[CEL-1560] Allow frozen UI renderer 0.155 alias by mong-x · Pull Request #25 · CellarNode/.github

mong-x · 2026-09-01T08:38:16Z

Linear: https://linear.app/cellarnode/issue/CEL-1560

Summary

allow @cellarnode/ui-renderer-0-155 in static-deploy manifest and pnpm-lock validators
preserve 0.154 frozen-renderer compatibility
cover exact npm:@cellarnode/ui@0.155.1 manifest and lockfile shapes

Why

E-label consumer PR #207 pins scan rendering to published @cellarnode/ui@0.155.1. Reusable deploy validator currently rejects its frozen alias before install.

Test plan

ruby .github/tests/deploy-static-lock-validator.test.rb
ruby .github/tests/deploy-static-job-boundaries.test.rb
ruby .github/tests/discord-metadata-boundary.test.rb
execute extracted validators against CEL-1560 consumer package.json and pnpm-lock.yaml

Merge order: this guard first; then pin consumer workflow to merged SHA; deploy consumer; widen backend publication allow-list.

Summary by cubic

Allows the static-deploy validator to accept the frozen @cellarnode/ui-renderer-0-155 alias for @cellarnode/ui@0.155.1, and enforces that each frozen renderer alias resolves to its exact pinned target version.

The 0-155 alias is allowed in both manifest and lockfile validators, covering the npm:@cellarnode/ui@0.155.1 shape.
Both 0-154 and 0-155 aliases now fail if their target version, package, or placement doesn't match the exact pinned value.
Lockfile version strings may only carry valid peer or 32-char hash suffixes, blocking path traversal via peer contexts.
Frozen aliases are only valid as direct entries in dependency fields with exact-case names; nested, override, resolution, catalog, or package-extension aliases are rejected.
Merge this guard first, then pin the consumer workflow and widen the backend publication allow-list.

^{Written for commit 1badd4f. Summary will update on new commits.}

coderabbitai · 2026-09-01T08:39:11Z

Warning

Review limit reached

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1f8fa902-3c7a-447e-8082-53851a24ea63

📥 Commits

Reviewing files that changed from the base of the PR and between 3ce9d0e and 1badd4f.

📒 Files selected for processing (2)

.github/tests/deploy-static-lock-validator.test.rb
.github/workflows/deploy-static-website.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 78d4abe3-e4e2-4d6b-af59-22bd56b09b11

📥 Commits

Reviewing files that changed from the base of the PR and between 341fdbc and 3ce9d0e.

📒 Files selected for processing (2)

.github/tests/deploy-static-lock-validator.test.rb
.github/workflows/deploy-static-website.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Summary by CodeRabbit

Bug Fixes
- Updated deployment validation to recognize the frozen 0.155 UI renderer package.
- Added validation coverage for scoped renderer aliases with valid integrity metadata.
- Prevented valid dependency manifests and lockfiles from being incorrectly rejected.

Walkthrough

The workflow allowlists ui-renderer-0-155 in manifest and lockfile validation. Tests add valid fixtures for the frozen renderer alias and its @cellarnode/ui@0.155.1 resolution.

Changes

Frozen renderer validation

Layer / File(s)	Summary
Allowlist and validation fixtures `.github/workflows/deploy-static-website.yaml`, `.github/tests/deploy-static-lock-validator.test.rb`	Both validators allow `ui-renderer-0-155`. Tests cover the valid manifest alias and lockfile resolution.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 3ce9d

This change allows the frozen 0.155 renderer alias while preserving existing 0.154 compatibility and adds coverage for the supported manifest and lockfile shapes. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested labels: fix

Suggested reviewers: lebedevdsl

Poem

A rabbit checked the renderer gate
The 0.155 alias now passes straight
Lockfiles hold their safe resolve
Manifests match the package prose
Carrots cheer the fixtures’ state

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: allowing the frozen UI renderer 0.155 alias.
Description check	✅ Passed	The description directly explains the validator updates, compatibility requirement, test coverage, and consumer workflow impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch mjnong/cel-1560-frozen-renderer-guard

