fix(scheduler): accept safe Unicode pull-request refs - #940
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthrough스케줄러가 이모지와 한글을 포함한 유효한 Unicode Git ref를 허용하도록 검증을 변경했습니다. 제어 문자, 공백, 셸 메타문자 및 위험한 Git 경로 형식은 계속 거부합니다. 관련 변경은 exact-head 품질 CI를 실행합니다. Changes스케줄러 Git ref 검증
스케줄러 품질 CI 연결
Estimated code review effort: 3 (보통) | ~20 minutes Merge Risk: ⚪ Minimal · up to The change accepts safe GitHub-valid Unicode branch names while preserving unsafe-ref rejection and adds exact-head quality coverage for scheduler changes. No actionable merge-blocking risk remains after normal checks and review. Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Review exact current head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='b999b0593267f6be6504d88db73a6a1b0bd754c5'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Local commit identity and ancestry =='
git rev-parse HEAD
git merge-base HEAD "$expected_base"
git rev-list --left-right --count "$expected_base...HEAD"
git diff-tree --no-commit-id --name-status -r HEAD
git diff --check "$expected_base...HEAD"
echo '== Changed-file outlines =='
git diff --name-only "$expected_base...HEAD" | while IFS= read -r path; do
printf '\n-- %s --\n' "$path"
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
*) sed -n '1,260p' "$path" ;;
esac
done
echo '== Exact patch =='
git diff --find-renames --find-copies --unified=80 "$expected_base...HEAD"Length of output: 42964 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='b999b0593267f6be6504d88db73a6a1b0bd754c5'
echo '== Pull request metadata =='
gh pr view "$pr" --repo "$repo" --json number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup
echo '== Check runs for the requested commit =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha,.details_url] | `@tsv`'
echo '== Workflow runs for the requested commit =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.head_sha,.event,.html_url] | `@tsv`'
echo '== Review threads and reviews =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body } } }
}
reviews(first: 100) { nodes { author { login } state commit { oid } } }
}
}
}' --jq '.data.repository.pullRequest'Length of output: 45371 🏁 Script executed: #!/bin/bash
set -euo pipefail
file='scripts/ci/pr_review_merge_scheduler.py'
echo '== Process execution and validation boundaries =='
sed -n '420,610p' "$file"
echo '== Ref-validation call sites =='
rg -n -C 5 '\bvalidate_git_ref\s*\(' "$file"
echo '== Dispatch and merge/update mutation paths =='
sed -n '1450,1590p' "$file"
sed -n '1770,2165p' "$file"
echo '== Structured process invocation sites =='
rg -n -C 4 '\brun(?:_github_(?:read|actions|dispatch))?\s*\(' "$file"
echo '== PR ref field use sites =='
rg -n -C 4 '(?:baseRefName|headRefName|baseRefOid|headRefOid)' "$file"
echo '== Unicode regression test context =='
sed -n '140,260p' 'tests/test_pr_review_merge_scheduler.py'Length of output: 56407
No code findings.
I applied the stored exact-current-head evidence policy during this review. This review does not provide independent human approval or merge authorization. 🧠 Learnings used
|
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='b999b0593267f6be6504d88db73a6a1b0bd754c5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit and scope =='
printf 'HEAD: '; git rev-parse HEAD
printf 'Expected head object: '; git rev-parse "$head^{commit}"
printf 'Merge base: '; git merge-base "$head" "$base"
printf 'Ahead/behind: '; git rev-list --left-right --count "$base...$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "$base...$head"
git diff --find-renames --unified=100 "$base...$head"
echo '== Changed-file structure =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
printf '\n-- %s --\n' "$path"
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
*) sed -n '1,280p' "$path" ;;
esac
done
echo '== Validator, structured invocation, and authority boundaries =='
file='scripts/ci/pr_review_merge_scheduler.py'
rg -n -C 12 '\bvalidate_git_ref\s*\(' "$file"
rg -n -C 8 '(?:subprocess\.(?:run|Popen|check_output|check_call)|\brun(?:_github_(?:read|actions|dispatch))?\s*\(|shell\s*=|gh\s+api|repository-dispatch)' "$file"
rg -n -C 8 '(?:permissions:|credential|token|merge|update-ref|restamp|dispatch|baseRefName|headRefName|headRefOid|baseRefOid)' "$file"
echo '== Unicode regression tests =='
test_file='tests/test_pr_review_merge_scheduler.py'
rg -n -C 16 '(?:validate_git_ref|🎨|Korean|Korean|zero.width|non.breaking|\.lock|HEAD|@\{|hidden|traversal)' "$test_file"
echo '== Current remote PR and exact-head checks =='
gh pr view "$pr" --repo "$repo" \
--json state,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated } }
reviews(first: 100) { nodes { author { login } state commit { oid } } }
}
}
}' --jq '.data.repository.pullRequest'Length of output: 228340
No code findings.
