fix(audit): exclude virtualenv binaries from reconcile, serialize prompts#110
Merged
Conversation
…mpts make reconcile-all treated binaries inside an activated virtualenv (~/.venv/bin/black) as duplicate installations. classify_install_method fell through to 'is the tool in uv tool list' — true for a DIFFERENT install — so the removal ran uv tool uninstall and deleted the real uv tool while the venv copy survived, and the duplicate report never converged. Virtualenvs are environments, not installations; the shell layer (capability.sh) already skips them. - detect_installations now skips env bins: pyvenv.cfg next to bin/ (any env name), conda/virtualenvwrapper name patterns, and symlinks resolving into an env - serialize _confirm_removal with a lock: bulk_reconcile runs in a ThreadPool, so all prompts printed at once before any input was read Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
SonarCloud S5443 flags the /tmp path string even though the test never creates the file; use a neutral path. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two bugs from a real
make reconcile-allrun with an always-activated~/.venvon PATH:classify_install_methodhas no path rule for venv dirs and fell through to "tool appears inuv tool list" — true because a separate uv-tool install existed — so the venv copy was labeleduv, and removal-by-method ranuv tool uninstall, deleting the user's real uv tools (black, flake8, isort, bandit) while the venv copies survived. The duplicate report then never converged (make updatekept flagging 3 duplicates). Virtualenvs are environments, not installations —capability.sh:detect_all_installationsalready skips them;detect_installationsnow does too:pyvenv.cfgnext tobin/(catches any env name), conda/virtualenvwrapper name patterns, and symlinks resolving into an env.bulk_reconcileruns workers in a ThreadPool; every worker printed itsProceed with removal? [y/N]at once and the answers raced for stdin — it looked like "the script is not waiting for input"._confirm_removalis now serialized with a lock.Tests
tests/test_reconcile_venv.py(6 tests, red→green):.venv/binskipped,pyvenv.cfgdetection independent of dir name, condaenvs/*/binskipped, symlink-into-venv skipped, non-venv duplicates still detected, threaded prompt-interleaving reproduction (asserts strict prompt→input→prompt→input ordering)audit.py --reconcile --allon the affected machine now reports No duplicate installations detected (previously 3 phantom conflicts every run)