From da496a93721b488a0442c49123fe98729e60e35c Mon Sep 17 00:00:00 2001 From: Frank O'Hara Date: Thu, 27 Aug 2026 09:58:06 -0600 Subject: [PATCH] =?UTF-8?q?ci:=20scheduled=20audits=20use=20the=20Docker?= =?UTF-8?q?=20backend=20=E2=80=94=20native=20under-kills=20subprocess-test?= =?UTF-8?q?ed=20code?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first scheduled audit scored 77.5% vs the Docker-verified 98.7% baseline; forensics show 72 of its 88 survivors are Docker-verified kills, clustered in the crates whose tests spawn the built lash binary. Reproduced locally in flawd's native mode and filed upstream (tasks.native-subprocess-false-survivors); that audit's score is invalidated for threshold-setting. Score history must be trustworthy, so the weekly audit switches to the Docker config; PR runs stay native for speed while the gate is report-only, with the caveat documented. --- .github/workflows/mutation.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml index 82cd4d5..a7fa8dd 100644 --- a/.github/workflows/mutation.yml +++ b/.github/workflows/mutation.yml @@ -73,10 +73,19 @@ jobs: --diff "${{ github.event.pull_request.base.sha }}" \ --threshold 0 --out flawd-report + # Scheduled audits feed the future gate threshold, so they use the + # Docker backend (flawd.toml): native mode currently under-kills on + # suites that spawn the project's own binary (false survivors in + # lash-cli/lash-tui; flawd defect filed as + # tasks.native-subprocess-false-survivors — first audit's 77.5% is + # invalidated by it; Docker-verified baseline is 98.7%). PR runs + # stay native for speed while the gate is report-only; survivors + # reported in subprocess-tested code may be false until the flawd + # fix lands. - name: Mutation test (scheduled, full depth) if: github.event_name != 'pull_request' run: | - flawd run --config flawd.ci.toml --ci-mode --yes \ + flawd run --config flawd.toml --ci-mode --yes \ --baseline-retries 3 --out flawd-report # flawd v0.14.0 writes no SARIF on a zero-mutant diff pass (fixed in