Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion scripts/ci/pr_review_merge_scheduler.py
Original file line number Diff line number Diff line change
Expand Up @@ -3097,9 +3097,18 @@ def dispatch_opencode_review(repo: str, workflow: str, pr: dict[str, Any], *, dr
return "dispatched"


def is_strix_scan_check_run(node: dict[str, Any]) -> bool:
"""Return whether a check run is the authoritative Strix scan job."""
return (
node.get("__typename") == "CheckRun"
and node.get("name") == "strix"
and is_strix_context(node)
)
Comment on lines +3100 to +3106

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: Trusted identity remains enforced

is_strix_scan_check_run requires both the authoritative job name and trusted workflow identity. Unrelated same-named checks cannot become rerun targets.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.



def dispatch_strix_evidence(repo: str, workflow: str, pr: dict[str, Any], *, dry_run: bool) -> str:
"""Dispatch same-head Strix workflow evidence before OpenCode reviews."""
job_id = matching_actions_job_id(pr, is_strix_context)
job_id = matching_actions_job_id(pr, is_strix_scan_check_run)
if job_id:
rerun_actions_job(repo, job_id, dry_run=dry_run, action="rerun-strix-evidence")
return "rerun" if not dry_run else "dry_run"
Expand Down
57 changes: 57 additions & 0 deletions tests/test_strix_rerun_job_selection.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
"""Regression coverage for exact-head Strix rerun job selection."""

from scripts.ci import pr_review_merge_scheduler as sched


def _strix_job(name: str, job_id: int, conclusion: str) -> dict:
"""Build one exact-head job from the trusted Strix workflow."""
return {
"__typename": "CheckRun",
"name": name,
"status": "COMPLETED",
"conclusion": conclusion,
"startedAt": "2026-08-30T05:24:23Z",
"detailsUrl": f"https://github.com/ContextualWisdomLab/bandscope/actions/runs/33294403831/job/{job_id}",
"checkSuite": {
"createdAt": "2026-08-30T05:22:18Z",
"workflowRun": {"workflow": {"name": "Strix Security Scan"}},
},
}


def test_dispatch_strix_reruns_scan_job_not_sibling_publisher(monkeypatch) -> None:
"""A skipped status-publisher sibling must never be selected as the Strix rerun target."""
pr = {
"number": 1055,
"statusCheckRollup": {
"contexts": {
"nodes": [
_strix_job("strix", 99212031836, "FAILURE"),
_strix_job("publish-manual-pr-evidence-status", 99212677006, "SKIPPED"),
]
}
},
}
reruns: list[tuple[str, str, str]] = []

def record_rerun(repo: str, job_id: str, *, dry_run: bool, action: str) -> None:
reruns.append((repo, job_id, action))

monkeypatch.setattr(sched, "rerun_actions_job", record_rerun)

assert (
sched.dispatch_strix_evidence(
"ContextualWisdomLab/bandscope",
"Strix Security Scan",
pr,
dry_run=False,
)
== "rerun"
)
assert reruns == [
(
"ContextualWisdomLab/bandscope",
"99212031836",
"rerun-strix-evidence",
)
]
Loading