fix(langgraph): resolve summarizer PR workflow and CodeQL issues

Fix the ci_failure_summarizer template issues called out on PR #272 by making the local CLI example type-checkable, guarding nullable summary inserts, hardening image path serving, and cleaning the remaining template lint violations.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

agents/langgraph/templates/ci_failure_summarizer/main.py

@@ -35,6 +35,7 @@
 from langgraph.checkpoint.postgres import PostgresSaver
 from langgraph.checkpoint.postgres.aio import AsyncPostgresSaver
 from pydantic import BaseModel, Field
+from werkzeug.utils import safe_join
 
 logger = logging.getLogger(__name__)
 
@@ -639,11 +640,10 @@ async def playground():
 async def serve_image(filename: str):
     """Serve images from the project-level images directory."""
     base = _IMAGES_DIR.resolve()
-    file_path = (base / filename).resolve()
-    try:
-        file_path.relative_to(base)
-    except ValueError:
+    safe_path = safe_join(str(base), filename)
+    if safe_path is None:
         raise HTTPException(status_code=404, detail="Image not found")
+    file_path = Path(safe_path).resolve()
     if not file_path.is_file():
         raise HTTPException(status_code=404, detail="Image not found")
     return FileResponse(file_path)

agents/langgraph/templates/ci_failure_summarizer/src/ci_failure_summarizer/failure_evidence.py

@@ -20,6 +20,10 @@
     r"pytest\.fail\(|ERROR tests/|Process completed with exit code|During handling of the above exception",
     re.IGNORECASE,
 )
+_ROUTE_SERVER_NOT_FOUND_RE = re.compile(
+    r'routes\.route\.openshift\.io\s+"[^"]+"\s+not found',
+    re.IGNORECASE,
+)
 
 
 def _truncate_excerpt(text: str) -> str | None:
@@ -87,7 +91,7 @@ def _score_error_marker(marker: str) -> tuple[int, int]:
         score -= 100
     if "container_image" in lower:
         score += 120
-    if "routenotfounderror" in lower or "routes.route.openshift.io" in lower:
+    if "routenotfounderror" in lower or _ROUTE_SERVER_NOT_FOUND_RE.search(marker):
         score += 120
     if "error from server" in lower:
         score += 30

agents/langgraph/templates/ci_failure_summarizer/tests/test_github_client.py

@@ -7,6 +7,7 @@
 from unittest.mock import MagicMock
 
 import requests
+from ci_failure_summarizer.failure_evidence import select_best_error_marker
 from ci_failure_summarizer.github_client import (
     GitHubActionsClient,
     canonical_workflow_file,
@@ -228,6 +229,16 @@ def test_fetch_job_logs_prefers_failed_step_section_over_cleanup_tail():
     assert "Removing includeIf entries" not in (result.excerpt or "")
 
 
+def test_select_best_error_marker_prefers_specific_route_not_found_marker():
+    wrapper = "E Failed: Pre-deployed agent route not found"
+    route_marker = (
+        'E oc stderr: Error from server (NotFound): routes.route.openshift.io '
+        '"langflow-simple-tool-calling-agent" not found'
+    )
+
+    assert select_best_error_marker([wrapper, route_marker]) == route_marker
+
+
 def test_list_jobs_parses_fixture_payload():
     payload = json.loads((FIXTURES / "github_failure_run.json").read_text())
     client = GitHubActionsClient("red-hat-data-services/agentic-starter-kits")

agents/langgraph/templates/ci_failure_summarizer/tests/test_summarize_api.py

@@ -181,3 +181,15 @@ def test_summarize_maps_run_mismatch_to_400(self, summarize_client):
 
         assert response.status_code == 400
         assert "Run 999 is not from workflow" in response.json()["detail"]
+
+    def test_images_route_rejects_path_traversal(self, summarize_client, tmp_path):
+        import main
+
+        images_dir = tmp_path / "images"
+        images_dir.mkdir()
+        (tmp_path / "secret.txt").write_text("secret")
+
+        with patch.object(main, "_IMAGES_DIR", images_dir):
+            response = summarize_client.get("/images/../secret.txt")
+
+        assert response.status_code == 404