fix: grant hourly callers reusable workflow OIDC scope

[seonghobae]

Root cause

Scheduled DiskSage and Clearfolio hourly caller runs have ended in startup_failure with no jobs since the callers invoke a reusable scheduler that requests an OIDC exchange. The fast-mlsirm caller already declares job-scoped id-token: write; these two callers did not, so the called workflow could not receive the required permission.

Change

• grant only contents: read and job-scoped id-token: write to DiskSage and Clearfolio reusable-workflow jobs;
• retain explicit scheduler secrets and no repository/write/model/Copilot permissions;
• update contract tests and doctoring.

Proof

python -m pytest -q tests/test_disksage_hourly_review_caller.py tests/test_pr_review_fix_hourly_contract.py tests/test_hourly_scheduler_runtime_budget.py → 24 passed.
git diff --check and actionlint passed.

This is a normal protected PR; no bypass or self-approval.

---

Summary by CodeRabbit

• 개선 사항

  • 시간별 검토·복구 워크플로에서 제한된 읽기 권한과 작업 범위의 OIDC 인증 권한을 지원합니다.
  • 워크플로 호출자의 권한 경계를 강화해 불필요한 쓰기 권한을 제거했습니다.
  • 보안 감사에 사용되는 고정 pip 버전과 해시를 업데이트했습니다.

• 문서

  • OIDC 인증 및 최소 권한 구성에 대한 워크플로 계약 문서를 갱신했습니다.

• 테스트

  • 새로운 권한 구성과 작업 수준 적용 여부를 검증하도록 계약 테스트를 업데이트했습니다.

[coderabbitai]

Warning

Review limit reached

Next included review available in 28 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a0f65ab-4185-4da9-b2fe-d62833ebf619

📥 Commits

Reviewing files that changed from the base of the PR and between 7c131ad and 432a07a.

📒 Files selected for processing (2)

• CHANGELOG.md
• docs/doctoring/clearfolio-hourly-review-caller.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe8e278d-152b-469c-af4c-400ebb342a75

📥 Commits

Reviewing files that changed from the base of the PR and between dd58a88 and 7c131ad.

📒 Files selected for processing (8)

• .github/workflows/clearfolio-hourly-review-repair.yml
• .github/workflows/disksage-hourly-review-repair.yml
• CHANGELOG.md
• docs/doctoring/clearfolio-hourly-review-caller.md
• docs/doctoring/disksage-hourly-review-caller.md
• requirements-pip-audit-ci-hashes.txt
• tests/test_disksage_hourly_review_caller.py
• tests/test_pr_review_fix_hourly_contract.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

시간별 Clearfolio와 DiskSage 리뷰 복구 호출자에 contents: read 및 작업 범위 id-token: write 권한을 추가했습니다. 관련 문서와 계약 테스트를 갱신하고, 해시 고정 pip 버전을 26.2.1로 변경했습니다.

Changes

시간별 리뷰 복구 OIDC 권한

Layer / File(s)	Summary
호출 워크플로 권한 및 계약 문서 .github/workflows/*hourly-review-repair.yml, docs/doctoring/*hourly-review-caller.md	Clearfolio와 DiskSage 호출 워크플로에 contents: read 및 id-token: write를 추가했습니다. 문서는 작업 범위 OIDC 권한과 제한된 토큰 권한을 반영합니다.
권한 계약 테스트 tests/test_disksage_hourly_review_caller.py, tests/test_pr_review_fix_hourly_contract.py	계약 테스트가 작업 수준의 contents: read 및 id-token: write 선언을 확인합니다. 모의 실행 함수의 사용하지 않는 인자 처리도 정리했습니다.

pip 감사 고정 버전

Layer / File(s)	Summary
해시 고정 pip 버전 갱신 requirements-pip-audit-ci-hashes.txt, CHANGELOG.md	보안 감사용 pip 버전을 26.1.2에서 26.2.1로 변경하고 두 SHA-256 해시를 갱신했습니다. 변경 사항을 CHANGELOG.md에 기록했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 7c131

This PR narrowly grants the required job-scoped OIDC permission while retaining restricted repository access and explicit secrets. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 두 시간별 호출자에 재사용 워크플로 OIDC 권한을 부여하는 주요 변경을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. (6 skipped: 6 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hourly-reusable-oidc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Exact head 7f9f9f0 has focused scheduler contracts passing; the earlier scan-pr-queue run was cancelled by the newer pull_request_review-triggered run, now queued. @OpenCode review exact current head and publish fresh approval.

