feat: make static analysis runtime configurable - #522
Conversation
Default to a five-minute per-artifact allowance bounded by the remaining workflow time. Prepared by Codex on behalf of Mohit Gupta. Signed-off-by: Mohit Gupta <[email protected]>
…VIDIA#524 Raise reviewed_pr_through to 527 and reviewed_issue_through to 524 in tools/upstream_baseline.json (commit axis unchanged at 69dcdfb). Every item gets a verdict in docs/DECISIONS.md: NVIDIA#493/NVIDIA#507/NVIDIA#508/NVIDIA#511 verified via git merge-base --is-ancestor as already included through the 2.11.1/2.11.2 sync (including NVIDIA#521, which merged only into the still- open NVIDIA#516 stack, not main); the remaining 27 items stay "wait for upstream merge", none adopted now. Two items get dedicated comparison notes per docs/DIVERGENCE.md's static_runner.py and scripts/compare_scan_accuracy.py rows: NVIDIA#522 uses a different env var name and different default/semantics than this fork's SKILLSPECTOR_MAX_STATIC_SECONDS, so merging it cannot simply delete the divergence row and needs a downstream env var migration first; NVIDIA#490 extends this fork's own upstream PR NVIDIA#486 with a Python 3.14/POSIX edge case the fork's Windows environment does not hit, so NVIDIA#486 is left untouched pending upstream's own resolution. NVIDIA#501-NVIDIA#505 and NVIDIA#518 are also flagged as near-verbatim matches to this fork's existing Windows test divergence rows, worth revisiting for row deletion once merged. Co-Authored-By: Claude Opus 5 <[email protected]> Signed-off-by: SanHsien <[email protected]>
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Reviewed head 5b81d8068e2671284dca86bf0276f1fbf39a0556 — APPROVE.
The configurable positive finite allowance is consistently shared by pattern and YARA analysis, remains capped by the workflow deadline, retains fail-closed partial accounting, and is documented and covered at process/configuration boundaries. I found no required changes in the current post-merge head.
Merge gate: GitHub reports mergeStateStatus=BLOCKED and no checks yet on the new merge commit. Wait for the required lint, unit, and DCO checks to run and pass before merging.
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Re-reviewed current head 094023d2dbeaf8685e0821907f9bca14b4c07231 after the later main synchronizations. The configurable positive finite static-analysis allowance remains shared by pattern and YARA analysis, bounded by the remaining workflow deadline, fail-closed at exhausted or subsecond YARA budgets, documented, and covered at configuration and runtime boundaries. The integrated provider-documentation and reconstruction-hook changes do not conflict with this behavior. I found no required change.
Merge gate: GitHub currently reports no hosted checks on this exact head and mergeStateStatus=BLOCKED; required checks must run and pass before merging.
The fixed 30-second static-analysis allowance can truncate otherwise valid work even when the shared workflow has time remaining. Add
SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACTand raise its default to 300 seconds.Static patterns and YARA continue to use the smaller of this configured allowance and the remaining workflow time. Invalid, zero, negative, infinite, or NaN values warn and retain the default. The setting is read at process startup, following the existing workflow-deadline convention. Other timeout layers are unchanged.
Tests cover fresh-process environment propagation, work lasting beyond the previous 30-second ceiling, tighter local and parent limits, YARA's integer timeout, invalid values, and retained incomplete-result behavior. Configuration does not replace the separate linear quote-scan fix in #521.
Validation:
make test-cipassed 4,029 tests, 14 skipped, 38 deselected, 4 expected failures; 89% coverage.codex_cliand with--no-llmwhile using an explicit 45.5-second static setting; three semantic analyzer call-log entries succeeded in the live run.Prepared by Codex on behalf of Mohit Gupta.