Repository navigation
fix(plugin): include Vyper sources in scan inventories - #1306
Conversation
mldangelo-oai
left a comment
mldangelo-oai
left a comment
There was a problem hiding this comment.
Thank you for catching this gap and for covering both diff modes and all three ranking modes! The shared allowlist is the right focused fix, and checking out the base in the revision test usefully proves that previews come from the requested head.
I verified that all five new inventory/ranking cases fail on the parent and pass with this change. I pushed a small Ruff-only formatting correction; lint, formatting, the CI TypeScript build, source compatibility, and all nine source-compatibility tests now pass. Across the three affected Python test modules, 295 tests passed. One existing no-Git/no-ripgrep fallback test fails identically on the parent because this validation environment has an ancestor Git marker; it is unrelated to this change. No blocking behavior issues found.
A useful follow-up is to share a single source-case fixture across inventory and ranking tests and test the sampled-preview byte budget as generic behavior. That would make future source additions require one test-fixture edit instead of copied test bodies. Longer term, separating text-file eligibility from preview-parser support could remove this class of omitted-extension fixes altogether; that broader coverage change should be evaluated separately. Thanks again for the contribution!
|
@mldangelo-oai :Thanks again for the detailed review and validation. I’ll take a look at the shared source-case fixture as a separate follow-up. More broadly, this is actually the direction I’m most interested in exploring. Over the past two weeks I’ve been running a small open-source security experiment: auditing real projects, reproducing findings against current upstream, writing regressions, developing patches, and working directly with maintainers until fixes land. #1306 is now the sixth finding from that work that I’ve assessed at roughly Medium impact, across projects including Codex Security, Nethermind and other widely used open-source software. What caught my attention is how closely that workflow overlaps with what OpenAI is building around Daybreak and Patch the Planet: moving beyond vulnerability discovery into validation, remediation, testing and upstream patching. I’m also exploring a similar model with TheDAO Security Fund: a funded pilot focused on Ethereum client software where researchers work directly with maintainers instead of dropping findings into the usual open-source queue. The goal is to shorten the loop between discovery, validation and a production-ready fix. I’d genuinely be interested in learning whether the work I’m doing could fit anywhere within Daybreak, Patch the Planet, Trusted Access for Cyber, or another OpenAI security initiative — particularly if there are ways for independent researchers to contribute or get access to capabilities that would let me test this workflow at greater scale. Separately, I’ve also applied for the Product Marketing Manager, Cybersecurity role because my professional background is in technical product marketing and security. But the open-source security work itself is something I intend to keep pursuing regardless, and that’s the part of OpenAI’s cyber direction I’m especially interested in. |
Summary
Vyper source files use the
.vyextension, but the shared scan/rank source allowlist does not currently include it. Repository and diff ranking paths can therefore omit Vyper-only changes before they reach review-item generation.This change includes
.vyin the existing text-code allowlist and adds deterministic coverage for the same inventory and ranking paths already exercised for Solidity.Changes
.vytoTEXT_CODE_EXTENSIONS.Testing
main:.vyis absent fromTEXT_CODE_EXTENSIONS, while both diff inventory and rank-input generation require the suffix to be present in that set.dcc68201030be308e0053f1a4dfd282f90dc45fb: one production-line addition plus targeted regression coverage.Risk and rollout
Low. This only allows
.vytext source files to participate in existing inventory/ranking flows. There is no CLI, schema, output-format, or parser change. Vyper previews use the existing sampled-text fallback.Public disclosure review