[BartLucien]

For some Ruling projects, the ruling-diff-comment doesn't work, as some file are not found. By cloning the submodules recursively, it should fix the issue.

[hashicorp-vault-sonar-prod]

RC-789

[gitar-bot]

CI failed: The Windows ruling job fails because JavaRulingTest.eclipse_jetty_incremental finds 2 issue differences, most likely from the PR's intentional 'Add artificial difference' fixture edits to eclipse-jetty S100/S107; the Ubuntu ruling job shows no failing step in the excerpt, so its status is unclear.

Overview

Two unique error templates were analyzed from 2 logs for commit f1f19f0. One is a test failure in the Windows ruling job that appears related to the PR; the other is an excerpt with no visible failure, so it cannot be diagnosed from what was provided.

Failures

Ruling test difference in eclipse_jetty_incremental (confidence: medium)

• Type: test
• Affected jobs: 122757166284
• Related to change: yes
• Root cause: JavaRulingTest.eclipse_jetty_incremental fails at JavaRulingTest.assertNoDifferences (JavaRulingTest.java:569) with "Issues differences: 2". The PR's "Add artificial difference" commit changes two eclipse-jetty expected ruling files (S100 and S107), which matches the failing project and the count of two differences. The recursive submodule checkout is not implicated by the shown failure.
• Suggested fix: Remove the artificial expected-ruling changes in the eclipse-jetty S100/S107 expected data, or regenerate that expected data to match actual analysis. If the artificial difference is needed to exercise diff-comment reporting, isolate that scenario so it does not fail the normal ruling test.

Ubuntu ruling job with no visible failure (confidence: high)

• Type: other
• Affected jobs: 122757167053
• Related to change: unclear
• Root cause: The excerpt shows diff-report generation and artifact upload completing successfully, with no error message or failing final conclusion. The truncated portion may contain the actual failure, so no root cause can be established.
• Suggested fix: Inspect the complete, untruncated job log for the first failed step and final job conclusion. If the job did not fail, confirm which job or error template should be analyzed.

Summary

• Change-related failures: 1 test failure (eclipse_jetty_incremental, 2 issue differences) that likely stems from the PR's intentional fixture edits.
• Infrastructure/flaky failures: None identified.
• Unclear relationship: 1 template (Ubuntu ruling job) with no visible failure; the relationship to the PR is unknown.
• Recommended action: Fix or isolate the artificial eclipse-jetty S100/S107 difference so the ruling test passes, then review the full Ubuntu job log to confirm whether it actually failed.

Code Review ⚠️ Changes requested 0 closed / 1 findings

🟡 Medium risk · Recursive submodule checkout changes which repository content the ruling-diff workflow fetches, potentially affecting its generated comment results.

Recursively checks out submodules in the ruling workflow so ruling-diff-comment can locate files in projects that use them. An open important finding flags that the test-only commit f1f19f0 deletes expected issues from the eclipse-jetty ruling baselines, which will fail the ruling IT if merged. Revert that commit before leaving draft.

⚠️ Bug: Test-only edits to ruling baselines will break ruling ITs if merged

📄 its/ruling/src/test/resources/expected/eclipse-jetty/java-S107.json:3 📄 its/ruling/src/test/resources/expected/eclipse-jetty/java-S100.json

Commit f1f19f0 ("Add artificial difference") deletes expected issues from the eclipse-jetty ruling baselines: HttpCookie.java line 110 is removed from java-S107.json and UnixCrypt.java line 395 is removed from java-S100.json. No analyzer change in this PR stops those issues from being raised, so the ruling IT will report them as unexpected and fail. The edits only exist to trigger the ruling-diff-comment workflow. Revert the commit before the PR leaves draft so that only the submodules: recursive workflow change gets merged.

Restore the original S107 baseline entry. Also restore line 395 in java-S100.json, for example with `git revert f1f19f0`.

"eclipse-jetty:jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java": [
105,
110
],

🤖 Prompt for agents

Code Review: Recursively checks out submodules in the ruling workflow so ruling-diff-comment can locate files in projects that use them. An open important finding flags that the test-only commit f1f19f0 deletes expected issues from the eclipse-jetty ruling baselines, which will fail the ruling IT if merged. Revert that commit before leaving draft.

1. ⚠️ Bug: Test-only edits to ruling baselines will break ruling ITs if merged
   Files: its/ruling/src/test/resources/expected/eclipse-jetty/java-S107.json:3, its/ruling/src/test/resources/expected/eclipse-jetty/java-S100.json

   Commit f1f19f0 ("Add artificial difference") deletes expected issues from the eclipse-jetty ruling baselines: `HttpCookie.java` line 110 is removed from `java-S107.json` and `UnixCrypt.java` line 395 is removed from `java-S100.json`. No analyzer change in this PR stops those issues from being raised, so the ruling IT will report them as unexpected and fail. The edits only exist to trigger the ruling-diff-comment workflow. Revert the commit before the PR leaves draft so that only the `submodules: recursive` workflow change gets merged.

   Fix (Restore the original S107 baseline entry. Also restore line 395 in java-S100.json, for example with `git revert f1f19f0`.):
   "eclipse-jetty:jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java": [
   105,
   110
   ],

Verification Rules 3/3 met Knowledge ✅ 1 PRs 3 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Knowledge ✅ 1 expectation met

Ruling baseline project-key format expectation met

Broader impact PRs 3 inspected

Cross-PR 3 PRs inspected 0 open impacts

PR 15: Remove self-referencing submodules, copy content to respective directories Inspected
PR 14: Remove self-referencing submodules, merge Jetty variants Inspected
PR 6418: RC-353 Test Sarif diff Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact	Unblock
gitar auto-apply:on	gitar display:verbose	gitar unblock

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-actions]

Ruling Diff Summary

Detected changes in 2 rule files: 0 issues removed, 2 issues added.

S100 (java) on eclipse-jetty - 0 issues removed, 1 issues added

Added jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java (line 395)

(source file not found at this revision: jetty-util/src/main/java/org/eclipse/jetty/util/security/UnixCrypt.java)

S107 (java) on eclipse-jetty - 0 issues removed, 1 issues added

Added jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java (line 110)

(source file not found at this revision: jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java)

[gitar-bot]

⚠️ Bug: Test-only edits to ruling baselines will break ruling ITs if merged

Commit f1f19f0 ("Add artificial difference") deletes expected issues from the eclipse-jetty ruling baselines: HttpCookie.java line 110 is removed from java-S107.json and UnixCrypt.java line 395 is removed from java-S100.json. No analyzer change in this PR stops those issues from being raised, so the ruling IT will report them as unexpected and fail. The edits only exist to trigger the ruling-diff-comment workflow. Revert the commit before the PR leaves draft so that only the submodules: recursive workflow change gets merged.

Restore the original S107 baseline entry. Also restore line 395 in java-S100.json, for example with git revert f1f19f0.:

"eclipse-jetty:jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java": [
105,
110
],

• Apply fix

_{Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎}

[datadog-sonarsource]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

Build | Ruling QA (warp-custom-ubuntu-24-04, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Build | Ruling QA (warp-custom-windows-2022-l, without-sonarqube-project, LATEST_RELEASE) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f1f19f0 | Docs | View more details | Give us feedback!}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[github-actions]

⚖️ Ruling update ready for review: #6422

[github-actions]

This PR is stale because it has been open 7 days with no activity. If there is no activity in the next 7 days it will be closed automatically