fix: address additional Copilot review feedback

- Add timeout parameters to subprocess calls in snapshot.py and git_analysis.py
- Fix debt marker regex pattern (remove literal pipe from character class)
- Fix import pattern regex to avoid cross-statement matches
- Use astral-sh/setup-uv@v4 action instead of curl | sh

Author: karthiknadig

.github/workflows/code-analysis.yml

@@ -23,9 +23,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install uv
-        run: |
-          curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        uses: astral-sh/setup-uv@v4
 
       - name: Install analysis dependencies
         working-directory: analysis

analysis/debt_indicators.py

@@ -69,13 +69,13 @@ def to_dict(self) -> dict:
 
 # Debt marker patterns
 DEBT_PATTERNS = [
-    (r"#\s*(TODO|FIXME|HACK|XXX|BUG|REFACTOR|OPTIMIZE|REVIEW)[:|\s](.+)$", "python"),
+    (r"#\s*(TODO|FIXME|HACK|XXX|BUG|REFACTOR|OPTIMIZE|REVIEW)[:\s](.+)$", "python"),
     (
-        r"//\s*(TODO|FIXME|HACK|XXX|BUG|REFACTOR|OPTIMIZE|REVIEW)[:|\s](.+)$",
+        r"//\s*(TODO|FIXME|HACK|XXX|BUG|REFACTOR|OPTIMIZE|REVIEW)[:\s](.+)$",
         "typescript",
     ),
     (
-        r"/\*\s*(TODO|FIXME|HACK|XXX|BUG|REFACTOR|OPTIMIZE|REVIEW)[:|\s](.+?)\*/",
+        r"/\*\s*(TODO|FIXME|HACK|XXX|BUG|REFACTOR|OPTIMIZE|REVIEW)[:\s](.+?)\*/",
         "typescript",
     ),
 ]

analysis/dependency_analysis.py

@@ -122,7 +122,7 @@ def extract_imports_typescript(
     # import './path'
     # const x = require('./path')
     import_patterns = [
-        r'import\s+(?:.*?\s+from\s+)?[\'"]([^\'"]+)[\'"]',
+        r'import\s+(?:[^\'";]+?\s+from\s+)?[\'"]([^\'"]+)[\'"]',
         r'require\s*\(\s*[\'"]([^\'"]+)[\'"]\s*\)',
         r'import\s*\(\s*[\'"]([^\'"]+)[\'"]\s*\)',  # dynamic import
     ]

analysis/git_analysis.py

@@ -92,6 +92,7 @@ def run_git_command(args: List[str], cwd: pathlib.Path) -> str:
         capture_output=True,
         text=True,
         check=True,
+        timeout=60,
     )
     return result.stdout
 

analysis/snapshot.py

@@ -34,6 +34,7 @@ def get_git_info(repo_root: pathlib.Path) -> dict:
             capture_output=True,
             text=True,
             check=True,
+            timeout=10,
         ).stdout.strip()
 
         short_sha = subprocess.run(
@@ -42,6 +43,7 @@ def get_git_info(repo_root: pathlib.Path) -> dict:
             capture_output=True,
             text=True,
             check=True,
+            timeout=10,
         ).stdout.strip()
 
         branch = subprocess.run(
@@ -50,6 +52,7 @@ def get_git_info(repo_root: pathlib.Path) -> dict:
             capture_output=True,
             text=True,
             check=True,
+            timeout=10,
         ).stdout.strip()
 
         # Get commit message
@@ -59,6 +62,7 @@ def get_git_info(repo_root: pathlib.Path) -> dict:
             capture_output=True,
             text=True,
             check=True,
+            timeout=10,
         ).stdout.strip()
 
         return {
@@ -67,7 +71,7 @@ def get_git_info(repo_root: pathlib.Path) -> dict:
             "branch": branch,
             "message": message[:200],  # Truncate long messages
         }
-    except subprocess.CalledProcessError:
+    except (subprocess.CalledProcessError, subprocess.TimeoutExpired):
         return {
             "sha": "unknown",
             "short_sha": "unknown",