feat(serve): variant source-linkage slices a+b (REQ-265, DD-077)#717
Merged
Conversation
…s, no scope leak (REQ-265) DD-077 scopes REQ-265 (variant source-linkage completeness) into four independently-shippable slices. This lands the two small serve-side ones: Slice (a) — external source links are honest. `resolve_source_file` fell back to the raw absolute path for an external artifact (source_file outside the project root), producing a link the `/source` path-traversal guard then rejects: a dead link. Return None for out-of-project paths so the UI renders no link rather than a broken one. (Serving external source from a configured external root is a larger, security-sensitive follow-on, deferred.) Slice (b) — variant scope leak. The `/artifacts` external loop added externals without consulting `variant_scope`, so a variant-scoped view still showed unscoped externals. An external artifact has no binding to this project's feature model and cannot be variant-scoped, so under an active variant it is now excluded — mirroring the existing stats/diagnostics exclusion. Tests: three unit tests for `resolve_source_file` (in-project relative, external None, absent None); a serve integration test asserting `origin=all` includes the `spar:` externals but `origin=all&variant=minimal-ci` excludes every external-origin row. Slices (c) binding source-globs reach serve and (d) `export --variant` remain; REQ-265 stays proposed until all four land. Confirmed with the new tests, clippy --all-targets clean, rivet validate + docs check PASS. Serve only — composition core and wasm seam untouched. Refs: REQ-265, DD-077
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark 'Rivet Criterion Benchmarks'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.20.
| Benchmark suite | Current: 6778e94 | Previous: 2ff1c09 | Ratio |
|---|---|---|---|
traceability_matrix/1000 |
59265 ns/iter (± 506) |
44662 ns/iter (± 165) |
1.33 |
query/10000 |
326469 ns/iter (± 2999) |
229887 ns/iter (± 3997) |
1.42 |
This comment was automatically generated by workflow using github-action-benchmark.
📐 Rivet artifact delta
Graphgraph LR
DD_077["DD-077"]:::added
classDef added fill:#d4edda,stroke:#28a745,color:#155724
classDef removed fill:#f8d7da,stroke:#dc3545,color:#721c24
classDef modified fill:#fff3cd,stroke:#ffc107,color:#856404
classDef overflow fill:#e2e3e5,stroke:#6c757d,color:#495057,stroke-dasharray: 3 3
Added
Posted by |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
REQ-265 slices a+b — variant source-linkage (v0.29.0)
DD-077 scopes REQ-265 (variant source-linkage completeness) into four
independently-shippable slices. This PR lands the two small, serve-side ones;
(c) and (d) follow, so REQ-265 stays
proposed.Slice (a) — external source links are honest
resolve_source_filefell back to the raw absolute path for an externalartifact (source_file outside the project root), producing a link the
/sourcepath-traversal guard then rejects — a dead link. Now returnsNonefor out-of-project paths so the UI renders no link instead of a brokenone. (Serving external source from a configured external root is a larger,
security-sensitive follow-on — deferred.)
Slice (b) — variant scope leak
The
/artifactsexternal loop added externals without consultingvariant_scope, so a variant-scoped view still showed unscoped externals.An external has no binding to this project's feature model and cannot be
variant-scoped, so under an active variant it is now excluded — mirroring
the existing stats/diagnostics exclusion.
Tests
resolve_source_file(in-project → relative; external →None; absent → None).
origin=allincludes thespar:externals, butorigin=all&variant=minimal-ciexcludes every external-origin row.Verification
New tests pass ·
clippy --all-targets(1.97.0) clean ·rivet validate+docs checkPASS. Serve only — composition core and wasm seam untouched.Refs: REQ-265, DD-077
🤖 Generated with Claude Code