fix(figma): retain style references and component sets - #1146
fix(figma): retain style references and component sets#1146seonghobae wants to merge 23 commits into
Conversation
|
Warning Review limit reachedNext included review available in 12 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (15)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review request for exact current head |
|
Correction to the previous review request: the exact current head is |
|
@opencode-agent Review exact current head |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current exact head: 37c4bd5. The hosted Semgrep failure was traced to the two fixed-host Figma HTTPSConnection sinks being reported as blocking warnings. Both sinks now carry the exact rule-scoped nosemgrep justification. Fresh local evidence: Semgrep p/default on both files found 0 findings, Figma tests 64 passed, docstrings 100%, compileall and diff checks passed. Re-run hosted checks at this head; no merge claim is made. |
37c4bd5 to
fc5ab3c
Compare
|
Current-head refresh after merge of #1140: head |
|
Current-head refresh: The only review feedback is an empty GitHub Advanced Security COMMENTED event on an older commit; there are no actionable review findings. Revalidated the Figma REST auth/file boundary at this exact head: 64 focused tests passed; both helpers have 100% statement/branch coverage (529 statements, 260 branches); interrogate 100%; Semgrep p/default 0 findings; Ruff, compileall, and diff check passed. No self-approval or bypass used. Please perform an independent review against this exact head after protected checks become authoritative. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headfc5ab3cdba74bfcfa74661121f01a87c905ca3d1. -
Head SHA:
fc5ab3cdba74bfcfa74661121f01a87c905ca3d1 -
Workflow run: 32283142696
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Docs (2 files)"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["CI script (2 files)"]
S3 --> I3["review and security gate shell path"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
|
@opencode-agent Re-review exact unchanged head |
fc5ab3c to
1b8c7f6
Compare
|
Current-head refresh published at |
|
@opencode-agent Review exact current head |
|
Revalidated exact current head 1b8c7f6 against main@c47bee591c3d95bd305f2130833ed3a4780d2d1. Figma focused proof: 64 passed; interrogate 100%; compileall; Semgrep p/default 0 findings; git diff --check passed. The prior REQUEST_CHANGES referenced an older head/run. @opencode-agent recompute the protected verdict for this exact head only, including Figma auth/TLS boundaries and style/component-set retention. |
Cursor Cloud Agents cannot complete Figma MCP OAuth. Record the 401 challenge, the official Cloud-unsupported decision, and a REST FIGMA_ACCESS_TOKEN whoami helper that never prints the secret. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Semgrep p/default flagged urllib.request.urlopen in figma_rest_auth.py as dynamic-urllib-use-detected. Open api.figma.com over TLS with a literal host and path, and refuse any other URL. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Whoami alone does not read a Figma file. Add a pinned api.figma.com GET /v1/files helper with allowlisted keys and node ids, and record the operator path in ADR, changelog, and APA 7 doctoring so Cloud Agents can continue design-to-code. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Cloud Agent file read now returns geometry, solid fills, text, and auto-layout instead of name/type only, uses branch keys from branch URLs, accepts instance node ids, and stops claiming MCP-equivalent design-to-code. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Exact-head audit update\n\n- Observed hosted failures on the prior head: pip-audit reported PYSEC-2026-3721 through pip 26.1.2; Semgrep reported two HTTPSConnection findings in the new fixed-origin Figma REST sinks.\n- Root-cause fix: refreshed the hash-locked CI dependency to pip 26.2.1 and added narrowly scoped, tested Semgrep suppressions at the two fixed TLS sinks. The sinks retain pinned hosts/paths, certificate-validating default SSL contexts, bounded bodies, and allowlisted request paths.\n- Exact head: 8ffdf4d\n- Exact base: 731af58\n- Local verification: pip-audit clean; local Semgrep on both Figma modules reported 0 findings; 65 Figma tests passed; diff checks passed.\n- GitHub currently reports the branch behind; required checks and exact-head approval remain pending. Decision remains WAIT_AND_REMEDIATE. |
|
Correction to the preceding audit comment: the two fixed API host TLS sinks are pinned to api.figma.com. The wording lost that literal during shell quoting; no repository content or secret was affected. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
opencode-agent
Bot
added
area: ui-ux
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
AGENTS.md— repository behaviorARCHITECTURE.md— repository behaviorCHANGELOG.md— repository behaviorCLAUDE.md— repository behaviordocs/CWL-MASTER-CONTEXT.md— operator or user guidancedocs/adr/0013-figma-cloud-agent-rest-fallback.md— operator or user guidancedocs/doctoring/figma-cloud-agent-mcp-auth.md— operator or user guidancerequirements-pip-audit-ci-hashes.txt— repository behaviorscripts/ci/figma_rest_auth.py— review and security gate shell pathscripts/ci/figma_rest_file.py— review and security gate shell pathtests/test_figma_rest_auth.py— regression suitetests/test_figma_rest_file.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: AGENTS.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: AGENTS.md"]
R1 --> V1["required checks"]
Evidence --> S2["Repository file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: ARCHITECTURE.md"]
R2 --> V2["required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
R3 --> V3["required checks"]
Evidence --> S4["Repository file: CLAUDE.md"]
S4 --> I4["repository behavior"]
I4 --> R4["Review risk: Repository file: CLAUDE.md"]
R4 --> V4["required checks"]
Evidence --> S5["Docs: CWL-MASTER-CONTEXT.md (3 files)"]
S5 --> I5["operator or user guidance"]
I5 --> R5["Review risk: Docs: CWL-MASTER-CONTEXT.md (3 files)"]
R5 --> V5["docs review"]
Evidence --> S6["Repository file: requirements-pip-audit-ci-hashes.txt"]
S6 --> I6["repository behavior"]
I6 --> R6["Review risk: Repository file: requirements-pip-audit-ci-hashes.txt"]
R6 --> V6["required checks"]
Evidence --> S7["CI script: figma_rest_auth.py"]
S7 --> I7["review and security gate shell path"]
I7 --> R7["Review risk: CI script: figma_rest_auth.py"]
R7 --> V7["bash -n plus Strix self-test"]
Evidence --> S8["CI script: figma_rest_file.py"]
S8 --> I8["review and security gate shell path"]
I8 --> R8["Review risk: CI script: figma_rest_file.py"]
R8 --> V8["bash -n plus Strix self-test"]
Evidence --> S9["Test: test_figma_rest_auth.py (2 files)"]
S9 --> I9["regression suite"]
I9 --> R9["Review risk: Test: test_figma_rest_auth.py (2 files)"]
R9 --> V9["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
8ffdf4d8150091957a79b5fc63c984e927d323b3 - Workflow run: 33195630587
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: AGENTS.md"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Repository file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["Repository file: CLAUDE.md"]
S4 --> I4["repository behavior"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["required checks"]
Evidence --> S5["Docs: CWL-MASTER-CONTEXT.md (3 files)"]
S5 --> I5["operator or user guidance"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["docs review"]
Evidence --> S6["Repository file: requirements-pip-audit-ci-hashes.txt"]
S6 --> I6["repository behavior"]
I6 --> Conflict["Merge conflict blocks this path"]
Conflict --> V6["required checks"]
Evidence --> S7["CI script: figma_rest_auth.py"]
S7 --> I7["review and security gate shell path"]
I7 --> Conflict["Merge conflict blocks this path"]
Conflict --> V7["bash -n plus Strix self-test"]
Evidence --> S8["CI script: figma_rest_file.py"]
S8 --> I8["review and security gate shell path"]
I8 --> Conflict["Merge conflict blocks this path"]
Conflict --> V8["bash -n plus Strix self-test"]
Evidence --> S9["Test: test_figma_rest_auth.py (2 files)"]
S9 --> I9["regression suite"]
I9 --> Conflict["Merge conflict blocks this path"]
Conflict --> V9["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
AGENTS.md— repository behaviorARCHITECTURE.md— repository behaviorCHANGELOG.md— repository behaviorCLAUDE.md— repository behaviordocs/CWL-MASTER-CONTEXT.md— operator or user guidancedocs/adr/0013-figma-cloud-agent-rest-fallback.md— operator or user guidancedocs/doctoring/figma-cloud-agent-mcp-auth.md— operator or user guidancerequirements-pip-audit-ci-hashes.txt— repository behaviorscripts/ci/figma_rest_auth.py— review and security gate shell pathscripts/ci/figma_rest_file.py— review and security gate shell pathtests/test_figma_rest_auth.py— regression suitetests/test_figma_rest_file.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: AGENTS.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: AGENTS.md"]
R1 --> V1["required checks"]
Evidence --> S2["Repository file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: ARCHITECTURE.md"]
R2 --> V2["required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
R3 --> V3["required checks"]
Evidence --> S4["Repository file: CLAUDE.md"]
S4 --> I4["repository behavior"]
I4 --> R4["Review risk: Repository file: CLAUDE.md"]
R4 --> V4["required checks"]
Evidence --> S5["Docs: CWL-MASTER-CONTEXT.md (3 files)"]
S5 --> I5["operator or user guidance"]
I5 --> R5["Review risk: Docs: CWL-MASTER-CONTEXT.md (3 files)"]
R5 --> V5["docs review"]
Evidence --> S6["Repository file: requirements-pip-audit-ci-hashes.txt"]
S6 --> I6["repository behavior"]
I6 --> R6["Review risk: Repository file: requirements-pip-audit-ci-hashes.txt"]
R6 --> V6["required checks"]
Evidence --> S7["CI script: figma_rest_auth.py"]
S7 --> I7["review and security gate shell path"]
I7 --> R7["Review risk: CI script: figma_rest_auth.py"]
R7 --> V7["bash -n plus Strix self-test"]
Evidence --> S8["CI script: figma_rest_file.py"]
S8 --> I8["review and security gate shell path"]
I8 --> R8["Review risk: CI script: figma_rest_file.py"]
R8 --> V8["bash -n plus Strix self-test"]
Evidence --> S9["Test: test_figma_rest_auth.py (2 files)"]
S9 --> I9["regression suite"]
I9 --> R9["Review risk: Test: test_figma_rest_auth.py (2 files)"]
R9 --> V9["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
8ffdf4d8150091957a79b5fc63c984e927d323b3 - Workflow run: 33226543952
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: AGENTS.md"]
S1 --> I1["repository behavior"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["required checks"]
Evidence --> S2["Repository file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["Repository file: CLAUDE.md"]
S4 --> I4["repository behavior"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["required checks"]
Evidence --> S5["Docs: CWL-MASTER-CONTEXT.md (3 files)"]
S5 --> I5["operator or user guidance"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["docs review"]
Evidence --> S6["Repository file: requirements-pip-audit-ci-hashes.txt"]
S6 --> I6["repository behavior"]
I6 --> Conflict["Merge conflict blocks this path"]
Conflict --> V6["required checks"]
Evidence --> S7["CI script: figma_rest_auth.py"]
S7 --> I7["review and security gate shell path"]
I7 --> Conflict["Merge conflict blocks this path"]
Conflict --> V7["bash -n plus Strix self-test"]
Evidence --> S8["CI script: figma_rest_file.py"]
S8 --> I8["review and security gate shell path"]
I8 --> Conflict["Merge conflict blocks this path"]
Conflict --> V8["bash -n plus Strix self-test"]
Evidence --> S9["Test: test_figma_rest_auth.py (2 files)"]
S9 --> I9["regression suite"]
I9 --> Conflict["Merge conflict blocks this path"]
Conflict --> V9["targeted test run"]
|
Codex ownership note: claimed this Project #1 item at 2026-09-01T00:15:20+0900 for isolated conflict reconciliation against current protected main, current-head review disposition, and full exact-head revalidation. PR #1411 remains independently in hosted-check wait; the only shared path is CHANGELOG.md and no concurrent source edits will be made in the same worktree. |
|
Current-main reconciliation pushed at exact HEAD |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current-head remediation is now b159854. The hosted Strix failure root cause was the pipefail-unsafe bootstrap grep; the one-file shell fix passed the complete test_strix_quick_gate.sh self-test. Devin then identified two valid Figma findings, fixed on the same branch: direct CLI imports now work from arbitrary cwd, and generated labels reject Figma credential markers case-insensitively. Verification on the resulting tree: git diff --check; Ruff; Figma focused suite 66 passed; full pytest 2192 passed, 1 skipped, 21 subtests. Both review threads were answered and resolved; hosted exact-head checks remain authoritative before merge. |
|
Follow-up exact head d2da380 also ports the validated Noema concurrency correction: cancelled workflow_run follow-ups use their run ID and can no longer evict an actionable same-PR review. Evidence: required-workflow contract 68 passed; full pytest 2192 passed, 1 skipped, 21 subtests; git diff --check. The prior b159854 Noema run was cancelled before steps, not a source-test failure. Hosted checks on d2da380 are now authoritative. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent Review exact current head |
|
Scheduled review-feedback autofix for this PR head.
|
3 participants
Summary
Validation
python3 -m pytest -q tests/test_figma_rest_file.py tests/test_figma_rest_auth.py(64 passed)python3 -m compileall -q ...git diff --checkSupersedes #1043. No Copilot token or bypass is used.