fix(opencode): bind coverage artifacts to workflow attempts - #928
fix(opencode): bind coverage artifacts to workflow attempts#928seonghobae wants to merge 10 commits into
Conversation
|
Caution Review failedAn error occurred during the review process. Please try again later. 📝 WalkthroughWalkthroughOpenCode 커버리지 source를 현재 workflow 시도와 불변 아티팩트 ID에 연결했습니다. 소비자는 다운로드 전에 실행 시도와 ID를 검증합니다. 계약 테스트, 품질 게이트, 운영 문서를 추가했습니다. ChangesOpenCode 커버리지 재실행
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟡 Moderate · up to The change tightens coverage-artifact identity and fail-closed workflow behavior, but the current branch does not fully enforce those guarantees in its contract tests, including artifact-path binding, pre-execution guard ordering, conflict-repair protections, and reordered-inventory rejection. This can allow workflow security or correctness regressions to pass validation, so merge is not ready without fixes or explicit owner acceptance. Sequence Diagram(s)sequenceDiagram
participant Dispatch as repository_dispatch
participant Producer as coverage-source-tree
participant Storage as Actions artifact storage
participant Consumer as coverage-evidence
Dispatch->>Producer: 현재 workflow 시도 실행
Producer->>Storage: 시도별 coverage source 업로드
Producer-->>Consumer: artifact-id 및 run_attempt 전달
Consumer->>Consumer: 현재 시도와 ID 검증
Consumer->>Storage: 검증된 artifact-id로 다운로드
Consumer-->>Dispatch: 실패 시 전체 재실행 또는 새 dispatch 안내
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml (1)
41-44: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value
harden-runner모드를block으로 강화하는 것을 고려하십시오.이 단계는
egress-policy: audit를 사용합니다. 이 작업은 해시 고정된 의존성만 설치합니다.block모드와 명시적 허용 엔드포인트 목록을 사용하면 공급망 무결성을 더 강하게 보장합니다.이 제안은 선택 사항입니다. 즉시 수정할 필요는 없습니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml around lines 41 - 44, 선택적으로 Harden runner 단계의 egress-policy를 audit에서 block으로 변경하고, 해시 고정 의존성 설치에 필요한 엔드포인트만 명시적으로 허용하도록 설정하십시오.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml:
- Around line 41-44: 선택적으로 Harden runner 단계의 egress-policy를 audit에서 block으로
변경하고, 해시 고정 의존성 설치에 필요한 엔드포인트만 명시적으로 허용하도록 설정하십시오.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f50d49be-4c63-4c3a-b297-d848e0b50bdd
📒 Files selected for processing (6)
.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml.github/workflows/opencode-review-dispatch.ymlCHANGELOG.mddocs/doctoring/opencode-coverage-artifact-reruns.mdscripts/ci/test_strix_quick_gate.shtests/test_opencode_coverage_artifact_rerun_contract.py
|
@opencode-agent review Evaluate exact current head |
|
@coderabbitai review Review exact current head |
Rate Limit Exceeded
|
|
Exact-current-head review request for Review the bounded six-file attempt-scoped artifact repair: immutable artifact ID, positive producer workflow-attempt identity before download, no search or stale-attempt fallback, exact-head/source/archive validation, one-day retention, credential-free Keep this exact head unchanged. Do not update the branch, synthesize author approval, search for an older artifact, widen credentials, merge, release, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact current head |
Rate Limit Exceeded
|
|
Exact-current-head automated and independent review requested for Fresh evidence: the focused artifact-rerun quality workflow plus all nine generic exact-head workflows are terminal-success, no inline thread exists, and the only CodeRabbit note is an explicitly optional egress-hardening suggestion rather than a current blocker. Review the immutable artifact-ID and positive producer-attempt binding, credential-free Submit an exact-head verdict without updating the branch, extending retention to hide identity loss, enabling stale-artifact fallback, synthesizing author approval, or bypassing protection. @coderabbitai review |
Rate Limit Exceeded
|
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 928 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811
# rebase path only: git push --force-with-lease origin HEAD:fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: opencode-coverage-artifact-reruns.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: opencode-coverage-artifact-reruns.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Merge Conflict Guidance
gh pr checkout 928 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811
