fix(noema): validate stable OIDC exchange envelope - #834
Conversation
📝 WalkthroughWalkthroughNoema OIDC 교환 응답에 fail-closed 검증을 추가했습니다. 워크플로는 저장소에 바인딩된 ChangesNoema OIDC 응답 검증
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant NoemaOIDC
participant GitHubWorkflow
participant jq
NoemaOIDC->>GitHubWorkflow: OIDC 교환 응답 반환
GitHubWorkflow->>jq: 응답 envelope 및 저장소 메타데이터 검증
jq-->>GitHubWorkflow: 검증 결과와 data.token 반환
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the unchanged exact head |
|
|
|
@coderabbitai review Re-review only the unchanged exact head |
|
I will limit the review to the four-file Noema OIDC response-envelope repair. I will not use evidence from superseded PR
|
|
@coderabbitai review Re-review only unchanged exact head |
|
I will limit the review to the four-file Noema OIDC success-envelope repair. I will not use evidence from superseded PR ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@coderabbitai review @cwl-noema-review @opencode-agent Review only exact current head |
|
I will verify the specified OIDC envelope validation, token handling, diagnostic safety, and unchanged fallback and permission boundaries. I will not modify, merge, retarget, or alter credentials.
|
|
@opencode-agent review Evaluate exact current head |
|
Exact-current-head review request for Review the bounded four-file Noema OIDC consumer repair: accept only Keep the exact head unchanged. Do not transfer #822 evidence, synthesize author approval, accept the old top-level token shape, expose response/token data, alter credential fallbacks or reviewer identity, update the branch, merge, release, or bypass protection. After protected integration, operational acceptance still requires a real OIDC exchange proving the validated envelope reaches extraction without disclosure. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== revision verification =='
git rev-parse HEAD
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
git merge-base --is-ancestor "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
echo
echo '== bounded diff =='
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo
echo '== workflow outline =='
ast-grep outline .github/workflows/noema-review.yml --items all || true
echo
echo '== test outline =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all || true
echo
echo '== workflow references relevant to credentials, outputs, diagnostics, and OIDC =='
rg -n -i -C 8 \
'(oidc|noema|token|github_output|github app|app[_ -]?token|pat|permissions|reviewer|nvidia|model|curl|jq)' \
.github/workflows/noema-review.yml
echo
echo '== contract test source =='
cat -n tests/test_noema_oidc_exchange_contract.pyLength of output: 35934 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr_number='834'
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
echo '== response-contract references =='
rg -n -C 5 \
'(token_expires_at|workflow_ref|target_repository|response envelope|data\.token)' \
. \
-g '!docs/doctoring/noema-oidc-exchange-envelope.md' \
-g '!tests/test_noema_oidc_exchange_contract.py' \
-g '!CHANGELOG.md' \
-g '!**/.git/**' || true
echo
echo '== PR identity and exact-head state =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{number, state, draft, mergeable, merge_commit_sha, base_sha: .base.sha, head_sha: .head.sha, changed_files, review_comments, commits}'
echo
echo '== check runs attached to exact head =='
gh api --paginate "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url, head_sha}' || true
echo
echo '== statuses attached to exact head =='
gh api --paginate "repos/${repo}/commits/${head_sha}/status?per_page=100" \
--jq '.statuses[] | {context, state, target_url, updated_at}' || true
echo
echo '== unresolved PR review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } body path line } } }
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}' || trueLength of output: 63301
I verified exact head The OIDC consumer now requires The workflow masks GitHub reports this exact head as mergeable with zero unresolved review threads. The inspected security and supply-chain checks are associated with this head and have successful conclusions where applicable. I did not treat skipped or neutral jobs as passing evidence. The expiry field has presence and string-type validation. A real post-integration exchange is still required to verify the provider envelope, extraction path, and token non-disclosure in the GitHub Actions environment. 🧠 Learnings usedYou are interacting with an AI system. |
Live sole-collaborator canary for the OIDC response-envelope repairEmbedRelay PR #3 at exact head The supported non-author review path therefore depends on the installed Noema/OpenCode reviewer App chain. This makes the After this PR reaches protected central |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_sha='7e3c9e581f981bd2ceaa37c7b9bde16b452b899b'
base_sha='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
repo='ContextualWisdomLab/.github'
pr_number='834'
echo '== revision and scope =='
printf 'checked-out HEAD: '; git rev-parse HEAD
git cat-file -e "${head_sha}^{commit}"
git cat-file -e "${base_sha}^{commit}"
git merge-base --is-ancestor "$base_sha" "$head_sha"
git diff --name-status "$base_sha" "$head_sha"
git diff --no-ext-diff --unified=80 "$base_sha" "$head_sha" -- \
