fix(ci): resolve hosted script analysis and transitive license gates #26
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/AppKit#26
Reference in new issue
Block a user
Problem
AppKit draft PR #25 exposes two hosted script/dependency gate failures at
bbf7efd. Run 38093013716 crashes inside PSScriptAnalyzer 1.25.0 recursive analysis with a NullReferenceException. An unchanged full-rule analysis of all nine PowerShell files individually passes locally. Run 38093014202 rejects ESLint's development-only transitive uri-js 4.4.1, whose actual LICENSE includes the BSD views sentence. No vulnerable packages were detected.Acceptance criteria
Evidence and boundaries
https://github.com/KofTwentyTwo/AppKit/actions/runs/38093013716
https://github.com/KofTwentyTwo/AppKit/actions/runs/38093014202
https://github.com/garycourt/uri-js/blob/master/LICENSE
https://spdx.org/licenses/BSD-2-Clause-Views.html
A proposed exemption is not an approved exception. No allowlist broadening, gate bypass, merge, release or settings change is authorized by this issue. Substantial implementation/diagnosis assistance: Codex (GPT-6).
The authorized topic branches are now pushed and draft PRs are open:
09f9e0777e)Shared signing run 38093017631 completed successfully, including Windows signing tests, conformance, docs, CodeQL, security and PR gates. These are preparation tests, not proof of Azure authentication or real signatures.
AppKit's initial hosted run passed build-test, UI, JavaScript and security checks. It exposed a pinned analyzer recursive-analysis crash and uri-js development-license policy rejection, now tracked in #26. A signed, reviewed correction checks all nine PowerShell files separately with unchanged rules; all pass locally, and current-head hosted validation is running. The license failure remains enforced pending a recorded policy exception.
Both PRs remain drafts. Owner review acknowledgement, review-gate/settings bootstrap, shared publication/consumer adoption, public starter rollout and actual AppKit signing remain required where applicable. Push/draft approval did not authorize merge, release, repository creation, settings or Azure login retry.
The PowerShell correction at
09f9e07is verified on GitHub: run 38093180400 succeeds, including all 40 Pester cases (zero failed/skipped) and unchanged full-rule file-by-file analysis. JavaScript lint/tests/package-signature verification also succeeds.The remaining dependency-review failure requires policy review. A separate local standards branch docs/appkit-tooling-license has signed/DCO commit cd20e945bd9809745d4d872ae29dd2496b5a9644, proposing EX-0009 only for development-only uri-js 4.4.1 in AppKit. One-file review, Markdown and applicable hooks pass. It is unpushed; proposal status and caller gate stay unchanged until reviewed approval through the published process. Nothing exempts vulnerability checks or other licenses.
This is additional to the two authorized draft PRs; a third push/draft PR needs separate authorization. #26 remains open for license-policy and exact-head acceptance; #7 remains open for required-context activation and starter hosted propagation.
Owner approved the separate proposal push/draft PR. Opened https://github.com/KofTwentyTwo/standards/pull/32 at cd20e945bd9809745d4d872ae29dd2496b5a9644, targeting main as a draft. Run 38093461441 is in progress; docs/internal-link, conformance, dependency-review, title/DCO, secrets and workflow checks have passed.
EX-0009 remains Proposed. This push approval does not approve the exception or activate a caller exemption. AppKit's dependency license gate still fails; all vulnerability/SCA checks stay enforced. Review/mark Open through the normal register process is required before separately enabling the exact-version exemption.
AppKit #25 current build, format, UI, scripts (40 cases), security and Actions/JavaScript CodeQL pass. C# manual build has completed; analysis is running. Shared signing #31 is fully green. No merge, release, repository/settings or Azure changes occurred.
Final hosted checkpoint:
09f9e0777e: build-test, format, WinUI/WPF UI, PowerShell (40/40), JavaScript/review tests, title/DCO, security and all three CodeQL language checks succeed. CodeQL run 38093181044 is completed SUCCESS. The only failed check is dependency-review's uri-js tooling-license policy rejection.No CI job is still pending. License-policy acceptance remains unresolved: EX-0009 is Proposed, not Open/approved, and no caller exemption is enabled. Both the exact-version exception and any eventual caller correction need the normal reviewed process and updated current-head acknowledgement. No gate was weakened to obtain these results.
All three branches were pushed with explicit approval and remain drafts. No merge, release, starter creation/push, settings or Azure mutation/login retry occurred. Hosted results do not prove actual AppKit Azure signing, production feeds or full standards compliance. Scoped implementation/tests are verified; broader acceptance tickets remain open.
Committed starter d8cea35cdf971ae327d69adc7ab222a1e7d891e3 (signed/DCO): the bootstrap plan now requires GitHub's actual standalone job names installed-updates, powershell and javascript; the template source additionally requires template. Generated apps omit that source-only packaging gate.
A new regression reads standalone job names from the actual ci.yml/scripts.yml workflows. It failed against the old plan (13 passed, one failed), then passed after correction. The source and both renamed, custom-owner variants generated from the real packed template each pass all 41 script tests. No manual synchronization of generated files. Source/generated workflow syntax and offline security, docs, Node seven-case review tests/ESLint and applicable commit hooks pass. Generated policies contain 16 actual contexts; source has 17.
Propagated AppKit's full-rule file-by-file analyzer workflow. Individual source/generated checks pass, but the pinned analyzer still occasionally crashes internally before emitting findings; file-by-file execution is not a proven complete cure. No rule/error suppression or retry wrapper is added. #26 remains open for that tool stability and license acceptance. Earlier complete installed runtime evidence covers unchanged UI/application code; this commit changes only administration/tests/docs and the analysis job.
Live disposable-repository setup and hosted starter gates still require public rollout/settings authorization. #10 remains open against that deployed acceptance requirement. Original sibling checkout is preserved; starter topic branch has no origin and has not been pushed.
Follow-up at signed starter commit e93f7ca9a5602355b5ac37d02313326f10227109:
The first fresh CLI acceptance stopped before installation because the harness required a space after the version, accidentally requiring SourceLink metadata. The valid output outside a Git checkout was
Public API true 0.1.0. Fixed the assertion to require the complete version token at line end with optional parenthesized metadata. The old assertion fails the retained no-metadata regression; the fixed suite passes 46/46 with zero failures/skips. Incorrect/extended version tokens still fail. Original failed fixture/logs remain retained; a fresh final CLI template is generated for sequential acceptance after the GUI run.Analyzer limitation: captured an actual PSScriptAnalyzer 1.25.0 / PowerShell 7.6.6 exception in
CommandInfo.get_Parameterscalled byUseCorrectCasing.AnalyzeScript. The pinned upstream rule source has a runspace-affinity fallback for InvalidOperationException; our captured exception is NullReferenceException. This narrows the failure but does not establish its complete cause or a cure. Pre-initializing command metadata did not prevent it. Failed diagnostic processes were scoped and stopped; no CI retry, disabled rule or suppressed error. The initial public-probe harness analysis passed before this follow-up; current changed-script full-rule analysis remains unverified because of the engine crash.GUI-only acceptance is running on the reserved desktop and has passed the first three 532-file portable/full byte gates. Public AppKit installed check/apply outcomes and final UI results remain pending. No issue closure, merge, release, Azure retry or live setting change.
Completed fresh public AppKit installed acceptance for both actual packed template variants:
The real shipped AppKit 0.1.0 public
CheckAsyncandDownloadAndApplyAsyncdrive these upgrades. Only offline transport is injected; actual backend/manager/locator/channel selection remains intact. Both results record successful public checks, apply calls, the target full-package URL, exact installed application SHA256, target manifest, a restarted window, and no remaining update offer. Stable/dev requests stay isolated. Both portable and full archives preserve all 532 original non-PDB publish files for each of four versions. Loose-build rejection and portable behavior pass. Both installations and each unique uninstall registry entry are confirmed removed.Retained evidence is in
~/.cache/AppKit-acceptance/2026-10-10/{public-api-false,public-api-final-cli}/artifacts/installed-public-appkit: results.json, three passing TRX files each, channel before/after JSON, installer/process logs and package byte evidence. GUI runtime source is c2b7b8c; CLI uses e93f7ca. Current signed starter head 49df4902d91d8e4c5e8f29cce9b4f6a2ba5c1a74 adds only the updated acceptance guide after those runtime tests. Source and final packed/renamed CLI script suites pass 46/46. Original metadata-free CLI failure and regression evidence remain retained.Desktop reservation has ended. No build/test process remains intentionally active.
Remaining limits: this proves offline public AppKit service integration, not a public GitHub release feed, interactive update-dialog check/apply, hosted starter CI, production Authenticode signing, deltas or non-x64 runtimes. No broad issue closure or complete compliance claim.
The analyzer exception is now matched to the still-open upstream PSScriptAnalyzer #1708. Latest published release is still 1.25.0. Current follow-up script analysis remains unverified; no error suppression, disabled rule or retry gate was introduced. AppKit #25 remains green except the enforced license policy; standards #31/#32 are green, and EX-0009 remains Proposed. Azure retry stays deferred; no merge/publication/settings/Azure change.