserviceaccount.com\u003e\n" }, { "commit": "612779b564d2ba08167db3f63f4166fa012729bd", "tree": "a08c5332892367e7f114d6c4af6c41331148d525", "parents": [ "cf172301993250b31d532152bc8c834eaee8131e" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Oct 10 18:53:15 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Oct 10 18:53:15 2023 +0000" }, "message": "[engine] Limit number of active subprocesses\n\nPreviously the number of concurrent subprocess invocations launched by\n`ctx.os.exec()` was unbounded, which could place a strain on the system.\nNow there\u0027s effectively a pool of NumCPU+2 workers for running\nsubprocesses.\n\n`ctx.os.exec()` returns immediately, but the underlying subprocess is\nstarted asynchronously.\n\n`ba -against main` showed no significant difference in the results of\nthe `ctx.os.exec()` benchmarks.\n\nChange-Id: I76e4542249783c9a503f0f927e327e9f90f8bb04\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/867979\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "cf172301993250b31d532152bc8c834eaee8131e", "tree": "8265a628481d33bb7cbce0a94ed09488be8e8fba", "parents": [ "b0fc6611c911bc4dd0896b0dde24a7e679a18291" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Oct 10 18:24:25 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Oct 10 18:24:25 2023 +0000" }, "message": "[engine] Accept None for optional args to ctx.emit.finding\n\nThis will enable simpler integration with certain linting tools that\nemit output that then needs to be translated to shac\u0027s finding schema.\nE.g. some linting tools emit JSON output that omits empty fields, or\nsets their values to null, so it\u0027s handy to be able to do `replacements\n\u003d output.get(\"replacements\")` and have it \"just work\" even if\n`replacements` is not set or is null.\n\nChange-Id: I53ffcb3fb4d64081a13cc55f72343c9eff0eef9f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929632\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\n" }, { "commit": "b0fc6611c911bc4dd0896b0dde24a7e679a18291", "tree": "d5da66a86f1af55ee68c07d01a4f23511fb6e0e6", "parents": [ "d92939a591fbd494631c89bf8bb054e760496d8e" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Oct 10 17:44:59 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Oct 10 17:44:59 2023 +0000" }, "message": "[buffers] Catch duplicate buffers.push() calls\n\nPreviously, if the same buffer gets returned to the buffer pool multiple\ntimes (which should never happen, but could happen if a bug was\nintroduced that led to `buffers.push()` being called multiple times with\nthe same buffer), the buffer could subsequently be returned to multiple\ndifferent goroutines by `buffers.get()`. This would lead to parallelism\nbugs as multiple goroutines try to write to the same buffer.\n\nNow `buffers.push()` will panic if the buffer being pushed is already in\nthe buffer pool.\n\nChange-Id: I701b2f45cdce8085bcdbb4d1b2bbb2247dd0ee21\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929154\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "d92939a591fbd494631c89bf8bb054e760496d8e", "tree": "cb5f075e885c3ebc3e591a8c62986f661e3398ba", "parents": [ "2ca3a4fbbe1e58932a3515e5894c7422d5081dac" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Oct 09 19:31:19 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Oct 09 19:31:19 2023 +0000" }, "message": "[engine] Use relative paths in `shac fmt` output\n\nThis is less verbose and repetitive than using absolute paths.\n\nChange-Id: I2a12f097e41e4542f4f4416cfe9934bbaf0c86ee\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/929013\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "2ca3a4fbbe1e58932a3515e5894c7422d5081dac", "tree": "33dea7d86bcf783ee130bd2ed87d930a223fd079", "parents": [ "5d6681e44ae956420851e75d0757bc40848f1ffb" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 05 22:55:32 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 05 22:55:32 2023 +0000" }, "message": "[resultdb] Add more context to error messages\n\n... on the off chance that somebody has the `LUCI_CONTEXT` env var set\nlocally with some invalid value.\n\nChange-Id: I38c247b42706529e01de649ed3a0f47a62e3cd6e\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/927714\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "5d6681e44ae956420851e75d0757bc40848f1ffb", "tree": "74e0980c0acf49ff609577633c134631a3b4d66b", "parents": [ "247f7795e4fed68d3d4f6337de3020efb0dcd247" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 05 22:55:01 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 05 22:55:01 2023 +0000" }, "message": "[cli] Move env var modification into init()\n\n... so it applies to all tests in this package, and so the tests can go\nback to using `t.Parallel()`.\n\nBased on code review comments from\ncommit 247f7795e4fed68d3d4f6337de3020efb0dcd247.\n\nChange-Id: Ibc5a0c47c492f8d4ac390d2413e0e7e493a5562f\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/927992\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\n" }, { "commit": "247f7795e4fed68d3d4f6337de3020efb0dcd247", "tree": "fb14413309350e666cee153a14322ee8feacead6", "parents": [ "5315ff82632419805df5b25b6a7f36d899d57988" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 05 18:36:38 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 05 18:36:38 2023 +0000" }, "message": "[cli] Make tests not be sensitive to env\n\ncommit 5315ff82632419805df5b25b6a7f36d899d57988 added these tests that\nrun shac nearly end-to-end, including automatic selection of reporting\nmechanism. The reporting mechanism selection is sensitive to the\nenvironment and in particular is somewhat picky about how the ResultDB\nenvironment is set up, so the tests fail if they\u0027re run on a builder\nwith ResultDB enabled but without the process being wrapped by `rdb\nstream`: https://ci.chromium.org/b/8768055331277189409\n\nChange-Id: Idc006375834a225d207413a7962baad1083a8abf\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/927713\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\n" }, { "commit": "5315ff82632419805df5b25b6a7f36d899d57988", "tree": "83a73011d3ef7cd5ecbedb0f0ef53a097e352f86", "parents": [ "45245cedfc897061f483fd5e8389123fe8cf8cb8" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Oct 05 17:43:33 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Oct 05 17:43:33 2023 +0000" }, "message": "[engine] Support specifying an allow-list of checks\n\n... user-controllable via an `--only \u003ccheck1\u003e,\u003ccheck2\u003e` flag.\n\nThis has a couple use cases:\n1. Allowing users to only run one specific check to save time while\n iterating on a new check implementation.\n2. Rerunning checks to resolve conflicts when applying fixes, but\n skipping checks for which fixes were already successfully applied.\n This will come in a future change.\n\nChange-Id: I503d5d07d20602262e364c45b16707a042eafcc9\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/927712\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\n" }, { "commit": "45245cedfc897061f483fd5e8389123fe8cf8cb8", "tree": "123f6531c4ac30dbdba9b9313a311f89ae04d910", "parents": [ "3cab7b9276042c142f266dfa38d90772709f63b7" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Wed Oct 04 16:19:50 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Oct 04 16:19:50 2023 +0000" }, "message": "[engine] Improve error messages when run in invalid directory\n\n1. --var flags are not validated until after shac determines that the\n working directory is valid (i.e. contains a shac.star file).\n2. If a shac.star file cannot be discovered via git, print the expected\n location of the shac.star file.\n3. If a --var flag is specified but no shac.textproto file exists, use a\n slightly different error message to make it more clear that\n shac.textproto doesn\u0027t exist yet.\n\nChange-Id: I6bed59f60b73e9ecff0caec97c152f2f7ea94fb7\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/926852\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "3cab7b9276042c142f266dfa38d90772709f63b7", "tree": "c3e01349cabb88eefd7f54014af0f31f0c5d75e5", "parents": [ "34074c1e0c12bc6302aba12b831825cf27e7aa7d" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Oct 03 21:25:11 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Oct 03 21:25:11 2023 +0000" }, "message": "[engine] Don\u0027t try to mount invalid PATH elements\n\nSkip trying to mount any elements of $PATH that are not valid absolute\npaths. This makes shac resilient to weirdly/improperly configured\nenvironments.\n\nChange-Id: Ib6ba47798433c68c1b19e07e2afc49e172f4ee98\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/926132\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\n" }, { "commit": "34074c1e0c12bc6302aba12b831825cf27e7aa7d", "tree": "fbc39ba0eac6466188873fadd227de4c67dd5faf", "parents": [ "1d1ca72e3982825749575b0e0a4cf9f1a3c82809" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Tue Oct 03 17:36:43 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Oct 03 17:36:43 2023 +0000" }, "message": "[checks] Fix govet docstring\n\nThis was a copy-paste error.