.github/workflows/noema-review.yml \
tests/test_noema_oidc_exchange_contract.py \
docs/doctoring/noema-oidc-exchange-envelope.md \
CHANGELOG.md
echo '== workflow relevant context =='
rg -n -i -C 12 \
'(oidc|noema|token_response|app_token|data\.token|github_output|github app|app[_ -]?token|pat|permissions|reviewer|nvidia|model|curl|jq)' \
.github/workflows/noema-review.yml
echo '== contract tests =='
ast-grep outline tests/test_noema_oidc_exchange_contract.py --items all
cat -n tests/test_noema_oidc_exchange_contract.py
echo '== reviewer edit boundary =='
if [ -f opencode.jsonc ]; then
rg -n -C 4 '"edit"\s*:\s*"(deny|allow)"' opencode.jsonc
else
echo 'opencode.jsonc is absent'
fi
echo '== exact-head PR state, check runs, and review threads =='
gh api "repos/${repo}/pulls/${pr_number}" \
--jq '{state, draft, mergeable, base_sha: .base.sha, head_sha: .head.sha, changed_files, review_comments}'
gh api --paginate "repos/${repo}/commits/${head_sha}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, head_sha}' || true
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr_number" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
comments(first: 1) { nodes { author { login } body path line } }
}
}
}
}
}' \
--jq '.data.repository.pullRequest | {
headRefOid,
unresolvedThreads: [
.reviewThreads.nodes[]
| select(.isResolved == false)
| {isOutdated, comment: .comments.nodes[0]}
]
}'Length of output: 44773
I verified exact head The OIDC exchange accepts only The workflow applies The GitHub App and PAT fallback order is unchanged. The reviewer/model routing, NVIDIA behavior, workflow permissions, and reviewer GitHub reports this exact head as mergeable. The current-head review threads are resolved. The inspected terminal-success checks belong to this exact head. I did not count skipped or neutral checks as passing evidence. A real post-integration OIDC exchange remains necessary to prove the provider response, extraction path, and token non-disclosure in GitHub Actions. This request invoked 🧠 Learnings usedYou are interacting with an AI system. |
|
Fresh policy RCA is tracked in #948. Protected |
|
@opencode-agent review Re-evaluate exact current head |
Pull request was converted to draft
|
Current owner-boundary checkpoint (freshly revalidated 2026-08-30 KST): existing The causal producer/consumer defect is still present in protected central truth: Preserve the repairs already present on #834 while converging: consume only validated Noema-side acceptance after protected central integration remains one real OIDC exchange using the then-current audited central workflow SHA, proving the |
|
@coderabbitai review Review only exact current head |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
4becf4275f274723e52c25eb6729950c587a7ba1. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Changed Path Quality CI/exact-head-path-policy: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33375305486/job/99435329128)
- exact-head-path-policy check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33375305486/job/99435329128)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: noema-oidc-exchange-envelope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: noema-oidc-exchange-envelope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_noema_oidc_exchange_contract.py (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_noema_oidc_exchange_contract.py (2 files)"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
4becf4275f274723e52c25eb6729950c587a7ba1. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Changed Path Quality CI/exact-head-path-policy: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33375305486/job/99435329128)
- exact-head-path-policy check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33375305486/job/99435329128)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: noema-review.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: noema-review.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Repository file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: noema-oidc-exchange-envelope.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: noema-oidc-exchange-envelope.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_noema_oidc_exchange_contract.py (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_noema_oidc_exchange_contract.py (2 files)"]
R4 --> V4["targeted test run"]
|
Fresh Noema downstream revalidation evidence (no foreign source mutation from the Noema writer): protected central |
|
Fresh exact-head evidence after non-force main convergence:
The new execution is non-passing. Of 34 exact-head check runs, only 4 succeeded; 18 were cancelled and 12 skipped. Security, SAST, CodeQL, Python Security, OSV, Secret, Scorecard, SBOM, Strix path-quality, Required OpenCode, Required Noema, close-empty, scheduler, and bootstrap evidence were all cancelled. There is no queued replacement currently bound to Predecessor |
Exact-state refresh after protected-main movementProtected Live comparison is now diverged / 22 behind / 1 ahead, and GitHub reports The protected-main workflow still consumes top-level |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Scheduled review-feedback autofix for this PR head.
