fix: harden range note parsing#531
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.
Hardens untrusted note/range parsing in RangeAnalyzer by bounding note strings and switching _parse_note from regex-based parsing to bounded character-level parsing, plus adds regression tests for new behaviors.
Changes:
- Add
_MAX_NOTE_LENGTHand enforce note-length bounds in_parse_noteandRangeAnalyzer.analyze()serialization. - Replace regex note parsing with a bounded character-level parser (including
sharp/flattext forms). - Add tests for long inputs, text accidentals, and inverted-range overlap behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| services/analysis-engine/src/bandscope_analysis/ranges/analyzer.py | Adds bounded parsing/serialization and refactors overlap detection loop and severity computation. |
| services/analysis-engine/tests/test_ranges.py | Adds coverage for text-accidental parsing, overlong input bounding, and inverted-range overlap behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Addressed the four range hardening review threads in
Verification:
|
|
Security Notes:
This resolves both the release-preflight coverage failure and the Rust security-audit failure for this PR. |
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryApproval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: analyzer.py"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: analyzer.py"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_ranges.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_ranges.py"]
R2 --> V2["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including apps/desktop/src-tauri/.cargo/audit.toml, apps/desktop/src-tauri/Cargo.lock, apps/desktop/src-tauri/osv-scanner.toml, docs/security/dependency-policy.md, services/analysis-engine/src/bandscope_analysis/ranges/analyzer.py, and 1 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects apps/desktop/src-tauri/.cargo/audit.toml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: All tests passed with 100% coverage, security exceptions properly documented, and range parsing hardened
- Head SHA:
0ce99953f79a8f4946ac4315ceec47a3402324dc - Workflow run: 28588813338
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs: dependency-policy.md"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs: dependency-policy.md"]
R2 --> V2["docs review"]
Evidence --> S3["Test: test_ranges.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_ranges.py"]
R3 --> V3["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including services/analysis-engine/src/bandscope_analysis/ranges/analyzer.py, services/analysis-engine/tests/test_ranges.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects services/analysis-engine/src/bandscope_analysis/ranges/analyzer.py to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: All verification checks passed with 100% coverage for modified files
- Head SHA:
468e4b17778a28a9b9bcbf8948d9145b6fd59250 - Workflow run: 28623068129
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file: analyzer.py"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file: analyzer.py"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_ranges.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_ranges.py"]
R2 --> V2["targeted test run"]
Summary
developwithout the unrelated workflow, lockfile, and test deletion churn.Test Plan
uv sync --project services/analysis-engine --devuv run pytest tests/test_ranges.pyfromservices/analysis-engineuv run ruff check src/bandscope_analysis/ranges/analyzer.py tests/test_ranges.pyfromservices/analysis-engineuv run pytestfromservices/analysis-engine(436 passed, 3 existing librosa warnings)python3 scripts/checks/security_gates.pypython3 scripts/checks/verify_supply_chain.pypython3 scripts/checks/verify_security_notes.pygit diff --checkSupersedes #431.