chore: purge committed backend/venv from version control (coverage + static-analysis hygiene)#78
Open
Prekzursil wants to merge 1 commit into
Open
chore: purge committed backend/venv from version control (coverage + static-analysis hygiene)#78Prekzursil wants to merge 1 commit into
Prekzursil wants to merge 1 commit into
Conversation
…static-analysis hygiene) Removes the accidentally-committed Python virtualenv at backend/venv/ (8,724 tracked files) from version control. Why: - It poisons the coverage denominator (third-party site-packages code is counted as project source). - It generates ~33 spurious CodeQL / static-analysis alerts on vendored third-party code that is not part of this project. .gitignore already had a bare `venv/` rule, but these files were committed before that rule existed, so Git kept tracking them. This change runs an explicit `git rm -r` and hardens .gitignore (venv/, .venv/, backend/venv/, **/site-packages/). Note: this does NOT address the separately-flagged leaked Azure Entra ID token (operator rotation required); that secret is not located inside the venv, so purging the venv does not remove or rotate it.
|
Unable to trigger custom agent "Code Reviewer". You have run out of credits 😔 |
|
Skipping CodeAnt AI review — this PR changes more than 100 files, which usually means a migration, codemod, or vendored drop. Line-level review on diffs this large produces duplicate findings on the same rewrite pattern and drowns out anything that actually matters. If you still want a review, comment |
|
Important Review skippedToo many files! This PR contains 162 files, which is 12 over the limit of 150. To get a review, narrow the scope: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (138)
📒 Files selected for processing (162)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review Summary by QodoRemove accidentally-committed Python virtualenv from version control and harden .gitignore WalkthroughsDescription• Removes 8,724 tracked files from the accidentally-committed Python virtualenv at backend/venv/ from version control • Hardens .gitignore with explicit rules for venv/, .venv/, backend/venv/, and **/site-packages/ to prevent future commits • Eliminates coverage metric pollution caused by third-party library code in site-packages/ being counted as project source • Eliminates ~33 spurious static-analysis (CodeQL) alerts generated by vendored third-party code • No first-party application code, tests, or configuration files are affected • No genuine secrets or project config files were removed (only benign venv-specific metadata like pyvenv.cfg) • Does not address separately-flagged Azure Entra ID token leak (requires separate operator rotation) Diagramflowchart LR
A["Committed backend/venv<br/>8,724 files"] -- "git rm -r" --> B["Removed from tracking"]
B -- "Hardens .gitignore" --> C["Prevents future commits"]
C --> D["Cleaner coverage metrics"]
C --> E["Reduced static-analysis noise"]
|
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require review |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review completed
Note: This PR contains a large number of files. cubic only reviews up to 100 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
On a pro plan you can use ultrareview for larger PRs.
Re-trigger cubic
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Up to standards ✅🟢 Issues
|
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purge committed Python virtualenv (
backend/venv/) from version controlPart of the quality-zero-platform drive-to-zero campaign (fleet-quality hygiene).
What this does
Removes the accidentally-committed Python virtualenv at
backend/venv/— 8,724 tracked files — from version control, and hardens.gitignore.Why
site-packages/is third-party library code that gets counted as project source, deflating/distorting coverage metrics.Removing the venv from tracking is a high-impact, low-risk cleanup: it touches no first-party application code.
Why it was still tracked
.gitignorealready had a barevenv/rule, but the venv files were committed before that rule existed —.gitignoreonly affects untracked files, so Git kept tracking them. This PR runs an explicitgit rm -r backend/venvand hardens the ignore rules:Scope / safety
backend/venv/is removed (it was the single tracked virtualenv in the repo — confirmed viapyvenv.cfg/site-packages/search). No first-party code, tests, or config changed.backend/venv/pyvenv.cfg(local machine paths + Python version — benign).Out of scope: leaked Azure Entra ID token
This PR does NOT address the separately-flagged leaked Azure Entra ID token. That secret does not live inside the venv, so purging the venv neither removes nor rotates it. Operator rotation of that token is still required and is being handled separately.
Summary by cubic
Removed the accidentally committed Python virtualenv at
backend/venv/and hardened.gitignoreto prevent tracking of virtualenvs andsite-packages. This fixes coverage pollution and removes noisy static-analysis alerts from third-party code.backend/venv/from version control.venv/,.venv/,backend/venv/,**/site-packages/.Written for commit 88d6eb0. Summary will update on new commits.