fix(automation): recover organization loop without maintainer PAT - #1581
fix(automation): recover organization loop without maintainer PAT#1581seonghobae wants to merge 5 commits into
Conversation
|
Warning Review limit reachedNext included review available in 10 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Pull request was closed
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| def test_missing_maintainer_secret_uses_bounded_job_oidc_exchange() -> None: | ||
| """A protected scheduled pass must not die solely because the PAT is absent.""" | ||
| source = WORKFLOW_PATH.read_text(encoding="utf-8") | ||
| _, dispatch_step = source.split( | ||
| " - name: Coordinate one bounded fleet pass\n", maxsplit=1 | ||
| ) | ||
|
|
||
| assert "id-token: write" in source | ||
| assert "api.opencode.ai:443" in source | ||
| assert "OIDC_AUDIENCE: opencode-github-action" in dispatch_step | ||
| assert "OPENCODE_API_BASE_URL: https://api.opencode.ai" in dispatch_step | ||
| assert "ACTIONS_ID_TOKEN_REQUEST_TOKEN" in dispatch_step | ||
| assert "ACTIONS_ID_TOKEN_REQUEST_URL" in dispatch_step | ||
| assert "--connect-timeout 10" in dispatch_step | ||
| assert "--max-time 30" in dispatch_step | ||
| assert "/exchange_github_app_token" in dispatch_step | ||
| assert 'export GH_TOKEN="$app_token"' in dispatch_step | ||
| assert "::add-mask::$oidc_token" in dispatch_step | ||
| assert "::add-mask::$app_token" in dispatch_step | ||
| assert "${{ github.token }}" not in dispatch_step | ||
| assert "GITHUB_TOKEN:" not in dispatch_step |
There was a problem hiding this comment.
🔍 Runtime exchange needs operational evidence
Static assertions cannot exercise exchange_github_app_token. The documented protected-main run must verify the returned installation can inspect and dispatch across eligible repositories.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Ready successor to closed Draft #1577 using the exact same reconciled source tree.
Root cause
The protected-main organization commercial-readiness coordinator can fail before execution when
PR_REVIEW_MERGE_TOKENis absent. The bounded repair keeps that secret as first choice and, only on trusted protected-main execution, exchanges job-scoped GitHub OIDC evidence for the existing short-lived OpenCode GitHub App credential. It does not fall back to the repositoryGITHUB_TOKEN, reviewer credentials, or provider/model keys.Test-first evidence
The original branch established hosted RED on
d6a726219bb317f12748006acbce050b27715bbcand hosted GREEN on46261f201ba5d1dde7c40023dc6bd7097240abb9: 35 focused tests passed;organization_commercial_readiness_loop.pyreached 100% statement/branch coverage; compileall and clean-tree verification passed. Those predecessor receipts are lineage only; exact-current hosted evidence must regenerate.Current-main reconciliation
Protected main advanced to
7f3581693dc0f40df32914c695645f500e3a3ba7. Fresh compare proved main's intervening delta and this repair's three-file delta were disjoint. The source was reconciled without force-push or destructive rebase by merge commit556dee448b24116276673321fcae0fbf564b84c8, whose parents are the prior source head and exact protected main. Its tree uses protected main as baseline and reapplies only:.github/workflows/organization-commercial-readiness-loop.ymldocs/doctoring/organization-commercial-readiness-loop.mdtests/test_organization_commercial_readiness_loop_secret_scope.pyThe previous Draft conversation was closed because the connected Ready mutation is broken by a connector GraphQL schema mismatch. This successor branch points to the exact same reconciled commit and exists only to regenerate legitimate Ready-only exact-head checks/reviews.
Merge boundary
No self-approval, gate weakening, synthetic status, force push, destructive rebase, or predecessor evidence transfer. Merge only after this exact head has terminal required checks, zero substantive unresolved findings, and qualifying independent review under live protection. Operational closure additionally requires a protected-main coordinator run that actually reaches the coordinator and emits its governed receipt.