fix(ci): lint modern Actions schemas safely - #1247
Conversation
…odern-schema-compat # Conflicts: # .github/workflows/opencode-review-dispatch.yml # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head07da88dc4c709670db19f347fec461cc51ebcb12. -
Head SHA:
07da88dc4c709670db19f347fec461cc51ebcb12 -
Workflow run: 32625830639
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: actionlint-modern-schema-and-shellcheck.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: actionlint-modern-schema-and-shellcheck.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: lint_github_workflows.rb"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: lint_github_workflows.rb"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head evidence but found unresolved reviewer or review-agent threads before approval. Findings1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved reviewer thread blocks automated approval
Review thread evidenceLatest unresolved reviewer thread evidence
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head6e7eb393b309c3cf94a38325dd140df5ed5a88b2. -
Head SHA:
6e7eb393b309c3cf94a38325dd140df5ed5a88b2 -
Workflow run: 32626287656
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: actionlint-modern-schema-and-shellcheck.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: actionlint-modern-schema-and-shellcheck.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: lint_github_workflows.rb"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: lint_github_workflows.rb"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…ns-read-token' into fix/actionlint-modern-schema-compat
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head evidence but found unresolved reviewer or review-agent threads before approval.
Findings
1. HIGH .github/workflows/opencode-review.yml:1 - Unresolved reviewer thread blocks automated approval
- Problem: OpenCode reached an APPROVE control result, but the approval step found unresolved, non-outdated human or review-agent thread evidence on the current pull request.
- Root cause: Reviewer and review-agent feedback can arrive after bounded model evidence is prepared, so the approval step must re-query GitHub immediately before publishing an approval.
- Fix: Address or resolve the listed reviewer thread(s), then re-run OpenCode on the current head.
- Regression test: Keep the approval gate querying reviewThreads(first: 100) after model output and before create_pull_review APPROVE, including bot review agents other than OpenCode itself.
Review thread evidence
Latest unresolved reviewer thread evidence
scripts/ci/lint_github_workflows.rb line 74
- Latest reviewer comment: @devin-ai-integration at 2026-08-23T07:46:44Z
- Comment URL: #1247 (comment)
- Comment excerpt: <!-- devin-review-comment {"id": "ANALYSIS_pr-review-job-ea9a1ea050da481b9a128341f337dae5_0001", "file_path": "scripts/ci/lint_github_workflows.rb", "start_line": 68, "end_line": 74, "side": "RIGHT", "kind": "analysis"} --> / 🔍 Shell-dialect detection parity with actionlint / 'shellcheck_dialect' (scripts/ci/lint_github_workflows.rb:68-74) matches any shell starting with 'bash ' or 'sh ', so custom shells like 'bash --noprofile --norc -e -o pipefail {0}' get ShellCheck run against them. If released actionlint extracts the shell name or gates cu
scripts/ci/lint_github_workflows.rb line 16
- Latest reviewer comment: @devin-ai-integration at 2026-08-23T07:46:46Z
- Comment URL: #1247 (comment)
- Comment excerpt: <!-- devin-review-comment {"id": "ANALYSIS_pr-review-job-ea9a1ea050da481b9a128341f337dae5_0002", "file_path": "scripts/ci/lint_github_workflows.rb", "start_line": 16, "end_line": 16, "side": "RIGHT", "kind": "analysis"} --> / 🔍 ShellCheck exclusion codes vs actionlint defaults / The excluded codes are hardcoded (scripts/ci/lint_github_workflows.rb:16). Any code actionlint 1.7.12 excludes by default but omitted here makes the Ruby path report a finding actionlint suppresses, failing the autofix verifier on a workflow actionlint would accept. The list cannot be verified against actionl
.github/workflows/opencode-review-dispatch.yml line 1768
- Latest reviewer comment: @devin-ai-integration at 2026-08-23T07:46:47Z
- Comment URL: #1247 (comment)
