fix: preserve directory-only manifest patterns

Address peer review feedback by retaining pathlib.rglob trailing-slash semantics, trimming the release notes, and removing redundant implementation commentary.

Wach Social Media Post

@@ -4,44 +4,22 @@
 
 ### Changed: faster local scan setup for large repositories
 
-- Replaced repeated per-pattern recursive manifest globs with one streaming
- filesystem walk per scan root. Excluded directories and `.git` are pruned
- before descent, reducing filesystem metadata work without building a
- repository-sized in-memory file index.
-- Removed the unconditional `git fetch --all` from CLI initialization. Pull
- request scans now use local refs first and fetch only a required base or head
- ref when the checkout does not contain enough history.
-- Added native Buildkite commit, branch, pull-request range, and CloneAGC SCM
- configuration fallbacks so Buildkite jobs no longer need CloneAGC
- Actions-shaped environment-variable shims.
-- Added INFO-level timings for CLI run registration, organization setup, Git
- initialization and fetches, changed-file detection, supported-pattern lookup,
- and manifest discovery.
-- Supported manifest patterns are cached for each CLI invocation once the API
- returns them, so a transient lookup failure no longer keeps the run on the
- smaller local fallback pattern set. Manifest results from `--sub-path` routing
- are reused during scan creation.
+- Manifest discovery now uses one filesystem walk per scan root and prunes
+ excluded directories before descent.
+- Pull request scans use local Git refs first and fetch only missing history.
+ Buildkite pull request metadata is now supported directly.
+- Supported manifest patterns are cached per invocation, and discovered
+ manifests are reused during scan creation.
+- Added timings for initialization, Git operations, changed-file detection,
+ pattern lookup, and manifest discovery.
 
 ### Changed: scan comparisons no longer fetch unused artifacts
 
-- Scan comparisons now ask the API to omit unchanged artifacts unless an enabled
- output actually reads them (`--strict-blocking`, `--enable-gitlab-security`,
- `--generate-license`, or `--legal-format fossa`). Cached comparison responses
- embed every unchanged artifact at roughly 1 KB each, so on a large dependency
- tree this was most of the response — over 10 MB for a tree of ~10k unchanged
- packages — downloaded and parsed on every pull request even when nothing read
- it. Behavior is unchanged for any run that uses those outputs.
-
-### Changed: scan comparison timing is easier to attribute
-
-- Lowered the diff-scan poll ceiling from 30s to 10s. A finished comparison is no
- longer left unobserved for up to half a minute, which matters when the CLI runs
- inside a CI step with a per-step time budget.
-- Diff scans now log their ID, poll count, and the wait before the final poll, so
- a CI log distinguishes backend comparison time from time spent between polls.
+- Scan comparisons omit unchanged artifacts unless an enabled output needs them.
+- Diff scans poll more frequently and log identifiers and timing details for
+ easier troubleshooting.
 - Documented the `diff-scans:create`, `diff-scans:list` and `full-scans:list`
- token scopes. Without them the comparison silently falls back to the older
- streaming path.
+ token scopes required by the optimized comparison path.
 
 ## 2.6.5
 

Good Technical Content Post Examples

@@ -103,13 +103,6 @@
 # minutes to compute. The timeout is a backstop against a diff scan that never
 # completes; on expiry (or any other failure of this flow) the caller falls back to the
 # legacy streaming comparison rather than failing the scan outright.
-#
-# The max interval is also the upper bound on how long a finished comparison sits
-# unnoticed between polls, which is dead time added to every PR job. Callers commonly
-# run this inside a CI step with a per-step time budget of a few minutes, so the cap is
-# kept small: a multi-minute comparison costs roughly 2x the polls of a 30s cap while
-# cutting the worst-case dead time from 30s to 10s. Diff scans log their poll count and
-# last interval on completion so this tradeoff can be re-evaluated against real timings.
 DIFF_SCAN_POLL_INITIAL_INTERVAL_SECONDS = 5.0
 DIFF_SCAN_POLL_MAX_INTERVAL_SECONDS = 10.0
 DIFF_SCAN_POLL_BACKOFF_MULTIPLIER = 1.5
@@ -495,12 +488,12 @@ def _prepare_manifest_patterns(
  # PurePath.match compares pattern segments right to left, so a path-shaped glob
  # can only match a file whose basename matches the glob's final segment. Folding
  # those final segments into the basename prefilter lets the walk skip the path
- # match for everything else. An empty final segment (a trailing "/") constrains
- # nothing, so it becomes "*" and the prefilter admits every name.
+ # match for everything else. A trailing "/" is directory-only under the legacy
+ # rglob behavior, so its empty final segment intentionally admits no files.
  candidate_basenames = set(literal_basenames)
  candidate_basename_globs = set(basename_globs)
  for pattern in path_globs:
- final_segment = pattern.rstrip("/").rsplit("/", 1)[-1] or "*"
+ final_segment = pattern.rsplit("/", 1)[-1]
  if any(character in final_segment for character in "*?["):
  candidate_basename_globs.add(final_segment)
  else:

Product Launch Graphics Social

@@ -117,6 +117,24 @@ def test_single_walk_matches_legacy_rglob_results_for_builtin_patterns(tmp_path)
  assert set(core.find_files(str(tmp_path))) == legacy_results
 
 
+def test_directory_only_pattern_does_not_match_same_named_file(tmp_path):
+ """A trailing slash keeps pathlib.rglob's directory-only semantics."""
+ _write_files(
+ tmp_path,
+ {
+ "manifests/package.json",
+ "nested/manifests",
+ },
+ )
+ patterns = {
+ "test": {
+ "directory-only": {"pattern": "manifests/"},
+ },
+ }
+
+ assert _make_core(patterns=patterns).find_files(str(tmp_path)) == []
+
+
 def test_prunes_git_default_globs_and_exclude_paths_before_descent(
  tmp_path, mocker, caplog
 ):