fix(scheduler): scope Actions credentials by run host

[seonghobae]

Root cause

Central required-workflow inventory and force-cancellation were routed through the same cross-repository Actions credential used for target repositories. If the mutation App installation exhausted its independent API quota, the scheduler could not discover or cancel central current-head review runs even though the receiving workflow runner token had the required same-repository authority.

Historical owner PR #1231 contains this valid repair mixed with unrelated linter, SBOM, GPU, and mutation-credential changes on a branch 36 commits behind protected main. This successor extracts only the independently verifiable host-scoped Actions credential boundary; #1231 remains open for complete delta reconciliation.

RED → GREEN

• RED: 8cc62ce8837e456dfac4f592bcbd0786a77e4b81
  • permanent regression requires central discovery/cancellation to use the central runner token and target operations to retain the explicit cross-repository Actions token
• GREEN: 7bf3451a47768dbda903115a393b1da1d98e1dba
  • adds one repository-aware Actions command boundary
  • routes active-run inventory and force-cancellation through that boundary
  • compares central repository identity case-insensitively
  • updates CHANGELOG, APA-style doctoring, and docs/product-technical-gap-baseline.md

Authority and safety

• Base: protected main@c9052e607e5f3cc76e73207e7786b21500721b79
• Branch updates are normal fast-forwards; no force push or rebase
• No reviewer, status, ruleset, mutation, or cross-repository permission is weakened
• Missing target authority still fails closed at the GitHub API boundary
• Status remains Proposed until fresh exact-head GitHub Checks and independent review are terminal and clean

Summary by CodeRabbit

• 개선 사항

  • 워크플로 실행 조회 및 강제 취소가 실행을 호스팅하는 저장소의 자격 증명을 사용하도록 개선되었습니다.
  • 중앙 필수 워크플로 실행과 다른 저장소의 실행에 적절한 인증 방식이 적용됩니다.

• 문서

  • 자격 증명 라우팅 방식, 실패 시나리오 및 관련 결정 사항을 문서화했습니다.

• 테스트

  • 중앙 저장소와 대상 저장소별 인증 방식이 올바르게 적용되는지 검증하는 테스트를 추가했습니다.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 541ac2e4-e36f-4b54-992a-ee67dd5f0788

📥 Commits

Reviewing files that changed from the base of the PR and between 78a4937 and b18b7ca.

📒 Files selected for processing (5)

• CHANGELOG.md
• docs/doctoring/host-scoped-actions-inventory-credentials.md
• docs/product-technical-gap-baseline.md
• scripts/ci/pr_review_merge_scheduler_core.py
• tests/test_pr_review_merge_scheduler.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

스케줄러가 워크플로 실행을 호스팅하는 저장소에 따라 Actions 자격 증명을 선택합니다. 중앙 저장소의 실행 조회와 취소에는 dispatch 자격 증명을 사용하고, 대상 저장소에는 기존 Actions 자격 증명을 사용합니다. 테스트와 결정 기록을 추가했습니다.

Changes

Actions 자격 증명 라우팅

Layer / File(s)	Summary
저장소별 Actions 실행 경로 scripts/ci/pr_review_merge_scheduler_core.py	run_github_actions_for_repository가 중앙 저장소에는 dispatch 자격 증명을 사용하고, 다른 저장소에는 Actions 자격 증명을 사용합니다. 활성 실행 조회와 강제 취소가 이 경로를 사용합니다.
동작 검증 및 결정 기록 tests/test_pr_review_merge_scheduler.py, docs/doctoring/host-scoped-actions-inventory-credentials.md, docs/product-technical-gap-baseline.md, CHANGELOG.md	테스트가 중앙 및 대상 저장소의 자격 증명 선택을 검증합니다. 관련 결정과 변경 사항을 문서에 기록합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b18b7

The scheduler now scopes Actions credentials to the run-hosting repository, with central and target operations covered by updated tests. No actionable merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant Scheduler
  participant run_github_actions_for_repository
  participant GitHub_API
  Scheduler->>run_github_actions_for_repository: 워크플로 실행 조회 또는 취소 요청
  run_github_actions_for_repository->>GitHub_API: 중앙 저장소면 SCHEDULER_DISPATCH_TOKEN 사용
  run_github_actions_for_repository->>GitHub_API: 대상 저장소면 SCHEDULER_ACTIONS_TOKEN 사용
  GitHub_API-->>Scheduler: 실행 결과 반환

Loading

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 2 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 scheduler의 Actions credential을 실행 호스트 저장소 기준으로 분리하는 핵심 변경을 정확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 2 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/scheduler-central-actions-credential-routing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Baseline reproduction narrows #2005 failure ownership

Independent clean-detached reproduction was completed against parent stack head 14f7c85ca56be3297fa4d090d39d487d7be9bf14 in /tmp/cwl-2005-baseline.nThdOD (session 78451). No source mutation was made.

Command:

.venv/bin/python -m pytest tests/test_pr_review_merge_scheduler.py -q -k 'cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs or force_cancel_failure_logs_reason_and_does_not_raise or force_cancel_multiple_runs_reports_only_failures or workflow_starting_credentials_allow_head_mutations' --tb=short

Result: 4 failed, 330 deselected / 13.60s / terminal 1.

The same four failures already exist before #2005's target-Actions-inventory omission delta:

1. cancel_stale_opencode_runs_uses_bounded_executor_for_multiple_runs — cancellation mock list.append does not accept the new stdin= keyword.
2. force_cancel_failure_logs_reason_and_does_not_raise — fail_cancel fixture does not accept stdin=.
3. force_cancel_multiple_runs_reports_only_failures — maybe_fail fixture does not accept stdin=.
4. workflow_starting_credentials_allow_head_mutations — remains false under the parent credential-proof contract.

Therefore these four are parent-stack regressions, not caused by #2005's child-only inventory-suppression delta. This does not prove that the remaining 11 failures from #2005 hosted run 34082563712 / job 101620505562 have the same cause; those still require separate RCA.

Canonical repair request for #2002/#2003 owner lane:

• Preserve the production safety contract: repository-aware Actions calls must keep stdin forwarding and host-scoped credentials; do not weaken cancellation authority or fail-closed credential proof merely to satisfy fixtures.
• Repair cancellation mocks/fixtures to match the real callable signature where fixture drift is proven.
• Independently verify workflow_starting_credentials_allow_head_mutations against the intended fix(scheduler): prove workflow-starting mutation token #2003 present/distinct-token contract; if the production contract changed intentionally, update the test expectation/fixture only after proving semantic equivalence. If production behavior is wrong, fix the implementation instead.
• Re-run this exact 4-test baseline first, then the broader Runtime Quality review-repair suite, before claiming fix(scheduler): filter central review workflow authority #2005 exact-head failure resolved.

No force push, source change, close, or safety-gate weakening is requested.

[seonghobae]

Exact-head repair receipt — b18b7ca77ba6a8cb733a4661c00d1035408c5eec

• Non-force merge parent: protected main@78a4937c684a54ca8e415822c913742f41c6efc4 (includes fix(codeql): dispatch one current-head scan per pull request #2008/fix(codeql): accept queued pre-cutover scan-dispatch payloads #2009 CodeQL coordinator and pre-cutover payload compatibility).
• Runtime Quality RCA from prior exact head: three cancellation tests mocked run_github_actions(args), while the host-scoped wrapper correctly preserves the public stdin=None keyword contract.
• Repair: retain the production host-scoped credential boundary and update only those permanent test doubles to accept stdin.
• Current comparison: 4 ahead / 0 behind main; 5-file bounded delta; Draft/Proposed; mechanically mergeable; unresolved review threads 0.
• Fresh exact-head hosted workflows were created. Prior-head failures are not admission evidence for this head.

[seonghobae]

Exact-head source review for b18b7ca77ba6a8cb733a4661c00d1035408c5eec: no new substantive finding in the five-file delta.

The production change is bounded to one repository-aware Actions command boundary. It selects the central runner token only when the run-host repository case-insensitively matches the configured SCHEDULER_REQUIRED_WORKFLOW_REPOSITORY, which the protected caller sets to ContextualWisdomLab/.github; every other repository retains the explicit cross-repository Actions token. Both inventory and force-cancellation pass through the same selector, including stdin, and missing/invalid authority still fails in the existing command boundary.

The three parent-baseline failures caused by one-argument cancellation doubles are repaired by accepting the production callable's existing stdin=None keyword. The tests do not bypass the new host routing or weaken the production credential checks.

This is an independent source review, not approval or hosted GREEN. Current exact-head Runtime Quality, CodeQL, security, model review, and stack admission evidence remains required. Preserve the downstream non-force #2003→#2007 stack and do not transfer predecessor evidence if this head changes.

[seonghobae]

Fresh exact-head verification for b18b7ca77ba6a8cb733a4661c00d1035408c5eec: Agent Review Runtime Quality CI run 34178933394, job 101913838434, completed success. The scheduler/contextual-orchestrator repair contracts and consolidated workflow contract passed on this head, replacing the predecessor's 15-failure receipt. Other required workflows remain queued/cancelled-and-requeued, so the PR stays Draft/Proposed and no previous-head result is transferred.