fix(ci): protect current review evidence from stale runs

.github/workflows/noema-review.yml

@@ -15,12 +15,12 @@ on:
     types: [noema-review]
 
 concurrency:
-  # Workflow-level admission is required: a queued run cannot reach a job-level
-  # cancellation guard while the organization is at its Actions job ceiling.
+  # Coalesce entire first-attempt runs; isolate old retries before admission.
   group: >-
     required-noema-review-${{
     github.event.pull_request.base.repo.full_name ||
     github.event.client_payload.target_repository || github.repository }}-${{
+    github.run_attempt > 1 && format('rerun-{0}', github.run_id) ||
     github.event.pull_request.number ||
     github.event.client_payload.pr_number || github.run_id }}
   cancel-in-progress: true

.github/workflows/opencode-review-dispatch.yml

@@ -30,6 +30,7 @@ concurrency:
   group: >-
     opencode-review-dispatch-${{
     github.event.client_payload.target_repository || github.repository }}-${{
+    github.run_attempt > 1 && format('rerun-{0}', github.run_id) ||
     github.event.client_payload.pr_number || github.run_id }}
   cancel-in-progress: true
 
@@ -668,7 +669,7 @@ jobs:
               changed_basename="${changed_path##*/}"
               case "$changed_basename" in
                 *.py|pyproject.toml|uv.lock|poetry.lock|Pipfile|Pipfile.lock|\
-                setup.py|setup.cfg|tox.ini|pytest.ini|.pytest.ini|\
+                setup.cfg|tox.ini|pytest.ini|.pytest.ini|\
                 requirements.lock|requirements*.txt|requirements*.in|\
                 environment.yml|environment.yaml)
                   python_coverage_required=1
@@ -984,9 +985,11 @@ jobs:
           }
 
           append_command() {
-            printf '$ ' >>"$summary_file"
-            printf '%q ' "$@" >>"$summary_file"
-            printf '\n' >>"$summary_file"
+            {
+              printf '$ '
+              printf '%q ' "$@"
+              printf '\n'
+            } >>"$summary_file"
           }
 
           emit_captured_log() {
@@ -1259,13 +1262,17 @@ jobs:
                       --command-json "$configured_command_json"
                 done <<<"$configured_commands_json"
             else
+              # Positional parameters expand in the child bash.
+              # shellcheck disable=SC2016
               run_and_capture "Python coverage with missing-line report (${project_dir})" \
                 bash -c 'cd "$1" && PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m coverage run -m pytest tests && python3 -m coverage report --show-missing' bash "$project_dir"
             fi
             done < <(tracked_python_projects_with_tests)
 
             if [ "$measured_projects" -eq 0 ]; then
               if has_tracked_files '*.py'; then
+                # Command substitution expands in the child bash.
+                # shellcheck disable=SC2016
                 run_and_capture "Python coverage with missing-line report" \
                   bash -c 'PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m coverage run -m pytest && python3 -m coverage report --show-missing'
               elif python3 -I -c 'import pytest_cov' >/dev/null 2>&1; then
@@ -1417,6 +1424,8 @@ jobs:
             while IFS= read -r project_dir; do
               if [ -f "${project_dir}/tests/test_docstrings.py" ]; then
                 measured_projects=1
+                # Positional parameters expand in the child bash.
+                # shellcheck disable=SC2016
                 run_and_capture "Python docstring coverage (${project_dir})" \
                   bash -c 'cd "$1" && PYTHONPATH="$([ -d src ] && printf src:. || printf .)" python3 -m pytest tests/test_docstrings.py' bash "$project_dir"
               fi
@@ -1786,20 +1795,26 @@ jobs:
                 if [ -n "$package_name" ] && jq -e '.workspaces // empty' package.json >/dev/null 2>&1; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" corepack npm run build --workspace "$package_name"
                 else
+                  # Positional parameters expand in the child bash.
+                  # shellcheck disable=SC2016
                   run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && corepack npm run build' bash "$package_dir"
                 fi
                 ;;
               pnpm)
                 if [ -n "$package_name" ] && [ -f pnpm-workspace.yaml ]; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" corepack pnpm --filter "$package_name" run build
                 else
+                  # Positional parameters expand in the child bash.
+                  # shellcheck disable=SC2016
                   run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && corepack pnpm run build' bash "$package_dir"
                 fi
                 ;;
               yarn)
                 if [ -n "$package_name" ] && jq -e '.workspaces // empty' package.json >/dev/null 2>&1; then
                   run_and_capture "Tauri frontendDist build (${package_dir})" yarn workspace "$package_name" build
                 else
+                  # Positional parameters expand in the child bash.
+                  # shellcheck disable=SC2016
                   run_and_capture "Tauri frontendDist build (${package_dir})" bash -c 'cd "$1" && yarn build' bash "$package_dir"
                 fi
                 ;;
@@ -1916,8 +1931,11 @@ jobs:
             # coverage command still runs and reports any uncovered GPU lines
             # exactly as before, so Rust repositories without GPU code are
             # unaffected and no gate is weakened.
-            if ls /usr/share/vulkan/icd.d/lvp_icd*.json >/dev/null 2>&1; then
-              lvp_icd="$(ls /usr/share/vulkan/icd.d/lvp_icd*.json | head -n1)"
+            local lvp_icd=""
+            while IFS= read -r lvp_icd; do
+              break
+            done < <(compgen -G '/usr/share/vulkan/icd.d/lvp_icd*.json')
+            if [ -n "$lvp_icd" ]; then
               export VK_ICD_FILENAMES="$lvp_icd"
               export VK_DRIVER_FILES="$lvp_icd"
               export WGPU_BACKEND=vulkan
@@ -2332,6 +2350,7 @@ jobs:
       group: >-
         opencode-review-${{
         needs.validate-pr-metadata.outputs.target_repository }}-${{
+        github.run_attempt > 1 && format('rerun-{0}', github.run_id) ||
         needs.validate-pr-metadata.outputs.pr_number || github.run_id }}
       cancel-in-progress: true
     runs-on: ubuntu-24.04
@@ -3087,12 +3106,20 @@ jobs:
               language_signal="Match changed prose"
             fi
 
+            # Markdown backticks in the single-quoted format are intentional literals.
+            # shellcheck disable=SC2016
             printf -- '- Preferred review language: `%s`\n' "$language_signal"
             printf -- '- Rule: write human-readable review prose in the preferred language; keep file paths, identifiers, logs, quoted source, error text, and protocol literals unchanged.\n'
+            # Markdown backticks in the single-quoted format are intentional literals.
+            # shellcheck disable=SC2016
             printf -- '- PR title: `%s`\n' "$(printf '%s' "$title" | tr '\r\n`' '   ' | cut -c 1-240)"
             if [ -n "$body" ]; then
+              # Markdown backticks in the single-quoted format are intentional literals.
+              # shellcheck disable=SC2016
               printf -- '- PR body excerpt: `%s`\n' "$(printf '%s' "$body" | tr '\r\n`' '   ' | cut -c 1-360)"
             else
+              # Markdown backticks in the single-quoted format are intentional literals.
+              # shellcheck disable=SC2016
               printf -- '- PR body excerpt: `[empty]`\n'
             fi
           }
@@ -3372,6 +3399,8 @@ jobs:
             shift
 
             if ! git -C "$OPENCODE_SOURCE_WORKDIR" diff "$@"; then
+              # Markdown backticks in the single-quoted format are intentional literals.
+              # shellcheck disable=SC2016
               printf 'Unable to collect %s from `%s` to `%s`; continue review from available changed-file evidence and direct file inspection.\n' "$description" "$PR_MERGE_BASE" "$PR_HEAD_SHA"
             fi
           }
@@ -3382,12 +3411,16 @@ jobs:
             printf -- "- Base SHA: \`%s\`\n" "$PR_BASE_SHA"
             printf -- "- Head SHA: \`%s\`\n\n" "$PR_HEAD_SHA"
             if ! PR_MERGE_BASE="$(git -C "$OPENCODE_SOURCE_WORKDIR" merge-base "$PR_BASE_SHA" "$PR_HEAD_SHA")"; then
+              # Markdown backticks in the single-quoted format are intentional literals.
+              # shellcheck disable=SC2016
               printf 'Merge-base discovery failed for `%s` and `%s`; falling back to base SHA for bounded diff evidence.\n\n' "$PR_BASE_SHA" "$PR_HEAD_SHA"
               PR_MERGE_BASE="$PR_BASE_SHA"
             fi
             printf -- "- Merge base SHA: \`%s\`\n\n" "$PR_MERGE_BASE"
             printf '## Current-head authority order\n\n'
             printf 'Treat current-head sections in this file as authoritative for this run: Other unresolved review thread evidence, Failed GitHub Check evidence, Coverage execution evidence, Changed files, and Focused changed hunks.\n'
+            # Markdown backticks in the single-quoted format are intentional literals.
+            # shellcheck disable=SC2016
             printf 'All PR reviews and comments evidence is historical context only and may contain stale bot conclusions. Do not infer active failed checks, unresolved threads, or missing changed files from those comments unless current-head evidence corroborates the same claim for Head SHA `%s`.\n\n' "$PR_HEAD_SHA"
             if ! git -C "$OPENCODE_SOURCE_WORKDIR" diff --name-only --find-renames "$PR_MERGE_BASE" "$PR_HEAD_SHA" |
               awk 'NF > 0 && $0 !~ /^\// && $0 !~ /(^|\/)\.\.($|\/)/ { print }' >"$OPENCODE_CHANGED_FILES_FILE"; then
@@ -4399,6 +4432,8 @@ jobs:
               "$@"
           }
 
+          # This is a jq program, not shell expansion.
+          # shellcheck disable=SC2016
           self_check_filter='
             def self_check:
               (.name // "") as $n
@@ -5066,6 +5101,8 @@ jobs:
             if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
               {
                 printf '## OpenCode %s review body\n\n' "$event"
+                # Markdown backticks in the single-quoted format are intentional literals.
+                # shellcheck disable=SC2016
                 printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
                 printf -- '- Workflow run: %s\n' "$RUN_ID"
                 printf -- '- Workflow attempt: %s\n\n' "$RUN_ATTEMPT"
@@ -5420,6 +5457,8 @@ jobs:
               printf '## Summary\n\n'
               printf '%s\n\n' "$summary"
               printf '## Adversarial validation\n\n'
+              # Markdown backticks in the single-quoted format are intentional literals.
+              # shellcheck disable=SC2016
               printf '```json\n%s\n```\n\n' "$adversarial_evidence"
               printf -- '- Result: REQUEST_CHANGES\n'
               printf -- '- Reason: %s\n\n' "$reason"
@@ -6235,6 +6274,8 @@ jobs:
 
             case "$mode" in
               failed)
+                # This is a jq program, not shell expansion.
+                # shellcheck disable=SC2016
                 jq_filter='
                   [.[].check_runs[]?]
                   | sort_by((.started_at // .completed_at // .created_at // ""), (.id // 0))
@@ -6251,6 +6292,8 @@ jobs:
                 '
                 ;;
               pending)
+                # This is a jq program, not shell expansion.
+                # shellcheck disable=SC2016
                 jq_filter='
                   [.[].check_runs[]?]
                   | sort_by((.started_at // .completed_at // .created_at // ""), (.id // 0))
@@ -6315,6 +6358,8 @@ jobs:
             local owner="${GH_REPOSITORY%%/*}"
             local name="${GH_REPOSITORY#*/}"
 
+            # GraphQL variables expand on the server, not in this shell.
+            # shellcheck disable=SC2016
             timeout "$(check_lookup_api_timeout_seconds)s" gh api graphql \
               -f owner="$owner" \
               -f name="$name" \
@@ -6468,6 +6513,8 @@ jobs:
             commit_check_runs_file="$(mktemp)"
             filtered_rollup_file="$(mktemp)"
             successful_check_names_file="$(mktemp)"
+            # GraphQL variables expand on the server, not in this shell.
+            # shellcheck disable=SC2016
             if ! pr_node_id="$(timeout "$(check_lookup_api_timeout_seconds)s" gh api graphql \
               -f owner="$owner" \
               -f name="$name" \
@@ -6911,6 +6958,8 @@ jobs:
             head_ref="$(printf '%s\n' "$pr_json" | jq -r '.headRefName // empty')"
             [ -n "$head_ref" ] || return 1
             lookup_error_file="$(mktemp)"
+            # This is a jq program, not shell expansion.
+            # shellcheck disable=SC2016
             if ! GH_TOKEN="$scan_token" timeout "$(check_lookup_api_timeout_seconds)s" \
               gh api -X GET "repos/${GH_REPOSITORY}/code-scanning/alerts" \
                 -f "ref=refs/heads/${head_ref}" \
@@ -6978,6 +7027,8 @@ jobs:
                 printf 'OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.\n\n'
                 printf '## Findings\n\n'
                 printf '### 1. HIGH Current-head GitHub Checks - Fix failed required checks before approval\n'
+                # Markdown backticks in the single-quoted format are intentional literals.
+                # shellcheck disable=SC2016
                 printf -- '- Problem: Failed same-head checks remain for `%s`.\n' "$HEAD_SHA"
                 printf -- '- Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.\n'
                 printf -- '- Fix: Read and fix the failed check logs below, then rerun the current-head checks.\n'
@@ -7034,10 +7085,16 @@ jobs:
               if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
                 {
                   printf '## OpenCode required check satisfied by existing same-head approval\n\n'
+                  # Markdown backticks in the single-quoted format are intentional literals.
+                  # shellcheck disable=SC2016
                   printf -- '- Result: `EXISTING_CURRENT_HEAD_APPROVAL`\n'
+                  # Markdown backticks in the single-quoted format are intentional literals.
+                  # shellcheck disable=SC2016
                   printf -- '- Head SHA: `%s`\n' "$HEAD_SHA"
                   printf -- '- Workflow run: %s\n' "$RUN_ID"
                   printf -- '- Workflow attempt: %s\n' "$RUN_ATTEMPT"
+                  # Markdown backticks in the single-quoted format are intentional literals.
+                  # shellcheck disable=SC2016
                   printf -- '- Model-pool outcome: `%s`\n' "${OPENCODE_MODEL_POOL_OUTCOME:-unknown}"
                   printf -- '- Reason: a prior real-model OpenCode APPROVED review with passed structured adversarial probes already targets this exact head, and the fallback rechecked coverage, peer checks, code-scanning alerts, and unresolved review threads before accepting it.\n'
                   printf -- '- Review state: unchanged; no duplicate APPROVE review was posted from model-output-unavailable evidence.\n\n'