Repository navigation
feat(qml): add bounded Qt 6 and QML static analysis - #4111
SlinkyRamey wants to merge 58 commits into
Graphify — looks good
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Details
Graphify reviewed this change.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify review — findings
Hardens CI into a proof-producing run: it builds the wheel, starts a pinned, mount-free FalkorDB container, and records checkout, toolchain, wheel-hash and service identity before running pytest with JUnit output. A post-run check confirms the checkout, dependencies and wheel are unchanged, and fails unless the FalkorDB, QML wheel-artifact and upstream Qt integration cases actually executed instead of auto-skipping. CI also runs on codex/qml-* PRs with read-only permissions, cancels superseded PR runs, and keeps the CRLF bytes in the UnicodeCRLF.qml parser fixture.
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 12228 functions depend on the 8907 functions this change touches.
Health — this change adds coupling hotspots:
- new:
extract()— 880 callers, 59 callees - new:
_rebuild_code()— 245 callers, 63 callees - new:
build_from_json()— 409 callers, 23 callees - new:
detect()— 126 callers, 16 callees - new:
to_json()— 207 callers, 9 callees - new:
build_merge()— 82 callers, 14 callees - new:
_extract_generic()— 18 callers, 35 callees - new:
to_obsidian()— 43 callers, 14 callees - …and 467 more — each is listed as a finding
Verification — 12228 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 12069 function(s) in the blast radius were not formally verified this run
Test selection
Test selection
486 of 486 test file(s) selected (100%) via static blast radius.
Escalated to a full run for safety — the selection is not trustworthy on its own (see below). CI should run the whole suite.
tests/test_affected_cli.py— impact, full-run-safetytests/test_affected_member_seed.py— impact, full-run-safetytests/test_agents_platform.py— impact, full-run-safetytests/test_analyze.py— impact, full-run-safetytests/test_anthropic_custom_endpoint.py— full-run-safetytests/test_antigravity_install.py— full-run-safetytests/test_apm_fallback_version.py— full-run-safetytests/test_architecture_doc.py— full-run-safetytests/test_astro_extraction.py— impact, full-run-safetytests/test_astro_import_ids.py— impact, full-run-safetytests/test_atomic_canvas_export.py— impact, full-run-safetytests/test_atomic_replace_retention.py— impact, changed-test, full-run-safetytests/test_atomic_version_stamp.py— impact, full-run-safetytests/test_atomic_writes.py— impact, full-run-safetytests/test_backend_env_isolation.py— full-run-safetytests/test_backend_extras.py— full-run-safetytests/test_benchmark.py— impact, full-run-safetytests/test_benchmark_raw_graph.py— impact, full-run-safetytests/test_blade_extractor.py— impact, full-run-safetytests/test_build.py— impact, full-run-safetytests/test_build_merge_dedup_scope.py— impact, full-run-safetytests/test_build_merge_hyperedges_and_prune.py— impact, full-run-safetytests/test_build_merge_shrink_guard.py— impact, full-run-safetytests/test_builtin_global_type_refs.py— impact, full-run-safetytests/test_cache.py— impact, full-run-safetytests/test_callflow_html.py— impact, full-run-safetytests/test_cargo_introspect.py— impact, full-run-safetytests/test_cargo_missing_manifest.py— full-run-safetytests/test_carried_hyperedge_remap.py— impact, full-run-safetytests/test_case_sensitive_resolution.py— impact, full-run-safetytests/test_charmap_encoding.py— impact, full-run-safetytests/test_chunking.py— impact, full-run-safetytests/test_ci_windows_tools.py— impact, changed-test, full-run-safetytests/test_cjs_module_extension.py— impact, full-run-safetytests/test_claude_cli_backend.py— impact, full-run-safetytests/test_claude_md.py— full-run-safetytests/test_cli_broken_pipe.py— full-run-safetytests/test_cli_export.py— impact, full-run-safetytests/test_cli_help.py— full-run-safetytests/test_cluster.py— impact, full-run-safetytests/test_cluster_exclude_hubs.py— full-run-safetytests/test_cobol_extractor.py— impact, full-run-safetytests/test_codebuddy.py— impact, full-run-safetytests/test_community_hub_labels.py— full-run-safetytests/test_community_labels_skill.py— impact, full-run-safetytests/test_confidence.py— impact, full-run-safetytests/test_corrupt_graph_json.py— impact, full-run-safetytests/test_cpp_constructor_ownership.py— impact, changed-test, full-run-safetytests/test_cpp_method_declarations.py— impact, full-run-safetytests/test_cpp_nested_and_cli.py— impact, full-run-safety- … and 436 more
non-code file(s) changed (
.gitattributes,.github/workflows/ci.yml,.github/workflows/qml-wheel.yml,.gitignore,.graphifyignore…) → running the full suite for safety (a code graph can't see config/fixture/data deps)
changed code file(s) not in the graph (
tests/fixtures/qml/parser_probe/Incomplete.qml,tests/fixtures/qml/parser_probe/Malformed.qml) — deleted or unindexed, so their dependent tests can't be found; running the full suite for safety
changed code file(s) with no mapped test (
.github/workflows/ci.yml,.github/workflows/qml-wheel.yml,README.md,docs/COMPATIBILITY.md,docs/REQUIREMENTS.md…) — a coverage gap or a missing link — running the full suite rather than only the selected tests
Selection is safe under the controlled-regression assumption; always-run tests + a periodic full run are the backstops. Advisory — it never changes the check verdict.
Docs that may be stale (advisory)
.github/PULL_REQUEST_TEMPLATE.md§ How was this tested? (lines 25-32): references changed symbolstext.github/PULL_REQUEST_TEMPLATE.md§ Graphify-specific checklist (lines 33-39): references changed symbolsrunAGENTS.md§ graphify (lines 1-8): references changed symbolsupdateARCHITECTURE.md§ Pipeline (lines 5-12): references changed symbolsextract,report,stagesARCHITECTURE.md§ Module responsibilities (lines 13-35): references changed symbolsextract,extraction,graph,nodes,pointARCHITECTURE.md§ Calling extract() from your own code (lines 36-49): references changed symbolsextract,resolve,rootARCHITECTURE.md§ Extraction output schema (lines 50-66): references changed symbolscalls,nodes,source,targetARCHITECTURE.md§ Confidence labels (lines 67-74): references changed symbolssourceARCHITECTURE.md§ Adding a new language extractor (lines 75-82): references changed symbolscalls,extract,nodesBENCHMARKS.md§ Harness (lines 36-56): references changed symbolsanswer
…and 10 more.