|
|
Fresh Noema consumer canary / owner handoff (2026-09-03): protected This PR is currently Downstream acceptance remains: after protected integration, Noema must execute a real OIDC exchange canary bound to the then-current protected central workflow source and prove validated |
|
Fresh downstream Noema consumer revalidation against protected Current #834 authority is now |
Only CHANGELOG.md conflicted (both branches independently appended distinct Fixed bullets) -- kept both. noema-review.yml auto-merged cleanly with the data.token envelope fix intact and verified present in the merged file. Confirmed this fix is not superseded: main's current noema-review.yml still reads the nonexistent top-level `.token` from the OIDC exchange response (the bug this PR describes), so the repair remains genuinely needed. Verified post-merge: coverage run -m pytest tests -q (2778 passed, 1 skipped, 21 subtests), coverage report --fail-under=100 (100%), interrogate (100%). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Resolved the merge conflict against current `main` (previous CHANGES_REQUESTED was `mergeStateStatus: DIRTY` only). New head `50219fb2` merges cleanly — only `CHANGELOG.md` had a real content conflict (both branches independently appended distinct `### Fixed` bullets); kept both. `noema-review.yml` auto-merged cleanly and the `data.token` envelope fix is confirmed present and intact in the merged file. Confirmed this bug is not fixed some other way: main's current `noema-review.yml` still reads the nonexistent top-level `.token` from the OIDC exchange response, so this repair remains genuinely needed. Post-merge verification: `coverage run -m pytest tests -q` → 2778 passed, 1 skipped, 21 subtests; `coverage report --fail-under=100` → 100%; `interrogate` → 100%. 🤖 Generated with Claude Code |
1 participant
RCA
Protected
mainreads Noema's stable OIDC exchange response from a nonexistenttop-level
.token. Noema publishes the credential underdata.tokentogetherwith repository, workflow, expiry, and trace evidence, so the consumer
misdiagnoses a producer/consumer schema mismatch as a missing credential.
Current-main repair
ok: true, object-valueddata, and a non-empty visible-ASCIIdata.tokenwithout trimming or normalization;GITHUB_WORKFLOW_REF;data.token_expires_atwith zero to threefractional-second digits and a non-empty
trace_id;routing, permissions, and merge authority.
The effective diff is limited to the workflow, its executable regression
contract, APA 7 doctoring, one changelog entry, and removal of one unused
test-only import. The regression executes the production shell body and proves
valid acceptance plus fail-closed rejection of the old top-level token, wrong
repository/workflow, expired, offset, calendar-invalid, malformed, or
over-precision timestamps, missing trace evidence, and CR/LF/space/non-ASCII
token bytes.
Governance
This replaces the stale #822 implementation but inherits none of its checks,
reviews, or approvals. Merge remains prohibited until every required check is
terminal on the unchanged exact head, all valid threads are resolved, and a
qualifying independent current-head approval satisfies protected-branch policy.
Local green evidence and mergeability are not approval.
After protected integration, execute one real Noema exchange and confirm the
bound response reaches masked token export without exposing the credential.
Current exact-head evidence
Head:
ff25d7a67c3b82c0389b8eaa2f913f990a2940edBase:
7b1a028e704a98ae8a807bb827f44aeaee0399afAncestry: regular merge history,
0 behind / 22 ahead, five-file effective diff.Secret Scan, Scorecard, SBOM, Strix changed-path quality, Required OpenCode,
Required Noema, scheduler, close-empty, and bootstrap paths. Cancelled and
skipped evidence is non-passing.
main@7b1a028e704a98ae8a807bb827f44aeaee0399afstill reads thenonexistent top-level
.token, so this consumer repair remains required.Merge is nevertheless prohibited until fresh exact-head review, security,
provenance, and quality evidence is terminal-clean on one unchanged head.