Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-08 18:31:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix knowledge corpus integrity issues

Browse source 
Repair broken knowledge references and align review examples with canonical articles. Correct explicit version gates, restore a missing title, and recognize the plugin directory in the root guard.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Jesper Schulz-Wedde 2026-07-10 12:46:43 +02:00
parent 3aa3581f95
commit a56d1453b9
15 changed files with 58 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

53
microsoft/skills/review/al-code-review.md
View file

@ -127,36 +127,36 @@ Output conforms to the DO output contract, extended with `sub-results` and `skip
},
"findings": [
{
"id": "microsoft/knowledge/performance/filter-before-find.md",
"id": "microsoft/knowledge/performance/apply-filters-before-iterating.md",
"severity": "major",
"message": "FindSet is called on a record variable without any prior SetRange/SetFilter. This forces a full-table scan.",
"message": "The Country/Region Code predicate is evaluated inside the loop instead of with SetRange before FindSet, so every row crosses the database boundary.",
"location": {
"file": "src/Sales/PostingRoutines.Codeunit.al",
"line": 140,
"range": { "start-line": 140, "end-line": 144 }
},
"references": [
{ "path": "microsoft/knowledge/performance/filter-before-find.md" }
{ "path": "microsoft/knowledge/performance/apply-filters-before-iterating.md" }
],
"confidence": "high",
"from-sub-skill": "al-performance-review"
},
{
"id": "community/knowledge/performance/call-setloadfields-before-filters.md",
"id": "community/knowledge/performance/setloadfields-unlisted-field-triggers-jit-load.md",
"severity": "minor",
"message": "SetLoadFields is called after SetRange. Per the referenced guidance the call must come before filters to be folded into the query plan.",
"message": "The loop reads an unlisted field after SetLoadFields, triggering a hidden JIT load for each record passed by value.",
"location": {
"file": "src/Sales/PostingRoutines.Codeunit.al",
"line": 152
},
"references": [
{ "path": "community/knowledge/performance/call-setloadfields-before-filters.md" }
{ "path": "community/knowledge/performance/setloadfields-unlisted-field-triggers-jit-load.md" }
],
"confidence": "high",
"from-sub-skill": "al-performance-review"
},
{
"id": "microsoft/knowledge/security/use-secrettext-for-credentials.md",
"id": "microsoft/knowledge/security/secrettext-for-credentials.md",
"severity": "blocker",
"message": "A bearer token is declared as a Text parameter and passed through the HTTP request path as plain text. The referenced guidance requires credentials to flow as SecretText end-to-end.",
"location": {
@ -165,21 +165,21 @@ Output conforms to the DO output contract, extended with `sub-results` and `skip
"range": { "start-line": 85, "end-line": 89 }
},
"references": [
{ "path": "microsoft/knowledge/security/use-secrettext-for-credentials.md" }
{ "path": "microsoft/knowledge/security/secrettext-for-credentials.md" }
],
"confidence": "high",
"from-sub-skill": "al-security-review"
},
{
"id": "microsoft/knowledge/security/never-hardcode-secrets-in-al.md",
"id": "community/knowledge/security/secrets-isolated-storage.md",
"severity": "minor",
"message": "An API key is assigned from a string literal rather than retrieved from IsolatedStorage or Key Vault at runtime.",
"message": "A setup table stores an API key in an ordinary Text field, exposing it through table reads and exports. Persist it in IsolatedStorage instead.",
"location": {
"file": "src/Integration/ApiClient.Codeunit.al",
"line": 201
"file": "src/Integration/ExternalServiceSetup.Table.al",
"line": 12
},
"references": [
{ "path": "microsoft/knowledge/security/never-hardcode-secrets-in-al.md" }
{ "path": "community/knowledge/security/secrets-isolated-storage.md" }
],
"confidence": "medium",
"from-sub-skill": "al-security-review"
@ -209,29 +209,29 @@ Output conforms to the DO output contract, extended with `sub-results` and `skip
},
"findings": [
{
"id": "microsoft/knowledge/performance/filter-before-find.md",
"id": "microsoft/knowledge/performance/apply-filters-before-iterating.md",
"severity": "major",
"message": "FindSet is called on a record variable without any prior SetRange/SetFilter. This forces a full-table scan.",
"message": "The Country/Region Code predicate is evaluated inside the loop instead of with SetRange before FindSet, so every row crosses the database boundary.",
"location": {
"file": "src/Sales/PostingRoutines.Codeunit.al",
"line": 140,
"range": { "start-line": 140, "end-line": 144 }
},
"references": [
{ "path": "microsoft/knowledge/performance/filter-before-find.md" }
{ "path": "microsoft/knowledge/performance/apply-filters-before-iterating.md" }
],
"confidence": "high"
},
{
"id": "community/knowledge/performance/call-setloadfields-before-filters.md",
"id": "community/knowledge/performance/setloadfields-unlisted-field-triggers-jit-load.md",
"severity": "minor",
"message": "SetLoadFields is called after SetRange. Per the referenced guidance the call must come before filters to be folded into the query plan.",
"message": "The loop reads an unlisted field after SetLoadFields, triggering a hidden JIT load for each record passed by value.",
"location": {
"file": "src/Sales/PostingRoutines.Codeunit.al",
"line": 152
},
"references": [
{ "path": "community/knowledge/performance/call-setloadfields-before-filters.md" }
{ "path": "community/knowledge/performance/setloadfields-unlisted-field-triggers-jit-load.md" }
],
"confidence": "high"
}
@ -247,7 +247,7 @@ Output conforms to the DO output contract, extended with `sub-results` and `skip
},
"findings": [
{
"id": "microsoft/knowledge/security/use-secrettext-for-credentials.md",
"id": "microsoft/knowledge/security/secrettext-for-credentials.md",
"severity": "blocker",
"message": "A bearer token is declared as a Text parameter and passed through the HTTP request path as plain text. The referenced guidance requires credentials to flow as SecretText end-to-end.",
"location": {
@ -256,20 +256,20 @@ Output conforms to the DO output contract, extended with `sub-results` and `skip
"range": { "start-line": 85, "end-line": 89 }
},
"references": [
{ "path": "microsoft/knowledge/security/use-secrettext-for-credentials.md" }
{ "path": "microsoft/knowledge/security/secrettext-for-credentials.md" }
],
"confidence": "high"
},
{
"id": "microsoft/knowledge/security/never-hardcode-secrets-in-al.md",
"id": "community/knowledge/security/secrets-isolated-storage.md",
"severity": "minor",
"message": "An API key is assigned from a string literal rather than retrieved from IsolatedStorage or Key Vault at runtime.",
"message": "A setup table stores an API key in an ordinary Text field, exposing it through table reads and exports. Persist it in IsolatedStorage instead.",
"location": {
"file": "src/Integration/ApiClient.Codeunit.al",
"line": 201
"file": "src/Integration/ExternalServiceSetup.Table.al",
"line": 12
},
"references": [
{ "path": "microsoft/knowledge/security/never-hardcode-secrets-in-al.md" }
{ "path": "community/knowledge/security/secrets-isolated-storage.md" }
],
"confidence": "medium"
}
@ -310,4 +310,3 @@ The empty-corpus case — BCQuality's state until knowledge files land — rolls
]
}
```