From c12ee848b2ef4970013750e687dc4dcd2c7826a4 Mon Sep 17 00:00:00 2001 From: Mark Beacom Date: Mon, 28 Sep 2026 17:47:37 -0400 Subject: [PATCH] docs(adr): accept ADR-0043; record the CodeQL findings its zod bump surfaced ADR-0043: status accepted, ratifiedBy @mbeacom. All five action items were already complete, including the post-deploy check of both served schema versions. Consequences gains a note on CodeQL alerts 9 and 10 (js/bad-code-sanitization in packages/ci/dist/index.js and queue-action.js). Both point at zod 4.6's object fast path, Doc.compile(), which #241's bump brought into the bundles. The flagged value is JSON.stringify of a zod shape key. Every such key is a field name from adrkit's static schemas, never corpus or PR content, and it only ever sits in a string-literal position in code run on Node. So both alerts are false positives. They are to be dismissed rather than excluded, because codeql.yml scans the committed bundles on purpose. MANIFEST.md regenerated by `bun run emit:manifest`. Signed-off-by: Mark Beacom --- MANIFEST.md | 4 ++-- ...conds-retain-v0-1-0-and-validate-every-rec.md | 16 +++++++++++++++- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/MANIFEST.md b/MANIFEST.md index f9e5f180..44574d10 100644 --- a/MANIFEST.md +++ b/MANIFEST.md @@ -74,7 +74,7 @@ hand-written. There are 43 records, ids `0001`-`0043`, alongside -`0000-template.md`: 39 accepted, 2 proposed, 2 superseded. +`0000-template.md`: 40 accepted, 1 proposed, 2 superseded. | Id | Status | Title | | --- | --- | --- | @@ -120,6 +120,6 @@ There are 43 records, ids `0001`-`0043`, alongside | `0040` | proposed | Keep derived surfaces in lockstep with three mechanisms matched to three classes of drift | | `0041` | accepted | Regenerate committed artifacts on Dependabot pull requests with default-branch scripts behind a maintainer label | | `0042` | accepted | Count a gate-change acknowledgment only when an admin or maintainer applied it | -| `0043` | proposed | Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema | +| `0043` | accepted | Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema | diff --git a/docs/adr/0043-publish-schema-v0-2-0-with-rfc-3339-seconds-retain-v0-1-0-and-validate-every-rec.md b/docs/adr/0043-publish-schema-v0-2-0-with-rfc-3339-seconds-retain-v0-1-0-and-validate-every-rec.md index a4a79a13..18d6abdd 100644 --- a/docs/adr/0043-publish-schema-v0-2-0-with-rfc-3339-seconds-retain-v0-1-0-and-validate-every-rec.md +++ b/docs/adr/0043-publish-schema-v0-2-0-with-rfc-3339-seconds-retain-v0-1-0-and-validate-every-rec.md @@ -2,7 +2,7 @@ schemaVersion: 0.2.0 id: "0043" title: "Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema" -status: proposed +status: accepted date: 2026-09-28 deciders: ["@mbeacom"] tags: [schema, core, dependencies, hosting] @@ -21,6 +21,7 @@ affects: pattern: "zod" provenance: authoredBy: agent-drafted + ratifiedBy: "@mbeacom" review: tier: arb tierReason: >- @@ -161,6 +162,19 @@ pressure. stops serving the pinned bytes. - Revisit if: a second schema bump needs a rule change that a one-line migration cannot express. +- **`zod` 4.6's code generator is visible to CodeQL in the Action bundles.** After + #241, `js/bad-code-sanitization` flagged zod's object fast path + (`Doc.compile()`, which builds a parser with `new Function`) in both + `packages/ci/dist/index.js` and `packages/ci/dist/queue-action.js` (alerts 9 + and 10). The flagged value is `JSON.stringify` of an object-schema *shape key*. + Every such key is a field name declared in adrkit's own static schemas — no + corpus, PR, or event content becomes one (`z.record` keys do not take this + path) — and the result is only ever placed in a string-literal position in + code run on Node, where the query's `` and U+2028/U+2029 concerns do + not apply. Both are false positives and are dismissed as such, not excluded: + the bundles stay in CodeQL's scope on purpose (`.github/workflows/codeql.yml`), + so a later `zod` that moves these lines may raise them again. Re-check that + shape keys are still static before dismissing a recurrence. ## Action items