- Comment excerpt: <!-- devin-review-comment {"id": "ANALYSIS_pr-review-job-ea9a1ea050da481b9a128341f337dae5_0003", "file_path": ".github/workflows/opencode-review-dispatch.yml", "start_line": 1767, "end_line": 1768, "side": "RIGHT", "kind": "analysis"} --> / 📝 Info: GPU adapter file-selection order changed / The rewrite replaces 'ls lvp_icd*.json | head -n1' (alphabetical) with 'find ... -print -quit' (first directory-order match). When multiple 'lvp_icd*.json' files exist, a different ICD can be selected. Provisioning is best-effort, so no gate is affected, but selection
.github/workflows/exact-artifact-sbom-attestation.yml line 370
- Latest reviewer comment: @devin-ai-integration at 2026-08-23T07:53:25Z
- Comment URL: #1247 (comment)
- Comment excerpt: <!-- devin-review-comment {"id": "ANALYSIS_pr-review-job-b0a53505905c4c52802b12f0e76f6aad_0001", "file_path": ".github/workflows/exact-artifact-sbom-attestation.yml", "start_line": 364, "end_line": 370, "side": "RIGHT", "kind": "analysis"} --> / 📝 Info: Process substitution drops find/sort failures the old pipeline caught / The rewrite from 'find | sort | while ... > SHA256SUMS' to 'mapfile -t evidence_files < <(find ... | sort)' ([exact-artifact-sbom-attestation.yml](https://github.com/contextualwisdomlab/.github/blob/b421f46411c8440f75fec545a0f65db889ce
scripts/ci/lint_github_workflows.rb line 66
- Latest reviewer comment: @devin-ai-integration at 2026-08-23T07:53:27Z
- Comment URL: #1247 (comment)
- Comment excerpt: <!-- devin-review-comment {"id": "ANALYSIS_pr-review-job-b0a53505905c4c52802b12f0e76f6aad_0002", "file_path": "scripts/ci/lint_github_workflows.rb", "start_line": 54, "end_line": 66, "side": "RIGHT", "kind": "analysis"} --> / 📝 Info: Windows shell inference misses matrix/expression runs-on / 'windows_runner?' only matches a literal 'windows' / 'windows-*' label ([lint_github_workflows.rb](https://github.com/contextualwisdomlab/.github/blob/b421f46411c8440f75fec545a0f65db889cea8f6/scripts/ci/lint_github_workflows.rb#L54-L58 "scripts/ci/lint_github_workflo
scripts/ci/lint_github_workflows.rb line 16
-
Latest reviewer comment: @devin-ai-integration at 2026-08-23T07:53:28Z
-
Comment URL: #1247 (comment)
-
Comment excerpt: <!-- devin-review-comment {"id": "ANALYSIS_pr-review-job-b0a53505905c4c52802b12f0e76f6aad_0003", "file_path": "scripts/ci/lint_github_workflows.rb", "start_line": 14, "end_line": 16, "side": "RIGHT", "kind": "analysis"} --> / 📝 Info: Queue-key suppression depends on exact actionlint message text / The '-ignore' regex 'QUEUE_DIAGNOSTIC' (lint_github_workflows.rb) suppresses actionlint
-
Result: REQUEST_CHANGES
-
Reason: unresolved reviewer or review-agent thread(s) were present before approval.
-
Head SHA:
e7816e92be2cb1499e15002da019f816ace32947 -
Workflow run: 32627117455
-
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: actionlint-modern-schema-and-shellcheck.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: actionlint-modern-schema-and-shellcheck.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: lint_github_workflows.rb"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: lint_github_workflows.rb"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…' into fix/actionlint-modern-schema-compat
131f494
into
fix/scheduler-actions-read-token
1 participant
Root cause
The write-capable autofix verifier invoked actionlint directly. Current actionlint 1.7.12 does not yet recognize GitHub Actions' native
concurrency.queue: maxschema, while its ShellCheck bridge can deadlock when a generated shell input exceeds the pipe-buffer boundary tracked inrhysd/actionlint#712. Treating either condition as a generic pass or disabling shell analysis would hide real workflow defects.Repair
queue: maxupstream schema gap admittedmaxqueue value and retain contextual path/line diagnostics${{ ... }}expressions so ShellCheck parsing and line diagnostics stay alignedfind | sortfailure propagation before exact-artifact checksum inventory generationExact-head verification
Head:
46f3e72110aadda14d77ae6fd56db756350c3fccStacked parent:
ContextualWisdomLab/.github#1231ate594f8ca2367aa226d98fcda4c2d17b248eea76bNo workflow permission, credential source, reviewer identity, approval rule, protected-branch gate, or scanner severity was weakened. This PR remains stacked until #1231 merges; it should then be retargeted to
mainand revalidated on the exact resulting head.