From 21b6e6c50344cc26019687b2d85593de3a8f530a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pato=20Sanda=C3=B1a?= Date: Fri, 28 Aug 2026 21:06:51 -0400 Subject: [PATCH 1/2] fix(cargo-gamma-unsafe): avoid clippy::fn_to_numeric_cast_any on the MSRV toolchain The `dying_resets_the_disposition_to_the_default_before_re_raising` test installed its handler with `record as *const () as libc::sighandler_t`. Clippy 1.95 -- the RUST_MSRV toolchain the publish pipeline builds with -- flags the `record as *const ()` sub-cast under `clippy::fn_to_numeric_cast_any`, so `-D warnings` broke `Build and Test` on linux for both dev and release. Newer clippy (1.97, RUST_LATEST) no longer flags the pointer form, which is why it passed local checks. Widen the function the same way `install_with` and the sibling `every_terminal_signal_is_armed_to_survive_its_own_delivery` test already do -- `record as extern "C" fn(i32) as usize` under an `#[expect(clippy::fn_to_numeric_cast_any, ...)]` -- which the lint fires on identically across 1.95 and 1.97, keeping the expectation fulfilled on both toolchains. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ff5a5cc-ea89-4c8e-a67a-ab83c17b8224 --- crates/cargo-gamma-unsafe/src/interrupt.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/crates/cargo-gamma-unsafe/src/interrupt.rs b/crates/cargo-gamma-unsafe/src/interrupt.rs index 5c2e3b55..1aef9d2f 100644 --- a/crates/cargo-gamma-unsafe/src/interrupt.rs +++ b/crates/cargo-gamma-unsafe/src/interrupt.rs @@ -678,9 +678,14 @@ mod tests { DELIVERED.store(true, Ordering::SeqCst); } + // C spells a signal handler as an integer, so the function has to be widened into one, + // exactly as `install_with` does for the production handler. + #[expect(clippy::fn_to_numeric_cast_any, reason = "the C signal API takes a handler as an integer")] + let record_handler: libc::sighandler_t = record as extern "C" fn(i32) as usize; + // SAFETY: installs a handler for a signal this test both owns for its whole process and // chooses because it cannot terminate the process by default. - let _previous = unsafe { libc::signal(libc::SIGCHLD, record as *const () as libc::sighandler_t) }; + let _previous = unsafe { libc::signal(libc::SIGCHLD, record_handler) }; die(libc::SIGCHLD); From 79cda2255d538a702e63ba13593a6b1c7f998eba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pato=20Sanda=C3=B1a?= Date: Fri, 28 Aug 2026 21:07:04 -0400 Subject: [PATCH 2/2] ci: baseline SDL ESLint no-inner-html on the vendored mutation viewer The SDLSources stage's ESLint tool flags `innerHTML`/`insertAdjacentHTML` usage (`@microsoft/sdl/no-inner-html`) inside `crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js`, the minified mutation-testing-elements 3.9.0 bundle we inline via `include_str!` for offline report rendering. Those three errors broke the Guardian post-analysis step of the publish pipeline. The bundle is vendored third-party code we edit only by re-vendoring, so add the repo-root `guardian_baselines.gdnbaselines` the publish pipeline already looks for (mirroring ox-sdk), suppressing exactly those three findings by their Guardian signatures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ff5a5cc-ea89-4c8e-a67a-ab83c17b8224 --- guardian_baselines.gdnbaselines | 63 +++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 guardian_baselines.gdnbaselines diff --git a/guardian_baselines.gdnbaselines b/guardian_baselines.gdnbaselines new file mode 100644 index 00000000..505dc913 --- /dev/null +++ b/guardian_baselines.gdnbaselines @@ -0,0 +1,63 @@ +{ + "properties": { + "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/baselines" + }, + "version": "1.0.0", + "baselines": { + "guardian-baseline": { + "name": "guardian-baseline", + "createdDate": "2026-08-29 01:01:08Z", + "lastUpdatedDate": "2026-08-29 01:01:08Z" + } + }, + "results": { + "76fd7a25c28f9262a9374458b53900557205bd749d44fc487f5c5959f66ae373": { + "signature": "76fd7a25c28f9262a9374458b53900557205bd749d44fc487f5c5959f66ae373", + "alternativeSignatures": [ + "d5579b003cf7281b08d85c890a30fc4c35a86b3f529ce49433b01e281d4b3135", + "70fa041a3c325fe39527255e4d9ba5be73545c59b593ac04560e0a38395f358e", + "a70c9324a6828d8ebbed3b533c86cd762dd13416d8e7fa0a5832f03ecd64f6d2" + ], + "target": "crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js", + "line": 2, + "memberOf": [ + "guardian-baseline" + ], + "tool": "eslint", + "ruleId": "@microsoft/sdl/no-inner-html", + "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring." + }, + "6c2296c115b4b8e065b919eac81644836d8995df35d788303693fc78d10b940d": { + "signature": "6c2296c115b4b8e065b919eac81644836d8995df35d788303693fc78d10b940d", + "alternativeSignatures": [ + "a086649633e0807a3bf8b158f7bde6ff79f7c9f79137c39d73e9e1e491c2c478", + "9adc979fa9ea8c34cdf268569ca111efa8435638b4db7aec448e55250d5535b4", + "1e11790819e5e5fb85d0b633f931d36100b5841d3618b9aa67aca1781e578d0f" + ], + "target": "crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js", + "line": 4, + "memberOf": [ + "guardian-baseline" + ], + "tool": "eslint", + "ruleId": "@microsoft/sdl/no-inner-html", + "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring." + }, + "c4f9dd267f73ed656e10bef2a86d91248af954f913c1c22b01fb09c9a52af6c8": { + "signature": "c4f9dd267f73ed656e10bef2a86d91248af954f913c1c22b01fb09c9a52af6c8", + "alternativeSignatures": [ + "551b2c218b40b608702491ef12fb494316a9a08a55c552327b9b8609df88988f", + "61b6972e757217738b718e807a998e49c3bb6211fc8ec36d313ed9316c1eec9c", + "8104abcdc875f7de72700d2fa22d4f59bb668d1b945ba72d7ff1a6f073171d6b" + ], + "target": "crates/cargo-gamma-lib/src/vendor/mutation-test-elements.js", + "line": 89, + "memberOf": [ + "guardian-baseline" + ], + "tool": "eslint", + "ruleId": "@microsoft/sdl/no-inner-html", + "justification": "Vendored, minified third-party bundle (mutation-testing-elements v3.9.0) inlined via include_str! for offline mutation-report rendering; not first-party code and edited only by re-vendoring." + } + } +}