Repository navigation
fix(trace): normalize skill first-use times - #3792
Merged
Merged
Conversation
Store the first-use time of a skill as RFC3339 in UTC with whole seconds in the shared SkillUse, so that every provider gives the same format and the earliest time is found also across timezone offsets. A time that cannot be read is ignored, and the use still counts. Sort skills with no time after the ones with a known time, so that the limit on skill entries keeps the skills used first, and warn at push when a skill entry records the push time because its use time is unknown. Assisted-by: Claude Code Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev> Chainloop-Trace-Sessions: a3209730-01fe-4c84-bf42-5253bd91b589
Contributor
PR validation — ✅ 3 passing
AI Session Checks —
|
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
Scans not applied (3)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 4 files
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
Move the warning about a skill entry that records the push time from readSessionSkills to attachSkills, after the entry is stored. A skill that cannot be stored no longer gets a warning about a time that no entry holds. Assisted-by: Claude Code Signed-off-by: Jose Ignacio Paris Prieto <jiparis@chainloop.dev> Chainloop-Trace-Sessions: a3209730-01fe-4c84-bf42-5253bd91b589
migmartri
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3793.
Summary
SkillUsenow stores the first-use time of a skill as RFC3339 in UTC with whole seconds. Before, each provider had to convert the time itself, and a raw value (for example a Pi timestamp with milliseconds, or one with a timezone offset) went into the evidence as is and compared wrongly as a string.issue-3540-trace-skills-used).This came up in the review of #3759: with this change, the Pi provider gets the right time format without its own conversion.
AI disclosure: this change was made with the assistance of Claude Code.