fix(review): consume leftover path:start-end receipts - #996
Closed
seonghobae wants to merge 33 commits into
Closed
Conversation
When GitHub refuses inline review comments, the PR-level fallback now lists each sanitized current-head finding location instead of a generic sentence. Suggested diffs stay out of the body.
Rebuild the fallback from gh api stderr after a refused attach so the OpenCode overview keeps each trusted path:line next to the GitHub 422 phrase instead of a location-only list.
A single invalid path:line 422s the whole comments array. After that failure, split the payload and retry each comment so surviving hunks still attach; remaining failures keep the overview receipts.
The publisher moved that phrase out of the workflow YAML, so the exact-head path-policy harness failed looking in the old file.
When some one-at-a-time inline comments attach and others 422, the overview must list only the refused locations so attached hunks are not reported as failed.
Mixed one-at-a-time retries can fail for different reasons. Record path:line plus that comment's gh api error so the overview does not reuse one shared sentence for every refused hunk.
Unbounded one-at-a-time retry after a batch 422 can thrash GitHub, and mixed receipts listed only refused locations. Cap retries at 20, persist attached path:line beside refused ones, and record leftovers the cap left untried so the overview shows every outcome.
GitHub 422s review comments that sit outside every current-head @@ hunk. Filter the payload against git diff --unified=3 first, post only the on-hunk comments, and persist skipped path:line as overview receipts.
Authors could not one-click apply OpenCode inline repairs because the payload only posted ```diff fences. Convert + lines from those diffs into ```suggestion blocks on surviving RIGHT-side hunk comments.
A surviving suggested_diff that removes more than one current-head line still posted as a single-line comment, so Apply suggestion only replaced the first line. Set start_line, line, and start_side when the full span sits on the same hunk; leave off-hunk spans single-line to avoid 422.
Authors could see refused and skipped path:line after a 422, but not which surviving hunks shipped as one-click GitHub suggestions. Persist path:line or path:start-end for comments that carry a suggestion fence.
Overview receipts listed applyable path:start-end ranges, but authors could not tell leftover ```diff fences (cannot-provide / LEFT) from one-click GitHub suggestions. Persist those leftover path:line reasons in a separate overview section.
Leftover cannot-provide and LEFT fences now keep a bounded excerpt in overview receipts as a distinct non-applyable ```diff block so authors can copy the replacement by hand without treating it as a GitHub suggestion range.
When a leftover LEFT suggested-diff still has an extractable replacement and the same path has a current-head RIGHT hunk, move the comment onto that hunk so GitHub can apply it. Pure deletions and cannot-provide fences stay leftover manual-edit blocks.
When a leftover LEFT comment cannot stay on the same RIGHT line, attach it to the first RIGHT line of that @@ hunk instead of the first RIGHT line of the whole path. Multi-hunk files no longer land on an earlier hunk. Pure-deletion hunks stay leftover.
Overview applyable receipts now show path:right came from LEFT path:left when a leftover comment was remapped onto a RIGHT hunk. Local origin keys are stripped before the GitHub POST.
One-at-a-time retry after a batch 422 now copies start_line and start_side so a remapped leftover that spans a multi-line RIGHT hunk still posts as one GitHub suggestion.
Comments past the 20-comment 422 retry cap are not posted as GitHub suggestions. Deferred overview rows now keep path:start-end and the LEFT origin, and those ranges are removed from the applyable heading.
A cannot-provide or pure-deletion leftover past the 20-comment retry cap still shows the Manual-edit ```diff block and the deferred range/origin row. Those fences stay off the applyable suggestion list.
When leftover and deferred share a path:line, the leftover heading prints the deferred range/origin first, then the Manual-edit excerpt. Deferred leftovers also appear before leftovers that were already posted.
When leftover heading already prefixes a deferred range/origin for the same path:line, skip the duplicate cannot-provide/LEFT reason bullet so authors see one deferred line then the Manual-edit excerpt.
When a leftover line sits inside a deferred multi-line path:start-end, prefix the deferred range and keep the Manual-edit excerpt immediately after it instead of repeating path:line — reason.
When several leftover lines sit inside the same deferred path:start-end, prefix that range once and keep each Manual-edit excerpt under it.
When a leftover line sits inside a trusted deferred multi-line path:start-end but is not itself a trusted finding, _trusted_receipt_subset used to drop the Manual-edit excerpt. Keep that excerpt under the deferred range and still drop untrusted-path leftovers.
When leftover-diff-locations sits inside a trusted deferred path:start-end but that leftover line is not a trusted control finding, the overview CLI still keeps the Manual-edit excerpt under the deferred range.
GitHub cannot apply a suggestion on the deleted LEFT side, so leftover LEFT fences must stay off the applyable overview. Darwin hosts now mock the linux x86_64 trusted-uv runner for installer verification.
When a leftover cannot-provide or LEFT line sits inside path:start-end, drop that range from the applyable overview so authors see Manual-edit instead of a one-click apply for the same span.
The overview CLI now drops applyable path:start-end rows that contain a leftover cannot-provide or LEFT line so authors see Manual-edit only.
write_hunk_filtered_payload now drops applyable path:start-end rows that contain a leftover cannot-provide or LEFT line so applyable.txt cannot list a one-click apply for the same span as leftover example.py:6.
Leftover cannot-provide rows written as path:start-end were dropped by the overview consumer, so applyable interiors such as example.py:6 stayed listed as one-click applies. Parse leftover ranges, cover every interior line, and write start_line-spanned leftover comments as path:start-end.
seonghobae
enabled auto-merge (squash)
August 13, 2026 12:05
|
Warning Review limit reached
Next review available in: 10 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
@cwl-noema-review exact current head |
Leftover Manual-edit text is copied into the overview HTML comment. A leftover --> or HTML metacharacter could close that comment or inject markup. Strip those sequences before the excerpt is stored.
Contributor
Author
|
@cwl-noema-review exact current head |
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
Contributor
Author
|
@cwl-noema-review exact current head |
Reject leftover 422-fallback paths that contain -->, <!--, or a suggestion fence so a leftover cannot close the overview HTML comment or reopen an applyable GitHub suggestion block.
Contributor
Author
|
@cwl-noema-review exact current head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
6821df8847d21539c5de6e50d5991b6765b768e6. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200888/job/94590773711)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200967/job/94588080095)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200887/job/94588079868)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200887/job/94588079868)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200888/job/94588080141)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201482/job/94588081665)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200888/job/94590773711)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200888/job/94588080141)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200888/job/94590773313)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200953/job/94588080107)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200911/job/94588080091)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200981/job/94588081031)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200981/job/94588081031)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200904/job/94588080365)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081125)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081119)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081255)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081230)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200953/job/94588080107)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200967/job/94588080095)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081125)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200911/job/94588080091)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200904/job/94588080365)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201482/job/94588081665)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081119)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742200888/job/94590773313)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081255)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31742201094/job/94588081230)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-inline-comment-422-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-inline-comment-422-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: review-inline-comment-422-fallback.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: review-inline-comment-422-fallback.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
Contributor
Author
|
Closing as a cumulative predecessor of #998. This range-receipt consumer and its regression are already present in canonical #998, which carries the complete bounded inline-comment fallback stack plus the later posted-suggestion exclusion boundary. Keeping both open duplicates checks, review traffic, and merge ordering. #998 remains Draft until its current-head materializer and true-HTTP-422 findings are repaired and revalidated. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--leftover-diff-locationsonly parsed leftoverpath:linerows. A leftover cannot-provide written asexample.py:5-7was dropped, so applyable interiors such asexample.py:6stayed listed as one-click applies next to a Manual-edit for the same span.This increment is the leftover-receipt consumer: leftover
path:start-endcovers every interior line, the overview omits overlapping applyable rows, leftover comments withstart_linewritepath:start-end, and leftover heading listsexample.py:5-7once.Verification
test_leftover_start_end_receipt_omits_interior_applyable_rangesparses leftoverexample.py:5-7, drops applyableexample.py:6andexample.py:5-7, keepsok.py:4, and pins leftover write ofstart_line=5/line=7.coverage run -m pytest tests && coverage report --show-missingtwice at 100% (1027 passed,scripts/ci100% statement/branch), theninterrogate100%.@cwl-noema-review