vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: harden the review classifier's real reviews

Browse source 
Follow-ups from the review of #5142.

A `Done` answer with fewer or more rows than the classifications sent, or
none, now posts the no-verdict comment instead of the classifier's overall
verdict, so a short answer can't approve.

Requests are accepted per repo, PR and head into a set bounded at the two
running plus eight waiting. A request for a key already running or waiting
starts nothing and logs at info; a request with every place taken starts no
run and posts a no-verdict comment saying so. Before, every delivery spawned
a task waiting on the semaphore, so toggling the review request queued one
paid run per toggle.

Table cells get a zero-width space after `#`, `!`, `://` and `www.`, so a
model's reason can't render an issue or PR reference or a bare URL as a link.

The secret publisher's policy denies the classifier's forge token leaf, the
way #5139 denied Grafana's admin password, with a module-eval-bao-grants arm
pinning it. The controller posts reviews with whatever token is there, so a
publisher write picked the account reviews come from.

Closes #5143, part of #5096.
This commit is contained in:
atlas 2026-10-12 17:33:45 +02:00 • committed by mara
commit 60ea7fdc04
10 changed files with 447 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

16
swarm-controller/src/main.rs
View file

@ -893,16 +893,8 @@ struct AppState {
/// The review classifier try-outs started here, until their results
/// expire.
try_outs: review_classifier::TryOuts,
/// Held by each requested review's run, so at most
/// `review_classifier::review::MAX_CONCURRENT_REVIEWS` go at once.
review_slots: Arc<tokio::sync::Semaphore>,
}
/// A fresh [`AppState::review_slots`].
fn review_slots() -> Arc<tokio::sync::Semaphore> {
Arc::new(tokio::sync::Semaphore::new(
review_classifier::review::MAX_CONCURRENT_REVIEWS,
))
/// The requested reviews running or waiting.
reviews: Arc<review_classifier::review::Reviews>,
}
/// Env var the controller's NixOS module sets from
@ -3275,7 +3267,7 @@ async fn main() -> Result<()> {
create_gate: Arc::default(),
accounts: linked_accounts::Accounts::Live,
try_outs: review_classifier::TryOuts::default(),
review_slots: review_slots(),
reviews: Arc::default(),
};
let app = build_app(state);
@ -3464,7 +3456,7 @@ mod tests {
create_gate: std::sync::Arc::default(),
accounts: super::linked_accounts::Accounts::Fake(std::sync::Arc::default()),
try_outs: super::review_classifier::TryOuts::default(),
review_slots: super::review_slots(),
reviews: std::sync::Arc::default(),
};
(state, sched)
}