[HackingGate]

Bumps astral-sh/ruff-pre-commit from v0.17.2 to v0.17.3. prek-pins-current refuses the old pin now that upstream has tagged a newer one, so the prek and pre-commit legs fail on every branch, including #451.

Checks run locally at the new pin.

• prek run ruff-check --all-files: passed
• prek run ruff-format --all-files: passed
• prek run prek-pins-current --hook-stage manual --all-files: passed

https://claude.ai/code/session_01BHpLckRt4BNGCdFG9vLyEP

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 40 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 11bae601-726d-41c5-8b84-5d59681d8fb2

Commits

Reviewing files that changed from the base of the PR and between 907eb95 and 23938ea.

Files selected for processing: 1

• .pre-commit-config.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[uphold-review]

uphold-review

Walkthrough

This is a one-line change. It moves the astral-sh/ruff-pre-commit hook pin in .pre-commit-config.yaml from v0.17.2 to v0.17.3, the newest upstream tag. The no-stale-hook-pins / prek-pins-current check had started rejecting the old pin. Nothing else in the repository pins this ruff version: the only other ruff version string is the ruff==0.14.0 text inside a test in tests/base_set_corpus.rs, which is unrelated. So no second copy of the pin is left to go stale. I checked the change against the principles in the review document and found nothing in it that violates any of them.

Changes

File	Change
.pre-commit-config.yaml	Moves the astral-sh/ruff-pre-commit hook rev from v0.17.2 to v0.17.3.

❌ uphold rules: uphold's rules refuse this · this repository's policy at 907eb95

Rule output

$ uphold scan
policy check failed: no-running-os-identity-metadata (hostname)
Do not commit identity metadata from the running OS. The scan reads the current
username, home path, hostname and default route at runtime, then searches the
tracked files for what it read. Use neutral placeholders instead --
example-user, example-host, example.test, /srv/example.
.github/workflows/test.yml:127:          components: llvm-tools-preview
.github/workflows/test.yml:138:          tool: cargo-llvm-cov,nextest
docs/COVERAGE.md:73:| [Abstract syntax tree](https://en.wikipedia.org/wiki/Abstract_syntax_tree) | the program's structure without layout, so a rule matches a construct however it is spelled | [Clang AST](https://clang.llvm.org/docs/IntroductionToTheClangAST.html), [ast-grep](https://ast-grep.github.io/) |
docs/COVERAGE.md:79:| [High-level intermediate representation](https://en.wikipedia.org/wiki/Intermediate_representation) | names resolved and types assigned, so a check sees what an identifier refers to | [rustc HIR](https://rustc-dev-guide.rust-lang.org/hir.html), [MLIR](https://mlir.llvm.org/), [LLVM IR](https://llvm.org/docs/LangRef.html) |
docs/COVERAGE.md:80:| [Control-flow graph](https://en.wikipedia.org/wiki/Control-flow_graph) | every path a function can take, so a check can ask whether one statement is reached before another | [LLVM](https://llvm.org/), [Soot](https://soot-oss.github.io/soot/) |
docs/COVERAGE.md:81:| [Data-flow graph](https://en.wikipedia.org/wiki/Data_dependency) | which value flows into which operation | [Joern](https://joern.io/), [LLVM](https://llvm.org/) |
docs/COVERAGE.md:83:| [Static single-assignment form](https://en.wikipedia.org/wiki/Static_single-assignment_form) | each variable assigned once, so a value's definition is its name | [LLVM](https://llvm.org/), [GCC](https://gcc.gnu.org/) |
docs/COVERAGE.md:85:| [Def-use chains](https://en.wikipedia.org/wiki/Use-define_chain) | each definition linked to every use it reaches, and back | [LLVM](https://llvm.org/), [GCC](https://gcc.gnu.org/) |
docs/COVERAGE.md:86:| [Dominator tree](https://en.wikipedia.org/wiki/Dominator_(graph_theory)) | which statement runs before another on every path, so "checked before used" is decidable | [LLVM](https://llvm.org/), [GCC](https://gcc.gnu.org/) |
docs/COVERAGE.md:95:| [Dependency analysis](https://en.wikipedia.org/wiki/Dependence_analysis) | which statements must stay in order, the ground of loop transformation and slicing | [Polly](https://polly.llvm.org/), [isl](https://libisl.sourceforge.io/) |
docs/COVERAGE.md:96:| [Precision](https://en.wikipedia.org/wiki/Data-flow_analysis#Sensitivities): interprocedural, flow-, context- and path-sensitive | how much of the program an answer accounts for: across calls, in statement order, per call site, per branch; each costs time and removes false positives | [Infer](https://fbinfer.com/), [Clang Static Analyzer](https://clang-analyzer.llvm.org/), [SVF](https://github.com/SVF-tools/SVF) |
docs/COVERAGE.md:98:| [Interval](https://en.wikipedia.org/wiki/Interval_arithmetic), [octagon](https://doi.org/10.1007/s10990-006-8609-1) and [polyhedral](https://doi.org/10.1145/512760.512770) domains | bounds per variable; bounds on sums and differences of pairs; any linear relation: each more precise and more costly than the last | [APRON](https://github.com/antoinemine/apron), [Astree](https://www.absint.com/astree/), [Polly](https://polly.llvm.org/)/[isl](https://libisl.sourceforge.io/) |
docs/COVERAGE.md:149:| [Coverage-guided fuzzing](https://en.wikipedia.org/wiki/Fuzzing) | inputs mutated toward new code coverage until one fails | [AFL++](https://aflplus.plus/), [libFuzzer](https://llvm.org/docs/LibFuzzer.html), [honggfuzz](https://github.com/google/honggfuzz) |
docs/COVERAGE.md:158:| [Coverage analysis](https://en.wikipedia.org/wiki/Code_coverage) | which lines, branches or conditions a suite ran; a measure that stops measuring once it is a target, as [goodharts-law](../principles/goodharts-law.toml) says | [llvm-cov](https://llvm.org/docs/CommandGuide/llvm-cov.html), [gcov](https://gcc.gnu.org/onlinedocs/gcc/Gcov.html) |
docs/COVERAGE.md:166:| [Memory instrumentation](https://en.wikipedia.org/wiki/Instrumentation_(computer_programming)) | every access checked against allocation bounds and lifetimes | [AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html), [Valgrind](https://valgrind.org/) |
docs/COVERAGE.md:167:| [Race detection](https://en.wikipedia.org/wiki/Race_condition) | unsynchronized conflicting accesses found from the happens-before order of a run | [ThreadSanitizer](https://clang.llvm.org/docs/ThreadSanitizer.html), [Helgrind](https://valgrind.org/docs/manual/hg-manual.html) |
docs/COVERAGE.md:169:| [Deadlock analysis](https://en.wikipedia.org/wiki/Deadlock_(computer_science)) | lock-order cycles seen in one run, which can deadlock in another | [Helgrind](https://valgrind.org/docs/manual/hg-manual.html), [ThreadSanitizer](https://clang.llvm.org/docs/ThreadSanitizer.html) |
scripts/coverage.sh:49:for tool in llvm-cov nextest; do
scripts/coverage.sh:58:# this crate has no lib target -- and llvm-cov instruments that binary and
scripts/coverage.sh:73:echo "==> cargo llvm-cov ${args[*]}"
scripts/coverage.sh:74:cargo llvm-cov "${args[@]}"
toolchain.toml:87:# declared anyway because "cargo llvm-cov: no such subcommand" is not a message
toolchain.toml:90:name = "cargo-llvm-cov"
toolchain.toml:91:check = "cargo llvm-cov --version"
toolchain.toml:93:hint = "coverage-only; install: cargo install cargo-llvm-cov (or run: scripts/deps.sh install)"
toolchain.toml:186:check = "cargo llvm-cov --version >/dev/null 2>&1 && cargo nextest --version >/dev/null 2>&1"
toolchain.toml:188:cargo install --locked cargo-llvm-cov


