ci: security workflows (codeql/scorecard/zizmor) + canonicalize idempotence fix#22
Merged
Conversation
Static analysis + supply-chain posture, mirroring the other Wickra repos: - codeql.yml — CodeQL over the Rust core and the Python / JavaScript-TypeScript binding surfaces (build-mode none), on push/PR/weekly. - scorecard.yml — OpenSSF Scorecard on push-to-main / weekly / branch-protection changes; publishes to the public OpenSSF API for the README badge. - zizmor.yml — report-only audit of the workflow files themselves (template injection, token scope, unpinned actions); findings surface in the Security tab. All actions are SHA-pinned; least-privilege GITHUB_TOKEN with per-job scope widening.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
…nary grid
A second canonicalize fuzz input (`44447444.444...`, ~4.5e7) still broke the
fixed-point invariant after the first fix. Root cause: the `round_to` binary
grid `(x*1e8).round()/1e8` and the `{:.8}` decimal grid disagree exactly where
the f64 ULP meets 1e-8, so canonicalize -> parse -> canonicalize drifted.
Drop `round_to` entirely and quantize purely by `{:.8}` decimal rounding, which
is a fixed point while the 1e-8 grid stays coarser than the ULP (|x| < 2^52*1e-8
~ 4.5e7). At or above that limit the grid is finer than f64 can represent, so
emit the shortest round-trippable Display form instead. Combined with
serde_json's float_roundtrip parser this is idempotent across the whole finite
f64 range; the fuzz-found 44447444.444... and 5e55 are pinned as regressions.
Golden report/inputs hashes are unchanged — real report values are far below the
grid limit, where decimal rounding matches the old binary rounding exactly.
kingchenc
changed the title
…idempotent
A tiny negative such as -1e-9 formats as -0.00000000 under {:.8}, trims
to -0, and re-parses to -0.0 -> 0. The first canonicalization pass then
emitted -0 and the second 0, breaking the fixed-point property the moat
depends on. Drop the sign whenever the rounded value is zero, and pin it
with rounds-to-zero regression cases (found by the canonicalize fuzz
target on an input near -3.39e-339).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the three security workflows (codeql/scorecard/zizmor), SHA-pinned and least-privilege, mirroring the other Wickra repos.
While this PR ran, the fuzz-smoke job surfaced a second canonicalize idempotence break (input
44447444.444..., ~4.5e7) — theround_tobinary quantization grid disagrees with the{:.8}decimal grid right where the f64 ULP meets 1e-8. Fixed in the same PR: dropround_toand quantize purely by decimal rounding (a fixed point below2^52*1e-8), falling back to the shortest round-trippable Display form above that magnitude. Golden report/inputs hashes are unchanged; the fuzz-found inputs are pinned as regressions.