fix(ci): identify trusted uv downloader - #1008
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthrough신뢰된 uv 요청에 고정된 Changes신뢰된 uv materialization 변경
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to The change uses a fixed downloader identifier while preserving the existing trust and integrity boundaries. No actionable merge-blocking risk remains beyond completing the normal current-head checks and review. Sequence Diagram(s)sequenceDiagram
participant CI
participant materialize
participant output_directory
participant output_files
CI->>materialize: trusted uv 실행 및 materialize 호출
materialize->>output_directory: 비심볼릭 디렉터리 열기
materialize->>output_files: lock 파일과 manifest 기록
materialize->>output_directory: 디렉터리 교체 여부 검증
materialize-->>CI: 성공 또는 오류 반환
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent @cwl-noema-review Please review exact current head |
|
@cwl-noema-review |
|
@opencode-agent @cwl-noema-review Review only exact current head |
|
@opencode-agent @cwl-noema-review Fresh exact-head retry for protected central prerequisite |
|
Consumer evidence: After this prerequisite reaches protected |
|
@cwl-noema-review |
|
@cwl-noema-review |
|
@cwl-noema-review @opencode-agent Please perform fresh independent review of exact current head |
|
@opencode-agent @cwl-noema-review |
|
@opencode-agent Please review exact head |
|
|
|
@coderabbitai review Please review exact head |
|
@opencode-agent review Review-only exact-head request for |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='d14ad6ca0260eabf1373213e76e521b98a57e86b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== checked-out commit =='
git rev-parse HEAD
git status --short
git cat-file -e "${expected_head}^{commit}"
git cat-file -e "${base}^{commit}"
printf '\n== exact commit check ==\n'
test "$(git rev-parse HEAD)" = "$expected_head" && echo 'HEAD matches requested commit' || echo 'HEAD DOES NOT match requested commit'
printf '\n== changed files and diff ==\n'
git diff --name-status "$base" "$expected_head"
git diff --find-renames --find-copies --check "$base" "$expected_head"
git diff --find-renames --find-copies --unified=80 "$base" "$expected_head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
printf '\n== source outlines ==\n'
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all || true
ast-grep outline tests/test_materialize_base_python_requirements.py --items all || true
ast-grep outline tests/test_uv_redirect_boundary.py --items all || true
printf '\n== trusted downloader declarations, calls, and test references ==\n'
rg -n -C 5 -e 'TRUSTED_UV|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|user-agent|sha256|MAX_|platform\.system|platform\.machine|_use_supported_trusted_uv_runner' \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
printf '\n== repository-wide direct references to trusted downloader symbols ==\n'
rg -n -C 3 -e '\bTRUSTED_UV_[A-Z0-9_]+\b|\b_download_trusted_uv\b|\b_install_trusted_uv\b|\btrusted_uv\b' \
-g '*.py' .
printf '\n== PR metadata, current head, checks, and review state ==\n'
gh pr view 1008 --repo ContextualWisdomLab/.github \
--json number,url,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author,reviews,statusCheckRollup \
--jq '{number,url,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:(.author.login),reviews:[.reviews[]|{author:(.author.login),state,commit:(.commit.oid // null)}],checks:[.statusCheckRollup[]|{name,conclusion,status}]}'Length of output: 110503 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='d14ad6ca0260eabf1373213e76e521b98a57e86b'
repo='ContextualWisdomLab/.github'
echo '== complete trusted downloader and installer implementation =='
sed -n '160,320p' scripts/ci/materialize_base_python_requirements.py
echo '== exact trusted-download contract tests =='
sed -n '1,260p' tests/test_trusted_uv_download_contract.py
sed -n '1,180p' tests/test_trusted_uv_portability_and_streaming.py
sed -n '1,120p' tests/conftest.py
echo '== all urlopen call sites and trusted opener invocations =='
rg -n -C 4 '\burllib\.request\.urlopen\s*\(|\b_install_trusted_uv_url_opener\s*\(' -g '*.py' .
echo '== public function call sites that could supply download inputs =='
rg -n -C 3 '\b_download_trusted_uv_archive\s*\(|\b_install_trusted_uv\s*\(' -g '*.py' \
-g '!tests/**' .
echo '== exact-head GitHub check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name,conclusion,status,details_url,started_at,completed_at,app:.app.slug}' \
| jq -s
echo '== required status checks and branch protection =='
gh api "repos/${repo}/branches/main/protection" \
--jq '{required_status_checks,required_pull_request_reviews,required_linear_history,required_conversation_resolution,enforce_admins}' \
|| true
echo '== PR mergeability and exact-head reviews =='
gh api "repos/${repo}/pulls/1008" \
--jq '{head_sha:.head.sha,base_sha:.base.sha,mergeable,mergeable_state,merge_commit_sha,review_comments,comments,requested_reviewers:[.requested_reviewers[].login]}'
gh api "repos/${repo}/pulls/1008/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at,body}]'Length of output: 54342
I found no actionable code findings. The downloader uses one literal Astral HTTPS URL. It accepts no caller-controlled URL, header, or destination input. The dedicated opener disables proxies, rejects redirects, and sets only the fixed The existing boundary controls remain in place. They include final-origin validation, bounded streaming, pinned SHA-256 verification, fixed regular-member extraction, executable-size validation, Linux x86_64 gating, and exact The updated installer tests explicitly simulate Linux x86_64. The existing contract tests also cover the literal network sink, rejection of dynamic GitHub reports that the head is mergeable but currently blocked with I did not approve, merge, or modify the branch.
|
Pull request was converted to draft
|
@opencode-agent @cwl-noema-review Please independently review exact head |
|
Exact-current-head read-only review request for This bounded prerequisite addresses the observed trusted-uv HTTP 403 failure without widening the download origin, proxy, redirect, size, checksum, credential, reviewer, or merge boundary. Exact-head deterministic security and supply-chain workflows are terminal-success; auto-merge is armed subject to normal protection. @coderabbitai review Review read-only. Do not update the branch, synthesize author approval, weaken protection, or merge outside the normal protected path. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='d14ad6ca0260eabf1373213e76e521b98a57e86b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== exact revision =='
printf 'checked-out: '; git rev-parse HEAD
printf 'requested head exists: '; git cat-file -t "${head}^{commit}"
printf 'requested base exists: '; git cat-file -t "${base}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES=true' || echo 'HEAD_MATCHES=false'
git status --short
echo '== changed files and whitespace check =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --unified=100 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
echo '== source and test structure =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
ast-grep outline tests/test_materialize_base_python_requirements.py --items all
ast-grep outline tests/test_uv_redirect_boundary.py --items all
echo '== trusted downloader implementation =='
rg -n -C 12 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|sha256|MAX_|platform\.system|platform\.machine' \
scripts/ci/materialize_base_python_requirements.py
echo '== related tests and uses =='
rg -n -C 6 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|sha256|MAX_|platform\.system|platform\.machine|_use_supported_trusted_uv_runner' \
tests/test_materialize_base_python_requirements.py tests/test_uv_redirect_boundary.py
rg -n -C 3 \
'\b_download_trusted_uv_archive\s*\(|\b_install_trusted_uv\s*\(|\b_install_trusted_uv_url_opener\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== PR metadata and exact-head checks =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:(.author.login),checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,completed_at}]'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'Length of output: 116283
I found no actionable code findings. The trusted downloader keeps a literal Astral HTTPS URL at the network sink. It accepts no caller-controlled URL, header, or destination. The opener disables proxies, rejects redirects, and sets only the fixed The archive boundary still validates the final HTTPS origin and port. It still enforces bounded streaming, SHA-256 verification, fixed regular-member extraction, and executable-size limits. The installer still rejects non-Linux-x86_64 hosts and verifies the exact The updated installer tests explicitly simulate Linux x86_64. The redirect-boundary test verifies the fixed opener headers and the no-proxy/no-redirect handlers. Merge readiness is blocked. GitHub reports I did not approve, update, merge, or change protection settings. You are interacting with an AI system. |
|
@opencode-agent review current exact head |
|
@cwl-noema-review review current exact head |
|
@opencode-agent review current exact head |
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='2f5e6056fb7d99f30e9ad87be57ca78d836fba3e'
echo '== Exact commit identity =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested commit: '; git rev-parse "${head}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES_REQUESTED=true' || echo 'HEAD_MATCHES_REQUESTED=false'
git status --short
echo '== Pull request metadata =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author \
--jq '{number,headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:.author.login}'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
echo "base=${base}"
echo '== Changed files and diff checks =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --find-renames --unified=100 "$base" "$head"
echo '== Changed Python file structure =='
git diff --name-only "$base" "$head" -- '*.py' | while IFS= read -r file; do
[ -n "$file" ] && ast-grep outline "$file" --items all
done
echo '== Trusted downloader implementation and related tests =='
rg -n -C 10 \
'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|urlopen|build_opener|ProxyHandler|HTTPRedirectHandler|addheaders|User-Agent|sha256|MAX_|platform\.system|platform\.machine|GIT_DIR' \
scripts tests -g '*.py'
echo '== Trusted downloader external call sites =='
rg -n -C 4 \
'\b(_download_trusted_uv_archive|_install_trusted_uv|_install_trusted_uv_url_opener)\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== Exact-head check runs and reviews =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,completed_at}]'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'Length of output: 202411 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-NHn2gH'
repo='ContextualWisdomLab/.github'
pr='1008'
head='2f5e6056fb7d99f30e9ad87be57ca78d836fba3e'
echo '== Prior exact identity and metadata =='
rg -n -A12 -B2 '^== Exact commit identity ==|^== Pull request metadata ==|^base=|^HEAD_MATCHES' "$log" || true
echo '== Prior changed-file summary =='
rg -n -A80 -B2 '^== Changed files and diff checks ==' "$log" || true
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
echo '== Current identity and changed paths =='
printf 'HEAD='; git rev-parse HEAD
printf 'BASE='; printf '%s\n' "$base"
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
echo '== Compact current diff =='
git diff --unified=20 "$base" "$head"
echo '== Focused boundary-test source =='
sed -n '1,160p' tests/test_uv_redirect_boundary.py
sed -n '1,180p' tests/test_trusted_uv_download_contract.py
sed -n '1,130p' tests/test_trusted_uv_portability_and_streaming.py
sed -n '1,100p' tests/test_materialize_base_python_requirements.py
sed -n '1,290p' scripts/ci/materialize_base_python_requirements.py
echo '== Current exact-head PR state =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,statusCheckRollup \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,checks:[.statusCheckRollup[]|{name,status,conclusion}]}'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'Length of output: 55095
I found blocking issues.
The fixed GitHub reports I did not approve, merge, or modify the branch.
|
|
Exact-current-head read-only review request for The temporary branch-writing repair workflow and unrelated Git-environment test are absent from the final protected-base diff. The candidate is now the bounded three-file trusted-downloader change: fixed organization User-Agent plus supported-runner test modeling, while preserving the fixed HTTPS origin, no-proxy behavior, redirect rejection, size bound, audited sink, and SHA-256 verification. All current-head checks have restarted; no formal approval exists yet. @coderabbitai review Review read-only. Preserve reviewer identity, credential separation, exact-head binding, and branch protection. Do not mutate, self-approve, weaken gates, or merge outside the protected path. |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact head |
Rate Limit Exceeded
|
|
@opencode-agent @cwl-noema-review Please review the exact current head |
|
@opencode-agent review exact current head 5e73836 |
|
@cwl-noema-review exact current head 5e73836 |
|
@cwl-noema-review Review exact head |
|
@coderabbitai review exact current head |
|
@opencode-agent Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='1008'
head='5e73836229250e247433e3f3dd372f4881fe2edf'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact revision =='
printf 'checked-out HEAD: '; git rev-parse HEAD
printf 'requested HEAD: '; git rev-parse "${head}^{commit}"
printf 'requested base: '; git rev-parse "${expected_base}^{commit}"
test "$(git rev-parse HEAD)" = "$head" && echo 'HEAD_MATCHES_REQUESTED=true' || echo 'HEAD_MATCHES_REQUESTED=false'
git status --short
echo '== Pull request metadata =='
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author \
--jq '{headRefOid,baseRefOid,mergeStateStatus,reviewDecision,isDraft,author:.author.login}'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'resolved PR base: %s\n' "$base"
echo '== Protected-base changed paths and diff =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --unified=80 "$base" "$head" -- \
scripts/ci/materialize_base_python_requirements.py \
tests/test_materialize_base_python_requirements.py \
tests/test_uv_redirect_boundary.py
echo '== Changed-file structures =='
ast-grep outline scripts/ci/materialize_base_python_requirements.py --items all
ast-grep outline tests/test_materialize_base_python_requirements.py --items all
ast-grep outline tests/test_uv_redirect_boundary.py --items all
echo '== Trusted downloader implementation =='
sed -n '150,340p' scripts/ci/materialize_base_python_requirements.py
echo '== Related contract and boundary tests =='
fd -t f -e py . tests | sort | while IFS= read -r file; do
if rg -q 'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|_install_trusted_uv_url_opener' "$file"; then
echo "--- $file"
rg -n -C 5 'TRUSTED_UV|_download_trusted_uv|_install_trusted_uv|_install_trusted_uv_url_opener|User-Agent|addheaders|ProxyHandler|HTTPRedirectHandler|platform\.system|platform\.machine|sha256|MAX_' "$file"
fi
done
echo '== Non-test downloader call sites =='
rg -n -C 5 '\b(_download_trusted_uv_archive|_install_trusted_uv|_install_trusted_uv_url_opener)\s*\(' \
-g '*.py' -g '!tests/**' .
echo '== Exact-head checks and review state =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | {name,status,conclusion,app:.app.slug,completed_at}]'
gh api "repos/${repo}/pulls/${pr}/reviews" \
--jq '[.[] | {user:.user.login,state,commit_id,submitted_at}]'Length of output: 78770 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='5e73836229250e247433e3f3dd372f4881fe2edf'
echo '== Structural trusted-download contract =='
sed -n '1,220p' tests/test_trusted_uv_download_contract.py
echo '== Streaming and platform contract =='
sed -n '1,150p' tests/test_trusted_uv_portability_and_streaming.py
echo '== Redirect and coverage contract =='
sed -n '1,120p' tests/test_uv_redirect_and_coverage_contract.py
echo '== Header assignment and downloader request construction references =='
rg -n -C 5 'TRUSTED_UV_USER_AGENT|addheaders|urllib\.request\.Request|urlopen\s*\(' \
scripts/ci/materialize_base_python_requirements.py tests -g '*.py'
echo '== Failed strix check metadata =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.name == "strix") | {id,name,status,conclusion,details_url,output,started_at,completed_at}'Length of output: 20990 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
check_run_id='95007835293'
gh api "repos/${repo}/check-runs/${check_run_id}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,message,title,raw_details}'Length of output: 550
I found no actionable source finding in the requested three-file delta. The downloader uses one literal Astral HTTPS URL. It does not accept a caller-controlled URL, The existing size bound, final-origin validation, SHA-256 pin, archive-member validation, executable-size check, and exact-version check remain unchanged. The Linux x86_64 test fixture changes test attributes only. The production platform gate still fails before network access on unsupported runners. Merge readiness is not established. The exact-head I did not approve, modify, or merge the pull request. You are interacting with an AI system. |
|
Please review the exact current head, focusing on the fixed-origin/no-proxy/no-redirect trusted-download boundary, immutable checksum verification, platform/architecture handling, and whether any caller-controlled input can influence request headers, URL selection, cache identity, or executable selection. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
2 participants
Summary
User-Agenton the existing trusteduvopener.Root cause
Central
coverage-evidencecan receive an upstream HTTP 403 when Python uses its default request identifier. The pinned archive succeeds through the same fixed trust boundary when the request carries the fixed organization identifier. No URL, redirect target, proxy, caller-supplied header, or integrity input becomes dynamic.Exact current scope
Exact head:
c34b367d0926af0f14a9186b0e8dd64dbeb06077Protected base:
main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dbaThe live protected-base diff is limited to four files:
scripts/ci/materialize_base_python_requirements.pytests/test_materialize_base_python_requirements.pytests/test_uv_redirect_boundary.pytests/test_uv_workspace_fail_closed.pyThe temporary branch-writing repair workflow is absent from the live diff. The current fourth file is a focused fail-closed regression for workspace/output handling, not a persistent workflow or downstream repository change.
Exact-head validation state
All merge evidence binds to exact head
c34b367d0926af0f14a9186b0e8dd64dbeb06077; predecessor-head validation is diagnostic only.Every currently visible exact-head repository workflow is terminal-success:
No queued, in-progress, failed, skipped-required, or
action_requiredrepository workflow remains on this exact head.Review/protection gate
The exact-head checks are green, but this PR is not merge-ready yet. The formal review list still contains only a GHAS
COMMENTEDreview; no qualifying independent non-author approval is recorded. Do not self-approve, use administrative bypass, or infer approval from automated check success. Normal branch protection, independent-approval, last-push, resolved-thread, and exact-head evidence requirements remain authoritative.Downstream evidence and dependency order
This PR is the bounded control-plane prerequisite for central coverage/review reruns that have been failing before leaf-repository tests while materializing protected-base Python locks.
For
ContextualWisdomLab/bandscope#783at exact head6f81f52c193c1e327d078eba7a2ea3bdbfbc87c2, repository-owned CI, build, release, SBOM, SAST, Bandit, secret-scan, security-audit, and Security Scan are terminal-success, while predecessor central coverage failed at trusted uv materialization withtrusted uv archive download failed: HTTPError. That is the central downloader failure family corrected here, not a BandScope source finding.Do not redispatch unchanged BandScope reviewer-agent work until this prerequisite reaches protected central
main; exact-current-head central evidence generated before protected integration cannot prove that downstream repositories inherited the fix. After protected merge, rerun central coverage/review once for each then-current BandScope head that otherwise satisfies its repository gates. PR #790 remains a separate complementary lane for explicitly classified transient transport retries and broader materializer hardening; do not conflate a permanent identification/403 repair with retry semantics.Summary by CodeRabbit
개선 사항
uv다운로드 요청에 식별용 User-Agent가 추가되었습니다.테스트