Repository navigation
Commit .claude/rules, gate migration parity in CI, clear reference_only on re-verify - #23
Merged
Merged
Conversation
.gitignore ignored all of .claude/, so the test-quality rules in .claude/rules/testing.instructions.md existed only on one machine. The blanket entry becomes .claude/* with .claude/rules/ re-included; git cannot re-include a path whose parent directory is excluded. .claude/* contains a slash, so it is anchored to the repo root, whereas the old .claude/ matched at any depth. */**/.claude/ keeps a .claude/ directory a session creates in a subdirectory out of git. Settings, locks and session memory stay ignored. The rules file linked to .claude/golang.md, a local, unattributed copy of github/awesome-copilot's MIT-licensed go.instructions.md whose test-naming and testify advice contradicts this repo. That file is deleted rather than committed; the rules file now names the idioms it relied on and the repo's own conventions (TestX_Scenario, stdlib testing only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI's test job now runs `make check-migrations` right after checkout, before the SDK fetch, so schema drift fails in seconds. Until now the check was manual and `go test` caught only version-ceiling skew. The script collected CREATE TABLE and ADD COLUMN only, so a column or table dropped in one dialect passed: the old script exits 0 with a one-sided `DROP COLUMN zone`. It now replays each set in migration order into a (table, column) set, applying DROP COLUMN and DROP TABLE, and diffs the final sets. A one-sided add, column drop or table drop each exits 1 (checked under mawk); the current schema still matches. The header promised exit 2 on a tooling failure, but a failed extraction exited with the awk status or not at all. It now exits 2 explicitly. Temp files move from fixed /tmp names, removed only on success, to a mktemp directory with an EXIT trap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lder
A resolver placeholder (InsertResourcesIfAbsent) is written with
reference_only = TRUE and `{}` attributes. When a scanner later emits
the same resource and the split path runs, the new row omits the column
and the flag ends up FALSE. But a scanner row identical to the
placeholder (same type, `{}` attributes and tags) compares equal and
takes the verify path, whose UPDATE never touched the column. The row
stayed flagged, so TypesForScan hid the type and `coverage verify`
could report it declared-not-emitted.
The verify UPDATE now sets reference_only = FALSE, unconditionally like
deleted_at/deleted_by. Only UpsertResources (scanners) reaches that
path; InsertResourcesIfAbsent never does, so a placeholder write can
neither clear the flag nor set it on a real row.
TestUpsertResources_VerifyClearsReferenceOnly (SQLite + Postgres)
re-emits an identical row under a second scan and checks the flag
clears, no split, verified_by advances, TypesForScan counts the type,
and an untouched placeholder keeps its flag. With the new SET line
removed it fails on both dialects (TypesForScan returns []).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rchildress87
added a commit
that referenced
this pull request
Oct 21, 2026
aws:ec2:ipam-prefix-list-resolver rows now carry a Rules key, read per resolver with GetIpamPrefixListResolverRules (manual NextToken loop, MaxResults 1000, shared errRepeatedNextToken) and sorted to a total order: each rule's conditions first, then the rules, both by their encoding, so unchanged rules never version-split the row. An empty read stores []. Delete-complete resolvers are stored without reading rules. A failed rules read never writes an empty or missing list in place of the rules (decision #23): a denied or transient read skips that resolver with one counted warning per phase; any other error, including the not-found code EC2's model does not list, fails the phase after the resolvers that were read are stored. Resolvers listed without an id or ARN are counted in a warning. The resolver phase moved out of scanEC2's concurrent categories into scanEC2IPAMExtended, which runs after them, so one failed rules read cannot cancel the other EC2 categories; this costs at least one round trip per region. Existing resolver rows split once (new Rules key), and a role without GetIpamPrefixListResolverRules now stores no resolver rows. Reviewed adversarially over three rounds; 26/26 mutants killed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DTWFksHGT3LDTeYfqUYPRB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
This PR closes the three items PR #22 left open, one commit each.
1. Commit the shared Claude rules (
27b3e835).gitignoreignored all of.claude/, so.claude/rules/testing.instructions.mdexisted on only one machine..claude/*with!.claude/rules/re-included. Settings, lock files and session memory stay ignored..claude/*applies only at the repo root, whereas the old.claude/matched at any depth.*/**/.claude/keeps any nested.claude/folder out of git..claude/golang.mddeleted, not committed:github/awesome-copilot's MIT-licensedgo.instructions.md.Test_x_yand to considertestifycontradicts this repo.2. Gate migration parity in CI (
19816253)testjob runsmake check-migrationsright after checkout, before the SDK fetch, so a mismatch fails in seconds.CREATE TABLEandADD COLUMN. A column or table dropped in one dialect only passed; the old script exits 0 on a one-sidedDROP COLUMN.mktempdirectory removed on any exit.3. Clear
reference_onlywhen a scanner re-verifies a placeholder (84406405){}attributes and tags) compares equal, so it takes the verify path, and that UPDATE never touched the flag. The row stayed flagged,TypesForScanhid its type, andcoverage verifycould report the type as declared but not emitted.reference_only = FALSE, the same way it already clears the archive tombstone. OnlyUpsertResources(scanners) reaches that path.Checklist
mainand targetingmainCGO_ENABLED=0 go test ./...passes (full run with-tags grpcnotrace)go vet ./...andgolangci-lint runare clean (store: 0 issues; no other Go package changed)golangci-lint fmt --diffis empty on the changed packagemake check-migrationspasses, and this PR's CI runs it for the first timeNotes for reviewers
TestUpsertResources_VerifyClearsReferenceOnlyruns on SQLite and Postgres (the Postgres subtest ran, not skipped). With the newSETline removed, both fail.reference_onlyfor a UI badge, a synthetic-inventory generator and a row count that does not filter on it. After this change a scanner-verified row shows as a real resource, which is how a row that took the split path already behaves.RENAMEis not modelled. A rename shows up as drift, never as a silent pass.🤖 Generated with Claude Code