inspequte-oss-fp-hunt

分类: 开发与编程 | 上传者: KengoTODA | 下载: 0 | 版本: v1.0（最新）

针对小型 OSS 库（Kotlin 和 Java+Guava）运行 inspequte 误报搜索，在克隆的固定装置中启用 inspequte-gradle-plugin，通过共享的 `scripts/capture-jaeger-trace-screenshot.mjs` 帮助程序捕获 Jaeger 跟踪屏幕截图，并一一分类 SARIF 发现。

更新日志: Source: GitHub https://github.com/KengoTODA/inspequte

目录结构

当前层级: tree/main/.codex/skills/inspequte-oss-fp-hunt/

📁 agents/
- 📄 openai.yaml 276 B
📁 references/
- 📄 fixtures.md 525 B
- 📄 jaeger-screenshot.md 648 B
📁 scripts/
- 📄 patch-fixtures.sh 2.0 KB
- 📄 prepare-fixtures.sh 857 B
- 📄 run-once.sh 8.7 KB
📄 SKILL.md 3.3 KB

SKILL.md

---
name: inspequte-oss-fp-hunt
description: Run inspequte false-positive hunting against small OSS libraries (Kotlin and Java+Guava), enable inspequte-gradle-plugin in cloned fixtures, capture Jaeger trace screenshots via the shared `scripts/capture-jaeger-trace-screenshot.mjs` helper, and triage SARIF findings one by one.
---

# inspequte OSS FP hunt

## Inputs
- Repository root of this project (contains `gradle-plugin/` and `target/debug/inspequte`).
- Docker available for Jaeger.
- Java 21 available and set via `JAVA_HOME`.
- Network access to clone OSS fixtures from GitHub.
- Node.js + npm available for screenshot capture.

## Outputs
- Fixture clones and temporary patches under `target/oss-fp/workdir/`.
- SARIF reports under `target/oss-fp/<fixture>/inspequte/`.
- Triage ledgers under `target/oss-fp/triage/`.
- Run summary in `target/oss-fp/report.md`.
- Jaeger screenshot and trace analysis under `target/oss-fp/jaeger/`.

## Fixture policy
Default fixture set:
- Kotlin fixture: `plasmoapp/plasmo-config`
- Java+Guava fixture: `launchdarkly/okhttp-eventsource`

If one fixture is not buildable, replace it with another thin OSS fixture of the same category and record the reason in `target/oss-fp/report.md`.

## Workflow
1. Execute `.codex/skills/inspequte-oss-fp-hunt/scripts/run-once.sh` from repository root.
2. The script clones fixtures, enables `io.github.kengotoda.inspequte` with local `includeBuild`, runs analysis tasks, exports SARIF, and writes triage ledgers with first-pass `TP`/`FP`/`FAILED` classification plus reason and `spec=...` reference.
3. Export trace JSON and resolve trace ID:
   - `trace_json="$(JAEGER_OUT_DIR=target/oss-fp/jaeger .codex/skills/jaeger-spotbugs-benchmark/scripts/export-jaeger-trace.sh)"`
   - `trace_id="$(basename "${trace_json}" .json)"`
   - `trace_id="${trace_id#jaeger-trace-}"`
4. Prepare Playwright runtime once per environment:
   - `npm install --no-save --no-package-lock playwright@1.53.0`
   - `npx playwright install --with-deps chromium`
5. Capture screenshot via shared script:
   - `screenshot_png="$(JAEGER_OUT_DIR=target/oss-fp/jaeger node scripts/capture-jaeger-trace-screenshot.mjs "${trace_id}")"`
6. Analyze trace:
   - `.codex/skills/jaeger-spotbugs-benchmark/scripts/analyze-trace-json.sh "${trace_json}"`
7. Review findings one-by-one in each triage ledger and adjust status only when code evidence contradicts the first-pass classification.

## Finding triage rules
First-pass automated classification in `run-once.sh`:
- `FP` when file is under `/.gradle/caches/modules-2/` (classpath dependency out of scope).
- `FAILED` when `line=0` (non-actionable location; requires manual rule/location handling).
- `FP` when duplicated by exact key `(rule, file, line, message)` after first occurrence.
- Other findings are marked `FAILED` with `spec=<path>` to the corresponding rule spec file.

Manual review policy:
- Confirm referenced file/line exists in fixture source.
- Compare finding message and source code against the referenced `spec.md`.
- Resolve `FAILED` items first, then override status only with short code-backed reason.

## Guardrails
- Do not edit fixture repositories outside `target/oss-fp/workdir/`.
- Keep all artifacts under `target/oss-fp/`.
- Do not report performance bottlenecks without numeric evidence from trace summary.
- Keep screenshot files only under `target/oss-fp/jaeger/`.

登录后下载/点赞/收藏 ❤ 6 | ★ 0

inspequte-oss-fp-hunt

目录结构

SKILL.md

举报内容

提示