[connabyss]

Requested by CH · project thread

What was wrong, what you changed, how you checked:

The first CodeQL scan (#196) found 3 alerts on main. All three are real; this fixes them.

• README: pyclibrary 6 PRs merged, marshmallow-fastoneofschema #1 #3 Inefficient regular expression (recent.py FAILED_TEST): the pytest part was \S+::(?:\S+::)*, and \S+ can itself swallow ::, so a line like FAILED followed by many :: backtracked exponentially. Measured: 22 pairs took 0.6 s, each 2 more about 4x longer, 3000 never finished. One odd line in a project's test output could hang Bite. \S+:: alone matches exactly the same lines and still keeps the name after the last ::.
• README: proof of concept framing and the prosemirror-py leak example #1, README: pyclibrary 5 PRs merged, prosemirror fix PR #336 #2 Workflow does not contain permissions (publish.yml, tests.yml): both now start with permissions: contents: read. The publish job keeps its own id-token: write for PyPI, as before.

Test: tests/test_failed_test_names_fast.py runs the slow line in a separate process with a 10 s limit. It fails without the fix (timed out) and passes with it in 0.3 s, plus checks pytest names still read right (TestA::test_one gives test_one, test_two[a-b], nested classes). Full suite: 368 passed, 1 skipped.

• It links the issue it fixes (the CodeQL alerts README: proof of concept framing and the prosemirror-py leak example #1-README: pyclibrary 6 PRs merged, marshmallow-fastoneofschema #1 #3 in the Security tab).
• For a bug fix: a test that fails without the change and passes with it.
• python -m pytest passes, and CI is green.

Assisted-by: Claude Code

---

Generated by Claude Code

[github-actions]

✅ Bite-proof. Nice work.

Bite took each change out, one at a time, and a test noticed every time. If one breaks later, that test will warn you.

Badge for your README: [![Bite-proof ✅](https://img.shields.io/badge/Bite--proof-%E2%9C%85-black)](https://github.com/connabyss/bite)

• ✅ The test test_a_line_full_of_colons_does_not_hang noticed it was gone. If this change breaks later, that test will warn you.
  _{Commit 89fdbc60: “Fix the 3 CodeQL alerts: slow failing-test regex, missing workflow permissions”}

How Bite checks

Bite asks one question about each change: if it disappeared, would any test notice? It takes the change out, runs your tests, and puts it back. What is Bite?