fix(ci): identify trusted uv downloader - #1008
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthrough신뢰된 uv 요청에 고정된 Changes신뢰된 uv materialization 변경
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to The change uses a fixed downloader identifier while preserving the existing trust and integrity boundaries. No actionable merge-blocking risk remains beyond completing the normal current-head checks and review. Sequence Diagram(s)sequenceDiagram
participant CI
participant materialize
participant output_directory
participant output_files
CI->>materialize: trusted uv 실행 및 materialize 호출
materialize->>output_directory: 비심볼릭 디렉터리 열기
materialize->>output_files: lock 파일과 manifest 기록
materialize->>output_directory: 디렉터리 교체 여부 검증
materialize-->>CI: 성공 또는 오류 반환
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent @cwl-noema-review Please review exact current head |
|
@cwl-noema-review |
|
@opencode-agent @cwl-noema-review Review only exact current head |
|
@opencode-agent @cwl-noema-review Fresh exact-head retry for protected central prerequisite |
|
Consumer evidence: After this prerequisite reaches protected |
|
@cwl-noema-review |
|
@cwl-noema-review |
|
@cwl-noema-review @opencode-agent Please perform fresh independent review of exact current head |
|
@opencode-agent @cwl-noema-review |
|
@opencode-agent Please review exact head |
|
|
|
@coderabbitai review Please review exact head |
|
@opencode-agent review Review-only exact-head request for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='d14ad6ca0260eabf1373213e76e521b98a57e86b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== checked-out commit =='
git rev-parse HEAD
git status --short
git cat-file -e "${expected_head}^{commit}"
git cat-file -e "${base}^{commit}"
printf '\n== exact commit check ==\n'
test "$(git rev-parse HEAD)" = "$expected_head" && echo 'HEAD matches requested commit' || echo 'HEAD DOES NOT match requested commit'
printf '\n== changed files and diff ==\n'
git diff --name-status "$base" "$expected_head"
git diff --find-renames --find-copies --check "$base" "$expected_head"
git diff --find-renames --find-copies --unified=80 "$base" "$expected_head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
printf '\n== source outlines ==\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
ast-grep outline tests/test_materialize_base_python_requirements.py --items all || true
ast-grep outline tests/test_uv_redirect_boundary.py --items all || true
printf '\n== trusted downloader declarations, calls, and test references ==\n'
rg -n -C 5 -e 'TRUSTED_UV|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|user-agent|sha256|MAX_|platform\.system|platform\.machine|_use_supported_trusted_uv_runner' \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
printf '\n== repository-wide direct references to trusted downloader symbols ==\n'
rg -n -C 3 -e '\bTRUSTED_UV_[A-Z0-9_]+\b|\b_download_trusted_uv\b|\b_install_trusted_uv\b|\btrusted_uv\b' \
-g '*.py' .
printf '\n== PR metadata, current head, checks, and review state ==\n'
gh pr view 1008 --repo ContextualWisdomLab/.github \
--json number,url,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author,reviews,statusCheckRollup \
--jq '{number,url,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:(.author.login),reviews:[.reviews[]|{author:(.author.login),state,commit:(.commit.oid // null)}],checks:[.statusCheckRollup[]|{name,conclusion,status}]}'Length of output: 110503 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='d14ad6ca0260eabf1373213e76e521b98a57e86b'
repo='ContextualWisdomLab/.github'
echo '== complete trusted downloader and installer implementation =='
sed -n '160,320p' scripts/ci/materialize_base_python_requirements.py
echo '== exact trusted-download contract tests =='
sed -n '1,260p' tests/test_trusted_uv_download_contract.py
sed -n '1,180p' tests/test_trusted_uv_portability_and_streaming.py
sed -n '1,120p' tests/conftest.py
echo '== all urlopen call sites and trusted opener invocations =='
rg -n -C 4 '\burllib\.request\.urlopen\s*\(|\b_install_trusted_uv_url_opener\s*\(' -g '*.py' .
echo '== public function call sites that could supply download inputs =='
rg -n -C 3 '\b_download_trusted_uv_archive\s*\(|\b_install_trusted_uv\s*\(' -g '*.py' \
-g '!tests/**' .
