fix(coverage): discover hash-pinned requirements lock files

[seonghobae]

Root cause

The trusted base Python coverage materializer only recognized requirements.lock and requirements*.txt. Repositories using requirements-dev.lock were therefore measured without their async test plugin; pg-erd-cloud #931 recorded 133 async test failures and coverage evidence failed.

Change

• accept requirements*.lock alongside existing hash-pinned .txt candidates
• add a focused candidate-name regression test

Verification

• python -m pytest -q tests/test_materialize_base_python_requirements.py (43 passed)
• ruff check scripts/ci/materialize_base_python_requirements.py tests/test_materialize_base_python_requirements.py
• git diff --check

Current branch head: f0823bb.

Summary by CodeRabbit

• 개선 사항

  • requirements-dev.lock과 같은 다양한 잠금 파일을 요구사항 파일로 인식하도록 지원 범위를 확장했습니다.
  • 기존에 제외되던 요구사항 파일 패턴은 계속 제외됩니다.
  • 관련 파일 판별 문서를 최신 동작에 맞게 업데이트했습니다.

• 테스트

  • 개발용 잠금 파일이 올바르게 인식되는지 검증하는 테스트를 추가했습니다.

[seonghobae]

@opencode-agent review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 68374097-fa17-4800-b4b4-ce108e22e17a

📥 Commits

Reviewing files that changed from the base of the PR and between 2cce96f and 666153a.

📒 Files selected for processing (2)

• scripts/ci/materialize_base_python_requirements.py
• tests/test_materialize_base_python_requirements.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

_is_candidate_lock_name이 requirements*.lock 파일을 허용합니다. 기존 .txt 후보와 CI 해시 파일 제외 규칙은 유지됩니다. 테스트는 requirements-dev.lock을 검증합니다.

Changes

requirements 잠금 파일 후보 확장

Layer / File(s)	Summary
잠금 파일 후보 판별 및 테스트 scripts/ci/materialize_base_python_requirements.py, tests/test_materialize_base_python_requirements.py	requirements*.lock 패턴을 후보로 허용합니다. 경로 판별 설명을 갱신합니다. requirements-dev.lock 테스트를 추가합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 66615

The change broadens coverage-materializer discovery to include hash-pinned lock files and adds a focused regression test; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• ContextualWisdomLab/.github#939: requirements 잠금 파일 탐색 로직을 도입했으며, 이번 변경은 허용 파일명 패턴을 확장합니다.
• ContextualWisdomLab/.github#1057: 동일한 스크립트와 테스트의 잠금 파일 후보 판별을 변경했습니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 hash-pinned requirements lock 파일을 검색하도록 변경한 PR의 주요 내용을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/coverage-discover-lock-files-20260820

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head verification for f0823bb5 against main@c47bee59: hash-pinned requirements discovery tests passed (43 passed); compileall and diff checks passed. The materializer still reads only exact-base committed bytes and excludes unpinned/irrelevant lock names; review this exact head only.

[seonghobae]

@opencode-agent Review exact current head f0823bb5 against main@c47bee59. Inspect exact-base hash-pinned requirements discovery, path/content bounds, generated manifest provenance, and coverage evidence. Do not reuse predecessor evidence.

[seonghobae]

Verified the two-file requirements-lock discovery change on exact HEAD f0823bb against c47bee5: 43 focused tests, interrogate 100%, compileall, and diff --check. It adds requirements*.lock discovery while retaining the existing bounded path and hash gates. Please review this exact head.

[seonghobae]

@opencode-agent review exact current head f0823bb against base c47bee5, including the candidate-lock naming boundary and regression tests.

[seonghobae]

@opencode-agent Review exact current head 666153a against main@2cce96f8. Rebased the lock-discovery change onto current main; requirements*.lock and existing requirements*.txt discovery remain content/hash gated. Verified: 43 focused tests passed, compileall, interrogate, and git diff --check.

[seonghobae]

@opencode-agent review exact head 666153a9510db18dca4c34977d40d9d559090224. Verify that requirements*.lock discovery remains bounded by the existing authenticated-blob and complete hash-closure validation, and that generated CI hash locks or unrelated lock formats cannot be admitted as executable dependency input.

[seonghobae]

@opencode-agent Review current exact head 666153a9510db18dca4c34977d40d9d559090224. Verify that requirements*.lock discovery remains path- and integrity-neutral: candidate-name expansion must not bypass the existing immutable-base regular-blob, include-graph, exact-pin, and SHA-256 closure validation; conventional requirements.lock, requirements-dev.lock, and hash-pinned .txt behavior must remain intact; generated requirements-*-ci-hashes.txt exclusions must not regress. Reacquire exact-head Trusted uv Materializer, security, SAST, Python/CodeQL, coverage and docstring evidence, then submit the formal review. Do not alter or merge the branch.

[seonghobae]

@opencode-agent Review the current exact head for the trusted Python lock-materializer repair. Verify requirements*.lock discovery remains confined to regular, authenticated base-tree lock candidates; hash/include validation, path containment, duplicate handling, and independent pip --require-hashes closure must remain fail-closed. Confirm the focused regression covers requirements-dev.lock without admitting arbitrary .lock files, then reacquire the complete exact-head quality, security, CodeQL, SAST, dependency/SBOM, and formal review evidence. Do not alter the branch.

[seonghobae]

Integrated current main normally at 107c572. Focused materializer suite passed (43 tests), actionlint, ruff, and diff checks passed. Re-review and re-run the exact-head required checks.

@OpenCode review this exact HEAD and report only current-head findings.

[seonghobae]

@opencode-agent review this exact current HEAD. Use the current commit SHA, current Checks, and current diff; do not reuse prior approvals or prior-head evidence.

[seonghobae]

Independent current-head verification for 107c572ab1ea077333c1199e98c734957a305ff6: materialization tests 43 passed; Ruff, compileall, and git diff --check passed. Please review this exact head and publish the required independent approval if no issues remain.