ci(fast-mlsirm): carry license checks with merged gate pin

[seonghobae]

Scope

Carry forward the four source-bound wheel and sdist-consumer license selection/verification steps and the fail-closed helper preflight from #2628 onto current central main. Pin the release dependency gate to merged control-plane SHA e249236e3f420c4e9c470f26925640dae59f0d93.

This separate successor preserves #2628's original branch and source custody. The changed pathset is the same workflow and its execution-order contract test. The new delta from the verified #2628 merge tree is one callee pin line.

Verification

• The source merge of main e249236e and ci(fast-mlsirm): retain per-target release license verification #2628 head b21c936e was conflict-free.
• Seven focused workflow contract tests passed on the candidate.
• git diff --check passed.
• Raw actionlint identified only the two inherited if: ${{ false }} guards that intentionally keep unsupported release legs disabled; actionlint passed with only that diagnostic excluded.
• Private patch and local receipt: /Users/seonghobae/orca/reports/fmls-central-repair-20261010/central-2628-pin-proposal-20261014/receipt.json (SHA256 b9b696e2e10b4fb5f0fe317ee3b1d9960a2a2b646d852c5587570717cc467292).

Required evidence still open

This source change does not establish formal Noema/OpenCode App approval, current-head CodeQL/Strix/security checks, supported macOS/Windows/ARM self-hosted wheel capacity, license-rights clearance, twelve-wheel acceptance, or PyPI publication. The central release workflow still has a failing publication-disabled job and intentionally disabled wheel legs. Do not consume this pin in fast-mlsirm #2177 until an exact merged central SHA and the independent release gates are accepted. Pinning e249236e does not claim that the release gate executes the Noema reader; #2629's security repair has its own review/runtime evidence boundary.

Summary by CodeRabbit

• 안정성
  • PyPI 배포 시 라이선스 파일이 정상적으로 포함되었는지 확인합니다.
  • 필수 라이선스 파일이 없거나 검증에 실패하면 배포를 중단합니다.
• 테스트
  • 라이선스 파일 확인 및 휠 라이선스 검증 동작을 테스트합니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 096b064b-7033-4956-9791-021369279106

📥 Commits

Reviewing files that changed from the base of the PR and between e249236 and 0098f5a.

📒 Files selected for processing: 2

• .github/workflows/fast-mlsirm-publish-pypi.yml
• tests/test_fast_mlsirm_self_hosted_workflows.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

PyPI 릴리스 워크플로가 라이선스 helper 파일을 확인하고, 두 빌드 경로에서 선택한 라이선스 번들과 생성 휠의 라이선스 바이트를 검증합니다. 관련 테스트와 재사용 워크플로의 고정 커밋도 변경합니다.

Changes: PyPI 릴리스 라이선스 검증

Layer / File(s)	Summary
릴리스 사전 확인 .github/workflows/fast-mlsirm-publish-pypi.yml, tests/test_fast_mlsirm_self_hosted_workflows.py	릴리스 소스에서 두 라이선스 helper 파일이 일반 파일인지 확인합니다. helper 파일 누락 시 실패하고, 두 파일이 있으면 통과하는 테스트를 추가합니다. 재사용하는 dependency license/Strix gate의 고정 커밋을 변경합니다.
휠 라이선스 번들 검증 .github/workflows/fast-mlsirm-publish-pypi.yml, tests/test_fast_mlsirm_self_hosted_workflows.py	일반 소스와 검증된 sdist에서 휠 대상별 라이선스 번들을 선택합니다. 각 휠 빌드 뒤 라이선스 바이트를 검증합니다. 테스트에서 두 빌드 경로의 단계 존재 여부와 순서를 확인합니다.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 0098f

The change adds license verification steps and a pin update to the release workflow. No concrete merge-blocking defect was identified in the reviewed files.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		제목은 라이선스 검증 단계의 추가와 병합된 게이트 커밋 고정이라는 주요 변경 사항을 정확히 요약합니다.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cwl-noema-review]

Noema LLM review

The supplied changes correctly place target-specific license selection before both wheel builds and verification before subsequent artifact capture. The new preflight rejects missing helpers and direct helper symlinks. Static counterexample analysis found no blocking regression in this wiring; runtime behavior and the newly pinned dependency-gate implementation remain unverified.

Reviewed changed lines

• .github/workflows/fast-mlsirm-publish-pypi.yml:136 (RIGHT): The preflight checks each helper independently and exits unsuccessfully if either is not a regular file or is itself a symlink. The supplied context places this check after checkout of the selected release commit.
• .github/workflows/fast-mlsirm-publish-pypi.yml:564 (RIGHT): The primary wheel verifier receives dist, matching the preceding build's --out dist argument. It executes immediately after the build and before native-runner graph capture.
• .github/workflows/fast-mlsirm-publish-pypi.yml:705 (RIGHT): The consumer verifier explicitly runs from sdist-consumer/source and receives dist-consumer. Together with the consumer selection step, this avoids implicitly invoking the checkout's helpers for the sdist-consumer checks.
• .github/workflows/fast-mlsirm-publish-pypi.yml:1108 (RIGHT): The dependency-gate reference remains pinned to a full commit SHA. The implementation at the new SHA is not included, so its behavioral compatibility cannot be established from this reference change alone.
• tests/test_fast_mlsirm_self_hosted_workflows.py:80 (RIGHT): The added assertions require unique selector/verifier steps and enforce their ordering around both builds and subsequent capture steps. These are useful wiring checks, although exact-text assertions do not establish helper behavior.
• tests/test_fast_mlsirm_self_hosted_workflows.py:90 (RIGHT): The regression test extracts the actual workflow guard rather than duplicating its implementation, checks rejection of an empty release directory, and subsequently checks acceptance when both helper files exist. This test was inspected, not executed.

Adversarial validation

• .github/workflows/fast-mlsirm-publish-pypi.yml:136 (RIGHT) falsified: The preflight admits a release containing only one required helper, or a verifier that is a direct symlink to an existing regular file. — Static shell evaluation rejects the first case because ! -f is true for the missing verifier. It rejects the second because -L is true even when -f follows the symlink successfully. Both branches reach exit 1.
• .github/workflows/fast-mlsirm-publish-pypi.yml:564 (RIGHT) falsified: The primary wheel verifier is wired to a different output directory or runs after downstream graph capture. — The selector precedes Build wheel; that build specifies --out dist; the immediately following verifier receives dist and precedes Capture first native-runner build graph. The added verifier step has no conditional or continue-on-error override.
• .github/workflows/fast-mlsirm-publish-pypi.yml:704 (RIGHT) falsified: The new sdist-consumer checks implicitly execute the checkout's helper files rather than the helpers in the extracted consumer source. — Both consumer selection and consumer verification explicitly set working-directory to sdist-consumer/source and invoke relative tools paths. Selection precedes the consumer build, and verification precedes consumer wheel capture.
• Residual risk: Validation was static; no commands or tests were executed. The supplied context does not include the license-helper implementations or the newly pinned reusable workflow. Cross-platform helper execution, helper inclusion in the sdist, and dependency-gate contract compatibility therefore remain unverified.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 0098f5a4b4be280456a28817fa286eff84255d42
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]