chore(policy): add the ReScript BANNED row (post-retirement sync) by hyperpolymath · Pull Request #67 · hyperpolymath/fireflag

hyperpolymath · 2026-08-31T19:52:27Z

Estate-wide policy sync (task: BANNED-row campaign, 2026-08-31).

ReScript is retired outside the enclave (owner ruling 2026-08-31: rescript, rescript-ecosystem, and the proven adapters stay ReScript; nothing else). This repo's language-policy table in .claude/CLAUDE.md predated that ruling.

Adds | ReScript | AffineScript | to the BANNED table (whole-line insert after the TypeScript row, extra columns mirrored).
Where the Python row still recommended ReScript as a replacement, rewrites it to AffineScript.

Doc-only change; verified estate-wide by an origin-side GraphQL scan of all 428 non-archived repos (52 repos in this sweep).

🤖 Generated with Claude Code

ReScript is retired estate-wide (enclave ruling 2026-08-31: only the rescript/rescript-ecosystem/proven-adapter repos remain ReScript). This syncs the language-policy BANNED table: adds | ReScript | AffineScript | after the TypeScript row, and where present rewrites the Python replacement row to no longer recommend ReScript. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sonarqubecloud · 2026-08-31T19:52:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai · 2026-08-31T19:53:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6c65166b-1d36-409b-8926-e3dbb65a9853

📥 Commits

Reviewing files that changed from the base of the PR and between 653da47 and a9bcc3a.

📒 Files selected for processing (1)

.claude/CLAUDE.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

GitHub Check: vordr-verification
GitHub Check: analyze (javascript-typescript, none)

⚠️ CI failures not shown inline (10)

GitHub Actions: Container Build / 2_container-build.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run podman build -f .containerization/Containerfile -t fireflag:58f7b48612e70a8e9b60613909cfce11cdea58c8 .
 �[36;1mpodman build -f .containerization/Containerfile -t fireflag:58f7b48612e70a8e9b60613909cfce11cdea58c8 .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [1/4] STEP 1/5: FROM cgr.dev/chainguard/wolfi-base:latest AS guix-base
 Trying to pull cgr.dev/chainguard/wolfi-base:latest...
 Getting image source signatures
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying config sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Writing manifest to image destination
 [1/4] STEP 2/5: RUN apk add --no-cache     bash     wget     xz     gpg     tar     ca-certificates
 fetch https://apk.cgr.dev/chainguard/x86_64/APKINDEX.tar.gz
 ERROR: unable to select packages:
   tar (no such package):
     required by: world[tar]
 Error: building at STEP "RUN apk add --no-cache     bash     wget     xz     gpg     tar     ca-certificates": while running runtime: exit status 1
 ##[error]Process completed with exit code 1.

GitHub Actions: Svalin Static Analysis / 0_svalin-analysis.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

�[36;1mecho "::group::Security Pattern Check"�[0m
 �[36;1m�[0m
 �[36;1m# Check for eval usage�[0m
 �[36;1mif grep -r "eval(" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::warning::Found eval() usage - potential security risk"�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# Check for innerHTML with variables�[0m
 �[36;1mif grep -r "innerHTML.*=.*\${" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::warning::Found innerHTML with template literals - XSS risk"�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# Check for hardcoded secrets patterns�[0m
 �[36;1mif grep -rE "(password|secret|token|api[_-]?key)\s*=\s*['\"][^'\"]{8,}" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets found"�[0m

GitHub Actions: Container Build / container-build: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run podman build -f .containerization/Containerfile -t fireflag:58f7b48612e70a8e9b60613909cfce11cdea58c8 .
 �[36;1mpodman build -f .containerization/Containerfile -t fireflag:58f7b48612e70a8e9b60613909cfce11cdea58c8 .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 [1/4] STEP 1/5: FROM cgr.dev/chainguard/wolfi-base:latest AS guix-base
 Trying to pull cgr.dev/chainguard/wolfi-base:latest...
 Getting image source signatures
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying blob sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Copying config sha256:***REDACTED_HIGH_ENTROPY_STRING***
 Writing manifest to image destination
 [1/4] STEP 2/5: RUN apk add --no-cache     bash     wget     xz     gpg     tar     ca-certificates
 fetch https://apk.cgr.dev/chainguard/x86_64/APKINDEX.tar.gz
 ERROR: unable to select packages:
   tar (no such package):
     required by: world[tar]
 Error: building at STEP "RUN apk add --no-cache     bash     wget     xz     gpg     tar     ca-certificates": while running runtime: exit status 1
 ##[error]Process completed with exit code 1.

