From 890bac2f69ff1a51f774ddf5d6c5d819afed4ac9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:15:30 +0900 Subject: [PATCH 1/2] test(ci): reproduce missing stacked Python and runtime checks --- tests/test_stacked_pr_security_workflow_contract.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/test_stacked_pr_security_workflow_contract.py b/tests/test_stacked_pr_security_workflow_contract.py index 9ee655381b..fca43d40a6 100644 --- a/tests/test_stacked_pr_security_workflow_contract.py +++ b/tests/test_stacked_pr_security_workflow_contract.py @@ -8,7 +8,12 @@ def test_security_workflows_run_for_stacked_pull_requests() -> None: """Required PR security workflows must not filter out feature bases.""" - for workflow_name in ("security-scan.yml", "sast-semgrep.yml"): + for workflow_name in ( + "security-scan.yml", + "sast-semgrep.yml", + "python-security.yml", + "agent-review-runtime-quality-ci.yml", + ): workflow = (REPO_ROOT / ".github" / "workflows" / workflow_name).read_text( encoding="utf-8" ) From 14f7c85ca56be3297fa4d090d39d487d7be9bf14 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 13:16:05 +0900 Subject: [PATCH 2/2] fix(ci): cover stacked Python and runtime reviews --- .../agent-review-runtime-quality-ci.yml | 2 +- .github/workflows/python-security.yml | 2 +- CHANGELOG.md | 5 +++ .../stacked-python-runtime-review-coverage.md | 36 +++++++++++++++++++ docs/product-technical-gap-baseline.md | 15 ++++++++ 5 files changed, 58 insertions(+), 2 deletions(-) create mode 100644 docs/doctoring/stacked-python-runtime-review-coverage.md diff --git a/.github/workflows/agent-review-runtime-quality-ci.yml b/.github/workflows/agent-review-runtime-quality-ci.yml index 3680da8778..4c0636aca3 100644 --- a/.github/workflows/agent-review-runtime-quality-ci.yml +++ b/.github/workflows/agent-review-runtime-quality-ci.yml @@ -2,7 +2,7 @@ name: Agent Review Runtime Quality CI on: pull_request: - branches: [main] + # Scan every PR base ref, including stacked feature branches. paths: - ".github/workflows/agent-review-runtime-quality-ci.yml" - ".github/workflows/noema-review.yml" diff --git a/.github/workflows/python-security.yml b/.github/workflows/python-security.yml index 8453895027..4ac7f33b48 100644 --- a/.github/workflows/python-security.yml +++ b/.github/workflows/python-security.yml @@ -24,8 +24,8 @@ name: Python Security on: pull_request: + # Scan every PR base ref, including stacked feature branches. types: [opened, synchronize, reopened, ready_for_review, closed] - branches: [main, master, develop] push: branches: [main, master, develop] # Periodic full-repo coverage so non-PR drift is caught (the removed local diff --git a/CHANGELOG.md b/CHANGELOG.md index f847f979b4..df6ee0c9b9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -162,6 +162,11 @@ ## Proposed +- Run Python Security and Agent Review Runtime Quality CI for stacked pull + requests by removing their pull-request base-branch filters. Extend the + permanent stacked-workflow contract so all four owner review workflows + continue covering feature-branch bases. + - Prove that the scheduler's selected head-mutation credential is present and distinct from the workflow `github.token`, even when its declared source is allowlisted. Missing comparison evidence and same-token fallback now fail diff --git a/docs/doctoring/stacked-python-runtime-review-coverage.md b/docs/doctoring/stacked-python-runtime-review-coverage.md new file mode 100644 index 0000000000..3e32484549 --- /dev/null +++ b/docs/doctoring/stacked-python-runtime-review-coverage.md @@ -0,0 +1,36 @@ +# Stacked Python and runtime review coverage + +Decision date: **2026-09-07** + +## Incident + +A pull request targeting the feature branch for `ContextualWisdomLab/.github#2002` +created Security Scan, SAST Semgrep, and CodeQL PR runs, but no Python Security +or Agent Review Runtime Quality CI run. Both missing workflows restricted the +`pull_request` base branch, while the existing stacked-PR regression covered +only Security Scan and SAST Semgrep. + +## Decision + +All four owner review workflows run for every pull-request base ref. Python +Security retains its event-type filter and Runtime Quality retains its path +filter; only the base-branch filters are removed. Push and schedule behavior is +unchanged. The single permanent contract enumerates all four workflow files. + +## Failure scenes + +- A dependent PR targets a feature branch and edits scheduler Python: Python + Security and Runtime Quality must both be created. +- A PR does not touch Runtime Quality paths: its existing path filter still + prevents irrelevant work. +- Closing a Python PR: the existing event/action guards continue to apply. + +## Evidence and follow-up + +RED commit: `890bac2f69ff1a51f774ddf5d6c5d819afed4ac9`. +Fresh exact-head hosted runs and independent review remain required. + +## Reference + +GitHub. (2026). *Workflow syntax for GitHub Actions: on.pull_request.branches*. +https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e7565cb305..1cae019f9a 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -3386,3 +3386,18 @@ same name in another file can carry the opposite safety property.** - **Evidence:** RED commit `ebcc6715e68d6bd4dc78f1ce6c3e473a2dfef899`; fresh exact-head hosted checks remain required before integration. + + +### Stacked Python and runtime review coverage + +- **Status:** Proposed +- **Owner:** `ContextualWisdomLab/.github` +- **Problem:** Python Security and Agent Review Runtime Quality CI filtered + `pull_request` events to default-like base branches, so a valid stacked PR + received Security/SAST/CodeQL but silently missed two owner checks. +- **Action:** Remove only the pull-request base filters and extend the existing + stacked-PR workflow regression to all four review workflows. +- **Evidence:** `ContextualWisdomLab/.github#2003` generated only three hosted + workflows at exact head `e2204eeb1ec2789ff791036140ba1672995d25f5`; + RED commit `890bac2f69ff1a51f774ddf5d6c5d819afed4ac9`; fresh exact-head + hosted checks remain required.