fix(review): require every current-head file on REQUEST_CHANGES - #994
fix(review): require every current-head file on REQUEST_CHANGES#994seonghobae wants to merge 8 commits into
Conversation
A one-path citation was enough to pass the changed-file gate, so approvals could skip the rest of the diff. Reject APPROVE when any path from the trusted changed-file artifact is unnamed, including after bounded-evidence repair.
Record that every current-head changed item must receive a review disposition. Naming one path cannot authorize APPROVE when the trusted artifact lists more files. Force the trusted-uv installer tests onto the linux x86_64 runner path and add the control-plane architecture diagram.
Naming example.py.bak contains example.py as a prefix substring, so a raw membership check treated the shorter file as reviewed. Count a current-head path only when it appears as a whole token; a sentence period after .yml is not a continuation.
A REQUEST_CHANGES review that names one blocker and ignores the rest of the diff is not a file-by-file walk. Finding paths and named no-blocker dispositions count; omitted files fail closed (IEEE 1028).
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@cwl-noema-review |
REQUEST_CHANGES already named a file via finding.path. A suggested diff whose a/ and b/ headers are the same current-head path is also a disposition. A mismatched pair names neither side.
|
@cwl-noema-review exact current head |
LLM suggested diffs often omit the diff --git line. Matching --- a/X and +++ b/X headers still dispose current-head X. A mismatched pair names neither path.
|
@cwl-noema-review exact current head |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
@cwl-noema-review exact current head |
Pull request was converted to draft
|
Designated as the canonical cumulative per-file disposition branch and returned to Draft. This tree includes #958’s rule that APPROVE must name every trusted current-head path and extends it correctly so REQUEST_CHANGES may satisfy a file through either reason/summary disposition or a finding on that exact path. #958 is therefore a predecessor slice, not a separate merge unit. Before Ready, rebuild from protected |
1 participant
Summary
OpenCode APPROVE already fails closed when any current-head file is unnamed. REQUEST_CHANGES could still cite one blocker and ignore the rest of the diff, which is thinner than a CodeRabbit per-file walk.
This increment extends
unnamed_changed_filesso a finding path counts as naming that file. REQUEST_CHANGES fails closed when any trusted current-head path is neither named in reason/summary nor present as a finding path (IEEE 1028).Verification
example.pyonly is rejected; finding plus a named no-blocker onstrix.ymlis accepted; findings covering both paths are accepted.coverage run -m pytest tests && coverage report --show-missingtwice at 100% (979 passed,scripts/ci100% statement/branch), theninterrogate100%.@cwl-noema-review