Repository navigation
ci: upload fork CodeQL results to the verified PR commit - #3274
Merged
Hillary Mutisya (hillary-mutisya) merged 1 commit intoNov 9, 2026
Merged
Conversation
Submit validated SARIF through the code-scanning API so the trusted helper checkout cannot override the verified PR SHA. Preserve report categories and wait for processing with bounded, explicit failure handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Hillary Mutisya (hillary-mutisya)
added a commit
that referenced
this pull request
Nov 10, 2026
## Summary - Replace the Memory Hub Views horizontal-scrolling type bar with a vertical-ellipsis overflow menu: empty types stay in overflow, and populated types move there when space is limited. - Preserve type selection, collection scope, search, pagination and keyboard focus, including when a selected type cannot fit on the bar. - Hide inventory pagination when neither forward nor backward navigation is possible. Label the Inbox's independent `View issues` and `Build issues` pagers when navigation is needed. - Add regression coverage for scoped/later-page presence, responsive layouts, menu accessibility, independent pagination and empty attention states. ## Motivation The gallery previously showed tabs for types with no saved instances and needed horizontal scrolling on narrow screens. Inbox Views also showed two indistinguishable, disabled page-one controls. Both controls belonged to that panel's real saved-view and build-receipt feeds; neither was a hidden-module leak. ## Behavior and configuration - Enabled by default; no configuration, storage migration or API changes. - View-type availability covers the selected collection scope, including saved drafts, rather than only the current search/filter/page. One-item existence probes are cached across ordinary filtering and invalidated by explicit refresh, scope and collection-head changes. - Populated selected types are prioritized on the bar when they fit. Otherwise selection remains visible and accessible in overflow. Arrow keys, Home/End and Escape retain appropriate focus. - Shared inventory pagers are hidden on empty/single-page inventories, but remain available on a last page with backward navigation. - Inbox feeds retain separate continuation tokens and existing attention counts; they are not merged or dropped. - No ingestion, model inference, publication, dataset changes or procedural-view implementation changes are included. The branch starts from current main, after #3273 and #3274. ## Reviewer guide 1. [memoryHubViewTypeFilter.ts](https://github.com/microsoft/TypeAgent/blob/16a917a82/ts/packages/agents/browser/src/views/client/library/memoryHubViewTypeFilter.ts): bounded presence requests, responsive selection/layout and menu keyboard lifecycle. 2. [memoryHubViews.ts](https://github.com/microsoft/TypeAgent/blob/16a917a82/ts/packages/agents/browser/src/views/client/library/memoryHubViews.ts): scoped presence caching, filter integration, refresh/disposal and visible-target focus restoration. 3. [memoryHubUi.ts](https://github.com/microsoft/TypeAgent/blob/16a917a82/ts/packages/agents/browser/src/views/client/library/memoryHubUi.ts) and [memoryHub.css](https://github.com/microsoft/TypeAgent/blob/16a917a82/ts/packages/agents/browser/src/views/client/library/memoryHub.css): opt-in radio-menu semantics and scoped styling; other menus retain their existing roles. 4. [memoryHubInventoryPager.ts](https://github.com/microsoft/TypeAgent/blob/16a917a82/ts/packages/agents/browser/src/views/client/library/memoryHubInventoryPager.ts) and [memoryHubViewActivity.ts](https://github.com/microsoft/TypeAgent/blob/16a917a82/ts/packages/agents/browser/src/views/client/library/memoryHubViewActivity.ts): navigation visibility, visible feed labels and removal of phantom empty headings. Fixture updates respect requested view kinds and allow the additional asynchronous presence requests to settle; no tests are skipped. ## Validation Windows, Node 26.13.0, standalone pnpm 11.9.0; initial UX commit `16a917a82`; final CI-repair qualification is recorded below. | Check | Command / evidence | Result | | --- | --- | --- | | Clean build | `pnpm run clean`, then `pnpm run build` from `ts`; full build rerun after final focus fix | Passed | | Browser client regression suite | `pnpm --filter @typeagent/browser run test:views:client` | 47 suites, 516 tests passed | | Formatting | `pnpm run prettier:changed:fix`; no changes produced | Passed | | Whitespace | `git diff --check` | Passed | | Lint ratchet | `pnpm run code-lint -- --ratchet --base origin/main` | 0 to 0 violations | | Complexity ratchet | `pnpm run code-complexity -- --ratchet --base origin/main --cyclomatic 25 --cognitive 30 --new-file-cyclomatic 25 --new-file-cognitive 30` | No added over-budget functions; new file meets 25/30 caps | | Circular ratchet | `pnpm run code-circular -- --ratchet --base origin/main --exceptions-file tools/scripts/code/circular-baseline-exception.json` | 210 to 210 cycles; 11 established baseline exceptions unchanged | | Test-debt gate | `pnpm run code-debt -- --gate --base origin/main` | No focused or newly skipped tests | | Actual browser checks | Existing saved corpus, desktop and 390px/320px layouts | See below | All four PR gates ran against the committed final HEAD, not just uncommitted edits. ### UI verification 1. Open Memory Hub Views with populated and empty view types. Confirm only populated types appear on the bar, with other supported types in the three-dot menu. 2. Narrow to 320px and select Project Brief from overflow. Confirm its selected state and keyboard focus remain on the replacement overflow trigger when the type cannot fit. 3. Verify no horizontal filter scrolling: the measured bar client and scroll widths were both 217px at 320px. Desktop/mobile popup widths were both 188px without horizontal overflow. 4. Open Inbox, then Views. The existing eight attention cards remain, with neither redundant page-one control visible. 5. Multi-page fixture tests cover either or both feeds needing paging, independent tokens, and last-page backward navigation. Empty fixtures verify no phantom attention heading. The browser checks used existing saved content; deterministic fixtures are engineering regressions, not live-model quality evidence. ## Risks and rollback The additional scoped existence requests occur on initial load or invalidation, not each ordinary filter/search refresh. Resize/font observers and menus are disposed on rerender, scope changes and teardown. Product changes are client-only; CI follow-up also hardens test/qualification harnesses. No data migration or corpus mutation is required. Remote CI and human review are separate from the local results above. ## CI repair follow-up (`9a860cc68`) The original six `build_ts` failures were aggregate coverage gates. Their underlying failures were incomplete recovery checkpoint JSON on Ubuntu/macOS Node 24, and an Ubuntu Node 24 workflow CLI child timeout reported as exit zero by its test helper. The runner-image migration notices were informational. - Publish complete checkpoint JSON through an exclusive hard link from an owned sibling temporary file. Readers never see a partially written final checkpoint; existing checkpoints cannot be overwritten. - Add deterministic partial-write visibility and exclusive-publication regressions while retaining all five real SQLite hard-crash scenarios. - Run CLI children with the current Node executable, close their non-interactive stdin, and reject killed/signalled/nonnumeric failures with diagnostics. Add a timeout regression. The default 30-second child and 35-second Jest deadlines are unchanged. - No assertions, gates, thresholds or test coverage were weakened; no tests were skipped and no dependencies changed. Reviewer entry points: `ts/tools/memory-maintenance-qualification/longmemeval-indexing-storage.mjs`, its indexing test, and `ts/examples/workflow/cli/test/cli.spec.ts`. Final local validation on `9a860cc68`: - `pnpm run build`: passed. - `pnpm run test:memory-quality`: **349 tests passed**, zero skipped. - `pnpm --filter workflow-cli test:local`: **12 tests passed**, zero skipped. - Browser client suite: **47 suites / 516 tests passed**. - Pinned changed-file formatting, whitespace and all four committed-HEAD PR gates passed against `origin/main` (lint, complexity, circular dependencies and test debt). The new-head CI run and human review remain separate from these local results. No merge or automatic merge is requested. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Motivation
Investigating #3240 showed that all five analysis jobs and their companion uploads succeeded, but the code-scanning merge requirement remained pending.
The pinned CodeQL upload action obtains the commit from
git rev-parse HEADin its checkout directory before falling back to itsshainput. Our privileged uploader checks out trusted default-branch helpers, so it constructs a payload combining the PR ref with the trusted checkout's commit instead of the verified PR head. A successful upload is therefore not evidence that the required results exist for that PR commit.This fixes the trusted uploader rather than weakening the merge rule or checking out untrusted PR code.
Reviewer guide
commit_shaandrefs/pull/<verified-number>/head, gzip/base64 encode the validated report, and poll the returned upload ID. Reject processing failures, unexpected statuses, missing IDs, API errors, or a five-minute polling timeout.actions/github-script. Keep verification separate from the write-permission upload jobs and cap each upload job at ten minutes.Validation
Validated on Windows with Node 26.13.0 and standalone pnpm 11.9.0, on commit
a52f3949003af5fa9f4a4309299e137100f44f08, based on currentmain(5b40c973375705d5f7e302131ba99bd0aae5c6a6).Commands run from
ts:pnpm run buildnode --test tools/scripts/test/codeqlForkUpload.spec.mjspnpm run prettier:changedpnpm exec prettier --check tools/scripts/codeqlForkUpload.mjs tools/scripts/test/codeqlForkUpload.spec.mjs ../.github/workflows/codeql-fork-upload.ymlpnpm run code-lint -- --ratchet --base origin/mainpnpm run code-complexity -- --ratchet --base origin/main --cyclomatic 25 --cognitive 30 --new-file-cyclomatic 25 --new-file-cognitive 30pnpm run code-circular -- --ratchet --base origin/main --exceptions-file tools/scripts/code/circular-baseline-exception.jsonpnpm run code-debt -- --gate --base origin/maingit diff --checkThese are local results, not a claim that remote CI or a live fork-upload test has passed.
Risks, limitations, and rollout
workflow_runconsumer uses trusted default-branch code. Land this change onmain, then rerun a fork analysis and verify that stored results and the code-scanning merge requirement reference its actual head SHA.