echo '== exact-head GitHub check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name,conclusion,status,details_url,started_at,completed_at,app:.app.slug}' \
| jq -s
echo '== required status checks and branch protection =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,required_conversation_resolution,enforce_admins}' \
|| true
echo '== PR mergeability and exact-head reviews =='
gh api "repos/${repo}/pulls/1008" \
--jq '{head_sha:.head.sha,base_sha:.base.sha,mergeable,mergeable_state,merge_commit_sha,review_comments,comments,requested_reviewers:[.requested_reviewers[].login]}'
gh api "repos/${repo}/pulls/1008/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at,body}]'Length of output: 54342
I found no actionable code findings. The downloader uses one literal Astral HTTPS URL. It accepts no caller-controlled URL, header, or destination input. The dedicated opener disables proxies, rejects redirects, and sets only the fixed The existing boundary controls remain in place. They include final-origin validation, bounded streaming, pinned SHA-256 verification, fixed regular-member extraction, executable-size validation, Linux x86_64 gating, and exact The updated installer tests explicitly simulate Linux x86_64. The existing contract tests also cover the literal network sink, rejection of dynamic GitHub reports that the head is mergeable but currently blocked with I did not approve, merge, or modify the branch.
|
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review Please independently review exact head |
|
Exact-current-head read-only review request for This bounded prerequisite addresses the observed trusted-uv HTTP 403 failure without widening the download origin, proxy, redirect, size, checksum, credential, reviewer, or merge boundary. Exact-head deterministic security and supply-chain workflows are terminal-success; auto-merge is armed subject to normal protection. @coderabbitai review Review read-only. Do not update the branch, synthesize author approval, weaken protection, or merge outside the normal protected path. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='d14ad6ca0260eabf1373213e76e521b98a57e86b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== exact revision =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested head exists: '; git cat-file -t "${head}^{commit}"
printf 'requested base exists: '; git cat-file -t "${base}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES=true' || echo 'HEAD_MATCHES=false'
git status --short
echo '== changed files and whitespace check =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --unified=100 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
echo '== source and test structure =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
ast-grep outline tests/test_materialize_base_python_requirements.py --items all
ast-grep outline tests/test_uv_redirect_boundary.py --items all
echo '== trusted downloader implementation =='
rg -n -C 12 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|sha256|MAX_|platform\.system|platform\.machine' \
scripts/ci/materialize_base_python_requirements.py
echo '== related tests and uses =='
rg -n -C 6 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|sha256|MAX_|platform\.system|platform\.machine|_use_supported_trusted_uv_runner' \
tests/test_materialize_base_python_requirements.py tests/test_uv_redirect_boundary.py
rg -n -C 3 \
'\b_download_trusted_uv_archive\s*\(|\b_install_trusted_uv\s*\(|\b_install_trusted_uv_url_opener\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== PR metadata and exact-head checks =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:(.author.login),checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,completed_at}]'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'Length of output: 116283
I found no actionable code findings. The trusted downloader keeps a literal Astral HTTPS URL at the network sink. It accepts no caller-controlled URL, header, or destination. The opener disables proxies, rejects redirects, and sets only the fixed The archive boundary still validates the final HTTPS origin and port. It still enforces bounded streaming, SHA-256 verification, fixed regular-member extraction, and executable-size limits. The installer still rejects non-Linux-x86_64 hosts and verifies the exact The updated installer tests explicitly simulate Linux x86_64. The redirect-boundary test verifies the fixed opener headers and the no-proxy/no-redirect handlers. Merge readiness is blocked. GitHub reports I did not approve, update, merge, or change protection settings. You are interacting with an AI system. |
|
@opencode-agent review current exact head |
|
@cwl-noema-review review current exact head |
|
@cwl-noema-review Review exact head |
|
@coderabbitai review exact current head |
|
@opencode-agent Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='5e73836229250e247433e3f3dd372f4881fe2edf'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact revision =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested HEAD: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${expected_base}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES_REQUESTED=true' || echo 'HEAD_MATCHES_REQUESTED=false'
git status --short
echo '== Pull request metadata =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:.author.login}'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'resolved PR base: %s\n' "$base"
echo '== Protected-base changed paths and diff =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --unified=80 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
echo '== Changed-file structures =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
ast-grep outline tests/test_materialize_base_python_requirements.py --items all
ast-grep outline tests/test_uv_redirect_boundary.py --items all
echo '== Trusted downloader implementation =='
sed -n '150,340p' scripts/ci/materialize_base_python_requirements.py
echo '== Related contract and boundary tests =='
fd -t f -e py . tests | sort | while IFS= read -r file; do
if rg -q 'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|_install_trusted_uv_url_opener' "$file"; then
echo "--- $file"
rg -n -C 5 'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|_install_trusted_uv_url_opener|User-Agent|addheaders|ProxyHandler|HTTPRedirectHandler|platform\.system|platform\.machine|sha256|MAX_' "$file"
fi
done
echo '== Non-test downloader call sites =='
rg -n -C 5 '\b(_download_trusted_uv_archive|_install_trusted_uv|_install_trusted_uv_url_opener)\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== Exact-head checks and review state =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,completed_at}]'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'Length of output: 78770 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='5e73836229250e247433e3f3dd372f4881fe2edf'
echo '== Structural trusted-download contract =='
sed -n '1,220p' tests/test_trusted_uv_download_contract.py
echo '== Streaming and platform contract =='
sed -n '1,150p' tests/test_trusted_uv_portability_and_streaming.py
echo '== Redirect and coverage contract =='
sed -n '1,120p' tests/test_uv_redirect_and_coverage_contract.py
echo '== Header assignment and downloader request construction references =='
rg -n -C 5 'TRUSTED_UV_USER_AGENT|addheaders|urllib\.request\.Request|urlopen\s*\(' \
scripts/ci/materialize_base_python_requirements.py tests -g '*.py'
echo '== Failed strix check metadata =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {id,name,status,conclusion,details_url,output,started_at,completed_at}'Length of output: 20990 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
check_run_id='95007835293'
gh api "repos/${repo}/check-runs/${check_run_id}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,message,title,raw_details}'Length of output: 550
I found no actionable source finding in the requested three-file delta. The downloader uses one literal Astral HTTPS URL. It does not accept a caller-controlled URL, The existing size bound, final-origin validation, SHA-256 pin, archive-member validation, executable-size check, and exact-version check remain unchanged. The Linux x86_64 test fixture changes test attributes only. The production platform gate still fails before network access on unsupported runners. Merge readiness is not established. The exact-head I did not approve, modify, or merge the pull request. You are interacting with an AI system. |
|
Please review the exact current head, focusing on the fixed-origin/no-proxy/no-redirect trusted-download boundary, immutable checksum verification, platform/architecture handling, and whether any caller-controlled input can influence request headers, URL selection, cache identity, or executable selection. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@opencode-agent @cwl-noema-review Please perform fresh independent review of exact current head |
|
@opencode-agent @cwl-noema-review Perform fresh independent formal review of exact head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='c34b367d0926af0f14a9186b0e8dd64dbeb06077'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Revision identity =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested HEAD: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${base}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES=true' || echo 'HEAD_MATCHES=false'
git status --short
echo '== Protected-base diff =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
git diff --find-renames --unified=80 "$base" "$head"
echo '== Changed Python source structure =='
git diff --name-only "$base" "$head" -- '*.py' | while IFS= read -r file; do
if [ -n "$file" ]; then
echo "--- $file"
ast-grep outline "$file" --items all
fi
done
echo '== Trusted downloader and output boundary implementation =='
rg -n -C 12 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|Request|sha256|MAX_|platform\.system|platform\.machine|openat|dir_fd|O_NOFOLLOW|O_DIRECTORY|lstat|stat|symlink|workspace|credential|manifest|lock' \
scripts/ci/materialize_base_python_requirements.py
echo '== Related test coverage =='
rg -n -C 8 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|Request|sha256|MAX_|platform\.system|platform\.machine|openat|dir_fd|O_NOFOLLOW|O_DIRECTORY|lstat|stat|symlink|workspace|credential|manifest|lock' \
tests -g '*.py'
echo '== Non-test trusted-downloader call sites =='
rg -n -C 5 \
'\b(_download_trusted_uv_archive|_install_trusted_uv|_install_trusted_uv_url_opener|materialize)\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== Exact-head pull request state =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author,statusCheckRollup \
--jq '{number,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:.author.login,checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,started_at,completed_at,details_url}]'
echo '== Exact-head reviews and unresolved review threads =='
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { path line body } } }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false) | {isResolved,isOutdated,comment:.comments.nodes[0]}]'Length of output: 203594 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-Ce1TXQ'
head='c34b367d0926af0f14a9186b0e8dd64dbeb06077'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Identity and changed paths from first inspection =='
rg -n -A12 -B2 '^== Revision identity ==|^== Protected-base diff ==' "$log" | head -n 80
echo '== Changed path names =='
git diff --name-only "$base" "$head"
echo '== Exact protected-base diff for changed paths =='
git diff --unified=35 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_workspace_fail_closed.py
echo '== Downloader implementation =='
sed -n '1,285p' scripts/ci/materialize_base_python_requirements.py
echo '== Output-directory implementation =='
sed -n '450,575p' scripts/ci/materialize_base_python_requirements.py
echo '== Changed installer and output tests =='
sed -n '1,360p' tests/test_materialize_base_python_requirements.py
echo '== Redirect and header test =='
sed -n '1,180p' tests/test_uv_redirect_boundary.py
echo '== Workspace diagnostic-redaction test =='
sed -n '1,180p' tests/test_uv_workspace_fail_closed.py
echo '== Dedicated trusted-download contract tests =='
sed -n '1,260p' tests/test_trusted_uv_download_contract.py
sed -n '1,200p' tests/test_trusted_uv_portability_and_streaming.py
sed -n '1,180p' tests/test_uv_redirect_and_coverage_contract.py
echo '== Exact source locations for request construction and output writes =='
rg -n -C 5 \
'TRUSTED_UV_URL|TRUSTED_UV_USER_AGENT|addheaders|urlopen\(|_download_trusted_uv_archive|_install_trusted_uv|os\.open|dir_fd|O_NOFOLLOW|_assert_output_directory_identity|write_bytes|manifest\.json|credential|workspace' \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_workspace_fail_closed.py \
tests/test_trusted_uv_download_contract.py \
tests/test_trusted_uv_portability_and_streaming.py \
tests/test_uv_redirect_and_coverage_contract.pyLength of output: 135687
Verdict: no actionable source finding. The protected-base diff changes four files. It includes the materializer and three test files. The trusted downloader retains one literal Astral HTTPS URL at the network sink. It does not accept a caller-controlled URL, The installed opener disables proxies and rejects redirects. It sets the fixed The downloader still validates the final HTTPS origin and port. It still enforces the archive download bound, SHA-256 pin, fixed regular archive member, executable-size limit, and exact The production installer still rejects unsupported platforms before it downloads the archive. The updated installer tests simulate Linux x86_64 only within the test process. The existing portability tests retain unsupported-platform rejection before network access. The output writer opens the output directory with The workspace failure path no longer includes parsed workspace values in the exception. The regression test verifies that the workspace member pattern and credential fixture are absent from the diagnostic. The exact-head quality, coverage, security, and supply-chain checks are terminal and successful where applicable. No unresolved, non-outdated review thread was returned. Merge readiness is still not established. GitHub reports I did not modify, approve, merge, or change protection settings.
|
|
@opencode-agent review Perform a fresh review-only review of exact current head |
|
@opencode-agent review Review exact unchanged head |
|
Exact-current-head read-only review request for All nine repository-owned exact-head workflows are terminal-success, the only returned inline thread is resolved and outdated, and the protected-base diff is limited to the four declared materializer/test files. Review this unchanged head only; predecessor evidence is historical. @opencode-agent review Read-only review. Do not update the branch, alter reviewer identity or credential scope, weaken protection, synthesize author approval, or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='c34b367d0926af0f14a9186b0e8dd64dbeb06077'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact revision =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested HEAD: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${base}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES=true' || echo 'HEAD_MATCHES=false'
git status --short
echo '== Protected-base changed paths and diff checks =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --stat "$base" "$head"
echo '== Changed Python structures =='
git diff --name-only "$base" "$head" -- '*.py' | while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all
done
echo '== Protected-base diff =='
git diff --unified=60 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py \
tests/test_uv_workspace_fail_closed.py
echo '== Downloader and output-boundary implementation =='
sed -n '1,330p' scripts/ci/materialize_base_python_requirements.py
sed -n '430,610p' scripts/ci/materialize_base_python_requirements.py
echo '== Trust-boundary test references =='
rg -n -C 5 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|Request|sha256|MAX_|platform\.system|platform\.machine|O_NOFOLLOW|O_DIRECTORY|dir_fd|workspace|credential' \
tests -g '*.py'
echo '== Non-test trusted downloader call sites =='
rg -n -C 4 \
'\b(_download_trusted_uv_archive|_install_trusted_uv|_install_trusted_uv_url_opener|materialize)\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== Exact-head PR state, checks, reviews, and unresolved threads =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:.author.login,checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,completed_at}]'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { path line body } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false) | {isResolved,isOutdated,comment:.comments.nodes[0]}]'Length of output: 203511 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-aGrcBX'
echo '== Section markers =='
rg -n '^== (Exact revision|Protected-base changed paths and diff checks|Changed Python structures|Protected-base diff|Downloader and output-boundary implementation|Trust-boundary test references|Non-test trusted downloader call sites|Exact-head PR state)' "$log"
echo '== Revision and changed-path evidence =='
sed -n '1,240p' "$log"
echo '== Protected-base diff section =='
start=$(rg -n '^== Protected-base diff ==$' "$log" | cut -d: -f1)
end=$(rg -n '^== Downloader and output-boundary implementation ==$' "$log" | cut -d: -f1)
sed -n "${start},$((end - 1))p" "$log"
echo '== Downloader and output implementation section =='
start=$(rg -n '^== Downloader and output-boundary implementation ==$' "$log" | cut -d: -f1)
end=$(rg -n '^== Trust-boundary test references ==$' "$log" | cut -d: -f1)
sed -n "${start},$((end - 1))p" "$log"
echo '== Dedicated trusted downloader contract tests =='
sed -n '1,300p' tests/test_trusted_uv_download_contract.py
sed -n '1,160p' tests/test_trusted_uv_portability_and_streaming.py
sed -n '1,160p' tests/test_uv_redirect_and_coverage_contract.pyLength of output: 82602
Verdict: no actionable source finding. The protected-base diff changes four files. The downloader uses the same literal Astral HTTPS URL in The trusted opener disables proxies with The downloader still validates the final HTTPS scheme, The production installer rejects non-Linux x86_64 runners before download. The updated installer tests use The output writer opens the output directory with The returned exact-head quality, coverage, security, and supply-chain checks are complete and successful where applicable. No unresolved, current review thread was returned. Merge readiness is not established. GitHub currently reports I did not approve, modify, merge, or change protection settings. You are interacting with an AI system. |
|
@cwl-noema-review Review exact current head |
|
Perform bounded review-only analysis of exact current head |
|
Superseded by current-main replacement #1020. Protected No check, review, approval, comment, auto-merge state, or synthetic merge result transfers. Continue exact-head review and integration only on #1020. |
|
Superseded by current-protected-main replacement #1020 ( #1020 preserves the same bounded four-file downloader repair while starting directly from |
2 participants
Summary
User-Agenton the existing trusteduvopener.Root cause
Central
coverage-evidencecan receive an upstream HTTP 403 when Python uses its default request identifier. The pinned archive succeeds through the same fixed trust boundary when the request carries the fixed organization identifier. No URL, redirect target, proxy, caller-supplied header, or integrity input becomes dynamic.Current-main reconciliation
Protected
mainadvanced when #782 integrated the hourly NVIDIA NIM review/RCA/repair control plane. The previous exact headc34b367d...was one protected-main commit behind, so predecessor checks and formal review evidence could not authorize integration.Forward commit
0cba2c4c144ad37f96820ac4e4a7163a4f711aedrebuilds the proposed tree from protectedmain@c47afc2dc68488292c1db7c9d6f82dcd5360f181plus exactly the four trusted-materializer files. It preserves the newly integrated central scheduler and all unrelated protected-main content. No force-push, rebase, protection change, or predecessor-evidence transfer was used.Exact current scope
0cba2c4c144ad37f96820ac4e4a7163a4f711aedmain@c47afc2dc68488292c1db7c9d6f82dcd5360f181scripts/ci/materialize_base_python_requirements.pytests/test_materialize_base_python_requirements.pytests/test_uv_redirect_boundary.pytests/test_uv_workspace_fail_closed.pyVerification boundary
Every check and review on
c34b367d...is now historical. Fresh exact-head quality, security, supply-chain, current-head semantic review, resolved-thread, and independent-approval evidence must be generated for0cba2c4c.... Queued, running, skipped-required, cancelled, failed, stale, status-only, automated-only, or author-only evidence is non-passing.Downstream dependency order
This PR remains the bounded control-plane prerequisite for central coverage/review reruns that fail before leaf-repository tests while materializing protected-base Python locks. After protected integration, rerun central coverage/review once for each then-current downstream head; do not treat a pre-integration rerun as evidence that the consumer inherited the fix.
PR #790 remains a separate complementary lane for explicitly classified transient transport retries and broader materializer hardening. A permanent request-identification/403 repair and retry semantics must remain independently reviewable.
Merge boundary
Merge only after the unchanged exact head has terminal required checks, zero valid unresolved findings, the live qualifying independent non-author approvals, and ordinary branch-protection acceptance. Do not self-approve or use administrative bypass.