fix(ci): harden hourly automation boundaries - #24
Conversation
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthrough시간별 PR 유지보수는 고정 리비전의 중앙 merge 스케줄러를 호출합니다. 제품 개발은 결정론적 게이트와 NVIDIA 자격 증명 검증을 분리합니다. 결과물은 자격 증명 지문으로 검사합니다. CI와 릴리스 검증은 해당 가드와 folded endpoint 형식을 확인합니다. Changes시간별 자동화 워크플로
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant HourlyProductDevelopment
participant DeterministicGate
participant NIMCredentialBroker
participant SecretFingerprintGuard
participant ArtifactCapture
HourlyProductDevelopment->>DeterministicGate: PR 및 release-blocker 상태 평가
DeterministicGate-->>HourlyProductDevelopment: 실행 준비 상태 반환
HourlyProductDevelopment->>NIMCredentialBroker: NVIDIA 자격 증명 검증
NIMCredentialBroker->>SecretFingerprintGuard: 지문 파일 생성
ArtifactCapture->>SecretFingerprintGuard: 패치, 통계, 제안서 검사
SecretFingerprintGuard-->>ArtifactCapture: 검사 결과 반환
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent @cwl-noema-review Review-only request for exact current head |
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='71a6d7e151ec6a9d53f9761ad65d4f22d3951c5f'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
repo='ContextualWisdomLab/ThreadWeave'
printf '%s\n' '== Checked-out and requested commits =='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=yes'
printf '%s\n' '== Exact-head changed files and diff =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --unified=80 "$base" "$head" -- .github || true
printf '%s\n' '== Candidate workflow/test files =='
fd -t f . .github 2>/dev/null || true
fd -t f . | rg -i '(harden|endpoint|workflow|actionlint|regression|test)' || true
printf '%s\n' '== PR metadata, checks, reviews, and review comments =='
gh pr view 24 --repo "$repo" --json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}],reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}]}'
gh api "repos/$repo/pulls/24/comments?per_page=100" \
--jq '.[] | {user:.user.login,path,position,original_position,commit_id,body,created_at}' || trueLength of output: 26977 🏁 Script executed: #!/bin/bash
set -euo pipefail
workflow='.github/workflows/hourly-product-development.yml'
test_file='tests/test_hourly_product_egress_contract.py'
printf '%s\n' '== Changed regression test =='
cat -n "$test_file"
printf '%s\n' '== Workflow: all Harden Runner declarations and endpoint blocks =='
rg -n -A22 -B4 'uses:\s*step-security/harden-runner|allowed-endpoints:|egress-policy:' "$workflow"
printf '%s\n' '== Workflow: deterministic development gate =='
rg -n -A80 -B5 'name: Enforce the credential and pull-request-first gate|NIM_UPSTREAM_API_KEY|NVIDIA_NIM_API_KEY|DRY_RUN|open_prs=|release_blockers=' "$workflow"
printf '%s\n' '== Workflow: job declarations and credential references =='
rg -n -A8 -B3 '^ (develop-product-gap|reverify-product-gap|publish-product-gap):|NVIDIA_NIM_API_KEY|NIM_UPSTREAM_API_KEY|integrate\.api\.nvidia\.com' "$workflow"
printf '%s\n' '== Static YAML scalar and endpoint-set validation =='
python - <<'PY'
from pathlib import Path
import re
text = Path(".github/workflows/hourly-product-development.yml").read_text()
expected = {
"develop-product-gap": {
"api.github.com:443", "cafe.github.com:443", "codeload.github.com:443",
"files.pythonhosted.org:443", "github.com:443", "integrate.api.nvidia.com:443",
"objects.githubusercontent.com:443", "pypi.org:443", "registry.npmjs.org:443",
"release-assets.githubusercontent.com:443", "results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443", "*.blob.core.windows.net:443",
},
"reverify-product-gap": {
"api.github.com:443", "cafe.github.com:443", "files.pythonhosted.org:443",
"github.com:443", "objects.githubusercontent.com:443", "pypi.org:443",
"release-assets.githubusercontent.com:443", "results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443", "*.blob.core.windows.net:443",
},
"publish-product-gap": {
"api.github.com:443", "cafe.github.com:443", "github.com:443",
"objects.githubusercontent.com:443", "results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443", "*.blob.core.windows.net:443",
},
}
jobs = {}
for job, body in re.findall(
r"^ ([a-z][\w-]+):\n(.*?)(?=^ [a-z][\w-]+:|\Z)",
text,
flags=re.M | re.S,
):
if job in expected:
scalar = re.search(
r"^ allowed-endpoints: (.+?)\n((?: .*\n)+)",
body,
flags=re.M,
)
assert scalar, f"{job}: allowed-endpoints block not found"
style, lines = scalar.groups()
endpoints = {line.strip() for line in lines.splitlines() if line.strip()}
jobs[job] = (style, endpoints)
for job, (style, endpoints) in jobs.items():
print(f"{job}: style={style!r}; exact_set={endpoints == expected[job]}; count={len(endpoints)}")
print(" endpoints=" + " ".join(sorted(endpoints)))
assert style == ">-", f"{job}: expected folded strip scalar"
assert endpoints == expected[job], f"{job}: endpoint set changed"
assert set(jobs) == set(expected), "missing expected Harden Runner job"
assert "allowed-endpoints: |" not in text, "literal endpoint scalar remains"
print("all exact endpoint-set checks passed")
PYLength of output: 43285 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
head='71a6d7e151ec6a9d53f9761ad65d4f22d3951c5f'
test_commit='601583d3b1846c5a019ab38d180e87a40d343069'
printf '%s\n' '== Test-first commit sequence =='
git merge-base --is-ancestor "$test_commit" "$head" && echo 'test-commit-is-ancestor=yes'
git show --no-ext-diff --format='commit=%H%nparent=%P%nsubject=%s' --stat "$test_commit"
git show --no-ext-diff --format='commit=%H%nparent=%P%nsubject=%s' --stat "$head"
printf '%s\n' '== Head-only patch after regression-contract commit =='
git diff --check "$test_commit" "$head"
git diff --name-status "$test_commit" "$head"
git diff --unified=12 "$test_commit" "$head" -- .github/workflows/hourly-product-development.yml tests/test_hourly_product_egress_contract.py
printf '%s\n' '== Current check suites for requested head =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | {name,status,conclusion,started_at,completed_at,details_url}'
printf '%s\n' '== Current GitHub review state and review-thread comments =='
gh pr view 24 --repo "$repo" --json reviewDecision,reviews,latestReviews \
--jq '{reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt,body}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number=24 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'
printf '%s\n' '== Protected-main branch requirements =='
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_signatures,enforce_admins}' || trueLength of output: 15127
I found no source-level review findings in the requested scope.
I cannot approve yet.
|
|
@coderabbitai review Please perform a fresh full review of exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='71a6d7e151ec6a9d53f9761ad65d4f22d3951c5f'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
echo '== Commit identity and ancestry =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
printf 'merge_base='; git merge-base "$base" "$head"
echo '== Exact diff =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=30 "$base" "$head" -- .github/workflows/hourly-product-development.yml tests/test_hourly_product_egress_contract.py
echo '== Candidate file map =='
fd -t f -a 'hourly-product-development.yml' .github
fd -t f -a 'test_hourly_product_egress_contract.py' tests
ast-grep outline .github/workflows/hourly-product-development.yml --items all || true
ast-grep outline tests/test_hourly_product_egress_contract.py --items all || true
echo '== Workflow and regression contract =='
cat -n .github/workflows/hourly-product-development.yml
cat -n tests/test_hourly_product_egress_contract.py
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | {name,status,conclusion,started_at,completed_at,details_url}'
echo '== Pull request identity, reviews, and files =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,reviews,latestReviews,files \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}],reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt}],files:[.files[]? | {path,additions,deletions}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 30) {
nodes { author { login } body commit { oid } path line originalLine createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'
echo '== Branch-protection policy =='
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_signatures,enforce_admins}' || trueLength of output: 76146
I found no source-level findings in the requested scope.
I could not verify protected-branch requirements. GitHub returned HTTP 403 for the branch-protection API. I cannot submit a formal approval from this
|
|
@coderabbitai review Re-review exact unchanged head |
|
Your plan includes PR reviews subject to rate limits. Reviews are available now. |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='71a6d7e151ec6a9d53f9761ad65d4f22d3951c5f'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
workflow='.github/workflows/hourly-product-development.yml'
test_file='tests/test_hourly_product_egress_contract.py'
echo '== Exact revision identity =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
printf 'merge_base='; git merge-base "$base" "$head"
echo '== Exact head diff =='
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=40 "$base" "$head" -- "$workflow" "$test_file"
echo '== Candidate file outlines =='
ast-grep outline "$workflow" --items all || true
ast-grep outline "$test_file" --items all || true
echo '== Harden Runner configurations =='
rg -n -A25 -B4 'step-security/harden-runner|egress-policy:|allowed-endpoints:' "$workflow"
echo '== Gate and model credential ordering =='
rg -n -A95 -B8 'open_prs=|release_blockers=|DRY_RUN|NIM_UPSTREAM_API_KEY|NVIDIA_NIM_API_KEY|open_pull_request|release_blocker|dry_run' "$workflow"
echo '== Parsed scalar and endpoint-set validation =='
python3 - <<'PY'
from pathlib import Path
import re
text = Path(".github/workflows/hourly-product-development.yml").read_text()
expected = {
"develop-product-gap": {
"api.github.com:443", "cafe.github.com:443", "codeload.github.com:443",
"files.pythonhosted.org:443", "github.com:443", "integrate.api.nvidia.com:443",
"objects.githubusercontent.com:443", "pypi.org:443", "registry.npmjs.org:443",
"release-assets.githubusercontent.com:443", "results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443", "*.blob.core.windows.net:443",
},
"reverify-product-gap": {
"api.github.com:443", "cafe.github.com:443", "files.pythonhosted.org:443",
"github.com:443", "objects.githubusercontent.com:443", "pypi.org:443",
"release-assets.githubusercontent.com:443", "results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443", "*.blob.core.windows.net:443",
},
"publish-product-gap": {
"api.github.com:443", "cafe.github.com:443", "github.com:443",
"objects.githubusercontent.com:443", "results-receiver.actions.githubusercontent.com:443",
"*.actions.githubusercontent.com:443", "*.blob.core.windows.net:443",
},
}
for job, wanted in expected.items():
body_match = re.search(
rf"^ {re.escape(job)}:\n(.*?)(?=^ [\w-]+:|\Z)", text, re.M | re.S
)
assert body_match, f"{job}: missing job"
body = body_match.group(1)
match = re.search(
r"^ allowed-endpoints: (.+?)\n((?: .*\n)+)",
body, re.M
)
assert match, f"{job}: missing allowed-endpoints"
style, endpoint_lines = match.groups()
values = {line.strip() for line in endpoint_lines.splitlines() if line.strip()}
print(f"{job}: style={style!r} egress_block={'egress-policy: block' in body} "
f"exact_set={values == wanted} endpoint_count={len(values)}")
assert style == ">-", f"{job}: scalar style is {style!r}"
assert "egress-policy: block" in body, f"{job}: egress is not block"
assert values == wanted, f"{job}: endpoint set changed"
assert "allowed-endpoints: |" not in text
print("literal endpoint scalar absent")
PY
echo '== Regression contract relevant assertions =='
rg -n -A8 -B5 'allowed-endpoints|>\-|literal|endpoint|suffix|open_pull_request|release_blocker|dry_run' "$test_file"
echo '== Current exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | {name,status,conclusion,started_at,completed_at,details_url}'
echo '== Current PR reviews and unresolved threads =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,latestReviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt}],checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } body commit { oid } path line originalLine createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'Length of output: 74239
I found no source-level findings in the requested scope.
A formal approval requires a separate top-level You are interacting with an AI system. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='507f6fef013d0a193f6626ecd680d081333eab5e'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
echo '== Exact revision and diff =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
printf 'merge_base='; git merge-base "$base" "$head"
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=50 "$base" "$head" -- .github tests
echo '== Candidate workflow and regression files =='
fd -t f . .github tests | rg -i '(hourly|release|harden|egress|endpoint|contract)'
echo '== Workflow outlines =='
fd -t f -e yml -e yaml .github/workflows -x ast-grep outline {} --items all 2>/dev/null || true
echo '== Harden Runner configuration blocks =='
rg -n -A35 -B5 'uses:\s*step-security/harden-runner|egress-policy:|allowed-endpoints:' .github/workflows
echo '== Hourly deterministic gates and credential scope =='
rg -n -A105 -B10 'open_pull_request|release_blocker|dry_run|NIM_UPSTREAM_API_KEY|NVIDIA_NIM_API_KEY|integrate\.api\.nvidia\.com' .github/workflows
echo '== Release credential, permission, and publication references =='
rg -n -A8 -B8 'NVIDIA_NIM_API_KEY|NIM_UPSTREAM_API_KEY|COPILOT_GITHUB_TOKEN|permissions:|publish|release|upload|attest|id-token|packages:|contents:' .github/workflows
echo '== Exact-head check runs =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | {name,status,conclusion,started_at,completed_at,details_url}'
echo '== Requested workflow runs =='
for run in 31257510926 31257510919 31257510936; do
gh api "repos/$repo/actions/runs/$run" \
--jq '{id,name,event,status,conclusion,head_sha,head_branch,run_started_at,updated_at,html_url}'
gh api "repos/$repo/actions/runs/$run/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,started_at,completed_at,html_url}'
done
echo '== Current pull request reviews, check rollup, and threads =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,latestReviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt,body}],checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 30) {
nodes { author { login } body commit { oid } path line originalLine createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'
echo '== Protected branch policy =='
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_signatures,enforce_admins}' || trueLength of output: 205834 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='507f6fef013d0a193f6626ecd680d081333eab5e'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
echo '== Endpoint block equality, excluding scalar marker =='
python3 - <<'PY'
import re
import subprocess
base = "e9e52e4cae47c1c0164a37ed907719f5e899caf5"
head = "507f6fef013d0a193f6626ecd680d081333eab5e"
files = (
".github/workflows/hourly-product-development.yml",
".github/workflows/release.yml",
)
def content(revision, path):
return subprocess.check_output(
["git", "show", f"{revision}:{path}"], text=True
)
def endpoint_blocks(text):
blocks = []
pattern = re.compile(
r"(?ms)^ ([a-z][a-z0-9-]+):\n.*?"
r"^ allowed-endpoints: ([|>][-+]?)\n"
r"((?:^ \S.*\n)+)"
)
for job, marker, block in pattern.findall(text):
endpoints = tuple(line.strip() for line in block.splitlines())
blocks.append((job, marker, endpoints))
return blocks
for path in files:
old = endpoint_blocks(content(base, path))
new = endpoint_blocks(content(head, path))
assert len(old) == len(new), (path, len(old), len(new))
assert [j for j, _, _ in old] == [j for j, _, _ in new], path
print(path)
for (job, old_marker, old_endpoints), (_, new_marker, new_endpoints) in zip(old, new):
unchanged = old_endpoints == new_endpoints
print(
f" {job}: base={old_marker!r} head={new_marker!r} "
f"count={len(new_endpoints)} exact_membership_unchanged={unchanged}"
)
assert old_marker == "|", (path, job, old_marker)
assert new_marker == ">-", (path, job, new_marker)
assert unchanged, (path, job)
assert len(new_endpoints) == len(set(new_endpoints)), (path, job, "duplicate endpoint")
print("all eight endpoint blocks retain exact base membership")
PY
echo '== Workflow diffs contain only scalar-marker changes =='
git diff --word-diff=porcelain "$base" "$head" -- \
.github/workflows/hourly-product-development.yml .github/workflows/release.yml |
awk '
/^[-+][^+-]/ {
line=$0
sub(/^[-+]/, "", line)
if (line != " allowed-endpoints: |" && line != " allowed-endpoints: >-") {
print "unexpected changed workflow line: " $0
bad=1
}
}
END { if (bad) exit 1; print "only allowed-endpoints scalar markers changed" }
'
echo '== Current remaining check and review state =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {name,status,conclusion,started_at,completed_at,details_url}'
gh pr view "$pr" --repo "$repo" \
--json headRefOid,mergeStateStatus,reviewDecision,reviews,latestReviews \
--jq '{headRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } commit { oid } path line body }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'Length of output: 4190 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='507f6fef013d0a193f6626ecd680d081333eab5e'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
echo '== Exact endpoint equality for Harden Runner jobs =='
python3 - <<'PY'
import re
import subprocess
base = "e9e52e4cae47c1c0164a37ed907719f5e899caf5"
head = "507f6fef013d0a193f6626ecd680d081333eab5e"
expected_jobs = {
".github/workflows/hourly-product-development.yml": (
"develop-product-gap", "reverify-product-gap", "publish-product-gap",
),
".github/workflows/release.yml": (
"build-release", "attest-release", "tag-release", "github-release", "publish-pypi",
),
}
def read(revision, path):
return subprocess.check_output(["git", "show", f"{revision}:{path}"], text=True)
def jobs(text):
section = text.split("\njobs:\n", 1)[1]
starts = list(re.finditer(r"(?m)^ ([a-z][a-z0-9-]+):\n", section))
blocks = {}
for index, match in enumerate(starts):
end = starts[index + 1].start() if index + 1 < len(starts) else len(section)
blocks[match.group(1)] = section[match.start():end]
return blocks
def endpoints(block):
match = re.search(
r"(?m)^ allowed-endpoints: ([|>][-+]?)\n"
r"((?: \S.*\n)+)",
block,
)
assert match, "allowed-endpoints block not found"
marker, lines = match.groups()
return marker, tuple(line.strip() for line in lines.splitlines())
for path, names in expected_jobs.items():
old, new = jobs(read(base, path)), jobs(read(head, path))
print(path)
for name in names:
old_marker, old_endpoints = endpoints(old[name])
new_marker, new_endpoints = endpoints(new[name])
assert old_marker == "|", (path, name, old_marker)
assert new_marker == ">-", (path, name, new_marker)
assert old_endpoints == new_endpoints, (path, name, old_endpoints, new_endpoints)
assert len(new_endpoints) == len(set(new_endpoints)), (path, name, "duplicate endpoint")
assert "egress-policy: block" in new[name], (path, name, "egress policy")
print(f" {name}: endpoint_count={len(new_endpoints)} exact_membership_unchanged=true")
print("all eight endpoint blocks retain exact base membership and block egress")
PY
echo '== Workflow changes are limited to scalar markers =='
git diff --word-diff=porcelain "$base" "$head" -- \
.github/workflows/hourly-product-development.yml .github/workflows/release.yml |
awk '
/^[-+][^+-]/ {
line=$0
sub(/^[-+]/, "", line)
if (line != " allowed-endpoints: |" && line != " allowed-endpoints: >-") {
print "unexpected changed workflow line: " $0
bad=1
}
}
END { if (bad) exit 1; print "only allowed-endpoints scalar markers changed" }
'
echo '== Current remaining check and review state =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {name,status,conclusion,started_at,completed_at,details_url}'
gh pr view "$pr" --repo "$repo" \
--json headRefOid,mergeStateStatus,reviewDecision,reviews,latestReviews \
--jq '{headRefOid,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes { author { login } commit { oid } path line body }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'Length of output: 5652 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='507f6fef013d0a193f6626ecd680d081333eab5e'
echo '== Exact-head check status =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] |
{name,status,conclusion,started_at,completed_at,details_url}'
echo '== Current pull request identity and formal reviews =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,latestReviews \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt,body}]}'
echo '== Current unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 20) {
nodes {
author { login }
body
commit { oid }
path
line
originalLine
createdAt
}
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'
echo '== Branch and ruleset policy visibility =='
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_signatures,enforce_admins}' \
|| true
gh api "repos/$repo/rules/branches/main" --jq '.' || trueLength of output: 12479
I found no source-level findings in the requested scope.
I did not submit The remaining gate is You are interacting with an AI system. |
seonghobae
changed the title
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='a012550f6e6ec9941348aa84707bd3c0388eb4eb'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
echo '== Revision identity and full change set =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base_is_ancestor=yes'
printf 'merge_base='; git merge-base "$base" "$head"
git diff --check "$base" "$head"
git diff --name-status "$base" "$head"
git diff --unified=50 "$base" "$head"
echo '== Candidate workflow and contract files =='
fd -t f .github tests | rg -i '(hourly|release|harden|egress|endpoint|maintenance|scheduler|contract)' || true
echo '== Workflow outlines =='
fd -t f -e yml -e yaml .github/workflows -x ast-grep outline {} --items all 2>/dev/null || true
echo '== Harden Runner blocks and model-gate ordering =='
rg -n -A45 -B6 'uses:\s*step-security/harden-runner|egress-policy:|allowed-endpoints:' \
.github/workflows/hourly-product-development.yml .github/workflows/release.yml
rg -n -A115 -B10 'open_pull_request|release_blocker|dry_run|NIM_UPSTREAM_API_KEY|NVIDIA_NIM_API_KEY|integrate\.api\.nvidia\.com' \
.github/workflows/hourly-product-development.yml
echo '== Hourly PR Maintenance delegation, permissions, secrets, and refs =='
fd -t f .github/workflows | rg -i 'hourly.*pr.*maintenance|pr.*maintenance' | while read -r file; do
echo "--- $file"
cat -n "$file"
done
rg -n -A18 -B8 'pr-review-(fix|merge)-scheduler|secrets:\s*inherit|permissions:|`@main`|3f65dbee6672b78802e7d71d49c390f3817bb03b|issues:\s*write' \
.github/workflows
echo '== Static endpoint and delegation assertions =='
python3 - <<'PY'
from pathlib import Path
import re
import subprocess
base = "e9e52e4cae47c1c0164a37ed907719f5e899caf5"
head = "a012550f6e6ec9941348aa84707bd3c0388eb4eb"
workflow_paths = (
".github/workflows/hourly-product-development.yml",
".github/workflows/release.yml",
)
def read(revision, path):
return subprocess.check_output(["git", "show", f"{revision}:{path}"], text=True)
def job_blocks(text):
section = text.split("\njobs:\n", 1)[1]
matches = list(re.finditer(r"(?m)^ ([a-z][a-z0-9-]+):\n", section))
return {
match.group(1): section[match.start(): matches[index + 1].start() if index + 1 < len(matches) else len(section)]
for index, match in enumerate(matches)
}
def endpoints(block):
match = re.search(
r"(?m)^ allowed-endpoints: ([|>][-+]?)\n((?: \S.*\n)+)",
block,
)
assert match, "missing allowed-endpoints"
return match.group(1), tuple(line.strip() for line in match.group(2).splitlines())
for path in workflow_paths:
old, new = job_blocks(read(base, path)), job_blocks(read(head, path))
print(path)
for name, block in new.items():
if "allowed-endpoints:" not in block:
continue
old_marker, old_members = endpoints(old[name])
marker, members = endpoints(block)
assert old_marker == "|", (path, name, old_marker)
assert marker == ">-", (path, name, marker)
assert old_members == members, (path, name, "membership changed")
assert len(members) == len(set(members)), (path, name, "duplicate member")
assert "egress-policy: block" in block, (path, name, "egress not blocked")
print(f" {name}: marker={marker} endpoint_count={len(members)} base_membership_equal=true")
print("endpoint serialization and membership assertions passed")
maintenance_candidates = list(Path(".github/workflows").glob("*"))
maintenance = [
path for path in maintenance_candidates
if path.is_file() and "pr" in path.name.lower() and "maintenance" in path.name.lower()
]
assert len(maintenance) == 1, [str(p) for p in maintenance]
text = maintenance[0].read_text()
assert "pr-review-fix-scheduler.yml" not in text
assert "pr-review-merge-scheduler.yml@main" not in text
assert "pr-review-merge-scheduler.yml@3f65dbee6672b78802e7d71d49c390f3817bb03b" in text
assert "secrets: inherit" not in text
assert re.search(r"(?m)^permissions:\n contents: read\s*$", text)
assert "issues: write" not in text
for permission in (
"actions: write", "checks: read", "contents: write", "id-token: write",
"pull-requests: write", "statuses: read",
):
assert permission in text, permission
print(f"{maintenance[0]}: immutable secretless single-scheduler and permission assertions passed")
PY
echo '== Requested workflow runs =='
for run in 31258267499 31258267481 31258267488; do
gh api "repos/$repo/actions/runs/$run" \
--jq '{id,name,event,status,conclusion,head_sha,head_branch,run_started_at,updated_at,html_url}'
gh api "repos/$repo/actions/runs/$run/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,started_at,completed_at,html_url}'
done
echo '== Exact-head checks, PR state, reviews, and unresolved threads =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | {name,status,conclusion,details_url}'
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,latestReviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt}],checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}]}'
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 30) {
nodes { author { login } body commit { oid } path line originalLine createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'
echo '== Branch protection and ruleset visibility =='
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_signatures,enforce_admins}' || true
gh api "repos/$repo/rules/branches/main" --jq '.' || trueLength of output: 111820 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/ThreadWeave'
pr='24'
head='a012550f6e6ec9941348aa84707bd3c0388eb4eb'
base='e9e52e4cae47c1c0164a37ed907719f5e899caf5'
echo '== Hourly PR Maintenance exact content =='
cat -n .github/workflows/hourly-pr-maintenance.yml
echo '== Static endpoint and delegation assertions =='
python3 - <<'PY'
from pathlib import Path
import re
import subprocess
base = "e9e52e4cae47c1c0164a37ed907719f5e899caf5"
head = "a012550f6e6ec9941348aa84707bd3c0388eb4eb"
workflow_paths = (
".github/workflows/hourly-product-development.yml",
".github/workflows/release.yml",
)
def read(revision, path):
return subprocess.check_output(["git", "show", f"{revision}:{path}"], text=True)
def job_blocks(text):
section = text.split("\njobs:\n", 1)[1]
matches = list(re.finditer(r"(?m)^ ([a-z][a-z0-9-]+):\n", section))
return {
match.group(1): section[
match.start(): matches[index + 1].start()
if index + 1 < len(matches) else len(section)
]
for index, match in enumerate(matches)
}
def endpoints(block):
match = re.search(
r"(?m)^ allowed-endpoints: ([|>][-+]?)\n((?: \S.*\n)+)",
block,
)
assert match, "missing allowed-endpoints"
return match.group(1), tuple(line.strip() for line in match.group(2).splitlines())
for path in workflow_paths:
old, new = job_blocks(read(base, path)), job_blocks(read(head, path))
print(path)
for name, block in new.items():
if "allowed-endpoints:" not in block:
continue
old_marker, old_members = endpoints(old[name])
marker, members = endpoints(block)
assert old_marker == "|", (path, name, old_marker)
assert marker == ">-", (path, name, marker)
assert old_members == members, (path, name, "membership changed")
assert len(members) == len(set(members)), (path, name, "duplicate member")
assert "egress-policy: block" in block, (path, name, "egress not blocked")
print(f" {name}: marker={marker} endpoint_count={len(members)} base_membership_equal=true")
print("endpoint serialization and membership assertions passed")
maintenance = Path(".github/workflows/hourly-pr-maintenance.yml")
text = maintenance.read_text()
assert "pr-review-fix-scheduler.yml" not in text
assert "pr-review-merge-scheduler.yml@main" not in text
assert "pr-review-merge-scheduler.yml@3f65dbee6672b78802e7d71d49c390f3817bb03b" in text
assert "secrets: inherit" not in text
assert re.search(r"(?m)^permissions:\n contents: read\s*$", text)
assert "issues: write" not in text
for permission in (
"actions: write", "checks: read", "contents: write", "id-token: write",
"pull-requests: write", "statuses: read",
):
assert permission in text, permission
print(f"{maintenance}: immutable secretless single-scheduler and permission assertions passed")
PY
echo '== Requested workflow runs =='
for run in 31258267499 31258267481 31258267488; do
gh api "repos/$repo/actions/runs/$run" \
--jq '{id,name,event,status,conclusion,head_sha,head_branch,run_started_at,updated_at,html_url}'
gh api "repos/$repo/actions/runs/$run/jobs?per_page=100" \
--jq '.jobs[] | {name,status,conclusion,started_at,completed_at,html_url}'
done
echo '== Exact-head checks and PR state =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs | sort_by(.name)[] | {name,status,conclusion,details_url}'
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews,latestReviews,statusCheckRollup \
--jq '{headRefOid,baseRefOid,state,isDraft,mergeStateStatus,reviewDecision,reviews:[.reviews[]? | {author:.author.login,state,commitId,submittedAt,body}],latestReviews:[.latestReviews[]? | {author:.author.login,state,commitId,submittedAt}],checks:[.statusCheckRollup[]? | {name,status,conclusion,detailsUrl}]}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='ThreadWeave' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 30) {
nodes { author { login } body commit { oid } path line originalLine createdAt }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)'
echo '== Branch protection and ruleset visibility =='
gh api "repos/$repo/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_signatures,enforce_admins}' || true
gh api "repos/$repo/rules/branches/main" --jq '.' || trueLength of output: 25940
I found no source-level findings in the requested scope.
I did not submit The remaining gate is The organization ruleset requires resolved review threads and requires zero approvals. The branch-protection API returned HTTP 403, so I could not verify additional branch-protection requirements through this integration. You are interacting with an AI system. |
|
@coderabbitai review The stated rate-limit window has elapsed. Perform one full review of exact unchanged head |
|
Your plan includes PR reviews subject to rate limits. More reviews will be available in 36 minutes. |
|
Fleet-incident RCA handoff for exact unchanged head Immediate cause: secret binding is attached to the deterministic gate step rather than to a later model-only step. Systemic cause: the regression in Please treat this as a merge blocker and repair it test-first under the repository owner lease: first add a regression that the deterministic gate block contains no |
|
Implementation request for exact current head The fail-first regression is already committed and authoritative: CI run Implement the smallest complete root-cause repair in only
|
|
@opencode-agent Implementation request for exact current head RCA and required scope:
Preserve fail-closed Harden Runner egress, the exact current endpoint sets and immutable action pins, deterministic gates before NVIDIA credential materialization, pristine per-model workspaces, 100% production statement/branch coverage, and the existing central-scheduler authority boundary. Run focused contract tests first, then Ruff/actionlint/full Python matrix-equivalent tests and security-relevant validation available locally. Commit only the smallest coherent correction to this existing branch. Do not merge, change reviewer/governance policy, create repair workflows, or touch another repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 136-137: release workflow의 printf 블록에서 형식 문자열의 YAML 블록 스칼라 들여쓰기를
올바르게 맞추고, `\n` 이스케이프를 동일한 printf 형식 문자열 안에 포함하도록 수정하세요.
In `@tests/test_ci_autonomous_coverage_contract.py`:
- Around line 17-25: Update
test_ci_and_release_cover_secret_guard_in_focused_boundary_suite to inspect each
workflow’s actual coverage run and coverage report command blocks rather than
searching the entire workflow text. Assert SECRET_GUARD_TEST is included in the
focused pytest arguments, and assert SECRET_GUARD_SOURCE plus --fail-under=100
are present in the corresponding coverage report --include command.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f6efb0dd-2fa9-42df-82e5-1516cc3753ea
📒 Files selected for processing (6)
.github/workflows/ci.yml.github/workflows/release.ymltests/test_ci_autonomous_coverage_contract.pytests/test_hourly_pr_maintenance_contract.pytests/test_release_workflow.pytests/test_workflows.py
🚧 Files skipped from review as they are similar to previous changes (2)
- tests/test_hourly_pr_maintenance_contract.py
- tests/test_workflows.py
c0f88b9 to
dd9053c
Compare
|
@opencode-agent @cwl-noema-review Review-only request for exact current head Revalidate the full current incident scope, including: folded |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3305c08e6372cfc213fdc7055f3e5dfa5d56387d. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL check run: failure (https://github.com/ContextualWisdomLab/ThreadWeave/runs/93157878981)
- CodeQL: FAILURE (https://github.com/ContextualWisdomLab/ThreadWeave/runs/93157878981)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: secret_fingerprint_guard.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: secret_fingerprint_guard.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (6 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (6 files)"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: secret_fingerprint_guard.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: secret_fingerprint_guard.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (8 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (8 files)"]
R3 --> V3["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3305c08e6372cfc213fdc7055f3e5dfa5d56387d. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL check run: failure (https://github.com/ContextualWisdomLab/ThreadWeave/runs/93157878981)
- CodeQL: FAILURE (https://github.com/ContextualWisdomLab/ThreadWeave/runs/93157878981)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (4 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["CI script: secret_fingerprint_guard.py"]
S2 --> I2["review and security gate shell path"]
I2 --> R2["Review risk: CI script: secret_fingerprint_guard.py"]
R2 --> V2["bash -n plus Strix self-test"]
Evidence --> S3["Test (6 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (6 files)"]
R3 --> V3["targeted test run"]
|
@opencode-agent review-only request for exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approved after inspection of changed files .github/workflows/hourly-product-development.yml, .github/workflows/hourly-pr-maintenance.yml, .github/workflows/ci.yml, .github/workflows/release.yml, scripts/ci/secret_fingerprint_guard.py, and the new contract tests. PR intent (harden hourly automation boundaries after fleet incident #22) matches the diff: folded allowed-endpoints: >- scalars, credential removed from the deterministic gate and capture step, fingerprint-only scan boundary, secretless pinned maintenance caller, job-scoped permissions. Approval sufficiency: bounded evidence affirmatively supports intent; no unresolved threads and no completed failed GitHub Checks at head f4c85f7 (predecessor CHANGES_REQUESTED reviews citing failed checks are superseded). Verification posture: Coverage execution evidence reports Result PASS (python3 -m coverage run -m pytest tests; python3 -m coverage report --show-missing --fail-under=100) and CI focused autonomous coverage now includes tests/test_hourly_product_secret_fingerprint.py and scripts/ci/secret_fingerprint_guard.py at --fail-under=100. Linter/static: ruff contract defined (python3 -m ruff check .); CodeQL fingerprint disposition pinned by tests/test_codeql_fingerprint_suppression_contract.py. TDD/regression: contract-first tests for every changed boundary — endpoint delimiter/lookalike rejection and fallback budget (tests/test_hourly_product_egress_contract.py), secretless maintenance contract (tests/test_hourly_pr_maintenance_contract.py), rolling-hash collision continuation (tests/test_secret_fingerprint_collision_regression.py), fingerprint broker boundary (tests/test_hourly_product_secret_fingerprint.py). Coverage: 100% threshold for scripts/ci including the new guard, per Coverage execution evidence PASS. Docstring coverage: configured repository docstring gates passed or advisory per Coverage execution evidence. DAG: source-backed head-flow flowchart (deterministic gate -> broker[fingerprint] -> agent -> capture -> scan -> upload -> reverify -> publish; secretless maintenance caller -> pinned scheduler @3f65dbee), reflecting the head flow vs base (base gate materialized the secret and capture bound THREADWEAVE_FORBIDDEN_SECRET). PoC/execution: no OPENCODE_EXECUTION_RECEIPT runtime receipts are present in bounded evidence; Harden Runner agent runtime delimiter behavior cannot be independently re-verified, stated as residual risk, not repository fact. DDD/domain: CI/automation domain, no domain-model changes. CDD/context: secrets no longer forwarded across workflow boundaries; egress allowlists exact per job. Similar issues: follow-up to incident #22; historical bot reviews do not corroborate current-head failures. Claim/concept check: exact per-job endpoint membership is pinned by verbatim CodeGraph test source (EXPECTED_ENDPOINTS exact set membership) and Coverage PASS. Standards search: no external standard asserted; endpoint membership unchanged (folding only), so no standards lookup is material. Compatibility/convention: naming review clean — fingerprint/scan subcommands, --output-file/--fingerprint-file/--file flags, forbidden_fingerprint_file env (multi-word snake_case); no single-word or reserved identifiers; no DB/API objects introduced. Breaking-change/backcompat: internal scheduled automation only; no public API changes; scheduler pinned from @main to full SHA is deliberate supply-chain hardening. Performance: timeout raised 45->180 minutes with asserted budget 32100s+1800s<=18060s; scan adds bounded fingerprint work. Developer experience: fail-closed ::error:: + exit 1 on missing NIM key replaces silent skip; maintenance caller reduced to one pinned job. User experience: non-web surface — workflow/CLI/test output only. Visual/DOM: non-web interaction surface (workflow YAML, CLI script, test output) reviewed; no DOM/ARIA surface in this PR. Accessibility/i18n: no UI changes. Supply-chain/license: actions pinned to full SHAs (harden-runner bf7454d0, checkout 3d3c42e5, upload-artifact 043fb46d, scheduler 3f65dbee); no new dependencies; pip_audit/bandit contracts defined. Packaging: unpackaged_source_surfaces empty; scripts/ci exercised under 100% CI coverage. Security/privacy: NVIDIA secret materialized only in the broker step after the deterministic gate, artifacts fingerprint-scanned before upload, caller no longer inherits secrets, top-level permissions narrowed to contents: read, per-job fail-closed egress.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/ci.yml, .github/workflows/hourly-pr-maintenance.yml, .github/workflows/hourly-product-development.yml, .github/workflows/release.yml, scripts/ci/secret_fingerprint_guard.py, and 8 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/ci.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/hourly-product-development.yml","line":38,"hypothesis":"The develop-product-gap job timeout budget cannot cover three sequential NVIDIA model fallback attempts plus orchestration reserve, so the scheduled run times out mid-pipeline (the defect class reported in incident run 31276613811).","attack_or_counterexample":"Worst-case wall time: 3 model candidates * OPENCODE_RUN_TIMEOUT_SECONDS=2100s + 30-minute orchestration reserve = 8100s (135 min) against the changed job timeout.","evidence":"Trusted source trace at .github/workflows/hourly-product-development.yml:38 observed the current-head hunk set timeout-minutes to 180 (changed from 45); the verbatim CodeGraph test source at tests/test_hourly_product_egress_contract.py:238 asserts job_timeout_minutes*60 >= len(candidates)*2100 + 1800 (180*60=10800 >= 8100) and Coverage execution evidence reports Result PASS with supported repository test suites passed, falsifying the timeout-exceeded hypothesis. source-line-sha256=c44ef41458433fff1a39b8ab1f5f850220add86444f3a0751d5e4bd668dfdda6","outcome":"falsified"},{"path":".github/workflows/hourly-pr-maintenance.yml","line":34,"hypothesis":"The hourly PR maintenance caller can still forward repository secrets to the central merge scheduler or grant it broad top-level permissions, so a compromised central workflow could exfiltrate secrets.","attack_or_counterexample":"Retain `secrets: inherit` and top-level write permissions while referencing the reusable scheduler by a floating @main ref.","evidence":"Trusted source trace at .github/workflows/hourly-pr-maintenance.yml:34 observed the current-head hunk confining write permissions to the review-merge job scope (line 34 is the job-scoped statuses: read entry), removing `secrets: inherit`, deleting the review-fix caller, reducing top-level permissions to contents: read, and pinning the reusable scheduler to full SHA 3f65dbee6672b78802e7d71d49c390f3817bb03b; tests/test_hourly_pr_maintenance_contract.py (new in this PR; history 'test(ci): reject explicit scheduler secret mappings') pins the secretless contract and Coverage execution evidence reports Result PASS, falsifying the secret-forwarding hypothesis. source-line-sha256=59c1506d593cce7b728b3deb936c0f45d561dffab8ac3df343180710c9b6d15e","outcome":"falsified"}],"residual_risk":"Harden Runner agent runtime delimiter/port behavior cannot be independently re-verified because no trusted execution receipt (OPENCODE_EXECUTION_RECEIPT) is present in bounded evidence; the fix is pinned by workflow-contract regression tests and CI green only. A scheduled run without NVIDIA_NIM_API_KEY now fails loudly (::error:: + exit 1) instead of silently skipping, a deliberate fail-closed posture change. The transient secret fingerprint file lives in RUNNER_TEMP and is removed after scan; the scan covers exactly the three packaged artifacts."}- Result: APPROVE
- Reason: No confirmed defects across the changed workflow, script, and contract-test surfaces; current-head evidence shows no failed checks, no unresolved threads, Coverage execution evidence PASS, and both adversarial probes falsified.
- Head SHA:
f4c85f701e76c410c6c048c2d6566e8f8868b21b - Workflow run: 31300878686
- Workflow attempt: 1
Superseded automated OpenCode change request from a previous head; exact current head f4c85f7 has a later OpenCode approval.
2 participants
Fleet incident continuation
Follow-up to issue #22 after the first repair reached protected
main.Protected-main scheduled run
31250354848ate9e52e4cae47c1c0164a37ed907719f5e899caf5disproved the earlier closure hypothesis. Although the workflow input visibly listedapi.github.com:443andcafe.github.com:443, the installed Harden Runner agent reduced the literal-newline endpoint input to an unusable GitHub API mapping with port0. The subsequentgh apiinventory call was dropped before the existing open-PR gate could terminate cleanly.The same fleet audit also found that ThreadWeave's Hourly PR Maintenance caller duplicated a mutable central review-fix path, invoked both central workflows at
@main, forwarded all repository/organization secrets withsecrets: inherit, and granted the caller the union of write permissions. The immutable central merge scheduler already performs bounded current-head review dispatch, exact-head check evaluation, one bounded branch update, and policy-compliant direct/auto-merge evaluation for the caller repository.Repairs
Harden Runner runtime serialization
allowed-endpointsscalars from literal|to folded>-;egress-policy: blockand the exact reviewed endpoint sets, including both GitHub API names justified by protected-run evidence;NVIDIA_NIM_API_KEY;NVIDIA_NIM_API_KEYlimited to the actual model-backed path;Hourly PR Maintenance authority
pr-review-fix-scheduler.yml@main;pr-review-merge-scheduler.yml@mainwith immutable pin3f65dbee6672b78802e7d71d49c390f3817bb03b;secrets: inheritdeclarations rather than inventing or forwarding a PAT-like credential;contents: read;actions: write,checks: read,contents: write,id-token: write,pull-requests: write, andstatuses: read;issues: writeauthority and preserve the existing bounded scheduler inputs.No central
.githubfile is changed by this pull request.Test-first evidence
Hourly product-development endpoint input
601583d3b1846c5a019ab38d180e87a40d343069first changed the executable hourly contract to require folded endpoint input while production still used literal blocks.71a6d7e151ec6a9d53f9761ad65d4f22d3951c5fmade the smallest production change: the three scalar styles only. The contract rejects literal-block regression and hostname-suffix injection while preserving exact endpoint membership.Manual release endpoint input
3a560a6d472c2f916d2b9bf5c7e27578e0c81a77added the release delimiter regression before production repair.31257108909failed on Python 3.10, 3.11, 3.12, and 3.13 exactly because all five release endpoint blocks remained literal: the focused autonomous/release suite reported1 failed, 74 passed; actionlint/lock integrity and package verification succeeded, and SAST/Security succeeded.9ba0a086a3f240064e62981de3d8550aa3ae7cf0exactly.507f6fef013d0a193f6626ecd680d081333eab5echanged exactly five scalar markers from|to>-; its commit diff contains no endpoint, permission, action-pin, script, release, or credential change.Hourly PR Maintenance caller
76e512e1917c34b6685c1ee91b2b9c5ee10121dbadded the immutable, secretless single-scheduler contract before production repair.31257969581failed on Python 3.10, 3.11, 3.12, and 3.13 exactly on that new contract:1 failed, 256 passed. The failure showed the live caller still containedpr-review-fix-scheduler.yml@main, mutable merge@main, andsecrets: inherit; focused 100% autonomous/release boundary coverage, actionlint/lock integrity, package verification, SAST, and Security all otherwise succeeded.a012550f6e6ec9941348aa84707bd3c0388eb4ebremoved the duplicate/mutable/secret-forwarding path and aligned the existing workflow contract with the immutable central scheduler.Exact-current-head verification
Current exact head:
095754134dd7f0e6e7c3292807348a3925c5fcf7Exact base:
e9e52e4cae47c1c0164a37ed907719f5e899caf531293099351: success across lock/actionlint, Python 3.10-3.13, package, installed-wheel smoke, andpip check.279 passed; the combined 1,524 statements / 528 branches and the focused 887 statements / 268 branches are all 100%.31293099330: success.31293099337: success.93193671980: success; the prior weak-sensitive-data-hashing alert is absent after replacing the fast SHA confirmation with salted scrypt and bounding collision work.31293098347is still in progress, so the PR is not merge-ready.CHANGES_REQUESTEDsubmissions refer to predecessor3305c08e6372cfc213fdc7055f3e5dfa5d56387d.Merge and operational-closure gates
Do not merge unless this exact head remains current, every required check and security gate passes, all valid exact-head feedback is addressed, branch/ruleset policy permits integration, and a qualifying independent non-author reviewer submits formal
APPROVE.Merge alone is not operational closure. After protected-main integration, issue #22 remains open until:
open_pull_request; andThe release scalar hardening is covered by exact-head workflow contracts but is not claimed as a protected release execution. No
COPILOT_GITHUB_TOKEN, guessed secret, repository-specific PAT, temporary write-capable repair workflow, egress-policy weakening, branch-protection bypass, release, or publication is introduced.Summary by CodeRabbit
워크플로 개선
테스트