feat(tcfeed): make the ask short enough to read, and true - #139
Merged
Conversation
"too much to process, obviously ai generated we are not doing this" Both halves of that were right. The issue and request together ran to 1,122 words for a two-file CI change, sent unsolicited to a stranger, and they were written by an AI. Arguing at length with someone who said it was too long only proves the point, so this sends less instead. before 1,122 words 7,042 characters after 330 words 2,443 characters and the 330 includes the dry-run framing and the diffstat; the text actually sent is about 110 words for the issue and 150 for the request. Gone: the CodeQL comparison, the permissions paragraph, the narrative about why pinning matters, and the demo block. The demo was the largest single piece and the one most likely to read as a threat — it reported 353 findings and 3 criticals against a repository nobody had asked us to scan. Its own docstring worried about becoming exactly that. Everything it claimed is still checkable in the diff, which is where it belongs. Two things added rather than cut: The scope is now stated. Every one of sixty-nine requests said the workflow "scans the diff". scanPath is ".", so it scans the whole checked-out repository. SAG asked for that correction and they were reading the same false sentence everyone else was. The AI assistance is disclosed. It is true, it is checkable, and a maintainer who works it out for themselves is entitled to be annoyed. Some will decline on the disclosure alone; that is a fair trade for not having it discovered later. Also says that an install or scan failure fails the job, which the old body left to be inferred from "report-only". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan69 finding(s) HIGH/CRITICAL: 12 | MEDIUM: 56 | LOW: 1
…and 19 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both halves of that were right. The issue and request together ran to 1,122 words for a two-file CI change, sent unsolicited to a stranger — and they were written by an AI. Arguing at length with someone who said it was too long only proves the point, so this sends less instead.
The 330 includes the dry-run framing and the diffstat; the text actually sent is about 110 words for the issue and 150 for the request.
Cut
The CodeQL comparison, the permissions paragraph, the narrative about why pinning matters, and the demo block.
The demo was the largest single piece and the one most likely to read as a threat — it reported 353 findings and 3 criticals against a repository nobody had asked us to scan. Its own docstring worried about becoming exactly that. Everything it claimed is still checkable in the diff, which is where it belongs.
Added rather than cut
The scope is now stated. Every one of 69 requests said the workflow "scans the diff".
scanPathis"."— it scans the whole checked-out repository. SAG asked for that correction, and they were reading the same false sentence everyone else was.The AI assistance is disclosed. It's true, it's checkable, and a maintainer who works it out for themselves is entitled to be annoyed. Some will decline on the disclosure alone; that's a fair trade for not having it discovered later.
Also states that an install or scan failure does fail the job — the old body left that to be inferred from "report-only".
Result
Net −200 lines. Verified by rendering a dry run.
🤖 Generated with Claude Code