Rca tool

[fede2cr]

Adding rca-tool:

• Web interface in leptos, uses WASM to run without any install required and uses stream decompression to analyze
• Rust library released into crate.io, includes CLI tool with text and JSON output
• Python native library that wraps the rust library, released into pypi, includes CLI tool with text and JSON output
• MCP library for interacting with agents, released as crate
• VSCode extension that packages mcp library with rust cli tool
• Extensive testing of the library via the web output via sample files created during CI runs ("fixtures") using Playwright, as well as rust and python unit testing

[jonathanbrenes]

PR #135 Review - RCA Tool by fede2cr

Metadata

• PR: Rca tool by fede2cr · Pull Request #135.
• Review date: 2026-07-17.
• Reviewer: GitHub Copilot.
• Base branch used for analysis: origin/master.
• Compared branch in local workspace: pr-135.

Scope Reviewed

• High-risk CI/CD workflows for build, test, publish, and deployment.
• Runtime-critical entry points in the web worker and CLI.
• VS Code extension activation/bootstrap path.
• Repository-wide pattern scan for high-risk code constructs.

Executive Summary

• The PR is a very large initial import of the rca-tool stack and includes web UI, Rust libraries, CLI tooling, tests, and release pipelines.
• One high-severity CI portability issue was found that can break release-tag builds on Windows.
• One low-severity source correctness issue was found in the worker file that can become a latent runtime bug.
• No critical secret-exposure pattern was identified in the sampled workflow and runtime paths.

Findings (Ordered by Severity)

ID	Severity	Area	Status	Summary
F-001	High	CI / Release pipeline	Action required	Bash script invocation is not portable on Windows matrix jobs for tag builds.
F-002	Low	Web worker source	Action required	WORKER_VERSION declaration is unintentionally commented out due to escaped newline text.

Detailed Findings

F-001 - Non-portable tag step on Windows matrix jobs

Severity: High.

Why this matters:

• Release-tag builds are expected to run the full matrix for packaging/publishing artifacts.
• A shell mismatch in one matrix OS can fail jobs and block downstream publish stages.

Evidence:

• Set crate versions step in Rust core job.
• Set crate versions step in Python wheel job.
• Script being invoked: set-crate-version-from-tag.sh.

The workflow calls a Bash script using:

- name: Set crate versions from tag
  if: startsWith(github.ref, 'refs/tags/v')
  run: .github/scripts/set-crate-version-from-tag.sh

The matrix includes Windows runners:

- os: windows
  arch: amd64
  runner: windows-latest

On Windows, default run shell is PowerShell unless explicitly overridden. Executing a .sh path directly is not portable there.

Impact:

• Tag-triggered Windows legs can fail early.
• Potentially blocks jobs that depend on successful matrix completion.
• Can delay or prevent release artifact publication.

Recommended fix:

Use one of the following approaches:

1. Gate the step to non-Windows runners.
2. Force Bash shell for the step and invoke with bash explicitly.
3. Re-implement version rewrite in a cross-platform script (Node.js or PowerShell).

Minimal tactical patch:

- name: Set crate versions from tag
  if: startsWith(github.ref, 'refs/tags/v') && matrix.os != 'windows'
  run: .github/scripts/set-crate-version-from-tag.sh

Alternative tactical patch:

- name: Set crate versions from tag
  if: startsWith(github.ref, 'refs/tags/v')
  shell: bash
  run: bash .github/scripts/set-crate-version-from-tag.sh

Validation after fix:

• Trigger a tag build in a test branch and verify Windows matrix jobs no longer fail in this step.
• Confirm crate and wheel versions are still rewritten correctly on supported runners.

F-002 - Worker version constant is not actually declared

Severity: Low.

Why this matters:

• Source readability and future safety are reduced when intent and behavior diverge.
• A latent bug can become active if code later references the constant.

Evidence:

• worker.js malformed declaration line.

Current line content effectively places declaration text inside a single-line comment:

// Version is only logged when debug mode is enabled\nconst WORKER_VERSION = '2025-12-23-nested-gzip';

Impact:

• WORKER_VERSION is not defined at runtime.
• If later referenced, this can throw ReferenceError.

Recommended fix:

Replace with two real lines:

// Version is only logged when debug mode is enabled
const WORKER_VERSION = '2025-12-23-nested-gzip';

Validation after fix:

• Ensure worker boot still succeeds.
• If version logging is implemented later, verify the constant resolves correctly.

Suggested Merge Gate

• Block merge until F-001 is resolved.
• Resolve F-002 either in this PR or as an immediate follow-up patch.

[jonathanbrenes]

As @fede2cr provided evidence. The powershell is actually able to manage the shell script properly during the build. So this is not a blocker anymore

[jonbrefe]

Everything looks fine