marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-11-14 10:18:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(hunt): contamination check (4.5): runs that used a reported repository are marked and kept out of any gain

Browse Source 
contamination.py reads the repositories named by the held-out pilot manifest and by every
benchmark report (accepted_repos.json and NOTES.md links under benchmarks/measurements), marks
each run directory clean or contaminated with the report digest and time, and refuses to count
an unchecked run toward a gain. ablation.analyse carries excluded_from_gain when its run is
contaminated. Implemented by Codex (gpt-6-astra), gated here; the benchmark import is lazy so
the package imports without the benchmarks tree.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-13 19:03:23 +02:00
co-authored by Claude Fable 5.1
parent 6e5d060de6
commit dbaaa86d5b
4 changed files with 319 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/hunt/ablation.py
+10 -1
View File
@@ -394,10 +394,19 @@ def analyse(out_dir: Path | str, manifest: Manifest, changes: Sequence[Mapping[s
for arm, mask in manifest.arms.items()
}
result["dry_run"] = sum(c["kind"] == "vulnerability" for c in changes) < 40
contamination_path = out / "contamination.json"
if contamination_path.exists():
contamination = json.loads(contamination_path.read_text(encoding="utf-8"))
result["contaminated"] = bool(contamination["contaminated"])
result["contaminating_repositories"] = contamination["repositories"]
if result["contaminated"]:
result["excluded_from_gain"] = True
_write(out / "analysis.json", result)
table = importance(result, annotations=[name for name, _, _ in INPUTS])
_write(out / "importance.json", json.loads(table.to_json(orient="records")))
decide(table, needs={name: set(deps) for name, deps in manifest.rule.get("needs", {}).items()})
decisions = decide(table, needs={name: set(deps) for name, deps in manifest.rule.get("needs", {}).items()})
if result.get("excluded_from_gain"):
_write(out / "decisions.json", {**decisions, "excluded_from_gain": True})
return result