# rebase path only: git push --force-with-lease origin HEAD:fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811 |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: APPROVE - affirmative evidence from inlined current-head changed-file hunks for .github/workflows/opencode-review-dispatch.yml and .github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml, Coverage execution evidence PASS, no failed GitHub Checks, no unresolved review threads. Verification posture: Coverage execution evidence records supported repository test suites passed; no OPENCODE_EXECUTION_RECEIPT lines were present for repository_dispatch runtime behavior, so runtime claims rest on source traces and static contract tests (source limitation). Linter/static: no failed lint checks in evidence; the new quality workflow adds compileall over scripts and tests. TDD/regression: new 187-line contract test tests/test_opencode_coverage_artifact_rerun_contract.py plus tests/test_materialize_base_python_requirements.py additions, wired into the new quality CI and recorded PASS. Coverage: supported repository test suites passed per Coverage execution evidence (PASS decision). Docstring coverage: Coverage execution evidence - configured repository docstring gates passed or advisory; quality workflow runs interrogate scripts/ci. DAG: base-to-head flowchart of coverage-source-tree upload -> attempt identity gate -> artifact-ids download -> tar validation (see review body); reflects the changed head flow. PoC/execution: no trusted execution receipts in evidence; static source-trace analysis only for GitHub Actions runtime behavior. DDD/domain: CI control-plane infrastructure change; no domain model surface touched. CDD/context: control-plane workflow context; no application contexts affected. Similar issues: extends prior artifact-binding hardening (PR #687, dependency bump #596) with attempt scoping. Claim/concept check: PR claim bind coverage artifacts to workflow attempts verified against the attempt-scoped artifact name, producer-attested run_attempt output, and fail-closed identity gate in the diff. Standards search: SLSA attempt-scoped artifact identity cited in CHANGELOG/ARCHITECTURE docs; no external lookup possible in this sandbox (source limitation). Compatibility/convention: new identifiers coverage_source_artifact_id, coverage_source_run_attempt, artifact_id, exact-head-contract are multi-word and idiomatic; no reserved-word risk. Breaking-change/backcompat: artifact name changed from opencode-coverage-source to attempt-scoped and download switched from name to artifact-ids; uploader and downloader updated in the same PR and no external consumers appear in CodeGraph evidence. Implementation completeness: all new steps (attempt validation, output plumbing, identity gate, unified fail-closed report) are fully implemented; no placeholders. Performance: CI-only; concurrency cancel-in-progress prevents redundant runs. Developer experience: actionable fail-closed guidance (full rerun or fresh repository dispatch) plus new operator doctoring doc. User experience: operator/CI output surface reviewed - ::error:: messages name the exact remediation. Visual/DOM: non-web change; no DOM surface; CLI/workflow/docs interaction surface reviewed instead. Accessibility/i18n: non-web; no i18n surface. Supply-chain/license: third-party actions SHA-pinned with version comments, hash-locked pip install (--require-hashes), no new dependencies. Packaging: python contract via pyproject.toml; no unpackaged source surfaces in evidence; compileall gate added. Security/privacy: least-privilege contents:read, egress-policy audit, retained tar-member validation before extraction, fail-closed identity checks, no secrets or credential changes.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml, .github/workflows/opencode-review-dispatch.yml, ARCHITECTURE.md, CHANGELOG.md, CLAUDE.md, and 4 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/opencode-review-dispatch.yml","line":225,"hypothesis":"A failed-jobs-only rerun (attempt N+1) silently reuses attempt N coverage-source evidence because the old fixed artifact name opencode-coverage-source allowed download regardless of attempt.","attack_or_counterexample":"Rerun attempt 2 where coverage-source-tree was only run in attempt 1; producer outputs still carry run_attempt=1 while coverage-evidence runs with github.run_attempt=2.","evidence":"Trusted workflow diff trace at .github/workflows/opencode-review-dispatch.yml:225 observed the producer publish attempt-scoped outputs (coverage_source_artifact_id, coverage_source_run_attempt) and the new identity step reject any run_attempt mismatch with exit 1 while gating the artifact-ids download on identity outcome success, so attempt 2 cannot consume attempt 1 evidence and the unified report step fails closed with full-rerun guidance; the 187-line contract test plus Coverage execution evidence PASS corroborate the fail-closed binding; source-line-sha256=ea24b3e44390319c3226b0385605b1d18cde39825308eec13d28c016b7a7e2c3","outcome":"falsified"},{"path":"tests/test_opencode_coverage_artifact_rerun_contract.py","line":187,"hypothesis":"Malformed or attacker-influenced identity values (non-positive run_attempt, non-numeric or multi-ID artifact_id) bypass