I applied the stored exact-current-head evidence policy. Direct exact-head checks with This review does not provide independent human approval or merge authorization. 🧠 Learnings usedYou are interacting with an AI system. |
|
Exact-current-head review request for Review the bounded two-file safe-Unicode ref repair. It permits GitHub-valid international branch names while continuing to reject ASCII shell metacharacters and whitespace, Unicode control/format/separator categories, leading dashes, reserved Keep the exact head unchanged. Do not broaden the validator beyond the tested boundary, synthesize author approval, update the branch, merge, release, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
Exact-current-head semantic review request for Review the four-file bounded repair on this exact head. Keep the exact head unchanged. Do not broaden the validator beyond the tested safe Unicode boundary, infer shell safety from displayability alone, remove scheduler quality triggers, synthesize author approval, update the branch, merge, release, or bypass protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='fa53feff221633b4911df8d3e0715551935dcf26'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Commit identity and scope =='
printf 'Checked-out HEAD: '; git rev-parse HEAD
printf 'Requested head: '; git rev-parse "${head}^{commit}"
printf 'Merge base: '; git merge-base "$head" "$base"
printf 'Ahead/behind: '; git rev-list --left-right --count "$base...$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Full exact diff =='
git diff --find-renames --find-copies --unified=80 "$base...$head"
echo '== Changed file outlines =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
printf '\n-- %s --\n' "$path"
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
*) sed -n '1,320p' "$path" ;;
esac
done
echo '== Scheduler validation and invocation boundaries =='
scheduler='scripts/ci/pr_review_merge_scheduler.py'
rg -n -C 16 '\bvalidate_git_ref\s*\(' "$scheduler"
rg -n -C 8 '(?:subprocess\.(?:run|Popen|check_output|check_call)|\brun(?:_github_(?:read|actions|dispatch))?\s*\(|shell\s*=|gh\s+api|repository-dispatch)' "$scheduler"
rg -n -C 8 '(?:baseRefName|headRefName|baseRefOid|headRefOid|update-ref|merge|restamp|permissions:|credential|token)' "$scheduler"
echo '== Ref and quality-trigger regression tests =='
tests='tests/test_pr_review_merge_scheduler.py'
rg -n -C 18 '(?:validate_git_ref|🎨|Korean|non.breaking|zero.width|\.lock|HEAD|@\{|hidden|traversal|strix-changed-path-quality-ci|pr_review_merge_scheduler)' "$tests"
echo '== PR and exact-head GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha] | `@tsv`'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.head_sha,.event] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body } }
}
}
reviews(first: 100) {
nodes { author { login } state commit { oid } }
}
}
}
}' --jq '.data.repository.pullRequest'Length of output: 216842
No code findings.
It continues to reject:
The scheduler continues to use argument vectors with Repository dispatch continues to use The changed code does not modify dispatch targets, credentials, permissions, merge guards, mutation-actor gates, or branch-protection behavior. The Strix workflow now triggers for the scheduler workflow, scheduler source, and scheduler test file. The regression test also checks the exact PR-head checkout, the full test command, and the clean-worktree gate.
The remaining observed exact-head workflows are queued. Skipped jobs and queued jobs are not passing evidence. GitHub currently reports I applied the stored exact-current-head evidence policy. This review does not provide a qualifying independent human approval or merge authorization. 🧠 Learnings usedYou are interacting with an AI system. |
|
Exact-current-head automated and independent review requested for Fresh evidence: all nine directly observed exact-head workflows are now terminal-success, no inline thread exists, and the permanent quality gate checked out the literal head with persisted credentials disabled, ran 978 tests plus 16 subtests, executed the bounded Strix regression, compiled the changed contracts, and left a clean worktree. Review both causal boundaries: GitHub-valid non-ASCII graphic/letter refs are accepted while Unicode control/format/separator, shell, traversal, hidden-component, reserved, and Submit an exact-head verdict without updating the branch, broadening unsafe ref syntax, removing scheduler trigger coverage, synthesizing author approval, or bypassing protection. @coderabbitai review |
Rate Limit Exceeded
|
|
Reviewed. CHANGELOG + APA 7th doctoring (Unicode 16.0, git-check-ref-format). Reality tests keep the observed emoji branch and Hangul ref. Local suite 978 passed x2. Auto-merge armed. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
bc85e8839ba819a179d66f0b97a114a69fba0640. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341340)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963494/job/94504004791)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963914/job/94504006073)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963914/job/94504006073)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504006693)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964689/job/94504010075)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006896)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006807)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341340)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504006693)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341382)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964123/job/94504006837)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963902/job/94504005926)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963911/job/94504006292)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963911/job/94504006292)