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

mong-x · 2026-09-01T08:41:23Z

Independent review B — REQUEST_CHANGES — SHA 3ce9d0e0ed9c27c01d93b3ac4a9294305d585e90

P1 — Validator allow-list entry authorizes more than intended frozen alias. Adding ui-renderer-0-155 to generic allowed_private_packages makes both production validators accept direct @cellarnode/ui-renderer-0-155@1.0.0, npm:@cellarnode/auth@9.9.9, and npm:@cellarnode/ui@999.0.0; intended shape is @cellarnode/ui-renderer-0-155 → exact npm:@cellarnode/ui@0.155.1. Reproduced by extracting validator heredocs from .github/workflows/deploy-static-website.yaml; all three adversarial manifest and lock cases returned ACCEPT. Unknown private alias and git source still return REJECT.

Fix: model frozen aliases as exact alias-name/target pairs, separate from general private-package allow-list. Add negative manifest + lock fixtures for direct package, wrong allowed target, and wrong version.

Checks: lock validator 29/29 + manifest 48/48; static job boundaries pass; Discord metadata boundary pass. Slop/overfit pass: new happy fixtures cover requested acceptance but omit exclusivity classes above.

GitHub disallowed formal request-changes review because authenticated account owns PR; posted comment instead.

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Auto-approved: Adds the 0.155 frozen renderer alias to static-deploy validators with matching tests, unblocking the consumer pin to @cellarnode/ui@0.155.1.

Re-trigger cubic}

mong-x · 2026-09-01T08:42:48Z

Independent review, SHA 3ce9d0e0ed9c27c01d93b3ac4a9294305d585e90: REQUEST_CHANGES.

P1: .github/workflows/deploy-static-website.yaml:201 accepts @cellarnode/ui-renderer-0-155: npm:@cellarnode/ui@0.155.2 (reproduced: validator accepted it). “Frozen” 0.155 must map explicitly to @cellarnode/ui@0.155.1. Add manifest/lock rejection fixtures for .2 and range/tag variants; preserve 0.154 -> 0.154.0.

mong-x · 2026-09-01T08:49:28Z

Independent final review A — APPROVE — SHA 94b23190732a2c746d8e2065dd97d010ae5efde3.

P0–P3: none. Frozen aliases map exactly: 0-154 → npm:@cellarnode/ui@0.154.0, 0-155 → npm:@cellarnode/ui@0.155.1. Manifest and lock validators reject wrong version/target, plain/direct/nested alias shapes; canonical package allow-list unchanged. Existing 0.154 compatibility passes. Consumer PR #207 manifest and real peer-suffixed lock mapping pass extracted validators.

Checks: ruby .github/tests/deploy-static-lock-validator.test.rb (32 lock, 56 manifest fixtures), job-boundaries, Discord boundary, YAML parse, diff check — pass. Skill-perspective: programming + remove-ai-slops consulted; no violations.

mong-x · 2026-09-01T08:49:59Z

Independent final review B — APPROVE — SHA 94b23190732a2c746d8e2065dd97d010ae5efde3

P0: none. P1: none. P2: none.

P3 note: committed happy lock fixture omits real pnpm peer-context suffix; validator regex accepts consumer shape @cellarnode/ui@0.155.1(e4ae...). Non-blocking.

Reproduced: validator fixtures 32/32 lock + 56/56 manifest; static-job boundaries; Discord boundary; git diff --check; GitHub lock-validator. Adversarial coverage rejects wrong target/version, plain version, nested manifest alias, and direct lock package. Slop/overfit pass clean.

mong-x · 2026-09-01T08:54:30Z

Independent final review B — APPROVE — SHA 34abf6551b6309c4c4936e83d89a6b926cafdebb

P0: none. P1: none. P2: none.

P3 note: lock alias version peer-context regex permits arbitrary parenthesized metadata, including file:../evil, git URLs, tags, ranges, and empty suffixes. Base locator remains pinned to @cellarnode/ui@0.155.1; pnpm frozen install remains downstream parser, so this does not violate CEL-1560 acceptance/exclusivity criteria. Consider narrowing peer-context grammar separately.

