[donislawdev]

Summary

• engine: a run that will hold more than its memory setting gives it says so before its first byte. A run holds its whole plan to the end and every file adds about 520 B (its answer and manifest entry, measured on txt, png, docx, pdf and zip). The plan was weighed and what the files add was not, so 600 000 text files in a 1 GB container wrote for fifteen minutes and were ended by the system with nothing said and no manifest. engine.PredictHold adds the heap as the run starts to what its files will add, against the setting. The command line prints a note: line before writing, dry runs included. The window says the same after Preview and after a run. It is a note and not a refusal, because the same run finished where the container had swap.
• ci: each part of the race detector job prints the machine it runs on (processors, model, memory) before the tests, and after them how the machine's processor time was spent while they ran and which processes still running have used the most of it. Part 2 has run past its twenty minutes in about one run of three while the other parts kept their usual time.
• deps: golang.org/x/net 0.62.0 for GO-2026-6860 and GO-2026-6866 in its html package. Only the window links that package, govulncheck finds neither in code it reaches, and the command line tool does not link golang.org/x/net. No generated file changes.
• security: three advisories against mcp 1.29.0 under semgrep get the same dated exception as the one already there. Every semgrep release pins that version, semgrep cannot start without the package, and the CI job runs only semgrep scan.

Test plan

• New guards: TestARunThatWillHoldMoreThanItsMemorySaysSoBeforeItsFirstByte, TestTheWindowSaysWhenARunWillHoldMoreThanItsMemory, TestAFileAddsWhatTheForecastSaysToTheRunsMemory (in a process of its own). Each mutation entry for them was red on its mutant before commit.
• The CI steps run as files in ubuntu:24.04.
• The OSV exceptions: the pinned scanner image exits 0 with them and reports exactly the three advisories without them.
• Cheap gates of the whole tree and the guards of the touched area.

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

The CI workflow adds runner and CPU diagnostics around race-detector test parts. The indirect golang.org/x/net dependency changes from v0.60.0 to v0.62.0. The changelog, third-party notice, and mutation expectation also reflect the updated version.

Changes: Race Detector Diagnostics

Layer / File(s)	Summary
Test-part system diagnostics .github/workflows/ci.yml	The workflow logs runner details before testing, records CPU counters and start time, then reports CPU-state percentages, elapsed time, load average, and top CPU-time processes afterward. The post-test report runs unless canceled and reports when no test-start data is available.

golang.org/x/net Update

Layer / File(s)	Summary
Dependency version and related records go.mod, THIRD-PARTY-NOTICES.md, CHANGELOG.md, internal/guard/mutation/entries.py	The indirect dependency changes to v0.62.0. The notice and changelog record the update, and the mutation expectation uses the new version.

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Suggested labels: dependencies, security

Merge Risk: Low · up to cd809

The PR is low risk, but should clarify the runner diagnostics and changelog wording so performance data and security notes are not misleading.

Pre-merge checks: 14

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Tests For Changed Behavior		PASS. The PR changes CI diagnostics, changelog/license metadata, mutation metadata, and an indirect golang.org/x/net dependency version. It does not change application runtime source behavior. No te…
No Secrets Or Debug Leftovers		The PR adds no CLAUDE.md, AGENTS.md, .claude/, or .env files. Added lines contain no credentials, private URLs, absolute local paths, personal e-mails, private hostnames/IPs, or hardcoded machine/user…
No Hardcoded Ui Styling		PASS — The pull request changes CI workflow shell commands, dependency metadata, changelog text, and mutation data only. It does not add or change GUI code, so the hardcoded UI styling check does not …
No Obvious Performance Problems		No clear performance problem is introduced. The PR adds one-time CI diagnostics (lscpu, free, /proc, ps) around each race-test part and updates a dependency. These commands do not run on a UI …
Desktop Robustness		The pull request changes only CI diagnostics, dependency metadata, changelog/notices, and mutation-test data. It does not add desktop asset loading, settings persistence, culture-sensitive parsing, de…
Safe File Parsing		PASS — The PR does not add or change application parsing of XML, YAML, JSON, CSV, XLSX, archives, themes, translations, or settings. The new CI shell only reads trusted runner telemetry from `/proc/st…
System Changes Are Reversible		PASS: The PR adds CI diagnostics that read runner information from /proc, lscpu, free, and ps. It does not add or change network filters, proxies, firewalls, system time, process hooking, services, re…
Clear User-Facing Text		PASS. The PR adds CI diagnostic labels and dependency/changelog text, but it adds no buttons, icons, confirmations, raw exceptions, or error messages needing the specified fixes. The new CI output use…
No Resource Leaks		PASS: The PR adds only CI shell diagnostics and dependency/version metadata. The diagnostics read /proc, run short-lived commands, and overwrite three fixed-size files (stat-before.txt, `time-befo…
Scope, Duplication And Docs		The changed files match the stated CI diagnostics and x/net dependency update. The dependency change updates go.mod/go.sum, the third-party notice, CHANGELOG.md, and its mutation guard. The new CI ste…
Title check		The title identifies the race-job diagnostics and the golang.org/x/net 0.62.0 upgrade. Its claim about a run outgrowing its memory setting is not supported by the changes, but the title still describe…