[seonghobae]

Current-head review complete at 7f9f9f0606ac5c88df3857eb5e5367d5bdbad420 (base 55a8b576725451dfe0a21a57d36a2f1a41619b24). The change is limited to job-scoped contents: read plus id-token: write for DiskSage and Clearfolio reusable-workflow callers, with explicit scheduler credentials and no provider/Copilot or write permissions. Focused suite: 24 passed; actionlint and git diff --check passed. Current hosted runs have no failure; required security, SBOM, CodeQL, Python and Scorecard runs are queued. Please obtain an independent non-author approval on this exact head and wait for terminal protected Checks before merge.

[seonghobae]

@OpenCode review current exact head 7f9f9f0606ac5c88df3857eb5e5367d5bdbad420. Verify the reusable scheduler OIDC permission repair and current central workflow checks; prior results do not transfer.

[seonghobae]

Exact-head local verification for 7f9f9f0606ac5c88df3857eb5e5367d5bdbad420:

• focused contract suite (tests/test_disksage_hourly_review_caller.py, tests/test_pr_review_fix_hourly_contract.py, tests/test_hourly_scheduler_runtime_budget.py): 24 passed
• actionlint .github/workflows/clearfolio-hourly-review-repair.yml .github/workflows/disksage-hourly-review-repair.yml: passed
• git diff --check: passed
• detached worktree is clean after removing the generated untracked uv.lock

This is validation evidence only; no approval or merge action was taken.

[seonghobae]

Reviewed exact HEAD 82cd117d279a9b870f185b136984d82bb3ac5236. The caller permission repair is minimal and correct: contents read plus job-scoped id-token write for the reusable scheduler OIDC exchange, with explicit scheduler secrets and no repository/write/Copilot permissions. I also closed the one remaining docstring gap in the touched hourly contract test. Focused tests: 24 passed; Ruff, compileall, interrogate 100%, actionlint, and diff checks passed. Enabling normal squash auto-merge; protected checks and independent review remain authoritative.

[seonghobae]

@OpenCode review current exact head 82cd117d279a9b870f185b136984d82bb3ac5236. The latest commit closes the touched-test docstring gap; focused tests, Ruff, compileall, interrogate, actionlint and diff checks are recorded. Please bind review to this head only. Normal auto-merge remains protected by required checks and independent approval.

[seonghobae]

Current-head governance recheck for 82cd117d279a9b870f185b136984d82bb3ac5236: no failed hosted Checks and no unresolved review threads were returned. Security/SBOM Checks are queued. Reviews are COMMENTED only; no independent APPROVED review is present, so protected merge is not attempted.

[seonghobae]

@OpenCode review current head 82cd117. Validate reusable-workflow caller permissions and hourly scheduler coverage.

[seonghobae]

Current-head disposition — reusable-workflow OIDC scope

• Exact head: 3ab34b57a7ab04eb14b5fca7994dd047df676748
• Exact base: 731af58e954901c4f1cc853231c592abb1eaf617
• Bounded diff: two hourly reusable-workflow callers, two doctoring documents, and two contract-test files. The caller grants only job-scoped contents: read plus id-token: write for the reusable scheduler's OIDC-to-app-token exchange; repository write permissions, model secrets, and secrets: inherit remain absent.
• Exact-current local evidence: 24 focused contract/runtime tests passed using the existing project Python environment; actionlint on both changed workflows and exact-base git diff --check passed. The earlier review at 7f9f9f0 is not treated as current-head approval.
• Live state: OPEN, non-Draft, MERGEABLE; current hosted security/policy/SBOM checks are queued and no formal independent approval is present.
• Decision: WAIT_AND_REMEDIATE; no approval, bypass, or merge performed.

