From a051f21b85d25d34cf0f4f35cd1af6a9c68d0712 Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Mon, 10 Aug 2026 13:48:20 +0200 Subject: [PATCH] fix: code-review: skip generated sources in the scanned file set --- CHANGELOG.md | 4 ++++ commands/code-review.md | 15 +++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 301b762..232c3b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/). * MINOR version when you add functionality in a backwards-compatible manner, and * PATCH version when you make backwards-compatible bug fixes. +## Unreleased + +- fix: code-review: skip generated sources when building the scanned file set — the existing path filter (`vendor`, `node_modules`, `dist`, `build`, `coverage`) cannot catch generated code living in ordinary package directories (`k8s/client/`, `mocks/`, `zz_generated.*`). Files whose first 25 lines carry `Code generated … DO NOT EDIT` are now dropped. Measured on `bborbe/backup`: 97 of 553 findings were generated-file noise, and 44+ of the 102 that reached adjudication were refuted solely on that basis. + ## v0.42.0 - feat: golden set covers `curated-1` — 155 entries over 20 PRs, up from 42 over 5. All 115 unmatched findings from the curated-1 Opus pass were adjudicated individually: 113 new entries, plus 2 findings that turned out to be an issue the set already held, re-reported in different words, where the existing key was relaxed rather than duplicated. One issue, one entry — a duplicate is what inflated recall to a spurious `1.000` in `v0.37.0` diff --git a/commands/code-review.md b/commands/code-review.md index 55588cd..7b4c85e 100644 --- a/commands/code-review.md +++ b/commands/code-review.md @@ -48,6 +48,21 @@ mv /tmp/code-review-files.txt /tmp/code-review-filelist.txt `dist/`, `build/`, and `coverage/` matter once JavaScript and TypeScript are in scope: a committed bundle is generated, minified, and often a single multi-megabyte line. Reviewing it produces findings nobody can act on and can exhaust the context window on one file. The pattern is anchored to a path segment rather than the line start, so a nested `frontend/app/dist/` is excluded too. +Then drop generated sources, which the path filter above cannot catch: + +```bash +while IFS= read -r f; do + head -25 "$f" | grep -q 'Code generated .* DO NOT EDIT' || echo "$f" +done < /tmp/code-review-filelist.txt > /tmp/code-review-files.txt +mv /tmp/code-review-files.txt /tmp/code-review-filelist.txt +``` + +Generated code lives in ordinary package directories — `k8s/client/`, `mocks/`, `zz_generated.deepcopy.go` — so no path pattern finds it. Its findings are unactionable by construction: the file says DO NOT EDIT, regeneration reverts any edit, and a genuine defect belongs upstream in the generator, not in this repo's review. + +**Scan the first ~25 lines, not the first line.** Placement varies by generator: `counterfeiter` emits the marker on line 1, while `client-gen` emits a licence header first and the marker on line 4. A `head -3` check silently misses every client-gen file. + +Measured on `bborbe/backup` (2026-08-10): 97 of 553 findings came from 25 client-gen files under `k8s/client/**` plus the `mocks/` tree, and **44+ of the 102 findings that reached adjudication were refuted for no reason other than being generated** — the largest single adjudication cost on that repo. + This is the **scope source** — every file the audit considers. Replaces the diff-based file list that `/coding:pr-review` and `/coding:local-review` use. ## Step 2: Project Detection + LICENSE check