fix(scheduler): accept safe Unicode pull-request refs - #940
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthrough스케줄러가 이모지와 한글을 포함한 유효한 Unicode Git ref를 허용하도록 검증을 변경했습니다. 제어 문자, 공백, 셸 메타문자 및 위험한 Git 경로 형식은 계속 거부합니다. 관련 변경은 exact-head 품질 CI를 실행합니다. Changes스케줄러 Git ref 검증
스케줄러 품질 CI 연결
Estimated code review effort: 3 (보통) | ~20 minutes Merge Risk: ⚪ Minimal · up to The change accepts safe GitHub-valid Unicode branch names while preserving unsafe-ref rejection and adds exact-head quality coverage for scheduler changes. No actionable merge-blocking risk remains after normal checks and review. Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review Review exact current head |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='b999b0593267f6be6504d88db73a6a1b0bd754c5'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Local commit identity and ancestry =='
git rev-parse HEAD
git merge-base HEAD "$expected_base"
git rev-list --left-right --count "$expected_base...HEAD"
git diff-tree --no-commit-id --name-status -r HEAD
git diff --check "$expected_base...HEAD"
echo '== Changed-file outlines =='
git diff --name-only "$expected_base...HEAD" | while IFS= read -r path; do
printf '\n-- %s --\n' "$path"
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
*) sed -n '1,260p' "$path" ;;
esac
done
echo '== Exact patch =='
git diff --find-renames --find-copies --unified=80 "$expected_base...HEAD"Length of output: 42964 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='b999b0593267f6be6504d88db73a6a1b0bd754c5'
echo '== Pull request metadata =='
gh pr view "$pr" --repo "$repo" --json number,state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup
echo '== Check runs for the requested commit =='
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha,.details_url] | `@tsv`'
echo '== Workflow runs for the requested commit =='
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.head_sha,.event,.html_url] | `@tsv`'
echo '== Review threads and reviews =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body } } }
}
reviews(first: 100) { nodes { author { login } state commit { oid } } }
}
}
}' --jq '.data.repository.pullRequest'Length of output: 45371 🏁 Script executed: #!/bin/bash
set -euo pipefail
file='scripts/ci/pr_review_merge_scheduler.py'
echo '== Process execution and validation boundaries =='
sed -n '420,610p' "$file"
echo '== Ref-validation call sites =='
rg -n -C 5 '\bvalidate_git_ref\s*\(' "$file"
echo '== Dispatch and merge/update mutation paths =='
sed -n '1450,1590p' "$file"
sed -n '1770,2165p' "$file"
echo '== Structured process invocation sites =='
rg -n -C 4 '\brun(?:_github_(?:read|actions|dispatch))?\s*\(' "$file"
echo '== PR ref field use sites =='
rg -n -C 4 '(?:baseRefName|headRefName|baseRefOid|headRefOid)' "$file"
echo '== Unicode regression test context =='
sed -n '140,260p' 'tests/test_pr_review_merge_scheduler.py'Length of output: 56407
No code findings.
I applied the stored exact-current-head evidence policy during this review. This review does not provide independent human approval or merge authorization. 🧠 Learnings used
|
|
@opencode-agent review Review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='b999b0593267f6be6504d88db73a6a1b0bd754c5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit and scope =='
printf 'HEAD: '; git rev-parse HEAD
printf 'Expected head object: '; git rev-parse "$head^{commit}"
printf 'Merge base: '; git merge-base "$head" "$base"
printf 'Ahead/behind: '; git rev-list --left-right --count "$base...$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "$base...$head"
git diff --find-renames --unified=100 "$base...$head"
echo '== Changed-file structure =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
printf '\n-- %s --\n' "$path"
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
*) sed -n '1,280p' "$path" ;;
esac
done
echo '== Validator, structured invocation, and authority boundaries =='
file='scripts/ci/pr_review_merge_scheduler.py'
rg -n -C 12 '\bvalidate_git_ref\s*\(' "$file"
rg -n -C 8 '(?:subprocess\.(?:run|Popen|check_output|check_call)|\brun(?:_github_(?:read|actions|dispatch))?\s*\(|shell\s*=|gh\s+api|repository-dispatch)' "$file"
rg -n -C 8 '(?:permissions:|credential|token|merge|update-ref|restamp|dispatch|baseRefName|headRefName|headRefOid|baseRefOid)' "$file"
echo '== Unicode regression tests =='
test_file='tests/test_pr_review_merge_scheduler.py'
rg -n -C 16 '(?:validate_git_ref|🎨|Korean|Korean|zero.width|non.breaking|\.lock|HEAD|@\{|hidden|traversal)' "$test_file"
echo '== Current remote PR and exact-head checks =='
gh pr view "$pr" --repo "$repo" \
--json state,headRefOid,baseRefOid,changedFiles,mergeable,reviewDecision,statusCheckRollup
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated } }
reviews(first: 100) { nodes { author { login } state commit { oid } } }
}
}
}' --jq '.data.repository.pullRequest'Length of output: 228340
No code findings.
I applied the stored exact-current-head evidence policy. Direct exact-head checks with This review does not provide independent human approval or merge authorization. 🧠 Learnings usedYou are interacting with an AI system. |
|
Exact-current-head review request for Review the bounded two-file safe-Unicode ref repair. It permits GitHub-valid international branch names while continuing to reject ASCII shell metacharacters and whitespace, Unicode control/format/separator categories, leading dashes, reserved Keep the exact head unchanged. Do not broaden the validator beyond the tested boundary, synthesize author approval, update the branch, merge, release, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
Exact-current-head semantic review request for Review the four-file bounded repair on this exact head. Keep the exact head unchanged. Do not broaden the validator beyond the tested safe Unicode boundary, infer shell safety from displayability alone, remove scheduler quality triggers, synthesize author approval, update the branch, merge, release, or bypass protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='fa53feff221633b4911df8d3e0715551935dcf26'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Commit identity and scope =='
printf 'Checked-out HEAD: '; git rev-parse HEAD
printf 'Requested head: '; git rev-parse "${head}^{commit}"
printf 'Merge base: '; git merge-base "$head" "$base"
printf 'Ahead/behind: '; git rev-list --left-right --count "$base...$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Full exact diff =='
git diff --find-renames --find-copies --unified=80 "$base...$head"
echo '== Changed file outlines =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
printf '\n-- %s --\n' "$path"
case "$path" in
*.py) ast-grep outline "$path" --items all --view expanded ;;
*) sed -n '1,320p' "$path" ;;
esac
done
echo '== Scheduler validation and invocation boundaries =='
scheduler='scripts/ci/pr_review_merge_scheduler.py'
rg -n -C 16 '\bvalidate_git_ref\s*\(' "$scheduler"
rg -n -C 8 '(?:subprocess\.(?:run|Popen|check_output|check_call)|\brun(?:_github_(?:read|actions|dispatch))?\s*\(|shell\s*=|gh\s+api|repository-dispatch)' "$scheduler"
rg -n -C 8 '(?:baseRefName|headRefName|baseRefOid|headRefOid|update-ref|merge|restamp|permissions:|credential|token)' "$scheduler"
echo '== Ref and quality-trigger regression tests =='
tests='tests/test_pr_review_merge_scheduler.py'
rg -n -C 18 '(?:validate_git_ref|🎨|Korean|non.breaking|zero.width|\.lock|HEAD|@\{|hidden|traversal|strix-changed-path-quality-ci|pr_review_merge_scheduler)' "$tests"
echo '== PR and exact-head GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha] | `@tsv`'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.head_sha,.event] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body } }
}
}
reviews(first: 100) {
nodes { author { login } state commit { oid } }
}
}
}
}' --jq '.data.repository.pullRequest'Length of output: 216842
No code findings.
It continues to reject:
The scheduler continues to use argument vectors with Repository dispatch continues to use The changed code does not modify dispatch targets, credentials, permissions, merge guards, mutation-actor gates, or branch-protection behavior. The Strix workflow now triggers for the scheduler workflow, scheduler source, and scheduler test file. The regression test also checks the exact PR-head checkout, the full test command, and the clean-worktree gate.
