From ca718fae0585d9307552e4236b01fbf801dde3a0 Mon Sep 17 00:00:00 2001 From: Joe Esquibel Date: Sat, 22 Aug 2026 20:33:45 -0400 Subject: [PATCH 1/5] fix(galaxyscope): fix non-deterministic ordering in telemetry (Issue #2030) --- gitgalaxy/galaxyscope.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index 595891606..45e3abec1 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -621,8 +621,8 @@ def _process_file_worker(rel_path: str) -> dict[str, Any]: "coding_loc": refraction["coding_loc"], "doc_loc": refraction["doc_loc"], "mitigations": refraction.get("mitigations", []), # <--- THE FIX: Route the suppressions - "raw_imports": list(raw_imports), - "named_tokens": list(named_tokens), + "raw_imports": sorted(list(raw_imports)), + "named_tokens": sorted(list(named_tokens)), "popularity_hits": popularity_hits, "regex_telemetry": (logic_data.pop("regex_telemetry", {}) if is_profiling else {}), } @@ -1679,6 +1679,9 @@ def _extract_features_parallel(self): # the pipeline sees a deterministic sequence regardless of thread # scheduling. self.ram_cache = dict(sorted(self.ram_cache.items())) + self.file_speed_telemetry["phase_totals"] = dict(sorted(self.file_speed_telemetry["phase_totals"].items())) + self.splicing_telemetry["regex_totals"] = dict(sorted(self.splicing_telemetry["regex_totals"].items())) + self.splicing_telemetry["top_slowest"].sort(key=lambda x: (x["time"], x["path"]), reverse=True) # unparsable_files is appended to from the same as_completed() loop # (the "parser_bypass" branch above) as well as from the earlier @@ -1704,8 +1707,8 @@ def _resolve_dependency_graph(self): """ logger.info("PASS_1.5: Resolving import graphs via O(1) Pre-computed Suffix Hash Maps...") - self.popularity_scores = dict.fromkeys(self.stem_map.values(), 0) - repo_file_paths = set(self.stem_map.values()) + self.popularity_scores = dict.fromkeys(sorted(self.stem_map.values()), 0) + repo_file_paths = sorted(set(self.stem_map.values())) # --- O(1) SUFFIX MAP --- suffix_map = {} @@ -1798,7 +1801,7 @@ def _resolve_dependency_graph(self): external_imports_tally = {} # <--- NEW: Track external dependencies for rel_path, meta in self.ram_cache.items(): - raw_imports = meta.get("raw_imports", set()) + raw_imports = sorted(list(meta.get("raw_imports", set()))) for raw_import in raw_imports: clean_path = import_cleaner.sub("", raw_import.strip()) if "from" in clean_path: From ef9f83d52cdf71b40fd84cef0fcb87903d0a6f0b Mon Sep 17 00:00:00 2001 From: Joe Esquibel Date: Sat, 22 Aug 2026 20:36:44 -0400 Subject: [PATCH 2/5] fix(galaxyscope): fix ruff C414 errors --- gitgalaxy/galaxyscope.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index 45e3abec1..73e4330c2 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -621,8 +621,8 @@ def _process_file_worker(rel_path: str) -> dict[str, Any]: "coding_loc": refraction["coding_loc"], "doc_loc": refraction["doc_loc"], "mitigations": refraction.get("mitigations", []), # <--- THE FIX: Route the suppressions - "raw_imports": sorted(list(raw_imports)), - "named_tokens": sorted(list(named_tokens)), + "raw_imports": sorted(raw_imports), + "named_tokens": sorted(named_tokens), "popularity_hits": popularity_hits, "regex_telemetry": (logic_data.pop("regex_telemetry", {}) if is_profiling else {}), } @@ -1801,7 +1801,7 @@ def _resolve_dependency_graph(self): external_imports_tally = {} # <--- NEW: Track external dependencies for rel_path, meta in self.ram_cache.items(): - raw_imports = sorted(list(meta.get("raw_imports", set()))) + raw_imports = sorted(meta.get("raw_imports", set())) for raw_import in raw_imports: clean_path = import_cleaner.sub("", raw_import.strip()) if "from" in clean_path: From 0237de286cb7ce553a5b333c68e65e34ab49b8d1 Mon Sep 17 00:00:00 