Skip to content

test(coverage): simulate Linux x86_64 in trusted-uv installer tests - #960

Open
seonghobae wants to merge 5 commits into
mainfrom
test/trusted-uv-installer-platform-mock
Open

test(coverage): simulate Linux x86_64 in trusted-uv installer tests#960
seonghobae wants to merge 5 commits into
mainfrom
test/trusted-uv-installer-platform-mock

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Five trusted-uv installer verification tests call _install_trusted_uv() after production correctly rejects unsupported local hosts. On macOS, they therefore fail at the Linux/x86_64 portability gate before reaching version verification, cache, wrong-version, process-failure, and cleanup behavior. The full local suite cannot exercise those branches even though hosted Linux CI can.

Bounded test-only repair

  • add _simulate_linux_x86_64_runner() in the installer test module;
  • patch only sys.platform and platform.machine() in the five installer-behavior tests;
  • clear the process-cached installer after the patch so each test measures the simulated runner rather than a stale host-architecture miss;
  • leave production source, pinned archive identity, hash verification, download limits, executable/version checks, and fail-closed unsupported-runner behavior unchanged;
  • retain the independent portability test that proves unsupported hosts fail before download.

Exact identity and scope

  • protected base and live tip: main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
  • exact current head: 77c62b517807296c26a449800f792aa77d65b41f;
  • bounded diff: one test module, focused trusted-uv doctoring, and one changelog entry;
  • state: Ready after the current transition and mechanically mergeable.

Later commits had mixed in unrelated root Architecture/CLAUDE and production lock-materializer changes. An ordinary non-destructive forward commit restores the exact original bounded tree d6165b3946ab57624096d518ed2037571ac4f7ea. No force-push, rebase, history rewrite, production gate change, or predecessor evidence transfer was used.

Verification posture

Predecessor local evidence reported the focused trusted-uv/portability suite and the full repository suite with exact 100% production statement/branch/docstring coverage. Those results prove predecessor trees only.

The current head must regenerate terminal-success exact-head quality, security, SAST, dependency/SBOM, supply-chain, and semantic-review evidence. Pending, queued, skipped, cancelled, stale, predecessor-head, local-only, author-only, status-only, or model-only evidence is not acceptance.

Merge gate

Merge or auto-merge only after the unchanged current head satisfies all live required checks, zero valid unresolved findings, qualifying independent non-author and last-push approvals, compatible live-base evidence, and ordinary branch-protection authority. No administrative bypass, self-approval, or production portability weakening is requested.

@seonghobae
test(coverage): simulate Linux x86_64 in trusted-uv installer tests
d6165b3 
Installer verification, cache, and cleanup coverage was unreachable on
macOS because the production gate rejects non-Linux runners first.
Pin platform and machine only in those unit tests; the portability
contract still fail-closes unsupported hosts before any download.
@seonghobae
seonghobae enabled auto-merge (squash) August 13, 2026 06:41
@seonghobae

seonghobae commented Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review please review this current head. Installer verification tests now pin linux/x86_64 so local full-suite coverage is 100%; production still fail-closes unsupported runners.

@coderabbitai

coderabbitai Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 731c048c-c7fc-4a92-ba6f-5a3d372f6658

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb06cd and 77c62b5.

📒 Files selected for processing (3)
  • CHANGELOG.md
  • docs/doctoring/trusted-uv-lock-materialization.md
  • tests/test_materialize_base_python_requirements.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
docs(coverage): cite CWE-670 for trusted-uv installer cache clear
21611fc 
Clear the process-cached installer after the Linux x86_64 monkeypatch
so version verification is measured on the simulated runner, not a
stale host-architecture miss.
This was referenced Aug 13, 2026
Draft
Closed
@seonghobae
fix(coverage): treat linux amd64 as the pinned uv ISA
5fc91b9 
Debian-style runners report amd64 or AMD64 for the same userspace the
pinned uv-x86_64-unknown-linux-gnu archive targets. Normalize the
machine label and fail-closed only for a different ISA.
@seonghobae
fix(coverage): accept only bounded relative requirement includes
1d8e620 
Materialize a base Python lock only when every package line is an exact
SHA-256 pin or a two-token relative -r/--requirement include of a
candidate lock path. A lone --require-hashes directive, ./dotted paths,
and -r other-hashes.txt no longer enter the trusted build context.
opencode-agent[bot]
opencode-agent Bot requested changes Aug 14, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for 1d8e6208e575540ec2f0819be39bd711dc902905.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: trusted-uv-lock-materialization.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: trusted-uv-lock-materialization.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script: materialize_base_python_requirements.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: materialize_base_python_requirements.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (2 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (2 files)"]
  R4 --> V4["targeted test run"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 1d8e6208e575540ec2f0819be39bd711dc902905
  • Workflow run: 31754633591
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for 1d8e6208e575540ec2f0819be39bd711dc902905.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: trusted-uv-lock-materialization.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: trusted-uv-lock-materialization.md"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script: materialize_base_python_requirements.py"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script: materialize_base_python_requirements.py"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (2 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (2 files)"]
  R4 --> V4["targeted test run"]
Loading

@opencode-agent
opencode-agent Bot disabled auto-merge August 14, 2026 01:55
@seonghobae
seonghobae marked this pull request as draft August 14, 2026 09:12
@seonghobae ChatGPT Codex Connector

seonghobae commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Returned to Draft because this test-only portability slice carries production materializer and governance changes beyond its stated scope.

The useful change should be limited to a test helper that simulates Linux x86_64 only inside the installer verification cases, while preserving production fail-closed behavior on unsupported runners. Head 1d8e6208e575540ec2f0819be39bd711dc902905 also changes materialize_base_python_requirements.py, broad governance files, doctoring, and changelog.

After the authoritative materializer branch lands, rebuild this as a minimal test-only follow-up against protected main, retaining only the affected test modules and any strictly attributable test-contract note. Reconfirm that the helper cannot leak platform monkeypatches across tests, then reacquire exact-head coverage/security/supply-chain and independent-review evidence.

@seonghobae seonghobae mentioned this pull request Aug 14, 2026
Draft
@seonghobae
seonghobae marked this pull request as ready for review August 15, 2026 13:35
@seonghobae
seonghobae enabled auto-merge (squash) August 15, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@opencode-agent opencode-agent[bot] opencode-agent[bot] requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seonghobae