fix: address PR hardening annotations

Dominikus Nold · Dominikus Nold · commit 7ff643aea58b · 2026-06-13T01:53:33.000+02:00
diff --git a/.github/workflows/pr-orchestrator.yml b/.github/workflows/pr-orchestrator.yml
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,17 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.47.8] - 2026-06-13
+
+### Fixed
+
+- **PR hardening follow-up**: address PR review annotations and failing CI by
+  pinning orchestrator actions to immutable SHAs, preserving precise coverage
+  threshold comparisons, making Semgrep SAST result parsing fail closed, and
+  normalizing versioned dependency constraints before dedupe.
+
+---
+
 ## [0.47.7] - 2026-06-12
 
 ### Fixed
diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specfact-cli"
-version = "0.47.7"
+version = "0.47.8"
 description = "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, and spec/contract evidence for AI-assisted and brownfield delivery."
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/scripts/check_version_sources.py b/scripts/check_version_sources.py
@@ -83,7 +83,7 @@ def _changed_files_vs_git_ref(root: Path, git_ref: str) -> list[str]:
 def _is_packaged_artifact(path_str: str) -> bool:
     """True when staged paths imply a release/version bump must accompany the commit."""
     normalized = path_str.replace("\\", "/")
-    if normalized in {"pyproject.toml", "setup.py"}:
+    if normalized == "setup.py":
         return True
     if normalized.startswith("src/"):
         return True
@@ -93,6 +93,24 @@ def _is_packaged_artifact(path_str: str) -> bool:
     return normalized.startswith("resources/")
 
 
+def _candidate_requires_versioning(
+    root: Path,
+    candidate_files: set[str],
+    compare_ref: str,
+    current_version: str,
+) -> bool:
+    """Return whether changed files imply a package version/changelog bundle."""
+    for path in candidate_files:
+        normalized = path.replace("\\", "/")
+        if normalized == "pyproject.toml":
+            if _version_bumped_vs_git_ref(root, current_version, compare_ref):
+                return True
+            continue
+        if _is_packaged_artifact(normalized):
+            return True
+    return False
+
+
 def _parse_semver(version: str) -> tuple[int, int, int] | None:
     match = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)", version.strip())
     if match is None:
@@ -255,9 +273,9 @@ def main(argv: list[str] | None = None) -> int:
         sys.stderr.write(_REMEDIATION)
         return 1
 
-    if any(_is_packaged_artifact(path) for path in candidate_files):
+    compare_ref = changed_vs_ref if changed_vs_ref else "HEAD"
+    if _candidate_requires_versioning(root, candidate_files, compare_ref, unique[0]):
         required_files = changed_files if changed_files else staged_files
-        compare_ref = changed_vs_ref if changed_vs_ref else "HEAD"
         return _enforce_packaged_artifact_versioning(root, required_files, unique[0], compare_ref)
     return 0
 
diff --git a/scripts/semgrep_sast_gate.py b/scripts/semgrep_sast_gate.py
@@ -6,21 +6,37 @@
 import argparse
 import json
 import sys
+from collections.abc import Mapping
 from pathlib import Path
-from typing import Any
+from typing import Any, cast
+
+from beartype import beartype
+from icontract import ensure
 
 
 FindingKey = tuple[str, str, int]
 
 
 def _finding_key(result: dict[str, Any]) -> FindingKey:
-    check_id = str(result.get("check_id", ""))
-    path = str(result.get("path", ""))
-    start_raw = result.get("start", {})
-    start_line = int(start_raw.get("line", 0)) if isinstance(start_raw, dict) else 0
+    check_id = result.get("check_id")
+    path = result.get("path")
+    start = result.get("start")
+    if not isinstance(check_id, str) or not check_id.strip():
+        raise ValueError("Semgrep result missing non-empty check_id")
+    if not isinstance(path, str) or not path.strip():
+        raise ValueError("Semgrep result missing non-empty path")
+    if not isinstance(start, dict):
+        raise ValueError("Semgrep result missing integer start.line")
+    start_line = cast(Mapping[str, object], start).get("line")
+    if not isinstance(start_line, int):
+        raise ValueError("Semgrep result missing integer start.line")
     return (check_id, path, start_line)
 
