test(supply-chain): rebase Maven checksum RED on live develop - #281
Closed
seonghobae wants to merge 14 commits into
Closed
test(supply-chain): rebase Maven checksum RED on live develop#281seonghobae wants to merge 14 commits into
seonghobae wants to merge 14 commits into
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughMaven Wrapper에 Maven 3.9.11 배포 아카이브의 SHA-256 체크섬을 추가했습니다. 검증 도구가 고정된 Wrapper 설정을 확인합니다. CI와 SBOM 워크플로는 Maven 실행 전에 검증합니다. 회귀 테스트가 설정과 워크플로 순서를 검사합니다. ChangesMaven Wrapper 무결성
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI 또는 SBOM 워크플로
participant VerifyMavenWrapperIntegrity
participant Maven Wrapper 설정
participant Maven Wrapper 실행
CI 또는 SBOM 워크플로->>VerifyMavenWrapperIntegrity: 무결성 검증 실행
VerifyMavenWrapperIntegrity->>Maven Wrapper 설정: 고정 URL, 버전, 유형, 체크섬 읽기
Maven Wrapper 설정-->>VerifyMavenWrapperIntegrity: properties 값 반환
VerifyMavenWrapperIntegrity-->>CI 또는 SBOM 워크플로: 검증 성공 또는 예외
CI 또는 SBOM 워크플로->>Maven Wrapper 실행: 테스트 또는 SBOM 생성 실행
Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Aug 11, 2026
seonghobae
marked this pull request as ready for review
August 11, 2026 17:11
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@etl-service/src/test/java/com/xtrmetl/etl/documentation/MavenWrapperIntegrityTest.java`:
- Around line 17-23: Add preflight validation before every Unix and Windows
Maven Wrapper invocation in the CI and SBOM workflows, ensuring the configured
distributionUrl and distributionSha256Sum are present and match the reviewed
fixed values. Make these checks run before the wrapper can bootstrap Maven,
including paths using -DskipTests, while retaining MavenWrapperIntegrityTest as
post-run regression coverage.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 02465730-e0ce-4d53-8001-4de909bee140
📒 Files selected for processing (2)
.mvn/wrapper/maven-wrapper.propertiesetl-service/src/test/java/com/xtrmetl/etl/documentation/MavenWrapperIntegrityTest.java
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@etl-service/src/test/java/com/xtrmetl/etl/documentation/MavenWrapperIntegrityTest.java`:
- Around line 138-140: Update containsWrapperInvocation to match the Windows
wrapper invocation with a single runtime backslash, so it detects .\mvnw.cmd
calls alongside ./mvnw calls. Then run ./mvnw -B test to verify the change.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8f916d89-f37c-462f-8010-ed68517100f6
📒 Files selected for processing (4)
.github/scripts/VerifyMavenWrapperIntegrity.java.github/workflows/ci.yml.github/workflows/sbom.ymletl-service/src/test/java/com/xtrmetl/etl/documentation/MavenWrapperIntegrityTest.java
seonghobae
marked this pull request as draft
August 11, 2026 20:14
seonghobae
marked this pull request as ready for review
August 11, 2026 22:13
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
2664071fd94d18edc3181da1159a2065b24e2d23. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/mightyETL/actions/runs/31647227721/job/94283519838)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/mightyETL/actions/runs/31647227721/job/94283519838)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Workflow (2 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow (2 files)"]
R2 --> V2["actionlint plus required checks"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Workflow (2 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow (2 files)"]
R2 --> V2["actionlint plus required checks"]
|
Collaborator
Author
|
Superseded by current-base replacement #311; closing this stale evidence lane without transferring its checks/reviews. Fresh preservation proof: #281 is at |
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
2664071fd94d18edc3181da1159a2065b24e2d23. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/mightyETL/actions/runs/31647227721/job/94283519838)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/mightyETL/actions/runs/31647227721/job/94283519838)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (3 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (3 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Workflow (2 files)"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow (2 files)"]
R2 --> V2["actionlint plus required checks"]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes stale-base PR #266 for issue #265 without rewriting its evidence.
This replacement starts from exact protected
develop@106add38465937f6eb4e4accc185fd30aab4446f. Current exact test-only head39fecd992e22cfa125af2d7af0510b9fd78dd85fadds onlyMavenWrapperIntegrityTest; protected.mvn/wrapper/maven-wrapper.propertiesstill lacksdistributionSha256Sum, so the intended RED is the focused checksum assertion after normal build/test startup.Preserved contract from #266: Maven Wrapper 3.3.4,
only-script, Maven 3.9.11 Central URL, reviewed SHA-2560d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb. No old-head/base checks or reviews transfer. Keep Draft through valid current-base RED. After RED, the narrow GREEN may add onlydistributionSha256Sumto the wrapper properties, followed by fresh exact-head validation. Shared exact-source, non-vacuous coverage, scanner-completeness, and independent-review gates remain separate.Summary by CodeRabbit
보안 강화
테스트