2001 From: Joe Esquibel Date: Sat, 22 Aug 2026 20:47:31 -0400 Subject: [PATCH 3/5] fix(galaxyscope): fix remaining ruff warnings --- gitgalaxy/galaxyscope.py | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index 73e4330c2..4d959a555 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -1061,7 +1061,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if isinstance(ts, dict) and isinstance(eqs, dict): keys_to_delete_ts = [ k - for k in ts.keys() + for k in ts if k in mitigs or f"sec_{k}" in mitigs or k.replace("sec_", "") in mitigs @@ -1072,7 +1072,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): ] keys_to_delete_eqs = [ k - for k in eqs.keys() + for k in eqs if k in mitigs or k.replace("sec_", "") in mitigs or k in ignored_rules @@ -1089,12 +1089,10 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if k in eqs: del eqs[k] - if "GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs: - if "ai_appsec" in file_data.get("telemetry", {}): + if ("GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs) and "ai_appsec" in file_data.get("telemetry", {}): del file_data["telemetry"]["ai_appsec"] - if "GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs: - if "ai_guardrails" in file_data.get("telemetry", {}): + if ("GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs) and "ai_guardrails" in file_data.get("telemetry", {}): del file_data["telemetry"]["ai_guardrails"] if file_data.get("is_ml_threat"): @@ -1146,8 +1144,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): # THE FIX: Bulletproof Truthiness Check ts = file_data.get("telemetry", {}).get("threat_snippets", {}) - if isinstance(ts, dict): - if ts.get("hardcoded_secrets") or ts.get("sec_hardcoded_secrets"): + if isinstance(ts, dict) and (ts.get("hardcoded_secrets") or ts.get("sec_hardcoded_secrets")): has_secrets = True # Check Domain Context @@ -2575,7 +2572,7 @@ def execute_incremental_scan( self.ext_tally = {} self.stem_map = {} - for rel_path in self.ram_cache.keys(): + for rel_path in self.ram_cache: stem = Path(rel_path).stem.lower() ext = Path(rel_path).suffix.lower() name = Path(rel_path).name.lower() @@ -2598,7 +2595,7 @@ def execute_incremental_scan( self._extract_features_parallel() # 5. The Ripple Effect (Recalculate Downstream Exposure for ALL files) - self.stem_map = {f: f for f in self.ram_cache.keys()} + self.stem_map = {f: f for f in self.ram_cache} self._resolve_dependency_graph() self._calculate_risk_exposures() From f27a6c433cda997cee3e998775b14cde128c50c1 Mon Sep 17 00:00:00 2001 From: Joe Esquibel Date: Sat, 22 Aug 2026 20:57:34 -0400 Subject: [PATCH 4/5] Revert 'fix(galaxyscope): fix remaining ruff warnings' --- gitgalaxy/galaxyscope.py | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index 4d959a555..73e4330c2 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -1061,7 +1061,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if isinstance(ts, dict) and isinstance(eqs, dict): keys_to_delete_ts = [ k - for k in ts + for k in ts.keys() if k in mitigs or f"sec_{k}" in mitigs or k.replace("sec_", "") in mitigs @@ -1072,7 +1072,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): ] keys_to_delete_eqs = [ k - for k in eqs + for k in eqs.keys() if k in mitigs or k.replace("sec_", "") in mitigs or k in ignored_rules @@ -1089,10 +1089,12 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if k in eqs: del eqs[k] - if ("GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs) and "ai_appsec" in file_data.get("telemetry", {}): + if "GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs: + if "ai_appsec" in file_data.get("telemetry", {}): del file_data["telemetry"]["ai_appsec"] - if ("GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs) and "ai_guardrails" in