Skip to content

fix(stale_repositories): fix 8 logical bugs causing false positives - #6610

Open
Liu-meng-hao wants to merge 1 commit into
avelino:mainfrom
Liu-meng-hao:fix/stale-repo-bugfix
Open

fix(stale_repositories): fix 8 logical bugs causing false positives#6610
Liu-meng-hao wants to merge 1 commit into
avelino:mainfrom
Liu-meng-hao:fix/stale-repo-bugfix

Conversation

@Liu-meng-hao

Copy link
Copy Markdown

Description

This PR fixes the false positive dead-link / stale repository reports produced by the weekly automated check in stale_repositories_test.go.

The script had several accumulated logical bugs that caused it to report hundreds of perfectly valid repositories as "dead" or "stale" every week, creating noise for maintainers and unnecessary Issue spam.

Fixes #6279

Root Causes & Fix Summary

# Root Cause Fix
1 numberOfYears typed as time.Duration = 1 nanosecond; the 1-year window was evaluated as ~31.5ms → every repository appeared "stale" Changed to int with explicit cast time.Duration(numberOfYears) * 365 * 24 * time.Hour
2 Anchor links (#actor-model) not skipped after regex mismatch → fed into GitHub API → 400 → false "dead link" Added early return for anchors and after regex non-match; also pre-normalize URLs via url.Parse to strip RawQuery/Fragment
3 strings.ReplaceAll(href, "https://github.com", "") corrupted URLs where repo names contained the substring Replaced with regex capture groups FindStringSubmatch to safely extract owner and repo
4 ALL status codes >= 400 treated as dead links → 403 rate-limit responses flagged normal repos as dead Only explicit 404 / 410 now map to the dead-link condition
5 Upon hitting API rate limits, the script continued scanning and flagged all subsequent repos Added aborted bool return value; caller exits EachWithBreak and still creates the Issue with the already-collected results
6 Hardcoded plaintext http://api.github.com constant (security + modern proxy/network incompatibility) Upgraded to https:// (consistent with other constants)
7 createIssue / getAllFlaggedRepositories / both checkers leaked TCP connections (missing resp.Body.Close()) Added defer resp.Body.Close() across every HTTP response
8 The noRecentCommits suffix was missing from getRepositoriesFromBody(), breaking Issue deduplication for the "1 year without commits" class Added constant + corresponding strings.ReplaceAll line in the dedup function

Required links

N/A — This PR is an internal CI script bug fix, not a new package addition.
The PR does not modify README.md, so package-level quality checks do not apply.


Pre-submission checklist

- Fix time.Duration 31ms bug by using int numberOfYears with explicit cast
- Strip URL RawQuery/Fragment via url.Parse before regex validation
- Use regex capture groups to safely extract owner/repo (replace strings.ReplaceAll)
- Only treat 404/410 as dead links (not >=400, avoids 403 rate-limit false positives)
- Gracefully abort on 401/403 via EachWithBreak aborted signal
- Upgrade http:// to https:// for all GitHub API constants
- Add defer resp.Body.Close() to all HTTP requests
- Add noRecentCommits suffix to close issue dedup loop

Fixes avelino#6279
@qodo-code-review

Copy link
Copy Markdown

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

@github-actions

Copy link
Copy Markdown

Automated Quality Checks

Skipped — this PR does not modify README.md, so package quality checks do not apply.

This is expected for maintenance, documentation, or workflow PRs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Investigate repositories with more than 1 year without update - 2026-04-25

1 participant