GitHub Actions: Selur Secrets Detection / 0_selur-scan.txt: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run ##########################################
 �[36;1m##########################################�[0m
 �[36;1m## ADVANCED USAGE                       ##�[0m
 �[36;1m## Scan by BASE & HEAD user inputs      ##�[0m
 �[36;1m## If BASE == HEAD, exit with error     ##�[0m
 �[36;1m##########################################�[0m
 �[36;1m# Check if jq is installed, if not, install it�[0m
 �[36;1mif ! command -v jq &> /dev/null�[0m
 �[36;1mthen�[0m
 �[36;1m  echo "jq could not be found, installing..."�[0m
 �[36;1m  apt-get -y update && apt-get install -y jq�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mgit status >/dev/null  # make sure we are in a git repository�[0m
 �[36;1mif [ -n "$BASE" ] || [ -n "$HEAD" ]; then�[0m
 �[36;1m  if [ -n "$BASE" ]; then�[0m
 �[36;1m    base_commit=$(git rev-parse "$BASE" 2>/dev/null) || true�[0m
 �[36;1m  else�[0m
 �[36;1m    base_commit=""�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ -n "$HEAD" ]; then�[0m
 �[36;1m    head_commit=$(git rev-parse "$HEAD" 2>/dev/null) || true�[0m
 �[36;1m  else�[0m
 �[36;1m    head_commit=""�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ "$base_commit" == "$head_commit" ] ; then�[0m
 �[36;1m    echo "::error::BASE and HEAD commits are the same. TruffleHog won't scan anything. Please see documentation (https://github.com/trufflesecurity/trufflehog#octocat-trufflehog-github-action)."�[0m

GitHub Actions: Svalin Static Analysis / svalin-analysis: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

�[36;1mecho "::group::Security Pattern Check"�[0m
 �[36;1m�[0m
 �[36;1m# Check for eval usage�[0m
 �[36;1mif grep -r "eval(" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::warning::Found eval() usage - potential security risk"�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# Check for innerHTML with variables�[0m
 �[36;1mif grep -r "innerHTML.*=.*\${" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::warning::Found innerHTML with template literals - XSS risk"�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# Check for hardcoded secrets patterns�[0m
 �[36;1mif grep -rE "(password|secret|token|api[_-]?key)\s*=\s*['\"][^'\"]{8,}" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets found"�[0m

GitHub Actions: Selur Secrets Detection / selur-scan: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]Run ##########################################
 �[36;1m##########################################�[0m
 �[36;1m## ADVANCED USAGE                       ##�[0m
 �[36;1m## Scan by BASE & HEAD user inputs      ##�[0m
 �[36;1m## If BASE == HEAD, exit with error     ##�[0m
 �[36;1m##########################################�[0m
 �[36;1m# Check if jq is installed, if not, install it�[0m
 �[36;1mif ! command -v jq &> /dev/null�[0m
 �[36;1mthen�[0m
 �[36;1m  echo "jq could not be found, installing..."�[0m
 �[36;1m  apt-get -y update && apt-get install -y jq�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mgit status >/dev/null  # make sure we are in a git repository�[0m
 �[36;1mif [ -n "$BASE" ] || [ -n "$HEAD" ]; then�[0m
 �[36;1m  if [ -n "$BASE" ]; then�[0m
 �[36;1m    base_commit=$(git rev-parse "$BASE" 2>/dev/null) || true�[0m
 �[36;1m  else�[0m
 �[36;1m    base_commit=""�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ -n "$HEAD" ]; then�[0m
 �[36;1m    head_commit=$(git rev-parse "$HEAD" 2>/dev/null) || true�[0m
 �[36;1m  else�[0m
 �[36;1m    head_commit=""�[0m
 �[36;1m  fi�[0m
 �[36;1m  if [ "$base_commit" == "$head_commit" ] ; then�[0m
 �[36;1m    echo "::error::BASE and HEAD commits are the same. TruffleHog won't scan anything. Please see documentation (https://github.com/trufflesecurity/trufflehog#octocat-trufflehog-github-action)."�[0m

