Audit panic paths, split config domains, and align release metadata (#37)

* fix: harden parser panic paths

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

* refactor: group config domains and trim path modules

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

* fix: align release metadata with tagged version

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

* build: pin jsonwebtoken for Rust 1.83

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

* build: pin Rust toolchain for current deps

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

* build: raise pinned Rust toolchain to 1.88

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

* Preserve zero hunk line counts

* fix(ci): release.yml YAML parse + clippy uninlined_format_args

- release: use python3 -c one-liners for version check (avoid heredoc that actionlint parses as YAML)
- Apply clippy uninlined_format_args fixes across codebase for lint job

Made-with: Cursor

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>
Co-authored-by: Jonathan Haas <jonathan@haas.holdings>

Author: 3 people

.github/workflows/release.yml

@@ -28,6 +28,23 @@ jobs:
       - name: Extract version
         id: get_version
         run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Verify release metadata matches tag
+        env:
+          TAG_NAME: ${{ steps.get_version.outputs.VERSION }}
+        run: |
+          set -euo pipefail
+          expected_version="${TAG_NAME#v}"
+          cargo_version="$(python3 -c "import tomllib; from pathlib import Path; print(tomllib.loads(Path('Cargo.toml').read_text())['package']['version'])")"
+          chart_app_version="$(python3 -c "import re; from pathlib import Path; c=Path('charts/diffscope/Chart.yaml').read_text(); m=re.search(r'^appVersion:\s*\"?(.*?)\"?\s*\$', c, re.MULTILINE); (exit('Chart.yaml missing appVersion') if not m else print(m.group(1)))")"
+          test "$cargo_version" = "$expected_version" || {
+            echo "Cargo.toml version ($cargo_version) does not match tag ($expected_version)"
+            exit 1
+          }
+          test "$chart_app_version" = "$expected_version" || {
+            echo "Chart appVersion ($chart_app_version) does not match tag ($expected_version)"
+            exit 1
+          }
         
       - name: Create Release
         id: create_release
@@ -264,4 +281,4 @@ jobs:
       - name: Upload SBOM to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.ref_name }} sbom-diffscope.spdx.json --clobber || true
+        run: gh release upload ${{ github.ref_name }} sbom-diffscope.spdx.json --clobber || true

charts/diffscope/Chart.yaml

@@ -3,7 +3,7 @@ name: diffscope
 description: AI-powered code review engine with smart analysis and professional reporting
 type: application
 version: 0.1.0
-appVersion: "0.5.3"
+appVersion: "0.5.26"
 home: https://github.com/evalops/diffscope
 sources:
   - https://github.com/evalops/diffscope

eval/dag-runtime-smoke-or.json

@@ -2195,4 +2195,4 @@
       ]
     }
   ]
-}
+}

eval/frontier-e2e-or.json

@@ -9981,4 +9981,4 @@
       ]
     }
   ]
-}
+}

eval/frontier-smoke-or.json

@@ -5904,4 +5904,4 @@
       ]
     }
   ]
-}
+}

src/adapters/anthropic.rs

@@ -407,8 +407,7 @@ mod tests {
         let err_msg = format!("{:#}", result.unwrap_err());
         assert!(
             err_msg.contains("401") || err_msg.contains("Unauthorized"),
-            "Error should mention 401 or Unauthorized, got: {}",
-            err_msg
+            "Error should mention 401 or Unauthorized, got: {err_msg}"
         );
         mock.assert_async().await;
     }
@@ -502,8 +501,7 @@ mod tests {
         let err = result.unwrap_err().to_string();
         assert!(
             err.contains("Unsupported content type"),
-            "Error should mention unsupported type, got: {}",
-            err
+            "Error should mention unsupported type, got: {err}"
         );
     }
 
@@ -534,8 +532,7 @@ mod tests {
         let err = result.unwrap_err().to_string();
         assert!(
             err.contains("empty content"),
-            "Error should mention empty content: {}",
-            err
+            "Error should mention empty content: {err}"
         );
     }
 

src/adapters/ollama.rs

@@ -211,11 +211,10 @@ mod tests {
     fn chat_response_body(content: &str, model: &str, done: bool) -> String {
         format!(
             r#"{{
-                "message": {{"role": "assistant", "content": "{}"}},
-                "model": "{}",
-                "done": {}
-            }}"#,
-            content, model, done
+                "message": {{"role": "assistant", "content": "{content}"}},
+                "model": "{model}",
+                "done": {done}
+            }}"#
         )
     }
 
@@ -227,13 +226,12 @@ mod tests {
     ) -> String {
         format!(
             r#"{{
-                "message": {{"role": "assistant", "content": "{}"}},
-                "model": "{}",
+                "message": {{"role": "assistant", "content": "{content}"}},
+                "model": "{model}",
                 "done": true,
-                "prompt_eval_count": {},
-                "eval_count": {}
-            }}"#,
-            content, model, prompt_eval, eval
+                "prompt_eval_count": {prompt_eval},
+                "eval_count": {eval}
+            }}"#
         )
     }
 

src/adapters/openai.rs

@@ -771,8 +771,7 @@ mod tests {
         let err_msg = format!("{:#}", result.unwrap_err());
         assert!(
             err_msg.contains("401") || err_msg.contains("Unauthorized"),
-            "Error should mention 401 or Unauthorized, got: {}",
-            err_msg
+            "Error should mention 401 or Unauthorized, got: {err_msg}"
         );
         mock.assert_async().await;
     }
@@ -814,8 +813,7 @@ mod tests {
         let err_msg = format!("{:#}", result.unwrap_err());
         assert!(
             err_msg.contains("429") || err_msg.contains("Rate limited"),
-            "Error should mention rate limiting, got: {}",
-            err_msg
+            "Error should mention rate limiting, got: {err_msg}"
         );
         mock.assert_async().await;
     }
@@ -866,8 +864,7 @@ mod tests {
         let err = result.unwrap_err().to_string();
         assert!(
             err.contains("empty choices"),
-            "Error should mention empty choices: {}",
-            err
+            "Error should mention empty choices: {err}"
         );
     }
 

src/commands/doctor/command/display/config.rs

@@ -27,17 +27,14 @@ pub(in super::super) fn print_configuration(config: &Config) {
         }
     );
     if let Some(cw) = config.context_window {
-        println!("  Context:  {} tokens", cw);
+        println!("  Context:  {cw} tokens");
     }
     println!();
 }
 
 pub(in super::super) fn print_unreachable(base_url: &str) -> Result<()> {
     println!("UNREACHABLE");
-    println!(
-        "\nCannot reach {}. Make sure your LLM server is running.",
-        base_url
-    );
+    println!("\nCannot reach {base_url}. Make sure your LLM server is running.");
     println!("\nQuick start:");
     println!("  Ollama:    ollama serve");
     println!("  vLLM:      vllm serve <model>");

src/commands/doctor/command/display/endpoint.rs

@@ -1,7 +1,7 @@
 use crate::core::offline::LocalModel;
 
 pub(in super::super) fn print_endpoint_models(endpoint_type: &str, models: &[LocalModel]) {
-    println!("\nEndpoint type: {}", endpoint_type);
+    println!("\nEndpoint type: {endpoint_type}");
     println!("\nAvailable models ({}):", models.len());
     if models.is_empty() {
         println!("  (none found)");
@@ -25,7 +25,7 @@ fn format_model_size_info(model: &LocalModel) -> String {
         + &model
             .quantization
             .as_ref()
-            .map(|quantization| format!(", {}", quantization))
+            .map(|quantization| format!(", {quantization}"))
             .unwrap_or_default()
         + ")"
 }