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964027/job/94504006276)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006676)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006578)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006719)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006797)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964123/job/94504006837)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964083/job/94504006842)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006896)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006807)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963494/job/94504004791)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963334/job/94504316060)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006676)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964083/job/94504006842)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963902/job/94504005926)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964027/job/94504006276)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964689/job/94504010075)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006578)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341382)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963334/job/94504004356)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006719)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006797)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix-changed-path-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix-changed-path-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scheduler-unicode-git-refs.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scheduler-unicode-git-refs.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix-changed-path-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix-changed-path-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scheduler-unicode-git-refs.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scheduler-unicode-git-refs.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
|
Returned to Draft because the exact current tree mixes the safe-Unicode scheduler repair with an unrelated trusted-uv materializer branch. The bounded product slice is sound: accept GitHub-valid Unicode ref components while rejecting control/format/separator categories, shell metacharacters, traversal/reserved forms, and Rebuild from protected |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='8866aa67241a30cd2e33b37441583eeb44e4c0bb'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit identity and ancestry =='
printf 'checked_out_head='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "${head}^{commit}"
printf 'merge_base='; git merge-base "$head" "$base"
printf 'ahead_behind='; git rev-list --left-right --count "$base...$head"
echo '== Changed paths =='
git diff --name-status "$base...$head"
echo '== Whitespace errors =='
git diff --check "$base...$head"
echo '== Full patch =='
git diff --find-renames --find-copies --unified=100 "$base...$head"
echo '== Affected Python structure =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
case "$path" in
*.py)
printf '\n-- %s --\n' "$path"
ast-grep outline "$path" --items all --view expanded
;;
esac
done
echo '== Validator and process/API boundaries =='
scheduler='scripts/ci/pr_review_merge_scheduler.py'
rg -n -C 14 '\bvalidate_git_ref\s*\(' "$scheduler"
rg -n -C 8 '(?:subprocess\.(?:run|Popen|check_output|check_call)|\brun(?:_github_(?:read|actions|dispatch))?\s*\(|shell\s*=|gh\s+api|repository-dispatch)' "$scheduler"
rg -n -C 8 '(?:baseRefName|headRefName|headRefOid|baseRefOid|update-ref|merge|restamp|permissions:|credential|token)' "$scheduler"
echo '== Tests and quality workflow trigger policy =='
tests='tests/test_pr_review_merge_scheduler.py'
workflow='.github/workflows/strix-changed-path-quality-ci.yml'
rg -n -C 18 '(?:validate_git_ref|🎨|Korean|non.breaking|zero.width|\.lock|HEAD|@\{|hidden|traversal|strix-changed-path-quality-ci|pr_review_merge_scheduler|clean.worktree|persist-credentials)' "$tests"
sed -n '1,300p' "$workflow"
echo '== Current PR and exact-head GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha] | `@tsv`'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.head_sha,.event] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body } } }
}
reviews(first: 100) { nodes { author { login } state commit { oid } } }
}
}
}' --jq '.data.repository.pullRequest'Length of output: 144523 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='8866aa67241a30cd2e33b37441583eeb44e4c0bb'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
scheduler='scripts/ci/pr_review_merge_scheduler.py'
tests='tests/test_pr_review_merge_scheduler.py'
echo '== Identity, scope, and commits =='
printf 'checked_out='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$head" "$base"
printf 'ahead_behind='; git rev-list --left-right --count "$base...$head"
git log --oneline --decorate "$base..$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Exact patch, changed files only =='
git diff --unified=30 "$base...$head" -- \
'scripts/ci/pr_review_merge_scheduler.py' \
'tests/test_pr_review_merge_scheduler.py' \
'.github/workflows/strix-changed-path-quality-ci.yml' \
'tests/test_strix_changed_path_policy.py' \
'CHANGELOG.md' \
'docs/doctoring/**' \
'AGENTS.md'
echo '== validate_git_ref definition and direct call paths =='
rg -n -A100 -B12 '^def validate_git_ref\b' "$scheduler"
rg -n -A40 -B8 '^def dispatch_(?:opencode_review|strix_evidence)\b' "$scheduler"
rg -n -A45 -B8 '^def restamp_pr_head_for_last_push_approval\b' "$scheduler"
echo '== Targeted regression assertions =='
sed -n '140,205p' "$tests"
rg -n -A90 -B15 'test_.*(?:strix|changed_path|quality).*' 'tests/test_strix_changed_path_policy.py'
echo '== Paths outside the stated scheduler, Strix, and documentation scope =='
git diff --name-only "$base...$head" | grep -Ev \
'^(scripts/ci/pr_review_merge_scheduler\.py|tests/test_pr_review_merge_scheduler\.py|\.github/workflows/strix-changed-path-quality-ci\.yml|tests/test_strix_changed_path_policy\.py|CHANGELOG\.md|docs/doctoring/|AGENTS\.md)$' \
|| trueLength of output: 38278 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='8866aa67241a30cd2e33b37441583eeb44e4c0bb'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
file='tests/test_materialize_base_python_requirements.py'
echo '== Materializer test delta with line numbers =='
git diff --unified=40 "$base...$head" -- "$file"
echo '== Current changed regions =='
git diff --unified=0 "$base...$head" -- "$file"
echo '== Current surrounding source =='
rg -n -C 12 '(?:relative|include|requirement|materialize)' "$file"Length of output: 41245
Finding
The current diff therefore does not meet the stated bounded rebuild scope. Remove this materializer-test delta, or move it to its own PR. Then regenerate all exact-head evidence. The remaining reviewed changes are consistent with the requested safety boundary:
The current exact-head workflows are queued, in progress, or cancelled. They are not passing evidence. The You are interacting with an AI system. |
|
Exact-current-head read-only review request for The bounded six-file repair accepts GitHub-valid international ref characters while retaining shell/control/format/separator/traversal/hidden/.lock/reserved-name rejection, and ensures all merge-scheduler source/test/workflow changes trigger the permanent exact-head full suite. Recheck structured argv/API use, unchanged credentials/permissions/reviewer/merge authority, exact trigger paths, literal PR-head checkout, full-suite and clean-worktree contracts, and removal of unrelated installer-test drift. Treat predecessor evidence as historical. Do not mutate or merge the branch. @opencode-agent review |
Rate Limit Exceeded
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
842560579ae73e5aad5bba7d522c25c61fcdf1ea. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31886559045/job/95016600364)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31886559045/job/95016600364)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix-changed-path-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix-changed-path-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scheduler-unicode-git-refs.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scheduler-unicode-git-refs.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
Replay the unique Git ref allowlist onto current main so GitHub-valid emoji and Hangul branches dispatch while shell and control characters stay rejected.
8425605 to
0f14ff8
Compare
1 participant
Outcome
Accept safe GitHub-valid Unicode pull-request refs in the central merge scheduler and permanently bind scheduler control-plane changes to the exact-head full-suite quality gate. International branch names can reach normal dispatch without relaxing command, ref, workflow, publication, review, or merge safety.
Closes #685. Supersedes only the relevant source/test slice of closed unmerged #696; unrelated historical work is excluded.
Exact current identity and scope
main@c47afc2dc68488292c1db7c9d6f82dcd5360f181;0f14ff87d79b4e85e9ff74f2d95fe13b714ece7e;No predecessor-head check, review, approval, or merge-preview evidence transfers to this head.
Safe Unicode ref boundary
The former ASCII-only validator rejected GitHub-valid names such as
🎨-palette-ux-improvement-13325911538352561627before repository-dispatch fields could be constructed.The current validator permits non-ASCII graphic/letter characters while continuing to reject:
._/-punctuation set;HEAD;@{, repeated/traversal slash or dot forms, hidden path components, trailing dots/slashes, and component.locksuffixes.All Git/GitHub calls remain structured argv or typed API fields. No shell evaluation, workflow permission, credential, protected setting, reviewer, merge, or release authority is broadened.
Exact-head scheduler quality boundary
Scheduler changes must not bypass the permanent exact-head full-suite gate.
.github/workflows/strix-changed-path-quality-ci.ymlnow explicitly triggers for:.github/workflows/pr-review-merge-scheduler.yml;scripts/ci/pr_review_merge_scheduler.py;tests/test_pr_review_merge_scheduler.py.The path-policy regression also verifies literal PR-head checkout, the complete repository coverage/test command, and a clean-worktree gate.
Test-first evidence
The branch carries positive coverage for the production emoji ref and a Hangul ref, plus negative cases for shell punctuation, whitespace/control/format characters,
.lock, hidden/traversal forms and other unsafe ref shapes. The scheduler-quality trigger contract is executable rather than prose-only.On exact current head
0f14ff87..., observed organization checks includingopencode-review,coverage-evidence, andcoverage-source-treeare terminal-success. CodeRabbit's complete six-file review found no actionable issue on the prior equivalent tree; its later incremental attempt was rate-limited and is not treated as current independent approval. The full live required-check set and review/ruleset state must still be revalidated immediately before integration.Acceptance and rollback
Merge or auto-merge only after the unchanged exact head satisfies every live required check, zero valid unresolved findings, the repository's qualifying semantic-review requirements, and the live independent non-author / last-push approval rules. No self-approval, administrative bypass, synthetic approval, or protection weakening is permitted.
After protected integration, scheduled/manual queue evidence must show a formerly rejected Unicode branch reaching its normal dispatch/defer decision, and a scheduler-source-only change must continue to trigger the permanent exact-head suite. Rollback must preserve both properties.
Summary by CodeRabbit
개선 사항
문서
테스트