[PR] fix(setup-preflight): accept sha512 in svn-zip locks [magpie]

["MakerFlyFly (via GitHub)" <gi...@apache.org>]

MakerFlyFly opened a new pull request, #1596:
URL: https://github.com/apache/magpie/pull/1596

   ## Summary
   
   - The documented svn-zip project lock includes `sha512:`, but the original parser rejected it and made the shared pre-flight exit 2 before reporting setup findings.
   - Accept and retain the digest only for `method: svn-zip`, independent of field order. Invalid methods and empty digests raise `MalformedLock`; scalar keys come from `Lock` while `plugins` and `reconciled` remain structured blocks.
   - Add regression coverage for these boundaries, unknown keys, and both existing forms of a svn-zip local lock. The original fix remains in history; the review revision is appended to it.
   
   ## Type of change
   
   - [x] Python package (`tools/*/` with `pyproject.toml`)
   
   ## Test plan
   
   - [x] `prek run --all-files` passes, including lychee, workspace checks and skill-script tests.
   - [x] Python 3.11.2 and 3.12.12: all 156 `setup-preflight` tests pass.
   - [x] Ruff check, Ruff format check, and member-config mypy (18 source files) pass.
   - [x] On `20cbbc56`, all 15 method-restriction and empty-value diagnostic cases fail; they pass with the revision. The original parser compatibility regression was separately demonstrated on `4556f693`.
   - [x] Actual CLI: 20 scenarios cover both key orders, four other installation methods, missing/unknown methods, empty/comment-only digests, `sha521:`, and invalid scalar assignments to structured blocks. Invalid cases exit 2; valid svn-zip locks still report `snapshot-never-fetched` and `sweep-never-run`.
   - [x] Existing svn-zip local locks with empty or version-shaped `fetched_commit` remain readable when recorded pin fields match.
   - [x] Independent zizmor check passes.
   
   ## RFC-AI-0004 compliance
   
   This parser-only correction restores the documented lock contract. It adds no outbound action, host access, configurable skill policy, or LLM data flow. No skill prompt material, dependency or local-lock schema changes.
   
   ## Linked issues
   
   Closes #1595.
   
   ## Notes for reviewers (optional)
   
   This PR targets apache/magpie:main from MakerFlyFly:fix/setup-preflight-svn-zip-sha512. The author has completed human review. The two commits retain the original fix and its scoped review revision; the aggregate diff is limited to lockfile.py and test_core.py (+70/-2). Public audit records: https://github.com/MakerFlyFly/magpie/issues/4 and https://github.com/MakerFlyFly/magpie/pull/5.
   
   **Scope and remaining limits:** this fixes parsing and the applicability of the new digest field. It does not provide SHA-512 drift detection or ZIP integrity attestation. `upgrade.md` requests a security-flagged finding when a digest changes under the same version, but the existing local lock records no fetched digest. Implementing that requires coordinated persistence, parser, comparison and legacy-lock changes and is a separate task. This revision does not add digest format checks, duplicate-key policy, general per-method schema validation or a documentation-template test harness.
   
   **How svn-zip adopters receive the fix:** the maintainers must advance the committed pin to a release that contains it, install/upgrade to that snapshot, and refresh the personal checker from that updated source. Repeating `config` or `upgrade` with the same affected pinned snapshot copies the old parser again and does not fix this error. This PR does not change adopter pins or automate an upgrade.
   
   Validation uses a Linux checkout with real Git symlinks and Docker `--init`; the Windows checkout keeps its existing symlink configuration. Prior reproduction and validation records are preserved, and revision records are stored separately. Python 3.9 is outside the package's declared Python 3.11+ support range.
   
   ---
   
   Generative AI (Codex, GPT-6) assisted reproduction, implementation and validation. The author has completed human review of the final change and owns this contribution; upstream maintainer review is pending.
   
   Suggested labels: bug, family:setup, substrate:setup, capability:fix.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(setup-preflight): accept sha512 in svn-zip locks [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1596:
URL: https://github.com/apache/magpie/pull/1596


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org