Reproduced: exact SHA; 33 lock + 60 manifest fixtures; static-job boundaries; Discord boundary; YAML parse; git diff --check. Direct, nested, case-variant, wrong-target/version, plain-version, tag/range alias shapes reject. Exact 0.154/0.155 aliases and real peer-suffixed locator pass. Programming + remove-ai-slops direct pass: no blocking slop/overfit findings.

mong-x · 2026-09-01T09:02:32Z

Independent final review B — APPROVE — SHA 363dd9474e115650f4f039299f4e644812c99463

P0: none. P1: none. P2: none.

P3 note: lock locator peer-context regex accepts arbitrary parenthesized metadata after pinned @cellarnode/ui@0.155.1; base package/version remains exact and protocol checks still run. Non-blocking for CEL-1560.

Reproduced: 35 lock + 66 manifest fixtures; static-job boundaries; Discord boundary; YAML parse; git diff --check. Custom matrix: direct peer/dev/optional exact aliases accept; nested/direct-package/case/overrides/packageExtensions/wrong target/wrong version/tag/range reject. Programming + remove-ai-slops direct pass: no blocking maintenance, scope-drift, or overfit findings.

mong-x · 2026-09-01T09:05:35Z

Independent final review B — APPROVE — SHA 4b4ba95de3545134bba6aabc1e6bb798bb21feef

P0–P3: none.

Reproduced: 36 lock + 74 manifest fixtures; static-job boundaries; Discord boundary; YAML parse; git diff --check; GitHub lock-validator check. Adversarial review confirms exact case, direct dependency-field depth, target/version pin, tag/range rejection, peer/dev/optional eligibility, nested and override/catalog/resolution/package-extension rejection. Programming + remove-ai-slops pass: no blocking slop, overfit, scope drift, or false-confidence findings.

Non-blocking P3 note: peer-context suffix regex remains permissive after exact pinned base locator; frozen install still validates pnpm lock semantics.

mong-x · 2026-09-01T09:07:55Z

Independent final review A — APPROVE — SHA 4b4ba95de3545134bba6aabc1e6bb798bb21feef

P0–P3: none. Direct frozen mappings exact: 0-154 → npm:@cellarnode/ui@0.154.0; 0-155 → npm:@cellarnode/ui@0.155.1. Manifest and lock validators reject mismatched target/version and non-direct placements.

Checks: validator fixtures 36 lock + 74 manifest; job-boundaries; Discord boundary; YAML parse; diff check; extracted consumer #207 artifacts; direct-field matrix 20/20. programming + remove-ai-slops perspectives consulted: no violations.

mong-x · 2026-09-01T09:15:33Z

Independent final review B — APPROVE — SHA 1badd4f6cf4c2840f439996b66503b3ff1c603ae

P0–P3: none.

Reproduced: 40 lock + 74 manifest fixtures; static-job boundaries; Discord boundary; YAML parse; git diff --check; GitHub lock-validator green. Adversarial peer-parser fuzz rejects protocol, traversal, malformed, empty, and trailing contexts; valid plain, nested peer, and 32-char hash contexts pass. Direct dependency aliases remain exact-case, exact-target/version, and limited to dependencies/dev/optional/peer fields; nested/direct-package/override/catalog/resolution/package-extension forms reject. programming + remove-ai-slops direct pass: no blocking slop, overfit, scope drift, or false-confidence findings.

[CEL-1560] Allow frozen UI renderer 0.155 alias

3ce9d0e

coderabbitai Bot added the fix label Sep 1, 2026

coderabbitai Bot approved these changes Sep 1, 2026

View reviewed changes

cubic-dev-ai Bot approved these changes Sep 1, 2026

View reviewed changes

[CEL-1560] Bind frozen renderer aliases to exact UI versions

94b2319

[CEL-1560] Reject nested frozen renderer aliases

34abf65

[CEL-1560] Restrict renderer aliases to direct dependencies

363dd94

[CEL-1560] Limit renderer aliases to dependency fields

4b4ba95

[CEL-1560] Validate frozen renderer peer contexts

1badd4f

mong-x merged commit 4ee63b5 into main Sep 1, 2026
2 checks passed

Uh oh!

Conversation

mong-x commented Sep 1, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Test plan

Summary by cubic

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

mong-x commented Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mong-x commented Sep 1, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading