fix: keep cross-repo OpenCode evidence healthy - #939
Conversation
|
Warning Review limit reached
Next review available in: 20 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthrough교차 저장소 상태 공개 경로가 정확한 PR HEAD의 공식 OpenCode 리뷰를 검증한다. 신뢰된 uv 아카이브 다운로드는 고정 User-Agent를 포함한 정적 ChangesOpenCode 리뷰 검증
신뢰된 uv 다운로드
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head Focus on the static fixed-URL/fixed-User-Agent uv request boundary, no-proxy/no-redirect behavior, bounded download/checksum/version enforcement, and the cross-repository OpenCode App status-publication guard. Verify that optional status publication cannot substitute for exact-head formal review or weaken branch protection. Review only; do not mutate, self-approve, enable auto-merge, or merge. |
|
@coderabbitai review Please perform a fresh read-only semantic review of exact current head Focus on the new fail-closed cross-repository status guard: unavailable |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='939'
echo '== Commit identity and ancestry =='
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
printf 'HEAD parent/base relationship: '
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo yes || echo no
printf 'merge-base: '
git merge-base "$base_sha" "$head_sha"
printf 'checked-out HEAD: '
git rev-parse HEAD
echo '== Changed files and exact diff =='
git diff --name-status "$base_sha" "$head_sha"
git diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
echo '== Workflow outline and relevant control-flow context =='
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all || true
rg -n -C 12 --glob 'opencode-review-dispatch.yml' \
'github\.token|opencode-app|commit.status|statuses|reviews|pulls|PR_HEAD_SHA|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|repository_dispatch' \
.github/workflows/opencode-review-dispatch.yml
echo '== Contract-test context =='
ast-grep outline tests/test_opencode_agent_contract.py --items all || true
rg -n -C 10 \
'github\.token|opencode-app|commit.status|statuses|reviews|PR_HEAD_SHA|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0' \
tests/test_opencode_agent_contract.py
echo '== Live PR identity, reviews, and check rollup =='
gh pr view "$pr_number" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],checks:[.statusCheckRollup[]|{name,conclusion,status,workflowName}]}'Length of output: 161212 🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='939'
echo '== Commit ancestry =='
printf 'base ancestor of head: '
git merge-base --is-ancestor "$base_sha" "$head_sha" && echo yes || echo no
printf 'merge-base: '; git merge-base "$base_sha" "$head_sha"
printf 'current checkout: '; git rev-parse HEAD
echo '== Exact changed hunks: status-publication guard =='
git diff --unified=30 "$base_sha" "$head_sha" -- .github/workflows/opencode-review-dispatch.yml |
sed -n '/Publish repository_dispatch OpenCode status/,+130p'
echo '== Exact changed hunks: regression contract =='
git diff --unified=30 "$base_sha" "$head_sha" -- tests/test_opencode_agent_contract.py |
sed -n '1,260p'
echo '== Guard source with line numbers =='
nl -ba .github/workflows/opencode-review-dispatch.yml |
sed -n '7828,7895p'
echo '== Exact-head Strix workflow runs =='
gh run list --repo "$repo" --workflow strix.yml --commit "$head_sha" --limit 20 \
--json databaseId,event,status,conclusion,headSha,url,workflowName \
--jq '.[] | {databaseId,event,status,conclusion,headSha,url,workflowName}'
echo '== Current branch-protection requirements =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,allow_force_pushes,allow_deletions}' \
|| trueLength of output: 13167 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head_sha='f97b9a44201633d2a94bf73c6bb7fde900135553'
echo '== Current exact-head Strix runs =='
gh run list --repo "$repo" --workflow strix.yml --commit "$head_sha" --limit 20 \
--json databaseId,event,status,conclusion,headSha,url,workflowName \
--jq '.[] | {databaseId,event,status,conclusion,headSha,url,workflowName}'
echo '== Branch protection: required checks and reviews =='
gh api "repos/${repo}/branches/main/protection" |
jq '{
required_status_check_contexts: (.required_status_checks.contexts // []),
strict_required_status_checks: (.required_status_checks.strict // null),
required_approving_review_count: (.required_pull_request_reviews.required_approving_review_count // 0),
dismiss_stale_reviews: (.required_pull_request_reviews.dismiss_stale_reviews // false),
require_code_owner_reviews: (.required_pull_request_reviews.require_code_owner_reviews // false),
require_last_push_approval: (.required_pull_request_reviews.require_last_push_approval // false),
enforce_admins: (.enforce_admins.enabled // false)
}'
echo '== Current live PR review and check state =='
gh pr view 939 --repo "$repo" --json headRefOid,reviews,statusCheckRollup \
--jq '{
head: .headRefOid,
reviews: [.reviews[] | {author:.author.login,state,commit:.commit.oid}],
active_or_non_success_checks: [
.statusCheckRollup[]
| select(.status != "COMPLETED" or ((.conclusion // "") | ascii_upcase | IN("SUCCESS","SKIPPED","NEUTRAL") | not))
| {name,status,conclusion,workflowName}
]
}'Length of output: 2589
I found no source-level defect in the new cross-repository status-publication guard.
The regression contract checks the required guard structure and failure path. It is static coverage. It does not execute mocked API failure or review-payload cases. Live verification is incomplete:
Therefore, the statement that all exact-head checks are terminal-success is not supported by the live data. I did not approve, merge, enable auto-merge, or modify repository state. I applied the existing exact-current-head evidence rule during this review. 🧠 Learnings used
|
|
@opencode-agent review Perform a fresh read-only semantic review of exact current head Review the fail-closed exact-head formal-review guard and the subsequent Strix outage-gate changes as one current tree. Keep source-review evidence distinct from workflow/provider evidence. Do not mutate, self-approve, enable auto-merge, dismiss reviews, weaken gates, or merge. |
|
@coderabbitai review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='939'
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit identity =='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
printf 'checked-out head: '; git rev-parse HEAD
printf 'base is ancestor: '; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
printf 'merge base: '; git merge-base "$base" "$head"
echo '== Changed files =='
git diff --name-status "$base" "$head"
echo '== Focused exact diff =='
git diff --unified=45 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_trusted_uv_download_contract.py \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py
echo '== Python module outline =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
echo '== Trusted uv request and enforcement context =='
rg -n -C 14 --glob 'materialize_base_python_requirements.py' \
'TRUSTED_UV_DOWNLOAD|Request\(|urlopen\(|ProxyHandler|HTTPRedirectHandler|timeout|read\(|sha256|checksum|version|extract' \
scripts/ci/materialize_base_python_requirements.py
echo '== Trusted uv contract context =='
ast-grep outline tests/test_trusted_uv_download_contract.py --items all || true
rg -n -C 10 \
'Request|urlopen|User-Agent|TRUSTED_UV_DOWNLOAD|ProxyHandler|HTTPRedirectHandler|timeout|sha256|version' \
tests/test_trusted_uv_download_contract.py
echo '== Status-publication guard context =='
rg -n -C 16 --glob 'opencode-review-dispatch.yml' \
'Publish repository_dispatch OpenCode status|github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit 1|exit 0|statuses|commit.status' \
.github/workflows/opencode-review-dispatch.yml
echo '== Status-guard contract context =='
rg -n -C 10 \
'github\.token|opencode-app|reviews|PR_HEAD_SHA|opencode-agent|APPROVED|CHANGES_REQUESTED|exit.?1|exit.?0|status' \
tests/test_opencode_agent_contract.py
echo '== Live PR exact-head state =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviews,statusCheckRollup \
--jq '{
number,state,isDraft,mergeable,headRefOid,baseRefOid,
reviews:[.reviews[]|{author:.author.login,state,commit:.commit.oid}],
checks:[.statusCheckRollup[]|{name,status,conclusion,workflowName,headSha}]
}'
echo '== Branch protection, if readable =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{
required_status_checks: (.required_status_checks // null),
required_pull_request_reviews: (.required_pull_request_reviews // null),
enforce_admins: (.enforce_admins.enabled // null)
}' || echo 'Branch-protection query was unavailable.'Length of output: 156484 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Checkout and ancestry =='
printf 'checkout='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$base" "$head"
printf 'base_ancestor='; git merge-base --is-ancestor "$base" "$head" && echo yes || echo no
echo '== Changed paths at exact revisions =='
git diff --name-status "$base" "$head"
echo '== Exact trusted uv diff =='
git diff --unified=25 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_trusted_uv_download_contract.py
echo '== Exact trusted uv implementation =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
nl -ba |
sed -n '/TRUSTED_UV_DOWNLOAD/,/^[[:space:]]*def /p'
echo '== Exact trusted uv contract functions =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
nl -ba |
sed -n '/test_urlopen_receives_one_static_release_request/,/^[[:space:]]*def /p'
echo '== Exact status guard diff =='
git diff --unified=28 "$base" "$head" -- \
.github/workflows/opencode-review-dispatch.yml \
tests/test_opencode_agent_contract.py |
sed -n '/Publish repository_dispatch OpenCode status/,+180p'
echo '== Exact status guard implementation =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
nl -ba |
sed -n '7828,7918p'
echo '== Exact status guard contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
nl -ba |
sed -n '1997,2053p'Length of output: 12650 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='ac5665148bb113f92e97d2fc49a729bca2f050b5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
numbered_range() {
start="$1"
end="$2"
awk -v start="$start" -v end="$end" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }'
}
echo '== Trusted uv downloader and enforcement =='
git show "${head}:scripts/ci/materialize_base_python_requirements.py" |
numbered_range 55 285
echo '== Trusted uv request contract =='
git show "${head}:tests/test_trusted_uv_download_contract.py" |
numbered_range 1 180
echo '== Exact cross-repository status guard =='
git show "${head}:.github/workflows/opencode-review-dispatch.yml" |
numbered_range 7828 7918
echo '== Exact cross-repository status contract =='
git show "${head}:tests/test_opencode_agent_contract.py" |
numbered_range 1997 2053
echo '== Strix exact diff and contracts =='
git diff --unified=30 "$base" "$head" -- \
.github/workflows/strix.yml \
tests/test_required_workflow_queue_contract.py \
tests/test_strix_nvidia_nim_not_found_fallback.pyLength of output: 48876
I found no blocking source-level defect.
Trusted
Cross-repository commit-status limitation
Strix outage gate
Live evidence
I applied the existing exact-current-head evidence rule during this review. I did not modify repository state, approve, merge, release, dismiss reviews, or change protections. 🧠 Learnings usedYou are interacting with an AI system. |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head read-only review request for ac5665148bb113f92e97d2fc49a729bca2f050b5 against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
This is now the canonical repair after closing superseded #943. Review the combined causal boundaries: fixed-origin static User-Agent for trusted uv bootstrap; proof of an exact-head formal OpenCode review before tolerating unavailable cross-repository status publication; and fail-closed Strix behavior when provider evidence is incomplete. Nine directly observed exact-head hosted workflows, including Trusted uv Materializer Quality CI, are terminal-success and no inline thread exists.
Do not transfer #943 evidence, update this branch, synthesize author approval, neutralize missing security evidence, or bypass protection.
|
Canonical exact-current-head review dispatch for Review the combined root-cause repair only: fixed-origin static Keep this request read-only. Do not update the branch, synthesize author approval, merge, release, neutralize missing security evidence, or weaken protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact current head |
Rate Limit Exceeded
|
1 participant
Summary\n\n- Send a static User-Agent with the fixed Astral uv archive request so the trusted coverage bootstrap is accepted by the release host.\n- Preserve the fixed URL, no-proxy/no-redirect opener, bounded download, checksum, and executable-version checks.\n- Treat the observed cross-repository OpenCode App commit-status permission gap as an optional status-publication limitation; keep the exact-head formal review authoritative instead of failing the review job after the review is posted.\n- Add regression contracts for the request URL/header and cross-repository token guard.\n\nThis repairs the trusted coverage evidence path used by https://github.com/ContextualWisdomLab/naruon/pull/1317.\n\n## Verification\n\n- Linux amd64/Colima reproduction: 976 passed, 16 subtests passed.\n- Focused Linux amd64/Colima contracts: 96 passed.\n- Local docstring gate: 100%.\n- Python compile and git diff checks passed.\n\nNo admin merge, review dismissal, bypass, or security-gate suppression is requested.
Summary by CodeRabbit
개선 사항
테스트