Skip to content

ci: schedule naruon hourly review repair - #1143

Open
seonghobae wants to merge 6 commits into
mainfrom
chore/add-naruon-hourly-review-repair
Open

ci: schedule naruon hourly review repair#1143
seonghobae wants to merge 6 commits into
mainfrom
chore/add-naruon-hourly-review-repair

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add the minute-11 naruon hourly caller for the central bounded review-repair scheduler
  • target ContextualWisdomLab/naruon develop with max 50 PRs, one dispatch, and a two-hour same-head retry floor
  • keep read-only workflow permissions, job-scoped OIDC, and explicit scheduler secrets
  • add contract/doctoring coverage and central path filters

Verification

  • python -m pytest -q tests/test_naruon_hourly_review_caller.py tests/test_pr_review_fix_hourly_contract.py tests/test_nonnest2_hourly_review_caller.py (26 passed)
  • actionlint .github/workflows/naruon-hourly-review-repair.yml .github/workflows/hourly-nvidia-nim-review-repair.yml
  • python -m compileall -q tests/test_naruon_hourly_review_caller.py
  • git diff --check

No customer mailbox data or attachment bytes were uploaded.


Open in Devin Review

@coderabbitai

coderabbitai Bot commented Aug 19, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6dc65d19-1577-43ca-a5a8-bd7ec6565433

📥 Commits

Reviewing files that changed from the base of the PR and between 6a79f07 and 9c2842a.

📒 Files selected for processing (6)
  • .github/workflows/hourly-nvidia-nim-review-repair.yml
  • .github/workflows/naruon-hourly-review-repair.yml
  • AGENTS.md
  • docs/doctoring/naruon-hourly-review-caller.md
  • requirements-pip-audit-ci-hashes.txt
  • tests/test_naruon_hourly_review_caller.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae

seonghobae commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Current-head review request for #1143.

HEAD: 3a7a703

The exact HEAD now contains only the naruon hourly repair caller and its path-filtered contract/doctoring: minute 11, protected develop, one bounded dispatch, two-hour same-head retry, explicit review credentials, and no Copilot/NVIDIA secret forwarding. The unrelated agent-mention-router permission change was reverted because that responsibility is covered by #1162. Validate current Checks and active ruleset against this exact HEAD; do not reuse stale review state.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head revalidation for a749dff: 3 Naruon caller contract tests passed; actionlint for both changed workflows, compileall, and diff check passed. Required checks remain queued; no stale approval is being reused.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please review exact current head a749dff.

seonghobae commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please independently review exact current head 88d036d5c135ea8f465e26d7d8fa9f90a489191d only. The rebase follow-up restores pull-requests: write for the router reaction endpoint after an observed HTTP 403. Verify the workflow permission and current protected checks; review-only, no merge, dismissal, bypass, or stale-head reuse.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please review this exact current PR head only: 5f2f1f4. Verify the pull-request comment reaction permission fix and the valid concurrency contract; review-only, no merge, dismissal, bypass, or auto-merge.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head repair evidence for 5f2f1f4fde261b7264efabd59eb77786d87b3a7e:

  • RCA from Review Agent Mention Router run 32251664581: the dispatch POST completed, then the target PR-comment reaction POST failed with HTTP 403 because the local job declared pull-requests: read.
  • Fixed the permission to pull-requests: write, which is required for PR comment reaction/comment mutation.
  • Replaced unsupported concurrency.queue: max with GitHub Actions cancel-in-progress: false; actionlint now passes.
  • Agent-mention test suite: 72 passed; git diff --check passed.

Review-only evidence; no merge bypass, dismissal, or auto-merge.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head evidence for a65b4d8f160cff6fb4315440bb781e7c56338047:

  • The scheduled run 32256873195 failed before jobs started because .github/workflows/github-hourly-review-repair.yml requested the reusable scheduler's id-token: write while the caller granted id-token: none.
  • Fixed the caller with job-scoped contents: read + id-token: write; the reusable workflow contract remains unchanged.
  • python3 -m pytest -q tests/test_github_hourly_conflict_repair.py tests/test_naruon_hourly_review_caller.py: 10 passed.
  • actionlint .github/workflows/github-hourly-review-repair.yml and git diff --check: passed.

@opencode-agent
opencode-agent Bot disabled auto-merge August 19, 2026 13:36
@seonghobae
seonghobae force-pushed the chore/add-naruon-hourly-review-repair branch from a65b4d8 to 0bb567d Compare August 19, 2026 14:08
@seonghobae

seonghobae commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

Exact current head 88d036d5c135ea8f465e26d7d8fa9f90a489191d adds the restored PR-comment reaction permission (pull-requests: write) that was missing after the rebase. Exact-head verification: 14 focused workflow/contract tests passed; git diff --check passed. The official GitHub Actions queue: max syntax is retained; the installed actionlint version reports it as an outdated schema warning. No merge claim until current protected checks and review complete.

Copy link
Copy Markdown
Contributor Author

@opencode-agent Please review exact current head 0bb567d9cf39de9f5240f653987cd84aa72706e2 against live main@bbedc1a51ec1a2421f129955c629b3cd0507a4ec. Verify the minute-11 naruon hourly caller remains read-only, job-scoped OIDC only, uses explicit scheduler secrets without inheritance, targets develop with bounded 50-PR / one-dispatch / two-hour retry behavior, and does not add merge or branch mutation authority. Submit a fresh formal verdict only after applicable exact-head gates are terminal.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review Please independently review exact current head 88d036d5c135ea8f465e26d7d8fa9f90a489191d only. Verify the Naruon hourly caller has job-scoped OIDC permissions, read-only authority, explicit scheduler secrets without inheritance, bounded 50-PR/one-dispatch/two-hour retry behavior, and the restored pull-requests: write permission for local PR-comment reactions. Protected checks remain required; no merge or bypass.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head review evidence for 8f7a736: naruon minute-11 caller, develop target, one bounded dispatch, explicit OIDC/secrets, and path-filtered APA7 doctoring are present. Focused contract/regression tests: 15 passed; new caller and hourly workflow actionlint passed; compileall and diff check passed. The existing agent-mention router still emits the known local actionlint queue-key schema diagnostic; hosted quality remains the authority for that already-present queue contract.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode Please review exact current head 8f7a736 against base main@c47bee591c3d95bd305f2130833ed3a4780d2d1d.

@seonghobae
seonghobae force-pushed the chore/add-naruon-hourly-review-repair branch from a843a57 to c234d61 Compare August 20, 2026 04:19
@seonghobae

Copy link
Copy Markdown
Contributor Author

@opencode-agent Review exact current head c234d61 against main@2cce96f8. Rebased the Naruon minute-11 caller onto current main; it remains a thin read-only reusable-workflow caller for protected develop with explicit scheduler secrets, job-scoped OIDC, max 50 PRs/one dispatch/two-hour retry floor, and no NVIDIA/Copilot token. Verified: 5 focused caller/router tests, actionlint for the affected hourly workflows, compileall, interrogate, and git diff --check passed. The pre-existing agent-mention-router actionlint warning for nonstandard queue: max remains environment/schema-specific and is not claimed fixed.

@seonghobae
seonghobae enabled auto-merge (squash) August 20, 2026 06:56
@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head validation for exact commit 4116730769223fd52e37952b27cccd5d7c848739: the naruon minute-11 caller remains bounded to develop, one dispatch, explicit established secrets, and no COPILOT/NVIDIA fallback. Focused caller/workflow tests pass (3 passed), actionlint and diff checks pass. Please have @opencode-agent review this exact HEAD and verify protected Checks; do not reuse prior-head evidence.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head validation for exact commit 3a7a7039741069d16204d40633d3a1cd754e376: the branch now contains only the naruon hourly caller, central path filters, AGENTS entry, doctoring, and contract test; the reverted router permission experiment is not part of this head. Focused tests pass (3 passed), actionlint and diff checks pass. Please have @opencode-agent review this exact HEAD and verify current protected Checks.

@seonghobae
seonghobae force-pushed the chore/add-naruon-hourly-review-repair branch from 3a7a703 to 361f9eb Compare August 20, 2026 15:23

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Open in Devin Review

@seonghobae

Copy link
Copy Markdown
Contributor Author

Rebased this PR onto current main; exact head is 361f9eb. The previously successful checks were tied to the pre-rebase head and are being revalidated. Please review this exact head only; merge remains gated on independent approval, terminal required Checks, and resolved threads.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@opencode-agent review exact current head 361f9eb only after the rebase. Do not reuse predecessor approvals/findings; verify the naruon hourly caller, immutable source/credential boundaries, and current terminal Checks.

@opencode-agent

opencode-agent Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 361f9eb34f3297a68d7ea1f327f98538aded9199
  • Workflow run: 32408103281
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

  • Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
  • Root cause: Branch chore/add-naruon-hourly-review-repair cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
  • Fix: Merge or rebase the latest main into chore/add-naruon-hourly-review-repair, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
  • Repair commands:
gh pr checkout 1143 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:chore/add-naruon-hourly-review-repair
# rebase path only: git push --force-with-lease origin HEAD:chore/add-naruon-hourly-review-repair
  • Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: AGENTS.md"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: naruon-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["Test: test_naruon_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["targeted test run"]
Loading
  • Result: REQUEST_CHANGES
  • Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
  • Head SHA: 361f9eb34f3297a68d7ea1f327f98538aded9199
  • Workflow run: 32408103281
  • Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: AGENTS.md"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: naruon-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["Test: test_naruon_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["targeted test run"]
Loading

Merge Conflict Guidance

  • Current merge state: DIRTY
  • Base branch: main
  • Head branch: chore/add-naruon-hourly-review-repair
  • Fix direction: merge or rebase origin/main into chore/add-naruon-hourly-review-repair, resolve conflict markers in the changed files, rerun the focused checks, then push the same branch.
  • Repair commands:
gh pr checkout 1143 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:chore/add-naruon-hourly-review-repair
# rebase path only: git push --force-with-lease origin HEAD:chore/add-naruon-hourly-review-repair

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

  • Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
  • Root cause: Branch chore/add-naruon-hourly-review-repair cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
  • Fix: Merge or rebase the latest main into chore/add-naruon-hourly-review-repair, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
  • Repair commands:
gh pr checkout 1143 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:chore/add-naruon-hourly-review-repair
# rebase path only: git push --force-with-lease origin HEAD:chore/add-naruon-hourly-review-repair
  • Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: AGENTS.md"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: naruon-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["Test: test_naruon_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["targeted test run"]
Loading
  • Result: REQUEST_CHANGES
  • Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
  • Head SHA: 361f9eb34f3297a68d7ea1f327f98538aded9199
  • Workflow run: 32408103281
  • Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: AGENTS.md"]
  S2 --> I2["repository behavior"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["required checks"]
  Evidence --> S3["Docs: naruon-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["docs review"]
  Evidence --> S4["Test: test_naruon_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V4["targeted test run"]
Loading

Copy link
Copy Markdown
Contributor Author

Merge-conflict repair pushed normally to current head d26e0cf320d87f7c11292afb894b475d84080451.

  • Merged the current protected main into the PR branch without force-push.
  • Preserved both the NarUon hourly caller documentation and the exact-artifact SBOM documentation.
  • GitHub now reports the PR as mergeable; no unresolved review threads remain.
  • Hosted Checks and a fresh Hourly NVIDIA NIM Review Repair are running/queued for this new head. The predecessor CHANGES_REQUESTED review is historical until the fresh exact-head review completes; no merge is attempted without current approval and terminal protected Checks.

# Conflicts:
#	.github/workflows/hourly-nvidia-nim-review-repair.yml
@seonghobae
seonghobae enabled auto-merge (squash) August 21, 2026 17:12
@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head conflict repair

  • Exact head: c12457db8267887da61ec805302752ee44289841
  • Exact base: main@6a79f075d62b5f8dcfef6145960f1c42c147f273
  • Normal update-branch was blocked by a real workflow-list conflict. The conflict was resolved by retaining both the NarUon and Orgmetra caller, test, and doctoring paths; no unrelated source was discarded.
  • Exact merge-result local verification: 1296 passed, 16 subtests; statement and branch coverage 8127/8127 and 3144/3144 at 100%; actionlint, shell syntax, compileall, and git diff --check passed.
  • GitHub new-head Checks are in progress or queued; no exact-head approval is present. Auto-merge is enabled on the protected normal path.
  • Decision: WAIT_AND_REMEDIATE; no bypass, direct protected push, self-approval, or force push.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review

Fresh exact-head review request for central Naruon hourly caller PR #1143.

  • Exact head: c12457db8267887da61ec805302752ee44289841
  • Exact base: 6a79f075d62b5f8dcfef6145960f1c42c147f273
  • The prior CHANGES_REQUESTED review was bound to predecessor head 361f9eb34f3297a68d7ea1f327f98538aded9199 and its merge-conflict finding was repaired in the current merge commit.
  • Review the complete current diff and bind every finding/verdict to the exact head. Verify both Naruon caller/workflow paths, conflict-scope safety, actionlint, focused/full tests, credential boundaries, and that no predecessor evidence is reused.

@seonghobae
seonghobae dismissed opencode-agent[bot]’s stale review August 21, 2026 17:27

Dismissed as stale predecessor-head conflict evidence; current head c12457d was repaired and revalidated.

@opencode-agent
opencode-agent Bot disabled auto-merge August 21, 2026 17:44
@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head audit update\n\nObserved hosted CI failure on the prior head: pip-audit lock refresh for PYSEC-2026-3721.\nRoot-cause fix: updated the hash-locked pip dependency to pip 26.2.1 with both package hashes.\n\nExact head: 9c2842a\nExact base: 6a79f07\nLocal verification: pip-audit clean and diff checks passed; the lock-only change has no additional local product test delta.\nGitHub mergeability: behind. Required checks and exact-head approval remain pending; decision remains WAIT_AND_REMEDIATE.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

Open in Devin Review

Comment on lines +216 to +218
pip==26.2.1 \
--hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \
--hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Unrelated pip hash bump bundled in

requirements-pip-audit-ci-hashes.txt bumps pip 26.1.2 to 26.2.1, unrelated to scheduling the naruon caller. Confirm the lock was regenerated via the recorded uv pip compile command rather than hand-edited.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

1 participant