* segment: bound checkpoint tensors and pickle work
* segment: bound entry size, memo clones, and total tensor elements
* segment: cap cumulative decompressed storage bytes
The stat is the validation that rejects anything but an existing regular
file; annotate it with that reasoning.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
The path is the developer's own CLI build, stat'ed as a regular file before
use; suppress the taint finding with that reasoning.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Sonar applies NOSONAR to the line that carries the marker, so the
explanation above the call did not suppress anything.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Resolve the argument and require a regular file before spawnSync, which
never uses a shell and only runs fixed binaries or that validated path.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
- scriptui.js: replace the self-comparison NaN check (o.max === o.max) with
the explicit Number.isNaN(o.max) (S1764).
- sw.js: mark the fire-and-forget cache.put() with void and a .catch() so the
promise rejection is handled (S9383).
- prelude.js: return __err(...) from the activeCamera getter so every path
yields a value (S4275); __err always throws, so behavior is unchanged.
Replace Math.random() with crypto.randomUUID() when generating the unique
suffix for the atomic write-then-move temp file. The value isn't security-
sensitive, but a CSPRNG gives a stronger uniqueness guarantee and resolves
SonarCloud javascript:S2245.
Calls storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
with secrets: inherit. Adds SonarCloud badge to README where missing and
removes the redundant sonar-project.properties (config now passed by the
reusable workflow).
* ci: refactor workflows to use reusable artcraft-common-actions
* ci: point reusable workflows to storytold/craft-common-actions
* ci: pin storytold/craft-common-actions to commit 27a978f and pass secrets explicitly
* ci: use @main (unpinned) for craft-common-actions with explanation comment
Dylan M. Taylor