You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ocaml-5.5.2: GithubRepo provenance so the vuln scan covers it (0 rebuilds) - #1461
pkgmgr's nightly coverage gate (vuln-db coverage-health) failed at 00:02 because two packages that #1242 added can no longer be checked for advisories: ghc-9.6.7 and ocaml-5.5.2.
ocaml-5.5.2 is the seed compiler that packages/ocaml now builds from. #1242 gave it a 'Website provenance (ocaml.org plus the caml.inria.fr distrib directory). No advisory source can query that shape, so the package went dark. packages/ocaml itself is covered through 'GithubRepo ocaml/ocaml, and this PR gives the seed the same provenance. go-1.24.9 and rustc-1.98.1 are covered the same way (golang/go, rust-lang/rust).
Rebuilds: 0.attrs are not part of the spec hash (mip dump --packages, amd64, against main).
ghc-9.6.7 is handled on the pkgmgr side. ghc and ghc-bootstrap are already in pkgmgr's coverage baseline because no advisory source tracks the GHC compiler. A GithubRepo ghc/ghc provenance would make the gate pass with queries that can only return nothing, so ghc-9.6.7 joins them in the baseline instead.
OCaml 5.5.2 package source information now identifies the upstream OCaml GitHub repository instead of listing the project website and downloads page. This updates the repository details shown in package metadata; no changes to OCaml’s functionality are included.
No actionable comments were generated in the recent review.
Walkthrough
The OCaml 5.5.2 package replaces website-based source provenance with GitHub repository provenance. The metadata names ocaml as the owner and repository.
This change lets the vulnerability scan check the OCaml 5.5.2 package for advisories again. It does not change build behavior, and no merge-blocking risk is evident.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the main change: ocaml-5.5.2 switches to GithubRepo provenance so the vulnerability scan covers it. The PR summary and raw summary both confirm this change to packages/ocaml-5.5.2/buil…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: ocaml-5.5.2 switches to GithubRepo provenance so the vulnerability scan covers it. The PR summary and raw summary both confirm this change to packages/ocaml-5.5.2/build.ncl. The title also states the expected outcome of zero rebuilds, which the objectives support because attrs are not part of the spec hash. The title is specific, single-sentence, and not vague.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Reviewing files that changed from the base of the PR and between c8f2093 and 8646644.
Files selected for processing: 1
packages/ocaml-5.5.2/build.ncl
Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
The reason will be displayed to describe this comment to others. Learn more.
Approving at 86466443 on Karl's behalf. ocaml-5.5.2 now has the same 'GithubRepo ocaml/ocaml provenance as packages/ocaml, so the vuln scan can query it. It's an attrs-only change, so there are no rebuilds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
agent-137
left a comment
pkgmgr's nightly coverage gate (
vuln-db coverage-health) failed at 00:02 because two packages that #1242 added can no longer be checked for advisories:ghc-9.6.7andocaml-5.5.2.ocaml-5.5.2is the seed compiler thatpackages/ocamlnow builds from. #1242 gave it a'Websiteprovenance (ocaml.org plus the caml.inria.fr distrib directory). No advisory source can query that shape, so the package went dark.packages/ocamlitself is covered through'GithubRepo ocaml/ocaml, and this PR gives the seed the same provenance. go-1.24.9 and rustc-1.98.1 are covered the same way (golang/go,rust-lang/rust).Rebuilds: 0.
attrsare not part of the spec hash (mip dump --packages, amd64, against main).ghc-9.6.7is handled on the pkgmgr side.ghcandghc-bootstrapare already in pkgmgr's coverage baseline because no advisory source tracks the GHC compiler. AGithubRepo ghc/ghcprovenance would make the gate pass with queries that can only return nothing, so ghc-9.6.7 joins them in the baseline instead.🤖 Generated with Claude Code
Summary by CodeRabbit