Three artifacts of the bad merge resolution on this branch are now corrected:
- [tool.coverage.report] section restored. The Robot integration test
``Coverage Threshold :: Noxfile Contains Coverage Threshold Constant``
asserts pyproject.toml contains ``fail_under = 96.5`` as the single
source for the coverage floor. The section was lost during merge-conflict
resolution; ``noxfile._read_coverage_fail_under`` was falling back to its
hard-coded default and the robot test was failing as a result.
- ``fastapi>=0.115.0`` (was 0.100.0). Master pins 0.115.0; the older floor
on this branch came in with the auto-scratch fix and is now bumped to
match.
- Duplicate ``langchain-anthropic>=0.2.0`` entry removed (line 40). Master
declares it once; the duplicate is a stray from the same bad merge.
Refs: #9055
Three step patterns in pyyaml_security_steps.py clashed with existing
step files, causing all Behave features to error at load time:
- "I call load_yaml_text with YAML text" clashed with actor_config_coverage_boost_steps.py:103
- "the load_yaml_text result should have key" clashed with actor_config_coverage_boost_steps.py:90
- "a ValueError should be raised" clashed with lsp_registry_steps.py:475
Rename all three to unique patterns and update pyyaml_security.feature
to match. Also fix typings/behave/runner.pyi ruff format (.pyi convention:
single blank line before class, no blank lines between stub methods) and
add missing fastapi>=0.100.0 to pyproject.toml (asgi_app.py imports
fastapi but it was absent from declared dependencies, causing typecheck
and integration test failures).
Refs: #9055
Remove ``# type: ignore[import-untyped]`` comments from features/steps/pyyaml_security_steps.py, replacing them with proper .pyi stubs for behave.runner.Context in typings/behave/runner.pyi.
Refs: #9055
Scenario 2 in features/pyyaml_security.feature referenced three step
definitions that were not implemented in the step file, causing
StepDefinitionNotFoundError and CI unit_tests failure:
- When I call load_yaml_text with YAML text "..."
- Then the load_yaml_text result should have key "..." equal to "..."
Added both missing step definitions with proper type annotations.
Also fixed dead code (except (ValueError, Exception) -> except Exception,
ruff B014) and toned down the alarmist assertion message per reviewer
feedback.
Added explicit pyyaml>=6.0.3 constraint to pyproject.toml to address
CVE-2017-18342 and related advisories. A codebase-wide audit confirmed
all YAML loading uses yaml.safe_load() exclusively via
cleveragents.actor.yaml_loader. Added BDD regression scenarios in
features/pyyaml_security.feature to verify the version constraint and
safe-load enforcement are maintained. Updated CHANGELOG.md with a
security entry.
ISSUES CLOSED: #9055
HAL9000
controller-ci-rerun