[seonghobae]

Scope

Stage a fixed-caller, workflow_call-only self-hosted supplier for ContextualWisdomLab/noema reviewer-ci. Two additive source/test files; no consumer is activated.

Preserves the original exact PR-head checkout, Python 3.11, 100% line/branch and docstring gates, wheel/sdist/editable checks, authenticated/scanned image preparation and real no-network CodeGraph Docker smoke. Adds explicit Node setup, platform/tool preflight, a private virtual environment and per-job temporary/cache paths. No inherited secrets, privileged-pool or hosted fallback is introduced.

Verification

• 18 scoped supplier/runner-contract tests pass, including actual shell denial controls and owned-path cleanup controls.
• Original executable workload body hashes are retained in regression tests, except the deliberately changed private dependency installation.
• actionlint 1.7.12 workflow/expression checks pass. ShellCheck is unavailable, so this is not complete shell lint acceptance.
• Independent source review and an independent rerun of the 18 scoped tests completed. This is not formal current-head App approval.
• Final full local pytest run with complete Git history and a writable temporary HOME: 6533 passed, 10 skipped, 92 subtests passed, exit 0. Python 3.12, GITHUB_ACTIONS=true. This is local functional-suite evidence, not configured coverage/security acceptance or product runtime execution.
• Earlier 6529-pass/4-failure attempt lacked historical Git objects and writable HOME; all four reproduced on unchanged base. Fetching published history and using temporary HOME resolved them without changing tests or gates. Ten skips remain explicit, not counted as executed passes.
• Both published file bytes were read back at exact head dac6db9 and match the locally tested files.

Required activation gates

Draft/source preparation only. The existing noema Hosted caller remains unchanged. A protected immutable supplier revision and actual self-hosted product execution must precede caller adoption.

This supplier admits same-repository PRs and main pushes only. The old caller also covers forks. Before replacement, explicitly design and verify an isolated fork-validation path and required-check behavior; an unconditional skipped-success fork job is not an acceptable migration.

Job-local directories and cleanup are hygiene, not a security boundary: PR code sharing a guest can mutate environment/state. Activation requires independently verified single-job disposable guests without host mounts/sockets, ambient operational credentials or production-network reachability, plus external timeout and whole-guest teardown. The guest Docker daemon must belong solely to that disposable guest. Labels and this preflight do not prove these properties.

No runner registration, credential issuance, ACL/network changes, required-gate weakening, merge or live rollout is included.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}