[seonghobae]

@opencode-agent Please perform a review-only substantive review of exact current head 3ab34b57a7ab04eb14b5fca7994dd047df676748 against base 731af58e954901c4f1cc853231c592abb1eaf617. Re-check the reusable caller job permissions, OIDC exchange boundary, explicit secret scope, docs, tests, and full diff. Do not approve or merge.

[seonghobae]

Exact-head review disposition

• Pull request: fix: grant hourly callers reusable workflow OIDC scope #1188
• Exact head SHA: 3ab34b5
• Exact base SHA: 731af58
• Decision: WAIT_AND_REMEDIATE

The bounded change grants the hourly Clearfolio and Disksage callers the reusable-workflow OIDC permission and updates the corresponding contract/documentation evidence. Local exact-head checks: 21 targeted tests passed, actionlint passed for both changed workflows, and git diff check passed.

Hosted exact-head state is incomplete: 16 Checks remain nonterminal and no formal APPROVED review exists. Mergeable metadata alone is not protected merge evidence. This is not a D1-D5 deadlock; continue normal required Checks and independent review. No bypass or force merge is authorized.

[seonghobae]

@opencode-agent Please perform a substantive independent review of exact head 3ab34b5 only. Read the full changed workflow/docs/test diff, report security/permission and regression findings, and publish the verdict against this SHA. Do not reuse predecessor-head evidence.

[seonghobae]

Hosted check follow-up for exact head 3ab34b5

The latest hosted observation has three non-success conclusions, all infrastructure-only neutral results: OSV scanner reports missing security-scan.yml configuration, Trivy reports missing scheduled-security-scan.yml configuration, and Scorecard reports missing supply-chain/branch-protection configuration. None reports a source/test/security finding in this PR. Eight checks remain nonterminal and exact-head approval remains absent. Keep this PR on WAIT_AND_REMEDIATE; repair the missing central scanning configuration through its own bounded control-plane change, then rerun the gates. Do not convert neutral to success or bypass protection.

[seonghobae]

Exact-head review audit

• Exact head: 3ab34b5
• Exact base: 731af58
• Scope: two reusable-workflow callers only; job scope adds contents: read and id-token: write for the documented OIDC exchange, without repository, pull-request, workflow, or secret inheritance elevation.
• Review threads: 0 unresolved.
• Local verification: 21 focused tests passed; Ruff, compileall, git diff --check, and actionlint passed.
• Hosted exact-head evidence: security, SAST, CodeQL detection, Strix, Noema, scheduler, and cadence gates passed; coverage/CodeQL provider jobs remain queued.
• Decision: NORMAL_MERGE via the already-enabled squash auto-merge; no bypass.

[seonghobae]

Exact-head review disposition.

• Head: 3ab34b57a7ab04eb14b5fca7994dd047df676748
• Base: 731af58e954901c4f1cc853231c592abb1eaf617
• Scope: caller-scoped id-token: write for the two reusable hourly workflows; no secret inheritance or write permissions added.
• Review threads: none unresolved.
• Local focused evidence previously recorded: 21 passed; Ruff, compileall, git diff --check, and changed-workflow actionlint passed.
• Current hosted pip-audit failure is a real inherited PYSEC-2026-3721 lock finding on the old base, not an infrastructure deadlock; normal security-root PR fix(review): fail closed before every Noema skip path #1198 updates pip to 26.2.1.
• Decision: WAIT_AND_REMEDIATE pending exact-head checks after the security base repair and independent approval. Normal squash auto-merge enabled; no bypass.

[seonghobae]

Exact-head verification update

• Exact head: bce92b810ca42175d1222615178ff864128e1993
• Exact base: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• Local merge-result tree: b63755b94ac0f5cec0ac85e4e9a0890902b4c823 (base is an ancestor; tree equals current head)
• Full local verification: 1308 passed, 16 subtests; statement/branch coverage 8128/3144, 100%; interrogate 100%; compileall, Clearfolio/DiskSage actionlint, shell syntax, exact hash-lock pip-audit, and git diff --check passed.
• Current hosted exact-head observation: all prior runs are cancelled/skipped or completed successfully; no current qualifying required run is pending, and no qualifying formal approval is present. Previous f2f79b9… evidence is stale after the head update.

Decision: WAIT_AND_REMEDIATE. Keep normal auto-merge enabled and obtain fresh current-head required Checks and independent approvals. No bypass, force push, direct protected-branch push, fake status, or self-approval.

[seonghobae]

Current-head verification record

• Exact head SHA: bce92b810ca42175d1222615178ff864128e1993
• Exact base SHA: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• State: OPEN, non-draft, MERGEABLE, normal squash auto-merge enabled.
• Diff: two hourly reusable-workflow callers now grant only job-level id-token: write alongside read-only contents, with contract/docs and inherited CI maintenance updates.
• Local verification at this exact head:
  • caller/reusable-scheduler/coordinator/queue tests — 107 passed
  • STRIX_TEST_PROCESS_TIMEOUT_SECONDS=3 STRIX_TEST_FAKE_SLEEP_SECONDS=5 bash scripts/ci/test_strix_quick_gate.sh — passed
  • python -m compileall — passed
  • actionlint on all affected workflows — passed
  • interrogate --fail-under 100 scripts/ci — 100%
  • git diff --check — passed
• Unresolved non-outdated review threads: 0.
• Decision: WAIT_AND_REMEDIATE pending current-head required checks and qualifying approval. No force-merge criteria are present.

[seonghobae]

Current-head repair — exact head 3e2dc26

• Exact base: fce028b.
• Root cause from the prior exact-head failure: scripts/ci/test_strix_quick_gate.sh asserted a stale cancel-in-progress expression after the current scheduler gained the explicit orphan workflow_run cancellation clause. The contract now matches the live scheduler expression.
• A remote Agent merged current main first; that commit was fetched and merged normally before this fix. No force-push or history rewrite was used.
• Exact local verification after the remote merge: python -m pytest tests -q (1308 passed, 16 subtests); Python statement/branch coverage 100% (8128/8128 statements, 3144/3144 branches); compileall; changed-workflow actionlint for the four touched scheduler/caller files was run. The current main baseline also reports four pre-existing actionlint expression diagnostics in pr-review-fix-scheduler.yml, which this PR does not modify.
• Hosted required Checks for this SHA are newly queued/in progress. No qualifying independent approval is present on this SHA.
• Decision: WAIT_AND_REMEDIATE pending exact-head hosted Checks and protected review. No bypass, force push, direct protected-branch push, fake status, or approval manipulation was used.

[seonghobae]

Exact-head verification (2026-08-22): head 3e2dc26, base fce028b, merge-result tree fc41f92f64baf642cfa718a2e69072a048ae5b9f. Local evidence: 1308 passed, statement/branch coverage 8128/3144 (100%), interrogate 100%, compileall, actionlint for clearfolio-hourly-review-repair.yml and disksage-hourly-review-repair.yml, hash-locked pip-audit (No known vulnerabilities found), and git diff --check all passed. Hosted exact-head checks were still running/queued when observed, with 8 success and 13 skipped results; formal approvals remain 0. Decision: WAIT_AND_REMEDIATE pending terminal required Checks and normal independent approval. No bypass or forced merge.

[seonghobae]

Exact-head review disposition

• Pull request: fix: grant hourly callers reusable workflow OIDC scope #1188
• Exact head: 2c05f05f5fbb923099e0e228d616ab9974dbd327
• Exact base: 0156282022134484ea9d7541d5ba0730ba14fd96
• Verified merge-result tree: 6c19376c4a030eb97a9d4b7f6a2a0b85d38740a3
• Bounded diff: two reusable-workflow callers receive only job-scoped contents: read and id-token: write; docs, changelog, contract tests, and required docstring maintenance are included. No secret inheritance or repository/write/model permission was added.
• Exact-head local verification: focused caller/scheduler suite 24 passed; full suite 1,319 passed with 16 subtests; production statement coverage 8,168/8,168 and branch coverage 3,162/3,162; interrogate 730/730; actionlint, compileall, git diff check, Semgrep (0 findings), and hash-locked pip-audit (no known vulnerabilities) passed.
• Local gitleaks is unavailable; hosted Secret Scan remains required and queued. The unpinned latest Ruff probe reports existing repository-wide baseline diagnostics and is not treated as a passing gate.
• Exact-head Reviews API: no current formal review or approval. Hosted snapshot remains non-terminal with 5 success, 13 skipped, and 16 queued aggregate entries plus pending records.
• Normal squash auto-merge is now armed. This is not a D1–D5 deadlock: the required runs were created, the remaining wait is fresh hosted gate/review state, and no source failure or bypass evidence exists.
• Decision: WAIT_AND_REMEDIATE.

[seonghobae]

Exact-head verification (2026-08-22): head 2c05f05, base 0156282, merge-result tree 6c19376c4a030eb97a9d4b7f6a2a0b85d38740a3. The current main-refresh head was validated from scratch: 1319 passed; statement/branch coverage 8168/3162 (100%); interrogate 100%; compileall; actionlint for clearfolio-hourly-review-repair.yml and disksage-hourly-review-repair.yml; shell syntax; hash-locked pip-audit (No known vulnerabilities found); and git diff --check all passed. Hosted rollup currently has 25 success, 18 skipped, 1 cancelled, 3 neutral, and 4 queued/in-progress results; formal approvals remain 0. Decision: WAIT_AND_REMEDIATE pending terminal required Checks and normal independent approval. No bypass or forced merge.

[seonghobae]

Triage sweep: attempted to merge current main into this branch to clear the stale dirty/behind state (no owner activity since Aug 30). The conflict is more than mechanical:

main merged #1673 (refactor(actions): consolidate hourly review-repair callers), which deletes the per-repository caller workflows — including .github/workflows/clearfolio-hourly-review-repair.yml and .github/workflows/disksage-hourly-review-repair.yml, the exact two files this PR patches — and their dedicated tests (tests/test_disksage_hourly_review_caller.py), replacing all 18 with a single .github/workflows/hourly-review-repair.yml matrix workflow plus tests/test_pr_review_fix_hourly_contract.py coverage.

So the fix this PR carries (granting job-scoped id-token: write/contents: read to the DiskSage and Clearfolio reusable-workflow jobs) needs to be re-applied against the new consolidated hourly-review-repair.yml matrix entries for those two repos, not merged onto files main no longer has. That's a rewrite of the fix's target, not a conflict resolution, so I'm leaving it for the PR owner/dedicated automation rather than guessing at the right matrix-entry shape. Root cause and permission fix in the PR description still look correct in principle — verify whether the consolidated workflow already carries the fix (post-#1673) before redoing it.

No changes pushed; branch left as-is.

---

Generated by Claude Code

[seonghobae]

완전 승계 확인 및 종결 근거

이 PR의 유효 delta는 보호된 main에 별도 successor로 완전히 승계됐습니다.

• 병합된 #1673이 18개 개별 hourly caller를 .github/workflows/hourly-review-repair.yml 한 파일로 통합했습니다.
• 통합본은 Clearfolio 23 * * * *, DiskSage 37 * * * *, 각 target/base/retry/concurrency 값을 보존합니다.
• 공통 dispatch job에 최소 권한 contents: read와 id-token: write가 적용되어 Clearfolio와 DiskSage 모두 reusable scheduler의 OIDC 교환 권한을 갖습니다.
• tests/test_hourly_review_repair_callers.py가 두 target을 포함한 18개 former caller의 cadence·target·base·retry·concurrency를 단일 계약으로 검증합니다.
• pip==26.2.1은 현재 main의 pyproject.toml과 hash-locked requirements-pip-audit-ci-hashes.txt에 반영되어 있습니다.
• 개별 caller source를 되살리는 것은 이미 완료된 중앙 통합을 역행하고 GitHub Actions registry·bootup 수를 다시 늘립니다.

따라서 #1188을 단순 폐기가 아니라 #1673 및 현재 main에 의한 유효 delta 완전 승계로 종결합니다. predecessor의 과거 Checks·리뷰는 successor에 이전하지 않으며, 현재 운영 권위는 통합 workflow와 그 계약 테스트입니다.