Repository navigation
build: make the unused-state rules precise enough to gate - #1307
Merged
Merged
Conversation
- XSB076 takes an allowlist of table.column=reason entries: audit history people read through audit exports, and mirror columns whose reader comes with the UI epic. - XSB077 takes Enum or Enum::Variant exceptions with reasons for serde wire enums and variants written as SQL text, and construction_required enums whose variants count only where code builds them as a value, so a permission named only in role tables and classifiers is reported. - An entry without a reason, or one that no longer hides anything in a tree that defines its table or enum, is reported too.
Require fensu 0.29.0 and run `fensu dupes --since <base> --fail-on-new` from check-ci. A new cluster prints a warning and does not fail the build until it becomes a gate. CI fetches the pull request base so the shallow checkout can diff against it.
kvlonge
enabled auto-merge (squash)
November 5, 2026 05:45
The UI's sample-row reads will require view.evidence, so XSB077 excepts Action::ViewEvidence with that reason instead of reporting it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
XSB076 (unread control-store state) and XSB077 (unconstructed enum variants) shipped in warn mode. Before they can gate, each needs a way to record intentional cases with a written reason, and XSB077 must not count a variant as used just because a lookup table or comparison names it. The new-duplicate check from fensu 0.29.0 also needs wiring, in warn mode until it becomes a gate.
Changes
allowed = ["table.column=reason", ...]. It covers audit-history columns that people query directly and the typed mirror columns the UI will filter on, marked "reader comes with the UI epic". XSB077 excepts the evidence-view permission for the same reason.exceptions = ["Enum" or "Enum::Variant=reason", ...]for serde wire enums and variants written as SQL text. It also readsconstruction_required = ["Enum=reason"]for enums whose variants count only when a value is constructed; const tables,use, patterns,matches!and==/!=do not count.Action(permissions) uses this.make check-cirunsfensu dupes --since <base> --fail-on-new; a new cluster prints a warning and does not fail. CI fetches the pull request base for the diff.Verification
pytest tests/unit/scripts/fensu_policy: passes; mutations of each new matcher fail a test.fensu check --warnon main: 0 faults, 3 XSB077 warnings, all likely-real unused variants.make check-dupes-newwith a copied function reports the cluster and exits 0; with a missing base it skips with a warning.make check-cipasses.