validation and reach actions/download-artifact artifact-ids, causing wrong-artifact download or shell injection.","attack_or_counterexample":"CURRENT_RUN_ATTEMPT=1;echo pwned and COVERAGE_SOURCE_ARTIFACT_ID=1,2 injected through job outputs.","evidence":"Trusted source trace: the identity step applies ^[1-9][0-9]*$ regex gates to both CURRENT_RUN_ATTEMPT and COVERAGE_SOURCE_ARTIFACT_ID and exits 1 before writing artifact_id to GITHUB_OUTPUT, and the download step is gated on identity outcome success, so only one validated positive integer can reach artifact-ids; the contract test at tests/test_opencode_coverage_artifact_rerun_contract.py:187 pins the attempt-scoped download contract and Coverage execution evidence records the supported suite as PASS; source-line-sha256=8f97b452b8f232dfda9852c7cb2137eb169f4757fe716986fa8dae831da7658a","outcome":"falsified"}],"residual_risk":"No trusted runtime receipts exist for the repository_dispatch download-by-ID flow, so download-artifact v8 single-ID path placement inside the download directory is unverified at runtime (the prepare step expects opencode-coverage-source.tar at the download path root). The new quality workflow coverage step omits the repo contract flag --fail-under=100: if pyproject.toml does not set fail_under, that step cannot actually fail on incomplete coverage; confirm pyproject fail_under or add the flag. Docstring/interrogate thresholds are advisory per Coverage execution evidence. ARCHITECTURE.md line 4 contains the nonstandard word naruon that may be a typo (or an intentional product name)."}- Result: APPROVE
- Reason: Attempt-scoped coverage artifact binding is coherent, fail-closed, test-backed, and green (coverage PASS, no failed checks, no unresolved threads); no blocking findings.
- Head SHA:
ed86e9e6dc58c3531841a5d8ce6fde20f96ce987 - Workflow run: 31672305810
- Workflow attempt: 1
Pull request was converted to draft
|
Returned to Draft because the exact current tree contradicts the body’s six-file bounded-closure claim. The valid product slice is the attempt-scoped coverage artifact contract: immutable artifact ID, producer workflow-attempt identity, positive pre-download validation, credential-free Rebuild from protected |
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='17327a23b75f00523c6ad409d8abebbed3a48397'
expected_main='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== checked-out commit =='
git rev-parse HEAD
git status --short
printf '%s\n' '== requested commit objects =='
git cat-file -t "$expected_head"
git cat-file -t "$expected_main"
printf '%s\n' '== ancestor and merge-base checks =='
git merge-base --is-ancestor "$expected_main" "$expected_head"; printf 'requested-main-is-ancestor=%s\n' "$?"
git merge-base "$expected_main" "$expected_head"
printf '%s\n' '== changed files against requested main =='
git diff --name-status "$expected_main" "$expected_head"
printf '%s\n' '== exact diff statistics =='
git diff --stat "$expected_main" "$expected_head"
printf '%s\n' '== relevant file outlines =='
for file in \
.github/workflows/opencode-review-dispatch.yml \
.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml \
tests/test_opencode_coverage_artifact_rerun_contract.py \
scripts/ci/test_strix_quick_gate.sh \
CHANGELOG.md \
docs/doctoring/opencode-coverage-artifact-reruns.md
do
if test -f "$file"; then
printf '\n-- %s --\n' "$file"
case "$file" in
*.yml|*.yaml) ast-grep outline "$file" --lang yaml --items all || true ;;
*.py) ast-grep outline "$file" --lang python --items all || true ;;
*.sh) ast-grep outline "$file" --lang bash --items all || true ;;
*) sed -n '1,24p' "$file" ;;
esac
fi
done
printf '%s\n' '== exact-head GitHub PR and check state =='
gh pr view 928 --repo ContextualWisdomLab/.github \
--json number,state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus,statusCheckRollup \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeable,mergeStateStatus,checks:[.statusCheckRollup[]|{name,conclusion,status,headSha}]}'Length of output: 16572 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
head='17327a23b75f00523c6ad409d8abebbed3a48397'
printf '%s\n' '== exact workflow diff =='
git diff --unified=80 "$base" "$head" -- .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== contract test implementations =='
sed -n '1,230p' tests/test_opencode_coverage_artifact_rerun_contract.py
printf '%s\n' '== quality-workflow diff =='
git diff --unified=20 "$base" "$head" -- .github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml
printf '%s\n' '== artifact and attempt operations in changed workflow =='
rg -n -C 4 --glob '.github/workflows/opencode-review-dispatch.yml' \
'(upload-artifact|download-artifact|artifact-id|run_attempt|coverage_source_artifact_id|coverage_source_run_attempt|permissions:|actions:\s*read|gh\s+api|/artifacts|artifact.*(list|search)|find.*artifact)' \