 
+def _emit_stdout(message: str) -> None:
+    sys.stdout.write(f"{message}\n")
+
+
 def _load_json(path: Path) -> dict[str, Any]:
     try:
         payload = json.loads(path.read_text(encoding="utf-8"))
@@ -56,9 +72,20 @@ def _load_results(path: Path) -> list[dict[str, Any]]:
     raw_results = payload.get("results")
     if not isinstance(raw_results, list):
         raise SystemExit(f"::error::{path} missing Semgrep results list")
-    return [result for result in raw_results if isinstance(result, dict)]
-
-
+    results: list[dict[str, Any]] = []
+    for index, result in enumerate(raw_results):
+        if not isinstance(result, dict):
+            raise SystemExit(f"::error::{path} results[{index}] must be an object")
+        try:
+            _finding_key(result)
+        except ValueError as exc:
+            raise SystemExit(f"::error::{path} results[{index}] is malformed: {exc}") from exc
+        results.append(result)
+    return results
+
+
+@beartype
+@ensure(lambda result: result in {0, 1}, "exit code must be 0 or 1")
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--results", type=Path, required=True, help="Semgrep JSON results file")
@@ -71,15 +98,15 @@ def main() -> int:
     new_findings = sorted(current - baseline)
     resolved_findings = sorted(baseline - current)
 
-    print(f"Semgrep SAST findings: {len(current)} current, {len(baseline)} accepted baseline")
+    _emit_stdout(f"Semgrep SAST findings: {len(current)} current, {len(baseline)} accepted baseline")
     if resolved_findings:
-        print(f"Semgrep SAST baseline can shrink by {len(resolved_findings)} finding(s)")
+        _emit_stdout(f"Semgrep SAST baseline can shrink by {len(resolved_findings)} finding(s)")
     if not new_findings:
-        print("Semgrep SAST gate passed: no new findings outside baseline")
+        _emit_stdout("Semgrep SAST gate passed: no new findings outside baseline")
         return 0
 
     for check_id, path, line in new_findings:
-        print(f"::error file={path},line={line}::New Semgrep SAST finding: {check_id}")
+        _emit_stdout(f"::error file={path},line={line}::New Semgrep SAST finding: {check_id}")
     return 1
 
 
diff --git a/scripts/sign-module.sh b/scripts/sign-module.sh
@@ -168,7 +168,11 @@ if changed or untracked:
 PY
 fi
 
-python3 scripts/sign-modules.py "${ARGS[@]}" "$MANIFEST"
+if [[ "${#ARGS[@]}" -gt 0 ]]; then
+  python3 scripts/sign-modules.py "${ARGS[@]}" "$MANIFEST"
+else
+  python3 scripts/sign-modules.py "$MANIFEST"
+fi
 
 # Emit checksum line for legacy pipeline compatibility.
 python3 - "$MANIFEST" <<'PY'
diff --git a/setup.py b/setup.py
@@ -7,7 +7,7 @@
 if __name__ == "__main__":
     _setup = setup(
         name="specfact-cli",
-        version="0.47.7",
+        version="0.47.8",
         description=(
             "AI-bloat defense CLI for Python teams. Run deterministic code review, cleanup forecasts, "
             "and spec/contract evidence for AI-assisted and brownfield delivery."
diff --git a/src/__init__.py b/src/__init__.py
@@ -3,4 +3,4 @@
 """
 
 # Package version: keep in sync with pyproject.toml, setup.py, src/specfact_cli/__init__.py
-__version__ = "0.47.7"
+__version__ = "0.47.8"
diff --git a/src/specfact_cli/__init__.py b/src/specfact_cli/__init__.py
@@ -76,6 +76,6 @@ def _install_progressive_disclosure() -> None:
 # keeps missing-command and missing-parameter UX consistent outside the root CLI too.
 _install_progressive_disclosure()
 
-__version__ = "0.47.7"
+__version__ = "0.47.8"
 
 __all__ = ["__version__"]
diff --git a/src/specfact_cli/registry/dependency_resolver.py b/src/specfact_cli/registry/dependency_resolver.py
@@ -132,8 +132,9 @@ def _collect_constraints(modules: list[ModulePackageMetadata]) -> list[str]:
                 constraints.append(normalized)
                 seen.add(normalized)
         for vd in meta.pip_dependencies_versioned or []:
-            spec = vd.version_specifier or ""
-            s = f"{vd.name}{spec}" if spec else vd.name
+            name = vd.name.strip()
+            spec = (vd.version_specifier or "").strip()
+            s = f"{name}{spec}" if spec else name
             normalized = s.strip()
             if normalized and normalized not in seen:
                 constraints.append(normalized)
diff --git a/src/specfact_cli/telemetry.py b/src/specfact_cli/telemetry.py
@@ -678,6 +678,11 @@ def test_telemetry_settings_from_env_property() -> None:
     assert isinstance(settings.opt_in_source, str)
 
