fix(types): validate script JSON boundaries - #1679
Conversation
open-inspect
Bot
added
the
automation:unsafe-cast
Terraform Validation Results
Pushed by: @open-inspect[bot], Action: |
Terraform Validation Results
Pushed by: @ColeMurray, Action: |
ColeMurray
left a comment
ColeMurray
left a comment
There was a problem hiding this comment.
Reviewed exact head 3d4429a, every changed file and CLI boundary, all discussion, and main compatibility. The follow-up preserves current atomic merge safeguards, validates consumed telemetry fields without dropping raw output fields, and rejects malformed Wrangler rows instead of treating them as missing results. Both original findings remain relevant. All 38 CLI regression tests and exact-head CI passed; Terraform deployment jobs are intentionally skipped. No actionable review comments or remaining blockers.
2 participants
This is an automated nightly unsafe-cast remediation sweep. It replaces selected unsafe TypeScript casts at external/opaque JSON boundaries with local parse-and-validate guards, following the TypeScript Coding Standards guidance for unsafe casts / parse-don't-assert and the Zod boundary-validation pattern established in PR #807. These two script-local boundaries do not justify a new dependency, so the fixes use narrow inline structural guards instead of adding a schema library at the root.
scripts/cf-logs.tsawait response.json()asserted as a response object--jsonoutput.scripts/merge-split-users.tsJSON.parse(child.stdout)asserted asWranglerQueryResult[]The branch incorporates current main's user-merge CLI runner/test seam and atomic result-bearing batch behavior. No new dependency is introduced.
Verification
npm run test:user-merge-clinpm run test:cf-logs-cligit diff --check3d4429a9c8668209f1a4230f30bec584de06ea59: lint/format (including both CLI test suites), workspace typecheck, web build, control-plane unit tests, both integration shards, web tests, bot tests, Compose smoke, and Terraform validation. Terraform Plan/Apply are expected skips.Both CLI suites run in the TypeScript CI workflow. Tests do not access live Cloudflare services or production databases.
An additional direct strict typecheck of the user-merge script reproduces main's existing
SqlStatementto{ render(): string }assertion diagnostic; the JSON-boundary changes introduce no additional diagnostics in that check.Created with Open-Inspect