fix(noema): remove dead CodeGraph context branch from Noema review gate - #1491
Conversation
load_codegraph_context() read NOEMA_CODEGRAPH_CONTEXT_PATH and always returned "" because no workflow ever set that variable -- a full-repo grep confirms only this script and its own unit tests referenced it, and noema-review.yml never mentions CodeGraph. Every production Noema review therefore rendered an always-empty "## CodeGraph context" section while its own LLM prompt claimed CodeGraph context was supplied. Wiring the capability up for real would mean running the CodeGraph CLI's trusted-root setup against untrusted PR code inside noema-review.yml, a workflow that currently never checks out PR head content at all (it only materializes the trusted gate script itself and reads PR data through the GitHub content API) -- a security-sensitive feature addition, not a minimal fix. Since CodeGraph context was never wired for Noema and nothing else in the repo advertises it as a Noema capability, remove the hollow branch, the dead helper, and the prompt's false claim instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Gs7KmNvH75nxz1sL8mKjw
|
Warning Review limit reachedNext included review available in 10 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (9)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Resolve conflicts from concurrent hollow-path audit PRs that merged to main since this PR was opened. # Conflicts: # tests/test_noema_review_gate.py
|
Contextual-Orchestrator와 관계한 것들을 같이 손보든 어쩌든 해결하세요. Bypass merge 필요하면 가능 (chicken and eggs 상황이라면) + NVIDIA NIM 만 쓰는 건 허용하지 않아요. Contextual-Orchestrator를 쓰세요. Timeout은 적어도 3시간으로 잡으세요. 120초 같은 건 당황스럽군요. Opencode와 Noema 는 Coderabbitai 및 Devin 수준으로 실제로 리뷰를 하게 하시오. Strix도 보안 리뷰를 꼼꼼하게 하도록 하시오. 특히 보안 리뷰는 전체 코드로 수행하는 것입니다. Contextual-Orchestrator는 실시간으로 빠르면서 능력이 좋은 모델에 요청을 보내어 시간을 당기시오. |
|
@opencode-agent review the current exact head |
Rebasing onto current main inherited the same pre-existing coverage gap #1547 (not yet merged) fixes: two REST-fallback scheduler code paths (fetch_workflow_names_by_check_suite_rest's pagination/error-handling, inspect_pr's conflicted-branch draft/unauthorized-conflict skips) with no existing test coverage. Ported #1547's identical test additions here rather than leaving this PR red waiting on that one to merge first -- this will no-op once #1547 lands and this branch rebases again. Full suite: 2228 passed, 1 skipped, 21 subtests. 100% coverage, 100% docstrings.
|
@opencode-agent review exact current head |
|
@opencode-agent review exact head |
|
Fresh current-main ownership check after #1546: the hollow path still exists on protected @opencode-agent fix and review |
|
Confirmed the branch is 7 ahead / 1 behind current main and the scheduler-test changes are not this PR's own concern — but they aren't arbitrary pollution either: I re-verified from a clean, unmodified Rather than carry that fix inside this PR's diff (which is what produced the pollution you flagged) or strip it out and leave Generated by Claude Code Generated by Claude Code |
|
Reorder this lower-risk hollow-path cleanup behind the active Noema correctness owners to prevent three branches from independently rewriting |
|
Acknowledged — holding on this per the updated plan. Checked Generated by Claude Code Generated by Claude Code |
|
Current effective diff still carries unrelated scheduler-coverage files ( |
…rest-and-live-head' into fix/hollow-codegraph-context # Conflicts: # tests/test_pr_review_fix_scheduler_rest_workflow_identity.py
|
Converged onto protected main ( Base-relative delta on the new head ( Validated: Generated by Claude Code Generated by Claude Code |
|
Stack normalized onto #1567's branch ( |
400f2b5
into
fix/main-coverage-gap-scheduler-rest-and-live-head
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| def load_codegraph_context() -> str: | ||
| """Load optional precomputed CodeGraph context for structural review evidence.""" | ||
| path = os.environ.get("NOEMA_CODEGRAPH_CONTEXT_PATH", "").strip() | ||
| if not path: | ||
| return "" | ||
| try: | ||
| with open(path, encoding="utf-8") as handle: | ||
| return truncate_text(handle.read(), MAX_REVIEW_CONTEXT_CHARS) | ||
| except OSError as exc: | ||
| return f"CodeGraph context unavailable: {exc}" |
There was a problem hiding this comment.
📝 Info: Removed branch had no producer
load_codegraph_context had no production configuration or producer. Remaining CodeGraph setup belongs to OpenCode, so Noema loses no deployed review evidence.
Was this helpful? React with 👍 or 👎 to provide feedback.
2 participants
Summary
Fixes a confirmed hollow-path finding from the org-wide audit (
빈 깡통 경로sweep):load_codegraph_context()inscripts/ci/noema_review_gate.pyreadsNOEMA_CODEGRAPH_CONTEXT_PATHand always returned""because no workflow ever sets thatvariable. A full-repo grep before this change confirmed only
noema_review_gate.pyand its ownunit tests referenced the env var, and
noema-review.ymlnever mentions CodeGraph at all. Everyproduction Noema review therefore rendered an always-empty
## CodeGraph contextsection, whilethe reviewer LLM's own prompt claimed CodeGraph context was supplied — a review capability that
read as wired but never was.
Why removal instead of wiring it up
The finding's suggested direction offered two options: wire the env var for real, or remove the
dead branch if the capability was abandoned. I chose removal because:
noema-review.ymlnever checks out PR head content today — it only materializes the trustednoema_review_gate.pyscript itself fromContextualWisdomLab/.github@<trusted sha>and readsPR data through the GitHub content API (
changed_file_context). There is no local clone for aCodeGraph index to run against.
opencode-review-dispatch.yml'sCODEGRAPH_TRUSTED_ROOT/CODEGRAPH_NO_DOWNLOADsetup) is a ~150-line, security-sensitive trusted-root/hash-verificationflow for running an npm CLI against untrusted PR code. Bolting that onto a different workflow
with a different trust model is a real feature addition, not a minimal, scoped fix for a hollow
path.
noema_review_gate.pyand its tests advertises "CodeGraph context" as a Noemacapability (checked
docs/,README.md,PR_GOVERNANCE_AUDIT.md— all CodeGraph mentions thereare about OpenCode review's CodeGraph use, which is real and wired, and untouched by this PR).
Changes
scripts/ci/noema_review_gate.py: removeload_codegraph_context(), the## CodeGraph contextbranch in
build_review_context(), and the false "CodeGraph context" claim in the reviewerprompt text.
tests/test_noema_review_gate.py,tests/test_repository_branch_coverage_javascript_and_noema.py,tests/test_repository_branch_coverage_reporting_edges.py: drop the now-deadNOEMA_CODEGRAPH_CONTEXT_PATH/load_codegraph_contextsetup and assertions from the affectedtests; renamed one test to drop "codegraph" from its name.
No workflow files change —
noema-review.ymlnever referenced this env var, so there is nothingto remove there.
Verification
Ran from a clean clone at
origin/mainper this repo's own gates:Developer experience
Removes a function and branch that could never execute with real evidence, and a reviewer-prompt
claim that misrepresented what context Noema actually received. No behavior change for any caller:
build_review_context()'s only observable difference is the permanently-empty CodeGraph section nolonger appears.
User experience
None — this is CI-internal review-context assembly, not an end-user-facing surface. Noema review
verdicts are unaffected since the CodeGraph section was always empty in production.
Generated by Claude Code