 
+def _crosshair_temp_log_path() -> Path:
+    """Return a unique local telemetry log path for property tests."""
+    return Path(tempfile.gettempdir()) / f"test_telemetry-{uuid4().hex}.log"
+
+
 @beartype
 @require(lambda enabled: isinstance(enabled, bool), "enabled must be a bool")
 def test_telemetry_manager_init_property(enabled: bool) -> None:
@@ -686,7 +691,7 @@ def test_telemetry_manager_init_property(enabled: bool) -> None:
         enabled=enabled,
         endpoint=None,
         headers={},
-        local_path=Path(tempfile.gettempdir()) / "test_telemetry.log",
+        local_path=_crosshair_temp_log_path(),
         debug=False,
         opt_in_source="disabled",
     )
@@ -753,9 +758,7 @@ def test_telemetry_manager_normalize_value_property(value: Any) -> None:
 @require(lambda event: isinstance(event, Mapping), "event must be a Mapping")
 def test_telemetry_manager_write_local_event_property(event: Mapping[str, Any]) -> None:
     """CrossHair property test for TelemetryManager._write_local_event."""
-    manager = TelemetryManager(
-        TelemetrySettings(enabled=False, local_path=Path(tempfile.gettempdir()) / "test_telemetry.log")
-    )
+    manager = TelemetryManager(TelemetrySettings(enabled=False, local_path=_crosshair_temp_log_path()))
     # This test verifies the function doesn't raise exceptions
     # Actual file writing is tested in integration tests
     with suppress(OSError):  # Expected in some test environments
@@ -766,9 +769,7 @@ def test_telemetry_manager_write_local_event_property(event: Mapping[str, Any])
 @require(lambda event: isinstance(event, MutableMapping), "event must be a MutableMapping")
 def test_telemetry_manager_emit_event_property(event: MutableMapping[str, Any]) -> None:
     """CrossHair property test for TelemetryManager._emit_event."""
-    manager = TelemetryManager(
-        TelemetrySettings(enabled=False, local_path=Path(tempfile.gettempdir()) / "test_telemetry.log")
-    )
+    manager = TelemetryManager(TelemetrySettings(enabled=False, local_path=_crosshair_temp_log_path()))
     manager._emit_event(event)
     assert manager._last_event is not None
     assert isinstance(manager._last_event, dict)
@@ -784,9 +785,7 @@ def test_telemetry_manager_track_command_property(command: str, initial_metadata
     """CrossHair property test for TelemetryManager.track_command."""
     if not command or len(command) == 0:
         return  # Skip invalid inputs
-    manager = TelemetryManager(
-        TelemetrySettings(enabled=True, local_path=Path(tempfile.gettempdir()) / "test_telemetry.log")
-    )
+    manager = TelemetryManager(TelemetrySettings(enabled=True, local_path=_crosshair_temp_log_path()))
     try:
         with manager.track_command(command, initial_metadata) as record:
             assert callable(record)
diff --git a/tests/unit/registry/test_dependency_resolver_properties.py b/tests/unit/registry/test_dependency_resolver_properties.py
@@ -9,7 +9,7 @@
 
 from hypothesis import given, strategies as st
 
-from specfact_cli.models.module_package import ModulePackageMetadata
+from specfact_cli.models.module_package import ModulePackageMetadata, VersionedPipDependency
 from specfact_cli.registry import module_installer
 from specfact_cli.registry.dependency_resolver import _collect_constraints
 from specfact_cli.registry.module_installer import _dependency_version_satisfies, _extract_bundle_dependency_specs
@@ -40,6 +40,22 @@ def test_collect_constraints_dedupes_after_trimming(raw_names: list[str]) -> Non
     assert constraints == list(dict.fromkeys(name.strip() for name in pip_dependencies if name.strip()))
 