$ uphold check
reconciled 19 enforcement claims:
  explicit-unknown <- catalog-tests  enforced by a hook installed here
  single-authoritative-source <- catalog-reference-current  enforced by a hook installed here
  make-illegal-states-unrepresentable <- catalog-validate  enforced by a hook installed here
  single-authoritative-source <- catalog-tests  enforced by a hook installed here
  explicit-unknown <- no-stale-hook-pins  enforced by uphold guard at manual
  single-authoritative-source <- no-stale-hook-pins  enforced by uphold guard at manual
  complete-mediation <- prevent-ai-author  enforced by uphold guard at commit-msg
  fail-safe-defaults <- prevent-public-push  enforced by uphold guard at pre-push
  observability <- removed-function-named  enforced by uphold guard at commit-msg
  least-privilege <- workflow-declares-permissions  enforced by uphold scan
  minimize-attack-surface <- workflow-declares-permissions  enforced by uphold scan
  compromise-recording <- no-local-merge  enforced by uphold guard at pre-merge-commit
  compromise-recording <- no-merge-commit  enforced by uphold guard at pre-commit
  data-minimization <- no-private-repo-names  enforced by uphold guard at commit-msg
  data-minimization <- no-running-os-identity-metadata  enforced by uphold scan
  chestertons-fence <- removed-function-named  enforced by uphold guard at commit-msg
  deprecation-discipline <- no-stale-hook-pins  enforced by uphold guard at manual
  reproducible-derived-state <- catalog-reference-current  enforced by a hook installed here
  reproducible-derived-state <- review-current  enforced by a hook installed here
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-validate: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-ai-author: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-public-push: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-local-merge: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-merge-commit: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-private-repo-names: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-running-os-identity-metadata: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  review-current: unmeasured [not_requested] — no behavioral probe requested
  note  lefthook.yml runs the binary
  note  lefthook.yml defines 20 command(s)
  note  .claude/settings.json runs `uphold hook`

✅ uphold review

The review document asked about 33 of uphold's records; this change violates none of them.

---

Reviewed with uphold 1.38.0 by uphold-review 0.3.1 · 23938ea · claude-opus-5-5 · 28 s · $0.07 list

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.95%. Comparing base (907eb95) to head (23938ea).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #452   +/-   ##
=======================================
  Coverage   94.95%   94.95%           
=======================================
  Files          55       55           
  Lines       28054    28054           
=======================================
  Hits        26640    26640           
  Misses       1414     1414           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.