fix(opencode): retain adversarial fallback scope - #1273
Conversation
|
Warning Review limit reachedNext included review available in 38 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (9)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughOpenCode 커버리지 소스를 현재 워크플로 시도와 아티팩트 ID에 연결합니다. 소비자는 시도 일치와 아티팩트 존재를 검증한 뒤 다운로드합니다. 관련 계약 테스트, fallback 허용 목록, Strix 검증과 문서를 갱신합니다. ChangesOpenCode 커버리지 아티팩트 재실행
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change scopes coverage evidence to the current workflow attempt and expands the fallback allowlist for the extracted adversarial-evidence paths. The supplied contract coverage indicates stale artifacts are rejected and missing evidence fails closed, with no remaining merge-blocking risk. Sequence Diagram(s)sequenceDiagram
participant coverage-source-tree
participant upload-artifact
participant coverage-evidence
participant download-artifact
coverage-source-tree->>upload-artifact: 현재 시도 이름으로 커버리지 소스 업로드
upload-artifact-->>coverage-source-tree: artifact-id 반환
coverage-source-tree-->>coverage-evidence: artifact-id와 run_attempt 전달
coverage-evidence->>coverage-evidence: 현재 시도 신원 검증
coverage-evidence->>download-artifact: artifact-ids로 다운로드
download-artifact-->>coverage-evidence: 커버리지 소스 전달
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7bbbed45a4eeaeec6d392dab5a8fad2f82674498. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-adversarial-fallback-scope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-adversarial-fallback-scope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7bbbed45a4eeaeec6d392dab5a8fad2f82674498. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32661154228/job/97247436674)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: opencode-adversarial-fallback-scope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: opencode-adversarial-fallback-scope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…HEAD # Conflicts: # scripts/ci/test_strix_quick_gate.sh
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Disposition: informational and accepted. The added classifier intentionally matches the exact bare timeout emitted by the existing self-test fixture, while the existing qualified path remains covered. No further source change is required. |
|
Disposition: informational and accepted. The added litellm.Timeout classifier intentionally matches the exact bare timeout emitted by the existing self test fixture, while the existing qualified litellm.exceptions.Timeout path remains covered. No further source change is required. |
|
Exact-head RCA: Strix run 32688204055 checked out 9fd37e2 and completed the source scan, but NVIDIA NIM emitted provider infrastructure/failure-signal output; the fallback then used the protected-base openai-direct alias and LiteLLM rejected it before authoritative evidence. No source finding was produced. The separate scan-pr-queue run was cancelled before steps. This PR remains non-mergeable until its base/control-plane provider repair is available and fresh exact-head checks plus formal review are produced. |
Current-head re-review request\n\nCurrent exact head: 212d070\n\nThe previous REQUEST_CHANGES review is tied to an older Strix/provider-failure head. Current-head evidence must be re-established from this SHA; predecessor failures and approvals are not being reused. Please inspect the complete current diff and publish a substantive review after the current required Checks finish. No merge is requested until exact-head checks and independent approval are current. |
|
Exact-head formal review request for 212d070. Please inspect the complete changed-file diff, with emphasis on adversarial fallback scope and provider-failure handling. Publish a substantive Reviews API verdict tied only to this exact SHA, including security/control-plane impact, test gaps, and residual uncertainty. Do not reuse predecessor-head evidence or failed provider checks as source findings. @opencode-agent |
|
Current-head conflict repair and verification:
Current hosted required Checks and independent review are still pending, with no valid unresolved review threads. This PR remains |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3ab55c3da0e9b05c6cc9e80fc3d5fe89a6f53b84. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
3ab55c3da0e9b05c6cc9e80fc3d5fe89a6f53b84. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32724098358/job/97421469269)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: opencode-review-dispatch.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: opencode-review-dispatch.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
…ain-replacement-20260824 # Conflicts: # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
Resolved the stale merge conflict against
|
# Conflicts: # CHANGELOG.md # tests/test_pr_review_autofix_nvidia_nim_contract.py
Stale base resolved — merged current
|
The only conflict is REVIEW_DISPATCH_BLOB_SHA, which pins `.github/workflows/opencode-review-dispatch.yml` byte-for-byte via `git hash-object`. Both sides' values are correct for their own tree and wrong for the merge: branch 254df8e… == hash of the branch's copy main ade10b3… == hash of main's copy merged ccc0d34… == hash of the merged file, neither side's value Taking either side verbatim would fail the pin, so the constant is recomputed against the actual merged file. The accompanying semantic assertion still holds: the merged dispatch workflow contains no `pr-review-autofix` reference. Verified after resolution: 2895 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
#1932 changed `.github/workflows/opencode-review-dispatch.yml`, which REVIEW_DISPATCH_BLOB_SHA pins by whole-file `git hash-object`. The workflow itself auto-merged cleanly; only the pin line conflicted, and again neither side's value is right for the merge: this branch ccc0d34… (its own tree) main 26e8555… (after #1932) merged 449cee2… (recomputed) 449cee2 matches the value predicted by simulating this merge before #1932 landed, so the pin behaves exactly as expected under a base change. Verified: 2896 passed, 1 skipped, coverage 100%, interrogate 100%; zero conflict markers; `ruff check --select F821` clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2 participants
Outcome
Keeps the extracted adversarial-evidence gate and its test inside the exact central OpenCode fallback allowlist. This is a clean current-main replacement for #904 and omits its unrelated pip-lock and materializer history.
Closes #626.
Supersedes #904.
Verification
Standards
The doctoring record cites NIST SP 800-53 Rev. 5 SA-11 and the stable OWASP Web Security Testing Guide v4.2 in APA 7th form.
Summary by CodeRabbit
버그 수정
문서
테스트