Repository navigation
ci(fast-mlsirm): bind ndk-sys rights evidence to fixed release gate - #2647
Open
seonghobae wants to merge 3 commits into
Open
seonghobae wants to merge 3 commits into
seonghobae wants to merge 3 commits into
Conversation
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 36 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
marked this pull request as ready for review
October 13, 2026 22:09
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Noema LLM review
Approved. The ndk-sys rights evidence is bound to the exact archive, reviewed upstream commit, license-text hashes, and bundled notice digest, while the workflow updates preserve the fixed helper revision and tree-integrity checks. No concrete correctness, security, maintainability, or regression issue was found at the allowed changed-side locations.
Reviewed changed lines
scripts/ci/release_dependency_gate.py:2097 (RIGHT): The new ndk-sys record binds the exact crate archive digest, upstream repository and commit, combined notice digest, selected license, and per-license byte hashes. This prevents a different archive or substituted upstream grant from satisfying the reviewed entry..github/workflows/release-dependency-license-strix-gate.yml:187 (RIGHT): The materialized helper is advanced to a specific immutable commit while retaining the trusted repository and detached checkout model..github/workflows/release-dependency-license-strix-gate.yml:207 (RIGHT): The workflow verifies the helper commit, scripts/ci tree hash, dependency-hash file hash, and required files, preserving defense against mismatched or substituted helper contents..github/workflows/fast-mlsirm-publish-pypi.yml:1108 (RIGHT): The publication workflow calls the updated gate workflow at an immutable commit, so the new ndk-sys admission logic is actually used by this publishing path.
Adversarial validation
scripts/ci/release_dependency_gate.py:2097 (RIGHT)falsified: A modified or truncated ndk-sys upstream notice could still pass because the registry entry only identifies the license names. — The probe expects SOURCE_HASH_MISMATCH after the notice mutation, while the registry supplies exact per-license sizes and hashes plus the combined digest..github/workflows/release-dependency-license-strix-gate.yml:207 (RIGHT)falsified: Updating the helper revision could allow the workflow to execute a different scripts/ci tree or dependency set than the reviewed one. — The changed workflow updates all related expected values together and retains explicit equality and diff checks for the helper commit, scripts/ci tree, and requirements hash..github/workflows/fast-mlsirm-publish-pypi.yml:1108 (RIGHT)falsified: The publication path could continue using the old gate revision despite the helper changes. — The publication call is updated to immutable revision 165a37b, while the gate independently pins its helper to 51d356a.- Residual risk: The review is bounded to the supplied changed-side locations; runtime behavior still depends on the referenced immutable commits remaining available and on the existing gate implementation consuming the new registry record as intended.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
92fb5546790149c09010af64776604e3358ac975 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/fast-mlsirm-publish-pypi.yml— GitHub Actions review job.github/workflows/release-dependency-license-strix-gate.yml— GitHub Actions review jobscripts/ci/release_dependency_gate.py— review and security gate shell pathtests/fixtures/release_license_texts/ndk-sys-0.6.0+11769913-upstream-LICENSE-APACHE.txt— regression suitetests/fixtures/release_license_texts/ndk-sys-0.6.0+11769913-upstream-LICENSE-MIT.txt— regression suitetests/fixtures/release_license_texts/provenance.json— regression suitetests/fixtures/release_license_texts/texts.json— regression suitetests/test_release_dependency_gate.py— regression suitetests/test_release_dependency_gate_workflow_contract.py— regression suitetests/test_release_fixed_helper_identity.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fast-mlsirm-publish-pypi.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: fast-mlsirm-publish-pypi.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: release-dependency-license-strix-gate.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: release-dependency-license-strix-gate.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["CI script: release_dependency_gate.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: release_dependency_gate.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: ndk-sys-0.6.0+11769913-upstream-LICENSE-APACHE.txt (4 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: ndk-sys-0.6.0+11769913-upstream-LICENSE-APACHE.txt (4 files)"]
R4 --> V4["targeted test run"]
Evidence --> S5["Test: test_release_dependency_gate.py (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_release_dependency_gate.py (3 files)"]
R5 --> V5["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
92fb5546790149c09010af64776604e3358ac975 - Workflow run: 38475937259
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: fast-mlsirm-publish-pypi.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: fast-mlsirm-publish-pypi.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: release-dependency-license-strix-gate.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: release-dependency-license-strix-gate.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["CI script: release_dependency_gate.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: release_dependency_gate.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: ndk-sys-0.6.0+11769913-upstream-LICENSE-APACHE.txt (4 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: ndk-sys-0.6.0+11769913-upstream-LICENSE-APACHE.txt (4 files)"]
R4 --> V4["targeted test run"]
Evidence --> S5["Test: test_release_dependency_gate.py (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_release_dependency_gate.py (3 files)"]
R5 --> V5["targeted test run"]
Contributor
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Bind the locked
ndk-sys 0.6.0+11769913crate to complete MIT and Apache-2.0 grants from its recorded upstream commit. The crate archive has no license file; its.cargo_vcs_info.jsonnamesrust-mobile/ndkcommit49bbbba16c58ff63cb8a0ad0eca5a9fb7ecaec25and pathndk-sys. All 11 non-generated crate members match that upstream snapshot byte for byte. The exact archive SHA-256 isee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873.This branch has three ordered commits:
51d356af85f612730e5529936d7be4e307585c7fadds the exact reviewed source notice, provenance fixtures, and mutation test. Itsscripts/citree isf5edf7eb959973175c67cf0980174b3562a92508.165a37bde7ef596d26dbc38a6ed0ac64023fc043binds all three reusable gate helper checkouts and guards to commit 1, including the requirements blob.92fb5546790149c09010af64776604e3358ac975pins the fast-mlsirm publish caller's nested dependency gate to commit 2.The fast-mlsirm source selection and bundled notice are prepared separately at
/private/tmp/fmls-ndk-fast-20261014and are not part of this PR. Its release branch integration remains pending.Focused verification
git diff --checkpassed.Receipt:
/Users/seonghobae/orca/reports/fmls-central-repair-20261010/ndk-sys-central-three-stage-20261014.json(SHA-256df2af420708cfb15f4586774fea830e192ea8d914b20db4aeb9191fd85039528).Release boundary
The
ndk-sysHOLD remains until a committed fast-mlsirm successor source is admitted by the exact source-bound gate. Other Cargo, Python, and platform rights HOLDs remain. The workflow retainspublication-disabledand the unsupported wheel-leg stops. This PR does not establish formal App review, hosted checks, whole-workspace Rust 100% coverage, twelve-wheel evidence, or PyPI publication.