[hyperpolymath]

Atoma’s estate audit rejects its CLI file I/O because the Zig FFI rule scans every Zig source. Add an optional, literal tracked FFI scope and forward it through the canonical reusable audit; the default remains the existing repository-wide scan.

Explicit scopes fail when invalid, empty, unmatched, or when a selected tracked file is missing. Scanner errors fail closed. The rule remains a lexical policy check: callers must include the FFI implementation’s local import closure; this does not claim semantic effect analysis.

Validation: tests/zig-ffi-scope.sh passes the positive CLI/FFI separation control and rejects forbidden FFI I/O, repository-wide CLI I/O, unmatched/traversing/exclusion scopes and missing files. The existing language-gate CI now runs those controls. This fixes an upstream cause of hyperpolymath/atoma#3.

The action implementation pin must remain reachable from the canonical main history before consumers adopt it; merge/pin closure will be checked before Atoma is updated.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T19:46:18.313749Z	ef38cb4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Summary

Summary by CodeRabbit

• Chores
  • Updated automated checks to support scanning selected Zig FFI paths or all tracked Zig files.
  • Invalid or unmatched path scopes now fail validation, while scopes with no applicable files are reported as not applicable.
• Tests
  • Added automated coverage for scoped checks, including invalid scopes and files that use restricted I/O interfaces.

The Zig UnifiedApiAdapter check now accepts an optional scope of tracked Zig paths. A Bash checker validates and scans the selected files. The reusable audit workflow passes the scope to the action, and the self-test workflow runs scope checks.

Changes: Zig FFI Gate

Layer / File(s)	Summary
Scoped checker implementation actions/zig-unified-api-adapter-check/action.yml, actions/zig-unified-api-adapter-check/check.sh, tests/zig-ffi-scope.sh	The action passes its optional paths input to the checker. The checker selects tracked Zig files, rejects invalid or unmatched explicit scopes, and checks selected files for std.fs or std.io. The test harness covers valid and failing scope cases.
Reusable workflow scope input .github/workflows/main-estate-audit.yml	The reusable workflow adds the optional zig-ffi-paths input and passes it to the Zig UnifiedApiAdapter action.
Self-test workflow integration .github/workflows/language-gates-self-test.yml	The workflow path filters include the action and scope test. A self-test step runs the scope test script.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant WorkflowCaller
  participant MainEstateAudit
  participant ZigCheckAction
  participant CheckScript
  WorkflowCaller->>MainEstateAudit: Set zig-ffi-paths
  MainEstateAudit->>ZigCheckAction: Pass paths input
  ZigCheckAction->>CheckScript: Set FFI_PATHS and run check
  CheckScript->>CheckScript: Select and scan tracked Zig files

Loading

Merge Risk: Low · up to ef38c

The scoped check has no established common-path failure, but its negative tests can miss regressions. Tighten those assertions before relying on the self-test; the remaining risk is bounded.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud