feat(operations): run default-branch Maintainer App preflight - #62
Conversation
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (18)
📝 WalkthroughWalkthroughMaintainer App readiness 워크플로와 상업적 준비성 증거 정규화기가 추가되었습니다. 워크플로는 App 토큰, 감사, 드라이런, 증거 업로드를 실패-폐쇄 방식으로 처리합니다. CI 동시성, 액션 SHA 고정, 커버리지 정책도 강화되었습니다. ChangesReadiness hardening
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant GitHubApps
participant ReadinessChecks
participant EvidenceNormalizer
GitHubActions->>GitHubApps: Maintainer 및 Reviewer 설치 토큰 생성
GitHubActions->>ReadinessChecks: 거버넌스와 readiness 검사 실행
ReadinessChecks->>EvidenceNormalizer: 상업적 준비성 보고서 전달
EvidenceNormalizer-->>GitHubActions: 정규화된 증거와 실패 상태 반환
GitHubActions->>GitHubActions: 모든 사전 활성화 게이트 검증
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
|
@coderabbitai review Please run a full review against the exact current head |
|
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 33 minutes. |
|
@coderabbitai review Please perform a full review against the exact current head |
|
I will use evidence from this exact head only. I will not reuse evidence from ✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 32 minutes. |
|
@coderabbitai review Please run a full review against the exact current head |
|
I will evaluate all changed files. I will assess the specified security boundaries, workflow controls, and 100% production coverage gate. I will use evidence from this exact head only. ✅ Action performedFull review finished. |
|
@opencode-agent Please independently review exact current head |
|
@cwl-noema-review Please independently review exact current head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
scripts/normalize-commercial-readiness-evidence.mjs (1)
93-100: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win
parseJsonPrimitive의 전체 나머지 문자열 복사를 제거하십시오.
text.slice(state.index)는 원시 토큰마다 남은 문자열 전체를 복사합니다. 1 MiB 문서가 숫자 토큰 수십만 개로 구성되면 스캔 비용이 입력 길이에 대해 제곱으로 증가합니다. sticky 정규식과lastIndex를 사용하면 복사가 사라집니다.♻️ 제안 수정
-const primitivePattern = /^(?:-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/; +const primitivePattern = /(?:-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/y;function parseJsonPrimitive(text, state) { - const match = primitivePattern.exec(text.slice(state.index)); - if (!match) { + primitivePattern.lastIndex = state.index; + const match = primitivePattern.exec(text); + if (!match) { throw new SyntaxError(`Unexpected JSON token at character ${state.index}.`); } state.index += match[0].length; return false; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/normalize-commercial-readiness-evidence.mjs` around lines 93 - 100, Update the parseJsonPrimitive function to eliminate the quadratic complexity caused by text.slice. Convert primitivePattern to use the sticky regex flag ('y') so it anchors matches to a specific position, then set primitivePattern.lastIndex to state.index before executing the match operation, eliminating the text.slice call that copies the remaining string for each primitive token.test/maintainer-app-readiness-workflow-hardening.test.ts (1)
90-92: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win정규화기 상수는 소스 텍스트 대신 모듈 import로 단정하십시오.
이 세 단정은
scripts/normalize-commercial-readiness-evidence.mjs의 소스 문자열을 그대로 비교합니다. 공백, 숫자 구분자, 따옴표 스타일만 바뀌어도 동작 변화 없이 테스트가 실패합니다.MAX_REPORT_BYTES는 이미 export되어 있으므로 값으로 단정할 수 있습니다.♻️ 제안 수정
- expect(normalizer).toContain("export const MAX_REPORT_BYTES = 1_048_576;"); - expect(normalizer).toContain('const EXPECTED_REPOSITORY = "ContextualWisdomLab/noema";'); - expect(normalizer).toContain('code: "dry_run_report_invalid"'); + expect(MAX_REPORT_BYTES).toBe(1_048_576); + const replaced = normalizeCommercialReadinessEvidence(Buffer.from("{")); + expect(replaced.valid).toBe(false); + expect(replaced.report.repository).toBe("ContextualWisdomLab/noema"); + expect(replaced.report.results[0].reasons[0].code).toBe("dry_run_report_invalid");import { readFileSync } from "node:fs"; import { describe, expect, it } from "vitest"; +import { + MAX_REPORT_BYTES, + normalizeCommercialReadinessEvidence, +} from "../scripts/normalize-commercial-readiness-evidence.mjs";🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/maintainer-app-readiness-workflow-hardening.test.ts` around lines 90 - 92, The test assertions are checking for exact source code strings from the normalize script, which makes the test brittle to formatting changes that don't affect behavior. Since MAX_REPORT_BYTES is already exported from the module, refactor the three expect assertions to import the actual exported constant values and verify the values directly rather than searching for source text patterns. This preserves the verification intent while making the test resilient to code formatting, whitespace, and quote style changes..github/workflows/maintainer-app-readiness.yml (1)
114-117: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win실패 보고서의
repository값을 정규화기의 기대값과 동일한 상수로 고정하십시오.실패 보고서는
process.env.GITHUB_REPOSITORY를 사용합니다.scripts/normalize-commercial-readiness-evidence.mjs의main은 하드코딩된EXPECTED_REPOSITORY만 비교합니다(529행). 두 값이 다르면 정규화기가 보고서를 폐기하고maintainer_token_unavailable또는commercial_loop_failed이유 코드를 일반dry_run_report_invalid로 대체합니다. 진단 구분이 사라집니다. 현재 이 리포지터리에서는 두 값이 같으므로 동작하지만, 리포지터리 이름 변경이나 fork 실행에서 계약이 깨집니다.또한
reasonCode지역 변수와 호출자의 동일 이름 변수가 중복됩니다. 호출자에서 리터럴을 직접 전달하면 중복이 사라집니다.♻️ 제안 수정
- repository: process.env.GITHUB_REPOSITORY || "ContextualWisdomLab/noema", + repository: "ContextualWisdomLab/noema",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/maintainer-app-readiness.yml around lines 114 - 117, The repository field in the report object uses process.env.GITHUB_REPOSITORY with a fallback, but the normalizer script in scripts/normalize-commercial-readiness-evidence.mjs has a hardcoded EXPECTED_REPOSITORY constant at line 529 that must match exactly. When these values diverge due to repository rename or fork execution, the normalizer discards valid reports and loses diagnostic reason codes. Fix by replacing the process.env.GITHUB_REPOSITORY expression with the same hardcoded constant string that the normalizer expects. Additionally, remove the reasonCode local variable and pass the reason code literal directly to the caller to eliminate variable name duplication.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/doctoring/commercial-readiness-evidence-utf8-boundary.md`:
- Line 17: Update the verification-contract sentence in the UTF-8 boundary
evidence document to match the actual companion test: the valid Korean and
punctuation text is placed in the allowlist-dropped `ignored` member, and the
normalized output must not preserve it. Remove the conflicting claim that the
text is in an allowlisted reason detail and requires exact preservation.
---
Nitpick comments:
In @.github/workflows/maintainer-app-readiness.yml:
- Around line 114-117: The repository field in the report object uses
process.env.GITHUB_REPOSITORY with a fallback, but the normalizer script in
scripts/normalize-commercial-readiness-evidence.mjs has a hardcoded
EXPECTED_REPOSITORY constant at line 529 that must match exactly. When these
values diverge due to repository rename or fork execution, the normalizer
discards valid reports and loses diagnostic reason codes. Fix by replacing the
process.env.GITHUB_REPOSITORY expression with the same hardcoded constant string
that the normalizer expects. Additionally, remove the reasonCode local variable
and pass the reason code literal directly to the caller to eliminate variable
name duplication.
In `@scripts/normalize-commercial-readiness-evidence.mjs`:
- Around line 93-100: Update the parseJsonPrimitive function to eliminate the
quadratic complexity caused by text.slice. Convert primitivePattern to use the
sticky regex flag ('y') so it anchors matches to a specific position, then set
primitivePattern.lastIndex to state.index before executing the match operation,
eliminating the text.slice call that copies the remaining string for each
primitive token.
In `@test/maintainer-app-readiness-workflow-hardening.test.ts`:
- Around line 90-92: The test assertions are checking for exact source code
strings from the normalize script, which makes the test brittle to formatting
changes that don't affect behavior. Since MAX_REPORT_BYTES is already exported
from the module, refactor the three expect assertions to import the actual
exported constant values and verify the values directly rather than searching
for source text patterns. This preserves the verification intent while making
the test resilient to code formatting, whitespace, and quote style changes.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f1570d2c-4dad-474a-a9ed-3df95e5fb0bf
📒 Files selected for processing (16)
.github/workflows/ci.yml.github/workflows/maintainer-app-readiness.yml.github/workflows/reviewer-ci.ymlCHANGELOG.mddocs/doctoring/commercial-readiness-evidence-utf8-boundary.mddocs/maintainer-app-readiness-audit.mdpackage.jsonscripts/normalize-commercial-readiness-evidence.mjstest/commercial-readiness-evidence.test.tstest/commercial-readiness-json-duplicates.test.tstest/commercial-readiness-utf8.test.tstest/maintainer-app-readiness-workflow-hardening.test.tstest/maintainer-app-readiness-workflow.test.tstest/production-coverage-policy.test.tstest/workflow-concurrency-policy.test.tsvitest.config.ts
|
@opencode-agent Please independently review exact current head |
|
@cwl-noema-review Please independently review exact current head |
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='6decdc94d5e4b8421da12173dd770b7c8a987b7d'
base='157d51cd99aa0cc39cb898308000e082f7871ab6'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Target commit =='
git show -s --format='%H%n%P%n%s' "$target"
printf '%s\n' '== Changed files and status =='
git diff --name-status "$base" "$target"
printf '%s\n' '== Changed-line summary =='
git diff --stat "$base" "$target"
printf '%s\n' '== Exact range diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$target"
printf '%s\n' '== Candidate source outlines =='
git diff --name-only "$base" "$target" | while IFS= read -r f; do
case "$f" in
*.js|*.mjs|*.cjs|*.ts|*.tsx)
printf '\n--- %s ---\n' "$f"
ast-grep outline "$f" --items all --view compact || true
;;
esac
doneLength of output: 28335 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='6decdc94d5e4b8421da12173dd770b7c8a987b7d'
base='157d51cd99aa0cc39cb898308000e082f7871ab6'
printf '%s\n' '== Ancestry and range verification =='
git merge-base --is-ancestor "$base" "$target" && echo 'base is an ancestor of target'
git diff --name-only "$base...$target"
git diff --name-only "$target^" "$target"
printf '%s\n' '== Normalizer symbol map =='
ast-grep outline scripts/normalize-commercial-readiness-evidence.mjs \
--items all --view expanded
printf '%s\n' '== JSON scanner implementation =='
sed -n '1,260p' scripts/normalize-commercial-readiness-evidence.mjs
printf '%s\n' '== URL-parser symbol locations =='
rg -n -C 8 --glob '*.ts' \
'function isTrustedGithubApiBase|const isTrustedGithubApiBase|function trustedClientIdentifier|const trustedClientIdentifier' \
src test
printf '%s\n' '== Source module maps =='
fd -t f -e ts . src | while IFS= read -r f; do
if rg -q 'isTrustedGithubApiBase|trustedClientIdentifier' "$f"; then
printf '\n--- %s ---\n' "$f"
ast-grep outline "$f" --items all --view expanded
fi
done
printf '%s\n' '== Source implementations and workflow header =='
rg -n -C 35 --glob '*.ts' \
'isTrustedGithubApiBase|trustedClientIdentifier' src
sed -n '1,240p' .github/workflows/maintainer-app-readiness.yml
printf '%s\n' '== Coverage configuration and policies =='
fd -t f 'vitest.config.ts' 'package.json' test | sort | while IFS= read -r f; do
if [ "$f" = 'vitest.config.ts' ] || [ "$f" = 'package.json' ] || [[ "$f" == *coverage* ]]; then
printf '\n--- %s ---\n' "$f"
sed -n '1,240p' "$f"
fi
doneLength of output: 38755 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Evidence normalization and filesystem boundary =='
sed -n '240,575p' scripts/normalize-commercial-readiness-evidence.mjs
printf '%s\n' '== Changed tests with line numbers =='
for f in \
test/commercial-readiness-json-scan-performance.test.ts \
test/maintainer-app-readiness-workflow-hardening.test.ts \
test/url-parser-defensive-branches.test.ts
do
printf '\n--- %s ---\n' "$f"
nl -ba "$f"
done
printf '%s\n' '== Exact changed production lines with line numbers =='
for f in \
.github/workflows/maintainer-app-readiness.yml \
scripts/normalize-commercial-readiness-evidence.mjs
do
printf '\n--- %s ---\n' "$f"
git diff --unified=12 157d51cd99aa0cc39cb898308000e082f7871ab6 \
6decdc94d5e4b8421da12173dd770b7c8a987b7d -- "$f"
done
printf '%s\n' '== Package and Vitest configuration =='
for f in package.json vitest.config.ts; do
printf '\n--- %s ---\n' "$f"
nl -ba "$f"
done
printf '%s\n' '== Coverage policy test =='
fd -t f 'production-coverage-policy.test.ts' . -x sh -c '
for f do
printf "\n--- %s ---\n" "$f"
nl -ba "$f"
done
' sh {} \;Length of output: 11117 🏁 Script executed: #!/bin/bash
set -euo pipefail
numbered() {
awk '{ printf "%6d %s\n", NR, $0 }' "$1"
}
printf '%s\n' '== Worktree and exact current commit =='
git rev-parse HEAD
git status --short
printf '%s\n' '== Changed tests with line numbers =='
for f in \
test/commercial-readiness-json-scan-performance.test.ts \
test/maintainer-app-readiness-workflow-hardening.test.ts \
test/url-parser-defensive-branches.test.ts
do
printf '\n--- %s ---\n' "$f"
numbered "$f"
done
printf '%s\n' '== Production changes with current line numbers =='
for range in '100,145' '30,60'; do
:
done
printf '\n--- .github/workflows/maintainer-app-readiness.yml ---\n'
awk 'NR >= 95 && NR <= 150 { printf "%6d %s\n", NR, $0 }' .github/workflows/maintainer-app-readiness.yml
printf '\n--- scripts/normalize-commercial-readiness-evidence.mjs ---\n'
awk 'NR >= 25 && NR <= 110 { printf "%6d %s\n", NR, $0 }' scripts/normalize-commercial-readiness-evidence.mjs
printf '%s\n' '== Package and Vitest configuration =='
for f in package.json vitest.config.ts; do
printf '\n--- %s ---\n' "$f"
numbered "$f"
done
printf '%s\n' '== Production coverage policy test =='
fd -t f 'production-coverage-policy.test.ts' . -x awk \
'{ printf "%6d %s\n", NR, $0 }' {}
printf '%s\n' '== References to URL-parser defensive coverage =='
rg -n -C 4 --glob '*.ts' \
'isTrustedGithubApiBase|trustedClientIdentifier|URL parser defensive branches' testLength of output: 28829
I verified that I found no actionable findings in the changed files. The review confirmed these controls:
I did not execute repository tests because the review sandbox prohibits executing repository files. ✅ Action performedReview finished.
|
|
@coderabbitai review Please perform a full substantive review against the exact current head |
|
@opencode-agent Please independently review exact current head |
|
@cwl-noema-review Please independently review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
target='6decdc94d5e4b8421da12173dd770b7c8a987b7d'
printf '%s\n' '== Exact-head verification =='
printf 'HEAD: '
git rev-parse HEAD
printf 'Target: '
git rev-parse "$target"
git show -s --format='Commit: %H%nParents: %P%nSubject: %s' "$target"
printf '%s\n' '== PR merge base and changed files =='
base="$(git merge-base "$target" origin/main 2>/dev/null || git merge-base "$target" main)"
printf 'Base: %s\n' "$base"
git merge-base --is-ancestor "$base" "$target"
git diff --name-status "$base" "$target"
git diff --stat "$base" "$target"
printf '%s\n' '== Source outlines =='
git diff --name-only "$base" "$target" | while IFS= read -r file; do
case "$file" in
*.js|*.mjs|*.cjs|*.ts|*.tsx)
printf '\n--- %s ---\n' "$file"
ast-grep outline "$file" --items all --view compact || true
;;
esac
done
printf '%s\n' '== Full exact-head diff =='
git diff --find-renames --find-copies --unified=55 "$base" "$target"Length of output: 114719 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Workflow-called script locations =='
for name in main-governance-audit.mjs maintainer-app-readiness.mjs hourly-commercial-readiness.mjs; do
fd -t f -a "$name" . -x sh -c '
for file do
printf "%s\n" "$file"
done
' sh {} \;
done
printf '%s\n' '== Script outlines =='
for name in main-governance-audit.mjs maintainer-app-readiness.mjs hourly-commercial-readiness.mjs; do
fd -t f -a "$name" . -x ast-grep outline {} --items all --view expanded \;
done
printf '%s\n' '== Workflow-called script contents =='
for name in main-governance-audit.mjs maintainer-app-readiness.mjs hourly-commercial-readiness.mjs; do
fd -t f -a "$name" . -x sh -c '
for file do
printf "\n--- %s ---\n" "$file"
nl -ba "$file"
done
' sh {} \;
done
printf '%s\n' '== Write-capable calls and dry-run argument handling =='
rg -n -C 6 --glob '*.mjs' \
'(?:--apply|process\.argv|argv|octokit|gh api|fetch\(|POST|PATCH|PUT|DELETE|merge|createPull|updatePull|GITHUB_TOKEN|GH_TOKEN)' \
scripts
printf '%s\n' '== Relevant Worker implementations =='
rg -n -C 35 --glob '*.ts' \
'\b(isTrustedGithubApiBase|trustedClientIdentifier)\b' src
printf '%s\n' '== Workflow static checks =='
python3 - <<'PY'
from pathlib import Path
import re
for path in [Path(".github/workflows/ci.yml"),
Path(".github/workflows/reviewer-ci.yml"),
Path(".github/workflows/maintainer-app-readiness.yml")]:
text = path.read_text()
print(f"\n--- {path} ---")
refs = re.findall(r'^\s*uses:\s*([^\s#]+)', text, flags=re.M)
print("actions:", *refs, sep="\n ")
for ref in refs:
print(f"pinned {ref}: {bool(re.fullmatch(r'[^@]+@[0-9a-f]{40}', ref))}")
PY
printf '%s\n' '== Coverage configuration and package scripts =='
nl -ba package.json
nl -ba vitest.config.tsLength of output: 9603 🏁 Script executed: #!/bin/bash
set -euo pipefail
print_file() {
file="$1"
printf '\n--- %s ---\n' "$file"
awk '{ printf "%6d %s\n", NR, $0 }' "$file"
}
printf '%s\n' '== Workflow-called entrypoints =='
for file in \
scripts/main-governance-audit.mjs \
scripts/maintainer-app-readiness.mjs \
scripts/hourly-commercial-readiness.mjs
do
print_file "$file"
done
printf '%s\n' '== Commercial-loop evaluator write decision boundary =='
fd -t f -a 'commercial-readiness-loop.mjs' scripts -x sh -c '
for file do
printf "\n--- %s ---\n" "$file"
awk "{ printf \"%6d %s\\n\", NR, \$0 }" "$file"
done
' sh {} \;
printf '%s\n' '== Readiness evaluation contract =='
fd -t f -a 'maintainer-app-readiness.mjs' scripts/lib -x sh -c '
for file do
printf "\n--- %s ---\n" "$file"
awk "{ printf \"%6d %s\\n\", NR, \$0 }" "$file"
done
' sh {} \;
printf '%s\n' '== Action pins and coverage policy =='
python3 - <<'PY'
from pathlib import Path
import re
for path in map(Path, [
".github/workflows/ci.yml",
".github/workflows/reviewer-ci.yml",
".github/workflows/maintainer-app-readiness.yml",
]):
text = path.read_text()
refs = re.findall(r'^\s*uses:\s*([^\s#]+)', text, flags=re.M)
print(f"{path}:")
for ref in refs:
print(f" {ref} pinned={bool(re.fullmatch(r'[^@]+@[0-9a-f]{40}', ref))}")
PY
awk '{ printf "%6d %s\n", NR, $0 }' package.json
awk '{ printf "%6d %s\n", NR, $0 }' vitest.config.ts
printf '%s\n' '== Worker defensive functions =='
rg -n -C 30 --glob '*.ts' \
'\b(isTrustedGithubApiBase|trustedClientIdentifier)\b' srcLength of output: 93468 🏁 Script executed: #!/bin/bash
set -euo pipefail
target='6decdc94d5e4b8421da12173dd770b7c8a987b7d'
base='5cc520cce23e9bef090cfbe0a668909e3594ed33'
printf '%s\n' '== Exact-range whitespace check =='
git diff --check "$base" "$target"
printf '%s\n' '== YAML syntax check =='
python3 - <<'PY'
from pathlib import Path
try:
import yaml
except ImportError as error:
print(f"PyYAML unavailable: {error}")
else:
for name in (
".github/workflows/ci.yml",
".github/workflows/reviewer-ci.yml",
".github/workflows/maintainer-app-readiness.yml",
):
value = yaml.safe_load(Path(name).read_text())
print(f"{name}: top-level keys={sorted(map(str, value.keys()))}")
print(f"{name}: jobs={sorted(value.get('jobs', {}).keys())}")
PY
printf '%s\n' '== Production coverage source inventory =='
printf '%s\n' 'Worker sources:'
fd -t f -e ts . src | sort
printf '%s\n' 'Normalizer imports and focused tests:'
rg -n -C 2 --glob '*.ts' \
'normalizeCommercialReadinessEvidence|hasDuplicateJsonObjectKeys|readBoundedReport|writeAtomically|runAsCommand|isBoundedRegularEvidence' \
test
printf '%s\n' '== Changed-file line counts =='
git diff --numstat "$base" "$target"
printf '%s\n' '== Current worktree state =='
git rev-parse HEAD
git status --shortLength of output: 14689
I reviewed the 18-file range from merge base The review confirmed:
✅ Action performedFull review finished. Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 37 minutes. |
|
Merge remains fail-closed on exact head |
1 participant
Summary
maintainer-app-readinessrepository_dispatchpre-activation workflow for the dedicated Maintainer GitHub AppNOEMA_REVIEWER_LOGINto the action-authenticatedapp-slugand positiveinstallation-id, and never expose the Reviewer token to scriptsmaingovernance, effective Maintainer identity/scope/permissions/API probes, disabled activation state, and the existing commercial-readiness loop in no-write mode${RUNNER_TEMP}/noema-maintainer-app-readiness/, outside the checked-out repository tree, and upload only those exact absolute pathsapply=falseschema, canonical UTC, unique decoded object keys, maximum 256-level JSON nesting, allowlisted fields, bounded result/reason data, full SHAs, and fixeddry_run_report_invalidreplacementO_RDONLY | O_NOFOLLOW, descriptor-to-path device/inode/size binding, exact-byte reads, unpredictable private same-filesystem temporary directories, exclusive mode-0600 writes, atomic rename, and rollback cleanupsrc/**/*.tsand the evidence normalizer; add realistic deterministic schema, UTF-8, JSON-grammar, duplicate-key, nesting, security, rollback, command-boundary, workflow-policy, and coverage-policy testsciandreviewer-ciruns in workflow-and-PR-specific concurrency groups, while pinning every external action in those workflows to an immutable full commit SHACHANGELOG.md, including the RFC 8259/WHATWG/Node.js fatal-decoding rationale indocs/doctoring/commercial-readiness-evidence-utf8-boundary.mdDependency and lineage
Prerequisites already merged:
operations:preflightcommand#59 was closed without merge after its review-trigger evidence became unusable. This PR supersedes it without reusing predecessor-PR or stale-head checks, comments, or approvals. The merge decision must be made only against the exact current head shown by GitHub.
Security and operational boundaries
repository_dispatchresolves workflow code only from the default branch; checkout is bound to event-timegithub.sharather than a moving branch lookupGITHUB_TOKENremainscontents: readand is not a write fallbackContextualWisdomLab/noemaExact-head verification required before merge
The exact current head must independently satisfy
ci,reviewer-ci, the central Security Scan, substantive CodeRabbit and organization-required OpenCode/Noema review evidence where repository policy requires them, zero unresolved review threads, branch protection, and every repository gate. Queued, pending, cancelled, stale-head, predecessor-PR, metadata-only, or self-approval evidence is not accepted.Related: #59, #29, #27