.github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== temporary writers and stale-fallback indicators in exact diff =='
git diff --unified=3 "$base" "$head" -- \
| rg -n -i -C 2 \
'(temporary|repair|artifact.*(list|search)|list.*artifact|actions/download-artifact|github\.run_attempt|coverage_source_artifact_id|coverage_source_run_attempt|git\s+(push|commit)|gh\s+(api|workflow|run))' \
|| true
printf '%s\n' '== additional out-of-scope exact diff files =='
for file in ARCHITECTURE.md CLAUDE.md tests/test_materialize_base_python_requirements.py; do
printf '\n-- %s --\n' "$file"
git diff --unified=10 "$base" "$head" -- "$file"
doneLength of output: 88719
The artifact handoff implementation passes the requested static semantic review.
The exact head does not satisfy the stated six-file bounded scope. It changes nine files. The additional files are The current checks do not support acceptance. GitHub reports queued, in-progress, cancelled, and skipped checks. GitHub reports No source, workflow, protection, or merge state was changed.
|
|
Exact-current-head read-only review request for A non-destructive forward commit restored the exact six-file previously bounded artifact-attempt tree; GitHub compare reports zero changed files from @opencode-agent review |
Rate Limit Exceeded
|
|
Resolved the current-main merge conflict with a normal merge commit and hardened both ordinary and conflict repair paths: conflict allowlists now receive a SHA-256 sidecar, and contract tests cover exact producer/verifier paths, reordered inventories, guard-before-execution, and symmetric scope ordering. Exact head |
|
Current head 87506ec: added the missing GitHubClient initializer docstring that caused the exact-head 99.9% repository docstring gate, preserving runtime behavior. Local proof: focused contract tests 29 passed, Ruff passed, interrogate scripts/ci 100%; full Strix contract self-test remains running. Please evaluate this exact head. |
|
Current head dd7f7a4: added a filterable Strix harness case and direct normalization regression for Vertex custom-model resource paths (projects/.../locations/.../models/...). Local shell syntax checks pass; full self-test is being revalidated on this exact head. Earlier 29 focused contracts, Ruff, and 100% docstring coverage remain green. |
…t-current-main-20260811
|
Reconciled the latest main without force-pushing: GitHub update-branch created a normal merge update after the rebase path reported a CHANGELOG-only conflict. The conflict was resolved by retaining both the coverage-artifact attempt contract and existing changelog entries. Fresh local proof before the ordinary merge update: 1239 passed, 16 subtests passed, 100% statements/branches; 68 targeted artifact/OpenCode contract tests passed; actionlint passed for the new artifact workflow; bash -n passed for the changed Strix harness. Current exact head for Checks: 9315e4a. |
|
Current-head validation for e096b68: fixed the shared Strix gate to block only CRITICAL/HIGH/MEDIUM severity, while Low/INFO and provider infrastructure output without medium-or-higher evidence remain neutral and available as artifacts. Added the focused regression contract. Passed: 25 NVIDIA NIM/autofix contract tests, actionlint for the changed Strix/OpenCode workflows, bash -n for the Strix harness, and git diff --check. Please review this exact head; merge remains gated on an independent non-author approval and terminal protected checks. |
|
@opencode-agent Please review the current PR head e096b68 on the exact branch. Re-check the Strix threshold/scope gate, coverage-artifact workflow changes, current mergeability, and required checks. Do not approve a stale head. |
|
Current-head failure triage for central run 32405745972: the failing Hourly cadence, immutable source, NIM credential, and conflict scope / exact-head-path-policy wrapper is executing the shared Strix fallback contract tests, not the PR's product files. The concrete failures are stale assertions in tests/test_strix_nvidia_nim_not_found_fallback.py that do not accept the current vulnerability-count signal. The root-cause repair is central PR #1177 at exact head a6ab307, which narrows the retry classifier and updates those assertions. No unrelated source patch is warranted on this PR; regenerate this PR's exact-head checks after #1177 is normally merged. |
|
Current-head repair is pushed at . The shared Strix vulnerability contract now keeps Critical/High/Medium evidence fail-closed and treats only non-assessable/info-only provider output as neutral. Focused regression tests and shell syntax checks passed. @opencode-agent review this exact HEAD; do not transfer predecessor approval or merge. |
|
