Skip to content

Freeze measurement score indices#4473

Closed
FlorianPfaff wants to merge 4 commits into
mainfrom
agent/freeze-measurement-score-indices
Closed

Freeze measurement score indices#4473
FlorianPfaff wants to merge 4 commits into
mainfrom
agent/freeze-measurement-score-indices

Conversation

@FlorianPfaff

@FlorianPfaff FlorianPfaff commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Bug

MeasurementScore is a frozen dataclass in a module explicitly providing non-mutating result containers, but it retained the caller's mutable active_measurement_indices list directly.

That allowed external mutation to change an already-created score. In particular, appending to an originally empty list could silently change score.is_active from False to True, potentially causing update logic to treat a skipped measurement batch as active.

Fix

  • accept sequence-like index inputs as before
  • normalize active_measurement_indices to an owned tuple in __post_init__
  • preserve NumPy index-array support and existing tracker iteration/length behavior
  • add a regression that mutates the source list after construction and verifies the score remains inactive

Validation

  • syntax-compiled the modified module and test
  • ran a focused runtime regression for caller-list mutation and NumPy array conversion
  • branch comparison: 2 commits ahead of main, 0 behind
  • diff is limited to the measurement-score container and its focused test

The full repository matrix should run on this pull request.

@github-actions

github-actions Bot commented Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅MegaLinter analysis: Success

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ COPYPASTE jscpd yes no no 26.35s
✅ JSON prettier 7 0 0 0 1.08s
✅ JSON v8r 7 0 0 4.05s
✅ MARKDOWN markdownlint 68 0 0 0 2.1s
✅ MARKDOWN markdown-table-formatter 68 0 0 0 0.89s
✅ PYTHON black 1550 199 0 0 99.4s
✅ PYTHON isort 1550 370 0 0 2.76s
✅ REPOSITORY betterleaks yes no no 2.45s
✅ REPOSITORY checkov yes no no 53.5s
✅ REPOSITORY gitleaks yes no no 14.73s
✅ REPOSITORY git_diff yes no no 0.36s
✅ REPOSITORY secretlint yes no no 65.73s
✅ REPOSITORY syft yes no no 5.69s
✅ REPOSITORY trivy-sbom yes no no 7.41s
✅ REPOSITORY trufflehog yes no no 31.85s
✅ YAML prettier 11 0 0 0 0.81s
✅ YAML v8r 11 0 0 12.16s
✅ YAML yamllint 11 0 0 0.73s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters PYTHON_BLACK,PYTHON_ISORT,COPYPASTE_JSCPD,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@FlorianPfaff
FlorianPfaff marked this pull request as ready for review July 16, 2026 21:09
@FlorianPfaff
FlorianPfaff enabled auto-merge (squash) July 16, 2026 21:09
@FlorianPfaff ChatGPT Codex Connector

FlorianPfaff commented Jul 17, 2026

Copy link
Copy Markdown
Owner Author

Closing after a second validation attempt. The branch remains red specifically across the NumPy 3.11, 3.12, and 3.14 matrix jobs, despite packaging, documentation, lint, security, JAX, and PyTorch paths being healthy. The change is a small defensive immutability hardening, and resolving the backend-specific compatibility fallout is disproportionate to its current value. The focused patch remains recoverable if this mutation pattern is observed in real use.

auto-merge was automatically disabled July 17, 2026 13:40

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@FlorianPfaff