From ad8b64417f140b224dda11b519af3d73cb9341a3 Mon Sep 17 00:00:00 2001 From: ziggie Date: Tue, 10 Feb 2026 10:48:09 +0100 Subject: [PATCH] build: classify cmd/* as MEDIUM in PR severity bot The severity bot was misclassifying CLI client code as HIGH because filenames like cmd_walletunlocker.go matched the walletunlocker/* auth/security keyword. Add cmd/* explicitly to the MEDIUM tier and add a classification rule to prevent filename-based false positives. --- .github/workflows/pr-severity.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-severity.yml b/.github/workflows/pr-severity.yml index 10c672d96..352df0bdc 100644 --- a/.github/workflows/pr-severity.yml +++ b/.github/workflows/pr-severity.yml @@ -95,6 +95,7 @@ jobs: - chainntnfs/*, chanacceptor/*, protofsm/*, sqldb/* **MEDIUM** (severity-medium) - Focused review: + - cmd/* - CLI client commands (do NOT inherit severity from server-side packages with similar names) - payments/*, autopilot/*, lncfg/*, chanfitness/* - netann/*, kvdb/*, chanbackup/*, aezeed/*, tor/* - zpay32/*, tlv/*, fn/*, record/*, amp/* @@ -110,12 +111,16 @@ jobs: ## Classification Rules 1. The HIGHEST severity file determines the PR severity - 2. Bump severity UP one level if: + 2. Classify files by their actual package path, NOT by filename keywords. + Files under cmd/* are CLI client code and should always be MEDIUM, + even if the filename contains a server-side package name (e.g. + cmd/commands/cmd_walletunlocker.go is MEDIUM, not HIGH). + 3. Bump severity UP one level if: - PR touches >20 files (excluding tests and auto-generated files) - PR has >500 lines changed (excluding tests and auto-generated files) - PR touches multiple distinct critical packages - 3. Check for override labels first (severity-override-*). If present, respect the override. - 4. Database migrations (channeldb/migration*, sqldb/*, wtdb/*) are always CRITICAL + 4. Check for override labels first (severity-override-*). If present, respect the override. + 5. Database migrations (channeldb/migration*, sqldb/*, wtdb/*) are always CRITICAL ## Files to Exclude from Line/File Counting When calculating file count and lines changed for severity bumps, exclude: