feat: emit VC v1.0 outputs from Docker action entrypoint - #313
Conversation
🤖 CodeAnt AI — Review Status
|
QWED Security Verification Report1 files scanned | 0 blocked | 0 warnings | 1 info | 0 suppressed | 0 verified | 1 pre-existing Pre-existing Findings (not introduced by this PR — advisory)
Engines
Verified by QWED — deterministic security verification. No LLM used. |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
dosubot
Bot
added
enhancement
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe action entrypoint now generates versioned Verification Context documents and SHA-256 proof references. Verification and scan modes emit verdict, admission, proof reference, and optional serialized context outputs. ChangesVerification Context Outputs
Estimated code review effort: 3 (Moderate) | ~20 minutes Mergeability Score: 🟠 High · up to The Docker action now emits standardized verdict, admission, proof, and context outputs, but current behavior can still admit partially failed verification, reuse an unbound process proof reference, and emit contradictory context for some modes or denied results. These issues can mislead downstream automation and weaken fail-closed guarantees, so merge should wait for fixes or explicit owner acceptance. Sequence Diagram(s)sequenceDiagram
participant VerificationMode
participant VerificationContext
participant GITHUB_OUTPUT
VerificationMode->>VerificationContext: Provide verdict, admission, and evidence
VerificationContext->>VerificationContext: Canonicalize and hash context data
VerificationContext->>GITHUB_OUTPUT: Emit verdict, admission, and proof_ref
VerificationContext->>GITHUB_OUTPUT: Emit serialized verification_context for selected formats
Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:M
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@action_entrypoint.py`:
- Around line 108-112: Update action_entrypoint.py lines 108-112 in
action_verify’s client-error path to publish BLOCKED, DENY, and an empty
proof_ref before exiting. At lines 191-195, 268-272, and 321-325, record
secret-scan, syntax/scan, and shell-scan read failures respectively, then ensure
final verdict generation emits BLOCKED and DENY with an empty proof_ref whenever
any failure occurred, rather than certifying partial findings as VERIFIED/ADMIT.
- Around line 511-513: Update the formal_statement construction in the result
object to derive its wording from both scan_type and verdict. Name the specific
verification mode (security, math, logic, code, or process integrity) and
accurately reflect whether the result passed or was denied, avoiding a universal
security-scan success message.
- Around line 396-400: Update the process evidence flow around _set_vc_outputs
so proof_ref is generated from the exact evidence object containing irac_score
and process_rate, using canonical deterministic serialization. Ensure
authorized/VERIFIED output is emitted only when this evidence-derived proof_ref
is non-empty, while unauthorized behavior remains unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 79d0e357-c954-40f6-bd5b-fa4bad8e9e99
📒 Files selected for processing (1)
action_entrypoint.py
Greptile SummaryThis change adds Verification Context v1.0 outputs across the action modes. Executed clean and finding-producing code-scan runs confirmed that verified contexts use a canonical content-bound proof reference, denied contexts use DENY with a null in-document proof reference, and the formal statement reflects the outcome. Confidence Score: 5/5No blocking failure remains. No accepted P0 or P1 findings remain. Reviews (4): Last reviewed commit: "fix: use is_verified and result dict for..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
- proof_ref now computed from full VC payload (formal_statement + context) excluding only context.evidence.proof_ref, per spec - formal_statement now reflects actual verdict (passed/detected/blocked) - proof_ref is null (not empty string) for UNVERIFIABLE/BLOCKED verdicts - process mode proof_ref binds irac_score and process_rate evidence - scan modes bind findings_count evidence, not just count - removed ad-hoc proof_ref hashing from all callers
…ify mode - proof_ref now computed using _canonical_json (RFC 8785-compatible) instead of json.dumps, ensuring Unicode evidence resolves correctly - paths key omitted from configuration when PATHS env var is not set (e.g., action_verify mode), avoiding false directory-scan claims
|
CodeRabbit (@coderabbitai) review |
|
- VerificationResult from qwed_sdk.models has is_verified, not verified - explanation is in result.result dict, not a direct attribute - fixes AttributeError crash in action_verify mode
|
1 participant
Closes QWED-AI/qwed-verification-action#9.
Adds Verification Context v1.0 output support to the Docker action entrypoint.
Changes
_build_verification_context()helper that builds a VC v1.0 document_set_vc_outputs()helper that setsverdict,admission,proof_ref, andverification_contextoutputs viaGITHUB_OUTPUTverify,scan-secrets,scan-code,verify-shell,verify-process) to emit VC v1.0 outputsverification_contextoutput is emitted whenoutput_format=verification-contextoroutput_format=jsonVC v1.0 contract
verdictVERIFIED/UNVERIFIABLE/BLOCKEDadmissionADMIT/DENYproof_refsha256:<64-hex>or emptyverification_contextverifiedtrueonly whenverdict=VERIFIEDandadmission=ADMITFail-closed
UNVERIFIABLE/BLOCKEDalways produceadmission: DENYproof_refis empty when notVERIFIEDRelated
CodeAnt-AI Description
Emit Verification Context v1.0 results from every Docker action mode
What Changed
verification-contextorjson, including scan evidence and configuration details.Impact
✅ Consistent results across all action modes✅ Fail-closed admission decisions for findings✅ Machine-readable verification evidence💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
New Features