block/check-safety
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(scan-roots): detect consolidated CMS layout (backend/go.mod + web/src)

Browse Source 
The old detection keyed on backend/cmd/check-safety, which left the CMS
tree when check-safety was hoisted standalone. Since then the CMS
resolved as its own backend: web/ was classified as a plugin frontend
(strict rules, allowedFrontendFiles bypassed — audit F2's check-5 noise),
check 2 demanded RBAC entries for client-only orchestrator protos
(audit F3), check 2c flagged a bogus missing go.mod, and checks 3/3b
silently SKIPPED. Recognize backend/go.mod + web/src as the CMS shape
so backendDir resolves to backend/ and web/src scans under core rules.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Alex Dunmow 2026-06-10 14:52:35 +08:00
parent 57bca429cc
commit 0e8d0e6d1c
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
targets.go
View File

@ -53,6 +53,15 @@ func resolveScanRoots(target string) (backendDir string, repoRoot string, err er
return filepath.Join(absTarget, "backend"), absTarget, nil
}
// Consolidated CMS layout — Go module at backend/, frontend at web/src.
// The clause above keys on backend/cmd/check-safety, which left the CMS
// tree when check-safety was hoisted to its own repo; without this one
// the CMS resolves as its own backend, web/ is classified as a plugin
// frontend, and the strict plugin rules bypass allowedFrontendFiles.
if fileExists(filepath.Join(absTarget, "backend", "go.mod")) && dirExists(filepath.Join(absTarget, "web", "src")) {
return filepath.Join(absTarget, "backend"), absTarget, nil
}
if dirExists(filepath.Join(absTarget, "cmd", "check-safety")) {
parent := filepath.Clean(filepath.Join(absTarget, ".."))
if fileExists(filepath.Join(parent, "buf.yaml")) {