[Audit] Reduce high-value duplication found by jscpd #7

New Issue

2026-07-13T20:09:58+02:00

zemion commented

2026-07-13 20:09:58 +02:00

jscpd reports low overall duplication, but several repeated areas are worth targeted cleanup when touched.

Source report: /mnt/DATA/git/govoplan/audit-reports/govoplan-full-20260713-1949/jscpd/jscpd-report.json

Current summary:

322 clones.
3,850 duplicated lines out of 195,834 lines.
1.97% duplicated lines overall.

High-value clusters:

src/govoplan_mail/backend/router.py vs src/govoplan_scheduling/backend/router.py
src/govoplan_core/core/configuration_packages.py vs src/govoplan_core/core/module_package_catalog.py
repeated tools/release/govoplan_release/publisher.py blocks
repeated WebUI API helper shapes across module APIs

Acceptance criteria:

Track and reduce the largest non-test duplicate clusters opportunistically.
Prefer shared helpers only where they reduce real maintenance risk.
Avoid cross-module imports that violate optional module boundaries.

jscpd reports low overall duplication, but several repeated areas are worth targeted cleanup when touched. Source report: `/mnt/DATA/git/govoplan/audit-reports/govoplan-full-20260713-1949/jscpd/jscpd-report.json` Current summary: - 322 clones. - 3,850 duplicated lines out of 195,834 lines. - 1.97% duplicated lines overall. High-value clusters: - `src/govoplan_mail/backend/router.py` vs `src/govoplan_scheduling/backend/router.py` - `src/govoplan_core/core/configuration_packages.py` vs `src/govoplan_core/core/module_package_catalog.py` - repeated `tools/release/govoplan_release/publisher.py` blocks - repeated WebUI API helper shapes across module APIs Acceptance criteria: - Track and reduce the largest non-test duplicate clusters opportunistically. - Prefer shared helpers only where they reduce real maintenance risk. - Avoid cross-module imports that violate optional module boundaries.

zemion commented

2026-07-29 13:26:00 +02:00

Codex State: progress

The July audit wrapper now scans every module requirement/lock file and applies only narrow test-root exclusions for assertion/fake-secret rules; production security scans remain unchanged. jscpd was unavailable in the host-only rerun because the pinned audit container could not access the host Docker socket. Existing duplication findings therefore remain open and unsuppressed. Enforceable scanner coverage is tracked in the new security-audit CI issue.

## Codex State: progress The July audit wrapper now scans every module requirement/lock file and applies only narrow test-root exclusions for assertion/fake-secret rules; production security scans remain unchanged. jscpd was unavailable in the host-only rerun because the pinned audit container could not access the host Docker socket. Existing duplication findings therefore remain open and unsuppressed. Enforceable scanner coverage is tracked in the new security-audit CI issue.

zemion added the area/devex area/governance audit/duplication audit/structural codex/ready module/core

priority

p2

source/security-audit

labels 2026-07-29 14:15:07 +02:00

zemion referenced this issue

2026-08-01 08:21:48 +02:00

[Epic] Adopt the institutional governance target architecture #29

zemion commented

2026-08-02 05:32:15 +02:00

Implemented and pushed.

Core catalog/configuration-package acceptance now uses one persistence helper (GovOPlaN/govoplan-core@3c4bcc2).
Core exposes the shared authenticated apiPostJson/apiPatchJson mutation path; IDM and Organizations no longer carry local copies (govoplan-idm@820ea5e, govoplan-organizations@3f0f38d).
Release publication result assembly is consolidated and generated/declarative sources have narrow jscpd exclusions (GovOPlaN/govoplan@f7a3068).
The refreshed 64-repository scan reports 564 exact clones and 9,957 duplicated lines out of 588,960: 1.69%, down from the reviewed 1.82% pre-exclusion baseline. Remaining Dataflow/Workflow and domain-router similarities stay independently owned where sharing would violate optional-module boundaries.

Verification: Core contract/module suite 128 passed, 211 subtests; release/deployment/inventory suite 54 passed, 2 subtests; production WebUI build and bundle budgets passed; Ruff and git diff --check passed.

Acceptance criteria are met; closing.

Implemented and pushed. - Core catalog/configuration-package acceptance now uses one persistence helper (`GovOPlaN/govoplan-core@3c4bcc2`). - Core exposes the shared authenticated `apiPostJson`/`apiPatchJson` mutation path; IDM and Organizations no longer carry local copies (`govoplan-idm@820ea5e`, `govoplan-organizations@3f0f38d`). - Release publication result assembly is consolidated and generated/declarative sources have narrow jscpd exclusions (`GovOPlaN/govoplan@f7a3068`). - The refreshed 64-repository scan reports 564 exact clones and 9,957 duplicated lines out of 588,960: **1.69%**, down from the reviewed 1.82% pre-exclusion baseline. Remaining Dataflow/Workflow and domain-router similarities stay independently owned where sharing would violate optional-module boundaries. Verification: Core contract/module suite `128 passed, 211 subtests`; release/deployment/inventory suite `54 passed, 2 subtests`; production WebUI build and bundle budgets passed; Ruff and `git diff --check` passed. Acceptance criteria are met; closing.

zemion closed this issue

2026-08-02 05:32:15 +02:00

zemion removed the codex/ready

status

ready

labels 2026-08-02 05:42:11 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#7