file_data.get("telemetry", {}): + if "GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs: + if "ai_guardrails" in file_data.get("telemetry", {}): del file_data["telemetry"]["ai_guardrails"] if file_data.get("is_ml_threat"): @@ -1144,7 +1146,8 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): # THE FIX: Bulletproof Truthiness Check ts = file_data.get("telemetry", {}).get("threat_snippets", {}) - if isinstance(ts, dict) and (ts.get("hardcoded_secrets") or ts.get("sec_hardcoded_secrets")): + if isinstance(ts, dict): + if ts.get("hardcoded_secrets") or ts.get("sec_hardcoded_secrets"): has_secrets = True # Check Domain Context @@ -2572,7 +2575,7 @@ def execute_incremental_scan( self.ext_tally = {} self.stem_map = {} - for rel_path in self.ram_cache: + for rel_path in self.ram_cache.keys(): stem = Path(rel_path).stem.lower() ext = Path(rel_path).suffix.lower() name = Path(rel_path).name.lower() @@ -2595,7 +2598,7 @@ def execute_incremental_scan( self._extract_features_parallel() # 5. The Ripple Effect (Recalculate Downstream Exposure for ALL files) - self.stem_map = {f: f for f in self.ram_cache} + self.stem_map = {f: f for f in self.ram_cache.keys()} self._resolve_dependency_graph() self._calculate_risk_exposures() From e105e940f30fb8b7a4d7af605648ca499d3a822b Mon Sep 17 00:00:00 2001 From: Joe Esquibel Date: Sat, 22 Aug 2026 20:58:28 -0400 Subject: [PATCH 5/5] fix(galaxyscope): add noqa to ignore ruff warnings without mutating AST --- gitgalaxy/galaxyscope.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py index 73e4330c2..a9e67f99f 100644 --- a/gitgalaxy/galaxyscope.py +++ b/gitgalaxy/galaxyscope.py @@ -1061,7 +1061,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if isinstance(ts, dict) and isinstance(eqs, dict): keys_to_delete_ts = [ k - for k in ts.keys() + for k in ts.keys() # noqa: SIM118 if k in mitigs or f"sec_{k}" in mitigs or k.replace("sec_", "") in mitigs @@ -1072,7 +1072,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): ] keys_to_delete_eqs = [ k - for k in eqs.keys() + for k in eqs.keys() # noqa: SIM118 if k in mitigs or k.replace("sec_", "") in mitigs or k in ignored_rules @@ -1089,11 +1089,11 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): if k in eqs: del eqs[k] - if "GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs: + if "GG-AGENT-VULNERABILITY" in ignored_rules or "ai_appsec" in mitigs: # noqa: SIM102 if "ai_appsec" in file_data.get("telemetry", {}): del file_data["telemetry"]["ai_appsec"] - if "GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs: + if "GG-AGENT-GUARDRAIL" in ignored_rules or "ai_guardrails" in mitigs: # noqa: SIM102 if "ai_guardrails" in file_data.get("telemetry", {}): del file_data["telemetry"]["ai_guardrails"] @@ -1146,7 +1146,7 @@ def execute_pipeline(self, output_file: str = "galaxy.json"): # THE FIX: Bulletproof Truthiness Check ts = file_data.get("telemetry", {}).get("threat_snippets", {}) - if isinstance(ts, dict): + if isinstance(ts, dict): # noqa: SIM102 if ts.get("hardcoded_secrets") or ts.get("sec_hardcoded_secrets"): has_secrets = True @@ -2575,7 +2575,7 @@ def execute_incremental_scan( self.ext_tally = {} self.stem_map = {} - for rel_path in self.ram_cache.keys(): + for rel_path in self.ram_cache.keys(): # noqa: SIM118 stem = Path(rel_path).stem.lower() ext = Path(rel_path).suffix.lower() name = Path(rel_path).name.lower() @@ -2598,7 +2598,7 @@ def execute_incremental_scan( self._extract_features_parallel() # 5. The Ripple Effect (Recalculate Downstream Exposure for ALL files) - self.stem_map = {f: f for f in self.ram_cache.keys()} + self.stem_map = {f: f for f in self.ram_cache.keys()} # noqa: SIM118 self._resolve_dependency_graph() self._calculate_risk_exposures()