Current-head repair is pushed at SHA b4212f5. The shared Strix vulnerability contract keeps Critical/High/Medium evidence fail-closed and treats only non-assessable/info-only provider output as neutral. Focused regression tests and shell syntax checks passed. @opencode-agent review this exact HEAD; do not transfer predecessor approval or merge. |
…t-current-main-20260811
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811cannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/opencode-attempt-scoped-coverage-artifact-current-main-20260811, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 928 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811
# rebase path only: git push --force-with-lease origin HEAD:fix/opencode-attempt-scoped-coverage-artifact-current-main-20260811- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: opencode-coverage-artifact-reruns.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
33934d0ef2b98ba2e6d9abf6887e22c21680519a - Workflow run: 32444460084
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (4 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: opencode-coverage-artifact-reruns.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
|
Resolved the exact merge conflict against main in CHANGELOG.md by preserving both the artifact-quality and scheduler credential fixes. The merge-result local tree passed the required-workflow queue contract tests (52 passed) and git diff --check. The push invalidated predecessor checks/reviews; current-head hosted checks and an independent approval are required. |
…t-current-main-20260811
opencode-agent
Bot
added
area: ci-cd
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 similar comment
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
opencode-agent
Bot
added
priority: critical
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
actions: readconsumer boundary.Lineage and exact identities
This clean current-main successor supersedes #812, whose donor head diverged from protected
mainand contained a historically truncated central workflow. The successor was rebuilt from independently resolved protectedmain6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba; no checks, reviews, approvals, or generated merge evidence from the donor transfer.5cf988c7aca0541fa7a6561c55667a52caf306ec.6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.During connector publication, a size-capped local read initially truncated the central workflow in commit
308d2b8a79e1e5ba5531d4a776135fe616c76974. That defect was detected before external consumption and repaired from GitHub's complete protected-main blob in44e3ecc66312e2c232b8f415322d09d84983aa1a.After the previously bounded head
498867cf05079120aa89c05fe1d13b65b26084a4, unrelated architecture and trusted-lock-test drift entered this branch. A non-destructive forward commit now points to the exact previously bounded tree. GitHub compare reports zero changed files between498867cf...and the current head. No force-push, rebase, history rewrite, or predecessor evidence transfer was used.The final comparison is bounded to exactly six permanent files:
.github/workflows/opencode-coverage-artifact-rerun-quality-ci.yml;.github/workflows/opencode-review-dispatch.yml;CHANGELOG.md;docs/doctoring/opencode-coverage-artifact-reruns.md;scripts/ci/test_strix_quick_gate.sh; andtests/test_opencode_coverage_artifact_rerun_contract.py.Every predecessor check, review, and approval is historical only; current-head evidence must regenerate.
Test-first and product contract
mainbecause immutable artifact-ID and producer-attempt binding are absent.Verification posture
The previously bounded tree completed its focused contract, full repository suite, 100% owned production statement/branch coverage, public documentation gate, compilation, Strix, security, SAST, dependency, and supply-chain checks with zero unresolved thread. Those results prove the prior head only.
The current head must regenerate every applicable exact-head quality, security, supply-chain, and semantic-review result. Pending, queued, skipped, cancelled, absent, stale, predecessor-head, local-only, author-only, status-only, synthetic, or model-only evidence is not acceptance.
Acceptance
Merge or auto-merge only after the unchanged current head has terminal-success required gates, zero valid unresolved findings, a qualifying current-head semantic verdict, the independent non-author formal approval required by live rules, a compatible live base, and ordinary expected-head merge authority. Closing #811 additionally requires protected-main operational rerun evidence; source-branch success alone is insufficient. No administrative bypass, self-approval, synthetic approval, or protection weakening is requested.
Supersedes #812.
Summary by CodeRabbit
품질 개선
문서화
테스트