The remaining observed exact-head workflows are queued. Skipped jobs and queued jobs are not passing evidence. GitHub currently reports I applied the stored exact-current-head evidence policy. This review does not provide a qualifying independent human approval or merge authorization. 🧠 Learnings usedYou are interacting with an AI system. |
|
Exact-current-head automated and independent review requested for Fresh evidence: all nine directly observed exact-head workflows are now terminal-success, no inline thread exists, and the permanent quality gate checked out the literal head with persisted credentials disabled, ran 978 tests plus 16 subtests, executed the bounded Strix regression, compiled the changed contracts, and left a clean worktree. Review both causal boundaries: GitHub-valid non-ASCII graphic/letter refs are accepted while Unicode control/format/separator, shell, traversal, hidden-component, reserved, and Submit an exact-head verdict without updating the branch, broadening unsafe ref syntax, removing scheduler trigger coverage, synthesizing author approval, or bypassing protection. @coderabbitai review |
Rate Limit Exceeded
|
Record the safe-Unicode ref decision with APA 7th citations. Isolate Darwin installer tests on the linux x86_64 path.
|
Reviewed. CHANGELOG + APA 7th doctoring (Unicode 16.0, git-check-ref-format). Reality tests keep the observed emoji branch and Hangul ref. Local suite 978 passed x2. Auto-merge armed. |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
bc85e8839ba819a179d66f0b97a114a69fba0640. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341340)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963494/job/94504004791)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963914/job/94504006073)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963914/job/94504006073)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504006693)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964689/job/94504010075)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006896)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006807)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341340)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504006693)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341382)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964123/job/94504006837)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963902/job/94504005926)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963911/job/94504006292)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963911/job/94504006292)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964027/job/94504006276)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006676)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006578)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006719)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006797)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964123/job/94504006837)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964083/job/94504006842)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006896)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964122/job/94504006807)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963494/job/94504004791)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963334/job/94504316060)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006676)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964083/job/94504006842)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963902/job/94504005926)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964027/job/94504006276)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964689/job/94504010075)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006578)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964019/job/94504341382)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716963334/job/94504004356)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006719)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31716964044/job/94504006797)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix-changed-path-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix-changed-path-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scheduler-unicode-git-refs.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scheduler-unicode-git-refs.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix-changed-path-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix-changed-path-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scheduler-unicode-git-refs.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scheduler-unicode-git-refs.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
|
Returned to Draft because the exact current tree mixes the safe-Unicode scheduler repair with an unrelated trusted-uv materializer branch. The bounded product slice is sound: accept GitHub-valid Unicode ref components while rejecting control/format/separator categories, shell metacharacters, traversal/reserved forms, and Rebuild from protected |
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='940'
head='8866aa67241a30cd2e33b37441583eeb44e4c0bb'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact commit identity and ancestry =='
printf 'checked_out_head='; git rev-parse HEAD
printf 'requested_head='; git rev-parse "${head}^{commit}"
printf 'merge_base='; git merge-base "$head" "$base"
printf 'ahead_behind='; git rev-list --left-right --count "$base...$head"
echo '== Changed paths =='
git diff --name-status "$base...$head"
echo '== Whitespace errors =='
git diff --check "$base...$head"
echo '== Full patch =='
git diff --find-renames --find-copies --unified=100 "$base...$head"
echo '== Affected Python structure =='
git diff --name-only "$base...$head" | while IFS= read -r path; do
case "$path" in
*.py)
printf '\n-- %s --\n' "$path"
ast-grep outline "$path" --items all --view expanded
;;
esac
done
echo '== Validator and process/API boundaries =='
scheduler='scripts/ci/pr_review_merge_scheduler.py'
rg -n -C 14 '\bvalidate_git_ref\s*\(' "$scheduler"
rg -n -C 8 '(?:subprocess\.(?:run|Popen|check_output|check_call)|\brun(?:_github_(?:read|actions|dispatch))?\s*\(|shell\s*=|gh\s+api|repository-dispatch)' "$scheduler"
rg -n -C 8 '(?:baseRefName|headRefName|headRefOid|baseRefOid|update-ref|merge|restamp|permissions:|credential|token)' "$scheduler"
echo '== Tests and quality workflow trigger policy =='
tests='tests/test_pr_review_merge_scheduler.py'
workflow='.github/workflows/strix-changed-path-quality-ci.yml'
rg -n -C 18 '(?:validate_git_ref|🎨|Korean|non.breaking|zero.width|\.lock|HEAD|@\{|hidden|traversal|strix-changed-path-quality-ci|pr_review_merge_scheduler|clean.worktree|persist-credentials)' "$tests"
sed -n '1,300p' "$workflow"
echo '== Current PR and exact-head GitHub state =='
gh pr view "$pr" --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,changedFiles,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.head_sha] | `@tsv`'
gh api "repos/$repo/actions/runs?head_sha=$head&per_page=100" \
--jq '.workflow_runs[] | [.name,.status,.conclusion,.head_sha,.event] | `@tsv`'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body } } }
}
reviews(first: 100) { nodes { author { login } state commit { oid } } }
}
}
}' --jq '.data.repository.pullRequest'Length of output: 144523 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='8866aa67241a30cd2e33b37441583eeb44e4c0bb'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
scheduler='scripts/ci/pr_review_merge_scheduler.py'
tests='tests/test_pr_review_merge_scheduler.py'
echo '== Identity, scope, and commits =='
printf 'checked_out='; git rev-parse HEAD
printf 'merge_base='; git merge-base "$head" "$base"
printf 'ahead_behind='; git rev-list --left-right --count "$base...$head"
git log --oneline --decorate "$base..$head"
git diff --name-status "$base...$head"
git diff --check "$base...$head"
echo '== Exact patch, changed files only =='
git diff --unified=30 "$base...$head" -- \
'scripts/ci/pr_review_merge_scheduler.py' \
'tests/test_pr_review_merge_scheduler.py' \
'.github/workflows/strix-changed-path-quality-ci.yml' \
'tests/test_strix_changed_path_policy.py' \
'CHANGELOG.md' \
'docs/doctoring/**' \
'AGENTS.md'
echo '== validate_git_ref definition and direct call paths =='
rg -n -A100 -B12 '^def validate_git_ref\b' "$scheduler"
rg -n -A40 -B8 '^def dispatch_(?:opencode_review|strix_evidence)\b' "$scheduler"
rg -n -A45 -B8 '^def restamp_pr_head_for_last_push_approval\b' "$scheduler"
echo '== Targeted regression assertions =='
sed -n '140,205p' "$tests"
rg -n -A90 -B15 'test_.*(?:strix|changed_path|quality).*' 'tests/test_strix_changed_path_policy.py'
echo '== Paths outside the stated scheduler, Strix, and documentation scope =='
git diff --name-only "$base...$head" | grep -Ev \
'^(scripts/ci/pr_review_merge_scheduler\.py|tests/test_pr_review_merge_scheduler\.py|\.github/workflows/strix-changed-path-quality-ci\.yml|tests/test_strix_changed_path_policy\.py|CHANGELOG\.md|docs/doctoring/|AGENTS\.md)$' \
|| trueLength of output: 38278 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='8866aa67241a30cd2e33b37441583eeb44e4c0bb'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
file='tests/test_materialize_base_python_requirements.py'
echo '== Materializer test delta with line numbers =='
git diff --unified=40 "$base...$head" -- "$file"
echo '== Current changed regions =='
git diff --unified=0 "$base...$head" -- "$file"
echo '== Current surrounding source =='
rg -n -C 12 '(?:relative|include|requirement|materialize)' "$file"Length of output: 41245
Finding
The current diff therefore does not meet the stated bounded rebuild scope. Remove this materializer-test delta, or move it to its own PR. Then regenerate all exact-head evidence. The remaining reviewed changes are consistent with the requested safety boundary:
The current exact-head workflows are queued, in progress, or cancelled. They are not passing evidence. The You are interacting with an AI system. |
|
Exact-current-head read-only review request for The bounded six-file repair accepts GitHub-valid international ref characters while retaining shell/control/format/separator/traversal/hidden/.lock/reserved-name rejection, and ensures all merge-scheduler source/test/workflow changes trigger the permanent exact-head full suite. Recheck structured argv/API use, unchanged credentials/permissions/reviewer/merge authority, exact trigger paths, literal PR-head checkout, full-suite and clean-worktree contracts, and removal of unrelated installer-test drift. Treat predecessor evidence as historical. Do not mutate or merge the branch. @opencode-agent review |
Rate Limit Exceeded
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
842560579ae73e5aad5bba7d522c25c61fcdf1ea. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31886559045/job/95016600364)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31886559045/job/95016600364)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix-changed-path-quality-ci.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix-changed-path-quality-ci.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: scheduler-unicode-git-refs.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: scheduler-unicode-git-refs.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: pr_review_merge_scheduler.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: pr_review_merge_scheduler.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
1 participant
Outcome
Replay the safe-Unicode scheduler repair on the protected-main snapshot and permanently bind every central merge-scheduler control-plane change to the exact-head full-suite quality gate. The scheduler can inspect and dispatch GitHub-valid international branch names without relaxing command, ref, workflow, publication, review, or merge safety.
Closes #685. Supersedes only the relevant source/test slice of closed unmerged #696; its unrelated CodeQL workflow bump is excluded.
Exact identity and bounded scope
main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;fa53feff221633b4911df8d3e0715551935dcf26;842560579ae73e5aad5bba7d522c25c61fcdf1ea;A later update introduced an unrelated trusted-lock installer-test change. A non-destructive forward cleanup restores that test to protected-main content while retaining the legitimate Unicode and trigger-doctoring contracts. No force-push, rebase, history rewrite, predecessor evidence transfer, or gate weakening was used.
Every check, review, approval, or generated merge result bound to an earlier head is historical only. Current-head evidence must regenerate.
Safe Unicode ref boundary
The ASCII-only validator rejected GitHub-valid branch names such as
🎨-palette-ux-improvement-13325911538352561627before repository-dispatch fields were constructed.The replacement permits non-ASCII graphic and letter characters while continuing to reject:
HEAD,@{, repeated/traversal slash or dot forms, hidden path components, trailing dots/slashes, and component.locksuffixes.All Git/GitHub calls remain structured argv or typed API fields. No shell evaluation, workflow permission, credential, protected setting, reviewer, merge, or release authority is broadened.
Exact-head scheduler quality boundary
The broader suite exposed a second causal gap: changes to the merge-scheduler workflow, production script, or scheduler tests did not trigger the permanent Strix exact-head full-suite workflow. The bounded repair adds exactly those three scheduler surfaces and makes the path-policy test assert literal PR-head checkout, complete repository testing, and a clean-worktree gate.
Test-first evidence
The branch records RED/GREEN evidence for the emoji ref and for missing scheduler trigger paths. The predecessor GREEN head completed exact-head checkout, the full suite, bounded Strix shell regression, compilation, and clean-worktree verification. Those results are lineage only.
The current head must regenerate every applicable exact-head quality, security, supply-chain, and semantic-review result. Pending, queued, skipped, cancelled, absent, stale, predecessor-head, local-only, author-only, status-only, synthetic, or model-only evidence is not acceptance.
Acceptance and rollback
Merge or auto-merge only after the unchanged current head has terminal-success required gates, zero valid unresolved findings, a qualifying current-head semantic verdict, two qualifying independent non-author approvals including last-push approval, compatible live-base evidence, and ordinary expected-head branch-protection authorization.
After protected integration, scheduled/manual queue evidence must show the formerly rejected Unicode branch reaching its normal dispatch/defer decision, and a scheduler-source-only change must trigger the permanent exact-head suite. Rollback must preserve both properties. No self-approval, administrative bypass, synthetic approval, or protection weakening is requested.
Summary by CodeRabbit
개선 사항
문서
테스트