Full details: Tests For Changed Behavior

Explanation

PASS. The PR changes CI diagnostics, changelog/license metadata, mutation metadata, and an indirect golang.org/x/net dependency version. It does not change application runtime source behavior. No test files were deleted, skipped, or weakened; the diff contains no test assertion changes.

Full details: No Secrets Or Debug Leftovers

Explanation

The PR adds no CLAUDE.md, AGENTS.md, .claude/, or .env files. Added lines contain no credentials, private URLs, absolute local paths, personal e-mails, private hostnames/IPs, or hardcoded machine/user names. The new lscpu, free, /proc, and ps output is intentional race-job telemetry, documented by the step names and comments, not leftover debug code.

Full details: No Hardcoded Ui Styling

Explanation

PASS — The pull request changes CI workflow shell commands, dependency metadata, changelog text, and mutation data only. It does not add or change GUI code, so the hardcoded UI styling check does not apply.

Full details: No Obvious Performance Problems

Explanation

No clear performance problem is introduced. The PR adds one-time CI diagnostics (lscpu, free, /proc, ps) around each race-test part and updates a dependency. These commands do not run on a UI thread, process a large collection quadratically, or poll or refresh data repeatedly.

Full details: Desktop Robustness

Explanation

The pull request changes only CI diagnostics, dependency metadata, changelog/notices, and mutation-test data. It does not add desktop asset loading, settings persistence, culture-sensitive parsing, destructive UI actions, window background work, admin elevation, or user-facing network calls. The existing race test command is unchanged; the new CI steps only read and report runner state.

Full details: Safe File Parsing

Explanation

PASS — The PR does not add or change application parsing of XML, YAML, JSON, CSV, XLSX, archives, themes, translations, or settings. The new CI shell only reads trusted runner telemetry from /proc/stat and /proc/loadavg, plus bounded lscpu, free, and ps output; it performs no deserialization, formula export, external-entity resolution, or path traversal. The dependency and notice changes only update golang.org/x/net version metadata.

Full details: System Changes Are Reversible

Explanation

PASS: The PR adds CI diagnostics that read runner information from /proc, lscpu, free, and ps. It does not add or change network filters, proxies, firewalls, system time, process hooking, services, registry, or drivers. The dependency, changelog, notice, and mutation-entry changes also do not modify system state.

Full details: Clear User-Facing Text

Explanation

PASS. The PR adds CI diagnostic labels and dependency/changelog text, but it adds no buttons, icons, confirmations, raw exceptions, or error messages needing the specified fixes. The new CI output uses clear labels and percentage units, and the dependency is consistently identified as golang.org/x/net 0.62.0 across the changelog, notices, and module file.

Full details: No Resource Leaks

Explanation

PASS: The PR adds only CI shell diagnostics and dependency/version metadata. The diagnostics read /proc, run short-lived commands, and overwrite three fixed-size files (stat-before.txt, time-before.txt, and processes.txt) per runner job. No handler, timer, stream, response, process, goroutine, task, cache, queue, or image is introduced without cleanup.

Full details: Scope, Duplication And Docs

Explanation

The changed files match the stated CI diagnostics and x/net dependency update. The dependency change updates go.mod/go.sum, the third-party notice, CHANGELOG.md, and its mutation guard. The new CI steps are scoped to the race job and do not introduce a public API, CLI, configuration format, or persisted-data change. No unrelated refactor or missing user-facing documentation is evident.

