fix(ci): correct required-workflow-bootstrap job-scope check boundary

[seonghobae]

Root cause

scripts/ci/test_strix_quick_gate.sh's assert_opencode_review_uses_codegraph_and_contextual_orchestrator check used:

awk '/^  required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep -q '^[[:space:]]*if:'

to assert that the required-workflow-bootstrap job in .github/workflows/opencode-review.yml has no if: gating (it must run unconditionally so branch protection always sees the required context). The end pattern /^[^ ]/ only matches a fully unindented line, but job headers in this workflow are 2-space indented — so the awk range never actually stops at the next job boundary and instead sweeps every subsequent job (coverage-source-tree, coverage-evidence, opencode-review-target) all the way to end of file.

This was latent (the swept-in jobs had no if: of their own) until #1497 ("require substantive agent verdicts") added a genuine step-level if: github.event.action != 'closed' inside opencode-review-target. The over-broad range now sweeps that line in and misattributes it to required-workflow-bootstrap, which has no if: at all and was always compliant — failing exact-head-path-policy/test_strix_quick_gate on every open PR against current main, not just the one where I first hit it (#1527).

Confirmed reproducing identically against a clean origin/main checkout (1cbb6aaf), independent of any PR's own diff.

Fix

Corrected the awk range to track an explicit found flag and exit as soon as it reaches the next 2-space-indented job header, so it captures only the required-workflow-bootstrap job's own body:

awk '
	/^  required-workflow-bootstrap:$/ { found=1; print; next }
	found && /^  [A-Za-z0-9_-]+:$/ { exit }
	found { print }
' "$bootstrap_file" | grep -q '^[[:space:]]*if:'

Verified the corrected range now extracts only required-workflow-bootstrap's own steps (stopping right before coverage-source-tree:), and still correctly flags a real violation if one were reintroduced.

Verification

• PYTHONPATH=. coverage run -m pytest tests && coverage report && interrogate: all tests pass, 100% statement/branch coverage, 100% docstrings (unchanged from baseline — this is a test-script-only fix, no scripts/ci/*.py touched).
• bash scripts/ci/test_strix_quick_gate.sh: previously failed with FAIL: opencode required workflow bootstrap must not depend on required-workflow event payload fields; now reports test_strix_quick_gate: PASS.

Developer experience

Restores exact-head-path-policy/test_strix_quick_gate to a correct, narrowly-scoped check instead of a false positive that blocks every open PR once opencode-review.yml gains any step-level if: anywhere after the bootstrap job.

User experience

No user-facing change — CI-only fix.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 40 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 63be1b71-396e-465b-849b-fc9d35d6b472

📥 Commits

Reviewing files that changed from the base of the PR and between 1cbb6aa and b62e75f.

📒 Files selected for processing (2)

• CHANGELOG.md
• scripts/ci/test_strix_quick_gate.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Closing as a duplicate writer of canonical existing owner #1506.

Live exact-head comparison:

• fix(ci): bound required-workflow-bootstrap awk extraction to its own job #1506 c6305c9732faceb8a21561db11dc4717296a9a1c is 0 behind protected main and already owns scripts/ci/test_strix_quick_gate.sh for this exact job-boundary defect.
• It contains the same stateful next-job boundary plus the still-required pipefail/SIGPIPE-safe consumer and executable regressions for a real job-level if: and a 20,000-line block.
• Its exact-head path-policy and generated Security/SAST/CodeQL/Python/OSV/Secret/Scorecard/SBOM workflows are terminal-success; required OpenCode/full Strix/Noema/formal approval remain non-passing, so no merge or evidence transfer is implied.

#1528 b62e75f3dd28788b0a37aef2e9532451359f24b0 is a narrower later implementation of the same boundary. Keeping it open would violate the single-writer owner rule and spend review/scanner capacity on a competing branch. #834 remains blocked on protected integration of #1506 and fresh exact-head evidence.