GitHub Actions: Svalin Static Analysis / svalin-analysis: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

�[36;1mecho "::group::SPDX Header Check"�[0m
 �[36;1mmissing_headers=0�[0m
 �[36;1m�[0m
 �[36;1mfor file in $(find extension -name "*.js" -o -name "*.res" -o -name "*.html" -o -name "*.css"); do�[0m
 �[36;1m  if ! head -5 "$file" | grep -q "SPDX-License-Identifier"; then�[0m
 �[36;1m    echo "::warning::Missing SPDX header in $file"�[0m
 �[36;1m    ((missing_headers++))�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ $missing_headers -gt 0 ]; then�[0m
 �[36;1m  echo "::error::$missing_headers files missing SPDX headers"�[0m

GitHub Actions: Selur Secrets Detection / selur-scan: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

�[36;1mecho "::group::Custom Secret Detection"�[0m
 �[36;1m�[0m
 �[36;1m# Check for API keys in code�[0m
 �[36;1mif grep -rE "(api[_-]?key|apikey)\s*[:=]\s*['\"][a-zA-Z0-9]{20,}" extension/ --include="*.js"; then�[0m
 �[36;1m  echo "::error::Potential API key found in code"�[0m

GitHub Actions: Selur Secrets Detection / selur-scan: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

�[36;1mecho "::group::Sensitive File Detection"�[0m
 �[36;1m�[0m
 �[36;1m# Files that should not be committed�[0m
 �[36;1msensitive_files=(�[0m
 �[36;1m  "*.env"�[0m
 �[36;1m  "*.pem"�[0m
 �[36;1m  "*.key"�[0m
 �[36;1m  ".env.local"�[0m
 �[36;1m  ".env.production"�[0m
 �[36;1m  "secrets.json"�[0m
 �[36;1m  "credentials.json"�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mfound_sensitive=0�[0m
 �[36;1mfor pattern in "${sensitive_files[@]}"; do�[0m
 �[36;1m  if find . -name "$pattern" -type f | grep -v node_modules; then�[0m
 �[36;1m    echo "::error::Found sensitive file matching pattern: $pattern"�[0m

GitHub Actions: Selur Secrets Detection / selur-scan: chore(policy): add the ReScript BANNED row (post-retirement sync)

Conclusion: failure

View job details

##[group]GitIgnore Validation
 ##[warning].gitignore missing pattern: *.env
 ##[error]Process completed with exit code 1.

🔇 Additional comments (1)

.claude/CLAUDE.md (1)

45-45: LGTM!

📝 Walkthrough

Summary by CodeRabbit

Documentation
- Updated the language policy to list ReScript as prohibited and AffineScript as the recommended replacement.

Walkthrough

The language policy adds ReScript to the banned languages table and lists AffineScript as its replacement.

Changes

Language policy

Layer / File(s)	Summary
Add banned language entry `.claude/CLAUDE.md`	The “BANNED - Do Not Use” table now lists ReScript as banned and AffineScript as its replacement.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a9bcc

This is a localized documentation-only policy update with no actionable merge-blocking risk remaining after normal checks and review.

Poem

I checked the table with a hop and a cheer
ReScript is banned from the path we steer
AffineScript waits in the replacement row
One small policy change, neatly in tow
The rabbit approves and is ready to go

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the policy change: adding the ReScript banned row. It is concise and matches the main change.
Description check	✅ Passed	The description accurately describes the ReScript policy update, the AffineScript replacement, and the documentation-only scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai Bot approved these changes Aug 31, 2026

View reviewed changes

hyperpolymath merged commit 676f510 into main Aug 31, 2026
30 of 33 checks passed

hyperpolymath deleted the policy/banned-row-rescript branch August 31, 2026 19:59

Navigation Menu

Uh oh!

chore(policy): add the ReScript BANNED row (post-retirement sync) - #67

chore(policy): add the ReScript BANNED row (post-retirement sync)#67
hyperpolymath merged 1 commit into
mainfrom
policy/banned-row-rescript

hyperpolymath commented Aug 31, 2026

Uh oh!

sonarqubecloud Bot commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Aug 31, 2026

Uh oh!

sonarqubecloud Bot commented Aug 31, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading