feat(coverage): add bounded PyO3 peer-evidence gate - #789
Conversation
📝 WalkthroughWalkthroughPyO3/maturin 네이티브 확장 수집 실패 분류기와 안전한 증거 파일 처리를 추가했습니다. 정확한 PR HEAD의 Python·Rust·package CheckRun 성공을 검증하고, 결과를 OpenCode 승인 흐름과 품질 CI에 연결했습니다. ChangesPython 네이티브 확장 peer-gate
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant PythonTest as Python 테스트 실행
participant Classifier as classify-pytest
participant GitHub as GitHub CheckRuns
participant PeerGate as require-checks
participant Approval as OpenCode 승인 흐름
PythonTest->>Classifier: 로그·pyproject 스냅샷·변경 파일 전달
Classifier-->>PythonTest: PASS 또는 DEFERRED 모듈명
Approval->>GitHub: PR HEAD의 CheckRun 조회
GitHub-->>PeerGate: Python·Rust·package CheckRun JSON
PeerGate-->>Approval: exact-head 성공 여부
Approval-->>Approval: peer check 충족 시 승인 진행
Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent address Integrate the published PyO3 native-extension helper into the protected central OpenCode coverage/review path on this same branch; keep the PR Draft until the integration is complete and exact-head evidence passes. Mirror the existing fail-closed R peer-evidence pattern rather than creating a second privileged reviewer. Required behavior:
Update the doctoring and CHANGELOG to distinguish source-only measurement, trusted native peer evidence, and remaining interpretation limits. Preserve immutable called-workflow source, reviewer credentials, NVIDIA/OpenCode model policy, independent approval, unresolved-thread, and branch-protection boundaries. |
|
@jules Implement the remaining central workflow integration on this existing Draft PR. Preserve the published helper and fail-closed trust boundary; do not create another PR or temporary workflow. Required scope:
Do not build PR-selected native code in the central sandbox, add a compatibility stub, skip product tests, use networked PR execution, change reviewer tokens or NVIDIA/OpenCode policy, weaken approval/protection gates, mark Ready, merge, or release. Commit as normal descendants without force-push, and report exact verification commands and the final head SHA. |
|
@jules Implement the remaining integration directly on this branch; do not create any temporary, self-modifying, encoded-patch, or branch-writing workflow. Required GREEN slice:
After integration, rerun OpenCode review for unchanged |
|
@jules Integrate the committed helper into the central Required fail-closed flow:
Do not build PR-selected native code inside the central sandbox, introduce a Python stub, auto-approve, weaken required checks, use COPILOT_GITHUB_TOKEN, or disturb the existing reviewer-agent secret contract. Update APA 7 doctoring and the authoritative changelog after GREEN. |
|
@coderabbitai Review the current Draft head |
Rate Limit Exceeded
|
|
Prepare the next bounded integration only after For the eventual current-main integration:
Keep Draft. Do not mutate the authoritative workflow from the pre-#759 base, approve, or merge. |
|
@jules Implement the existing TDD RED workflow contracts on exact live head Precondition: before every write, re-read the live head and stop without mutation unless it is the expected current head or your own direct descendant. Coverage integrationIn Initialize exactly: python_native_peer_check_required=0Only after a Python configured/default pytest/coverage command actually fails:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
--log "$log_file" \
--pyproject "$project_dir/pyproject.toml" \
--changed-files "$changed_files_file" \
--repo-root "$COVERAGE_SOURCE_WORKDIR"
and set In the compact PASS decision, when the variable is 1, emit exactly: Do not build/install PR-selected native code, add a Python stub, skip tests, or grant network access. Approval integrationMirror—but do not replace—the existing R peer-check pattern. Add independent functions that:
python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" require-checks \
--checks-json "$checks_file" \
--head-sha "$HEAD_SHA" \
--required-check "CI::python" \
--required-check "CI::rust" \
--required-check "CI::package"
Call this gate in both approval paths that already call Permanent tests and verificationMake the current tests GREEN without weakening them: python -m pytest -q \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_nested_project.py \
tests/test_python_native_extension_peer_gate_workflow_contract.pyThen run the permanent Python 3.10/3.14 quality workflow, focused and complete 100% production statement/branch coverage, interrogate 100%, compileall, actionlint, full central tests, security and supply-chain checks. Fix actual failures only. Preserve After GREEN, report the exact final SHA and verification commands in a PR comment. Do not request approval or change Draft state. |
|
Exact-head quality run @jules Implement the central workflow integration now rather than weakening these tests. Preserve the existing R peer gate and privileged reviewer chain. After GREEN, run full central coverage/docstrings/actionlint and replay OpenCode review against exact fast-mlsirm heads #546, #549, and #550. |
|
@opencode-agent address Fix the exact current-head quality failure on Run
Implement the documented fail-closed flow:
After GREEN, run all 90 focused tests at 100% statement/branch coverage, the complete central suite, interrogate 100%, compileall, actionlint, Python 3.10 compatibility, security workflows, and exact-head review. Keep Draft, |
|
@jules Implement the missing production integration on current branch |
|
@opencode-agent address Implement the committed workflow-integration RED contract on this Draft branch. Do not weaken the helper or tests. Preserve the existing R peer gate and reviewer credential chain. The central coverage job must capture bounded combined pytest output and status, classify only the exact unchanged maturin/PyO3 module-absence collection failure, then require trusted exact-head After GREEN, run the permanent workflow contracts, full central coverage/docstrings/actionlint/security, then replay exact current heads of fast-mlsirm #546, #549, and #550. |
|
Review-only request for exact current head Please inspect the five-file repair for all four addressed CodeRabbit findings: runner-owned pytest-log placement, rename-as-delete/add boundary inventory, fail-closed cursor pagination across every exact-head CheckRun page, and repository-wide The exact-head focused quality workflow 31570671841 and Strix workflow 31570671729 are terminal-success. Other security/supply-chain checks remain queued; they are separate gate evidence and must not be interpreted as semantic source findings or approval. Do not modify the branch, approve on behalf of the author, merge, release, weaken protection, or reuse predecessor-head review evidence. |
|
Exact-current-head review request for Review the complete 13-file bounded PyO3 peer-evidence gate: defer only complete pytest collection failures caused exclusively by the unchanged declared native module; sealed regular Keep the exact head unchanged. Do not transfer predecessor evidence, synthesize author approval, build PR-selected native code in the source sandbox, treat deferral as success, relax peer-check/path/file boundaries, merge, release, or bypass protection. @coderabbitai review |
|
@opencode-agent address Finish this existing Draft PR in place. Do not create a stacked PR, compatibility stub, temporary branch writer, or networked execution of PR-selected native code. Integrate
Keep Draft until the direct canonical integration and all same-head gates are green. Do not approve, merge, release, alter reviewer credentials/protections, or use |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='9299a4515b3436607bbad895bf1c73205dce3582'
repo='ContextualWisdomLab/.github'
pr='789'
echo '== checked-out HEAD =='
git rev-parse HEAD
echo '== expected head =='
printf '%s\n' "$expected_head"
echo '== PR metadata =='
gh pr view "$pr" --repo "$repo" --json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,reviewDecision
echo '== changed files against base =='
git diff --name-status '6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba...HEAD'
echo '== relevant file outlines =='
ast-grep outline scripts/ci/python_native_extension_peer_gate.py --items all --view expanded
ast-grep outline tests/test_python_native_extension_peer_gate_workflow_contract.py --items all --view expanded
echo '== workflow symbols and integration references =='
rg -n -C 4 \
-e 'r_peer_check_required' \
-e 'python_native_peer_check_required' \
-e 'python_native_extension_peer_gate\.py' \
-e 'classify-pytest' \
-e 'require-checks' \
-e 'Python native-extension source-only deferral' \
-e 'Python native-extension peer evidence' \
.github/workflows/opencode-review-dispatch.yml
echo '== helper exact-head and changed-file logic references =='
rg -n -C 3 \
-e 'def (classify_pytest_inputs|has_required_exact_head_checks|_read_bounded_regular)' \
-e 'requirements|constraints|pyproject|rename|previous|old' \
-e 'endCursor|hasNextPage|CheckRun|workflow' \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
echo '== current-head check runs =='
gh api --paginate \
"/repos/ContextualWisdomLab/.github/commits/$expected_head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha,.details_url] | `@tsv`' || true
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved comments(first: 1) { nodes { author { login } body } } }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | [.comments.nodes[0].author.login, .comments.nodes[0].body] | `@json`' || trueLength of output: 78558 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== coverage execution and PyO3 classification =='
sed -n '780,1020p' .github/workflows/opencode-review-dispatch.yml
echo '== changed-file inventory function =='
rg -n -A100 -B10 'changed_files_for_coverage\(\)' .github/workflows/opencode-review-dispatch.yml
echo '== coverage summary, outputs, and transfer boundary =='
sed -n '2030,2140p' .github/workflows/opencode-review-dispatch.yml
rg -n -C5 -e 'COVERAGE_EVIDENCE_SUMMARY' -e 'r_peer_check_required' -e 'python_native_peer_check_required' .github/workflows/opencode-review-dispatch.yml
echo '== Python native peer collector and gate call sites =='
sed -n '7180,7425p' .github/workflows/opencode-review-dispatch.yml
rg -n -C5 -e 'coverage_defers_to_python_native_peer_checks' -e 'require_successful_python_native_peer_checks' -e 'collect_successful_python_native_peer_check_evidence' .github/workflows/opencode-review-dispatch.yml
echo '== helper implementations =='
sed -n '64,165p' scripts/ci/python_native_extension_peer_gate.py
sed -n '168,398p' scripts/ci/python_native_extension_peer_gate.py
sed -n '399,536p' scripts/ci/python_native_extension_peer_gate.py
echo '== complete workflow-contract tests =='
cat -n tests/test_python_native_extension_peer_gate_workflow_contract.py
echo '== focused base-to-head diff =='
git diff --no-ext-diff --unified=40 '6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba...HEAD' -- \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py \
tests/test_python_native_extension_peer_gate_file_safety.py \
tests/test_python_native_extension_peer_gate_requirements_directory.pyLength of output: 161049 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== all Python native peer-gate call sites and enclosing control flow =='
rg -n -C 18 \
-e 'require_python_native_peer_checks_for_deferred_coverage\(\)' \
-e 'require_python_native_peer_checks_for_deferred_coverage' \
-e 'COVERAGE_EVIDENCE_RESULT' \
-e 'create_pull_review.*APPROVE' \
-e 'create_pull_review_with_payload.*APPROVE' \
.github/workflows/opencode-review-dispatch.yml
echo '== verifier and test coverage for duplicate CheckRun records =='
rg -n -C 8 \
-e 'len\(matches\)' \
-e 'duplicate' \
-e 'successful_checks' \
-e 'has_required_exact_head_checks' \
-e 'require-checks' \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py \
scripts/ci/python_native_extension_peer_gate.py
echo '== final coverage decision and all result markers =='
rg -n -C 4 \
-e 'Coverage Decision' \
-e 'Result: PASS' \
-e 'Result: DEFERRED' \
-e 'Test evidence: supported repository test suites passed' \
.github/workflows/opencode-review-dispatch.yml
echo '== permanent quality workflow =='
cat -n .github/workflows/python-native-extension-peer-gate-quality-ci.yml
echo '== doctoring and changelog references =='
rg -n -C 3 \
-e 'DEFERRED|CheckRun|PyO3|maturin|source-only|exact-head|duplicate|rerun' \
CHANGELOG.md \
docs/doctoring/python-native-extension-peer-evidence.md \
docs/doctoring/python-native-extension-peer-file-safety.md
echo '== PR review and latest current-head check suites =='
gh pr view 789 --repo ContextualWisdomLab/.github --json isDraft,reviewDecision,reviews,headRefOid
gh api "/repos/ContextualWisdomLab/.github/commits/9299a4515b3436607bbad895bf1c73205dce3582/check-suites?per_page=100" \
--jq '.check_suites[] | [.app.slug,.status,.conclusion,.head_sha,.workflow_run.url] | `@tsv`' || trueLength of output: 90605
[P1] Reject duplicate matching CheckRun recordsIn The function checks only that This conflicts with the stated fail-closed contract. Duplicate same-head Update the verifier to require exactly one matching record for each required I also verified these non-source conditions:
I applied the repository rule that only successful checks on the exact current head count as merge evidence. I do not approve this PR. 🧠 Learnings usedYou are interacting with an AI system. |
Record the inclusion-of-untrusted-control-sphere prohibition so a source-only sandbox cannot treat a missing compiled extension as license to run pull-request maturin or cargo hooks. Force the trusted-uv installer tests onto the linux x86_64 runner path and add the control-plane architecture diagram.
|
Hourly loop 2026-08-13: re-read exact head Current head already implements each one:
Removed stale |
A markdown file in docs/requirements/ is not a lock or packaging change. Only .in/.txt/.lock names in a requirements path invalidate source-only sandbox deferral.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
8c43ca2ae0d9a5dfc095d00a6bf2e4010bdae0dc. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098988/job/94413742812)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099028/job/94412021282)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098986/job/94412021495)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098986/job/94412021495)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098988/job/94412021089)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099312/job/94412022459)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098988/job/94413742812)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098988/job/94412021089)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098988/job/94413742743)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099051/job/94412021583)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099044/job/94412021317)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099054/job/94412021539)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099054/job/94412021539)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099075/job/94412021627)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021811)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021844)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021725)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021747)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099051/job/94412021583)
- Strix Security Scan/publish-manual-pr-evidence-status: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099005/job/94413750517)
- Strix Security Scan/strix: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099005/job/94412021833)
- Strix Security Scan/strix: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099005/job/94412021833)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099028/job/94412021282)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099038/job/94413730030)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021811)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099044/job/94412021317)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099075/job/94412021627)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099312/job/94412022459)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021844)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689098988/job/94413742743)
- publish-manual-pr-evidence-status check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099005/job/94413750517)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099038/job/94412021617)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021725)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31689099058/job/94412021747)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: python_native_extension_peer_gate.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: python_native_extension_peer_gate.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (8 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (8 files)"]
R5 --> V5["targeted test run"]
|
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
50bfccf0061f3d0df413b8ee3a174a404aaae62b. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033018/job/94545101818)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729030248/job/94544503596)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033093/job/94544513151)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033093/job/94544513151)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033018/job/94544513249)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033549/job/94544514706)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033018/job/94545101818)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033018/job/94544513249)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033018/job/94545101911)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032983/job/94544512547)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033006/job/94544512836)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032943/job/94544512701)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032943/job/94544512701)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033010/job/94544512705)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544513117)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544512821)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544512809)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544512725)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032983/job/94544512547)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31729030143/job/94614264183)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31729030143/job/94614264183)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729030248/job/94544503596)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729030148/job/94545126482)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544513117)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033006/job/94544512836)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033010/job/94544512705)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033549/job/94544514706)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544512821)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729033018/job/94545101911)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729030148/job/94544503630)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544512809)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31729032992/job/94544512725)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (8 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (8 files)"]
R5 --> V5["targeted test run"]
|
Exact-current-head revalidation for The dedicated Python Native Extension Peer Gate Quality CI and Strix Changed Path Quality CI succeeded. Nine generic security/supply-chain runs were cancelled rather than accepted; I have explicitly re-run their cancelled jobs on this unchanged head. Treat them as pending until terminal. After they complete, submit a current-head read-only verdict only; predecessor-head approvals or findings do not transfer. Do not mutate the branch, self-approve, weaken protection, or merge. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='789'
head='50bfccf0061f3d0df413b8ee3a174a404aaae62b'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== PR metadata =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,reviewDecision,mergeStateStatus
echo '== checked-out commit =='
git rev-parse HEAD
echo '== requested base...head changed files =='
git diff --name-status "$base...$head"
echo '== exact-head check suites =='
gh api "/repos/$repo/commits/$head/check-suites?per_page=100" --paginate \
--jq '.check_suites[] | [.app.slug, .status, (.conclusion // "null"), .head_sha, (.workflow_run.html_url // "")] | `@tsv`' || true
echo '== exact-head check runs =='
gh api "/repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | [.name, .status, (.conclusion // "null"), .head_sha, .html_url] | `@tsv`' || true
echo '== unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| .comments.nodes[0]
| [.author.login, (.path // ""), (.line // 0), .body] | `@json`' || true
echo '== workflow integration references =='
rg -n -C 4 \
-e 'python_native_peer_check_required' \
-e 'python_native_extension_peer_gate\.py' \
-e 'classify-pytest' \
-e 'require-checks' \
-e 'Python native-extension source-only deferral' \
-e 'r_peer_check_required' \
.github/workflows/opencode-review-dispatch.yml
echo '== helper and contract-test outlines =='
ast-grep outline scripts/ci/python_native_extension_peer_gate.py --items all --view expanded
ast-grep outline tests/test_python_native_extension_peer_gate_workflow_contract.py --items all --view expanded
echo '== focused source diff =='
git diff --no-ext-diff --unified=24 "$base...$head" -- \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_file_safety.py \
tests/test_python_native_extension_peer_gate_requirements_directory.pyLength of output: 117272 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='789'
head='50bfccf0061f3d0df413b8ee3a174a404aaae62b'
strix_run='31729030143'
strix_job='94614264183'
echo '== failed Strix job log tail =='
gh run view "$strix_run" --repo "$repo" --job "$strix_job" --log-failed 2>&1 | tail -n 240 || true
echo '== duplicate matching-CheckRun handling and regression coverage =='
rg -n -C 6 \
-e 'len\(matches\)' \
-e 'if not matches' \
-e 'duplicate.*[Cc]heck' \
-e 'append\(.*successful' \
scripts/ci/python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate.py \
tests/test_python_native_extension_peer_gate_workflow_contract.py
echo '== latest PR reviews on the current head =='
gh pr view "$pr" --repo "$repo" --json reviews,comments \
--jq '{
reviews: [.reviews[] | {
author: .author.login,
state,
commit: .commit.oid,
submittedAt,
body
}],
comments: [.comments[] | {
author: .author.login,
createdAt,
body
}]
}' || true
echo '== exact-head check summary after inspection =='
gh api "/repos/$repo/commits/$head/check-runs?per_page=100" --paginate \
--jq '.check_runs[]
| select(.name == "strix"
or .name == "Python 3.14 full quality gate"
or .name == "Python 3.10 compatibility contract"
or .name == "coverage-evidence"
or .name == "opencode-review"
or .name == "Semgrep (multi-language SAST)"
or .name == "gitleaks (secret scan)"
or .name == "generate-sbom"
or .name == "osv-scan / osv-scan"
or .name == "Scorecard")
| [.name, .status, (.conclusion // "null"), .html_url] | `@tsv`' || trueLength of output: 200292
Blocking source finding
The function requires only a nonempty This does not fail closed for ambiguous rerun evidence. A second same-head Add a regression that appends a second successful matching record and verifies that Current-head gate statusI verified the requested head and base:
The current head has these non-success states:
I treat the cancelled jobs as non-evidence. I treat the reruns as pending until they reach terminal success on this exact head. I do not transfer predecessor evidence. GitHub also reports that I do not approve this PR. ✏️ Learnings added
You are interacting with an AI system. |
1 participant
Buyer-visible blocker
Central OpenCode coverage can fail before pytest collection in maturin/PyO3 repositories because the source-only sandbox intentionally does not build or import an unchanged compiled extension. Treating that environment limitation as an ordinary source-test failure blocks otherwise valid exact-head review evidence; treating it as success would weaken the gate.
Bounded peer-evidence repair
pyproject.tomlbefore untrusted tests; reject symlinked ancestors, final links, non-regular files, device/inode/path drift, growth, malformed input, and bounded-read overflow.requirements/dependency path, workflow/action files, or any repositorypyproject.toml.docs/requirements/from dependency inputs.DEFERRED, neverPASS.CI::python,CI::rust, andCI::package, with bounded complete GraphQL pagination and rejection of stale, pending, failed, status-only, lookalike, missing, or duplicate contexts.Exact identity and scope correction
791ca881f50360b24825dbdcba848f2c6ace7920;main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;The final protected-base diff is limited to the peer-evidence vertical slice:
.github/workflows/opencode-review-dispatch.yml.github/workflows/python-native-extension-peer-gate-quality-ci.ymlscripts/ci/python_native_extension_peer_gate.pydocs/doctoring/python-native-extension-peer-evidence.mddocs/doctoring/python-native-extension-peer-file-safety.mdCHANGELOG.mdThe overlapping
AGENTS.md,CLAUDE.md, and rootARCHITECTURE.mdchanges were removed because PR #896 owns the canonical central documentation graph. Requirements-directory lock discovery and its materializer tests were restored to protected-main content because PR #785 owns that independent trust boundary.Verification lineage
The prior bounded head and review-driven repairs reported focused and complete suites with 100% owned production statement/branch coverage and complete public docstrings. Those results prove predecessor trees only. The current head must regenerate every applicable exact-head quality, security, supply-chain, and semantic-review result.
Security and merge gate
This PR does not skip tests, build PR-selected extensions, enable sandbox network access, introduce a Python substitute for Rust arithmetic, or convert missing evidence into success. Keep Draft until the unchanged current head completes the peer-gate/full-suite, exact 100% owned statement/branch coverage, public-docstring, security, SAST, dependency/SBOM, and semantic-review cycle with zero valid unresolved findings. Then mark Ready and require qualifying non-author exact-head approvals plus normal protected-main last-push semantics. No self-approval, stale evidence, temporary writer, administrative bypass, or weakened gate is authorized.
After protected integration, a real affected PyO3 consumer must rerun the protected-main path before incident closure.