 
+@given(PACKAGE_NAMES, st.sampled_from([">=1.0.0", "<2.0.0", "==1.2.3"]))
+def test_collect_constraints_dedupes_versioned_after_trimming(name: str, specifier: str) -> None:
+    """Whitespace variants of versioned dependencies collapse to one canonical constraint."""
+    metadata = ModulePackageMetadata(
+        name="property-module",
+        version="0.1.0",
+        commands=["property"],
+        pip_dependencies_versioned=[
+            VersionedPipDependency(name=f" {name} ", version_specifier=f" {specifier} "),
+            VersionedPipDependency(name=name, version_specifier=specifier),
+        ],
+    )
+
+    assert _collect_constraints([metadata]) == [f"{name}{specifier}"]
+
+
 @given(PACKAGE_NAMES, SPECIFIERS)
 def test_bundle_dependency_specs_accept_string_and_object_forms(name: str, specifier: str) -> None:
     """Registry bundle dependencies support legacy strings and versioned objects."""
diff --git a/tests/unit/scripts/test_check_version_sources.py b/tests/unit/scripts/test_check_version_sources.py
@@ -219,6 +219,34 @@ def test_check_version_sources_changed_vs_detects_ci_packaged_artifact_change_wi
     assert "missing staged version file" in completed.stderr
 
 
+def test_check_version_sources_changed_vs_allows_pyproject_tooling_edit_without_release_bundle(
+    tmp_path: Path,
+) -> None:
+    """CI mode must not require a release bundle for pyproject tooling-only edits."""
+    script = _copy_version_script(tmp_path)
+    _write_canonical_version_files(tmp_path, "1.2.3")
+    (tmp_path / "CHANGELOG.md").write_text("## [1.2.3] - 2026-04-16\n\n- Initial release entry.\n", encoding="utf-8")
+    _init_git_repo(tmp_path)
+    subprocess.run(["git", "add", "."], cwd=tmp_path, check=True, capture_output=True, text=True)
+    subprocess.run(["git", "commit", "-m", "initial"], cwd=tmp_path, check=True, capture_output=True, text=True)
+
+    pyproject = tmp_path / "pyproject.toml"
+    pyproject.write_text(pyproject.read_text(encoding="utf-8") + 'semgrep-sast = "semgrep scan"\n', encoding="utf-8")
+    subprocess.run(["git", "add", "pyproject.toml"], cwd=tmp_path, check=True, capture_output=True, text=True)
+    subprocess.run(
+        ["git", "commit", "-m", "tooling pyproject edit"], cwd=tmp_path, check=True, capture_output=True, text=True
+    )
+
+    completed = subprocess.run(
+        [sys.executable, str(script), "--changed-vs", "HEAD~1"],
+        cwd=str(tmp_path),
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed.returncode == 0, completed.stderr
+
+
 def test_check_version_sources_changed_vs_passes_with_version_bundle_and_changelog(
     tmp_path: Path,
 ) -> None:
diff --git a/tests/unit/scripts/test_semgrep_sast_gate.py b/tests/unit/scripts/test_semgrep_sast_gate.py
@@ -0,0 +1,45 @@
+"""Tests for the Semgrep SAST baseline gate."""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+from types import ModuleType
+from typing import Any
+
+import pytest
+
+
+def _load_gate_module() -> ModuleType:
+    script = Path(__file__).resolve().parents[3] / "scripts" / "semgrep_sast_gate.py"
+    spec = importlib.util.spec_from_file_location("semgrep_sast_gate", script)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+GATE: Any = _load_gate_module()
+
+
+def test_load_results_fails_closed_on_non_object_result(tmp_path: Path) -> None:
+    """Malformed Semgrep result entries must not be silently dropped."""
+    results = tmp_path / "semgrep.json"
+    results.write_text(json.dumps({"results": ["not-an-object"]}), encoding="utf-8")
+
+    with pytest.raises(SystemExit) as exc_info:
+        GATE._load_results(results)
+
+    assert "results[0] must be an object" in str(exc_info.value)
+
+
+def test_load_results_fails_closed_on_missing_required_fields(tmp_path: Path) -> None:
+    """Missing Semgrep identity fields must fail the gate."""
+    results = tmp_path / "semgrep.json"
+    results.write_text(json.dumps({"results": [{"check_id": "rule", "path": "file.py"}]}), encoding="utf-8")
+
+    with pytest.raises(SystemExit) as exc_info:
+        GATE._load_results(results)
+
+    assert "missing integer start.line" in str(exc_info.value)
diff --git a/tests/unit/specfact_cli/registry/test_signing_artifacts.py b/tests/unit/specfact_cli/registry/test_signing_artifacts.py
diff --git a/tests/unit/workflows/test_trustworthy_green_checks.py b/tests/unit/workflows/test_trustworthy_green_checks.py