Full details: Title check

Explanation

The title identifies the race-job diagnostics and the golang.org/x/net 0.62.0 upgrade. Its claim about a run outgrowing its memory setting is not supported by the changes, but the title still describes real parts of the pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6061c64e-330c-42db-9251-b0d1037944b1

Commits

Reviewing files that changed from the base of the PR and between 29b803c and cd80910.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum, !**/go.sum

Files selected for processing: 5

• .github/workflows/ci.yml
• CHANGELOG.md
• THIRD-PARTY-NOTICES.md
• go.mod
• internal/guard/mutation/entries.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 19

• GitHub Check: part 0
• GitHub Check: CodeRabbit
• GitHub Check: race detector (part 3 of 4)
• GitHub Check: race detector (part 0 of 4)
• GitHub Check: race detector (part 2 of 4)
• GitHub Check: race detector (part 1 of 4)
• GitHub Check: import table of the window binary
• GitHub Check: staticcheck
• GitHub Check: reference tools actually installed
• GitHub Check: coverage gate
• GitHub Check: the installer installs and leaves
• GitHub Check: test on ubuntu-latest
• GitHub Check: linters
• GitHub Check: the Chocolatey packages install and leave
• GitHub Check: test on windows-latest
• GitHub Check: known vulnerabilities
• GitHub Check: test on macos-latest
• GitHub Check: bill of materials
• GitHub Check: Analyze (go)

Additional context used

Code guidelines: 1

CONTRIBUTING.md — configured

Path-based instructions: 14

For every added or upgraded dependency: confirm the package really exists and the name is spelled correctly (typosquatting), it is actively maintained, the license is compatible with this project's license, and it is actually needed (not re...

CodeRabbit configuration file

Files:

• go.mod

Applies to text shown to the user (labels, buttons, tooltips, placeholders, dialogs, errors, status messages, empty states, translations).

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

These are end-user desktop applications.

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

Performance is a known weak spot of these projects.

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

Applies only to code that builds or styles a GUI.

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

Check GitHub Actions security: third-party actions pinned to a full commit SHA, minimal `permissions:` block, no `pull_request_target` with checkout of PR code, no untrusted input (`github.event.*.title/body`, branch names) interpolated dir...

CodeRabbit configuration file

Files:

• .github/workflows/ci.yml

User-facing changelog.

CodeRabbit configuration file

Files:

• CHANGELOG.md

Domain: test file generator (Go; `tfg` CLI and `tfg-gui` Fyne window over one engine).

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

SECURITY, HIGH PRIORITY.

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

These apps are QA/developer tools.

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

Check that documentation matches the actual code in this PR: commands, flags, config keys, file paths, build steps and examples must exist.

CodeRabbit configuration file

Files:

• CHANGELOG.md
• THIRD-PARTY-NOTICES.md

Python code.

CodeRabbit configuration file

Files:

• internal/guard/mutation/entries.py

All code in this repository is written by an AI coding agent (Claude Code).

CodeRabbit configuration file

Files:

• CHANGELOG.md
• go.mod
• THIRD-PARTY-NOTICES.md
• internal/guard/mutation/entries.py
• .github/workflows/ci.yml

Source excerpt: **Words a user reads are English, with a flat hyphen and no semicolons.**

CodeRabbit inference engine (CONTRIBUTING.md)

Files:

• CHANGELOG.md

Learnings: 1

Learning: 2026-11-02T16:20:03.196Z

Learnt from: CR
Repo: donislawdev/TestingFilesGenerator PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-11-02T16:20:03.196Z
Learning: Applies to CHANGELOG.md : Source excerpt:
# Contributing

## What a change has to satisfy

- **Words a user reads are English, with a flat hyphen and no semicolons.** That
  covers the README, the changelog, `--help`, every message, and every comment
  in the code. A test enforces the punctuation.

Applied to files:

• CHANGELOG.md

LanguageTool

THIRD-PARTY-NOTICES.md

[grammar] ~237-~237: Ensure spelling is correct
Context: ... published advisories name v0.60.0. Its licence file is byte for byte the one at v0.60....

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)