\n\nChange-Id: I670723ecce0c05bf2cebf4bc0871e2e5e901948c\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/925199\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nReviewed-by: Ina Huh \u003cihuh@google.com\u003e\n" }, { "commit": "1d1ca72e3982825749575b0e0a4cf9f1a3c82809", "tree": "5b18f1407bf1eb9b81655c72366a8d2806b3ccdb", "parents": [ "257dfa5868316879d4486f23de84fb741c9f62f5" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Oct 02 17:10:11 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Oct 02 17:10:11 2023 +0000" }, "message": "[checks] Add govet\n\nMost of go vet\u0027s checks overlap with other linters we already\nimplemented support for, but the `copylocks` check in particular is not\nenforced by the existing linters, so we should run that along with any\nfuture analyzers we discover are not enforced by other lintesr.\n\nChange-Id: Ie85f8085721b5d1006740d36a0c9bff7bba167b5\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/925054\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" }, { "commit": "257dfa5868316879d4486f23de84fb741c9f62f5", "tree": "a9e9aa97f14c0afded1fe52bd1d1d4fbe53f6b6b", "parents": [ "c1476aedb83e88a9c472afe71077cd761b67729e" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Mon Oct 02 15:53:22 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Oct 02 15:53:22 2023 +0000" }, "message": "[engine] Delete debug print statement\n\nThis was accidentally committed in\ncommit c1476aedb83e88a9c472afe71077cd761b67729e.\n\nChange-Id: Ie102dc263a2d596bfb2a17dbc8c9456c5d0831dd\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/925092\nReviewed-by: Jerry Belton \u003cjcecil@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "c1476aedb83e88a9c472afe71077cd761b67729e", "tree": "107aa72a6435e45eed7f780bdb3317bdefbb6320", "parents": [ "703c58c1d12d873ca9e99479d7a436e0f8fb6e3d" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Sep 28 21:14:16 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 28 21:14:16 2023 +0000" }, "message": "[engine] Support static env var pass-throughs\n\nAllow users to selectively poke holes in the subprocess sandbox by\nspecifying `pass_through_env` in shac.textproto. `pass_through_env` is a\nlist of environment variables that should be passed through the sandbox,\nalong with bits indicating whether the variable\u0027s value represents a\nfile that should also be mounted and, if so, whether it should be\nwriteable by subprocesses.\n\nWe can immediately use this feature to grant Go checks in this\nrepository access to $HOME so they can share the same go cache with the\nrest of the system (ideally we could use $GOCACHE, but it\u0027s not\nguaranteed to be set, and if it\u0027s not set it\u0027s inferred from $HOME).\nSame for tests that run `go run` since they can make use of the cache\ninstead of doing a full recompile on every test run; as a result, the\nruntime of `go test ./internal/engine` went from ~4.2 seconds to ~1.2\nseconds on my workstation.\n\nThis is a medium-term workaround until we support declaring\npass-throughs in Starlark, which would allow things like running `go env\nGOCACHE` to obtain and pass through just the $GOCACHE directory, while\nomitting the rest of $HOME.\n\nChange-Id: I0bcc9956c4c4e2e9cca292925c66f6aed6f07524\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/922772\nReviewed-by: Anthony Fandrianto \u003catyfto@google.com\u003e\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nCommit-Queue: Oliver Newman \u003colivernewman@google.com\u003e\n" }, { "commit": "703c58c1d12d873ca9e99479d7a436e0f8fb6e3d", "tree": "fc848787a24113cddb20783b1ce333e9536969c6", "parents": [ "4a0e9dd4bd68ca7f805e0759952f48430367c5cf" ], "author": { "name": "Oliver Newman", "email": "olivernewman@google.com", "time": "Thu Sep 28 16:25:42 2023 +0000" }, "committer": { "name": "CQ Bot", "email": "fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Sep 28 16:25:42 2023 +0000" }, "message": "[docs] Add getting-started documentation to README\n\nTo help people get started writing basic checks.\n\nChange-Id: Id45d52827b75248cb8d819f9adb1d55b7306cf2e\nReviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/919561\nFuchsia-Auto-Submit: Oliver Newman \u003colivernewman@google.com\u003e\nReviewed-by: Danny Rosen \u003cdannyrosen@google.com\u003e\nCommit-Queue: Auto-Submit \u003cauto-submit@fuchsia-infra.iam.gserviceaccount.com\u003e\n" } ], "next": "4a0e9dd4bd68ca7f805e0759952f48430367c5cf" }