Skip to content

fix(review): cap inline retry at 20 and list attached path:line - #970

Closed
seonghobae wants to merge 13 commits into
mainfrom
fix/inline-comment-bounded-retry-attached-receipts
Closed

fix(review): cap inline retry at 20 and list attached path:line#970
seonghobae wants to merge 13 commits into
mainfrom
fix/inline-comment-bounded-retry-attached-receipts

Conversation

@seonghobae

Copy link
Copy Markdown
Contributor

Summary

Unbounded one-at-a-time retry after a batch GitHub 422 can thrash the Reviews API, and mixed receipts listed only refused path:line.

#963/#964/#966/#967/#968 remain MERGEABLE with auto-merge; they are blocked by the two-approval ruleset, not a current-head code fail.

Test plan

  • pytest tests/test_opencode_inline_comment_fallback.py tests/test_opencode_agent_contract.py — 56 passed
  • coverage run -m pytest tests --ignore=tests/test_strix_quick_gate.sh — 993 passed, 100% statements/branches, interrogate 100%
  • Current-head required checks on this PR

When GitHub refuses inline review comments, the PR-level fallback now
lists each sanitized current-head finding location instead of a generic
sentence. Suggested diffs stay out of the body.
Rebuild the fallback from gh api stderr after a refused attach so the
OpenCode overview keeps each trusted path:line next to the GitHub 422
phrase instead of a location-only list.
A single invalid path:line 422s the whole comments array. After that
failure, split the payload and retry each comment so surviving hunks
still attach; remaining failures keep the overview receipts.
The publisher moved that phrase out of the workflow YAML, so the
exact-head path-policy harness failed looking in the old file.
When some one-at-a-time inline comments attach and others 422, the
overview must list only the refused locations so attached hunks are
not reported as failed.
Mixed one-at-a-time retries can fail for different reasons. Record
path:line plus that comment's gh api error so the overview does not
reuse one shared sentence for every refused hunk.
Unbounded one-at-a-time retry after a batch 422 can thrash GitHub,
and mixed receipts listed only refused locations. Cap retries at 20,
persist attached path:line beside refused ones, and record leftovers
the cap left untried so the overview shows every outcome.
@seonghobae
seonghobae enabled auto-merge (squash) August 13, 2026 07:48
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review Please review the current head. Cap one-at-a-time inline retries at 20 and list attached path:line beside refused receipts (plus leftovers the cap left untried).

@coderabbitai

coderabbitai Bot commented Aug 13, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 85 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 475d033f-1f49-4edf-9a3f-e99d81b4a39e

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb06cd and fd5a763.

📒 Files selected for processing (10)
  • .github/workflows/opencode-review-dispatch.yml
  • AGENTS.md
  • CHANGELOG.md
  • docs/doctoring/review-inline-comment-422-fallback.md
  • scripts/ci/materialize_base_python_requirements.py
  • scripts/ci/opencode_inline_comment_fallback.py
  • scripts/ci/test_strix_quick_gate.sh
  • tests/test_materialize_base_python_requirements.py
  • tests/test_opencode_agent_contract.py
  • tests/test_opencode_inline_comment_fallback.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

A 422 substring in a SHA or issue number no longer starts the
one-at-a-time retry (CWE-1288). Receipt phrases escape backticks
and HTML metacharacters before they enter the overview body.
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review Please review this exact current head (cbc83627). The head now requires a real HTTP 422 before bounded retry and escapes receipt phrases.

A multi-line GitHub suggestion that already has start_line/start_side
must keep that range when the batch 422 path retries one comment at a
time. Dropping the range posts a single comment on the last line.
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review

When a multi-line GitHub suggestion rewrites `line` to the span end,
record attach and refusal path:line from `start_line` so the overview
still matches the trusted finding.
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review exact current head 94eb97b3 — inline retry cap at 20; multiline attach receipts now cite start_line. Head moved after earlier mention. Independent Noema APPROVE on this SHA is required. Do not wait on two-approval. Reviewers remain edit: deny. NVIDIA_NIM_API_KEY only.

Materialize a base Python lock only when every package line is an exact
SHA-256 pin or a two-token relative -r/--requirement include of a
candidate lock path. A lone --require-hashes directive, ./dotted paths,
and -r other-hashes.txt no longer enter the trusted build context.
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review exact current head 5fda9ea2 — leftover increment kept; materialize accepts only bounded relative -r includes. Head moved. Independent Noema APPROVE on this SHA is required. Do not wait on two-approval. Reviewers remain edit: deny. NVIDIA_NIM_API_KEY only.

Leftover path:line receipts live in the overview HTML comment. Strip
HTML metacharacters and suggestion fences so a leftover cannot close
the comment or reopen an applyable GitHub suggestion block.
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review exact current head eeadd53f — leftover overview receipts now sanitize path and phrase (CWE-116). Head moved. Independent Noema APPROVE on this SHA is required. Reviewers remain edit: deny. NVIDIA_NIM_API_KEY only.

Reject leftover 422-fallback paths that contain -->, <!--, or a
suggestion fence so a leftover cannot close the overview HTML comment
or reopen an applyable GitHub suggestion block.
@seonghobae

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review exact current head fd5a763e — leftover overview paths with --> / <!-- / suggestion-fence closers omitted so leftover cannot break the overview HTML comment. Head moved after eeadd53f. Independent Noema APPROVE on this SHA is required. Do not wait on two-approval. Reviewers remain edit: deny. NVIDIA_NIM_API_KEY only.

@seonghobae seonghobae closed this Aug 14, 2026
auto-merge was automatically disabled August 14, 2026 08:25

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant